diff --git a/VueApp/src/CAHFS/router/index.ts b/VueApp/src/CAHFS/router/index.ts
index 1ee7424d1..bf695865a 100644
--- a/VueApp/src/CAHFS/router/index.ts
+++ b/VueApp/src/CAHFS/router/index.ts
@@ -1,4 +1,4 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
+import { createSpaRouter } from "@/shared/create-spa-router"
 import { routes } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 import { checkHasOnePermission } from "@/composables/CheckPagePermission"
diff --git a/VueApp/src/CMS/__tests__/cms-home.test.ts b/VueApp/src/CMS/__tests__/cms-home.test.ts
new file mode 100644
index 000000000..f892de107
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/cms-home.test.ts
@@ -0,0 +1,140 @@
+import CmsHome from "@/CMS/pages/CmsHome.vue"
+import { useUserStore } from "@/store/UserStore"
+import { mountCms, flushPromises } from "./test-utils"
+
+// The hub checks the trash for files nearing the purge cutoff (file managers only).
+const getMock = vi.fn<(...args: unknown[]) => Promise<{ success: boolean; result: unknown[] }>>(() =>
+    Promise.resolve({ success: true, result: [] }),
+)
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: getMock,
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+function trashedFile(friendlyName: string, purgeOn: string) {
+    return { fileGuid: `g-${friendlyName}`, friendlyName, purgeOn, deletedOn: "2024-01-01T00:00:00" }
+}
+
+function daysFromNow(days: number): string {
+    return new Date(Date.now() + days * 24 * 60 * 60 * 1000).toISOString()
+}
+
+/**
+ * CmsHome is the permission-gated hub: each tool card (and each action inside a card) only shows
+ * when the user holds one of its permissions, the recent-activity rail mirrors the manage
+ * permissions, and users with no CMS access get an explanatory banner instead. RecentActivity is
+ * stubbed (it fetches its own data); these tests only assert which props gate its panels.
+ */
+
+const recentActivityStub = {
+    name: "RecentActivity",
+    props: ["showBlocks", "showFiles", "showLeftNavs"],
+    template: "<div class='recent-activity-stub' />",
+}
+
+// MountCms seeds the full CMS admin permission set; narrower personas are applied afterwards
+// through the same user store the page reads reactively.
+async function mountHome(permissions?: string[]) {
+    const wrapper = mountCms(CmsHome, { global: { stubs: { RecentActivity: recentActivityStub } } })
+    if (permissions) {
+        useUserStore().setPermissions(permissions)
+        await flushPromises()
+    }
+    await flushPromises()
+    return wrapper
+}
+
+function actionLabels(wrapper: Awaited<ReturnType<typeof mountHome>>): string[] {
+    return wrapper.findAllComponents({ name: "QBtn" }).map((b) => b.props("label") as string)
+}
+
+describe("cmsHome.vue - permission-gated sections", () => {
+    it("shows every tool card and the full activity rail for a CMS admin", async () => {
+        const wrapper = await mountHome()
+
+        // One box per left-nav group, in the nav's order (Link Collections is an action
+        // inside Content Blocks, mirroring CmsNavMenu.cs).
+        // h2 text includes the leading icon ligature name in happy-dom, hence stringContaining.
+        expect(wrapper.findAll("h2").map((h) => h.text())).toStrictEqual([
+            expect.stringContaining("Content Blocks"),
+            expect.stringContaining("Files"),
+            expect.stringContaining("Left Navigation"),
+        ])
+        expect(actionLabels(wrapper)).toContain("Manage Link Collections")
+        const rail = wrapper.findComponent({ name: "RecentActivity" })
+        expect(rail.props("showBlocks")).toBeTruthy()
+        expect(rail.props("showFiles")).toBeTruthy()
+        expect(rail.props("showLeftNavs")).toBeTruthy()
+    })
+
+    it("shows a create-only user just the Content Blocks card with only the Add action", async () => {
+        const wrapper = await mountHome(["SVMSecure.CMS", "SVMSecure.CMS.CreateContentBlock"])
+
+        expect(wrapper.text()).toContain("Content Blocks")
+        expect(wrapper.text()).not.toContain("Link Collections")
+        expect(wrapper.text()).not.toContain("Left Navigation")
+        // Manage/History require ManageContentBlocks even inside a visible section.
+        expect(actionLabels(wrapper)).toStrictEqual(["Add Content Block"])
+        // No manage permission at all: the activity rail is hidden entirely.
+        expect(wrapper.findComponent({ name: "RecentActivity" }).exists()).toBeFalsy()
+    })
+
+    it("shows a files-only user the Files card, including the pre-filtered Trash deep-link", async () => {
+        const wrapper = await mountHome(["SVMSecure.CMS", "SVMSecure.CMS.AllFiles"])
+
+        expect(actionLabels(wrapper)).toStrictEqual(["Manage Files", "Add File", "Audit Trail", "Trash"])
+        const addFile = wrapper.findAllComponents({ name: "QBtn" }).find((b) => b.props("label") === "Add File")!
+        expect(addFile.props("to")).toStrictEqual({ name: "CmsFiles", query: { upload: "1" } })
+        const trash = wrapper.findAllComponents({ name: "QBtn" }).find((b) => b.props("label") === "Trash")!
+        expect(trash.props("to")).toStrictEqual({ name: "CmsFiles", query: { status: "deleted" } })
+
+        const rail = wrapper.findComponent({ name: "RecentActivity" })
+        expect(rail.props("showFiles")).toBeTruthy()
+        expect(rail.props("showBlocks")).toBeFalsy()
+        expect(rail.props("showLeftNavs")).toBeFalsy()
+    })
+
+    it("warns file managers when trashed files purge within a week, linking to the Trash", async () => {
+        getMock.mockResolvedValueOnce({
+            success: true,
+            result: [
+                trashedFile("soon.pdf", daysFromNow(2)),
+                trashedFile("soon2.pdf", daysFromNow(6)),
+                trashedFile("later.pdf", daysFromNow(20)),
+            ],
+        })
+        const wrapper = await mountHome()
+
+        expect(wrapper.text()).toContain("2 trashed files will be permanently deleted within 7 days.")
+        expect(wrapper.find("a[href*='status=deleted']").exists()).toBeTruthy()
+        const trashFetch = getMock.mock.calls
+            .map((c) => c[0] as unknown as string)
+            .find((u) => u.includes("status=deleted"))!
+        expect(trashFetch).toContain("sortBy=deletedOn")
+        expect(trashFetch).toContain("descending=false")
+    })
+
+    it("shows no purge warning when nothing in the trash purges soon", async () => {
+        getMock.mockResolvedValueOnce({ success: true, result: [trashedFile("later.pdf", daysFromNow(20))] })
+        const wrapper = await mountHome()
+
+        expect(wrapper.text()).not.toContain("permanently deleted within")
+    })
+
+    it("tells a user with no CMS tool permissions that they have no access", async () => {
+        const wrapper = await mountHome(["SVMSecure.CMS"])
+
+        expect(wrapper.text()).toContain("Your account does not have access to any CMS tools.")
+        expect(wrapper.findAllComponents({ name: "QBtn" })).toHaveLength(0)
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/content-block-edit-diff.test.ts b/VueApp/src/CMS/__tests__/content-block-edit-diff.test.ts
new file mode 100644
index 000000000..6d6418450
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/content-block-edit-diff.test.ts
@@ -0,0 +1,166 @@
+import ContentBlockEdit from "@/CMS/pages/ContentBlockEdit.vue"
+import { mountCms, flushPromises, createTestRouter } from "./test-utils"
+
+/**
+ * Diff additions to ContentBlockEdit: selecting a version only sets selectedHistory (it no longer
+ * auto-loads), the "Diff vs current" / "Load into editor" buttons are disabled until a version is
+ * selected, and diffAgainstCurrent POSTs the editor's CURRENT content to the diff endpoint, opens
+ * ContentDiffDialog with the returned HTML, and notifies + closes on failure. Mock ViperFetch.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+const mockPut = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        post: (...args: unknown[]) => mockPost(...args),
+        put: (...args: unknown[]) => mockPut(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const BLOCK = {
+    contentBlockId: 7,
+    content: "<p>current editor content</p>",
+    title: "Welcome",
+    system: "Viper",
+    application: null,
+    page: null,
+    viperSectionPath: null,
+    blockOrder: 1,
+    friendlyName: "welcome",
+    allowPublicAccess: false,
+    modifiedOn: "2024-03-01T12:00:00",
+    modifiedBy: "editor",
+    deletedOn: null,
+    permissions: [],
+    files: [],
+}
+
+const HISTORY = [
+    { contentHistoryId: 91, modifiedOn: "2024-02-01T10:00:00", modifiedBy: "bob" },
+    { contentHistoryId: 92, modifiedOn: "2024-01-01T09:00:00", modifiedBy: "amy" },
+]
+
+function routeGet() {
+    mockGet.mockReset()
+    mockPost.mockReset()
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("/section-paths")) {
+            return Promise.resolve({ success: true, result: [] })
+        }
+        if (url.includes("/history")) {
+            return Promise.resolve({ success: true, result: HISTORY })
+        }
+        // The single-block load (.../content/7).
+        return Promise.resolve({ success: true, result: { ...BLOCK } })
+    })
+}
+
+// QEditor relies on document.execCommand and rich-text DOM that happy-dom lacks; stub it with a
+// minimal v-model textarea so block.content still binds without exercising the real editor.
+const qEditorStub = {
+    name: "QEditor",
+    props: ["modelValue"],
+    emits: ["update:modelValue"],
+    methods: {
+        getContentEl() {
+            return null
+        },
+    },
+    template: `<textarea :value="modelValue" @input="$emit('update:modelValue', $event.target.value)" />`,
+}
+
+async function mountEdit() {
+    const router = createTestRouter()
+    await router.push({ name: "CmsContentBlockEdit", params: { id: "7" } })
+    await router.isReady()
+    const wrapper = mountCms(ContentBlockEdit, { global: { stubs: { QEditor: qEditorStub } } }, router)
+    await flushPromises()
+    await flushPromises()
+    return wrapper
+}
+
+function diffButton(wrapper: Awaited<ReturnType<typeof mountEdit>>) {
+    return wrapper.findAllComponents({ name: "QBtn" }).find((b) => b.text().includes("Diff vs current"))!
+}
+function loadButton(wrapper: Awaited<ReturnType<typeof mountEdit>>) {
+    return wrapper.findAllComponents({ name: "QBtn" }).find((b) => b.text().includes("Load into editor"))!
+}
+function historySelect(wrapper: Awaited<ReturnType<typeof mountEdit>>) {
+    // The version-history select is the one labeled "Select a previous version".
+    return wrapper.findAllComponents({ name: "QSelect" }).find((s) => s.props("label") === "Select a previous version")!
+}
+
+describe("ContentBlockEdit.vue - history selection gating", () => {
+    beforeEach(() => routeGet())
+
+    it("renders the diff/load buttons disabled until a version is selected", async () => {
+        const wrapper = await mountEdit()
+        expect(diffButton(wrapper).props("disable")).toBeTruthy()
+        expect(loadButton(wrapper).props("disable")).toBeTruthy()
+    })
+
+    it("selecting a version only sets selectedHistory and does not fetch that version", async () => {
+        const wrapper = await mountEdit()
+        const getCallsBefore = mockGet.mock.calls.length
+        historySelect(wrapper).vm.$emit("update:modelValue", HISTORY[0])
+        await flushPromises()
+        // No extra GET for the version content; the buttons just enable.
+        expect(mockGet.mock.calls.length).toBe(getCallsBefore)
+        expect(diffButton(wrapper).props("disable")).toBeFalsy()
+        expect(loadButton(wrapper).props("disable")).toBeFalsy()
+    })
+})
+
+describe("ContentBlockEdit.vue - diffAgainstCurrent", () => {
+    beforeEach(() => routeGet())
+
+    it("POSTs the current editor content to the diff endpoint and opens the dialog with the result", async () => {
+        mockPost.mockResolvedValue({
+            success: true,
+            result: { content: "<ins>new</ins>", hasComparison: true, hasChanges: true },
+        })
+        const wrapper = await mountEdit()
+        historySelect(wrapper).vm.$emit("update:modelValue", HISTORY[0])
+        await flushPromises()
+
+        await diffButton(wrapper).trigger("click")
+        await flushPromises()
+
+        expect(mockPost).toHaveBeenCalledOnce()
+        const [url, payload] = mockPost.mock.calls[0]!
+        expect(url).toContain("CMS/content/7/history/91/diff")
+        // The CURRENT editor content is posted (so unsaved edits are diffed).
+        expect(payload).toEqual({ content: "<p>current editor content</p>" })
+
+        const dialog = wrapper.findComponent({ name: "ContentDiffDialog" })
+        expect(dialog.props("modelValue")).toBeTruthy()
+        expect(dialog.props("diffHtml")).toContain("new")
+        expect(dialog.props("subtitle")).toContain("to your current editor content")
+    })
+
+    it("notifies and closes the diff dialog when the diff POST fails", async () => {
+        mockPost.mockResolvedValue({ success: false, errors: ["diff failed"] })
+        const wrapper = await mountEdit()
+        historySelect(wrapper).vm.$emit("update:modelValue", HISTORY[0])
+        await flushPromises()
+
+        await diffButton(wrapper).trigger("click")
+        await flushPromises()
+
+        const dialog = wrapper.findComponent({ name: "ContentDiffDialog" })
+        expect(dialog.props("modelValue")).toBeFalsy()
+        expect(document.body.textContent).toContain("diff failed")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/content-block-edit-save.test.ts b/VueApp/src/CMS/__tests__/content-block-edit-save.test.ts
new file mode 100644
index 000000000..e174e1f40
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/content-block-edit-save.test.ts
@@ -0,0 +1,378 @@
+import ContentBlockEdit from "@/CMS/pages/ContentBlockEdit.vue"
+import { mountCms, flushPromises, flushRouter, createTestRouter } from "./test-utils"
+
+/**
+ * ContentBlockEdit save flow: staged inline uploads commit BEFORE the block save (so their GUIDs
+ * ride along in fileGuids), the save payload carries the full block shape with lastModifiedOn as
+ * the concurrency stamp (null on create), a 409 rolls freshly-created files back and offers a
+ * reload, other failures roll back and show a banner, and success notifies + refreshes history.
+ * Mock ViperFetch; the inline uploader is stubbed with a controllable commit().
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+const mockPut = vi.fn<(...args: unknown[]) => unknown>()
+const mockDel = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        post: (...args: unknown[]) => mockPost(...args),
+        put: (...args: unknown[]) => mockPut(...args),
+        del: (...args: unknown[]) => mockDel(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const BLOCK = {
+    contentBlockId: 7,
+    content: "<p>hello</p>",
+    title: "Welcome",
+    system: "Viper",
+    application: null,
+    page: "home",
+    viperSectionPath: "/apps",
+    blockOrder: 2,
+    friendlyName: "welcome",
+    allowPublicAccess: false,
+    modifiedOn: "2024-03-01T12:00:00",
+    modifiedBy: "editor",
+    deletedOn: null,
+    permissions: ["SVMSecure.CMS"],
+    files: [{ fileGuid: "f1", friendlyName: "a.pdf", url: "/files/a.pdf" }],
+}
+
+// The payload buildSavePayload derives from BLOCK (files flattened to fileGuids, modifiedOn
+// becoming the lastModifiedOn concurrency stamp).
+const EXPECTED_PUT_PAYLOAD = {
+    contentBlockId: 7,
+    content: "<p>hello</p>",
+    title: "Welcome",
+    system: "Viper",
+    application: null,
+    page: "home",
+    viperSectionPath: "/apps",
+    blockOrder: 2,
+    friendlyName: "welcome",
+    allowPublicAccess: false,
+    permissions: ["SVMSecure.CMS"],
+    fileGuids: ["f1"],
+    lastModifiedOn: "2024-03-01T12:00:00",
+}
+
+const UPLOADED_FILE = { fileGuid: "f2", friendlyName: "b.pdf", friendlyUrl: "/files/b.pdf" }
+
+function routeGet(block: Record<string, unknown> = BLOCK) {
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.endsWith("/folders")) {
+            return Promise.resolve({ success: true, result: ["/apps", "/students"] })
+        }
+        if (url.includes("/history")) {
+            return Promise.resolve({ success: true, result: [] })
+        }
+        if (url.includes("cms/files/")) {
+            return Promise.resolve({ success: true, result: [] })
+        }
+        // The single-block load (.../content/7); deep-copied so tests can't cross-mutate BLOCK.
+        return Promise.resolve({ success: true, result: structuredClone(block) })
+    })
+}
+
+function blockLoadCount(): number {
+    return mockGet.mock.calls.map((c) => c[0] as string).filter((u) => u.endsWith("CMS/content/7")).length
+}
+
+// QEditor relies on document.execCommand and rich-text DOM that happy-dom lacks; stub it with a
+// minimal v-model textarea so block.content still binds without exercising the real editor.
+const qEditorStub = {
+    name: "QEditor",
+    props: ["modelValue"],
+    emits: ["update:modelValue"],
+    methods: {
+        getContentEl() {
+            return null
+        },
+    },
+    template: `<textarea :value="modelValue" @input="$emit('update:modelValue', $event.target.value)" />`,
+}
+
+// The inline uploader stages files client-side; the page only calls its exposed commit() during
+// save. Stub it with a controllable commit so the tests drive each staged-upload outcome.
+const mockCommit = vi.fn<() => Promise<{ attached: unknown[]; createdGuids: string[] }>>()
+const inlineUploadStub = {
+    name: "InlineFileUpload",
+    props: ["folder", "permissions", "allowPublicAccess"],
+    emits: ["staged-count"],
+    template: "<div class='inline-upload-stub' />",
+    methods: {
+        commit() {
+            return mockCommit()
+        },
+    },
+}
+
+async function mountEdit(routeArgs: { params?: Record<string, string> } = { params: { id: "7" } }) {
+    const router = createTestRouter()
+    await router.push({ name: "CmsContentBlockEdit", params: routeArgs.params ?? {} })
+    await router.isReady()
+    const wrapper = mountCms(
+        ContentBlockEdit,
+        { global: { stubs: { QEditor: qEditorStub, InlineFileUpload: inlineUploadStub } } },
+        router,
+    )
+    await flushPromises()
+    await flushPromises()
+    return { wrapper, router }
+}
+
+async function submitForm(wrapper: Awaited<ReturnType<typeof mountEdit>>["wrapper"]): Promise<void> {
+    await wrapper.findComponent({ name: "QForm" }).find("form").trigger("submit")
+    await flushPromises()
+    await flushPromises()
+}
+
+// Quasar plugin dialogs ($q.dialog) and notifications teleport to document.body, outside the
+// wrapper. Click the LAST match: a dismissed dialog's portal can linger mid-transition, so the
+// newest dialog is always the live one. The body is never wiped between tests (Quasar caches its
+// notification container there), so assertions use per-test-unique messages.
+function clickBodyButton(label: string) {
+    const btn = [...document.body.querySelectorAll("button")].filter((b) => b.textContent?.includes(label)).at(-1)
+    expect(btn, `expected a "${label}" button in the dialog`).toBeTruthy()
+    btn!.click()
+}
+
+beforeEach(() => {
+    mockGet.mockReset()
+    mockPost.mockReset()
+    mockPut.mockReset()
+    mockDel.mockReset()
+    mockCommit.mockReset()
+    mockCommit.mockResolvedValue({ attached: [], createdGuids: [] })
+    routeGet()
+})
+
+describe("ContentBlockEdit.vue - save payload", () => {
+    it("edit-mode save PUTs the full block payload with lastModifiedOn as the concurrency stamp", async () => {
+        mockPut.mockResolvedValue({ success: true, result: { ...BLOCK } })
+        const { wrapper } = await mountEdit()
+
+        await submitForm(wrapper)
+
+        expect(mockPut).toHaveBeenCalledOnce()
+        const [url, payload] = mockPut.mock.calls[0]!
+        expect(url).toContain("CMS/content/7")
+        expect(payload).toEqual(EXPECTED_PUT_PAYLOAD)
+        expect(document.body.textContent).toContain("Content block saved")
+    })
+
+    it("create-mode save POSTs with a null lastModifiedOn and empty friendlyName collapsed to null", async () => {
+        mockPost.mockResolvedValue({ success: true, result: { ...BLOCK, contentBlockId: 42, files: [] } })
+        const { wrapper, router } = await mountEdit({ params: {} })
+
+        wrapper.findAllComponents({ name: "QInput" })[0]!.vm.$emit("update:modelValue", "New block")
+        wrapper
+            .findAllComponents({ name: "QSelect" })
+            .find((s) => s.props("label") === "VIPER section path")!
+            .vm.$emit("update:modelValue", "/apps")
+        // Let the v-models propagate back into the inputs' props before submit-time validation.
+        await flushPromises()
+        await submitForm(wrapper)
+
+        expect(mockPost).toHaveBeenCalledOnce()
+        const [, payload] = mockPost.mock.calls[0]!
+        expect(payload).toMatchObject({
+            contentBlockId: 0,
+            title: "New block",
+            viperSectionPath: "/apps",
+            friendlyName: null,
+            lastModifiedOn: null,
+            fileGuids: [],
+        })
+        expect(document.body.textContent).toContain("Content block created")
+
+        // Success navigates from the create form to the new block's edit route.
+        await flushRouter()
+        expect(router.currentRoute.value.params.id).toBe("42")
+    })
+
+    it("blocks submit and shows the required-fields banner when validation fails", async () => {
+        const { wrapper } = await mountEdit({ params: {} })
+
+        await submitForm(wrapper)
+
+        expect(mockPost).not.toHaveBeenCalled()
+        expect(wrapper.text()).toContain("Please complete the required fields before creating this content block.")
+    })
+})
+
+describe("ContentBlockEdit.vue - staged upload commit", () => {
+    it("commits staged uploads before the save and includes the new GUIDs in fileGuids", async () => {
+        mockCommit.mockResolvedValue({ attached: [UPLOADED_FILE], createdGuids: ["f2"] })
+        mockPut.mockResolvedValue({ success: true, result: { ...BLOCK } })
+        const { wrapper } = await mountEdit()
+
+        await submitForm(wrapper)
+
+        expect(mockCommit.mock.invocationCallOrder[0]!).toBeLessThan(mockPut.mock.invocationCallOrder[0]!)
+        const [, payload] = mockPut.mock.calls[0]!
+        expect((payload as { fileGuids: string[] }).fileGuids).toEqual(["f1", "f2"])
+    })
+
+    it("aborts the save with a banner when a staged upload fails, leaving the block unsaved", async () => {
+        mockCommit.mockRejectedValue(new Error("upload boom"))
+        const { wrapper } = await mountEdit()
+
+        await submitForm(wrapper)
+
+        expect(mockPut).not.toHaveBeenCalled()
+        expect(wrapper.text()).toContain("upload boom")
+    })
+
+    it("rolls back freshly-created files and shows the error when the save fails", async () => {
+        mockCommit.mockResolvedValue({ attached: [UPLOADED_FILE], createdGuids: ["f2"] })
+        mockPut.mockResolvedValue({ success: false, errors: ["Friendly name already in use"] })
+        const { wrapper } = await mountEdit()
+
+        await submitForm(wrapper)
+
+        // The new upload is soft-deleted and detached again; the pre-existing file stays.
+        expect(mockDel).toHaveBeenCalledOnce()
+        expect(mockDel.mock.calls[0]![0]).toContain("cms/files/f2")
+        expect(wrapper.text()).toContain("Friendly name already in use")
+        expect(wrapper.text()).toContain("a.pdf")
+        expect(wrapper.text()).not.toContain("b.pdf")
+        expect(document.body.textContent).not.toContain("Edit Conflict")
+    })
+})
+
+describe("ContentBlockEdit.vue - 409 conflict handling", () => {
+    it("rolls back new files and offers to reload the latest version on a 409", async () => {
+        mockCommit.mockResolvedValue({ attached: [UPLOADED_FILE], createdGuids: ["f2"] })
+        mockPut.mockResolvedValue({ success: false, status: 409, errors: ["Someone else saved this block."] })
+        const { wrapper } = await mountEdit()
+        const loadsBefore = blockLoadCount()
+
+        await submitForm(wrapper)
+
+        expect(mockDel.mock.calls[0]![0]).toContain("cms/files/f2")
+        expect(document.body.textContent).toContain("Edit Conflict")
+        expect(document.body.textContent).toContain("Someone else saved this block.")
+
+        clickBodyButton("Reload")
+        await flushPromises()
+        await flushPromises()
+        expect(blockLoadCount()).toBe(loadsBefore + 1)
+    })
+
+    it("keeps the user's edits when they dismiss the conflict dialog", async () => {
+        mockPut.mockResolvedValue({ success: false, status: 409, errors: ["Someone else saved this block."] })
+        const { wrapper } = await mountEdit()
+        const loadsBefore = blockLoadCount()
+
+        await submitForm(wrapper)
+        clickBodyButton("Keep editing")
+        await flushPromises()
+
+        expect(blockLoadCount()).toBe(loadsBefore)
+    })
+})
+
+// Like routeGet, but the file-search endpoint returns a catalog including one already-attached
+// file (f1) and one new candidate (f9).
+function routeGetWithFileSearch() {
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("cms/files/")) {
+            return Promise.resolve({
+                success: true,
+                result: [
+                    { fileGuid: "f1", friendlyName: "a.pdf", friendlyUrl: "/files/a.pdf" },
+                    { fileGuid: "f9", friendlyName: "new.pdf", friendlyUrl: "/files/new.pdf" },
+                ],
+            })
+        }
+        if (url.includes("/history")) {
+            return Promise.resolve({ success: true, result: [] })
+        }
+        return Promise.resolve({ success: true, result: structuredClone(BLOCK) })
+    })
+}
+
+describe("ContentBlockEdit.vue - attached files", () => {
+    it("searches active files (excluding already-attached ones) and attaches the selection", async () => {
+        routeGetWithFileSearch()
+        const { wrapper } = await mountEdit()
+
+        const attachSelect = wrapper
+            .findAllComponents({ name: "QSelect" })
+            .find((s) => s.props("label") === "Attach a file")!
