9.1.8

* Remove double semicolons

* fix formatting

* fix formatting 2

.github/workflows/test-integration-pg.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   test:
     name: Test on PHP ${{ matrix.php-versions }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       TEST_DATABASE_HOST: '127.0.0.1'
       TEST_DATABASE_PLATFORM: 'Postgresql'

.github/workflows/test-integration.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   test:
     name: Test on PHP ${{ matrix.php-versions }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       TEST_DATABASE_HOST: '127.0.0.1'
       TEST_DATABASE_PORT: '8888'

.github/workflows/test.yml

@@ -23,7 +23,7 @@ on:
 jobs:
   test:
     name: Test on PHP ${{ matrix.php-versions }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         php-versions: ['8.2', '8.3', '8.4']

.idea/jsonSchemas.xml

@@ -341,6 +341,25 @@
             </SchemaInfo>
           </value>
         </entry>
+        <entry key="metadata/app/clientIcons">
+          <value>
+            <SchemaInfo>
+              <option name="generatedName" value="New Schema" />
+              <option name="name" value="metadata/app/clientIcons" />
+              <option name="relativePathToSchema" value="schema/metadata/app/clientIcons.json" />
+              <option name="schemaVersion" value="JSON Schema version 7" />
+              <option name="patterns">
+                <list>
+                  <Item>
+                    <option name="pattern" value="true" />
+                    <option name="path" value="*/Resources/metadata/app/clientIcons.json" />
+                    <option name="mappingKind" value="Pattern" />
+                  </Item>
+                </list>
+              </option>
+            </SchemaInfo>
+          </value>
+        </entry>
         <entry key="metadata/app/clientRecord">
           <value>
             <SchemaInfo>
@@ -1386,6 +1405,25 @@
             </SchemaInfo>
           </value>
         </entry>
+        <entry key="metadata/logicDefs">
+          <value>
+            <SchemaInfo>
+              <option name="generatedName" value="New Schema" />
+              <option name="name" value="metadata/logicDefs" />
+              <option name="relativePathToSchema" value="schema/metadata/logicDefs.json" />
+              <option name="schemaVersion" value="JSON Schema version 7" />
+              <option name="patterns">
+                <list>
+                  <Item>
+                    <option name="pattern" value="true" />
+                    <option name="path" value="*/metadata/logicDefs/*.json" />
+                    <option name="mappingKind" value="Pattern" />
+                  </Item>
+                </list>
+              </option>
+            </SchemaInfo>
+          </value>
+        </entry>
         <entry key="metadata/notificationDefs">
           <value>
             <SchemaInfo>

.vscode/settings.json

@@ -82,6 +82,12 @@
             ],
             "url": "./schema/metadata/integrations.json"
         },
+        {
+            "fileMatch": [
+                "*/metadata/logicDefs/*.json"
+            ],
+            "url": "./schema/metadata/logicDefs.json"
+        },
         {
             "fileMatch": [
                 "*/metadata/notificationDefs/*.json"
@@ -184,6 +190,12 @@
             ],
             "url": "./schema/metadata/app/client.json"
         },
+        {
+            "fileMatch": [
+                "*/Resources/metadata/app/clientIcons.json"
+            ],
+            "url": "./schema/metadata/app/clientIcons.json"
+        },
         {
             "fileMatch": [
                 "*/Resources/metadata/app/clientRecord.json"

Gruntfile.js

@@ -184,8 +184,12 @@ module.exports = grunt => {
                     comments: /^!/,
                 },
                 beautify: false,
-                mangle: true,
-                compress: true
+                compress: {
+                    sequences: false,
+                    collapse_vars: false,
+                    keep_fargs: true,
+                    webkit: true,
+                },
             },
             bundle: {
                 options: {

application/Espo/Binding.php

@@ -232,6 +232,16 @@ class Binding implements BindingProcessor
             'Espo\\Tools\\Stream\\Service',
             'streamService'
         );
+
+        $binder->bindService(
+            'Espo\\Core\\Utils\\Config\\SystemConfig',
+            'systemConfig'
+        );
+
+        $binder->bindService(
+            'Espo\\Core\\Utils\\Config\\ApplicationConfig',
+            'applicationConfig'
+        );
     }
 
     private function bindCore(Binder $binder): void

application/Espo/Classes/Acl/User/AccessChecker.php

@@ -46,14 +46,10 @@ class AccessChecker implements AccessEntityCREDSChecker
 {
     use DefaultAccessCheckerDependency;
 
-    private DefaultAccessChecker $defaultAccessChecker;
-    private AclManager $aclManager;
-
-    public function __construct(DefaultAccessChecker $defaultAccessChecker, AclManager $aclManager)
-    {
-        $this->defaultAccessChecker = $defaultAccessChecker;
-        $this->aclManager = $aclManager;
-    }
+    public function __construct(
+        private DefaultAccessChecker $defaultAccessChecker,
+        private AclManager $aclManager,
+    ) {}
 
     public function checkEntityCreate(User $user, Entity $entity, ScopeData $data): bool
     {
@@ -70,6 +66,10 @@ class AccessChecker implements AccessEntityCREDSChecker
 
     public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
     {
+        if (!$user->isAdmin() && !$entity->isActive()) {
+            return false;
+        }
+
         if ($entity->isPortal()) {
             if ($this->aclManager->getPermissionLevel($user, Permission::PORTAL) === Table::LEVEL_YES) {
                 return true;

application/Espo/Classes/AclPortal/Email/AccessChecker.php

@@ -68,9 +68,9 @@ class AccessChecker implements AccessEntityCREDSChecker
 
         assert($entity instanceof CoreEntity);
 
-        $userIdList = $entity->getLinkMultipleIdLIst('users');
+        $userIdList = $entity->getLinkMultipleIdList('users');
 
-        if (is_array($userIdList) && in_array($user->getId(), $userIdList)) {
+        if (in_array($user->getId(), $userIdList)) {
             return true;
         }
 

application/Espo/Classes/Cleanup/AppLog.php

@@ -47,6 +47,10 @@ class AppLog implements Cleanup
 
     public function process(): void
     {
+        if (!$this->config->get('cleanupAppLog')) {
+            return;
+        }
+
         $query = DeleteBuilder::create()
             ->from(AppLogRecord::ENTITY_TYPE)
             ->where(['createdAt<' => $this->getBefore()->toString()])

application/Espo/Classes/Cleanup/WebhookQueue.php

@@ -31,42 +31,40 @@ namespace Espo\Classes\Cleanup;
 
 use Espo\Core\Cleanup\Cleanup;
 use Espo\Core\Utils\Config;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+use Espo\Entities\WebhookEventQueueItem;
+use Espo\Entities\WebhookQueueItem;
 use Espo\ORM\EntityManager;
-
 use DateTime;
+use Espo\ORM\Name\Attribute;
 
+/**
+ * @noinspection PhpUnused
+ */
 class WebhookQueue implements Cleanup
 {
     private string $cleanupWebhookQueuePeriod = '10 days';
 
-    private $config;
-
-    private $entityManager;
-
-    public function __construct(Config $config, EntityManager $entityManager)
-    {
-        $this->config = $config;
-        $this->entityManager = $entityManager;
-    }
+    public function __construct(private Config $config, private EntityManager $entityManager)
+    {}
 
     public function process(): void
     {
         $period = '-' . $this->config->get('cleanupWebhookQueuePeriod', $this->cleanupWebhookQueuePeriod);
 
         $datetime = new DateTime();
-
         $datetime->modify($period);
-        $from = $datetime->format('Y-m-d H:i:s');
+        $from = $datetime->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
 
         $query1 = $this->entityManager
             ->getQueryBuilder()
             ->delete()
-            ->from('WebhookQueueItem')
+            ->from(WebhookQueueItem::ENTITY_TYPE)
             ->where([
                 'DATE:(createdAt)<' => $from,
                 'OR' => [
-                    'status!=' => 'Pending',
-                    'deleted' => true,
+                    'status!=' => WebhookQueueItem::STATUS_PENDING,
+                    Attribute::DELETED => true,
                 ],
             ])
             ->build();
@@ -76,12 +74,12 @@ class WebhookQueue implements Cleanup
         $query2 = $this->entityManager
             ->getQueryBuilder()
             ->delete()
-            ->from('WebhookEventQueueItem')
+            ->from(WebhookEventQueueItem::ENTITY_TYPE)
             ->where([
                 'DATE:(createdAt)<' => $from,
                 'OR' => [
                     'isProcessed' => true,
-                    'deleted' => true,
+                    Attribute::DELETED => true,
                 ],
             ])
             ->build();

application/Espo/Classes/FieldConverters/RelationshipRole.php

@@ -85,7 +85,7 @@ class RelationshipRole implements FieldConverter
                             'from' => $midTable,
                             'select' => [$nearKey],
                             'whereClause' => [
-                                'deleted' => false,
+                                Attribute::DELETED => false,
                                 $column => '{value}',
                             ],
                         ],
@@ -97,7 +97,7 @@ class RelationshipRole implements FieldConverter
                             'from' => $midTable,
                             'select' => [$nearKey],
                             'whereClause' => [
-                                'deleted' => false,
+                                Attribute::DELETED => false,
                                 $column => '{value}',
                             ],
                         ],
@@ -109,7 +109,7 @@ class RelationshipRole implements FieldConverter
                             'from' => $midTable,
                             'select' => [$nearKey],
                             'whereClause' => [
-                                'deleted' => false,
+                                Attribute::DELETED => false,
                                 $column => '{value}',
                             ],
                         ],
@@ -121,7 +121,7 @@ class RelationshipRole implements FieldConverter
                             'from' => $midTable,
                             'select' => [$nearKey],
                             'whereClause' => [
-                                'deleted' => false,
+                                Attribute::DELETED => false,
                                 $column => '{value}',
                             ],
                         ],
@@ -133,7 +133,7 @@ class RelationshipRole implements FieldConverter
                             'from' => $midTable,
                             'select' => [$nearKey],
                             'whereClause' => [
-                                'deleted' => false,
+                                Attribute::DELETED => false,
                                 "$column*" => '{value}',
                             ],
                         ],
@@ -145,7 +145,7 @@ class RelationshipRole implements FieldConverter
                             'from' => $midTable,
                             'select' => [$nearKey],
                             'whereClause' => [
-                                'deleted' => false,
+                                Attribute::DELETED => false,
                                 "$column*" => '{value}',
                             ],
                         ],

application/Espo/Classes/FieldProcessing/Email/AddressDataLoader.php

@@ -52,11 +52,6 @@ class AddressDataLoader implements Loader
         /** @var EmailRepository $repository */
         $repository = $this->entityManager->getRepository(Email::ENTITY_TYPE);
 
-        $repository->loadFromField($entity);
-        $repository->loadToField($entity);
-        $repository->loadCcField($entity);
-        $repository->loadBccField($entity);
-        $repository->loadReplyToField($entity);
         $repository->loadNameHash($entity);
     }
 }

application/Espo/Classes/FieldProcessing/Email/AddressLoader.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Email;
+
+use Espo\Core\FieldProcessing\Loader;
+use Espo\Core\FieldProcessing\Loader\Params;
+use Espo\Core\ORM\EntityManager;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+use Espo\Repositories\Email as EmailRepository;
+
+/**
+ * @implements Loader<Email>
+ */
+class AddressLoader implements Loader
+{
+    public function __construct(private EntityManager $entityManager)
+    {}
+    /**
+     * @inheritDoc
+     */
+    public function process(Entity $entity, Params $params): void
+    {
+        /** @var EmailRepository $repository */
+        $repository = $this->entityManager->getRepository(Email::ENTITY_TYPE);
+
+        $repository->loadFromField($entity);
+        $repository->loadToField($entity);
+        $repository->loadCcField($entity);
+        $repository->loadBccField($entity);
+        $repository->loadReplyToField($entity);
+    }
+}

application/Espo/Classes/FieldProcessing/Email/UserColumnsLoader.php

@@ -35,6 +35,7 @@ use Espo\Core\FieldProcessing\Loader;
 use Espo\Core\FieldProcessing\Loader\Params;
 use Espo\Core\ORM\EntityManager;
 use Espo\Entities\User;
+use Espo\ORM\Name\Attribute;
 
 /**
  * @implements Loader<Email>
@@ -57,7 +58,7 @@ class UserColumnsLoader implements Loader
                 Email::USERS_COLUMN_IN_ARCHIVE,
             ])
             ->where([
-                'deleted' => false,
+                Attribute::DELETED => false,
                 'userId' => $this->user->getId(),
                 'emailId' => $entity->getId(),
             ])

application/Espo/Classes/FieldProcessing/InboundEmail/IsSystemLoader.php

@@ -31,7 +31,7 @@ namespace Espo\Classes\FieldProcessing\InboundEmail;
 
 use Espo\Core\FieldProcessing\Loader;
 use Espo\Core\FieldProcessing\Loader\Params;
-use Espo\Core\Utils\Config;
+use Espo\Core\Mail\ConfigDataProvider;
 use Espo\Entities\InboundEmail;
 use Espo\ORM\Entity;
 