+        attachSelect.vm.$emit("filter", "pdf", (fn: () => void) => fn())
+        await flushPromises()
+        await flushPromises()
+
+        const fileSearch = mockGet.mock.calls.map((c) => c[0] as string).find((u) => u.includes("cms/files/?"))
+        expect(fileSearch).toContain("search=pdf")
+        expect(fileSearch).toContain("status=active")
+        // The already-attached f1 is excluded from the options.
+        const options = attachSelect.props("options") as { fileGuid: string }[]
+        expect(options.map((o) => o.fileGuid)).toEqual(["f9"])
+
+        attachSelect.vm.$emit("update:modelValue", options[0])
+        await flushPromises()
+        expect(wrapper.text()).toContain("new.pdf")
+    })
+
+    it("detaching a file removes it from the attachment list and the next save payload", async () => {
+        mockPut.mockResolvedValue({ success: true, result: { ...BLOCK } })
+        const { wrapper } = await mountEdit()
+
+        await wrapper.find("[aria-label='Detach file']").trigger("click")
+        expect(wrapper.text()).not.toContain("a.pdf")
+
+        await submitForm(wrapper)
+        const [, payload] = mockPut.mock.calls[0]!
+        expect((payload as { fileGuids: string[] }).fileGuids).toEqual([])
+    })
+})
+
+describe("ContentBlockEdit.vue - system/public-access coupling and restore", () => {
+    it("switching the system to Public auto-enables public access and explains why", async () => {
+        const { wrapper } = await mountEdit()
+
+        wrapper
+            .findAllComponents({ name: "QSelect" })
+            .find((s) => s.props("label") === "System")!
+            .vm.$emit("update:modelValue", "Public")
+        await flushPromises()
+
+        expect(wrapper.findComponent({ name: "QToggle" }).props("modelValue")).toBeTruthy()
+        expect(wrapper.text()).toContain("we turned on Public access")
+    })
+
+    it("restores a deleted block via the banner action and reloads it", async () => {
+        routeGet({ ...BLOCK, deletedOn: "2024-04-01T00:00:00" })
+        mockPost.mockResolvedValue({ success: true, result: null })
+        const { wrapper } = await mountEdit()
+        const loadsBefore = blockLoadCount()
+        expect(wrapper.text()).toContain("marked as deleted")
+
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.text().includes("Restore"))!
+            .trigger("click")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockPost.mock.calls[0]![0]).toContain("CMS/content/7/restore")
+        expect(document.body.textContent).toContain("Content block restored")
+        expect(blockLoadCount()).toBe(loadsBefore + 1)
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/content-block-history.test.ts b/VueApp/src/CMS/__tests__/content-block-history.test.ts
new file mode 100644
index 000000000..b14412f92
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/content-block-history.test.ts
@@ -0,0 +1,229 @@
+import ContentBlockHistory from "@/CMS/pages/ContentBlockHistory.vue"
+import { mountCms, flushPromises, flushRouter, createTestRouter } from "./test-utils"
+
+/**
+ * ContentBlockHistory is a logic-dense page: filters deep-link from route.query, onRequest builds
+ * the list query (contentBlockId/modifiedBy/from/to/search/page/perPage) and binds rowsNumber,
+ * syncFiltersToUrl reflects active filters back (omitting empties), clearBlockFilter drops the
+ * block chip and reloads, viewDiff fetches the GET diff endpoint and drives ContentDiffDialog
+ * with a comparison/original subtitle, and the route.query watcher's equality guard avoids a
+ * double-fetch on self-writes. DateRangeFilter is mounted real to exercise the binding end-to-end.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const HISTORY_ROW = {
+    contentHistoryId: 55,
+    contentBlockId: 7,
+    title: "Welcome",
+    friendlyName: "welcome",
+    page: "home",
+    modifiedOn: "2024-03-01T12:00:00",
+    modifiedBy: "editor",
+    blockDeleted: false,
+}
+
+type DiffResult = {
+    content: string
+    hasComparison: boolean
+    hasChanges: boolean
+    oldModifiedOn: string | null
+    oldModifiedBy: string | null
+    newModifiedOn: string | null
+    newModifiedBy: string | null
+}
+
+function routeGet(opts: { rows?: unknown[]; total?: number; diff?: DiffResult | { fail: true } } = {}) {
+    const rows = opts.rows ?? [HISTORY_ROW]
+    mockGet.mockReset()
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("/diff")) {
+            if (opts.diff && "fail" in opts.diff) {
+                return Promise.resolve({ success: false, errors: ["boom"] })
+            }
+            return Promise.resolve({ success: true, result: opts.diff })
+        }
+        return Promise.resolve({
+            success: true,
+            result: rows,
+            pagination: opts.total === undefined ? undefined : { totalRecords: opts.total },
+        })
+    })
+}
+
+function lastListUrl(): string {
+    return mockGet.mock.calls.map((c) => c[0] as string).findLast((u) => u.includes("CMS/content/history?")) ?? ""
+}
+
+async function mountPage(query: Record<string, string> = {}) {
+    const router = createTestRouter()
+    await router.push({ path: "/CMS/ManageContentBlocks/History", query })
+    await router.isReady()
+    const wrapper = mountCms(ContentBlockHistory, {}, router)
+    await flushPromises()
+    await flushPromises()
+    return { wrapper, router }
+}
+
+describe("ContentBlockHistory.vue - list request", () => {
+    beforeEach(() => routeGet({ total: 17 }))
+
+    it("requests page 1 with default perPage on mount and binds rowsNumber", async () => {
+        const { wrapper } = await mountPage()
+        const url = lastListUrl()
+        expect(url).toContain("page=1")
+        expect(url).toContain("perPage=50")
+        const pag = wrapper.findComponent({ name: "QTable" }).props("pagination") as { rowsNumber: number }
+        expect(pag.rowsNumber).toBe(17)
+        expect(wrapper.findComponent({ name: "QTable" }).props("rows")).toHaveLength(1)
+    })
+
+    it("initializes filters from route.query (deep-link) and reflects them in the request", async () => {
+        await mountPage({
+            contentBlockId: "7",
+            modifiedBy: "editor",
+            from: "2024-01-01",
+            to: "2024-02-01",
+            search: "welcome",
+        })
+        const url = lastListUrl()
+        expect(url).toContain("contentBlockId=7")
+        expect(url).toContain("modifiedBy=editor")
+        expect(url).toContain("from=2024-01-01")
+        expect(url).toContain("to=2024-02-01")
+        expect(url).toContain("search=welcome")
+    })
+
+    it("shows the single-block filter chip when contentBlockId is present", async () => {
+        const { wrapper } = await mountPage({ contentBlockId: "7" })
+        expect(wrapper.text()).toContain("Filtered to one block: 7")
+    })
+})
+
+describe("ContentBlockHistory.vue - filter to URL sync", () => {
+    beforeEach(() => routeGet({ total: 5 }))
+
+    it("syncFiltersToUrl writes only the active filters to the URL (empties omitted)", async () => {
+        const { wrapper, router } = await mountPage({ contentBlockId: "7" })
+        const modifiedByInput = wrapper.findAllComponents({ name: "QInput" })[0]!
+        modifiedByInput.vm.$emit("update:modelValue", "alice")
+        await flushRouter()
+        // The new filter reaches both the request and the URL.
+        expect(lastListUrl()).toContain("modifiedBy=alice")
+        expect(router.currentRoute.value.query.modifiedBy).toBe("alice")
+        expect(router.currentRoute.value.query.contentBlockId).toBe("7")
+        // Untouched empty filters are not serialized.
+        expect(router.currentRoute.value.query.search).toBeUndefined()
+        expect(router.currentRoute.value.query.from).toBeUndefined()
+    })
+
+    it("clearBlockFilter drops the chip and the contentBlockId param, then reloads", async () => {
+        const { wrapper, router } = await mountPage({ contentBlockId: "7" })
+        const before = mockGet.mock.calls.length
+        wrapper.findComponent({ name: "QChip" }).vm.$emit("remove")
+        await flushRouter()
+        expect(wrapper.text()).not.toContain("Filtered to one block")
+        expect(router.currentRoute.value.query.contentBlockId).toBeUndefined()
+        // A reload (new list request) happened.
+        expect(mockGet.mock.calls.length).toBeGreaterThan(before)
+        expect(lastListUrl()).not.toContain("contentBlockId=")
+    })
+
+    it("the route.query watcher's equality guard does not re-fetch on a self-write", async () => {
+        const { wrapper } = await mountPage()
+        const searchInput = wrapper.findAllComponents({ name: "QInput" }).at(-1)!
+        searchInput.vm.$emit("update:modelValue", "abc")
+        await flushPromises()
+        const callsAfterSearch = mockGet.mock.calls.length
+        // SyncFiltersToUrl (router.replace) updates the query; the watcher sees state already
+        // equal to filters and returns without a second fetch.
+        await flushPromises()
+        await flushPromises()
+        expect(mockGet.mock.calls.length).toBe(callsAfterSearch)
+    })
+})
+
+describe("ContentBlockHistory.vue - viewDiff", () => {
+    it("fetches the GET diff endpoint and shows the comparison subtitle for a non-original version", async () => {
+        routeGet({
+            diff: {
+                content: "<ins>added</ins>",
+                hasComparison: true,
+                hasChanges: true,
+                oldModifiedOn: "2024-02-01T10:00:00",
+                oldModifiedBy: "bob",
+                newModifiedOn: "2024-03-01T12:00:00",
+                newModifiedBy: "editor",
+            },
+        })
+        const { wrapper } = await mountPage()
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.attributes("aria-label") === "Diff with previous version")!
+            .trigger("click")
+        await flushPromises()
+
+        // The diff endpoint is .../content/<blockId>/history/<historyId>/diff.
+        const diffCall = mockGet.mock.calls.map((c) => c[0] as string).find((u) => u.includes("/diff"))
+        expect(diffCall).toContain("CMS/content/7/history/55/diff")
+
+        const dialog = wrapper.findComponent({ name: "ContentDiffDialog" })
+        expect(dialog.props("hasComparison")).toBeTruthy()
+        expect(dialog.props("diffHtml")).toContain("added")
+        // DiffStamp builds "Changes from <old> to <new>".
+        expect(dialog.props("subtitle")).toContain("Changes from")
+        expect(dialog.props("subtitle")).toContain("by bob")
+        expect(dialog.props("subtitle")).toContain("by editor")
+    })
+
+    it("shows the original-version subtitle when the version has no comparison", async () => {
+        routeGet({
+            diff: {
+                content: "",
+                hasComparison: false,
+                hasChanges: false,
+                oldModifiedOn: null,
+                oldModifiedBy: null,
+                newModifiedOn: "2024-03-01T12:00:00",
+                newModifiedBy: "editor",
+            },
+        })
+        const { wrapper } = await mountPage()
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.attributes("aria-label") === "Diff with previous version")!
+            .trigger("click")
+        await flushPromises()
+        const dialog = wrapper.findComponent({ name: "ContentDiffDialog" })
+        expect(dialog.props("hasComparison")).toBeFalsy()
+        expect(dialog.props("subtitle")).toContain("Original version")
+    })
+
+    it("notifies and closes the viewer when the diff request fails", async () => {
+        routeGet({ diff: { fail: true } })
+        const { wrapper } = await mountPage()
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.attributes("aria-label") === "Diff with previous version")!
+            .trigger("click")
+        await flushPromises()
+        const dialog = wrapper.findComponent({ name: "ContentDiffDialog" })
+        expect(dialog.props("modelValue")).toBeFalsy()
+        expect(document.body.textContent).toContain("boom")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/content-blocks.test.ts b/VueApp/src/CMS/__tests__/content-blocks.test.ts
new file mode 100644
index 000000000..5ac441e79
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/content-blocks.test.ts
@@ -0,0 +1,285 @@
+import ContentBlocks from "@/CMS/pages/ContentBlocks.vue"
+import { mountCms, flushPromises, flushRouter, createTestRouter } from "./test-utils"
+
+/**
+ * ContentBlocks is a server-paged list (like Files): filter inputs must drive the right query
+ * params on the paged list request, page/sort ride through onRequest, and rowsNumber binds from
+ * the response pagination envelope. Mock ViperFetch; section-paths and the paged list both go
+ * through get(), routed by URL.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockDel = vi.fn<(...args: unknown[]) => unknown>()
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        del: (...args: unknown[]) => mockDel(...args),
+        post: (...args: unknown[]) => mockPost(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const BLOCK_ROW = {
+    contentBlockId: 1,
+    title: "Welcome",
+    friendlyName: "welcome",
+    system: "Viper",
+    viperSectionPath: null,
+    page: null,
+    blockOrder: 1,
+    allowPublicAccess: false,
+    deletedOn: null,
+    permissions: [],
+    modifiedOn: "2024-01-01T00:00:00",
+    modifiedBy: "u",
+}
+
+// The list endpoint is the one without "/section-paths"; route by URL. Returns a paged
+// envelope carrying totalRecords when a total is given (else falls back to row count).
+function routeGet(opts: { rows?: unknown[]; total?: number } = {}) {
+    const rows = opts.rows ?? [BLOCK_ROW]
+    mockGet.mockReset()
+    mockDel.mockReset()
+    mockPost.mockReset()
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("/section-paths")) {
+            return Promise.resolve({ success: true, result: ["/a", "/b"] })
+        }
+        return Promise.resolve({
+            success: true,
+            result: rows,
+            pagination: opts.total === undefined ? undefined : { totalRecords: opts.total },
+        })
+    })
+}
+
+function lastListUrl(): string {
+    const listCalls = mockGet.mock.calls.map((c) => c[0] as string).filter((u) => !u.includes("/section-paths"))
+    return listCalls.at(-1) ?? ""
+}
+
+async function mountPage(query: Record<string, string> = {}) {
+    const router = createTestRouter()
+    await router.push({ path: "/CMS/ManageContentBlocks", query })
+    await router.isReady()
+    const wrapper = mountCms(ContentBlocks, {}, router)
+    await flushPromises()
+    await flushPromises()
+    return { wrapper, router }
+}
+
+describe("ContentBlocks.vue - filter-driven query params", () => {
+    beforeEach(() => routeGet({ total: 42 }))
+
+    it("requests page 1 with default sort and active status on mount, binding rows and rowsNumber", async () => {
+        const { wrapper } = await mountPage()
+        const url = lastListUrl()
+        expect(url).toContain("status=active")
+        expect(url).toContain("page=1")
+        expect(url).toContain("perPage=50")
+        expect(url).toContain("sortBy=title")
+        // Returned row binds to the table, and rowsNumber comes from the pagination envelope.
+        expect(wrapper.findComponent({ name: "QTable" }).props("rows")).toHaveLength(1)
+        expect(wrapper.text()).toContain("Welcome")
+        const pag = wrapper.findComponent({ name: "QTable" }).props("pagination") as { rowsNumber: number }
+        expect(pag.rowsNumber).toBe(42)
+    })
+
+    it("falls back to result length for rowsNumber when no pagination envelope is returned", async () => {
+        routeGet({ rows: [BLOCK_ROW, { ...BLOCK_ROW, contentBlockId: 2 }] })
+        const { wrapper } = await mountPage()
+        const pag = wrapper.findComponent({ name: "QTable" }).props("pagination") as { rowsNumber: number }
+        expect(pag.rowsNumber).toBe(2)
+    })
+
+    it("includes the search term in the query when the search field changes", async () => {
+        const { wrapper } = await mountPage()
+        const searchInput = wrapper.findAllComponents({ name: "QInput" })[0]!
+        searchInput.vm.$emit("update:modelValue", "welcome")
+        await flushPromises()
+        expect(lastListUrl()).toContain("search=welcome")
+    })
+
+    it("adds isPublic=true only when the Public-only toggle is on", async () => {
+        const { wrapper } = await mountPage()
+        expect(lastListUrl()).not.toContain("isPublic")
+        const toggle = wrapper.findComponent({ name: "QToggle" })
+        toggle.vm.$emit("update:modelValue", true)
+        await flushPromises()
+        expect(lastListUrl()).toContain("isPublic=true")
+    })
+
+    it("sends the chosen status when the status select changes", async () => {
+        const { wrapper } = await mountPage()
+        const statusSelect = wrapper.findAllComponents({ name: "QSelect" })[0]!
+        statusSelect.vm.$emit("update:modelValue", "deleted")
+        await flushPromises()
+        expect(lastListUrl()).toContain("status=deleted")
+    })
+
+    it("binds an empty table when the list request fails", async () => {
+        mockGet.mockReset()
+        mockGet.mockImplementation((...args: unknown[]) => {
+            const url = args[0] as string
+            if (url.includes("/section-paths")) {
+                return Promise.resolve({ success: true, result: [] })
+            }
+            return Promise.resolve({ success: false, result: null })
+        })
+        const { wrapper } = await mountPage()
+        expect(wrapper.findComponent({ name: "QTable" }).props("rows")).toEqual([])
+    })
+})
+
+describe("ContentBlocks.vue - URL filter sync", () => {
+    beforeEach(() => routeGet())
+
+    it("initializes filters from the URL query (deep-link) and reflects them in the request", async () => {
+        await mountPage({ status: "deleted", section: "courses", search: "welcome", public: "1" })
+        const url = lastListUrl()
+        expect(url).toContain("status=deleted")
+        expect(url).toContain("viperSectionPath=courses")
+        expect(url).toContain("search=welcome")
+        expect(url).toContain("isPublic=true")
+    })
+
+    it("writes only the active filters to the URL when a filter changes (defaults omitted)", async () => {
+        const { wrapper, router } = await mountPage()
+        const searchInput = wrapper.findAllComponents({ name: "QInput" })[0]!
+        searchInput.vm.$emit("update:modelValue", "welcome")
+        await flushRouter()
+        // The changed filter reaches the URL; the default active status and the off
+        // public toggle are omitted rather than serialized as defaults.
+        expect(router.currentRoute.value.query.search).toBe("welcome")
+        expect(router.currentRoute.value.query.status).toBeUndefined()
+        expect(router.currentRoute.value.query.public).toBeUndefined()
+    })
+
+    it("re-syncs filters and refetches when in-app navigation changes the query", async () => {
+        const { router } = await mountPage()
+        const before = mockGet.mock.calls.length
+
+        await router.push({ path: "/CMS/ManageContentBlocks", query: { status: "deleted", search: "old" } })
+        await flushRouter()
+
+        expect(mockGet.mock.calls.length).toBeGreaterThan(before)
+        const url = lastListUrl()
+        expect(url).toContain("status=deleted")
+        expect(url).toContain("search=old")
+    })
+})
+
+describe("ContentBlocks.vue - onRequest pagination passthrough", () => {
+    beforeEach(() => routeGet({ total: 200 }))
+
+    it("uses the sort/descending/page from a table request", async () => {
+        const { wrapper } = await mountPage()
+        await wrapper.findComponent({ name: "QTable" }).vm.$emit("request", {
+            pagination: { page: 3, rowsPerPage: 25, sortBy: "modifiedOn", descending: true },
+        })
+        await flushPromises()
+        const url = lastListUrl()
+        expect(url).toContain("page=3")
+        expect(url).toContain("perPage=25")
+        expect(url).toContain("sortBy=modifiedOn")
+        expect(url).toContain("descending=true")
+    })
+})
+
+// Quasar plugin dialogs ($q.dialog) and notifications teleport to document.body. Click the LAST
+// match: a dismissed dialog's portal can linger mid-transition, so the newest dialog is the live
+// one. The body is never wiped between tests (Quasar caches its notification container there),
+// so toast assertions use per-test-unique messages.
+function clickBodyButton(label: string) {
+    const btn = [...document.body.querySelectorAll("button")].filter((b) => b.textContent?.includes(label)).at(-1)
+    expect(btn, `expected a "${label}" button in the dialog`).toBeTruthy()
+    btn!.click()
+}
+
+function listCallCount(): number {
+    return mockGet.mock.calls.map((c) => c[0] as string).filter((u) => !u.includes("/section-paths")).length
+}
+
+describe("ContentBlocks.vue - delete and restore actions", () => {
+    beforeEach(() => routeGet())
+
+    it("soft-deletes the block and reloads the list once the confirm dialog is accepted", async () => {
+        mockDel.mockResolvedValue({ success: true, result: null })
+        const { wrapper } = await mountPage()
+        const before = listCallCount()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("delete")
+        await flushPromises()
+        expect(document.body.textContent).toContain('Mark "Welcome" as deleted?')
+
+        clickBodyButton("Delete")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockDel).toHaveBeenCalledOnce()
+        expect(mockDel.mock.calls[0]![0]).toContain("CMS/content/1")
+        expect(document.body.textContent).toContain("Content block marked as deleted")
+        expect(listCallCount()).toBeGreaterThan(before)
+    })
+
+    it("does not delete when the confirm dialog is cancelled", async () => {
+        const { wrapper } = await mountPage()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("delete")
+        await flushPromises()
+        clickBodyButton("Cancel")
+        await flushPromises()
+
+        expect(mockDel).not.toHaveBeenCalled()
+    })
+
+    it("notifies when the delete fails", async () => {
+        mockDel.mockResolvedValue({ success: false, errors: ["nope"] })
+        const { wrapper } = await mountPage()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("delete")
+        await flushPromises()
+        clickBodyButton("Delete")
+        await flushPromises()
+        await flushPromises()
+
+        expect(document.body.textContent).toContain("Failed to delete content block")
+    })
+
+    it("restores a deleted block and reloads the list", async () => {
+        routeGet({ rows: [{ ...BLOCK_ROW, deletedOn: "2024-02-01T00:00:00" }] })
+        mockPost.mockResolvedValue({ success: true, result: null })
+        const { wrapper } = await mountPage()
+        const before = listCallCount()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("restore")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockPost.mock.calls[0]![0]).toContain("CMS/content/1/restore")
+        expect(document.body.textContent).toContain("Content block restored")
+        expect(listCallCount()).toBeGreaterThan(before)
+    })
+
+    it("notifies when the restore fails", async () => {
+        routeGet({ rows: [{ ...BLOCK_ROW, deletedOn: "2024-02-01T00:00:00" }] })
+        mockPost.mockResolvedValue({ success: false, errors: ["nope"] })
+        const { wrapper } = await mountPage()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("restore")
+        await flushPromises()
+        await flushPromises()
+
+        expect(document.body.textContent).toContain("Failed to restore content block")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/content-diff-dialog.test.ts b/VueApp/src/CMS/__tests__/content-diff-dialog.test.ts
new file mode 100644
index 000000000..e04baa832
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/content-diff-dialog.test.ts
@@ -0,0 +1,66 @@
+import ContentDiffDialog from "@/CMS/components/ContentDiffDialog.vue"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * ContentDiffDialog is a prop-driven presentational wrapper, so this stays light: it emits
+ * update:modelValue on close, shows the added/removed legend only when there is a real
+ * comparison with changes (and not loading), and falls back to emptyMessage when there is
+ * no comparison. The dialog teleports, so assertions read document.body.
+ */
+
+function bodyText(): string {
+    return document.body.textContent ?? ""
+}
+
+function mountDialog(props: Record<string, unknown>) {
+    return mountCms(ContentDiffDialog, { props: { modelValue: true, ...props } })
+}
+
+describe("ContentDiffDialog.vue", () => {
+    beforeEach(() => {
+        document.body.innerHTML = ""
+    })
+
+    it("re-emits update:modelValue when the dialog requests close", async () => {
+        const wrapper = mountDialog({})
+        await flushPromises()
+        wrapper.findComponent({ name: "QDialog" }).vm.$emit("update:modelValue", false)
+        await flushPromises()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([false])
+    })
+
+    it("shows the added/removed legend when there is a comparison with changes and not loading", async () => {
+        mountDialog({ hasComparison: true, hasChanges: true, loading: false, diffHtml: "<ins>x</ins>" })
+        await flushPromises()
+        expect(bodyText()).toContain("added")
+        expect(bodyText()).toContain("removed")
+    })
+
+    it("hides the legend while loading", async () => {
+        mountDialog({ hasComparison: true, hasChanges: true, loading: true })
+        await flushPromises()
+        expect(bodyText()).not.toContain("(newer)")
+    })
+
+    it("hides the legend and states identical when there are no changes", async () => {
+        mountDialog({ hasComparison: true, hasChanges: false })
+        await flushPromises()
+        expect(bodyText()).not.toContain("(newer)")
+        expect(bodyText()).toContain("These two versions are identical.")
+    })
+
+    it("falls back to the empty message when there is no comparison", async () => {
+        mountDialog({ hasComparison: false, emptyMessage: "Nothing to compare here." })
+        await flushPromises()
+        expect(bodyText()).toContain("Nothing to compare here.")
+        // No legend without a comparison.
+        expect(bodyText()).not.toContain("(newer)")
+    })
+
+    it("renders the provided subtitle and title", async () => {
+        mountDialog({ title: "Diff title", subtitle: "Changes from A to B" })
+        await flushPromises()
+        expect(bodyText()).toContain("Diff title")
+        expect(bodyText()).toContain("Changes from A to B")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/date-range-filter.test.ts b/VueApp/src/CMS/__tests__/date-range-filter.test.ts
new file mode 100644
index 000000000..aae8722fa
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/date-range-filter.test.ts
@@ -0,0 +1,52 @@
+import DateRangeFilter from "@/CMS/components/DateRangeFilter.vue"
+import { mountCms } from "./test-utils"
+
+/**
+ * DateRangeFilter is a small shared component (FileAuditLog + ContentBlockHistory both
+ * use it). It exposes v-model:from / v-model:to and emits "change" whenever either input
+ * updates, so the parent can reload. Lock down the binding and the change emission.
+ */
+
+describe("DateRangeFilter.vue", () => {
+    it("renders From and To date inputs bound to the models", () => {
+        const wrapper = mountCms(DateRangeFilter, {
+            props: { from: "2024-01-01", to: "2024-02-01" },
+        })
+        const inputs = wrapper.findAll("input[type='date']")
+        expect(inputs).toHaveLength(2)
+        expect((inputs[0]!.element as HTMLInputElement).value).toBe("2024-01-01")
+        expect((inputs[1]!.element as HTMLInputElement).value).toBe("2024-02-01")
+    })
+
+    it("emits update:from and change when the From input changes", async () => {
+        const wrapper = mountCms(DateRangeFilter, {
+            props: { from: "", to: "" },
+        })
+        const fromInput = wrapper.findAll("input[type='date']")[0]!
+        await fromInput.setValue("2024-05-10")
+
+        expect(wrapper.emitted("update:from")?.at(-1)).toEqual(["2024-05-10"])
+        expect(wrapper.emitted("change")).toBeTruthy()
+    })
+
+    it("emits update:to and change when the To input changes", async () => {
+        const wrapper = mountCms(DateRangeFilter, {
+            props: { from: "", to: "" },
+        })
+        const toInput = wrapper.findAll("input[type='date']")[1]!
+        await toInput.setValue("2024-06-15")
+
+        expect(wrapper.emitted("update:to")?.at(-1)).toEqual(["2024-06-15"])
+        expect(wrapper.emitted("change")).toBeTruthy()
+    })
+
+    it("emits change separately for each input edit", async () => {
+        const wrapper = mountCms(DateRangeFilter, {
+            props: { from: "", to: "" },
+        })
+        const [fromInput, toInput] = wrapper.findAll("input[type='date']")
+        await fromInput!.setValue("2024-01-01")
+        await toInput!.setValue("2024-12-31")
+        expect(wrapper.emitted("change")).toHaveLength(2)
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/file-form-dialog-conflict.test.ts b/VueApp/src/CMS/__tests__/file-form-dialog-conflict.test.ts
new file mode 100644
index 000000000..9c62d445f
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/file-form-dialog-conflict.test.ts
@@ -0,0 +1,278 @@
+import FileFormDialog from "@/CMS/components/FileFormDialog.vue"
+import type { CmsFile } from "@/CMS/types"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * FileFormDialog upload outcomes: a clean add POSTs the form with folder/flags, a taken name
+ * prompts for rename vs overwrite (PUT to the existing record's guid, or POST with the overwrite
+ * flag when only an orphaned disk file exists), a failed conflict upload arrives as a toast with
+ * the conflict dialog kept open, and copy-link notifies on success/failure.
+ *
+ * Separate from file-form-dialog.test.ts: these tests assert Quasar toasts, and that spec wipes
+ * document.body between tests, which detaches Quasar's cached notification container. Here the
+ * body is never wiped and every asserted message is unique per test.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPostForm = vi.fn<(...args: unknown[]) => unknown>()
+const mockPutForm = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        postForm: (...args: unknown[]) => mockPostForm(...args),
+        putForm: (...args: unknown[]) => mockPutForm(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+// Stub the async selectors so they don't make their own fetches; their v-model still flows.
+const selectorStub = {
+    props: ["modelValue", "label"],
+    emits: ["update:modelValue"],
+    template: "<div class='selector-stub' />",
+}
+
+function existingFile(overrides: Partial<CmsFile> = {}): CmsFile {
+    return {
+        fileGuid: "guid-123",
+        fileName: "report.pdf",
+        folder: "Apps",
+        friendlyName: "report.pdf",
+        encrypted: false,
+        description: "A report",
+        allowPublicAccess: false,
+        oldUrl: "/old/report.pdf",
+        modifiedOn: "2024-01-01T00:00:00",
+        modifiedBy: "u",
+        deletedOn: null,
+        purgeOn: null,
+        permissions: ["SVMSecure.CMS"],
+        people: [{ iamId: "iam1", name: "Person One" }],
+        url: "/files/guid-123",
+        friendlyUrl: "/Apps/report.pdf",
+        ...overrides,
+    }
+}
+
+function mountDialog(props: { modelValue: boolean; folders: string[]; file: CmsFile | null }) {
+    return mountCms(FileFormDialog, {
+        props,
+        global: {
+            stubs: { PermissionSelector: selectorStub, PersonSelector: selectorStub },
+        },
+    })
+}
+
+// QDialog and notifications teleport to document.body.
+function bodyText(): string {
+    return document.body.textContent ?? ""
+}
+
+async function submitDialogForm(wrapper: ReturnType<typeof mountDialog>): Promise<void> {
+    await wrapper.findComponent({ name: "QForm" }).find("form").trigger("submit")
+}
+
+// Fills the add form (file + folder are the required fields) so a submit passes validation.
+async function fillAddForm(wrapper: ReturnType<typeof mountDialog>, fileName = "report.pdf") {
+    wrapper.findComponent({ name: "QFile" }).vm.$emit("update:modelValue", new File(["data"], fileName))
+    wrapper.findComponent({ name: "QSelect" }).vm.$emit("update:modelValue", "Apps")
+    await flushPromises()
+}
+
+// Click the LAST matching button: a dismissed dialog's portal can linger mid-transition, so the
+// newest dialog is always the live one.
+function clickBodyButton(label: string) {
+    const btn = [...document.body.querySelectorAll("button")].filter((b) => b.textContent?.includes(label)).at(-1)
+    expect(btn, `expected a "${label}" button`).toBeTruthy()
+    btn!.click()
+}
+
+const NAME_FREE = { success: true, result: { inUse: false } }
+const NAME_TAKEN = {
+    success: true,
+    result: {
+        inUse: true,
+        suggestedName: "report_1.pdf",
+        existingFileGuid: "eg9",
+        existingFriendlyName: "report.pdf",
+        existingDeleted: false,
+    },
+}
+
+beforeEach(() => {
+    mockGet.mockReset()
+    mockPostForm.mockReset()
+    mockPutForm.mockReset()
+})
+
+describe("FileFormDialog.vue - add-mode upload", () => {
+    it("checks the destination name, then POSTs the upload with folder, flags, and toggles", async () => {
+        mockGet.mockResolvedValue(NAME_FREE)
+        mockPostForm.mockResolvedValue({ success: true, result: existingFile() })
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: null })
+        await flushPromises()
+        await fillAddForm(wrapper)
+        const [publicToggle, encryptToggle] = wrapper.findAllComponents({ name: "QToggle" })
+        publicToggle!.vm.$emit("update:modelValue", true)
+        encryptToggle!.vm.$emit("update:modelValue", true)
+        await flushPromises()
+
+        await submitDialogForm(wrapper)
+        await flushPromises()
+
+        const checkUrl = mockGet.mock.calls[0]![0] as string
+        expect(checkUrl).toContain("check-name")
+        expect(checkUrl).toContain("folder=Apps")
+        expect(checkUrl).toContain("fileName=report.pdf")
+
+        const [, body] = mockPostForm.mock.calls[0]! as [string, FormData]
+        expect((body.get("file") as File).name).toBe("report.pdf")
+        expect(body.get("folder")).toBe("Apps")
+        expect(body.get("allowPublicAccess")).toBe("true")
+        expect(body.get("encrypt")).toBe("true")
+        expect(body.has("fileName")).toBeFalsy()
+        expect(body.has("overwrite")).toBeFalsy()
+
+        expect(bodyText()).toContain("File uploaded")
+        expect(wrapper.emitted("saved")).toBeTruthy()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([false])
+    })
+})
+
+describe("FileFormDialog.vue - name conflict resolution", () => {
+    async function openConflict() {
+        mockGet.mockResolvedValue(NAME_TAKEN)
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: null })
+        await flushPromises()
+        await fillAddForm(wrapper)
+        await submitDialogForm(wrapper)
+        await flushPromises()
+        expect(bodyText()).toContain("File name already exists")
+        return wrapper
+    }
+
+    it("prompts on a taken name instead of uploading, prefilling the suggested rename", async () => {
+        const wrapper = await openConflict()
+        expect(mockPostForm).not.toHaveBeenCalled()
+        // Rename is the default choice and the input is prefilled with the server's suggestion.
+        const renameInput = wrapper
+            .findAllComponents({ name: "QInput" })
+            .find((i) => i.props("label") === "New file name")!
+        expect(renameInput.props("modelValue")).toBe("report_1.pdf")
+    })
+
+    it("uploads under the new name when rename is confirmed", async () => {
+        const wrapper = await openConflict()
+        mockPostForm.mockResolvedValue({ success: true, result: existingFile() })
+
+        clickBodyButton("Upload with new name")
+        await flushPromises()
+        await flushPromises()
+
+        const [, body] = mockPostForm.mock.calls[0]! as [string, FormData]
+        expect(body.get("fileName")).toBe("report_1.pdf")
+        expect(body.has("overwrite")).toBeFalsy()
+        expect(bodyText()).toContain("File uploaded")
+        expect(wrapper.emitted("saved")).toBeTruthy()
+    })
+
+    it("PUTs to the existing record's guid when overwrite is chosen for a managed file", async () => {
+        const wrapper = await openConflict()
+        mockPutForm.mockResolvedValue({ success: true, result: existingFile() })
+
+        wrapper.findComponent({ name: "QOptionGroup" }).vm.$emit("update:modelValue", "overwrite")
+        await flushPromises()
+        clickBodyButton("Overwrite")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockPostForm).not.toHaveBeenCalled()
+        const [url, body] = mockPutForm.mock.calls[0]! as [string, FormData]
+        expect(url).toContain("cms/files/eg9")
+        // Overwriting a managed record replaces content in place; no folder/new-name fields.
+        expect(body.has("folder")).toBeFalsy()
+        expect(bodyText()).toContain("File overwritten")
+    })
+
+    it("POSTs with the overwrite flag when the conflicting name has no managed record", async () => {
+        mockGet.mockResolvedValue({
+            ...NAME_TAKEN,
+            result: { ...NAME_TAKEN.result, existingFileGuid: null, existingFriendlyName: null },
+        })
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: null })
+        await flushPromises()
+        await fillAddForm(wrapper)
+        await submitDialogForm(wrapper)
+        await flushPromises()
+        mockPostForm.mockResolvedValue({ success: true, result: existingFile() })
+
+        wrapper.findComponent({ name: "QOptionGroup" }).vm.$emit("update:modelValue", "overwrite")
+        await flushPromises()
+        clickBodyButton("Overwrite")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockPutForm).not.toHaveBeenCalled()
+        const [, body] = mockPostForm.mock.calls[0]! as [string, FormData]
+        expect(body.get("overwrite")).toBe("true")
+    })
+
+    it("reports a failed upload as a toast and keeps the conflict dialog open for a retry", async () => {
+        const wrapper = await openConflict()
+        mockPostForm.mockResolvedValue({ success: false, errors: ["disk full"] })
+
+        clickBodyButton("Upload with new name")
+        await flushPromises()
+        await flushPromises()
+
+        // The user is in the conflict sub-dialog, so the error arrives as a notification...
+        expect(bodyText()).toContain("disk full")
+        // ...and the conflict dialog stays open rather than stranding them on the form.
+        expect(bodyText()).toContain("File name already exists")
+        expect(wrapper.emitted("saved")).toBeFalsy()
+    })
+})
+
+describe("FileFormDialog.vue - copy link", () => {
+    function stubClipboard(writeText: (text: string) => Promise<void>) {
+        Object.defineProperty(navigator, "clipboard", { value: { writeText }, configurable: true })
+    }
+
+    it("copies the friendly URL and confirms", async () => {
+        const writeText = vi.fn<(text: string) => Promise<void>>().mockResolvedValue(undefined)
+        stubClipboard(writeText)
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: existingFile() })
+        await flushPromises()
+
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.attributes("aria-label") === "Copy link")!
+            .trigger("click")
+        await flushPromises()
+
+        expect(writeText).toHaveBeenCalledWith("/Apps/report.pdf")
+        expect(bodyText()).toContain("Link copied")
+    })
+
+    it("notifies when the clipboard write fails", async () => {
+        stubClipboard(vi.fn<(text: string) => Promise<void>>().mockRejectedValue(new Error("denied")))
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: existingFile() })
+        await flushPromises()
+
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.attributes("aria-label") === "Copy link")!
+            .trigger("click")
+        await flushPromises()
+
+        expect(bodyText()).toContain("Failed to copy link")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/file-form-dialog.test.ts b/VueApp/src/CMS/__tests__/file-form-dialog.test.ts
new file mode 100644
index 000000000..04f3c98f0
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/file-form-dialog.test.ts
@@ -0,0 +1,198 @@
+import FileFormDialog from "@/CMS/components/FileFormDialog.vue"
+import type { CmsFile } from "@/CMS/types"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * FileFormDialog covers add vs edit upload flows. Edit mode has no required file (replacing
+ * is optional) and no folder field; add mode requires both a file and a folder. New uploads
+ * first hit a check-name endpoint and prompt on conflict. These tests mock ViperFetch and
+ * stub the async selectors, then assert validation gating and the submitted FormData payload.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPostForm = vi.fn<(...args: unknown[]) => unknown>()
+const mockPutForm = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        postForm: (...args: unknown[]) => mockPostForm(...args),
+        putForm: (...args: unknown[]) => mockPutForm(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+// Stub the async selectors so they don't make their own fetches; their v-model still flows.
+const selectorStub = {
+    props: ["modelValue", "label"],
+    emits: ["update:modelValue"],
+    template: "<div class='selector-stub' />",
+}
+
+function existingFile(overrides: Partial<CmsFile> = {}): CmsFile {
+    return {
+        fileGuid: "guid-123",
+        fileName: "report.pdf",
+        folder: "Apps",
+        friendlyName: "report.pdf",
+        encrypted: false,
+        description: "A report",
+        allowPublicAccess: false,
+        oldUrl: "/old/report.pdf",
+        modifiedOn: "2024-01-01T00:00:00",
+        modifiedBy: "u",
+        deletedOn: null,
+        purgeOn: null,
+        permissions: ["SVMSecure.CMS"],
+        people: [{ iamId: "iam1", name: "Person One" }],
+        url: "/files/guid-123",
+        friendlyUrl: "/Apps/report.pdf",
+        ...overrides,
+    }
+}
+
+function mountDialog(props: { modelValue: boolean; folders: string[]; file: CmsFile | null }) {
+    return mountCms(FileFormDialog, {
+        props,
+        global: {
+            stubs: { PermissionSelector: selectorStub, PersonSelector: selectorStub },
+        },
+    })
+}
+
+// QDialog teleports content to document.body, so query there.
+function bodyText(): string {
+    return document.body.textContent ?? ""
+}
+
+// QDialog teleports its DOM, but the component tree (and so findComponent) still includes the
+// teleported children. Trigger submit on the QForm's <form> via VTU so a real event is dispatched
+// (calling QForm.submit() directly passes an undefined event and trips .prevent).
+async function submitDialogForm(wrapper: ReturnType<typeof mountDialog>): Promise<void> {
+    await wrapper.findComponent({ name: "QForm" }).find("form").trigger("submit")
+}
+
+describe("FileFormDialog.vue - add vs edit mode", () => {
+    beforeEach(() => {
+        mockGet.mockReset()
+        mockPostForm.mockReset()
+        mockPutForm.mockReset()
+        document.body.innerHTML = ""
+    })
+
+    it("shows the Add File title and an Upload button in add mode", async () => {
+        mountDialog({ modelValue: true, folders: ["Apps"], file: null })
+        await flushPromises()
+        expect(bodyText()).toContain("Add File")
+        expect(bodyText()).toContain("Upload")
+    })
+
+    it("shows the Edit File title and the existing file link in edit mode", async () => {
+        mountDialog({ modelValue: true, folders: ["Apps"], file: existingFile() })
+        await flushPromises()
+        expect(bodyText()).toContain("Edit File")
+        expect(bodyText()).toContain("Save Changes")
+        const link = [...document.querySelectorAll("a")].find((a) => a.getAttribute("href") === "/Apps/report.pdf")
+        expect(link).toBeTruthy()
+    })
+
+    it("renders the folder select only in add mode (not edit)", async () => {
+        const add = mountDialog({ modelValue: true, folders: ["Apps", "Reports"], file: null })
+        await flushPromises()
+        expect(bodyText()).toContain("VIPER app (folder)")
+        add.unmount()
+        document.body.innerHTML = ""
+
+        mountDialog({ modelValue: true, folders: ["Apps"], file: existingFile() })
+        await flushPromises()
+        expect(bodyText()).not.toContain("VIPER app (folder)")
+    })
+
+    it("applies the accepted-extensions allow-list to the file input", async () => {
+        mountDialog({ modelValue: true, folders: ["Apps"], file: null })
+        await flushPromises()
+        const fileInput = document.querySelector("input[type='file']") as HTMLInputElement | null
+        expect(fileInput).toBeTruthy()
+        const accept = fileInput!.getAttribute("accept") ?? ""
+        expect(accept).toContain(".pdf")
+        expect(accept).toContain(".docx")
+        expect(accept).toContain(".zip")
+        // A dangerous extension that is NOT allowed should be absent.
+        expect(accept).not.toContain(".bat")
+    })
+})
+
+describe("FileFormDialog.vue - required-field enforcement (add mode)", () => {
+    beforeEach(() => {
+        mockGet.mockReset()
+        mockPostForm.mockReset()
+        mockPutForm.mockReset()
+        document.body.innerHTML = ""
+    })
+
+    it("does not call check-name or postForm when add-mode submit has no file/folder", async () => {
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: null })
+        await flushPromises()
+        // Submit the empty form: greedy validation blocks save(), and save() also early-returns
+        // because there is no upload/folder, so no network calls are made.
+        await submitDialogForm(wrapper)
+        await flushPromises()
+        expect(mockGet).not.toHaveBeenCalled()
+        expect(mockPostForm).not.toHaveBeenCalled()
+        // The validation-error handler surfaces a banner message.
+        expect(bodyText()).toContain("Please choose a file")
+    })
+})
+
+describe("FileFormDialog.vue - save payload", () => {
+    beforeEach(() => {
+        mockGet.mockReset()
+        mockPostForm.mockReset()
+        mockPutForm.mockReset()
+        document.body.innerHTML = ""
+    })
+
+    it("edit-mode save PUTs FormData to the file's guid URL and emits saved", async () => {
+        const file = existingFile({ description: "Updated desc" })
+        mockPutForm.mockResolvedValue({ success: true, result: file })
+        // The form is populated by the open watcher (modelValue false -> true), so open via a
+        // prop toggle rather than mounting already-open, which would leave the form empty.
+        const wrapper = mountDialog({ modelValue: false, folders: ["Apps"], file })
+        await wrapper.setProps({ modelValue: true })
+        await flushPromises()
+
+        await submitDialogForm(wrapper)
+        await flushPromises()
+
+        expect(mockPutForm).toHaveBeenCalledOnce()
+        const [url, body] = mockPutForm.mock.calls[0]!
+        expect(url).toContain("cms/files/guid-123")
+        expect(body).toBeInstanceOf(FormData)
+        // Edit mode carries description/flags but not folder.
+        expect((body as FormData).get("description")).toBe("Updated desc")
+        expect((body as FormData).has("folder")).toBeFalsy()
+        expect((body as FormData).get("allowPublicAccess")).toBe("false")
+        expect((body as FormData).get("encrypt")).toBe("false")
+        expect(wrapper.emitted("saved")).toBeTruthy()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([false])
+    })
+
+    it("edit-mode save surfaces the server error on the form banner and does not emit saved", async () => {
+        mockPutForm.mockResolvedValue({ success: false, errors: ["Name already taken"] })
+        const wrapper = mountDialog({ modelValue: true, folders: ["Apps"], file: existingFile() })
+        await flushPromises()
+
+        await submitDialogForm(wrapper)
+        await flushPromises()
+
+        expect(bodyText()).toContain("Name already taken")
+        expect(wrapper.emitted("saved")).toBeFalsy()
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/files.test.ts b/VueApp/src/CMS/__tests__/files.test.ts
new file mode 100644
index 000000000..c6530de7e
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/files.test.ts
@@ -0,0 +1,317 @@
+import Files from "@/CMS/pages/Files.vue"
+import { mountCms, flushPromises, flushRouter, createTestRouter } from "./test-utils"
+
+/**
+ * Files is a server-paged list. Its filters initialize from the URL (deep-link), onRequest builds
+ * the page/sort/filter query and binds rowsNumber from the response pagination. Mock ViperFetch
+ * and route requests by URL (folders / folder-counts / the paged list).
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockDel = vi.fn<(...args: unknown[]) => unknown>()
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        del: (...args: unknown[]) => mockDel(...args),
+        post: (...args: unknown[]) => mockPost(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const FILE_ROW = {
+    fileGuid: "g1",
+    fileName: "a.pdf",
+    folder: "Apps",
+    friendlyName: "a.pdf",
+    encrypted: false,
+    description: "",
+    allowPublicAccess: false,
+    oldUrl: null,
+    modifiedOn: "2024-01-01T00:00:00",
+    modifiedBy: "u",
+    deletedOn: null,
+    purgeOn: null,
+    permissions: [],
+    people: [],
+    url: "/files/g1",
+    friendlyUrl: "/Apps/a.pdf",
+}
+
+// Returns the list endpoint URL (the bare "cms/files/?..." call, not folders/folder-counts).
+function lastListUrl(): string {
+    const listCalls = mockGet.mock.calls.map((c) => c[0] as string).filter((u) => u.includes("cms/files/?"))
+    return listCalls.at(-1) ?? ""
+}
+
+function routeGet(opts: { rows?: unknown[]; total?: number } = {}) {
+    const rows = opts.rows ?? [FILE_ROW]
+    mockGet.mockReset()
+    mockDel.mockReset()
+    mockPost.mockReset()
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("folder-counts")) {
+            return Promise.resolve({ success: true, result: [{ folder: "Apps", count: 3 }] })
+        }
+        if (url.includes("folders")) {
+            return Promise.resolve({ success: true, result: ["Apps", "Reports"] })
+        }
+        // The paged list request.
+        return Promise.resolve({
+            success: true,
+            result: rows,
+            pagination: opts.total === undefined ? undefined : { totalRecords: opts.total },
+        })
+    })
+}
+
+async function mountPageWithRouter(query: Record<string, string> = {}) {
+    const router = createTestRouter()
+    await router.push({ path: "/CMS/ManageFiles", query })
+    await router.isReady()
+    const wrapper = mountCms(Files, {}, router)
+    await flushPromises()
+    await flushPromises()
+    return { wrapper, router }
+}
+
+async function mountPage(query: Record<string, string> = {}) {
+    return (await mountPageWithRouter(query)).wrapper
+}
+
+function listCallCount(): number {
+    return mockGet.mock.calls.map((c) => c[0] as string).filter((u) => u.includes("cms/files/?")).length
+}
+
+// Quasar plugin dialogs ($q.dialog) and notifications teleport to document.body. Click the LAST
+// match: a dismissed dialog's portal can linger mid-transition, so the newest dialog is the live
+// one. The body is never wiped between tests (Quasar caches its notification container there),
+// so toast assertions use per-test-unique messages.
+function clickBodyButton(label: string) {
+    const btn = [...document.body.querySelectorAll("button")].filter((b) => b.textContent?.includes(label)).at(-1)
+    expect(btn, `expected a "${label}" button in the dialog`).toBeTruthy()
+    btn!.click()
+}
+
+describe("Files.vue - query param construction", () => {
+    beforeEach(() => routeGet({ total: 42 }))
+
+    it("requests page 1 with default sort and status on mount, binding rowsNumber from pagination", async () => {
+        const wrapper = await mountPage()
+        const url = lastListUrl()
+        expect(url).toContain("page=1")
+        expect(url).toContain("perPage=50")
+        expect(url).toContain("sortBy=friendlyName")
+        expect(url).toContain("status=active")
+        expect(wrapper.findComponent({ name: "QTable" }).props("rows")).toHaveLength(1)
+        // RowsNumber is read off the QTable's bound pagination prop.
+        const pag = wrapper.findComponent({ name: "QTable" }).props("pagination") as { rowsNumber: number }
+        expect(pag.rowsNumber).toBe(42)
+    })
+
+    it("initializes filters from the URL query (deep-link) and reflects them in the request", async () => {
+        await mountPage({ search: "report", status: "deleted", encrypted: "1", public: "1", folder: "Reports" })
+        const url = lastListUrl()
+        expect(url).toContain("search=report")
+        expect(url).toContain("status=deleted")
+        expect(url).toContain("encrypted=true")
+        expect(url).toContain("isPublic=true")
+        expect(url).toContain("folder=Reports")
+    })
+
+    it("omits the folder param when folder is the All sentinel", async () => {
+        await mountPage()
+        expect(lastListUrl()).not.toContain("folder=")
+    })
+
+    it("falls back to result length for rowsNumber when no pagination is returned", async () => {
+        routeGet({ rows: [FILE_ROW, { ...FILE_ROW, fileGuid: "g2" }] })
+        const wrapper = await mountPage()
+        const pag = wrapper.findComponent({ name: "QTable" }).props("pagination") as { rowsNumber: number }
+        expect(pag.rowsNumber).toBe(2)
+    })
+})
+
+describe("Files.vue - onRequest pagination passthrough", () => {
+    beforeEach(() => routeGet({ total: 200 }))
+
+    it("uses the sort/descending/page from a table request", async () => {
+        const wrapper = await mountPage()
+        await wrapper.findComponent({ name: "QTable" }).vm.$emit("request", {
+            pagination: { page: 3, rowsPerPage: 25, sortBy: "modifiedOn", descending: true },
+        })
+        await flushPromises()
+        const url = lastListUrl()
+        expect(url).toContain("page=3")
+        expect(url).toContain("perPage=25")
+        expect(url).toContain("sortBy=modifiedOn")
+        expect(url).toContain("descending=true")
+    })
+})
+
+describe("Files.vue - delete and restore actions", () => {
+    beforeEach(() => routeGet())
+
+    it("soft-deletes the file and reloads the list once the confirm dialog is accepted", async () => {
+        mockDel.mockResolvedValue({ success: true, result: null })
+        const wrapper = await mountPage()
+        const before = listCallCount()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("delete")
+        await flushPromises()
+        expect(document.body.textContent).toContain('Mark "a.pdf" as deleted?')