@@ -41,12 +41,12 @@ use Espo\ORM\Entity;
 class IsSystemLoader implements Loader
 {
     public function __construct(
-        private Config $config,
+        private ConfigDataProvider $configDataProvider,
     ) {}
 
     public function process(Entity $entity, Params $params): void
     {
-        $isSystem = $entity->getEmailAddress() === $this->config->get('outboundEmailFromAddress');
+        $isSystem = $entity->getEmailAddress() === $this->configDataProvider->getSystemOutboundAddress();
 
         $entity->set('isSystem', $isSystem);
     }

application/Espo/Classes/FieldProcessing/OAuthAccount/DataLoader.php

@@ -1,3 +1,4 @@
+<?php
 /************************************************************************
  * This file is part of EspoCRM.
  *
@@ -26,34 +27,46 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-define('crm:views/calendar/record/edit-view', ['views/record/base'], function (Dep) {
+namespace Espo\Classes\FieldProcessing\OAuthAccount;
 
-    return Dep.extend({
+use Espo\Core\FieldProcessing\Loader;
+use Espo\Core\FieldProcessing\Loader\Params;
+use Espo\Entities\OAuthAccount;
+use Espo\ORM\Entity;
+use Espo\Tools\OAuth\ConfigDataProvider;
 
-        template: 'crm:calendar/record/edit-view',
+/**
+ * @implements Loader<OAuthAccount>
+ */
+class DataLoader implements Loader
+{
+    public function __construct(
+        private ConfigDataProvider $configDataProvider,
+    ) {}
 
-        setup: function () {
-            Dep.prototype.setup.call(this);
+    public function process(Entity $entity, Params $params): void
+    {
+        if (!$entity->get('providerId')) {
+            return;
+        }
 
-            this.createField('mode', 'views/fields/enum', {
-                options: this.getMetadata().get(['clientDefs', 'Calendar', 'sharedViewModeList']) || [],
-                translation: 'DashletOptions.options.mode'
-            }, null, null, {
-                labelText: this.translate('mode', 'fields', 'DashletOptions')
-            });
+        $provider = $entity->getProvider();
 
-            this.createField('name', 'views/fields/varchar', {
-                required: true
-            }, null, null, {
-                labelText: this.translate('name', 'fields')
-            });
+        $scope = null;
 
-            this.createField('teams', 'crm:views/calendar/fields/teams', {
-                required: true
-            }, null, null, {
-                labelText: this.translate('teams', 'fields'),
-                foreignScope: 'Team'
-            });
-        },
-    });
-});
+        if ($provider->getScopes()) {
+            $scope = implode($provider->getScopeSeparator() ?? ' ', $provider->getScopes());
+        }
+
+        $data = [
+            'endpoint' => $provider->getAuthorizationEndpoint(),
+            'clientId' => $provider->getClientId(),
+            'redirectUri' => $this->configDataProvider->getRedirectUri(),
+            'scope' => $scope,
+            'prompt' => $provider->getAuthorizationPrompt(),
+            'params' => $provider->getAuthorizationParams(),
+        ];
+
+        $entity->set('data', $data);
+    }
+}

application/Espo/Classes/FieldProcessing/OAuthProvider/AuthorizationRedirectUriLoader.php

@@ -0,0 +1,51 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\OAuthProvider;
+
+use Espo\Core\FieldProcessing\Loader;
+use Espo\Core\FieldProcessing\Loader\Params;
+use Espo\Entities\OAuthProvider;
+use Espo\ORM\Entity;
+use Espo\Tools\OAuth\ConfigDataProvider;
+
+/**
+ * @implements Loader<OAuthProvider>
+ */
+class AuthorizationRedirectUriLoader implements Loader
+{
+    public function __construct(
+        private ConfigDataProvider $configDataProvider,
+    ) {}
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $entity->set('authorizationRedirectUri', $this->configDataProvider->getRedirectUri());
+    }
+}

application/Espo/Classes/FieldValidators/CurrencyType.php

@@ -32,6 +32,7 @@ namespace Espo\Classes\FieldValidators;
 use Espo\Core\Field\Currency;
 use Espo\Core\Utils\Config;
 use Espo\ORM\BaseEntity;
+use Espo\ORM\Defs\Params\AttributeParam;
 use Espo\ORM\Entity;
 
 class CurrencyType extends FloatType
@@ -83,7 +84,7 @@ class CurrencyType extends FloatType
         }
 
         /** @var int $precision */
-        $precision = $entity->getAttributeParam($field, 'precision') ?? self::DEFAULT_PRECISION;
+        $precision = $entity->getAttributeParam($field, AttributeParam::PRECISION) ?? self::DEFAULT_PRECISION;
 
         $value = $entity->get($field);
 
@@ -95,6 +96,8 @@ class CurrencyType extends FloatType
 
         $pad = str_pad('', $precision, '9');
 
+        assert(is_numeric($pad));
+
         $limit = Currency::create($pad, 'USD');
 
         if ($currency->compare($limit) === 1) {

application/Espo/Classes/Jobs/Cleanup.php

@@ -41,7 +41,6 @@ use Espo\Entities\ArrayValue;
 use Espo\Entities\Attachment;
 use Espo\Entities\AuthLogRecord;
 use Espo\Entities\AuthToken;
-use Espo\Entities\Email;
 use Espo\Entities\Job;
 use Espo\Entities\Note;
 use Espo\Entities\Notification;
@@ -98,7 +97,6 @@ class Cleanup implements JobDataLess
         $this->cleanupJobs();
         $this->cleanupScheduledJobLog();
         $this->cleanupAttachments();
-        $this->cleanupEmails();
         $this->cleanupNotifications();
         $this->cleanupActionHistory();
         $this->cleanupAuthToken();
@@ -149,7 +147,7 @@ class Cleanup implements JobDataLess
             ->where([
                 'modifiedAt<' => $this->getCleanupJobFromDate(),
                 'status=' => JobStatus::PENDING,
-                'deleted' => true,
+                Attribute::DELETED => true,
             ])
             ->build();
 
@@ -412,7 +410,7 @@ class Cleanup implements JobDataLess
                 ->from($scope)
                 ->withDeleted()
                 ->where([
-                    'deleted' => true,
+                    Attribute::DELETED => true,
                     'modifiedAt<' => $datetime->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT),
                     'modifiedAt>' => $datetimeFrom->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT),
                 ])
@@ -465,7 +463,7 @@ class Cleanup implements JobDataLess
             ->delete()
             ->from(Attachment::ENTITY_TYPE)
             ->where([
-                'deleted' => true,
+                Attribute::DELETED => true,
                 'createdAt<' => $datetime->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT),
             ])
             ->build();
@@ -473,68 +471,6 @@ class Cleanup implements JobDataLess
         $this->entityManager->getQueryExecutor()->execute($delete);
     }
 
-    private function cleanupEmails(): void
-    {
-        $dateBefore = date(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT, time() - 3600 * 24 * 20);
-
-        $query = $this->entityManager
-            ->getQueryBuilder()
-            ->select()
-            ->from(Email::ENTITY_TYPE)
-            ->withDeleted()
-            ->build();
-
-        /** @var iterable<Email> $emails */
-        $emails = $this->entityManager
-            ->getRDBRepository(Email::ENTITY_TYPE)
-            ->clone($query)
-            ->sth()
-            ->select([Attribute::ID])
-            ->where([
-                'createdAt<' => $dateBefore,
-                'deleted' => true,
-            ])
-            ->find();
-
-        foreach ($emails as $email) {
-            $id = $email->getId();
-
-            $attachments = $this->entityManager
-                ->getRDBRepository(Attachment::ENTITY_TYPE)
-                ->where([
-                    'parentId' => $id,
-                    'parentType' => Email::ENTITY_TYPE,
-                ])
-                ->find();
-
-            foreach ($attachments as $attachment) {
-                $this->entityManager->removeEntity($attachment);
-            }
-
-            $delete = $this->entityManager
-                ->getQueryBuilder()
-                ->delete()
-                ->from(Email::ENTITY_TYPE)
-                ->where([
-                    'deleted' => true,
-                    'id' => $id,
-                ])
-                ->build();
-
-            $this->entityManager->getQueryExecutor()->execute($delete);
-
-            $delete = $this->entityManager
-                ->getQueryBuilder()
-                ->delete()
-                ->from(Email::RELATIONSHIP_EMAIL_USER)
-                ->where([
-                    'emailId' => $id,
-                ])
-                ->build();
-
-            $this->entityManager->getQueryExecutor()->execute($delete);
-        }
-    }
 
     private function cleanupNotifications(): void
     {
@@ -584,17 +520,16 @@ class Cleanup implements JobDataLess
     {
         $scope = $entity->getEntityType();
 
-        if (!$entity->get('deleted')) {
+        if (!$entity->get(Attribute::DELETED)) {
             return;
         }
 
         $repository = $this->entityManager->getRepository($scope);
 
-        if (!$repository instanceof RDBRepository) {
-            return;
-        }
-
-        if (!$entity instanceof CoreEntity) {
+        if (
+            !$repository instanceof RDBRepository ||
+            !$entity instanceof CoreEntity
+        ) {
             return;
         }
 
@@ -647,82 +582,14 @@ class Cleanup implements JobDataLess
             }
         }
 
-        $query = $this->entityManager
-            ->getQueryBuilder()
-            ->select()
-            ->from(Note::ENTITY_TYPE)
-            ->withDeleted()
-            ->build();
-
-        $noteList = $this->entityManager
-            ->getRDBRepository(Note::ENTITY_TYPE)
-            ->clone($query)
-            ->sth()
-            ->where([
-                'OR' => [
-                    [
-                        'relatedType' => $scope,
-                        'relatedId' => $entity->getId(),
-                    ],
-                    [
-                        'parentType' => $scope,
-                        'parentId' => $entity->getId(),
-                    ]
-                ]
-            ])
-            ->find();
-
-        foreach ($noteList as $note) {
-            $this->entityManager->removeEntity($note);
-
-            $note->set('deleted', true);
-
-            $this->cleanupDeletedEntity($note);
-        }
+        $this->cleanupEntityNotes($entity);
+        $this->cleanupEntityAttachments($entity);
 
         if ($scope === Note::ENTITY_TYPE) {
-            $attachmentList = $this->entityManager
-                ->getRDBRepository(Attachment::ENTITY_TYPE)
-                ->where([
-                    'parentId' => $entity->getId(),
-                    'parentType' => Note::ENTITY_TYPE,
-                ])
-                ->find();
-
-            foreach ($attachmentList as $attachment) {
-                $this->entityManager->removeEntity($attachment);
-                $this->entityManager
-                    ->getRDBRepository(Attachment::ENTITY_TYPE)
-                    ->deleteFromDb($attachment->getId());
-            }
-
-            // @todo If ever reactions are supported not only for notes, then move out of the if-block.
-
-            $deleteReactionsQuery = DeleteBuilder::create()
-                ->from(UserReaction::ENTITY_TYPE)
-                ->where([
-                    'parentId' => $entity->getId(),
-                    'parentType' => Note::ENTITY_TYPE,
-                ])
-                ->build();
-
-            $this->entityManager->getQueryExecutor()->execute($deleteReactionsQuery);
+            $this->cleanupNoteReactions($entity);
         }
 
-        $arrayValueList = $this->entityManager
-            ->getRDBRepository(ArrayValue::ENTITY_TYPE)
-            ->sth()
-            ->where([
-                'entityType' => $entity->getEntityType(),
-                'entityId' => $entity->getId(),
-            ])
-            ->find();
-
-        foreach ($arrayValueList as $arrayValue) {
-            $this->entityManager
-                ->getRDBRepository(ArrayValue::ENTITY_TYPE)
-                ->deleteFromDb($arrayValue->getId());
-        }
+        $this->cleanupEntityArrayValues($entity);
     }
 
     private function cleanupDeletedRecords(): void
@@ -759,13 +626,13 @@ class Cleanup implements JobDataLess
 
             $service = $this->recordServiceContainer->get($scope);
 
-            $whereClause = ['deleted' => true];
+            $whereClause = [Attribute::DELETED => true];
 
             if (
                 !$this->entityManager
                     ->getDefs()
                     ->getEntity($scope)
-                    ->hasAttribute('deleted')
+                    ->hasAttribute(Attribute::DELETED)
             ) {
                 continue;
             }
@@ -816,4 +683,96 @@ class Cleanup implements JobDataLess
 
         return $datetime;
     }
+
+    private function cleanupEntityAttachments(CoreEntity $entity): void
+    {
+        // @todo Add file, image types support.
+
+        $attachments = $this->entityManager
+            ->getRDBRepository(Attachment::ENTITY_TYPE)
+            ->where([
+                'parentId' => $entity->getId(),
+                'parentType' => $entity->getEntityType(),
+            ])
+            ->find();
+
+        foreach ($attachments as $attachment) {
+            $this->entityManager->removeEntity($attachment);
+
+            $this->entityManager
+                ->getRDBRepository(Attachment::ENTITY_TYPE)
+                ->deleteFromDb($attachment->getId());
+        }
+    }
+
+    private function cleanupEntityNotes(CoreEntity $entity): void
+    {
+        $scope = $entity->getEntityType();
+
+        $query = $this->entityManager
+            ->getQueryBuilder()
+            ->select()
+            ->from(Note::ENTITY_TYPE)
+            ->withDeleted()
+            ->build();
+
+        $noteList = $this->entityManager
+            ->getRDBRepository(Note::ENTITY_TYPE)
+            ->clone($query)
+            ->sth()
+            ->where([
+                'OR' => [
+                    [
+                        'relatedType' => $scope,
+                        'relatedId' => $entity->getId(),
+                    ],
+                    [
+                        'parentType' => $scope,
+                        'parentId' => $entity->getId(),
+                    ]
+                ]
+            ])
+            ->find();
+
+        foreach ($noteList as $note) {
+            $this->entityManager->removeEntity($note);
+
+            $note->set(Attribute::DELETED, true);
+
+            $this->cleanupDeletedEntity($note);
+        }
+    }
+
+    private function cleanupNoteReactions(CoreEntity $entity): void
+    {
+        // @todo If ever reactions are supported not only for notes, then move out of the if-block.
+
+        $deleteReactionsQuery = DeleteBuilder::create()
+            ->from(UserReaction::ENTITY_TYPE)
+            ->where([
+                'parentId' => $entity->getId(),
+                'parentType' => Note::ENTITY_TYPE,
+            ])
+            ->build();
+
+        $this->entityManager->getQueryExecutor()->execute($deleteReactionsQuery);
+    }
+
+    private function cleanupEntityArrayValues(CoreEntity $entity): void
+    {
+        $arrayValues = $this->entityManager
+            ->getRDBRepository(ArrayValue::ENTITY_TYPE)
+            ->sth()
+            ->where([
+                'entityType' => $entity->getEntityType(),
+                'entityId' => $entity->getId(),
+            ])
+            ->find();
+
+        foreach ($arrayValues as $arrayValue) {
+            $this->entityManager
+                ->getRDBRepository(ArrayValue::ENTITY_TYPE)
+                ->deleteFromDb($arrayValue->getId());
+        }
+    }
 }

application/Espo/Classes/Record/OAuthProvider/GeneralFilter.php

@@ -0,0 +1,71 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\OAuthProvider;
+
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+use Espo\Core\Utils\Crypt;
+
+/**
+ * @noinspection PhpUnused
+ */
+class GeneralFilter implements Filter
+{
+    private const ATTR_CLIENT_SECRET = 'clientSecret';
+
+    public function __construct(private Crypt $crypt) {}
+
+    /**
+     * @throws BadRequest
+     */
+    public function filter(Data $data): void
+    {
+        $this->processClientSecret($data);
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function processClientSecret(Data $data): void
+    {
+        $value = $data->get(self::ATTR_CLIENT_SECRET);
+
+        if ($value === null) {
+            return;
+        }
+
+        if (!is_string($value)) {
+            throw new BadRequest();
+        }
+
+        $data->set(self::ATTR_CLIENT_SECRET, $this->crypt->encrypt($value));
+    }
+}

application/Espo/Classes/RecordHooks/Email/BeforeCreate.php

@@ -29,7 +29,7 @@
 
 namespace Espo\Classes\RecordHooks\Email;
 
-use Espo\Core\Mail\Sender;
+use Espo\Core\Mail\EmailSender;
 use Espo\Core\Record\Hook\SaveHook;
 use Espo\Entities\Email;
 use Espo\ORM\Entity;
@@ -42,7 +42,7 @@ class BeforeCreate implements SaveHook
     public function process(Entity $entity): void
     {
         if ($entity->getStatus() === Email::STATUS_SENDING) {
-            $messageId = Sender::generateMessageId($entity);
+            $messageId = EmailSender::generateMessageId($entity);
 
             $entity->setMessageId('<' . $messageId . '>');
         }

application/Espo/Classes/RecordHooks/Email/BeforeSave.php

@@ -33,13 +33,13 @@ use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Record\Hook\SaveHook;
 use Espo\Entities\Email;
 use Espo\ORM\Entity;
+use Espo\Tools\Email\Util;
 
 /**
  * @implements SaveHook<Email>
  */
 class BeforeSave implements SaveHook
 {
-
     public function process(Entity $entity): void
     {
         if (
@@ -49,5 +49,22 @@ class BeforeSave implements SaveHook
         ) {
             throw new BadRequest("Cannot set send-at if status is not Draft.");
         }
+
+        $this->processBodyPlain($entity);
+    }
+
+    private function processBodyPlain(Email $entity): void
+    {
+        if (!$entity->isHtml() || !$entity->isAttributeChanged('body')) {
+            return;
+        }
+
+        $body = $entity->getBody();
+
+        if ($body) {
+            $body = Util::stripHtml($body) ?: null;
+        }
+
+        $entity->setBodyPlain($body);
     }
 }

application/Espo/Classes/RecordHooks/Email/BeforeUpdate.php

@@ -29,7 +29,7 @@
 
 namespace Espo\Classes\RecordHooks\Email;
 
-use Espo\Core\Mail\Sender;
+use Espo\Core\Mail\EmailSender;
 use Espo\Core\Name\Field;
 use Espo\Core\Record\Hook\SaveHook;
 use Espo\Core\Utils\FieldUtil;
@@ -94,7 +94,7 @@ class BeforeUpdate implements SaveHook
         }
 
         if ($entity->getStatus() == Email::STATUS_SENDING) {
-            $messageId = Sender::generateMessageId($entity);
+            $messageId = EmailSender::generateMessageId($entity);
 
             $entity->setMessageId('<' . $messageId . '>');
         }

application/Espo/Classes/Select/Email/Where/ItemConverters/InFolder.php

@@ -201,11 +201,16 @@ class InFolder implements ItemConverter
             return WhereClause::fromRaw([
                 'groupFolderId' => $groupFolderId,
                 'groupStatusFolder' => null,
+                'createdById!=' => $this->user->getId(),
                 'fromEmailAddressId!=' => $this->getEmailAddressIdList(),
                 'status' => [
                     Email::STATUS_ARCHIVED,
                     Email::STATUS_SENT,
                 ],
+                'OR' => [
+                    'status' => Email::STATUS_ARCHIVED,
+                    'createdById!=' => $this->user->getId(),
+                ],
             ]);
         }
 

application/Espo/Classes/Select/EmailAddress/PrimaryFilters/Orphan.php

@@ -30,6 +30,7 @@
 namespace Espo\Classes\Select\EmailAddress\PrimaryFilters;
 
 use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Name\Attribute;
 use Espo\ORM\Query\SelectBuilder;
 
 class Orphan implements Filter
@@ -42,24 +43,24 @@ class Orphan implements Filter
                 'EntityEmailAddress',
                 'entityEmailAddress',
                 [
-                    'emailAddressId:' => 'id',
-                    'deleted' => false,
+                    'emailAddressId:' => Attribute::ID,
+                    Attribute::DELETED => false,
                 ]
             )
             ->leftJoin(
                 'EmailEmailAddress',
                 'emailEmailAddress',
                 [
-                    'emailAddressId:' => 'id',
-                    'deleted' => false,
+                    'emailAddressId:' => Attribute::ID,
+                    Attribute::DELETED => false,
                 ]
             )
             ->leftJoin(
                 'Email',
                 'email',
                 [
-                    'fromEmailAddressId:' => 'id',
-                    'deleted' => false,
+                    'fromEmailAddressId:' => Attribute::ID,
+                    Attribute::DELETED => false,
                 ]
             )
             ->where([

application/Espo/Classes/Select/PhoneNumber/PrimaryFilters/Orphan.php

@@ -30,6 +30,7 @@
 namespace Espo\Classes\Select\PhoneNumber\PrimaryFilters;
 
 use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Name\Attribute;
 use Espo\ORM\Query\SelectBuilder;
 
 class Orphan implements Filter
@@ -44,8 +45,8 @@ class Orphan implements Filter
             'EntityPhoneNumber',
             'entityPhoneNumber',
             [
-                'phoneNumberId:' => 'id',
-                'deleted' => false,
+                'phoneNumberId:' => Attribute::ID,
+                Attribute::DELETED => false,
             ]
         );
 

application/Espo/Classes/TemplateHelpers/GoogleMaps.php

@@ -32,30 +32,26 @@ namespace Espo\Classes\TemplateHelpers;
 use Espo\Core\Htmlizer\Helper;
 use Espo\Core\Htmlizer\Helper\Data;
 use Espo\Core\Htmlizer\Helper\Result;
-
 use Espo\Core\Utils\Metadata;
 use Espo\Core\Utils\Config;
 use Espo\Core\Utils\Log;
+use const CURLOPT_FOLLOWLOCATION;
+use const CURLOPT_HEADER;
+use const CURLOPT_HTTPHEADER;
+use const CURLOPT_RETURNTRANSFER;
+use const CURLOPT_TIMEOUT;
+use const CURLOPT_URL;
+use const CURLOPT_USERAGENT;
 
 class GoogleMaps implements Helper
 {
     private const DEFAULT_SIZE = '400x400';
 
-    private $metadata;
-
-    private $config;
-
-    private $log;
-
     public function __construct(
-        Metadata $metadata,
-        Config $config,
-        Log $log
-    ) {
-        $this->metadata = $metadata;
-        $this->config = $config;
-        $this->log = $log;
-    }
+        private Metadata $metadata,
+        private Config $config,
+        private Log $log,
+    ) {}
 
     public function render(Data $data): Result
     {
@@ -194,6 +190,7 @@ class GoogleMaps implements Helper
     }
 
     /**
+     * @param non-empty-string $url
      * @return string|bool
      */
     private function getImage(string $url)
@@ -207,13 +204,13 @@ class GoogleMaps implements Helper
 
         $c = curl_init();
 
-        curl_setopt($c, \CURLOPT_URL, $url);
-        curl_setopt($c, \CURLOPT_HTTPHEADER, $headers);
-        curl_setopt($c, \CURLOPT_HEADER, 0);
-        curl_setopt($c, \CURLOPT_USERAGENT, $agent);
-        curl_setopt($c, \CURLOPT_TIMEOUT, 10);
-        curl_setopt($c, \CURLOPT_RETURNTRANSFER, 1);
-        curl_setopt($c, \CURLOPT_FOLLOWLOCATION, 1);
+        curl_setopt($c, CURLOPT_URL, $url);
+        curl_setopt($c, CURLOPT_HTTPHEADER, $headers);
+        curl_setopt($c, CURLOPT_HEADER, false);
+        curl_setopt($c, CURLOPT_USERAGENT, $agent);
+        curl_setopt($c, CURLOPT_TIMEOUT, 10);
+        curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($c, CURLOPT_FOLLOWLOCATION, true);
 
         $raw = curl_exec($c);
 

application/Espo/Controllers/Admin.php

@@ -54,7 +54,8 @@ class Admin
         private Manager $adminNotificationManager,
         private SystemRequirements $systemRequirements,
         private ScheduledJob $scheduledJob,
-        private DataManager $dataManager
+        private DataManager $dataManager,
+        private Config\SystemConfig $systemConfig,
     ) {
         if (!$this->user->isAdmin()) {
             throw new Forbidden();
@@ -179,9 +180,14 @@ class Admin
      *     database: array<string, array<string, mixed>>,
      *     permission: array<string, array<string, mixed>>,
      * }
+     * @throws Forbidden
      */
     public function getActionSystemRequirementList(): object
     {
+        if (!$this->user->isSuperAdmin() && $this->systemConfig->isRestrictedMode()) {
+            throw new Forbidden();
+        }
+
         return (object) $this->systemRequirements->getAllRequiredList();
     }
 }

application/Espo/Controllers/Formula.php

@@ -30,31 +30,33 @@
 namespace Espo\Controllers;
 
 use Espo\Core\Api\Request;
-
+use Espo\Core\Exceptions\NotFoundSilent;
 use Espo\Tools\Formula\Service;
-
 use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\ForbiddenSilent;
-
 use Espo\Entities\User;
-
 use Espo\Core\Field\LinkParent;
 
 use stdClass;
 
 class Formula
 {
-    private Service $service;
-
-    public function __construct(Service $service, User $user)
-    {
-        $this->service = $service;
 