+
+        clickBodyButton("Delete")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockDel).toHaveBeenCalledOnce()
+        expect(mockDel.mock.calls[0]![0]).toContain("cms/files/g1")
+        expect(document.body.textContent).toContain("File marked as deleted")
+        expect(listCallCount()).toBeGreaterThan(before)
+    })
+
+    it("does not delete when the confirm dialog is cancelled", async () => {
+        const wrapper = await mountPage()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("delete")
+        await flushPromises()
+        clickBodyButton("Cancel")
+        await flushPromises()
+
+        expect(mockDel).not.toHaveBeenCalled()
+    })
+
+    it("notifies and keeps the list when the delete fails", async () => {
+        mockDel.mockResolvedValue({ success: false, errors: ["nope"] })
+        const wrapper = await mountPage()
+        const before = listCallCount()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("delete")
+        await flushPromises()
+        clickBodyButton("Delete")
+        await flushPromises()
+        await flushPromises()
+
+        expect(document.body.textContent).toContain("Failed to delete file")
+        expect(listCallCount()).toBe(before)
+    })
+
+    it("restores a deleted file and reloads the list", async () => {
+        routeGet({ rows: [{ ...FILE_ROW, deletedOn: "2024-02-01T00:00:00" }] })
+        mockPost.mockResolvedValue({ success: true, result: null })
+        const wrapper = await mountPage()
+        const before = listCallCount()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("restore")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockPost).toHaveBeenCalledOnce()
+        expect(mockPost.mock.calls[0]![0]).toContain("cms/files/g1/restore")
+        expect(document.body.textContent).toContain("File restored")
+        expect(listCallCount()).toBeGreaterThan(before)
+    })
+
+    it("notifies when the restore fails", async () => {
+        routeGet({ rows: [{ ...FILE_ROW, deletedOn: "2024-02-01T00:00:00" }] })
+        mockPost.mockResolvedValue({ success: false, errors: ["nope"] })
+        const wrapper = await mountPage()
+
+        wrapper.findComponent({ name: "DeleteRestoreButtons" }).vm.$emit("restore")
+        await flushPromises()
+        await flushPromises()
+
+        expect(document.body.textContent).toContain("Failed to restore file")
+    })
+})
+
+describe("Files.vue - row presentation", () => {
+    beforeEach(() => routeGet())
+    afterEach(() => vi.unstubAllEnvs())
+
+    it("labels a trashed file with its deletion and auto-purge dates", async () => {
+        routeGet({ rows: [{ ...FILE_ROW, deletedOn: "2024-02-01T00:00:00", purgeOn: "2024-03-02T00:00:00" }] })
+        const wrapper = await mountPage()
+
+        const deletedIcon = wrapper
+            .findAllComponents({ name: "StatusIcon" })
+            .find((c) => (c.props("label") as string).startsWith("Deleted"))!
+        expect(deletedIcon.props("label")).toBe("Deleted 02/01/24 · purges 03/02/24")
+    })
+
+    it("links the old URL on the VIPER 1 host so legacy links are exercised end to end", async () => {
+        vi.stubEnv("VITE_VIPER_1_HOME", "http://v1.local/")
+        routeGet({ rows: [{ ...FILE_ROW, oldUrl: "/old/report.pdf" }] })
+        const wrapper = await mountPage()
+
+        expect(wrapper.find('a[href="http://v1.local/old/report.pdf"]').exists()).toBeTruthy()
+    })
+
+    it("builds the folder filter options with per-folder counts and an All total", async () => {
+        const wrapper = await mountPage()
+
+        const options = wrapper.findAllComponents({ name: "QSelect" })[0]!.props("options") as { label: string }[]
+        expect(options.map((o) => o.label)).toEqual(["All (3)", "Apps (3)", "Reports (0)"])
+    })
+})
+
+describe("Files.vue - URL and query watcher", () => {
+    beforeEach(() => routeGet())
+
+    it("opens the upload dialog when mounted with the ?upload=1 deep-link and strips the flag", async () => {
+        const { wrapper, router } = await mountPageWithRouter({ upload: "1" })
+        await flushRouter()
+
+        expect(wrapper.findComponent({ name: "FileFormDialog" }).props("modelValue")).toBeTruthy()
+        // The on-mount filter sync races the upload-watcher's strip; the flag must not
+        // survive either write, so re-clicking the nav link can re-open the dialog later.
+        expect(router.currentRoute.value.query.upload).toBeUndefined()
+    })
+
+    it("re-opens the upload dialog when navigation adds ?upload=1, consuming the flag", async () => {
+        const { wrapper, router } = await mountPageWithRouter()
+        expect(wrapper.findComponent({ name: "FileFormDialog" }).props("modelValue")).toBeFalsy()
+
+        await router.push({ path: "/CMS/ManageFiles", query: { upload: "1" } })
+        await flushRouter()
+
+        expect(wrapper.findComponent({ name: "FileFormDialog" }).props("modelValue")).toBeTruthy()
+        // The flag is stripped so re-clicking the nav link can re-open the dialog later.
+        expect(router.currentRoute.value.query.upload).toBeUndefined()
+    })
+
+    it("re-syncs filters and refetches when in-app navigation changes the query", async () => {
+        const { router } = await mountPageWithRouter()
+        const before = listCallCount()
+
+        await router.push({ path: "/CMS/ManageFiles", query: { folder: "Reports", status: "deleted" } })
+        await flushRouter()
+
+        expect(listCallCount()).toBeGreaterThan(before)
+        const url = lastListUrl()
+        expect(url).toContain("folder=Reports")
+        expect(url).toContain("status=deleted")
+    })
+
+    it("does not refetch when the watcher sees our own URL sync (equality guard)", async () => {
+        const { wrapper } = await mountPageWithRouter()
+
+        wrapper.findComponent({ name: "QInput" }).vm.$emit("update:modelValue", "report")
+        await flushPromises()
+        const afterFilterChange = listCallCount()
+
+        // The filter change itself fetched once; the router.replace it triggered must not re-fetch.
+        await flushRouter()
+        expect(listCallCount()).toBe(afterFilterChange)
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/inline-file-upload.test.ts b/VueApp/src/CMS/__tests__/inline-file-upload.test.ts
new file mode 100644
index 000000000..1d168044f
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/inline-file-upload.test.ts
@@ -0,0 +1,335 @@
+import InlineFileUpload from "@/CMS/components/InlineFileUpload.vue"
+import type { CmsFile } from "@/CMS/types"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * InlineFileUpload stages files client-side (validating the extension and checking the name for
+ * conflicts) and only creates anything server-side when the parent calls the exposed commit().
+ * Each staged file commits per its chosen conflict action: new upload / rename (POST, rolled back
+ * on later failure), overwrite-in-place (PUT, never rolled back), or attach-existing (GET only).
+ * Mock ViperFetch; the file picker (VueUse useFileDialog) is mocked at the browser boundary so
+ * tests can hand the component a File directly.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPostForm = vi.fn<(...args: unknown[]) => unknown>()
+const mockPutForm = vi.fn<(...args: unknown[]) => unknown>()
+const mockDel = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        postForm: (...args: unknown[]) => mockPostForm(...args),
+        putForm: (...args: unknown[]) => mockPutForm(...args),
+        del: (...args: unknown[]) => mockDel(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+// Mock the file dialog at the browser boundary: capture the onChange callback so tests can
+// "pick" a file. The drop zone needs real pointer events, so it is inert here (staging via
+// drag and via the picker share stageFile).
+const fileDialogState = vi.hoisted(() => ({
+    onChange: undefined as ((files: File[] | null) => void) | undefined,
+    open: (() => undefined) as () => void,
+}))
+vi.mock("@vueuse/core", async (importOriginal) => {
+    const actual = await importOriginal<typeof import("@vueuse/core")>()
+    const { ref } = await import("vue")
+    return {
+        ...actual,
+        useFileDialog: () => ({
+            open: fileDialogState.open,
+            onChange: (cb: (files: File[] | null) => void) => {
+                fileDialogState.onChange = cb
+            },
+        }),
+        useDropZone: () => ({ isOverDropZone: ref(false) }),
+    }
+})
+
+type NameCheck = {
+    inUse: boolean
+    suggestedName: string
+    existingFileGuid: string | null
+    existingFriendlyName: string | null
+    existingDeleted: boolean
+}
+
+const NO_CONFLICT: NameCheck = {
+    inUse: false,
+    suggestedName: "",
+    existingFileGuid: null,
+    existingFriendlyName: null,
+    existingDeleted: false,
+}
+
+const CONFLICT: NameCheck = {
+    inUse: true,
+    suggestedName: "report_1.pdf",
+    existingFileGuid: "eg1",
+    existingFriendlyName: "report.pdf",
+    existingDeleted: false,
+}
+
+function cmsFile(fileGuid: string, friendlyName: string): CmsFile {
+    return {
+        fileGuid,
+        fileName: friendlyName,
+        folder: "Apps",
+        friendlyName,
+        encrypted: false,
+        description: "",
+        allowPublicAccess: false,
+        oldUrl: null,
+        modifiedOn: "2024-01-01T00:00:00",
+        modifiedBy: "u",
+        deletedOn: null,
+        purgeOn: null,
+        permissions: [],
+        people: [],
+        url: `/files/${fileGuid}`,
+        friendlyUrl: `/Apps/${friendlyName}`,
+    }
+}
+
+// Routes the check-name probe; other get() calls (attach-existing) are configured per test.
+function routeCheckName(check: NameCheck) {
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("check-name")) {
+            return Promise.resolve({ success: true, result: check })
+        }
+        return Promise.resolve({ success: true, result: cmsFile("eg1", "report.pdf") })
+    })
+}
+
+function mountUpload(props: Partial<{ folder: string | null; allowPublicAccess: boolean }> = {}) {
+    return mountCms(InlineFileUpload, {
+        props: {
+            folder: "Apps",
+            permissions: ["SVMSecure.CMS", "SVMSecure.CMS.AllFiles"],
+            allowPublicAccess: false,
+            ...props,
+        },
+    })
+}
+
+async function stage(fileName: string) {
+    fileDialogState.onChange!([new File(["data"], fileName)])
+    await flushPromises()
+    await flushPromises()
+}
+
+function commitOf(wrapper: ReturnType<typeof mountUpload>) {
+    return (wrapper.vm as unknown as { commit: () => Promise<{ attached: CmsFile[]; createdGuids: string[] }> }).commit
+}
+
+beforeEach(() => {
+    mockGet.mockReset()
+    mockPostForm.mockReset()
+    mockPutForm.mockReset()
+    mockDel.mockReset()
+    routeCheckName(NO_CONFLICT)
+})
+
+describe("inlineFileUpload.vue - staging", () => {
+    it("rejects a file type outside the allow-list without checking its name", async () => {
+        const wrapper = mountUpload()
+        await stage("script.bat")
+
+        expect(wrapper.text()).toContain("Files of type .bat aren't allowed.")
+        expect(wrapper.find(".staged-file").exists()).toBeFalsy()
+        expect(mockGet).not.toHaveBeenCalled()
+    })
+
+    it("checks the name in the block's folder and stages an allowed file, reporting the count", async () => {
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        const checkUrl = mockGet.mock.calls[0]![0] as string
+        expect(checkUrl).toContain("check-name")
+        expect(checkUrl).toContain("folder=Apps")
+        expect(checkUrl).toContain("fileName=report.pdf")
+        expect(wrapper.find(".staged-file").text()).toContain("report.pdf")
+        expect(wrapper.emitted("staged-count")?.at(-1)).toStrictEqual([1])
+    })
+
+    it("offers rename, overwrite, and use-existing choices when the name belongs to an existing record", async () => {
+        routeCheckName(CONFLICT)
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        const options = wrapper.findComponent({ name: "QOptionGroup" }).props("options") as { label: string }[]
+        expect(options).toHaveLength(3)
+        expect(options[0]!.label).toContain("report_1.pdf")
+        expect(options.map((o) => o.label).join(",")).toContain("Use the existing file instead")
+    })
+
+    it("omits the use-existing choice when the conflicting name has no file record", async () => {
+        routeCheckName({ ...CONFLICT, existingFileGuid: null })
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        const options = wrapper.findComponent({ name: "QOptionGroup" }).props("options") as { label: string }[]
+        expect(options.map((o) => o.label)).toStrictEqual([
+            "Upload under a new name (report_1.pdf)",
+            "Overwrite the existing file",
+        ])
+    })
+
+    it("removes a staged file and reports the new count", async () => {
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        await wrapper.find("[aria-label='Remove report.pdf']").trigger("click")
+
+        expect(wrapper.find(".staged-file").exists()).toBeFalsy()
+        expect(wrapper.emitted("staged-count")?.at(-1)).toStrictEqual([0])
+    })
+
+    it("ignores picked files while no folder is set (staging is disabled)", async () => {
+        const wrapper = mountUpload({ folder: null })
+        await stage("report.pdf")
+
+        expect(wrapper.find(".staged-file").exists()).toBeFalsy()
+        expect(mockGet).not.toHaveBeenCalled()
+        expect(wrapper.text()).toContain("Set a VIPER section path")
+    })
+})
+
+describe("inlineFileUpload.vue - commit", () => {
+    it("resolves empty without any requests when nothing is staged", async () => {
+        const wrapper = mountUpload()
+        await expect(commitOf(wrapper)()).resolves.toStrictEqual({ attached: [], createdGuids: [] })
+        expect(mockPostForm).not.toHaveBeenCalled()
+    })
+
+    it("uploads a new file with the block's folder, permissions, and public flag, marking it created", async () => {
+        mockPostForm.mockResolvedValue({ success: true, result: cmsFile("n1", "report.pdf") })
+        const wrapper = mountUpload({ allowPublicAccess: true })
+        await stage("report.pdf")
+
+        const result = await commitOf(wrapper)()
+
+        expect(mockPostForm).toHaveBeenCalledOnce()
+        const [url, data] = mockPostForm.mock.calls[0]! as [string, FormData]
+        expect(url).toContain("cms/files/")
+        expect((data.get("file") as File).name).toBe("report.pdf")
+        expect(data.get("folder")).toBe("Apps")
+        expect(data.get("allowPublicAccess")).toBe("true")
+        expect(data.getAll("permissions")).toStrictEqual(["SVMSecure.CMS", "SVMSecure.CMS.AllFiles"])
+        expect(data.has("fileName")).toBeFalsy()
+        expect(data.has("overwrite")).toBeFalsy()
+
+        expect(result.attached.map((f) => f.fileGuid)).toStrictEqual(["n1"])
+        expect(result.createdGuids).toStrictEqual(["n1"])
+        // The staged list is cleared once everything committed.
+        expect(wrapper.emitted("staged-count")?.at(-1)).toStrictEqual([0])
+    })
+
+    it("uploads under the suggested name when rename is chosen for a conflict", async () => {
+        routeCheckName(CONFLICT)
+        mockPostForm.mockResolvedValue({ success: true, result: cmsFile("n2", "report_1.pdf") })
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        // Rename is the default conflict action.
+        const result = await commitOf(wrapper)()
+
+        const [, data] = mockPostForm.mock.calls[0]! as [string, FormData]
+        expect(data.get("fileName")).toBe("report_1.pdf")
+        expect(data.has("overwrite")).toBeFalsy()
+        expect(result.createdGuids).toStrictEqual(["n2"])
+    })
+
+    it("overwrites the existing record in place via PUT and does not mark it for rollback", async () => {
+        routeCheckName(CONFLICT)
+        mockPutForm.mockResolvedValue({ success: true, result: cmsFile("eg1", "report.pdf") })
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        wrapper.findComponent({ name: "QOptionGroup" }).vm.$emit("update:modelValue", "overwrite")
+        const result = await commitOf(wrapper)()
+
+        expect(mockPostForm).not.toHaveBeenCalled()
+        const [url, data] = mockPutForm.mock.calls[0]! as [string, FormData]
+        expect(url).toContain("cms/files/eg1")
+        // Overwrite-in-place reuses the record; no folder/new-name fields.
+        expect(data.has("folder")).toBeFalsy()
+        expect(result.attached.map((f) => f.fileGuid)).toStrictEqual(["eg1"])
+        expect(result.createdGuids).toStrictEqual([])
+    })
+
+    it("pOSTs with the overwrite flag when overwriting an on-disk file that has no record", async () => {
+        routeCheckName({ ...CONFLICT, existingFileGuid: null })
+        mockPostForm.mockResolvedValue({ success: true, result: cmsFile("n3", "report.pdf") })
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        wrapper.findComponent({ name: "QOptionGroup" }).vm.$emit("update:modelValue", "overwrite")
+        const result = await commitOf(wrapper)()
+
+        expect(mockPutForm).not.toHaveBeenCalled()
+        const [, data] = mockPostForm.mock.calls[0]! as [string, FormData]
+        expect(data.get("overwrite")).toBe("true")
+        // A NEW record was created for the orphan, so it is rollback-safe.
+        expect(result.createdGuids).toStrictEqual(["n3"])
+    })
+
+    it("attaches the existing file without uploading when use-existing is chosen", async () => {
+        routeCheckName(CONFLICT)
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        wrapper.findComponent({ name: "QOptionGroup" }).vm.$emit("update:modelValue", "existing")
+        const result = await commitOf(wrapper)()
+
+        expect(mockPostForm).not.toHaveBeenCalled()
+        expect(mockPutForm).not.toHaveBeenCalled()
+        const fileFetch = mockGet.mock.calls.map((c) => c[0] as string).find((u) => !u.includes("check-name"))
+        expect(fileFetch).toContain("cms/files/eg1")
+        expect(result.attached.map((f) => f.fileGuid)).toStrictEqual(["eg1"])
+        expect(result.createdGuids).toStrictEqual([])
+    })
+
+    it("aborts the commit with the load error when the existing file cannot be fetched", async () => {
+        mockGet.mockImplementation((...args: unknown[]) => {
+            const url = args[0] as string
+            if (url.includes("check-name")) {
+                return Promise.resolve({ success: true, result: CONFLICT })
+            }
+            return Promise.resolve({ success: false, errors: ["gone"] })
+        })
+        const wrapper = mountUpload()
+        await stage("report.pdf")
+
+        wrapper.findComponent({ name: "QOptionGroup" }).vm.$emit("update:modelValue", "existing")
+        await expect(commitOf(wrapper)()).rejects.toThrow("gone")
+    })
+
+    it("rolls back files created earlier in the batch when a later upload fails, keeping them staged", async () => {
+        mockPostForm
+            .mockResolvedValueOnce({ success: true, result: cmsFile("n1", "a.pdf") })
+            .mockResolvedValueOnce({ success: false, errors: ["disk full"] })
+        mockDel.mockResolvedValue({ success: true, result: null })
+        const wrapper = mountUpload()
+        await stage("a.pdf")
+        await stage("b.pdf")
+
+        await expect(commitOf(wrapper)()).rejects.toThrow("disk full")
+
+        // The first (created) upload is soft-deleted so nothing new is stranded.
+        expect(mockDel).toHaveBeenCalledOnce()
+        expect(mockDel.mock.calls[0]![0]).toContain("cms/files/n1")
+        // The staged list is NOT cleared, so the user can retry the save.
+        expect(wrapper.findAll(".staged-file")).toHaveLength(2)
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/left-nav-menu-dialog.test.ts b/VueApp/src/CMS/__tests__/left-nav-menu-dialog.test.ts
new file mode 100644
index 000000000..88eb81f37
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/left-nav-menu-dialog.test.ts
@@ -0,0 +1,100 @@
+import LeftNavMenuDialog from "@/CMS/components/LeftNavMenuDialog.vue"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * LeftNavMenuDialog adds a left-nav menu. The behaviors worth locking down: the menu-header
+ * field is required (greedy validation blocks save), opening the dialog resets to an empty
+ * form and captures the unsaved-changes baseline, and a successful POST emits created + closes.
+ */
+
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        post: (...args: unknown[]) => mockPost(...args),
+    }),
+}))
+
+function bodyText(): string {
+    return document.body.textContent ?? ""
+}
+
+// QDialog teleports its DOM, but the component tree (and so findComponent) still includes the
+// teleported children. Trigger submit on the QForm's <form> element via VTU so a real event is
+// dispatched (calling QForm.submit() directly passes an undefined event and trips .prevent).
+async function submitDialogForm(wrapper: ReturnType<typeof mountDialog>): Promise<void> {
+    await wrapper.findComponent({ name: "QForm" }).find("form").trigger("submit")
+}
+
+function mountDialog(modelValue = true) {
+    return mountCms(LeftNavMenuDialog, { props: { modelValue } })
+}
+
+describe("LeftNavMenuDialog.vue", () => {
+    beforeEach(() => {
+        mockPost.mockReset()
+        document.body.innerHTML = ""
+    })
+
+    it("renders the Add Left-Nav Menu title and Create button when open", async () => {
+        mountDialog(true)
+        await flushPromises()
+        expect(bodyText()).toContain("Add Left-Nav Menu")
+        expect(bodyText()).toContain("Create Menu")
+    })
+
+    it("blocks save and shows the validation banner when the menu header is blank", async () => {
+        const wrapper = mountDialog(true)
+        await flushPromises()
+        await submitDialogForm(wrapper)
+        await flushPromises()
+        expect(mockPost).not.toHaveBeenCalled()
+        expect(bodyText()).toContain("Please complete the required fields")
+    })
+
+    it("POSTs the menu and emits created + close on success", async () => {
+        mockPost.mockResolvedValue({ success: true, result: { leftNavMenuId: 42 } })
+        const wrapper = mountDialog(true)
+        await flushPromises()
+
+        // The menu-header field is the first QInput the settings fields render.
+        await wrapper.findComponent({ name: "QInput" }).setValue("Main Menu")
+        await flushPromises()
+
+        await submitDialogForm(wrapper)
+        await flushPromises()
+
+        expect(mockPost).toHaveBeenCalledOnce()
+        const [url, payload] = mockPost.mock.calls[0]!
+        expect(url).toContain("cms/left-navs")
+        expect(payload).toMatchObject({ menuHeaderText: "Main Menu", system: "Viper" })
+        // Blank optional fields are normalized to null.
+        expect((payload as Record<string, unknown>).page).toBeNull()
+        expect(wrapper.emitted("created")?.at(-1)).toEqual([42])
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([false])
+    })
+
+    it("surfaces the server error and keeps the dialog open when POST fails", async () => {
+        mockPost.mockResolvedValue({ success: false, errors: ["A menu with that name exists"] })
+        const wrapper = mountDialog(true)
+        await flushPromises()
+
+        await wrapper.findComponent({ name: "QInput" }).setValue("Dupe")
+        await flushPromises()
+
+        await submitDialogForm(wrapper)
+        await flushPromises()
+
+        expect(bodyText()).toContain("A menu with that name exists")
+        expect(wrapper.emitted("created")).toBeFalsy()
+    })
+
+    it("closes immediately (no guard prompt) when the form is unchanged", async () => {
+        const wrapper = mountDialog(true)
+        await flushPromises()
+        // Close with a pristine, empty form: confirmClose resolves true with no dialog.
+        await wrapper.findComponent({ name: "QBtn" }).trigger("click")
+        await flushPromises()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([false])
+        expect(bodyText()).not.toContain("Unsaved Changes")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/left-nav-menus.test.ts b/VueApp/src/CMS/__tests__/left-nav-menus.test.ts
new file mode 100644
index 000000000..e73827842
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/left-nav-menus.test.ts
@@ -0,0 +1,176 @@
+import LeftNavMenus from "@/CMS/pages/LeftNavMenus.vue"
+import { mountCms, flushPromises, flushRouter, createTestRouter } from "./test-utils"
+
+/**
+ * LeftNavMenus list: filter inputs drive system/search query params, returned rows bind to the
+ * table, and the ?add=1 deep-link opens the add dialog on mount.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockDel = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        del: (...args: unknown[]) => mockDel(...args),
+        post: vi.fn<(...args: unknown[]) => unknown>(),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const MENU_ROW = {
+    leftNavMenuId: 1,
+    menuHeaderText: "Main",
+    system: "Viper",
+    viperSectionPath: null,
+    page: null,
+    friendlyName: null,
+    items: [{ leftNavItemId: 1 }],
+    modifiedOn: "2024-01-01T00:00:00",
+    modifiedBy: "u",
+}
+
+function routeGet(rows: unknown[] = [MENU_ROW]) {
+    mockGet.mockReset()
+    mockDel.mockReset()
+    mockGet.mockResolvedValue({ success: true, result: rows })
+}
+
+function lastUrl(): string {
+    return (mockGet.mock.calls.at(-1)?.[0] as string) ?? ""
+}
+
+async function mountPageWithRouter(query: Record<string, string> = {}) {
+    const router = createTestRouter()
+    await router.push({ path: "/CMS/ManageLeftNav", query })
+    await router.isReady()
+    const wrapper = mountCms(LeftNavMenus, {}, router)
+    await flushPromises()
+    await flushPromises()
+    return { wrapper, router }
+}
+
+async function mountPage(query: Record<string, string> = {}) {
+    return (await mountPageWithRouter(query)).wrapper
+}
+
+// Quasar plugin dialogs ($q.dialog) and notifications teleport to document.body. Click the LAST
+// match: a dismissed dialog's portal can linger mid-transition, so the newest dialog is the live
+// one. The body is never wiped between tests (Quasar caches its notification container there),
+// so toast assertions use per-test-unique messages.
+function clickBodyButton(label: string) {
+    const btn = [...document.body.querySelectorAll("button")].filter((b) => b.textContent?.includes(label)).at(-1)
+    expect(btn, `expected a "${label}" button in the dialog`).toBeTruthy()
+    btn!.click()
+}
+
+describe("LeftNavMenus.vue", () => {
+    beforeEach(() => routeGet())
+
+    it("loads menus on mount and binds the returned rows to the table", async () => {
+        const wrapper = await mountPage()
+        expect(mockGet).toHaveBeenCalled()
+        expect(wrapper.findComponent({ name: "QTable" }).props("rows")).toHaveLength(1)
+        expect(wrapper.text()).toContain("Main")
+    })
+
+    it("includes the search term in the query when the search field changes", async () => {
+        const wrapper = await mountPage()
+        const searchInput = wrapper.findAllComponents({ name: "QInput" })[0]!
+        searchInput.vm.$emit("update:modelValue", "main")
+        await flushPromises()
+        expect(lastUrl()).toContain("search=main")
+    })
+
+    it("includes the chosen system in the query", async () => {
+        const wrapper = await mountPage()
+        const systemSelect = wrapper.findAllComponents({ name: "QSelect" })[0]!
+        systemSelect.vm.$emit("update:modelValue", "Public")
+        await flushPromises()
+        expect(lastUrl()).toContain("system=Public")
+    })
+
+    it("opens the add dialog when ?add=1 is present on mount", async () => {
+        const wrapper = await mountPage({ add: "1" })
+        expect(wrapper.findComponent({ name: "LeftNavMenuDialog" }).props("modelValue")).toBeTruthy()
+    })
+
+    it("leaves the add dialog closed without ?add=1", async () => {
+        const wrapper = await mountPage()
+        expect(wrapper.findComponent({ name: "LeftNavMenuDialog" }).props("modelValue")).toBeFalsy()
+    })
+
+    it("clears the table and notifies when loading menus fails", async () => {
+        mockGet.mockReset()
+        mockGet.mockResolvedValue({ success: false, errors: ["nav service down"] })
+        const wrapper = await mountPage()
+
+        expect(wrapper.findComponent({ name: "QTable" }).props("rows")).toEqual([])
+        expect(document.body.textContent).toContain("nav service down")
+    })
+
+    it("navigates to the new menu's item editor after the add dialog reports a create", async () => {
+        const { wrapper, router } = await mountPageWithRouter()
+
+        wrapper.findComponent({ name: "LeftNavMenuDialog" }).vm.$emit("created", 33)
+        await flushRouter()
+
+        expect(router.currentRoute.value.name).toBe("CmsLeftNavEdit")
+        expect(router.currentRoute.value.params.id).toBe("33")
+    })
+})
+
+describe("LeftNavMenus.vue - delete", () => {
+    beforeEach(() => routeGet())
+
+    it("permanently deletes the menu and reloads once the confirm dialog is accepted", async () => {
+        mockDel.mockResolvedValue({ success: true, result: null })
+        const wrapper = await mountPage()
+        const before = mockGet.mock.calls.length
+
+        await wrapper.find("[aria-label='Delete menu']").trigger("click")
+        await flushPromises()
+        // The confirmation spells out the item count so the loss is clear.
+        expect(document.body.textContent).toContain('Permanently delete "Main" and its 1 item?')
+
+        clickBodyButton("Delete Menu")
+        await flushPromises()
+        await flushPromises()
+
+        expect(mockDel).toHaveBeenCalledOnce()
+        expect(mockDel.mock.calls[0]![0]).toContain("cms/left-navs/1")
+        expect(document.body.textContent).toContain("Menu deleted")
+        expect(mockGet.mock.calls.length).toBeGreaterThan(before)
+    })
+
+    it("does not delete when the confirm dialog is cancelled", async () => {
+        const wrapper = await mountPage()
+
+        await wrapper.find("[aria-label='Delete menu']").trigger("click")
+        await flushPromises()
+        clickBodyButton("Cancel")
+        await flushPromises()
+
+        expect(mockDel).not.toHaveBeenCalled()
+    })
+
+    it("notifies when the delete fails", async () => {
+        mockDel.mockResolvedValue({ success: false, errors: ["in use"] })
+        const wrapper = await mountPage()
+
+        await wrapper.find("[aria-label='Delete menu']").trigger("click")
+        await flushPromises()
+        clickBodyButton("Delete Menu")
+        await flushPromises()
+        await flushPromises()
+
+        expect(document.body.textContent).toContain("Failed to delete menu")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/link-collections.test.ts b/VueApp/src/CMS/__tests__/link-collections.test.ts
new file mode 100644
index 000000000..1c6660619
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/link-collections.test.ts
@@ -0,0 +1,293 @@
+import LinkCollections from "@/CMS/components/LinkCollections.vue"
+import ManageLinkCollections from "@/CMS/pages/ManageLinkCollections.vue"
+import type { Link, LinkCollection } from "@/CMS/types"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * LinkCollections is the most logic-dense CMS display component: it loads a collection and
+ * its links, derives tag-category filters, then filters (search across title/description/tags,
+ * case-insensitive; plus per-category tag select) and optionally groups links by a category.
+ * These tests mock ViperFetch to seed deterministic data and assert the filter/group output.
+ * The ManageLinkCollections admin page (same domain) is also exercised here for its
+ * unsaved-changes guard on the Edit Collection dialog.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPut = vi.fn<(...args: unknown[]) => unknown>()
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+const mockDel = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        put: (...args: unknown[]) => mockPut(...args),
+        post: (...args: unknown[]) => mockPost(...args),
+        del: (...args: unknown[]) => mockDel(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const TYPE_CATEGORY_ID = 1
+const SUBJECT_CATEGORY_ID = 2
+
+const collection: LinkCollection = {
+    linkCollectionId: 7,
+    linkCollection: "Resources",
+    linkCollectionTagCategories: [
+        { linkCollectionTagCategoryId: TYPE_CATEGORY_ID, linkCollectionTagCategory: "Type", sortOrder: 1 },
+        { linkCollectionTagCategoryId: SUBJECT_CATEGORY_ID, linkCollectionTagCategory: "Subject", sortOrder: 2 },
+    ],
+}
+
+function tag(categoryId: number, value: string) {
+    return {
+        linkTagId: Math.floor(Math.random() * 100_000),
+        linkId: 0,
+        linkCollectionTagCategoryId: categoryId,
+        sortOrder: 1,
+        value,
+    }
+}
+
+const links: Link[] = [
+    {
+        linkId: 1,
+        url: "https://a.example.com",
+        title: "Anatomy Guide",
+        description: "Bones and muscles",
+        order: 1,
+        linkTags: [tag(TYPE_CATEGORY_ID, "PDF"), tag(SUBJECT_CATEGORY_ID, "Anatomy")],
+    },
+    {
+        linkId: 2,
+        url: "https://b.example.com",
+        title: "Pharmacology Notes",
+        description: "Drug interactions",
+        order: 2,
+        linkTags: [tag(TYPE_CATEGORY_ID, "Doc"), tag(SUBJECT_CATEGORY_ID, "Pharmacology")],
+    },
+    {
+        linkId: 3,
+        url: "https://c.example.com",
+        title: "Anatomy Atlas",
+        description: "Detailed plates",
+        order: 3,
+        linkTags: [tag(TYPE_CATEGORY_ID, "PDF"), tag(SUBJECT_CATEGORY_ID, "Anatomy")],
+    },
+]
+
+// First get() returns the collection wrapped in an array (the component reads result[0]);
+// the second returns the link list.
+function primeFetch(linkList: Link[] = links) {
+    mockGet.mockReset()
+    mockGet
+        .mockResolvedValueOnce({ success: true, result: [collection] })
+        .mockResolvedValueOnce({ success: true, result: linkList })
+}
+
+async function mountLoaded(props: { linkCollectionName: string; groupByTagCategory?: string | null }) {
+    const wrapper = mountCms(LinkCollections, { props })
+    await flushPromises()
+    await flushPromises()
+    return wrapper
+}
+
+function linkCardTitles(wrapper: ReturnType<typeof mountCms>): string[] {
+    return wrapper.findAllComponents({ name: "Link" }).map((c) => (c.props("link") as Link).title)
+}
+
+describe("LinkCollections.vue - loading", () => {
+    beforeEach(() => primeFetch())
+
+    it("requests the collection by name then loads its links", async () => {
+        await mountLoaded({ linkCollectionName: "Resources" })
+        expect(mockGet).toHaveBeenCalledTimes(2)
+        expect(mockGet.mock.calls[0]![0]).toContain("linkCollectionName=Resources")
+        expect(mockGet.mock.calls[1]![0]).toContain(`/${collection.linkCollectionId}/links`)
+    })
+
+    it("renders one Link card per loaded link when no filter is active", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        expect(linkCardTitles(wrapper)).toHaveLength(3)
+    })
+})
+
+describe("LinkCollections.vue - search filter", () => {
+    beforeEach(() => primeFetch())
+
+    it("filters by title case-insensitively", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        const vm = wrapper.vm as unknown as { search: string }
+        vm.search = "anatomy"
+        await flushPromises()
+        expect(linkCardTitles(wrapper).toSorted()).toEqual(["Anatomy Atlas", "Anatomy Guide"])
+    })
+
+    it("matches on description text", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        const vm = wrapper.vm as unknown as { search: string }
+        vm.search = "interactions"
+        await flushPromises()
+        expect(linkCardTitles(wrapper)).toEqual(["Pharmacology Notes"])
+    })
+
+    it("matches on a tag value", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        const vm = wrapper.vm as unknown as { search: string }
+        vm.search = "pharmacology"
+        await flushPromises()
+        // "Pharmacology" matches both the title and the Subject tag of link 2 only.
+        expect(linkCardTitles(wrapper)).toEqual(["Pharmacology Notes"])
+    })
+
+    it("shows the empty banner when nothing matches", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        const vm = wrapper.vm as unknown as { search: string }
+        vm.search = "zzz-no-match"
+        await flushPromises()
+        expect(linkCardTitles(wrapper)).toHaveLength(0)
+        expect(wrapper.text()).toContain("No links found.")
+    })
+})
+
+describe("LinkCollections.vue - tag category filter", () => {
+    beforeEach(() => primeFetch())
+
+    it("filters links to those carrying the selected tag value", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        const vm = wrapper.vm as unknown as {
+            tagFilters: { linkCollectionTagCategoryId: number; selected: string | null }[]
+        }
+        const subjectFilter = vm.tagFilters.find((t) => t.linkCollectionTagCategoryId === SUBJECT_CATEGORY_ID)!
+        subjectFilter.selected = "Anatomy"
+        await flushPromises()
+        expect(linkCardTitles(wrapper).toSorted()).toEqual(["Anatomy Atlas", "Anatomy Guide"])
+    })
+
+    it("builds de-duplicated, sorted options per category from the link tags", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        const vm = wrapper.vm as unknown as {
+            tagFilters: { linkCollectionTagCategoryId: number; options: string[] }[]
+        }
+        const subject = vm.tagFilters.find((t) => t.linkCollectionTagCategoryId === SUBJECT_CATEGORY_ID)!
+        // Anatomy appears twice in the data but must be de-duplicated.
+        expect(subject.options).toEqual(["Anatomy", "Pharmacology"])
+    })
+})
+
+describe("LinkCollections.vue - group by tag category", () => {
+    beforeEach(() => primeFetch())
+
+    it("buckets links by their value in the group-by tag category", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources", groupByTagCategory: "Subject" })
+        const vm = wrapper.vm as unknown as { groupedLinks: Map<string, Link[]> }
+        const anatomy = (vm.groupedLinks.get("Anatomy") ?? []).map((l) => l.title)
+        expect(anatomy.toSorted()).toEqual(["Anatomy Atlas", "Anatomy Guide"])
+        const pharm = (vm.groupedLinks.get("Pharmacology") ?? []).map((l) => l.title)
+        expect(pharm).toEqual(["Pharmacology Notes"])
+    })
+
+    it("renders all links and builds no buckets when no group category is set", async () => {
+        primeFetch()
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources" })
+        expect(linkCardTitles(wrapper)).toHaveLength(3)
+        const vm = wrapper.vm as unknown as { groupedLinks: Map<string, Link[]> }
+        expect(vm.groupedLinks.size).toBe(0)
+    })
+
+    it("computes the sorted set of group header values", async () => {
+        const wrapper = await mountLoaded({ linkCollectionName: "Resources", groupByTagCategory: "Subject" })
+        const vm = wrapper.vm as unknown as { groupByValues: string[] }
+        expect(vm.groupByValues).toEqual(["Anatomy", "Pharmacology"])
+    })
+})
+
+// Quasar plugin dialogs teleport to document.body; click the LAST matching button since a
+// dismissed dialog's portal can briefly linger mid-transition.
+function clickBodyButton(label: string) {
+    const btn = [...document.body.querySelectorAll("button")].filter((b) => b.textContent?.includes(label)).at(-1)
+    expect(btn, `expected a "${label}" button`).toBeTruthy()
+    btn!.click()
+}
+
+const MANAGE_COLLECTION = { linkCollectionId: 7, linkCollection: "Resources" }
+const MANAGE_TAGS = [{ linkCollectionTagCategoryId: 1, linkCollectionTagCategory: "Type", sortOrder: 1 }]
+
+// The manage page fans out to the collection list, then the selected collection's links + tags.
+function primeManageFetch() {
+    mockGet.mockReset()
+    mockPut.mockReset()
+    mockPost.mockReset()
+    mockDel.mockReset()
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("/links")) return Promise.resolve({ success: true, result: [] })
+        if (url.includes("/tags")) return Promise.resolve({ success: true, result: MANAGE_TAGS })
+        return Promise.resolve({ success: true, result: [MANAGE_COLLECTION] })
+    })
+}
+
+type ManageVm = {
+    showCollectionDialog: boolean
+    draftTags: { linkCollectionTagCategoryId: number; linkCollectionTagCategory: string; sortOrder: number }[]
+}
+
+describe("ManageLinkCollections.vue - Edit Collection dialog unsaved-changes guard", () => {
+    beforeEach(() => primeManageFetch())
+
+    async function mountManage() {
+        const wrapper = mountCms(ManageLinkCollections)
+        await flushPromises()
+        await flushPromises()
+        return wrapper
+    }
+
+    function closeCollectionDialog() {
+        const closeBtn = document.body.querySelector<HTMLButtonElement>('button[aria-label="Close dialog"]')
+        expect(closeBtn, "expected the collection dialog close (X) button").toBeTruthy()
+        closeBtn!.click()
+    }
+
+    it("prompts before discarding staged tag edits, then discards on confirm", async () => {
+        const wrapper = await mountManage()
+        const vm = wrapper.vm as unknown as ManageVm
+
+        vm.showCollectionDialog = true
+        await flushPromises()
+        // Stage a new tag category so the dialog is dirty.
+        vm.draftTags.push({ linkCollectionTagCategoryId: -1, linkCollectionTagCategory: "New", sortOrder: 2 })
+        await flushPromises()
+
+        closeCollectionDialog()
+        await flushPromises()
+        // The guard intercepts the close instead of silently discarding the staged edits.
+        expect(document.body.textContent).toContain("Unsaved Changes")
+        expect(vm.showCollectionDialog).toBe(true)
+
+        clickBodyButton("Discard Changes")
+        await flushPromises()
+        await flushPromises()
+        expect(vm.showCollectionDialog).toBe(false)
+    })
+
+    it("closes without prompting when nothing was edited", async () => {
+        const wrapper = await mountManage()
+        const vm = wrapper.vm as unknown as ManageVm
+
+        vm.showCollectionDialog = true
+        await flushPromises()
+
+        closeCollectionDialog()
+        await flushPromises()
+        await flushPromises()
+        // Clean dialog: confirmClose resolves immediately, so the dialog just closes.
+        expect(vm.showCollectionDialog).toBe(false)
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/link.test.ts b/VueApp/src/CMS/__tests__/link.test.ts
new file mode 100644
index 000000000..aca3d3b47
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/link.test.ts
@@ -0,0 +1,137 @@
+// oxlint-disable no-script-url -- a javascript: URL is the unsafe input under test here
+import LinkComponent from "@/CMS/components/Link.vue"
+import type { Link, LinkCollection } from "@/CMS/types"
+import { mountCms } from "./test-utils"
+
+/**
+ * Link.vue renders a single collection link. The two behaviors worth locking down are:
+ * unsafe URLs degrade to plain text (no href), and tag badges color-cycle through a
+ * fixed palette keyed by each tag category's 1-based sortOrder.
+ */
+
+function makeCollection(sortOrders: number[]): LinkCollection {
+    return {
+        linkCollectionId: 1,
+        linkCollection: "Resources",
+        linkCollectionTagCategories: sortOrders.map((sortOrder, i) => ({
+            linkCollectionTagCategoryId: i + 1,
+            linkCollectionTagCategory: `Category ${i + 1}`,
+            sortOrder,
+        })),
+    }
+}
+
+function makeLink(overrides: Partial<Link> = {}): Link {
+    return {
+        linkId: 10,
+        url: "https://example.com",
+        title: "Example",
+        description: "An example link",
+        order: 1,
+        linkTags: [],
+        ...overrides,
+    }
+}
+
+describe("Link.vue - URL safety", () => {
+    it("renders an anchor with the safe href for an http(s) URL", () => {
+        const wrapper = mountCms(LinkComponent, {
+            props: { link: makeLink({ url: "https://example.com/page" }), linkCollection: makeCollection([]) },
+        })
+        const anchor = wrapper.find("a")
+        expect(anchor.exists()).toBeTruthy()
+        expect(anchor.attributes("href")).toBe("https://example.com/page")
+        expect(anchor.attributes("target")).toBe("_blank")
+        expect(anchor.attributes("rel")).toBe("noopener noreferrer")
+    })
+
+    it("renders the title as plain text (no anchor) for a javascript: URL", () => {
+        const wrapper = mountCms(LinkComponent, {
+            props: {
+                link: makeLink({ url: "javascript:alert(1)", title: "Sketchy" }),
+                linkCollection: makeCollection([]),
+            },
+        })
+        expect(wrapper.find("a").exists()).toBeFalsy()
+        expect(wrapper.text()).toContain("Sketchy")
+    })
+
+    it("renders plain text for an empty URL (safeHref returns '#')", () => {
+        const wrapper = mountCms(LinkComponent, {
+            props: { link: makeLink({ url: "" }), linkCollection: makeCollection([]) },
+        })
+        expect(wrapper.find("a").exists()).toBeFalsy()
+    })
+})
+
+describe("Link.vue - tag badge color cycling", () => {
+    // The categorical palette has 5 non-semantic entries; the component maps
+    // sortOrder n -> index (n-1) % 5. sortOrder 1 -> primary/white,
+    // 2 -> arboretum/dark, 6 -> wraps back to primary/white.
+    function mountWithTag(categorySortOrder: number) {
+        const categoryId = 1
+        const collection: LinkCollection = {
+            linkCollectionId: 1,
+            linkCollection: "Resources",
+            linkCollectionTagCategories: [
+                {
+                    linkCollectionTagCategoryId: categoryId,
+                    linkCollectionTagCategory: "Cat",
+                    sortOrder: categorySortOrder,
+                },
+            ],
+        }
+        const link = makeLink({
+            linkTags: [
+                { linkTagId: 1, linkId: 10, linkCollectionTagCategoryId: categoryId, sortOrder: 1, value: "TagValue" },
+            ],
+        })
+        return mountCms(LinkComponent, { props: { link, linkCollection: collection } })
+    }
+
+    it("uses the first palette entry (primary) for sortOrder 1", () => {
+        const wrapper = mountWithTag(1)
+        const badge = wrapper.findComponent({ name: "QBadge" })
+        expect(badge.exists()).toBeTruthy()
+        expect(badge.props("color")).toBe("primary")
+        expect(badge.props("textColor")).toBe("white")
+        expect(badge.text()).toContain("TagValue")
+    })
+
+    it("uses the second palette entry (arboretum) for sortOrder 2, paired with dark text", () => {
+        const badge = mountWithTag(2).findComponent({ name: "QBadge" })
+        expect(badge.props("color")).toBe("arboretum")
+        expect(badge.props("textColor")).toBe("dark")
+    })
+
+    it("wraps modulo the palette length so sortOrder 6 matches sortOrder 1", () => {
+        const badge = mountWithTag(6).findComponent({ name: "QBadge" })
+        expect(badge.props("color")).toBe("primary")
+        expect(badge.props("textColor")).toBe("white")
+    })
+
+    it("falls back to the first entry for a non-positive sortOrder", () => {
+        const badge = mountWithTag(0).findComponent({ name: "QBadge" })
+        expect(badge.props("color")).toBe("primary")
+    })
+
+    it("only renders badges for tags whose category matches the collection category", () => {
+        const collection: LinkCollection = {
+            linkCollectionId: 1,
+            linkCollection: "Resources",
+            linkCollectionTagCategories: [
+                { linkCollectionTagCategoryId: 1, linkCollectionTagCategory: "Cat1", sortOrder: 1 },
+            ],
+        }
+        const link = makeLink({
+            linkTags: [
+                { linkTagId: 1, linkId: 10, linkCollectionTagCategoryId: 1, sortOrder: 1, value: "Shown" },
+                { linkTagId: 2, linkId: 10, linkCollectionTagCategoryId: 99, sortOrder: 1, value: "Hidden" },
+            ],
+        })
+        const wrapper = mountCms(LinkComponent, { props: { link, linkCollection: collection } })
+        const badges = wrapper.findAllComponents({ name: "QBadge" })
+        expect(badges).toHaveLength(1)
+        expect(badges[0]!.text()).toContain("Shown")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/modified-stamp.test.ts b/VueApp/src/CMS/__tests__/modified-stamp.test.ts
new file mode 100644
index 000000000..2057abda5
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/modified-stamp.test.ts
@@ -0,0 +1,60 @@
+import ModifiedStamp from "@/CMS/components/ModifiedStamp.vue"
+import { mountCms } from "./test-utils"
+
+/**
+ * ModifiedStamp shows a "MM/DD/YY by <user>" stamp. It renders a <q-td> in table mode
+ * (cellProps given) or a plain <span> in card/grid mode (row given), sharing one date
+ * format. A blank modifiedOn must produce no date text.
+ */
+
+describe("ModifiedStamp.vue", () => {
+    it("formats modifiedOn as MM/DD/YY (en-US 2-digit)", () => {
+        // Card mode (row prop) and table mode share the same `formatted` computed; assert the
+        // format via the plainly-rendered span so we don't depend on QTable's slot internals.
+        const wrapper = mountCms(ModifiedStamp, {
+            props: { row: { modifiedOn: "2024-03-09T12:00:00", modifiedBy: "jdoe" } },
+        })
+        expect(wrapper.text()).toContain("03/09/24")
+        expect(wrapper.text()).toContain("jdoe")
+    })
+
+    it("renders a q-td when given cellProps (table mode)", () => {
+        const wrapper = mountCms(ModifiedStamp, {
+            props: { cellProps: { row: { modifiedOn: "2024-03-09T12:00:00", modifiedBy: "jdoe" } } },
+        })
+        expect(wrapper.findComponent({ name: "QTd" }).exists()).toBeTruthy()
+    })
+
+    it("renders a plain span (no q-td) when given a row directly (card mode)", () => {
+        const wrapper = mountCms(ModifiedStamp, {
+            props: { row: { modifiedOn: "2024-03-09T12:00:00", modifiedBy: "asmith" } },
+        })
+        expect(wrapper.findComponent({ name: "QTd" }).exists()).toBeFalsy()
+        expect(wrapper.find("span").exists()).toBeTruthy()
+        expect(wrapper.text()).toContain("03/09/24")
+        expect(wrapper.text()).toContain("asmith")
+    })
+
+    it("renders no date text when modifiedOn is empty", () => {
+        const wrapper = mountCms(ModifiedStamp, {
+            props: { row: { modifiedOn: "", modifiedBy: "nobody" } },
+        })
+        expect(wrapper.text().trim()).toBe("nobody")
+        // No slashes from a formatted date.
+        expect(wrapper.text()).not.toContain("/")
+    })
+
+    it("chooses the q-td (cellProps) branch when both cellProps and row are supplied", () => {
+        // The template's v-if is on cellProps, so supplying both renders the q-td branch (and
+        // the stamp computed prefers cellProps.row), never the plain-span row branch.
+        const wrapper = mountCms(ModifiedStamp, {
+            props: {
+                cellProps: { row: { modifiedOn: "2024-03-09T12:00:00", modifiedBy: "fromCell" } },
+                row: { modifiedOn: "2020-01-01T00:00:00", modifiedBy: "fromRow" },
+            },
+        })
+        expect(wrapper.findComponent({ name: "QTd" }).exists()).toBeTruthy()
+        // The span-only fallback branch must not render alongside the q-td.
+        expect(wrapper.text()).not.toContain("fromRow")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/permission-selector.test.ts b/VueApp/src/CMS/__tests__/permission-selector.test.ts
new file mode 100644
index 000000000..85d5702a5
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/permission-selector.test.ts
@@ -0,0 +1,86 @@
+import PermissionSelector from "@/CMS/components/PermissionSelector.vue"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * PermissionSelector lazily loads the full permission list on first filter, then filters it
+ * client-side (case-insensitive substring). Subsequent filters must not re-fetch. Driving the
+ * QSelect's filter() method exercises the component's @filter handler with a real done callback.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+    }),
+}))
+
+const ALL_PERMISSIONS = ["SVMSecure.CMS", "SVMSecure.CMS.Files", "SVMSecure.Effort", "CTS.Manage"]
+
+function mountSelector(modelValue: string[] = []) {
+    return mountCms(PermissionSelector, { props: { modelValue } })
+}
+
+// Quasar's @filter handler is (val, update, abort); the component only uses (val, update), so
+// runUpdate (which runs the setter synchronously, as Quasar would) is all we need to drive it.