+    /**
+     * @throws ForbiddenSilent
+     */
+    public function __construct(
+        private Service $service,
+        User $user,
+    ) {
         if (!$user->isAdmin()) {
             throw new ForbiddenSilent();
         }
     }
 
+    /**
+     * @throws BadRequest
+     */
     public function postActionCheckSyntax(Request $request): stdClass
     {
         $expression = $request->getParsedBody()->expression ?? null;
@@ -66,6 +68,10 @@ class Formula
         return $this->service->checkSyntax($expression)->toStdClass();
     }
 
+    /**
+     * @throws BadRequest
+     * @throws NotFoundSilent
+     */
     public function postActionRun(Request $request): stdClass
     {
         $expression = $request->getParsedBody()->expression ?? null;

application/Espo/Controllers/Integration.php

@@ -29,31 +29,34 @@
 
 namespace Espo\Controllers;
 
+use Espo\Core\Exceptions\NotFound;
 use Espo\Services\Integration as Service;
-
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Api\Request;
-
 use Espo\Entities\User;
 
 use stdClass;
 
 class Integration
 {
-    private $service;
 
-    private $user;
-
-    public function __construct(Service $service, User $user)
-    {
-        $this->service = $service;
-        $this->user = $user;
+    /**
+     * @throws Forbidden
+     */
+    public function __construct(
+        private Service $service,
+        private User $user,
+    ) {
 
         if (!$this->user->isAdmin()) {
             throw new Forbidden();
         }
     }
 
+    /**
+     * @throws Forbidden
+     * @throws NotFound
+     */
     public function getActionRead(Request $request): stdClass
     {
         /** @var string $id */
@@ -64,6 +67,10 @@ class Integration
         return $entity->getValueMap();
     }
 
+    /**
+     * @throws Forbidden
+     * @throws NotFound
+     */
     public function putActionUpdate(Request $request): stdClass
     {
         /** @var string $id */

application/Espo/Controllers/LastViewed.php

@@ -35,6 +35,9 @@ use Espo\Tools\ActionHistory\Service as Service;
 
 use stdClass;
 
+/**
+ * @noinspection PhpUnused
+ */
 class LastViewed
 {
     public function __construct(private SearchParamsFetcher $searchParamsFetcher, private Service $service)
@@ -49,9 +52,6 @@ class LastViewed
 
         $result = $this->service->getLastViewed($maxSize, $offset);
 
-        return (object) [
-            'total' => $result->getTotal(),
-            'list' => $result->getValueMapList(),
-        ];
+        return $result->toApiOutput();
     }
 }

application/Espo/Controllers/Notification.php

@@ -83,10 +83,7 @@ class Notification extends RecordBase
 
         $recordCollection = $this->getNotificationService()->get($userId, $searchParams);
 
-        return (object) [
-            'total' => $recordCollection->getTotal(),
-            'list' => $recordCollection->getValueMapList(),
-        ];
+        return $recordCollection->toApiOutput();
     }
 
     public function getActionNotReadCount(): int

application/Espo/Controllers/OAuthAccount.php

@@ -0,0 +1,47 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Controllers\RecordBase;
+
+/**
+ * @noinspection PhpUnused
+ */
+class OAuthAccount extends RecordBase
+{
+    protected function checkAccess(): bool
+    {
+        if (!$this->user->isAdmin()) {
+            return false;
+        }
+
+        return true;
+    }
+}

application/Espo/Controllers/OAuthProvider.php

@@ -0,0 +1,47 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Controllers\Record;
+
+/**
+ * @noinspection PhpUnused
+ */
+class OAuthProvider extends Record
+{
+    protected function checkAccess(): bool
+    {
+        if (!$this->user->isAdmin()) {
+            return false;
+        }
+
+        return true;
+    }
+}

application/Espo/Controllers/Stream.php

@@ -79,12 +79,12 @@ class Stream
 
             $reactionsCheckDate = DateTime::createNow();
 
-            return (object) [
-                'total' => $collection->getTotal(),
-                'list' => $collection->getValueMapList(),
-                'reactionsCheckDate' => $reactionsCheckDate->toString(),
-                'updatedReactions' => $this->getReactionUpdates($request, $id),
-            ];
+            $output = $collection->toApiOutput();
+
+            $output->reactionsCheckDate = $reactionsCheckDate->toString();
+            $output->updatedReactions = $this->getReactionUpdates($request, $id);
+
+            return $output;
         }
 
         if ($id === null) {
@@ -94,11 +94,11 @@ class Stream
         $collection = $this->service->find($scope, $id, $searchParams);
         $pinnedCollection = $this->service->getPinned($scope, $id);
 
-        return (object) [
-            'total' => $collection->getTotal(),
-            'list' => $collection->getValueMapList(),
-            'pinnedList' => $pinnedCollection->getValueMapList(),
-        ];
+        $output = $collection->toApiOutput();
+
+        $output->pinnedList = $pinnedCollection->getValueMapList();
+
+        return $output;
     }
 
     /**
@@ -126,10 +126,7 @@ class Stream
             $this->userRecordService->find($id, $searchParams) :
             $this->service->find($scope, $id ?? '', $searchParams);
 
-        return (object) [
-            'total' => $result->getTotal(),
-            'list' => $result->getValueMapList(),
-        ];
+        return $result->toApiOutput();
     }
 
     /**
@@ -150,10 +147,7 @@ class Stream
 
         $result = $this->service->findUpdates($scope, $id, $searchParams);
 
-        return (object) [
-            'total' => $result->getTotal(),
-            'list' => $result->getValueMapList(),
-        ];
+        return $result->toApiOutput();
     }
 
     /**

application/Espo/Controllers/Webhook.php

@@ -31,11 +31,10 @@ namespace Espo\Controllers;
 
 use Espo\Core\Api\Request;
 use Espo\Core\Api\Response;
-use Espo\Core\Controllers\RecordBase;
-
+use Espo\Core\Controllers\Record;
 use stdClass;
 
-class Webhook extends RecordBase
+class Webhook extends Record
 {
     protected function checkAccess(): bool
     {

application/Espo/Controllers/WebhookEventQueueItem.php

@@ -0,0 +1,61 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Api\Request;
+use Espo\Core\Api\Response;
+use Espo\Core\Controllers\RecordBase;
+use Espo\Core\Exceptions\Forbidden;
+use stdClass;
+
+/**
+ * @noinspection PhpUnused
+ */
+class WebhookEventQueueItem extends RecordBase
+{
+    protected function checkAccess(): bool
+    {
+        if (!$this->user->isAdmin()) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public function postActionCreate(Request $request, Response $response): stdClass
+    {
+        throw new Forbidden();
+    }
+
+    public function putActionUpdate(Request $request, Response $response): stdClass
+    {
+        throw new Forbidden();
+    }
+}

application/Espo/Core/Acl/AccessChecker.php

@@ -31,6 +31,11 @@ namespace Espo\Core\Acl;
 
 use Espo\Entities\User;
 
+/**
+ * Bindings:
+ *   - `$entityType` – as of v9.1.0.
+ *   - `Espo\Core\AclManager`
+ */
 interface AccessChecker
 {
     /**

application/Espo/Core/Acl/AccessChecker/AccessCheckerFactory.php

@@ -58,7 +58,7 @@ class AccessCheckerFactory
     {
         $className = $this->getClassName($scope);
 
-        $bindingContainer = $this->createBindingContainer($aclManager);
+        $bindingContainer = $this->createBindingContainer($className, $aclManager, $scope);
 
         return $this->injectableFactory->createWithBinding($className, $bindingContainer);
     }
@@ -77,19 +77,27 @@ class AccessCheckerFactory
         }
 
         if (!$this->metadata->get(['scopes', $scope])) {
-            throw new NotImplemented("Access checker is not implemented for '{$scope}'.");
+            throw new NotImplemented("Access checker is not implemented for '$scope'.");
         }
 
         return $this->defaultClassName;
     }
 
-    private function createBindingContainer(AclManager $aclManager): BindingContainer
+    /**
+     * @param class-string<AccessChecker> $className
+     */
+    private function createBindingContainer(string $className, AclManager $aclManager, string $scope): BindingContainer
     {
         $bindingData = new BindingData();
 
         $binder = new Binder($bindingData);
+
         $binder->bindInstance(AclManager::class, $aclManager);
 
+        $binder
+            ->for($className)
+            ->bindValue('$entityType', $scope);
+
         return new BindingContainer($bindingData);
     }
 }

application/Espo/Core/Acl/GlobalRestriction.php

@@ -29,7 +29,7 @@
 
 namespace Espo\Core\Acl;
 
-use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Config\SystemConfig;
 use Espo\Core\Utils\DataCache;
 use Espo\Core\Utils\FieldUtil;
 use Espo\Core\Utils\Metadata;
@@ -91,10 +91,10 @@ class GlobalRestriction
         private Metadata $metadata,
         private DataCache $dataCache,
         private FieldUtil $fieldUtil,
-        Config $config
+        SystemConfig $systemConfig,
     ) {
 
-        $useCache = $config->get('useCache');
+        $useCache = $systemConfig->useCache();
 
         if ($useCache && $this->dataCache->has($this->cacheKey)) {
             /** @var stdClass $cachedData */

application/Espo/Core/Acl/Map/DataBuilder.php

@@ -58,6 +58,9 @@ class DataBuilder
     public function __construct(private MetadataProvider $metadataProvider, private FieldUtil $fieldUtil)
     {}
 
+    /**
+     * @return stdClass&object{table: stdClass, fieldTable: stdClass}
+     */
     public function build(Table $table): stdClass
     {
         $data = (object) [

application/Espo/Core/Acl/Map/Map.php

@@ -57,14 +57,14 @@ class Map
     public function __construct(
         Table $table,
         private DataBuilder $dataBuilder,
-        private Config $config,
         private DataCache $dataCache,
-        CacheKeyProvider $cacheKeyProvider
+        CacheKeyProvider $cacheKeyProvider,
+        Config\SystemConfig $systemConfig,
     ) {
 
         $this->cacheKey = $cacheKeyProvider->get();
 
-        if ($this->config->get('useCache') && $this->dataCache->has($this->cacheKey)) {
+        if ($systemConfig->useCache() && $this->dataCache->has($this->cacheKey)) {
             /** @var stdClass $cachedData */
             $cachedData = $this->dataCache->get($this->cacheKey);
 
@@ -72,7 +72,7 @@ class Map
         } else {
             $this->data = $this->dataBuilder->build($table);
 
-            if ($this->config->get('useCache')) {
+            if ($systemConfig->useCache()) {
                 $this->dataCache->store($this->cacheKey, $this->data);
             }
         }

application/Espo/Core/Acl/OwnershipChecker.php

@@ -29,4 +29,9 @@
 
 namespace Espo\Core\Acl;
 
+/**
+ * Bindings:
+ *   - `$entityType` – as of v9.1.0.
+ *   - `Espo\Core\AclManager`
+ */
 interface OwnershipChecker {}

application/Espo/Core/Acl/OwnershipChecker/OwnershipCheckerFactory.php

@@ -58,7 +58,7 @@ class OwnershipCheckerFactory
     {
         $className = $this->getClassName($scope);
 
-        $bindingContainer = $this->createBindingContainer($aclManager);
+        $bindingContainer = $this->createBindingContainer($className, $aclManager, $scope);
 
         return $this->injectableFactory->createWithBinding($className, $bindingContainer);
     }
@@ -83,7 +83,10 @@ class OwnershipCheckerFactory
         return $this->defaultClassName;
     }
 
-    private function createBindingContainer(AclManager $aclManager): BindingContainer
+    /**
+     * @param class-string<OwnershipChecker> $className
+     */
+    private function createBindingContainer(string $className, AclManager $aclManager, string $scope): BindingContainer
     {
         $bindingData = new BindingData();
 
@@ -91,6 +94,10 @@ class OwnershipCheckerFactory
 
         $binder->bindInstance(AclManager::class, $aclManager);
 
+        $binder
+            ->for($className)
+            ->bindValue('$entityType', $scope);
+
         return new BindingContainer($bindingData);
     }
 }

application/Espo/Core/Acl/Table/DefaultTable.php

@@ -29,15 +29,14 @@
 
 namespace Espo\Core\Acl\Table;
 
+use Espo\Core\Utils\Config\SystemConfig;
 use Espo\Entities\User;
 
 use Espo\Core\Acl\FieldData;
 use Espo\Core\Acl\ScopeData;
 use Espo\Core\Acl\Table;
-use Espo\Core\Utils\Config;
 use Espo\Core\Utils\DataCache;
 use Espo\Core\Utils\Metadata;
-
 use stdClass;
 use RuntimeException;
 
@@ -96,7 +95,7 @@ class DefaultTable implements Table
         private RoleListProvider $roleListProvider,
         CacheKeyProvider $cacheKeyProvider,
         protected User $user,
-        Config $config,
+        SystemConfig $systemConfig,
         protected Metadata $metadata,
         DataCache $dataCache,
     ) {
@@ -116,7 +115,7 @@ class DefaultTable implements Table
 
         $this->cacheKey = $cacheKeyProvider->get();
 
-        if ($config->get('useCache') && $dataCache->has($this->cacheKey)) {
+        if ($systemConfig->useCache() && $dataCache->has($this->cacheKey)) {
             /** @var stdClass $cachedData */
             $cachedData = $dataCache->get($this->cacheKey);
 
@@ -124,7 +123,7 @@ class DefaultTable implements Table
         } else {
             $this->load();
 
-            if ($config->get('useCache')) {
+            if ($systemConfig->useCache()) {
                 $dataCache->store($this->cacheKey, $this->data);
             }
         }
@@ -219,7 +218,7 @@ class DefaultTable implements Table
             $this->applyAdminMandatory($aclTable, $fieldTable);
         }
 
-        foreach ($aclTable as $scope => $data) {
+        foreach (get_object_vars($aclTable) as $scope => $data) {
             if (is_string($data) && isset($aclTable->$data)) {
                 $aclTable->$scope = $aclTable->$data;
             }

application/Espo/Core/AclManager.php

@@ -308,11 +308,12 @@ class AclManager
 
         $checker = $this->getAccessChecker($scope);
 
+        /** @var non-falsy-string $methodName */
         $methodName = 'checkEntity' . ucfirst($action);
 
         $interface = $this->entityActionInterfaceMap[$action] ?? null;
 
-        if ($interface && $checker instanceof $interface) {
+        if ($interface && $checker instanceof $interface && method_exists($checker, $methodName)) {
             return $checker->$methodName($user, $entity, $data);
         }
 
@@ -322,7 +323,7 @@ class AclManager
     /**
      * Check 'read' access to a specific entity.
      *
-     * @throws NotImplemented.
+     * @throws NotImplemented
      */
     public function checkEntityRead(User $user, Entity $entity): bool
     {

application/Espo/Core/Action/Actions/ConvertCurrency.php

@@ -47,6 +47,9 @@ use Espo\Entities\User;
 use Espo\Tools\Currency\Conversion\EntityConverterFactory;
 use RuntimeException;
 
+/**
+ * @noinspection PhpUnused
+ */
 class ConvertCurrency implements Action
 {
     public function __construct(

application/Espo/Core/Action/Actions/Merge/Merger.php

@@ -34,16 +34,19 @@ use Espo\Core\Acl\Table;
 use Espo\Core\Action\Params;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Name\Field;
 use Espo\Core\ORM\EntityManager;
 use Espo\Core\ORM\Type\FieldType;
 use Espo\Core\Record\ActionHistory\Action;
 use Espo\Core\Record\ServiceContainer;
 use Espo\Core\Utils\Metadata;
 use Espo\Core\Utils\ObjectUtil;
+use Espo\Entities\Note;
 use Espo\ORM\Entity;
 use Espo\Entities\EmailAddress;
 use Espo\Entities\PhoneNumber;
 
+use Espo\ORM\Type\RelationType;
 use stdClass;
 
 class Merger
@@ -94,12 +97,12 @@ class Merger
         $entityDefs = $this->entityManager->getDefs()->getEntity($entityType);
 
         $hasPhoneNumber =
-            $entityDefs->hasField('phoneNumber') &&
-            $entityDefs->getField('phoneNumber')->getType() === FieldType::PHONE;
+            $entityDefs->hasField(Field::PHONE_NUMBER) &&
+            $entityDefs->getField(Field::PHONE_NUMBER)->getType() === FieldType::PHONE;
 
         $hasEmailAddress =
-            $entityDefs->hasField('emailAddress') &&
-            $entityDefs->getField('emailAddress')->getType() === FieldType::EMAIL;
+            $entityDefs->hasField(Field::EMAIL_ADDRESS) &&
+            $entityDefs->getField(Field::EMAIL_ADDRESS)->getType() === FieldType::EMAIL;
 
         if ($hasPhoneNumber) {
             $phoneNumberToRelateList = $this->fetchEntityPhoneNumberList($entity);
@@ -196,7 +199,6 @@ class Merger
 
         /** @var iterable<PhoneNumber> $collection */
         $collection = $this->entityManager
-            ->getRDBRepository($entity->getEntityType())
             ->getRelation($entity, 'phoneNumbers')
             ->find();
 
@@ -216,7 +218,6 @@ class Merger
 
         /** @var iterable<EmailAddress> $collection */
         $collection = $this->entityManager
-            ->getRDBRepository($entity->getEntityType())
             ->getRelation($entity, 'emailAddresses')
             ->find();
 
@@ -232,13 +233,17 @@ class Merger
         $updateQuery = $this->entityManager
             ->getQueryBuilder()
             ->update()
-            ->in('Note')
+            ->in(Note::ENTITY_TYPE)
             ->set([
                 'parentId' => $targetEntity->getId(),
                 'parentType' => $targetEntity->getEntityType(),
             ])
             ->where([
-                'type' => ['Post', 'EmailSent', 'EmailReceived'],
+                'type' => [
+                    Note::TYPE_POST,
+                    Note::TYPE_EMAIL_SENT,
+                    Note::TYPE_EMAIL_RECEIVED,
+                ],
                 'parentId' => $sourceEntity->getId(),
                 'parentType' => $sourceEntity->getEntityType(),
             ])
@@ -251,16 +256,24 @@ class Merger
 
     private function updateRelations(Entity $sourceEntity, Entity $targetEntity, string $link): void
     {
-        $repository = $this->entityManager->getRDBRepository($targetEntity->getEntityType());
+        $entityType = $sourceEntity->getEntityType();
 
-        $collection = $repository
+        $columnAttributeMap = $this->getLinkColumnAttributeMap($entityType, $link);
+
+        $collection = $this->entityManager
             ->getRelation($sourceEntity, $link)
             ->find();
 
         foreach ($collection as $relatedEntity) {
-            $repository
+            $map = null;
+
+            if ($columnAttributeMap) {
+                $map = array_map(fn ($attribute) => $relatedEntity->get($attribute), $columnAttributeMap);
+            }
+
+            $this->entityManager
                 ->getRelation($targetEntity, $link)
-                ->relate($relatedEntity);
+                ->relate($relatedEntity, $map);
         }
     }
 
@@ -383,4 +396,35 @@ class Merger
             }
         }
     }
+
+    /**
+     * @return ?array<string, string>
+     */
+    private function getLinkColumnAttributeMap(string $entityType, string $link): ?array
+    {
+        $entityDefs = $this->entityManager
+            ->getDefs()
+            ->getEntity($entityType);
+
+        $columnAttributeMap = null;
+
+        $relationDefs = $entityDefs->tryGetRelation($link);
+
+        if (
+            $relationDefs &&
+            $relationDefs->getType() === RelationType::MANY_MANY &&
+            $relationDefs->hasForeignEntityType() &&
+            $relationDefs->hasForeignRelationName()
+        ) {
+            $foreignRelationDefs = $this->entityManager
+                ->getDefs()
+                ->getEntity($relationDefs->getForeignEntityType())
+                ->getRelation($relationDefs->getForeignRelationName());
+
+            /** ?@var array<string, string> $columnAttributeMap */
+            $columnAttributeMap = $foreignRelationDefs->getParam('columnAttributeMap');
+        }
+
+        return $columnAttributeMap;
+    }
 }

application/Espo/Core/Action/Params.php

@@ -32,7 +32,7 @@ namespace Espo\Core\Action;
 use RuntimeException;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Params
 {

application/Espo/Core/Api/Starter.php

@@ -30,14 +30,15 @@
 namespace Espo\Core\Api;
 
 use Espo\Core\Api\Route\RouteParamsFetcher;
-use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Config\SystemConfig;
 use Espo\Core\Utils\Route as RouteUtil;
 use Espo\Core\Utils\Log;
 
-use Psr\Container\ContainerInterface;
 use Slim\App as SlimApp;
+use Slim\Exception\HttpBadRequestException;
 use Slim\Factory\AppFactory as SlimAppFactory;
 
+use Psr\Container\ContainerInterface;
 use Psr\Http\Message\ResponseInterface as Psr7Response;
 use Psr\Http\Message\ServerRequestInterface as Psr7Request;
 
@@ -54,7 +55,7 @@ class Starter
         private RouteParamsFetcher $routeParamsFetcher,
         private MiddlewareProvider $middlewareProvider,
         private Log $log,
-        private Config $config,
+        private SystemConfig $systemConfig,
         ?string $routeCacheFile = null
     ) {
         $this->routeCacheFile = $routeCacheFile ?? $this->routeCacheFile;
@@ -64,7 +65,13 @@ class Starter
     {
         $slim = SlimAppFactory::create();
 
-        if ($this->config->get('useCache')) {
+        if (RouteUtil::isBadUri()) {
+            $this->processError($slim);
+
+            return;
+        }
+
+        if ($this->systemConfig->useCache()) {
             $slim->getRouteCollector()->setCacheFile($this->routeCacheFile);
         }
 
@@ -126,4 +133,22 @@ class Starter
             $slimRoute->addMiddleware($middleware);
         }
     }
+
+    /**
+     * @param SlimApp<ContainerInterface|null> $slim
+     */
+    private function processError(SlimApp $slim): void
+    {
+        $slim->add(function (Psr7Request $request): Psr7Response {
+            throw new HttpBadRequestException($request, 'Malformed request path.');
+        });
+
+        $slim->addErrorMiddleware(
+            displayErrorDetails: false,
+            logErrors: false,
+            logErrorDetails: false,
+        );
+
+        $slim->run();
+    }
 }

application/Espo/Core/Api/Util.php

@@ -76,6 +76,8 @@ class Util
 
     public function obtainIpFromRequest(Request $request): ?string
     {
+        // Do not add support of any more parameters here.
+
         $param = $this->config->get('ipAddressServerParam') ?? 'REMOTE_ADDR';
 
         return $request->getServerParam($param);

application/Espo/Core/Application/Runner.php

@@ -29,10 +29,15 @@
 
 namespace Espo\Core\Application;
 
+use Espo\Core\Application\Exceptions\RunnerException;
+
 /**
  * Runs an application.
  */
 interface Runner
 {
+    /**
+     * @throws RunnerException
+     */
     public function run(): void;
 }

application/Espo/Core/Authentication/AuthToken/Data.php

@@ -35,7 +35,7 @@ use SensitiveParameter;
 /**
  * An auth token data. Used for auth token creation.
  *
- * @immutable
+ * Immutable.
  */
 class Data
 {

application/Espo/Core/Authentication/AuthToken/EspoManager.php

@@ -159,17 +159,6 @@ class EspoManager implements Manager
     {
         $length = self::TOKEN_RANDOM_LENGTH;
 
-        if (function_exists('random_bytes')) {
-            /** @noinspection PhpUnhandledExceptionInspection */
-            return bin2hex(random_bytes($length));
-        }
-
-        if (function_exists('openssl_random_pseudo_bytes')) {
-            $randomValue = openssl_random_pseudo_bytes($length);
-
-            return bin2hex($randomValue);
-        }
-
-        throw new RuntimeException("Could not generate token.");
+        return bin2hex(random_bytes($length));
     }
 }

application/Espo/Core/Authentication/Authentication.php

@@ -211,7 +211,7 @@ class Authentication
 
         if (!$user->isAdmin() && $this->configDataProvider->isMaintenanceMode()) {
             throw ServiceUnavailable::createWithBody(
-                "Application is in maintenance mod1e.",
+                "Application is in maintenance mode.",
                 Body::create()
                     ->withMessage($this->language->translateLabel('maintenanceModeError', 'messages'))
             );

application/Espo/Core/Authentication/AuthenticationData.php

@@ -29,8 +29,10 @@
 
 namespace Espo\Core\Authentication;
 
+use SensitiveParameter;
+
 /**
- * @immutable
+ * Immutable.
  */
 class AuthenticationData
 {
@@ -87,7 +89,7 @@ class AuthenticationData
         return $obj;
     }
 
-    public function withPassword(?string $password): self
+    public function withPassword(#[SensitiveParameter] ?string $password): self
     {
         $obj = clone $this;
         $obj->password = $password;

application/Espo/Core/Authentication/Jwt/Keys/Rsa.php

@@ -34,7 +34,7 @@ use UnexpectedValueException;
 use stdClass;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Rsa implements Key
 {

application/Espo/Core/Authentication/Jwt/Token.php

@@ -36,7 +36,7 @@ use RuntimeException;
 /**
  * JWT token.
  *
- * @immutable
+ * Immutable.
  */
 class Token
 {

application/Espo/Core/Authentication/Jwt/Token/Header.php

@@ -35,7 +35,7 @@ use JsonException;
 use stdClass;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Header
 {

application/Espo/Core/Authentication/Jwt/Token/Payload.php

@@ -35,7 +35,7 @@ use JsonException;
 use stdClass;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Payload
 {

application/Espo/Core/Authentication/Ldap/LdapLogin.php

@@ -345,11 +345,10 @@ class LdapLogin implements Login
     private function createUser(array $userData, bool $isPortal = false): ?User
     {
         $this->log->info("LDAP: Creating new user.");
+        $this->log->debug("LDAP: user data: {userData}", ['userData' => print_r($userData, true)]);
 