+const runUpdate = (fn: () => void) => fn()
+
+// Invoke the component's @filter handler directly via the QSelect's "filter" event.
+async function filter(wrapper: ReturnType<typeof mountSelector>, value: string) {
+    wrapper.findComponent({ name: "QSelect" }).vm.$emit("filter", value, runUpdate)
+    await flushPromises()
+    await flushPromises()
+}
+
+function currentOptions(wrapper: ReturnType<typeof mountSelector>): string[] {
+    return (wrapper.findComponent({ name: "QSelect" }).props("options") as string[]) ?? []
+}
+
+describe("PermissionSelector.vue", () => {
+    beforeEach(() => {
+        mockGet.mockReset()
+        mockGet.mockResolvedValue({ success: true, result: ALL_PERMISSIONS })
+    })
+
+    it("does not fetch permissions until the first filter", () => {
+        mountSelector()
+        expect(mockGet).not.toHaveBeenCalled()
+    })
+
+    it("lazy-loads the permission list on first filter and shows all for an empty needle", async () => {
+        const wrapper = mountSelector()
+        await filter(wrapper, "")
+        expect(mockGet).toHaveBeenCalledOnce()
+        expect(mockGet.mock.calls[0]![0]).toContain("cms/options/permissions")
+        expect(currentOptions(wrapper)).toEqual(ALL_PERMISSIONS)
+    })
+
+    it("filters case-insensitively by substring", async () => {
+        const wrapper = mountSelector()
+        await filter(wrapper, "cms")
+        expect(currentOptions(wrapper)).toEqual(["SVMSecure.CMS", "SVMSecure.CMS.Files"])
+    })
+
+    it("does not re-fetch on a second filter (list is cached after first load)", async () => {
+        const wrapper = mountSelector()
+        await filter(wrapper, "cms")
+        await filter(wrapper, "effort")
+        expect(mockGet).toHaveBeenCalledOnce()
+        expect(currentOptions(wrapper)).toEqual(["SVMSecure.Effort"])
+    })
+
+    it("emits the selected permissions array on update", async () => {
+        const wrapper = mountSelector(["SVMSecure.CMS"])
+        const select = wrapper.findComponent({ name: "QSelect" })
+        select.vm.$emit("update:modelValue", ["SVMSecure.CMS", "SVMSecure.Effort"])
+        await flushPromises()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([["SVMSecure.CMS", "SVMSecure.Effort"]])
+    })
+
+    it("coerces a null clear to an empty array on update", async () => {
+        const wrapper = mountSelector(["SVMSecure.CMS"])
+        const select = wrapper.findComponent({ name: "QSelect" })
+        select.vm.$emit("update:modelValue", null)
+        await flushPromises()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([[]])
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/person-selector.test.ts b/VueApp/src/CMS/__tests__/person-selector.test.ts
new file mode 100644
index 000000000..a2309e25f
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/person-selector.test.ts
@@ -0,0 +1,129 @@
+import PersonSelector from "@/CMS/components/PersonSelector.vue"
+import type { CmsPersonOption } from "@/CMS/types"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * PersonSelector searches people server-side, but only once the query reaches 2+ characters
+ * (shorter queries clear options without a request). An out-of-order guard (searchSeq) drops
+ * stale responses. These tests drive the QSelect filter() and assert the min-chars gate and
+ * the request query param.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+const PEOPLE: CmsPersonOption[] = [
+    { iamId: "iam1", name: "Jane Doe", loginId: "jdoe", mailId: "jdoe@x.com" },
+    { iamId: "iam2", name: "John Smith", loginId: "jsmith", mailId: "jsmith@x.com" },
+]
+
+function mountSelector(modelValue: { iamId: string; name: string | null }[] = []) {
+    return mountCms(PersonSelector, { props: { modelValue } })
+}
+
+// Quasar's @filter handler is (val, update, abort); the component only uses (val, update), so
+// runUpdate (which runs the setter synchronously) is all we need to drive it.
+const runUpdate = (fn: () => void) => fn()
+
+async function filter(wrapper: ReturnType<typeof mountSelector>, value: string) {
+    wrapper.findComponent({ name: "QSelect" }).vm.$emit("filter", value, runUpdate)
+    await flushPromises()
+    await flushPromises()
+}
+
+function currentOptions(wrapper: ReturnType<typeof mountSelector>): CmsPersonOption[] {
+    return (wrapper.findComponent({ name: "QSelect" }).props("options") as CmsPersonOption[]) ?? []
+}
+
+describe("PersonSelector.vue", () => {
+    beforeEach(() => {
+        mockGet.mockReset()
+        mockGet.mockResolvedValue({ success: true, result: PEOPLE })
+    })
+
+    it("does not search for a single-character query", async () => {
+        const wrapper = mountSelector()
+        await filter(wrapper, "j")
+        expect(mockGet).not.toHaveBeenCalled()
+        expect(currentOptions(wrapper)).toEqual([])
+    })
+
+    it("does not search for a whitespace-padded query under 2 chars", async () => {
+        const wrapper = mountSelector()
+        await filter(wrapper, " a ")
+        expect(mockGet).not.toHaveBeenCalled()
+    })
+
+    it("searches once the query reaches 2 characters, passing a trimmed search param", async () => {
+        const wrapper = mountSelector()
+        await filter(wrapper, "  ja  ")
+        expect(mockGet).toHaveBeenCalledOnce()
+        const url = mockGet.mock.calls[0]![0] as string
+        expect(url).toContain("cms/options/people")
+        expect(url).toContain("search=ja")
+        expect(currentOptions(wrapper)).toEqual(PEOPLE)
+    })
+
+    it("clears options when the search fails", async () => {
+        mockGet.mockResolvedValue({ success: false, result: null })
+        const wrapper = mountSelector()
+        await filter(wrapper, "jane")
+        expect(currentOptions(wrapper)).toEqual([])
+    })
+
+    it("ignores a stale response that resolves after a newer search (out-of-order guard)", async () => {
+        const wrapper = mountSelector()
+        let resolveFirst!: (v: unknown) => void
+        let resolveSecond!: (v: unknown) => void
+        mockGet
+            .mockImplementationOnce(
+                () =>
+                    new Promise((r) => {
+                        resolveFirst = r
+                    }),
+            )
+            .mockImplementationOnce(
+                () =>
+                    new Promise((r) => {
+                        resolveSecond = r
+                    }),
+            )
+
+        const select = wrapper.findComponent({ name: "QSelect" })
+        select.vm.$emit("filter", "jane", runUpdate)
+        select.vm.$emit("filter", "janet", runUpdate)
+
+        // The newer search answers first; the older one lands afterwards and must be dropped.
+        resolveSecond({ success: true, result: [PEOPLE[1]] })
+        await flushPromises()
+        resolveFirst({ success: true, result: [PEOPLE[0]] })
+        await flushPromises()
+
+        expect(currentOptions(wrapper)).toEqual([PEOPLE[1]])
+    })
+
+    it("emits the selected people array on update and coerces null to []", async () => {
+        const wrapper = mountSelector()
+        const select = wrapper.findComponent({ name: "QSelect" })
+        select.vm.$emit("update:modelValue", [{ iamId: "iam1", name: "Jane Doe" }])
+        await flushPromises()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([[{ iamId: "iam1", name: "Jane Doe" }]])
+
+        select.vm.$emit("update:modelValue", null)
+        await flushPromises()
+        expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([[]])
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/recent-activity.test.ts b/VueApp/src/CMS/__tests__/recent-activity.test.ts
new file mode 100644
index 000000000..fae4bd793
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/recent-activity.test.ts
@@ -0,0 +1,297 @@
+import RecentActivity from "@/CMS/components/RecentActivity.vue"
+import { createTestRouter, mountCms, flushPromises, flushRouter } from "./test-utils"
+
+/**
+ * RecentActivity merges up to three sources (content blocks, files, left-nav menus), each
+ * gated by a prop, then sorts the merged items by modifiedOn (desc) and caps at MAX_ITEMS (8).
+ * It uses Promise.allSettled, so a single source failing must NOT mark the panel failed;
+ * only an all-reject set does. typeLabel is shown per item.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+const mockPost = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        post: (...args: unknown[]) => mockPost(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+function block(id: number, modifiedOn: string, title = `Block ${id}`) {
+    return { contentBlockId: id, title, friendlyName: null, modifiedOn, modifiedBy: "editor" }
+}
+function file(guid: string, modifiedOn: string, friendlyName = `File ${guid}`) {
+    return { fileGuid: guid, friendlyName, modifiedOn, modifiedBy: "uploader" }
+}
+function leftNav(id: number, modifiedOn: string, menuHeaderText = `Menu ${id}`) {
+    return { leftNavMenuId: id, menuHeaderText, friendlyName: null, modifiedOn, modifiedBy: "navadmin" }
+}
+
+// Routes requests to the right canned response based on the URL the component builds.
+// The trash source defaults to an empty success so pre-existing tests keep their exact
+// call semantics; tests exercising deletions or all-source failure pass it explicitly.
+// The latest-change diff is a POST (current content vs newest history row) and answers
+// from historyDiff.
+function routeGet(handlers: {
+    blocks?: unknown
+    blockDetail?: unknown
+    files?: unknown
+    deletedFiles?: unknown
+    historyList?: unknown
+    historyDiff?: unknown
+    leftNavs?: unknown
+}) {
+    mockPost.mockReset()
+    mockPost.mockResolvedValue(handlers.historyDiff)
+    mockGet.mockReset()
+    mockGet.mockImplementation((...args: unknown[]) => {
+        const url = args[0] as string
+        if (url.includes("CMS/content/history")) {
+            return Promise.resolve(handlers.historyList)
+        }
+        if (/CMS\/content\/\d+$/u.test(url)) {
+            return Promise.resolve(handlers.blockDetail)
+        }
+        if (url.includes("CMS/content")) {
+            return Promise.resolve(handlers.blocks)
+        }
+        if (url.includes("cms/files") && url.includes("status=deleted")) {
+            return Promise.resolve(handlers.deletedFiles ?? { success: true, result: [] })
+        }
+        if (url.includes("cms/files")) {
+            return Promise.resolve(handlers.files)
+        }
+        if (url.includes("cms/left-navs")) {
+            return Promise.resolve(handlers.leftNavs)
+        }
+        return Promise.resolve({ success: false, result: [] })
+    })
+}
+
+async function mountActivity(props: Record<string, boolean>) {
+    const wrapper = mountCms(RecentActivity, { props })
+    await flushPromises()
+    await flushPromises()
+    return wrapper
+}
+
+describe("recentActivity.vue - source gating", () => {
+    it("loads no sources and shows the empty message when all flags are off", async () => {
+        routeGet({})
+        const wrapper = await mountActivity({})
+        expect(mockGet).not.toHaveBeenCalled()
+        expect(wrapper.text()).toContain("Nothing edited recently.")
+    })
+
+    it("loads only blocks when showBlocks is set", async () => {
+        routeGet({ blocks: { success: true, result: [block(1, "2024-01-01T00:00:00")] } })
+        await mountActivity({ showBlocks: true })
+        expect(mockGet).toHaveBeenCalledOnce()
+        const url = mockGet.mock.calls[0]![0] as string
+        expect(url).toContain("CMS/content")
+        // Recency must be resolved server-side: a client-side sort of the default page can
+        // only ever see the first alphabetical page of blocks.
+        expect(url).toContain("sortBy=modifiedOn")
+        expect(url).toContain("descending=true")
+        expect(url).toContain("perPage=5")
+    })
+
+    it("loads all three sources when every flag is set", async () => {
+        routeGet({
+            blocks: { success: true, result: [block(1, "2024-01-03T00:00:00")] },
+            files: { success: true, result: [file("g1", "2024-01-02T00:00:00")] },
+            leftNavs: { success: true, result: [leftNav(1, "2024-01-01T00:00:00")] },
+        })
+        await mountActivity({ showBlocks: true, showFiles: true, showLeftNavs: true })
+        // ShowFiles drives two fetches: active files and recently deleted (trash) files.
+        expect(mockGet).toHaveBeenCalledTimes(4)
+    })
+})
+
+describe("recentActivity.vue - merge, sort, cap", () => {
+    it("merges sources and sorts by modifiedOn descending", async () => {
+        routeGet({
+            blocks: { success: true, result: [block(1, "2024-01-01T00:00:00", "Old block")] },
+            files: { success: true, result: [file("g1", "2024-03-01T00:00:00", "New file")] },
+            leftNavs: { success: true, result: [leftNav(1, "2024-02-01T00:00:00", "Mid menu")] },
+        })
+        const wrapper = await mountActivity({ showBlocks: true, showFiles: true, showLeftNavs: true })
+        const labels = wrapper.findAll(".q-item__label").map((n) => n.text())
+        const newFileIdx = labels.findIndex((t) => t.includes("New file"))
+        const midMenuIdx = labels.findIndex((t) => t.includes("Mid menu"))
+        const oldBlockIdx = labels.findIndex((t) => t.includes("Old block"))
+        expect(newFileIdx).toBeLessThan(midMenuIdx)
+        expect(midMenuIdx).toBeLessThan(oldBlockIdx)
+    })
+
+    it("caps the merged list at MAX_ITEMS (8)", async () => {
+        // Five blocks + five files = 10 candidates after each source's own per-source cap.
+        const fiveBlocks = Array.from({ length: 5 }, (_, i) => block(i + 1, `2024-01-0${i + 1}T00:00:00`))
+        const fiveFiles = Array.from({ length: 5 }, (_, i) => file(`g${i}`, `2024-02-0${i + 1}T00:00:00`))
+        routeGet({
+            blocks: { success: true, result: fiveBlocks },
+            files: { success: true, result: fiveFiles },
+        })
+        const wrapper = await mountActivity({ showBlocks: true, showFiles: true })
+        expect(wrapper.findAllComponents({ name: "QItem" })).toHaveLength(8)
+    })
+
+    it("renders the typeLabel for each item", async () => {
+        routeGet({
+            blocks: { success: true, result: [block(1, "2024-01-01T00:00:00")] },
+            files: { success: true, result: [file("g1", "2024-01-02T00:00:00")] },
+        })
+        const wrapper = await mountActivity({ showBlocks: true, showFiles: true })
+        expect(wrapper.text()).toContain("Content block")
+        expect(wrapper.text()).toContain("File")
+    })
+})
+
+describe("recentActivity.vue - partial failure semantics", () => {
+    it("does NOT mark failed when one source rejects but another succeeds", async () => {
+        routeGet({
+            blocks: { success: false, result: [] }, // LoadBlocks throws on !success
+            files: { success: true, result: [file("g1", "2024-01-02T00:00:00")] },
+        })
+        const wrapper = await mountActivity({ showBlocks: true, showFiles: true })
+        expect(wrapper.text()).not.toContain("Couldn't load recent activity.")
+        expect(wrapper.findAllComponents({ name: "QItem" })).toHaveLength(1)
+    })
+
+    it("marks failed only when ALL active sources reject", async () => {
+        routeGet({
+            blocks: { success: false, result: [] },
+            files: { success: false, result: [] },
+            deletedFiles: { success: false, result: [] },
+        })
+        const wrapper = await mountActivity({ showBlocks: true, showFiles: true })
+        expect(wrapper.text()).toContain("Couldn't load recent activity.")
+    })
+})
+
+describe("recentActivity.vue - deleted files and item actions", () => {
+    it("shows recently deleted files with a deleted verb and a trash deep-link", async () => {
+        routeGet({
+            files: { success: true, result: [] },
+            deletedFiles: {
+                success: true,
+                result: [{ ...file("g9", "2024-05-01T00:00:00", "Gone file"), deletedOn: "2024-05-02T00:00:00" }],
+            },
+        })
+        const wrapper = await mountActivity({ showFiles: true })
+
+        expect(wrapper.text()).toContain("Gone file")
+        expect(wrapper.text()).toContain("deleted")
+        const item = wrapper.findAllComponents({ name: "QItem" }).find((i) => i.text().includes("Gone file"))!
+        expect(item.props("to")).toStrictEqual({
+            name: "CmsFiles",
+            query: { status: "deleted", search: "Gone file" },
+        })
+        const deletedFetch = mockGet.mock.calls.map((c) => c[0] as string).find((u) => u.includes("status=deleted"))!
+        expect(deletedFetch).toContain("sortBy=deletedOn")
+        expect(deletedFetch).toContain("descending=true")
+    })
+
+    it("links block items to their edit history and files to their audit trail", async () => {
+        routeGet({
+            blocks: { success: true, result: [block(7, "2024-01-02T00:00:00")] },
+            files: { success: true, result: [file("g1", "2024-01-01T00:00:00")] },
+        })
+        const wrapper = await mountActivity({ showBlocks: true, showFiles: true })
+
+        const buttons = wrapper.findAllComponents({ name: "QBtn" })
+        const history = buttons.find((b) => b.props("icon") === "history")!
+        expect(history.props("to")).toStrictEqual({
+            name: "CmsContentBlockHistory",
+            query: { contentBlockId: "7" },
+        })
+        const audit = buttons.find((b) => b.props("icon") === "fact_check")!
+        expect(audit.props("to")).toStrictEqual({ name: "CmsFileAudit", query: { fileGuid: "g1" } })
+    })
+
+    // Guards the click handling: a preventDefault on to-actions would make QBtn cancel its own
+    // router navigation, and a missing .stop would let the row's edit link hijack the click.
+    it("navigates to the block's edit history when its history action is clicked", async () => {
+        routeGet({ blocks: { success: true, result: [block(7, "2024-01-02T00:00:00")] } })
+        const router = createTestRouter()
+        const wrapper = mountCms(RecentActivity, { props: { showBlocks: true } }, router)
+        await flushPromises()
+        await flushPromises()
+
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.props("icon") === "history")!
+            .trigger("click")
+        await flushRouter()
+
+        expect(router.currentRoute.value.name).toBe("CmsContentBlockHistory")
+        expect(router.currentRoute.value.query).toStrictEqual({ contentBlockId: "7" })
+    })
+
+    it("opens the latest-change diff inline from a block item", async () => {
+        routeGet({
+            blocks: { success: true, result: [block(7, "2024-01-02T00:00:00", "Diffable block")] },
+            blockDetail: {
+                success: true,
+                result: { ...block(7, "2024-01-02T00:00:00", "Diffable block"), content: "<p>now</p>" },
+            },
+            historyList: { success: true, result: [{ contentHistoryId: 42, contentBlockId: 7 }] },
+            historyDiff: {
+                success: true,
+                result: {
+                    content: "<p>diff <ins>added</ins></p>",
+                    hasComparison: true,
+                    hasChanges: true,
+                    oldModifiedOn: "2024-01-01T00:00:00",
+                    oldModifiedBy: "before",
+                    newModifiedOn: null,
+                    newModifiedBy: null,
+                },
+            },
+        })
+        const wrapper = await mountActivity({ showBlocks: true })
+
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.props("icon") === "difference")!
+            .trigger("click")
+        await flushPromises()
+
+        const dialog = wrapper.findComponent({ name: "ContentDiffDialog" })
+        expect(dialog.props("modelValue")).toBeTruthy()
+        expect(dialog.props("diffHtml")).toContain("added")
+        // The latest change is live content vs the newest history row, so it must go through
+        // the POST diff (history rows only hold superseded versions) with the current content.
+        expect(mockPost).toHaveBeenCalledOnce()
+        const [diffUrl, diffBody] = mockPost.mock.calls[0] as [string, unknown]
+        expect(diffUrl).toContain("CMS/content/7/history/42/diff")
+        expect(diffBody).toStrictEqual({ content: "<p>now</p>" })
+    })
+
+    it("closes the diff viewer and notifies when the block has no history", async () => {
+        routeGet({
+            blocks: { success: true, result: [block(7, "2024-01-02T00:00:00")] },
+            blockDetail: { success: true, result: { ...block(7, "2024-01-02T00:00:00"), content: "<p>now</p>" } },
+            historyList: { success: true, result: [] },
+        })
+        const wrapper = await mountActivity({ showBlocks: true })
+
+        await wrapper
+            .findAllComponents({ name: "QBtn" })
+            .find((b) => b.props("icon") === "difference")!
+            .trigger("click")
+        await flushPromises()
+
+        expect(wrapper.findComponent({ name: "ContentDiffDialog" }).props("modelValue")).toBeFalsy()
+        expect(mockPost).not.toHaveBeenCalled()
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/router-canonicalization.test.ts b/VueApp/src/CMS/__tests__/router-canonicalization.test.ts
new file mode 100644
index 000000000..7559c6400
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/router-canonicalization.test.ts
@@ -0,0 +1,50 @@
+import { createPinia, setActivePinia } from "pinia"
+import { useUserStore } from "@/store/UserStore"
+import { cmsRouter } from "@/CMS/router"
+
+// The real beforeEach guard calls requireLogin, which hits the network and needs a Quasar/inject
+// context. Stub it (Vitest hoists this above the imports) so the test exercises only the
+// permission-driven canonicalization, not the auth plumbing.
+vi.mock("@/composables/RequireLogin", () => ({
+    useRequireLogin: () => ({ requireLogin: () => Promise.resolve(true) }),
+    getLoginUrl: () => ({ value: "" }),
+}))
+
+// Park on a neutral route first so the push to the area root is never a redundant navigation
+// (which would resolve to a NavigationFailure and leave currentRoute unchanged).
+async function goToAreaRoot(): Promise<void> {
+    await cmsRouter.push("/__reset__")
+    await cmsRouter.push("/CMS/")
+}
+
+describe("CMS area-root canonicalization", () => {
+    beforeEach(() => {
+        setActivePinia(createPinia())
+    })
+
+    it("redirects base SVMSecure.CMS users from /CMS/ to the Home hub", async () => {
+        useUserStore().setPermissions(["SVMSecure.CMS"])
+
+        await goToAreaRoot()
+
+        expect(cmsRouter.currentRoute.value.name).toBe("CmsHome")
+    })
+
+    it("redirects granular-only users (no base SVMSecure.CMS) to the Home hub", async () => {
+        // The regression: AllFiles/ManageNavigation/etc. users can enter the area but used to be
+        // stranded on /CMS/ because canonicalization only checked the base permission.
+        useUserStore().setPermissions(["SVMSecure.CMS.AllFiles"])
+
+        await goToAreaRoot()
+
+        expect(cmsRouter.currentRoute.value.name).toBe("CmsHome")
+    })
+
+    it("leaves visitors with no CMS permissions on the CmsAuth landing", async () => {
+        useUserStore().setPermissions([])
+
+        await goToAreaRoot()
+
+        expect(cmsRouter.currentRoute.value.name).toBe("CmsAuth")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/test-utils.ts b/VueApp/src/CMS/__tests__/test-utils.ts
new file mode 100644
index 000000000..0cb4bc343
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/test-utils.ts
@@ -0,0 +1,99 @@
+import { mount } from "@vue/test-utils"
+import type { ComponentMountingOptions } from "@vue/test-utils"
+import { createRouter, createWebHistory } from "vue-router"
+import type { Router, RouteRecordRaw } from "vue-router"
+import { Quasar, Notify, Dialog } from "quasar"
+import { createPinia, setActivePinia } from "pinia"
+import { nextTick } from "vue"
+import { useUserStore } from "@/store/UserStore"
+
+/**
+ * Shared test utilities for CMS component/page tests.
+ *
+ * CMS keeps page state local, but some pages read the signed-in user's permissions from the
+ * shared user store (e.g. ContentBlockEdit gates its section-path and file pickers). So the
+ * helpers install Pinia and seed a full CMS admin so mounted pages behave as they would for a
+ * manager (the role these tests assume).
+ */
+
+// Components build request URLs as inject("apiURL") + "cms/...". Tests assert against
+// this prefix, so keep it stable and obvious.
+const TEST_API_URL = "/api/"
+
+// The CMS area's full permission set; mounted pages default to this so existing tests see the
+// same UI a manager would. Mirrors the route meta in src/CMS/router/routes.ts.
+const CMS_ADMIN_PERMISSIONS = [
+    "SVMSecure.CMS",
+    "SVMSecure.CMS.ManageContentBlocks",
+    "SVMSecure.CMS.CreateContentBlock",
+    "SVMSecure.CMS.AllFiles",
+    "SVMSecure.CMS.ManageNavigation",
+]
+
+// Route table mirroring the real CMS route names/paths (src/CMS/router/routes.ts) so
+// router-link :to and programmatic navigation resolve exactly as they do in production.
+const stub = { template: "<div />" }
+const CMS_ROUTES: RouteRecordRaw[] = [
+    { path: "/", name: "CmsHome", component: stub },
+    { path: "/CMS/ManageContentBlocks", name: "CmsContentBlocks", component: stub },
+    { path: "/CMS/ManageContentBlocks/History", name: "CmsContentBlockHistory", component: stub },
+    { path: "/CMS/ManageContentBlocks/Edit/:id?", name: "CmsContentBlockEdit", component: stub },
+    { path: "/CMS/ManageFiles", name: "CmsFiles", component: stub },
+    { path: "/CMS/ManageFiles/Audit", name: "CmsFileAudit", component: stub },
+    { path: "/CMS/ManageFiles/Import", name: "CmsFileImport", component: stub },
+    { path: "/CMS/ManageFiles/BulkEncrypt", name: "CmsBulkEncrypt", component: stub },
+    { path: "/CMS/ManageLeftNav", name: "CmsLeftNavMenus", component: stub },
+    { path: "/CMS/ManageLeftNav/Edit/:id?", name: "CmsLeftNavEdit", component: stub },
+]
+
+function createTestRouter(): Router {
+    return createRouter({
+        history: createWebHistory(),
+        routes: CMS_ROUTES,
+    })
+}
+
+// Generic mount wrapper: registers Quasar (with Notify + Dialog so components that call
+// $q.notify / $q.dialog don't blow up), Pinia (seeded as a CMS admin), a router, and the
+// apiURL provide.