         $data = [];
 
-        $this->log->debug("LDAP: user data: {userData}", ['userData' => print_r($userData, true)]);
-
         $ldapFields = $this->loadFields('ldap');
 
         foreach ($ldapFields as $espo => $ldap) {
@@ -366,21 +365,20 @@ class LdapLogin implements Login
         }
 
         if ($isPortal) {
-            $userFields = $this->loadFields('portalUser');
+            $userAttributes = $this->loadFields('portalUser');
 
-            $userFields['type'] = 'portal';
+            $userAttributes['type'] = User::TYPE_PORTAL;
         } else {
-            $userFields = $this->loadFields('user');
+            $userAttributes = $this->loadFields('user');
         }
 
-        foreach ($userFields as $fieldName => $fieldValue) {
-            $data[$fieldName] = $fieldValue;
+        foreach ($userAttributes as $key => $value) {
+            $data[$key] = $value;
         }
 
-        /** @var User $user */
-        $user = $this->entityManager->getNewEntity(User::ENTITY_TYPE);
+        $user = $this->entityManager->getRDBRepositoryByClass(User::class)->getNew();
 
-        $user->set($data);
+        $user->setMultiple($data);
 
         $this->entityManager->saveEntity($user, [
             // Prevent `user` service being loaded by hooks.
@@ -388,10 +386,7 @@ class LdapLogin implements Login
             SaveOption::KEEP_NEW => true,
         ]);
 
-        $saverParams = SaverParams::create()
-            ->withRawOptions([
-                'skipLinkMultipleHooks' => true,
-            ]);
+        $saverParams = SaverParams::create()->withRawOptions(['skipLinkMultipleHooks' => true]);
 
         $this->linkMultipleSaver->process($user, Field::TEAMS, $saverParams);
         $this->linkMultipleSaver->process($user, 'portals', $saverParams);
@@ -402,31 +397,27 @@ class LdapLogin implements Login
         $user->setAsNotNew();
         $user->updateFetchedValues();
 
-        /** @var ?User */
-        return $this->entityManager->getEntityById(User::ENTITY_TYPE, $user->getId());
+        return $this->entityManager->getRDBRepositoryByClass(User::class)->getById($user->getId());
     }
 
     /**
-     * Find LDAP user DN by his username.
+     * Find LDAP user DN by their username.
      *
      * @throws LdapException
      */
     private function findLdapUserDnByUsername(string $username): ?string
     {
         $ldapClient = $this->getLdapClient();
-
         $options = $this->utils->getOptions();
 
-        $loginFilterString = '';
+        $filterString = !empty($options['userLoginFilter']) ?
+            $this->convertToFilterFormat($options['userLoginFilter']) : '';
 
-        if (!empty($options['userLoginFilter'])) {
-            $loginFilterString = $this->convertToFilterFormat($options['userLoginFilter']);
-        }
+        $objectClass = $options['userObjectClass'];
+        $attribute = $options['userNameAttribute'];
+        $usernameEscaped = $this->escapeUsernameFilter($username);
 
-        $searchString =
-            '(&(objectClass=' . $options['userObjectClass'] . ')' .
-            '(' . $options['userNameAttribute'] . '=' . $username . ')' .
-            $loginFilterString . ')';
+        $searchString = "(&(objectClass=$objectClass)($attribute=$usernameEscaped)$filterString)";
 
         /** @var array<int, array{dn: string}> $result */
         /** @noinspection PhpRedundantOptionalArgumentInspection */
@@ -435,12 +426,25 @@ class LdapLogin implements Login
         $this->log->debug("LDAP: user search string: {string}.", ['string' => $searchString]);
 
         foreach ($result as $item) {
-            return $item["dn"];
+            return $item['dn'];
         }
 
         return null;
     }
 
+    private function escapeUsernameFilter(string $username): string
+    {
+        $map = [
+            '\\' => '\\5c',
+            '*' => '\\2a',
+            '(' => '\\28',
+            ')' => '\\29',
+            "\x00" => '\\00',
+        ];
+
+        return strtr($username, $map);
+    }
+
     /**
      * Check and convert filter item into LDAP format.
      */

application/Espo/Core/Authentication/Login/DataBuilder.php

@@ -30,6 +30,7 @@
 namespace Espo\Core\Authentication\Login;
 
 use Espo\Core\Authentication\AuthToken\AuthToken;
+use SensitiveParameter;
 
 class DataBuilder
 {
@@ -44,7 +45,7 @@ class DataBuilder
         return $this;
     }
 
-    public function setPassword(?string $password): self
+    public function setPassword(#[SensitiveParameter] ?string $password): self
     {
         $this->password = $password;
 

application/Espo/Core/Authentication/Login/MetadataParams.php

@@ -30,7 +30,7 @@
 namespace Espo\Core\Authentication\Login;
 
 /**
- * @immutable
+ * Immutable.
  */
 class MetadataParams
 {

application/Espo/Core/Authentication/Logins/Hmac.php

@@ -50,7 +50,7 @@ class Hmac implements Login
     {
         $authString = base64_decode($request->getHeader('X-Hmac-Authorization') ?? '');
 
-        list($apiKey, $hash) = explode(':', $authString, 2);
+        [$apiKey, $hash] = explode(':', $authString, 2);
 
         if (!$apiKey) {
             return Result::fail(FailReason::WRONG_CREDENTIALS);

application/Espo/Core/Authentication/Logout/Params.php

@@ -30,7 +30,7 @@
 namespace Espo\Core\Authentication\Logout;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Params
 {

application/Espo/Core/Authentication/Logout/Result.php

@@ -30,7 +30,7 @@
 namespace Espo\Core\Authentication\Logout;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Result
 {

application/Espo/Core/Authentication/Oidc/ConfigDataProvider.php

@@ -104,6 +104,11 @@ class ConfigDataProvider
         return $this->object->get('oidcTokenEndpoint');
     }
 
+    public function getUserInfoEndpoint(): ?string
+    {
+        return $this->object->get('oidcUserInfoEndpoint');
+    }
+
     public function getJwksEndpoint(): ?string
     {
         return $this->object->get('oidcJwksEndpoint');

application/Espo/Core/Authentication/Oidc/KeysProvider.php

@@ -33,7 +33,7 @@ use Espo\Core\Authentication\Jwt\Exceptions\UnsupportedKey;
 use Espo\Core\Authentication\Jwt\Key;
 use Espo\Core\Authentication\Jwt\KeyFactory;
 use Espo\Core\Field\DateTime;
-use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Config\SystemConfig;
 use Espo\Core\Utils\DataCache;
 use Espo\Core\Utils\Json;
 use Espo\Core\Utils\Log;
@@ -48,10 +48,10 @@ class KeysProvider
 
     public function __construct(
         private DataCache $dataCache,
-        private Config $config,
         private ConfigDataProvider $configDataProvider,
         private KeyFactory $factory,
-        private Log $log
+        private Log $log,
+        private SystemConfig $systemConfig,
     ) {}
 
     /**
@@ -147,7 +147,7 @@ class KeysProvider
      */
     private function getRawFromCache(): ?array
     {
-        if (!$this->config->get('useCache')) {
+        if (!$this->systemConfig->useCache()) {
             return null;
         }
 
@@ -189,7 +189,7 @@ class KeysProvider
      */
     private function storeRawToCache(array $raw): void
     {
-        if (!$this->config->get('useCache')) {
+        if (!$this->systemConfig->useCache()) {
             return;
         }
 

application/Espo/Core/Authentication/Oidc/Login.php

@@ -38,6 +38,7 @@ use Espo\Core\Authentication\Logins\Espo;
 use Espo\Core\Authentication\Jwt\Exceptions\Invalid;
 use Espo\Core\Authentication\Jwt\Exceptions\SignatureNotVerified;
 use Espo\Core\Authentication\Jwt\Validator;
+use Espo\Core\Authentication\Oidc\UserProvider\UserInfo;
 use Espo\Core\Authentication\Result;
 use Espo\Core\Authentication\Result\FailReason;
 use Espo\Core\Utils\Json;
@@ -45,6 +46,7 @@ use Espo\Core\Utils\Log;
 use JsonException;
 use LogicException;
 use RuntimeException;
+use SensitiveParameter;
 use stdClass;
 
 class Login implements LoginInterface
@@ -62,7 +64,8 @@ class Login implements LoginInterface
         private Validator $validator,
         private TokenValidator $tokenValidator,
         private UserProvider $userProvider,
-        private ApplicationState $applicationState
+        private ApplicationState $applicationState,
+        private UserInfoDataProvider $userInfoDataProvider,
     ) {}
 
     public function login(Data $data, Request $request): Result
@@ -99,7 +102,8 @@ class Login implements LoginInterface
             throw new RuntimeException("No client secret.");
         }
 
-        [$rawToken, $failResult] = $this->requestToken($endpoint, $clientId, $code, $redirectUri, $clientSecret);
+        [$rawToken, $failResult, $accessToken] =
+            $this->requestToken($endpoint, $clientId, $code, $redirectUri, $clientSecret);
 
         if ($failResult) {
             return $failResult;
@@ -144,7 +148,9 @@ class Login implements LoginInterface
             return Result::fail(FailReason::DENIED);
         }
 
-        $user = $this->userProvider->get($tokenPayload);
+        $userInfo = $this->getUserInfo($tokenPayload, $accessToken);
+
+        $user = $this->userProvider->get($userInfo);
 
         if (!$user) {
             return Result::fail(FailReason::USER_NOT_FOUND);
@@ -198,7 +204,7 @@ class Login implements LoginInterface
     }
 
     /**
-     * @return array{?string, ?Result}
+     * @return array{?string, ?Result, ?string}
      */
     private function requestToken(
         string $endpoint,
@@ -250,7 +256,7 @@ class Login implements LoginInterface
 
             $this->log->warning(self::composeLogMessage('Token request error.', $status, $response));
 
-            return [null, Result::fail(FailReason::DENIED)];
+            return [null, Result::fail(FailReason::DENIED), null];
         }
 
         $parsedResponse = null;
@@ -266,6 +272,7 @@ class Login implements LoginInterface
         }
 
         $token = $parsedResponse->id_token ?? null;
+        $accessToken = $parsedResponse->access_token ?? null;
 
         if (!$token || !is_string($token)) {
             $this->log->error(self::composeLogMessage('Bad token response.', $status, $response));
@@ -273,7 +280,7 @@ class Login implements LoginInterface
             throw new RuntimeException();
         }
 
-        return [$token, null];
+        return [$token, null, $accessToken];
     }
 
     private static function composeLogMessage(string $text, ?int $status = null, ?string $response = null): string
@@ -295,4 +302,21 @@ class Login implements LoginInterface
         $this->tokenValidator->validateFields($token);
         $this->tokenValidator->validateSignature($token);
     }
+
+    private function getUserInfo(Token\Payload $payload, #[SensitiveParameter] ?string $accessToken): UserInfo
+    {
+        $endpoint = $this->configDataProvider->getUserInfoEndpoint();
+
+        if (!$endpoint) {
+            return new UserInfo($payload, []);
+        }
+
+        if (!$accessToken) {
+            throw new RuntimeException("OIDC: No access token received.");
+        }
+
+        $data = $this->userInfoDataProvider->get($accessToken);
+
+        return new UserInfo($payload, $data);
+    }
 }

application/Espo/Core/Authentication/Oidc/UserInfoDataProvider.php

@@ -0,0 +1,121 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Authentication\Oidc;
+
+use Espo\Core\Utils\Json;
+use Espo\Core\Utils\Log;
+use JsonException;
+use RuntimeException;
+use SensitiveParameter;
+
+class UserInfoDataProvider
+{
+    private const REQUEST_TIMEOUT = 10;
+
+    public function __construct(
+        private ConfigDataProvider $configDataProvider,
+        private Log $log,
+    ) {}
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function get(#[SensitiveParameter] string $accessToken): array
+    {
+        return $this->load($accessToken);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function load(#[SensitiveParameter] string $accessToken): array
+    {
+        $endpoint = $this->configDataProvider->getUserInfoEndpoint();
+
+        if (!$endpoint) {
+            throw new RuntimeException("No userinfo endpoint.");
+        }
+
+        $curl = curl_init();
+
+        curl_setopt_array($curl, [
+            CURLOPT_URL => $endpoint,
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_ENCODING => '',
+            CURLOPT_MAXREDIRS => 10,
+            CURLOPT_TIMEOUT => self::REQUEST_TIMEOUT,
+            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
+            CURLOPT_CUSTOMREQUEST => 'GET',
+            CURLOPT_PROTOCOLS => CURLPROTO_HTTPS | CURLPROTO_HTTP,
+            CURLOPT_HTTPHEADER => [
+                'Authorization: Bearer ' . $accessToken,
+                'Accept: application/json',
+            ],
+        ]);
+
+        /** @var string|false $response */
+        $response = curl_exec($curl);
+        $error = curl_error($curl);
+        $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
+
+        curl_close($curl);
+
+        if ($response === false) {
+            $response = '';
+        }
+
+        if ($error || is_int($status) && ($status >= 400 && $status < 500)) {
+            $this->log->error(self::composeLogMessage('UserInfo response error.', $status, $response));
+
+            throw new RuntimeException("OIDC: Userinfo request error.");
+        }
+
+        $parsedResponse = null;
+
+        try {
+            $parsedResponse = Json::decode($response, true);
+        } catch (JsonException) {}
+
+        if (!is_array($parsedResponse)) {
+            throw new RuntimeException("OIDC: Bad userinfo response.");
+        }
+
+        return $parsedResponse;
+    }
+
+    private static function composeLogMessage(string $text, ?int $status = null, ?string $response = null): string
+    {
+        if ($status === null) {
+            return "OIDC: $text";
+        }
+
+        return "OIDC: $text; Status: $status; Response: $response";
+    }
+}

application/Espo/Core/Authentication/Oidc/UserProvider.php

@@ -29,10 +29,10 @@
 
 namespace Espo\Core\Authentication\Oidc;
 
-use Espo\Core\Authentication\Jwt\Token\Payload;
+use Espo\Core\Authentication\Oidc\UserProvider\UserInfo;
 use Espo\Entities\User;
 
 interface UserProvider
 {
-    public function get(Payload $payload): ?User;
+    public function get(UserInfo $userInfo): ?User;
 }

application/Espo/Core/Authentication/Oidc/UserProvider/DefaultUserProvider.php

@@ -30,11 +30,11 @@
 namespace Espo\Core\Authentication\Oidc\UserProvider;
 
 use Espo\Core\ApplicationState;
-use Espo\Core\Authentication\Jwt\Token\Payload;
 use Espo\Core\Authentication\Oidc\ConfigDataProvider;
 use Espo\Core\Authentication\Oidc\UserProvider;
 use Espo\Core\Utils\Log;
 use Espo\Entities\User;
+
 use RuntimeException;
 
 class DefaultUserProvider implements UserProvider
@@ -44,30 +44,30 @@ class DefaultUserProvider implements UserProvider
         private Sync $sync,
         private UserRepository $userRepository,
         private ApplicationState $applicationState,
-        private Log $log
+        private Log $log,
     ) {}
 
-    public function get(Payload $payload): ?User
+    public function get(UserInfo $userInfo): ?User
     {
-        $user = $this->findUser($payload);
+        $user = $this->findUser($userInfo);
 
         if ($user === false) {
             return null;
         }
 
         if ($user) {
-            $this->syncUser($user, $payload);
+            $this->syncUser($user, $userInfo);
 
             return $user;
         }
 
-        return $this->tryToCreateUser($payload);
+        return $this->tryToCreateUser($userInfo);
     }
 
     /**
      * @return User|false|null
      */
-    private function findUser(Payload $payload): User|bool|null
+    private function findUser(UserInfo $userInfo): User|bool|null
     {
         $usernameClaim = $this->configDataProvider->getUsernameClaim();
 
@@ -75,10 +75,10 @@ class DefaultUserProvider implements UserProvider
             throw new RuntimeException("No username claim in config.");
         }
 
-        $username = $payload->get($usernameClaim);
+        $username = $userInfo->get($usernameClaim);
 
         if (!$username) {
-            throw new RuntimeException("No username claim `$usernameClaim` in token.");
+            throw new RuntimeException("No username claim `$usernameClaim` in token and userinfo.");
         }
 
         $username = $this->sync->normalizeUsername($username);
@@ -136,7 +136,7 @@ class DefaultUserProvider implements UserProvider
         return $user;
     }
 
-    private function tryToCreateUser(Payload $payload): ?User
+    private function tryToCreateUser(UserInfo $userInfo): ?User
     {
         if (!$this->configDataProvider->createUser()) {
             return null;
@@ -148,16 +148,16 @@ class DefaultUserProvider implements UserProvider
             throw new RuntimeException("Could not create a user. No OIDC username claim in config.");
         }
 
-        $username = $payload->get($usernameClaim);
+        $username = $userInfo->get($usernameClaim);
 
         if (!$username) {
-            throw new RuntimeException("Could not create a user. No username claim returned in token.");
+            throw new RuntimeException("Could not create a user. No username claim in token and userinfo.");
         }
 
-        return $this->sync->createUser($payload);
+        return $this->sync->createUser($userInfo);
     }
 
-    private function syncUser(User $user, Payload $payload): void
+    private function syncUser(User $user, UserInfo $userInfo): void
     {
         if (
             !$this->configDataProvider->sync() &&
@@ -166,6 +166,6 @@ class DefaultUserProvider implements UserProvider
             return;
         }
 
-        $this->sync->syncUser($user, $payload);
+        $this->sync->syncUser($user, $userInfo);
     }
 }

application/Espo/Core/Authentication/Oidc/UserProvider/Sync.php

@@ -31,7 +31,6 @@ namespace Espo\Core\Authentication\Oidc\UserProvider;
 
 use Espo\Core\Acl\Cache\Clearer as AclCacheClearer;
 use Espo\Core\ApplicationState;
-use Espo\Core\Authentication\Jwt\Token\Payload;
 use Espo\Core\Authentication\Oidc\ConfigDataProvider;
 use Espo\Core\Field\LinkMultiple;
 use Espo\Core\Name\Field;
@@ -50,30 +49,31 @@ class Sync
         private UserRepository $userRepository,
         private PasswordHash $passwordHash,
         private AclCacheClearer $aclCacheClearer,
-        private ApplicationState $applicationState
+        private ApplicationState $applicationState,
     ) {}
 
-    public function createUser(Payload $payload): User
+    public function createUser(UserInfo $userInfo): User
     {
-        $username = $this->getUsernameFromToken($payload);
+        $username = $this->getUsernameFromToken($userInfo);
 
         $this->usernameValidator->validate($username);
 
         $user = $this->userRepository->getNew();
 
-        $user->set([
-            'type' => User::TYPE_REGULAR,
-            'userName' => $username,
+        $user->setType(User::TYPE_REGULAR);
+        $user->setUserName($username);
+
+        $user->setMultiple([
             'password' => $this->passwordHash->hash(Util::generatePassword(10, 4, 2, true)),
         ]);
 
-        $user->set($this->getUserDataFromToken($payload));
-        $user->set($this->getUserTeamsDataFromToken($payload));
+        $user->set($this->getUserDataFromToken($userInfo));
+        $user->set($this->getUserTeamsDataFromToken($userInfo));
 
         if ($this->applicationState->isPortal()) {
             $portalId = $this->applicationState->getPortalId();
 
-            $user->set('type', User::TYPE_PORTAL);
+            $user->setType(User::TYPE_PORTAL);
             $user->setPortals(LinkMultiple::create()->withAddedId($portalId));
         }
 
@@ -82,7 +82,7 @@ class Sync
         return $user;
     }
 
-    public function syncUser(User $user, Payload $payload): void
+    public function syncUser(User $user, UserInfo $payload): void
     {
         $username = $this->getUsernameFromToken($payload);
 
@@ -116,19 +116,19 @@ class Sync
     /**
      * @return array<string, mixed>
      */
-    private function getUserDataFromToken(Payload $payload): array
+    private function getUserDataFromToken(UserInfo $userInfo): array
     {
         return [
-            'emailAddress' => $payload->get('email'),
-            'phoneNumber' => $payload->get('phone_number'),
+            'emailAddress' => $userInfo->get('email'),
+            'phoneNumber' => $userInfo->get('phone_number'),
             'emailAddressData' => null,
             'phoneNumberData' => null,
-            'firstName' => $payload->get('given_name'),
-            'lastName' => $payload->get('family_name'),
-            'middle_name' => $payload->get('middle_name'),
+            'firstName' => $userInfo->get('given_name'),
+            'lastName' => $userInfo->get('family_name'),
+            'middle_name' => $userInfo->get('middle_name'),
             'gender' =>
-                in_array($payload->get('gender'), ['male', 'female']) ?
-                    ucfirst($payload->get('gender') ?? '') :
+                in_array($userInfo->get('gender'), ['male', 'female']) ?
+                    ucfirst($userInfo->get('gender') ?? '') :
                     null,
         ];
     }
@@ -136,14 +136,14 @@ class Sync
     /**
      * @return array<string, mixed>
      */
-    private function getUserTeamsDataFromToken(Payload $payload): array
+    private function getUserTeamsDataFromToken(UserInfo $userInfo): array
     {
         return [
-            'teamsIds' => $this->getTeamIdList($payload),
+            'teamsIds' => $this->getTeamIdList($userInfo),
         ];
     }
 
-    private function getUsernameFromToken(Payload $payload): string
+    private function getUsernameFromToken(UserInfo $userInfo): string
     {
         $usernameClaim = $this->configDataProvider->getUsernameClaim();
 
@@ -151,7 +151,7 @@ class Sync
             throw new RuntimeException("No OIDC username claim in config.");
         }
 
-        $username = $payload->get($usernameClaim);
+        $username = $userInfo->get($usernameClaim);
 
         if (!$username) {
             throw new RuntimeException("No username claim returned in token.");
@@ -167,7 +167,7 @@ class Sync
     /**
      * @return string[]
      */
-    private function getTeamIdList(Payload $payload): array
+    private function getTeamIdList(UserInfo $userInfo): array
     {
         $idList = $this->configDataProvider->getTeamIds() ?? [];
         $columns = $this->configDataProvider->getTeamColumns() ?? (object) [];
@@ -176,7 +176,7 @@ class Sync
             return [];
         }
 
-        $groupList = $this->getGroups($payload);
+        $groupList = $this->getGroups($userInfo);
 
         $resultIdList = [];
 
@@ -194,7 +194,7 @@ class Sync
     /**
      * @return string[]
      */
-    private function getGroups(Payload $payload): array
+    private function getGroups(UserInfo $userInfo): array
     {
         $groupClaim = $this->configDataProvider->getGroupClaim();
 
@@ -202,7 +202,7 @@ class Sync
             return [];
         }
 
-        $value = $payload->get($groupClaim);
+        $value = $userInfo->get($groupClaim);
 
         if (!$value) {
             return [];

application/Espo/Core/Authentication/Oidc/UserProvider/UserInfo.php

@@ -0,0 +1,49 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Authentication\Oidc\UserProvider;
+
+use Espo\Core\Authentication\Jwt\Token\Payload;
+
+class UserInfo
+{
+    /**
+     * @internal
+     * @param array<string, mixed> $data
+     */
+    public function __construct(
+        private Payload $payload,
+        private array $data,
+    ) {}
+
+    public function get(string $name): mixed
+    {
+        return $this->payload->get($name) ?? $this->data[$name] ?? null;
+    }
+}

application/Espo/Core/Authentication/Result.php

@@ -37,7 +37,7 @@ use stdClass;
 /**
  * An authentication result.
  *
- * @immutable
+ * Immutable.
  */
 class Result
 {

application/Espo/Core/Authentication/Result/Data.php

@@ -32,7 +32,7 @@ namespace Espo\Core\Authentication\Result;
 use stdClass;
 
 /**
- * @immutable
+ * Immutable.
  */
 class Data
 {

application/Espo/Core/Binding/ContextualBinder.php

@@ -75,7 +75,7 @@ class ContextualBinder
      *
      * @template T of object
      * @param class-string<T>|NamedClassKey<T> $key An interface or interface with a parameter name.
-     * @param class-string<T> $serviceName A service name.
+     * @param string $serviceName A service name.
      */
     public function bindService(string|NamedClassKey $key, string $serviceName): self
     {

application/Espo/Core/Binding/EspoBindingLoader.php

@@ -73,6 +73,7 @@ class EspoBindingLoader implements BindingLoader
 
     private function loadCustom(Binder $binder): void
     {
+        /** @var class-string<BindingProcessor>|string $className */
         $className = 'Espo\\Custom\\Binding';
 
         if (!class_exists($className)) {

application/Espo/Core/Console/Command/Params.php

@@ -34,7 +34,7 @@ use Espo\Core\Utils\Util;
 /**
  * Command parameters.
  *
- * @immutable
+ * Immutable.
  */
 class Params
 {

application/Espo/Core/Console/Commands/Extension.php

@@ -248,11 +248,10 @@ class Extension implements Command
     private function printList(IO $io): void
     {
         $collection = $this->entityManager
-            ->getRDBRepository(ExtensionEntity::ENTITY_TYPE)
+            ->getRDBRepositoryByClass(ExtensionEntity::class)
             ->find();
 