+function mountCms<T>(component: T, options: ComponentMountingOptions<T> = {}, router?: Router) {
+    const testRouter = router ?? createTestRouter()
+    const pinia = createPinia()
+    setActivePinia(pinia)
+    useUserStore().setPermissions(CMS_ADMIN_PERMISSIONS)
+    const { global: globalOptions = {}, ...rest } = options as Record<string, unknown> & {
+        global?: Record<string, unknown>
+    }
+    return mount(
+        component as never,
+        {
+            ...rest,
+            global: {
+                plugins: [[Quasar, { plugins: { Notify, Dialog } }], testRouter, pinia],
+                provide: { apiURL: TEST_API_URL },
+                ...globalOptions,
+            },
+        } as ComponentMountingOptions<T>,
+    )
+}
+
+// Flush microtasks so awaited fetch mocks and the DOM both settle before assertions.
+async function flushPromises(): Promise<void> {
+    await Promise.resolve()
+    await nextTick()
+    await Promise.resolve()
+}
+
+// Router replace/push navigation resolves over several microtask turns; run enough flush
+// cycles (recursively, to avoid an await-in-loop) for the URL query and any query-watcher
+// reactions to settle before asserting on router.currentRoute.
+async function flushRouter(cycles = 10): Promise<void> {
+    if (cycles <= 0) {
+        return
+    }
+    await flushPromises()
+    await nextTick()
+    await flushRouter(cycles - 1)
+}
+
+export { createTestRouter, mountCms, flushPromises, flushRouter }
diff --git a/VueApp/src/CMS/__tests__/url.test.ts b/VueApp/src/CMS/__tests__/url.test.ts
new file mode 100644
index 000000000..dea379c5c
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/url.test.ts
@@ -0,0 +1,107 @@
+// oxlint-disable no-script-url -- this suite exists to prove javascript: URLs are blocked, so the literals are intentional
+import { isSafeUrl, safeHref } from "@/CMS/utils/url"
+
+/**
+ * Exhaustive coverage of the CMS URL safety helpers. These guard every user-supplied
+ * link rendered as an href, so the allowed/blocked scheme split and the null/empty
+ * asymmetry are the security-critical contract.
+ */
+
+describe("CMS url safety - isSafeUrl", () => {
+    describe("allowed schemes pass", () => {
+        it.each([
+            ["http", "http://example.com/page"],
+            ["https", "https://example.com/page"],
+            ["mailto", "mailto:person@example.com"],
+            ["tel", "tel:+15555551234"],
+        ])("treats %s as safe", (_scheme, url) => {
+            expect(isSafeUrl(url)).toBeTruthy()
+        })
+
+        it("is case-insensitive about the scheme (URL normalizes it)", () => {
+            expect(isSafeUrl("HTTPS://example.com")).toBeTruthy()
+            expect(isSafeUrl("MailTo:person@example.com")).toBeTruthy()
+        })
+    })
+
+    describe("dangerous schemes are blocked", () => {
+        it.each([
+            ["javascript", "javascript:alert(1)"],
+            ["data", "data:text/html,<script>alert(1)</script>"],
+            ["file", "file:///etc/passwd"],
+            ["vbscript", "vbscript:msgbox(1)"],
+        ])("rejects %s: URLs", (_scheme, url) => {
+            expect(isSafeUrl(url)).toBeFalsy()
+        })
+
+        it("blocks a javascript: URL regardless of casing/whitespace padding", () => {
+            expect(isSafeUrl("  JavaScript:alert(1)  ")).toBeFalsy()
+        })
+    })
+
+    describe("null / empty / whitespace are treated as safe (asymmetry with safeHref)", () => {
+        // IsSafeUrl returns true for absent values: an empty link is not a dangerous link,
+        // so it controls the "render as text vs link" choice. safeHref still returns "#"
+        // for the same inputs because there is no usable destination.
+        it.each([
+            ["null", null],
+            ["undefined", undefined],
+            ["empty string", ""],
+            ["whitespace only", "   "],
+        ])("returns true for %s", (_label, value) => {
+            expect(isSafeUrl(value)).toBeTruthy()
+        })
+    })
+
+    describe("malformed URLs are rejected", () => {
+        it.each([
+            ["scheme with no host", "http://"],
+            ["colons only", "::::"],
+            ["bare word", "not a url"],
+            ["protocol-relative (no scheme for URL())", "//example.com/foo"],
+        ])("returns false for %s", (_label, url) => {
+            expect(isSafeUrl(url)).toBeFalsy()
+        })
+    })
+})
+
+describe("CMS url safety - safeHref", () => {
+    it("returns the original URL unchanged for allowed schemes", () => {
+        expect(safeHref("https://example.com/a?b=c#d")).toBe("https://example.com/a?b=c#d")
+        expect(safeHref("mailto:person@example.com")).toBe("mailto:person@example.com")
+        expect(safeHref("tel:+15555551234")).toBe("tel:+15555551234")
+    })
+
+    it("preserves surrounding text but the original (untrimmed) string is returned", () => {
+        // Trimming is only used for the safety check; the returned value is the normalized
+        // (trimmed) form for valid URLs.
+        expect(safeHref("  https://example.com  ")).toBe("https://example.com")
+    })
+
+    it.each([
+        ["javascript", "javascript:alert(1)"],
+        ["data", "data:text/html,x"],
+        ["file", "file:///etc/passwd"],
+        ["vbscript", "vbscript:msgbox(1)"],
+    ])("returns '#' for blocked %s scheme", (_scheme, url) => {
+        expect(safeHref(url)).toBe("#")
+    })
+
+    it.each([
+        ["null", null],
+        ["undefined", undefined],
+        ["empty string", ""],
+        ["whitespace only", "   "],
+    ])("returns '#' for %s (asymmetry: isSafeUrl says true here)", (_label, value) => {
+        expect(safeHref(value)).toBe("#")
+        expect(isSafeUrl(value)).toBeTruthy()
+    })
+
+    it.each([
+        ["scheme with no host", "http://"],
+        ["colons only", "::::"],
+        ["bare word", "not a url"],
+    ])("returns '#' for malformed input %s", (_label, url) => {
+        expect(safeHref(url)).toBe("#")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/use-server-table.test.ts b/VueApp/src/CMS/__tests__/use-server-table.test.ts
new file mode 100644
index 000000000..b8c6e03c2
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/use-server-table.test.ts
@@ -0,0 +1,128 @@
+import { defineComponent } from "vue"
+import { useServerTable } from "@/CMS/composables/use-server-table"
+import { mountCms, flushPromises } from "./test-utils"
+
+/**
+ * useServerTable is the server-paged QTable core shared by the CMS list pages: onRequest issues
+ * the GET built from buildParams, binds rows and rowsNumber (falling back to the row count when
+ * the API returns no pagination envelope), copies the request pagination into state, and notifies
+ * on failure. Direct spec so regressions surface here rather than in every list page.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+type Row = { id: number }
+
+// The composable needs a component context for useQuasar/useFetch; host it in a renderless
+// component and drive it through its returned API (the same surface the pages use).
+function mountTable(options: { errorMessage?: string } = {}) {
+    let table!: ReturnType<typeof useServerTable<Row>>
+    const Host = defineComponent({
+        name: "ServerTableHost",
+        setup() {
+            table = useServerTable<Row>({
+                url: "/api/things",
+                errorMessage: options.errorMessage,
+                pagination: { sortBy: "name", descending: false, rowsPerPage: 25 },
+                buildParams: (p) => ({
+                    page: p.page,
+                    perPage: p.rowsPerPage,
+                    sortBy: p.sortBy,
+                    descending: p.descending ? "true" : "false",
+                }),
+            })
+            return () => null
+        },
+    })
+    mountCms(Host)
+    return table
+}
+
+const request = (page: number, overrides: Partial<{ sortBy: string; descending: boolean }> = {}) => ({
+    pagination: { page, rowsPerPage: 25, sortBy: "name", descending: false, ...overrides },
+})
+
+beforeEach(() => {
+    mockGet.mockReset()
+})
+
+describe("useServerTable", () => {
+    it("binds rows and takes rowsNumber from the response pagination envelope", async () => {
+        mockGet.mockResolvedValue({ success: true, result: [{ id: 1 }], pagination: { totalRecords: 91 } })
+        const table = mountTable()
+
+        await table.onRequest(request(2, { sortBy: "modifiedOn", descending: true }))
+
+        expect(mockGet.mock.calls[0]![0]).toBe("/api/things?page=2&perPage=25&sortBy=modifiedOn&descending=true")
+        expect(table.rows.value).toEqual([{ id: 1 }])
+        expect(table.pagination.value).toMatchObject({
+            rowsNumber: 91,
+            page: 2,
+            sortBy: "modifiedOn",
+            descending: true,
+        })
+        expect(table.loading.value).toBeFalsy()
+    })
+
+    it("falls back to the returned row count for rowsNumber when no envelope is present", async () => {
+        mockGet.mockResolvedValue({ success: true, result: [{ id: 1 }, { id: 2 }, { id: 3 }] })
+        const table = mountTable()
+
+        await table.onRequest(request(1))
+
+        expect(table.pagination.value.rowsNumber).toBe(3)
+    })
+
+    it("notifies with the server error and keeps the previous rows when the request fails", async () => {
+        mockGet.mockResolvedValueOnce({ success: true, result: [{ id: 1 }] })
+        const table = mountTable()
+        await table.onRequest(request(1))
+
+        mockGet.mockResolvedValueOnce({ success: false, errors: ["backend exploded"] })
+        await table.onRequest(request(2))
+        await flushPromises()
+
+        // The notification teleports to document.body.
+        expect(document.body.textContent).toContain("backend exploded")
+        expect(table.rows.value).toEqual([{ id: 1 }])
+        expect(table.loading.value).toBeFalsy()
+    })
+
+    it("falls back to the caller's errorMessage when a failure carries no errors", async () => {
+        mockGet.mockResolvedValue({ success: false, errors: null })
+        const table = mountTable({ errorMessage: "Failed to load things" })
+
+        await table.onRequest(request(1))
+        await flushPromises()
+
+        expect(document.body.textContent).toContain("Failed to load things")
+    })
+
+    it("reloadFirstPage re-requests page 1 while keeping the current sort and page size", async () => {
+        mockGet.mockResolvedValue({ success: true, result: [], pagination: { totalRecords: 0 } })
+        const table = mountTable()
+        await table.onRequest(request(3, { sortBy: "modifiedOn", descending: true }))
+
+        await table.reloadFirstPage()
+        await flushPromises()
+
+        const lastUrl = mockGet.mock.calls.at(-1)![0] as string
+        expect(lastUrl).toContain("page=1")
+        expect(lastUrl).toContain("sortBy=modifiedOn")
+        expect(lastUrl).toContain("descending=true")
+    })
+})
diff --git a/VueApp/src/CMS/__tests__/use-url-filtered-table.test.ts b/VueApp/src/CMS/__tests__/use-url-filtered-table.test.ts
new file mode 100644
index 000000000..763e1f731
--- /dev/null
+++ b/VueApp/src/CMS/__tests__/use-url-filtered-table.test.ts
@@ -0,0 +1,133 @@
+import { defineComponent } from "vue"
+import { useUrlFilteredTable } from "@/CMS/composables/use-url-filtered-table"
+import { mountCms, flushPromises, flushRouter, createTestRouter } from "./test-utils"
+
+/**
+ * useUrlFilteredTable layers URL sync onto useServerTable: filters and the primary deep-link id
+ * initialize from route.query, reload() reflects them back (empties omitted) and refetches page 1,
+ * clearPrimaryFilter drops the id chip, and the route.query watcher re-syncs on external
+ * navigation while its equality guard skips the composable's own URL writes.
+ */
+
+const mockGet = vi.fn<(...args: unknown[]) => unknown>()
+vi.mock("@/composables/ViperFetch", () => ({
+    useFetch: () => ({
+        get: (...args: unknown[]) => mockGet(...args),
+        createUrlSearchParams: (obj: Record<string, string | number | null | undefined>) => {
+            const params = new URLSearchParams()
+            for (const [k, v] of Object.entries(obj)) {
+                if (v !== null && v !== undefined) {
+                    params.append(k, v.toString())
+                }
+            }
+            return params
+        },
+    }),
+}))
+
+type Row = { id: number }
+type Filters = { search: string; from: string }
+
+async function mountTable(query: Record<string, string> = {}) {
+    const router = createTestRouter()
+    await router.push({ path: "/CMS/ManageFiles/Audit", query })
+    await router.isReady()
+
+    let table!: ReturnType<typeof useUrlFilteredTable<Row, Filters>>
+    const Host = defineComponent({
+        name: "UrlFilteredTableHost",
+        setup() {
+            table = useUrlFilteredTable<Row, Filters>({
+                url: "/api/audit",
+                errorMessage: "Failed to load audit",
+                primaryKey: "fileGuid",
+                defaultFilters: () => ({ search: "", from: "" }),
+                pagination: { sortBy: "when", descending: true },
+            })
+            return () => null
+        },
+    })
+    mountCms(Host, {}, router)
+    return { table, router }
+}
+
+function lastUrl(): string {
+    return (mockGet.mock.calls.at(-1)?.[0] as string) ?? ""
+}
+
+beforeEach(() => {
+    mockGet.mockReset()
+    mockGet.mockResolvedValue({ success: true, result: [], pagination: { totalRecords: 0 } })
+})
+
+describe("useUrlFilteredTable", () => {
+    it("initializes the primary id and filters from route.query and sends them, omitting empties", async () => {
+        const { table } = await mountTable({ fileGuid: "g1", search: "report" })
+
+        table.reload()
+        await flushPromises()
+
+        const url = lastUrl()
+        expect(url).toContain("fileGuid=g1")
+        expect(url).toContain("search=report")
+        expect(url).toContain("page=1")
+        expect(url).toContain("perPage=50")
+        // The untouched "from" filter is blank and must not be serialized at all.
+        expect(url).not.toContain("from=")
+    })
+
+    it("reload writes the active filters back to the URL, omitting empty ones", async () => {
+        const { table, router } = await mountTable()
+
+        table.filters.value.search = "hello"
+        table.reload()
+        await flushRouter()
+
+        expect(router.currentRoute.value.query.search).toBe("hello")
+        expect(router.currentRoute.value.query.from).toBeUndefined()
+        expect(router.currentRoute.value.query.fileGuid).toBeUndefined()
+    })
+
+    it("clearPrimaryFilter drops the deep-link id from the request and the URL, then refetches", async () => {
+        const { table, router } = await mountTable({ fileGuid: "g1" })
+        table.reload()
+        await flushRouter()
+        const before = mockGet.mock.calls.length
+
+        table.clearPrimaryFilter()
+        await flushRouter()
+
+        expect(table.primary.value).toBeNull()
+        expect(mockGet.mock.calls.length).toBeGreaterThan(before)
+        expect(lastUrl()).not.toContain("fileGuid=")
+        expect(router.currentRoute.value.query.fileGuid).toBeUndefined()
+    })
+
+    it("re-syncs filters and refetches when external navigation changes the query", async () => {
+        const { table, router } = await mountTable()
+        table.reload()
+        await flushRouter()
+        const before = mockGet.mock.calls.length
+
+        await router.push({ path: "/CMS/ManageFiles/Audit", query: { search: "changed", fileGuid: "g2" } })
+        await flushRouter()
+
+        expect(mockGet.mock.calls.length).toBe(before + 1)
+        expect(table.filters.value.search).toBe("changed")
+        expect(table.primary.value).toBe("g2")
+        expect(lastUrl()).toContain("search=changed")
+    })
+
+    it("does not double-fetch when the watcher sees the composable's own URL write (equality guard)", async () => {
+        const { table } = await mountTable()
+
+        table.filters.value.search = "abc"
+        table.reload()
+        await flushPromises()
+        const afterReload = mockGet.mock.calls.length
+
+        // Reload's router.replace triggers the route.query watcher; state already matches.
+        await flushRouter()
+        expect(mockGet.mock.calls.length).toBe(afterReload)
+    })
+})
diff --git a/VueApp/src/CMS/components/ActivityRow.vue b/VueApp/src/CMS/components/ActivityRow.vue
new file mode 100644
index 000000000..4b9044a25
--- /dev/null
+++ b/VueApp/src/CMS/components/ActivityRow.vue
@@ -0,0 +1,107 @@
+<template>
+    <q-item
+        clickable
+        :to="item.to"
+        class="q-px-none"
+    >
+        <q-item-section side>
+            <q-icon
+                :name="item.icon"
+                :aria-label="item.typeLabel"
+                color="secondary"
+                size="sm"
+            />
+        </q-item-section>
+        <q-item-section>
+            <q-item-label lines="1">{{ item.label }}</q-item-label>
+            <q-item-label
+                caption
+                :title="formatFullDate(item.modifiedOn)"
+            >
+                {{ item.typeLabel }} &middot; {{ item.verb ? item.verb + " " : ""
+                }}{{ formatTimeAgo(new Date(item.modifiedOn)) }} by
+                {{ item.modifiedBy }}
+            </q-item-label>
+        </q-item-section>
+        <q-item-section
+            v-if="item.actions?.length"
+            side
+            class="activity-actions"
+        >
+            <div class="row no-wrap">
+                <q-btn
+                    v-for="action in item.actions"
+                    :key="action.icon"
+                    flat
+                    dense
+                    round
+                    size="sm"
+                    color="primary"
+                    :icon="action.icon"
+                    :aria-label="action.label"
+                    :to="action.to"
+                    @click.stop="runAction(action, $event)"
+                >
+                    <q-tooltip>{{ action.label }}</q-tooltip>
+                </q-btn>
+            </div>
+        </q-item-section>
+    </q-item>
+</template>
+
+<script setup lang="ts">
+import { formatTimeAgo } from "@vueuse/core"
+import type { ActivityItem, RailAction } from "@/CMS/types/"
+
+defineProps<{
+    item: ActivityItem
+}>()
+
+function formatFullDate(value: string): string {
+    return new Date(value).toLocaleString()
+}
+
+// Row-level navigation must not fire for action clicks (`.stop` in the template). Actions with
+// their own `to` navigate via QBtn; only run-actions preventDefault, both to keep the row's
+// anchor inert and because a prevented default makes QBtn cancel its router navigation.
+function runAction(action: RailAction, event: Event) {
+    if (!action.run) return
+    event.preventDefault()
+    action.run()
+}
+</script>
+
+<style scoped>
+/* Keep the two icon actions from inflating the dense rows; the buttons carry their own
+   padding and get the standard 44px targets on coarse pointers via base.css. */
+.activity-actions {
+    padding-left: 0;
+}
+
+/* Quiet the rail: row actions fade in on row hover or keyboard focus. Opacity (not display)
+   keeps the buttons in the layout and the tab order, so rows never shift and focus reveals
+   them for keyboard users. */
+.activity-actions .q-btn {
+    opacity: 0;
+    transition: opacity 0.15s ease-out;
+}
+
+.q-item:hover .activity-actions .q-btn,
+.q-item:focus-within .activity-actions .q-btn {
+    opacity: 1;
+}
+
+/* No hover on touch: keep the actions always visible so they don't need a discovery tap
+   that would fight the row's own navigation. */
+@media (pointer: coarse) {
+    .activity-actions .q-btn {
+        opacity: 1;
+    }
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .activity-actions .q-btn {
+        transition: none;
+    }
+}
+</style>
diff --git a/VueApp/src/CMS/components/ContentBlock.vue b/VueApp/src/CMS/components/ContentBlock.vue
index e37953b89..35464cf1e 100644
--- a/VueApp/src/CMS/components/ContentBlock.vue
+++ b/VueApp/src/CMS/components/ContentBlock.vue
@@ -23,33 +23,12 @@ const contentBlock: Ref<ContentBlock | null> = ref(null)
 async function loadContentBlock() {
     const { get } = useFetch()
     const r = await get(import.meta.env.VITE_API_URL + "cms/content/fn/" + props.contentBlockName)
-    contentBlock.value = r.result
+    contentBlock.value = r.success ? r.result : null
 }
 
-watch(
-    () => props,
-    () => {
-        loadContentBlock()
-    },
-    { immediate: true, deep: true },
-)
-
-loadContentBlock()
+// Reload only when the block name changes. props is reactive, so watching the
+// specific source (instead of a deep watch on props) avoids the duplicate
+// immediate fetch and unrelated re-runs. Headings for the sanitized HTML are
+// styled globally in styles/base.css (shared with the diff view).
+watch(() => props.contentBlockName, loadContentBlock, { immediate: true })
 </script>
-
-<style>
-.content-block h1 {
-    font-size: 2rem;
-    line-height: 2rem;
-}
-
-.content-block h2 {
-    font-size: 2rem;
-    line-height: 2rem;
-}
-
-.content-block h3 {
-    font-size: 2rem;
-    line-height: 2rem;
-}
-</style>
diff --git a/VueApp/src/CMS/components/ContentDiffDialog.vue b/VueApp/src/CMS/components/ContentDiffDialog.vue
new file mode 100644
index 000000000..5f7cbf0c9
--- /dev/null
+++ b/VueApp/src/CMS/components/ContentDiffDialog.vue
@@ -0,0 +1,159 @@
+<template>
+    <q-dialog
+        :model-value="modelValue"
+        aria-labelledby="content-diff-title"
+        @update:model-value="emit('update:modelValue', $event)"
+    >
+        <q-card class="dialog-card-lg">
+            <q-card-section class="row items-center q-pb-none">
+                <div
+                    id="content-diff-title"
+                    class="text-h6"
+                >
+                    {{ title }}
+                </div>
+                <q-space />
+                <q-btn
+                    v-close-popup
+                    flat
+                    round
+                    dense
+                    icon="close"
+                    aria-label="Close"
+                />
+            </q-card-section>
+
+            <!-- Direction (old vs new) is the most important thing to read, so it sits at body
+                 contrast, not as a muted caption. -->
+            <q-card-section
+                v-if="subtitle"
+                class="text-body2 q-pb-none"
+            >
+                {{ subtitle }}
+            </q-card-section>
+
+            <!-- Legend only when there are real changes to read; it ties each color to a version. -->
+            <q-card-section
+                v-if="hasComparison && hasChanges && !loading"
+                class="row items-center q-gutter-sm q-pb-none text-caption"
+            >
+                <span class="cms-diff-legend"><ins class="diffins">added</ins> (newer)</span>
+                <span class="cms-diff-legend"><del class="diffdel">removed</del> (older)</span>
+            </q-card-section>
+
+            <q-separator class="q-mt-sm" />
+
+            <q-card-section
+                v-if="loading"
+                class="diff-body"
+            >
+                <div
+                    class="row items-center"
+                    role="status"
+                >
+                    <q-spinner color="primary" />
+                    <span class="sr-only">Loading diff</span>
+                </div>
+            </q-card-section>
+
+            <!-- Identical versions: state it plainly, no body (there is nothing to diff). -->
+            <q-card-section
+                v-else-if="hasComparison && !hasChanges"
+                class="text-body2 text-grey-8"
+                role="status"
+            >
+                These two versions are identical.
+            </q-card-section>
+
+            <template v-else>
+                <q-card-section
+                    v-if="!hasComparison"
+                    class="text-body2 text-grey-8"
+                    role="status"
+                >
+                    {{ emptyMessage }}
+                </q-card-section>
+                <q-card-section class="scroll diff-body">
+                    <!-- diffHtml is re-sanitized server-side after diffing (SanitizeDiff), keeping only ins/del markers -->
+                    <!-- eslint-disable vue/no-v-html -->
+                    <div
+                        v-html="diffHtml"
+                        class="content-block cms-diff"
+                    ></div>
+                    <!-- eslint-enable vue/no-v-html -->
+                </q-card-section>
+            </template>
+        </q-card>
+    </q-dialog>
+</template>
+
+<script setup lang="ts">
+withDefaults(
+    defineProps<{
+        modelValue: boolean
+        loading?: boolean
+        title?: string
+        subtitle?: string
+        diffHtml?: string
+        hasComparison?: boolean
+        hasChanges?: boolean
+        emptyMessage?: string
+    }>(),
+    {
+        loading: false,
+        title: "Content differences",
+        subtitle: "",
+        diffHtml: "",
+        hasComparison: true,
+        hasChanges: true,
+        emptyMessage: "This is the original version, so there is nothing to compare it against.",
+    },
+)
+
+const emit = defineEmits<{ "update:modelValue": [value: boolean] }>()
+</script>
+
+<style scoped>
+.diff-body {
+    max-height: 60vh;
+}
+
+/* htmldiff.net wraps changes in ins/del with diffins/diffdel/diffmod classes. Underline for
+   additions and strikethrough for deletions carry the meaning alongside the tint, so the diff
+   stays legible without relying on color. Ink text (--q-dark) on these light tints clears WCAG AA. */
+.cms-diff :deep(ins.diffins),
+.cms-diff :deep(ins.diffmod),
+.cms-diff-legend ins {
+    background-color: var(--diff-add);
+    color: var(--q-dark);
+    text-decoration: underline;
+}
+
+.cms-diff :deep(del.diffdel),
+.cms-diff :deep(del.diffmod),
+.cms-diff-legend del {
+    background-color: var(--diff-remove);
+    color: var(--q-dark);
+    text-decoration: line-through;
+}
+
+.cms-diff :deep(ins.diffins img),
+.cms-diff :deep(ins.diffmod img) {
+    outline: 2px solid var(--q-positive);
+}
+
+.cms-diff :deep(del.diffdel img),
+.cms-diff :deep(del.diffmod img) {
+    outline: 2px solid var(--q-negative);
+}
+
+/* Keep arbitrary historical content (wide tables, large images) inside the dialog. */
+.cms-diff :deep(img) {
+    max-width: 100%;
+    height: auto;
+}
+
+.cms-diff :deep(table) {
+    max-width: 100%;
+}
+</style>
diff --git a/VueApp/src/CMS/components/DateRangeFilter.vue b/VueApp/src/CMS/components/DateRangeFilter.vue
new file mode 100644
index 000000000..3acf4b6d7
--- /dev/null
+++ b/VueApp/src/CMS/components/DateRangeFilter.vue
@@ -0,0 +1,33 @@
+<template>
+    <div class="col-12 col-sm-3 col-lg-2">
+        <q-input
+            v-model="from"
+            dense
+            outlined
+            clearable
+            label="From"
+            type="date"
+            stack-label
+            @update:model-value="emit('change')"
+        />
+    </div>
+    <div class="col-12 col-sm-3 col-lg-2">
+        <q-input
+            v-model="to"
+            dense
+            outlined
+            clearable
+            label="To"
+            type="date"
+            stack-label
+            @update:model-value="emit('change')"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+// Shared From/To date-range inputs for the CMS audit/history list pages.