-        /** @noinspection PhpParamsInspection */
-        $count = is_countable($collection) ? count($collection) : iterator_count($collection);
+        $count = count($collection);
 
         /** @noinspection PhpIfWithCommonPartsInspection */
         if ($count === 0) {
@@ -268,9 +267,9 @@ class Extension implements Command
         $io->writeLine("");
 
         foreach ($collection as $extension) {
-            $isInstalled = $extension->get('isInstalled');
+            $isInstalled = $extension->isInstalled();
 
-            $io->writeLine(' Name: ' . $extension->get(Field::NAME));
+            $io->writeLine(' Name: ' . $extension->getName());
             $io->writeLine(' ID: ' . $extension->getId());
             $io->writeLine(' Version: ' . $extension->getVersion());
             $io->writeLine(' Installed: ' . ($isInstalled ? 'yes' : 'no'));

application/Espo/Core/Console/Commands/Upgrade.php

@@ -151,6 +151,8 @@ class Upgrade implements Command
             if (!$packageFile) {
                 fwrite(STDOUT, "Error: Unable to download upgrade package.\n");
 
+                $io->setExitStatus(1);
+
                 return;
             }
         }
@@ -177,6 +179,8 @@ class Upgrade implements Command
 
             fwrite(STDOUT, $errorMessage . "\n");
 
+            $io->setExitStatus(1);
+
             return;
         }
 
@@ -491,13 +495,19 @@ class Upgrade implements Command
             return null;
         }
 
-        /** @var string */
-        return realpath($localFilePath);
+        $path = realpath($localFilePath);
+
+        assert($path !== false);
+
+        return $path;
     }
 
     private function isShellEnabled(): bool
     {
-        if (!function_exists('exec') || !is_callable('shell_exec')) {
+        if (
+            !function_exists('exec') ||
+            !is_callable('shell_exec') /** @phpstan-ignore-line */
+        ) {
             return false;
         }
 
@@ -512,7 +522,7 @@ class Upgrade implements Command
 
     private function getCurrentVersion(): ?string
     {
-        $configData = include "data/config.php";
+        $configData = include "data/config.php"; /** @phpstan-ignore-line */
 
         if (!$configData) {
             return null;

application/Espo/Core/Console/Commands/Version.php

@@ -36,16 +36,12 @@ use Espo\Core\Utils\Config;
 
 class Version implements Command
 {
-    public function __construct(private Config $config)
+    public function __construct(private Config\SystemConfig $config)
     {}
 
     public function run(Params $params, IO $io): void
     {
-        $version = $this->config->get('version');
-
-        if (is_null($version)) {
-            return;
-        }
+        $version = $this->config->getVersion();
 
         $io->writeLine($version);
     }

application/Espo/Core/Container.php

@@ -187,13 +187,19 @@ class Container implements ContainerInterface
         }
 
         if ($id === self::ID_CONTAINER) {
-            $this->classCache[$id] = new ReflectionClass(Container::class);
+            /** @var ReflectionClass<object> $object */
+            $object = new ReflectionClass(Container::class);
+
+            $this->classCache[$id] = $object;
 
             return;
         }
 
         if ($id === self::ID_INJECTABLE_FACTORY) {
-            $this->classCache[$id] = new ReflectionClass(InjectableFactory::class);
+            /** @var ReflectionClass<object> $object */
+            $object = new ReflectionClass(InjectableFactory::class);
+
+            $this->classCache[$id] = $object;
 
             return;
         }

application/Espo/Core/Container/ContainerBuilder.php

@@ -168,12 +168,14 @@ class ContainerBuilder
             )
         );
 
+        /** @var FileManager $fileManager */
         $fileManager = $this->services['fileManager'] ?? (
             new $this->fileManagerClassName(
                 $config->get('defaultPermissions')
             )
         );
 
+        /** @var DataCache $dataCache */
         $dataCache = $this->services['dataCache'] ?? (
             new $this->dataCacheClassName($fileManager)
         );
@@ -185,10 +187,13 @@ class ContainerBuilder
             new $this->moduleClassName($fileManager, $dataCache, $useCache)
         );
 
+        $systemConfig = new Config\SystemConfig($config);
+
         $this->services['config'] = $config;
         $this->services['fileManager'] = $fileManager;
         $this->services['dataCache'] = $dataCache;
         $this->services['module'] = $module;
+        $this->services['systemConfig'] = $systemConfig;
 
         $bindingLoader = $this->bindingLoader ?? (
             new EspoBindingLoader($module)

application/Espo/Core/Container/ContainerConfiguration.php

@@ -39,8 +39,8 @@ class ContainerConfiguration implements Configuration
 {
     /**
      * Log must be loaded before anything.
-     * @phpstan-ignore-next-line
      * @noinspection PhpPropertyOnlyWrittenInspection
+     * @phpstan-ignore-next-line
      */
     private Log $log;
 

application/Espo/Core/Controllers/Base.php

@@ -63,12 +63,12 @@ abstract class Base
     private $container;
 
     /**
-     * @var User;
+     * @var User
      */
     protected $user;
 
     /**
-     * @var Acl;
+     * @var Acl
      */
     protected $acl;
 
@@ -161,12 +161,11 @@ abstract class Base
     }
 
     /**
-     * @return void;
+     * @return void
      * @deprecated
      */
     protected function checkControllerAccess()
     {
-        return;
     }
 
     /**

application/Espo/Core/Controllers/Record.php

@@ -31,7 +31,6 @@ namespace Espo\Core\Controllers;
 
 use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Api\Request;
-use Espo\Core\Exceptions\Error;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Exceptions\NotFound;
 use Espo\Core\Exceptions\NotFoundSilent;
@@ -65,12 +64,9 @@ class Record extends RecordBase
 
         $searchParams = $this->fetchSearchParamsFromRequest($request);
 
-        $recordCollection = $this->getRecordService()->findLinked($id, $link, $searchParams);
+        $result = $this->getRecordService()->findLinked($id, $link, $searchParams);
 
-        return (object) [
-            'total' => $recordCollection->getTotal(),
-            'list' => $recordCollection->getValueMapList(),
-        ];
+        return $result->toApiOutput();
     }
 
     /**

application/Espo/Core/Controllers/RecordBase.php

@@ -40,6 +40,7 @@ use Espo\Core\Record\ServiceContainer as RecordServiceContainer;
 use Espo\Core\Record\SearchParamsFetcher;
 use Espo\Core\Record\CreateParamsFetcher;
 use Espo\Core\Record\ReadParamsFetcher;
+use Espo\Core\Record\UpdateContext;
 use Espo\Core\Record\UpdateParamsFetcher;
 use Espo\Core\Record\DeleteParamsFetcher;
 use Espo\Core\Record\FindParamsFetcher;
@@ -222,8 +223,16 @@ class RecordBase extends Base implements
 
         $params = $this->updateParamsFetcher->fetch($request);
 
+        $context = new UpdateContext();
+
+        $params = $params->withContext($context);
+
         $entity = $this->getRecordService()->update($id, $data, $params);
 
+        if ($context->linkUpdated) {
+            $response->setHeader('X-Record-Link-Updated', 'true');
+        }
+
         return $entity->getValueMap();
     }
 
@@ -246,10 +255,7 @@ class RecordBase extends Base implements
 
         $recordCollection = $this->getRecordService()->find($searchParams, $findParams);
 
-        return (object) [
-            'total' => $recordCollection->getTotal(),
-            'list' => $recordCollection->getValueMapList(),
-        ];
+        return $recordCollection->toApiOutput();
     }
 
     /**

application/Espo/Core/Controllers/RecordTree.php

@@ -63,15 +63,12 @@ class RecordTree extends Record
             return (object) $this->actionListTree($request->getRouteParams(), $request->getParsedBody(), $request);
         }
 
-        $where = $request->getQueryParams()['where'] ?? null;
+        $selectParams = $this->fetchSearchParamsFromRequest($request);
+
         $parentId = $request->getQueryParam('parentId');
         $maxDepth = $request->getQueryParam('maxDepth');
         $onlyNotEmpty = (bool) $request->getQueryParam('onlyNotEmpty');
 
-        if ($where !== null && !is_array($where)) {
-            throw new BadRequest();
-        }
-
         if ($maxDepth !== null) {
             $maxDepth = (int) $maxDepth;
         }
@@ -79,7 +76,7 @@ class RecordTree extends Record
         $collection = $this->getRecordTreeService()->getTree(
             $parentId,
             [
-                'where' => $where,
+                'where' => $selectParams->getWhere(),
                 'onlyNotEmpty' => $onlyNotEmpty,
             ],
             $maxDepth

application/Espo/Core/Currency/CalculatorUtil.php

@@ -35,6 +35,11 @@ class CalculatorUtil
 {
     private const SCALE = 14;
 
+    /**
+     * @param numeric-string $arg1
+     * @param numeric-string $arg2
+     * @return numeric-string
+     */
     public static function add(string $arg1, string $arg2): string
     {
         if (!function_exists('bcadd')) {
@@ -50,6 +55,11 @@ class CalculatorUtil
         );
     }
 
+    /**
+     * @param numeric-string $arg1
+     * @param numeric-string $arg2
+     * @return numeric-string
+     */
     public static function subtract(string $arg1, string $arg2): string
     {
         if (!function_exists('bcsub')) {
@@ -65,6 +75,11 @@ class CalculatorUtil
         );
     }
 
+    /**
+     * @param numeric-string $arg1
+     * @param numeric-string $arg2
+     * @return numeric-string
+     */
     public static function multiply(string $arg1, string $arg2): string
     {
         if (!function_exists('bcmul')) {
@@ -80,6 +95,11 @@ class CalculatorUtil
         );
     }
 
+    /**
+     * @param numeric-string $arg1
+     * @param numeric-string $arg2
+     * @return numeric-string
+     */
     public static function divide(string $arg1, string $arg2): string
     {
         if (!function_exists('bcdiv')) {
@@ -88,20 +108,23 @@ class CalculatorUtil
             );
         }
 
-        /** @var ?string $result */
         $result = bcdiv(
             $arg1,
             $arg2,
             self::SCALE
         );
 
-        if ($result === null) {
+        if ($result === null) { /** @phpstan-ignore-line  */
             throw new DivisionByZeroError();
         }
 
         return $result;
     }
 
+    /**
+     * @param numeric-string $arg
+     * @return numeric-string
+     */
     public static function round(string $arg, int $precision = 0): string
     {
         if (!function_exists('bcadd')) {
@@ -114,6 +137,8 @@ class CalculatorUtil
             $addition = '-' . $addition;
         }
 
+        assert(is_numeric($addition));
+
         return bcadd(
             $arg,
             $addition,
@@ -121,6 +146,10 @@ class CalculatorUtil
         );
     }
 
+    /**
+     * @param numeric-string $arg1
+     * @param numeric-string $arg2
+     */
     public static function compare(string $arg1, string $arg2): int
     {
         if (!function_exists('bccomp')) {

application/Espo/Core/Currency/Converter.php

@@ -100,6 +100,10 @@ class Converter
         return $this->convert($value, $targetCurrencyCode);
     }
 
+    /**
+     * @param numeric-string $amount
+     * @return numeric-string
+     */
     private function convertAmount(string $amount, float $rate, float $targetRate): string
     {
         return CalculatorUtil::divide(

application/Espo/Core/Di/CryptSetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\Utils\Crypt;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait CryptSetter
 {
     /**

application/Espo/Core/Di/DataManagerSetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\DataManager;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait DataManagerSetter
 {
     /**

application/Espo/Core/Di/EmailSenderSetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\Mail\EmailSender as EmailSender;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait EmailSenderSetter
 {
     /**

application/Espo/Core/Di/HtmlizerFactorySetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\Htmlizer\HtmlizerFactory as HtmlizerFactory;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait HtmlizerFactorySetter
 {
     /**

application/Espo/Core/Di/LanguageSetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\Utils\Language;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait LanguageSetter
 {
     /**

application/Espo/Core/Di/PreferencesSetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Entities\Preferences;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait PreferencesSetter
 {
     /**

application/Espo/Core/Di/SelectManagerFactorySetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\Select\SelectManagerFactory;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait SelectManagerFactorySetter
 {
     /**

application/Espo/Core/Di/TemplateFileManagerSetter.php

@@ -31,6 +31,9 @@ namespace Espo\Core\Di;
 
 use Espo\Core\Utils\TemplateFileManager;
 
+/**
+ * @phpstan-ignore-next-line
+ */
 trait TemplateFileManagerSetter
 {
     /**