+const from = defineModel<string>("from", { required: true })
+const to = defineModel<string>("to", { required: true })
+const emit = defineEmits<{ change: [] }>()
+</script>
diff --git a/VueApp/src/CMS/components/DeleteRestoreButtons.vue b/VueApp/src/CMS/components/DeleteRestoreButtons.vue
new file mode 100644
index 000000000..c07ce8dff
--- /dev/null
+++ b/VueApp/src/CMS/components/DeleteRestoreButtons.vue
@@ -0,0 +1,37 @@
+<template>
+    <q-btn
+        v-if="!deleted"
+        dense
+        flat
+        no-caps
+        size="sm"
+        color="negative"
+        icon="delete"
+        :aria-label="`Delete ${entityName}`"
+        @click="emit('delete')"
+    >
+        <q-tooltip>Delete</q-tooltip>
+    </q-btn>
+    <q-btn
+        v-else
+        dense
+        flat
+        no-caps
+        size="sm"
+        color="positive"
+        icon="restore_from_trash"
+        :aria-label="`Restore ${entityName}`"
+        @click="emit('restore')"
+    >
+        <q-tooltip>Restore</q-tooltip>
+    </q-btn>
+</template>
+
+<script setup lang="ts">
+defineProps<{
+    deleted: boolean
+    entityName: string
+}>()
+
+const emit = defineEmits<{ delete: []; restore: [] }>()
+</script>
diff --git a/VueApp/src/CMS/components/EditButton.vue b/VueApp/src/CMS/components/EditButton.vue
new file mode 100644
index 000000000..690f2b724
--- /dev/null
+++ b/VueApp/src/CMS/components/EditButton.vue
@@ -0,0 +1,26 @@
+<template>
+    <q-btn
+        dense
+        flat
+        no-caps
+        size="sm"
+        color="secondary"
+        icon="edit"
+        :aria-label="`Edit ${entityName}`"
+        :to="to"
+        @click="emit('click')"
+    >
+        <q-tooltip>Edit</q-tooltip>
+    </q-btn>
+</template>
+
+<script setup lang="ts">
+import type { RouteLocationRaw } from "vue-router"
+
+defineProps<{
+    entityName: string
+    to?: RouteLocationRaw
+}>()
+
+const emit = defineEmits<{ click: [] }>()
+</script>
diff --git a/VueApp/src/CMS/components/FileFormDialog.vue b/VueApp/src/CMS/components/FileFormDialog.vue
new file mode 100644
index 000000000..3a7ea8e9c
--- /dev/null
+++ b/VueApp/src/CMS/components/FileFormDialog.vue
@@ -0,0 +1,485 @@
+<template>
+    <q-dialog
+        :model-value="modelValue"
+        persistent
+        aria-labelledby="file-dialog-title"
+        @update:model-value="emit('update:modelValue', $event)"
+        @hide="resetForm"
+        @keydown.escape="handleClose"
+    >
+        <q-card class="dialog-card-md">
+            <q-card-section class="row items-center q-pb-none">
+                <div
+                    id="file-dialog-title"
+                    class="text-h6"
+                >
+                    {{ isEdit ? "Edit File" : "Add File" }}
+                </div>
+                <q-space />
+                <q-btn
+                    icon="close"
+                    flat
+                    round
+                    dense
+                    aria-label="Close dialog"
+                    @click="handleClose"
+                />
+            </q-card-section>
+
+            <q-form
+                ref="formRef"
+                greedy
+                @submit.prevent="save"
+                @validation-error="onValidationError"
+            >
+                <q-card-section class="q-gutter-y-sm">
+                    <div
+                        v-if="isEdit"
+                        class="text-body2 q-mb-sm"
+                    >
+                        <strong>{{ file?.friendlyName }}</strong>
+                        <div class="text-caption text-grey-8">
+                            Link:
+                            <a
+                                :href="file?.friendlyUrl"
+                                target="_blank"
+                                rel="noopener"
+                            >
+                                {{ file?.friendlyUrl }}
+                            </a>
+                            <q-btn
+                                flat
+                                dense
+                                size="sm"
+                                icon="content_copy"
+                                aria-label="Copy link"
+                                @click="copyUrl"
+                            >
+                                <q-tooltip>Copy link</q-tooltip>
+                            </q-btn>
+                        </div>
+                    </div>
+
+                    <q-file
+                        v-model="form.upload"
+                        dense
+                        outlined
+                        :label="isEdit ? 'Replace file (optional)' : 'File'"
+                        :accept="acceptedExtensions"
+                        :rules="isEdit ? [] : [(v: File | null) => !!v || 'Please choose a file']"
+                        :hint="
+                            isEdit
+                                ? 'Uploading a new file replaces the current content, keeping the same name'
+                                : undefined
+                        "
+                    >
+                        <template #prepend>
+                            <q-icon name="attach_file" />
+                        </template>
+                    </q-file>
+
+                    <q-select
+                        v-if="!isEdit"
+                        v-model="form.folder"
+                        dense
+                        options-dense
+                        outlined
+                        label="VIPER app (folder)"
+                        :options="folders"
+                        :rules="[(v: string | null) => !!v || 'Please select a folder']"
+                    />
+
+                    <q-input
+                        v-model="form.description"
+                        dense
+                        outlined
+                        type="textarea"
+                        rows="2"
+                        label="Description"
+                        maxlength="1000"
+                    />
+
+                    <q-input
+                        v-model="form.oldUrl"
+                        dense
+                        outlined
+                        label="Old URL"
+                        maxlength="256"
+                        hint="Legacy VIPER 1 path this file replaces (optional)"
+                    />
+
+                    <PermissionSelector v-model="form.permissions" />
+
+                    <PersonSelector
+                        v-model="form.people"
+                        label="People with access"
+                    />
+
+                    <div class="row q-gutter-x-lg">
+                        <q-toggle
+                            v-model="form.allowPublicAccess"
+                            label="Public access"
+                        />
+                        <q-toggle
+                            v-model="form.encrypt"
+                            label="Encrypt file"
+                        />
+                    </div>
+
+                    <StatusBanner
+                        v-if="formError"
+                        type="error"
+                    >
+                        {{ formError }}
+                    </StatusBanner>
+                </q-card-section>
+
+                <q-card-actions align="right">
+                    <q-btn
+                        flat
+                        label="Cancel"
+                        dense
+                        no-caps
+                        @click="handleClose"
+                    />
+                    <q-btn
+                        type="submit"
+                        :label="isEdit ? 'Save Changes' : 'Upload'"
+                        color="primary"
+                        dense
+                        no-caps
+                        :loading="saving"
+                    >
+                        <template #loading>
+                            <q-spinner
+                                size="1em"
+                                class="q-mr-sm"
+                            />
+                            {{ isEdit ? "Save Changes" : "Upload" }}
+                        </template>
+                    </q-btn>
+                </q-card-actions>
+            </q-form>
+
+            <q-dialog
+                v-model="showConflict"
+                persistent
+                aria-labelledby="conflict-dialog-title"
+            >
+                <q-card class="dialog-card-sm">
+                    <q-card-section class="row items-center q-pb-none">
+                        <div
+                            id="conflict-dialog-title"
+                            class="text-h6"
+                        >
+                            File name already exists
+                        </div>
+                        <q-space />
+                        <q-btn
+                            icon="close"
+                            flat
+                            round
+                            dense
+                            aria-label="Close dialog"
+                            @click="showConflict = false"
+                        />
+                    </q-card-section>
+                    <q-card-section>
+                        <p class="text-body2">
+                            <strong>{{ form.upload?.name }}</strong> already exists in <strong>{{ form.folder }}</strong
+                            >{{ conflictDetail }}. Choose how to continue:
+                        </p>
+                        <q-option-group
+                            v-model="conflictChoice"
+                            :options="conflictOptions"
+                        />
+                        <q-input
+                            v-if="conflictChoice === 'rename'"
+                            v-model="renameTo"
+                            dense
+                            outlined
+                            label="New file name"
+                            class="q-mt-sm"
+                            :rules="[(v: string) => !!v?.trim() || 'Enter a file name']"
+                            hide-bottom-space
+                        />
+                    </q-card-section>
+                    <q-card-actions align="right">
+                        <q-btn
+                            color="primary"
+                            dense
+                            no-caps
+                            :label="conflictChoice === 'rename' ? 'Upload with new name' : 'Overwrite'"
+                            :loading="saving"
+                            @click="resolveConflict"
+                        >
+                            <template #loading>
+                                <q-spinner
+                                    size="1em"
+                                    class="q-mr-sm"
+                                />
+                                {{ conflictChoice === "rename" ? "Upload with new name" : "Overwrite" }}
+                            </template>
+                        </q-btn>
+                    </q-card-actions>
+                </q-card>
+            </q-dialog>
+        </q-card>
+    </q-dialog>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only; submitSave is split into small helpers below.
+// fallow-ignore-file complexity
+import { computed, inject, ref, watch } from "vue"
+import { useQuasar } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useUnsavedChanges } from "@/composables/use-unsaved-changes"
+import PermissionSelector from "@/CMS/components/PermissionSelector.vue"
+import PersonSelector from "@/CMS/components/PersonSelector.vue"
+import StatusBanner from "@/components/StatusBanner.vue"
+import { CMS_ACCEPTED_EXTENSIONS } from "@/CMS/file-types"
+import type { CmsFile, CmsFilePerson } from "@/CMS/types/"
+
+const props = defineProps<{
+    modelValue: boolean
+    folders: string[]
+    file: CmsFile | null
+}>()
+
+const emit = defineEmits<{
+    "update:modelValue": [value: boolean]
+    saved: [file: CmsFile]
+}>()
+
+const apiURL = inject("apiURL") + "cms/files/"
+const $q = useQuasar()
+const { get, postForm, putForm, createUrlSearchParams } = useFetch()
+
+const acceptedExtensions = CMS_ACCEPTED_EXTENSIONS
+
+const isEdit = computed(() => props.file !== null)
+const formRef = ref()
+const saving = ref(false)
+const formError = ref("")
+
+type FileForm = {
+    upload: File | null
+    folder: string | null
+    description: string
+    oldUrl: string
+    allowPublicAccess: boolean
+    encrypt: boolean
+    permissions: string[]
+    people: CmsFilePerson[]
+}
+
+type NameCheck = {
+    inUse: boolean
+    suggestedName: string
+    existingFileGuid: string | null
+    existingFriendlyName: string | null
+    existingDeleted: boolean
+}
+
+const emptyForm = (): FileForm => ({
+    upload: null,
+    folder: null,
+    description: "",
+    oldUrl: "",
+    allowPublicAccess: false,
+    encrypt: false,
+    permissions: [],
+    people: [],
+})
+
+const form = ref<FileForm>(emptyForm())
+
+const { setInitialState, confirmClose } = useUnsavedChanges(form)
+
+const conflict = ref<NameCheck | null>(null)
+const showConflict = ref(false)
+const conflictChoice = ref<"rename" | "overwrite">("rename")
+const renameTo = ref("")
+
+const conflictOptions = computed(() => [
+    { label: "Upload with a new name", value: "rename" },
+    {
+        label: conflict.value?.existingFileGuid
+            ? "Overwrite the existing file (replaces its content and details)"
+            : "Overwrite the existing file on disk",
+        value: "overwrite",
+    },
+])
+
+const conflictDetail = computed(() => {
+    if (!conflict.value?.existingFriendlyName) return ""
+    return ` (${conflict.value.existingFriendlyName}${conflict.value.existingDeleted ? ", deleted" : ""})`
+})
+
+watch(
+    () => [props.modelValue, props.file] as const,
+    ([open]) => {
+        if (!open) return
+        if (props.file) {
+            form.value = {
+                upload: null,
+                folder: props.file.folder,
+                description: props.file.description ?? "",
+                oldUrl: props.file.oldUrl ?? "",
+                allowPublicAccess: props.file.allowPublicAccess,
+                encrypt: props.file.encrypted,
+                permissions: [...props.file.permissions],
+                people: props.file.people.map((p) => ({ ...p })),
+            }
+        } else {
+            form.value = emptyForm()
+        }
+        formError.value = ""
+        setInitialState()
+    },
+)
+
+function resetForm() {
+    form.value = emptyForm()
+    conflict.value = null
+    showConflict.value = false
+    formError.value = ""
+    formRef.value?.resetValidation()
+}
+
+async function handleClose() {
+    if (await confirmClose()) {
+        emit("update:modelValue", false)
+    }
+}
+
+// The q-form focuses the first invalid field on a failed submit; this surfaces a matching
+// message next to the action buttons so the failure is obvious.
+function onValidationError() {
+    formError.value = isEdit.value
+        ? "Please complete the required fields before saving."
+        : "Please choose a file and complete the required fields before uploading."
+}
+
+async function copyUrl() {
+    if (!props.file) return
+    try {
+        await navigator.clipboard.writeText(props.file.friendlyUrl)
+        $q.notify({ type: "positive", message: "Link copied" })
+    } catch {
+        $q.notify({ type: "negative", message: "Failed to copy link" })
+    }
+}
+
+type SubmitOptions = {
+    fileName?: string
+    overwrite?: boolean
+    overwriteGuid?: string
+}
+
+function buildFormData(opts: SubmitOptions = {}): FormData {
+    const data = new FormData()
+    if (form.value.upload) {
+        data.append("file", form.value.upload)
+    }
+    if (!isEdit.value && !opts.overwriteGuid) {
+        data.append("folder", form.value.folder ?? "")
+        if (opts.fileName) {
+            data.append("fileName", opts.fileName)
+        }
+        if (opts.overwrite) {
+            data.append("overwrite", "true")
+        }
+    }
+    data.append("description", form.value.description)
+    data.append("oldUrl", form.value.oldUrl)
+    data.append("allowPublicAccess", form.value.allowPublicAccess.toString())
+    data.append("encrypt", form.value.encrypt.toString())
+    for (const p of form.value.permissions) {
+        data.append("permissions", p)
+    }
+    for (const person of form.value.people) {
+        data.append("iamIds", person.iamId)
+    }
+    return data
+}
+
+async function save() {
+    if (saving.value) return
+    formError.value = ""
+
+    // New uploads check the destination name first; a conflict prompts for rename/overwrite.
+    if (!isEdit.value && form.value.upload && form.value.folder) {
+        saving.value = true
+        const params = createUrlSearchParams({ folder: form.value.folder, fileName: form.value.upload.name })
+        const check = await get(apiURL + "check-name?" + params)
+        saving.value = false
+        if (check.success && check.result.inUse) {
+            conflict.value = check.result
+            conflictChoice.value = "rename"
+            renameTo.value = check.result.suggestedName
+            showConflict.value = true
+            return
+        }
+    }
+    await submitSave()
+}
+
+async function resolveConflict() {
+    if (saving.value) return
+    // Keep the conflict dialog open until the upload succeeds, so its buttons show the
+    // loading state and a failure leaves the user here instead of stranded on the form.
+    if (conflictChoice.value === "rename") {
+        const name = renameTo.value.trim()
+        if (!name) return
+        if (await submitSave({ fileName: name })) showConflict.value = false
+        return
+    }
+    const opts: SubmitOptions = conflict.value?.existingFileGuid
+        ? { overwriteGuid: conflict.value.existingFileGuid }
+        : { overwrite: true }
+    if (await submitSave(opts)) showConflict.value = false
+}
+
+// Edit updates the current record; overwriteGuid replaces an existing managed file's content and
+// details; otherwise this is a new upload.
+function sendSave(opts: SubmitOptions) {
+    if (isEdit.value) return putForm(apiURL + props.file!.fileGuid, buildFormData())
+    if (opts.overwriteGuid) return putForm(apiURL + opts.overwriteGuid, buildFormData(opts))
+    return postForm(apiURL, buildFormData(opts))
+}
+
+// During conflict resolution the user is in the conflict sub-dialog, so a toast is the only place
+// they'd see the error; otherwise surface it on the main form banner.
+function reportSaveError(res: { errors: string[] | null }) {
+    const message = res.errors?.[0] ?? `Failed to ${isEdit.value ? "save" : "upload"} file`
+    if (showConflict.value) {
+        $q.notify({ type: "negative", message })
+    } else {
+        formError.value = message
+    }
+}
+
+function saveSuccessMessage(opts: SubmitOptions): string {
+    if (isEdit.value) return "File updated"
+    return opts.overwrite || opts.overwriteGuid ? "File overwritten" : "File uploaded"
+}
+
+async function submitSave(opts: SubmitOptions = {}): Promise<boolean> {
+    if (saving.value) return false
+    saving.value = true
+    const res = await sendSave(opts)
+    saving.value = false
+
+    if (!res.success) {
+        reportSaveError(res)
+        return false
+    }
+
+    $q.notify({ type: "positive", message: saveSuccessMessage(opts) })
+    emit("saved", res.result)
+    emit("update:modelValue", false)
+    return true
+}
+</script>
diff --git a/VueApp/src/CMS/components/InlineFileUpload.vue b/VueApp/src/CMS/components/InlineFileUpload.vue
new file mode 100644
index 000000000..c302cc384
--- /dev/null
+++ b/VueApp/src/CMS/components/InlineFileUpload.vue
@@ -0,0 +1,348 @@
+<template>
+    <div>
+        <button
+            ref="dropZoneRef"
+            type="button"
+            class="inline-upload"
+            :class="{ 'inline-upload--over': isOverDropZone && !disabled }"
+            :disabled="disabled"
+            :aria-label="ariaLabel"
+            @click="activate"
+        >
+            <q-spinner
+                v-if="busy"
+                size="sm"
+                color="primary"
+            />
+            <q-icon
+                v-else
+                :name="folder ? 'upload_file' : 'block'"
+                size="sm"
+                class="inline-upload__icon"
+            />
+            <span class="inline-upload__text">
+                <template v-if="!folder">{{ disabledHint }}</template>
+                <template v-else>Drag a file here, or click to choose one. It uploads when you save.</template>
+            </span>
+        </button>
+
+        <!-- Files staged for upload on Save. Nothing is created on the server until the block is saved. -->
+        <div
+            v-for="item in staged"
+            :key="item.key"
+            class="staged-file q-mt-sm"
+        >
+            <div class="row items-center no-wrap">
+                <q-icon
+                    :name="item.conflict ? 'warning' : 'schedule'"
+                    :color="item.conflict ? 'warning' : 'grey-7'"
+                    size="xs"
+                    class="q-mr-sm"
+                />
+                <span class="col ellipsis">{{ item.file.name }}</span>
+                <q-btn
+                    flat
+                    dense
+                    size="sm"
+                    icon="close"
+                    color="negative"
+                    :aria-label="`Remove ${item.file.name}`"
+                    @click="removeStaged(item.key)"
+                >
+                    <q-tooltip>Remove</q-tooltip>
+                </q-btn>
+            </div>
+
+            <div
+                v-if="item.conflict"
+                class="staged-file__conflict"
+            >
+                <div class="text-caption text-warning">
+                    A file named "{{ item.file.name }}" already exists in {{ folder }}. Choose what to do:
+                </div>
+                <q-option-group
+                    v-model="item.action"
+                    :options="conflictOptions(item)"
+                    type="radio"
+                    dense
+                    class="q-mt-xs"
+                />
+            </div>
+        </div>
+
+        <StatusBanner
+            v-if="error"
+            type="error"
+            class="q-mt-sm"
+        >
+            {{ error }}
+        </StatusBanner>
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only; the upload logic is split into small helpers below.
+// fallow-ignore-file complexity
+import { computed, inject, ref, watch } from "vue"
+import { useDropZone, useFileDialog } from "@vueuse/core"
+import { useFetch } from "@/composables/ViperFetch"
+import StatusBanner from "@/components/StatusBanner.vue"
+import { CMS_ACCEPTED_EXTENSIONS } from "@/CMS/file-types"
+import type { CmsFile } from "@/CMS/types/"
+
+// Stages files for upload on the block's Save (nothing is created server-side until then), using the
+// block's own folder + permissions. On a name conflict the user picks per file: overwrite the
+// existing file, upload under a new name, or attach the existing file as-is (legacy's three options).
+const props = defineProps<{
+    folder: string | null
+    permissions: string[]
+    // Uploaded files inherit the block's public-access flag: a file on a public block must itself be
+    // publicly downloadable, or anonymous viewers get a broken/denied link.
+    allowPublicAccess?: boolean
+}>()
+
+const emit = defineEmits<{ "staged-count": [count: number] }>()
+
+const apiURL = inject("apiURL") + "cms/files/"
+const { get, postForm, putForm, del, createUrlSearchParams } = useFetch()
+
+type NameCheck = {
+    inUse: boolean
+    suggestedName: string
+    existingFileGuid: string | null
+    existingFriendlyName: string | null
+    existingDeleted: boolean
+}
+type StagedFile = {
+    key: string
+    file: File
+    conflict: NameCheck | null
+    action: "rename" | "overwrite" | "existing"
+}
+
+const dropZoneRef = ref<HTMLElement | null>(null)
+const staged = ref<StagedFile[]>([])
+const busy = ref(false)
+const error = ref("")
+let keyCounter = 0
+
+const disabled = computed(() => !props.folder || busy.value)
+const disabledHint = "Set a VIPER section path to upload files for this block."
+const ariaLabel = computed(() =>
+    props.folder ? "Add a file to upload when the block is saved, by clicking or dragging" : disabledHint,
+)
+
+watch(
+    () => staged.value.length,
+    (n) => emit("staged-count", n),
+)
+
+const { open: openFileDialog, onChange: onFileDialogChange } = useFileDialog({
+    accept: CMS_ACCEPTED_EXTENSIONS,
+    multiple: false,
+})
+onFileDialogChange((files) => stageFile(files?.[0]))
+const { isOverDropZone } = useDropZone(dropZoneRef, {
+    multiple: false,
+    onDrop: (files) => stageFile(files?.[0]),
+})
+
+function activate() {
+    if (disabled.value) return
+    openFileDialog()
+}
+
+function conflictOptions(item: StagedFile) {
+    const opts = [
+        { label: `Upload under a new name (${item.conflict!.suggestedName})`, value: "rename" },
+        { label: "Overwrite the existing file", value: "overwrite" },
+    ]
+    // "Use existing" only works when the conflict is a real file record we can attach.
+    if (item.conflict!.existingFileGuid) {
+        opts.push({ label: "Use the existing file instead (don't upload)", value: "existing" })
+    }
+    return opts
+}
+
+async function stageFile(file: File | null | undefined) {
+    if (!file || disabled.value) return
+    error.value = ""
+
+    // Drag-drop bypasses the picker's accept filter, so validate the extension ourselves.
+    const ext = "." + (file.name.split(".").pop() ?? "").toLowerCase()
+    if (!CMS_ACCEPTED_EXTENSIONS.split(",").includes(ext)) {
+        error.value = `Files of type ${ext} aren't allowed.`
+        return
+    }
+
+    busy.value = true
+    try {
+        const params = createUrlSearchParams({ folder: props.folder!, fileName: file.name })
+        const check = await get(apiURL + "check-name?" + params)
+        const conflict: NameCheck | null = check.success && check.result.inUse ? check.result : null
+        staged.value.push({ key: String(++keyCounter), file, conflict, action: "rename" })
+    } finally {
+        busy.value = false
+    }
+}
+
+function removeStaged(key: string) {
+    staged.value = staged.value.filter((s) => s.key !== key)
+}
+
+// Uploads (or resolves) every staged file per its chosen action. Returns the files to attach plus
+// the GUIDs that were newly created (new uploads/renames) so the parent can roll them back if the
+// block save then fails. Called as part of Save; throws on the first failure so the save aborts,
+// after rolling back files created earlier in the batch (soft delete, same as the parent's
+// rollbackFiles) so a partial failure doesn't strand new uploads attached to nothing.
+async function commit(): Promise<{ attached: CmsFile[]; createdGuids: string[] }> {
+    if (staged.value.length === 0) return { attached: [], createdGuids: [] }
+    busy.value = true
+    const attached: CmsFile[] = []
+    const createdGuids: string[] = []
+    try {
+        for (const item of staged.value) {
+            const { file, created } = await commitOne(item)
+            attached.push(file)
+            if (created) createdGuids.push(file.fileGuid)
+        }
+        staged.value = []
+        return { attached, createdGuids }
+    } catch (e) {
+        for (const guid of createdGuids) {
+            await del(apiURL + guid)
+        }
+        throw e
+    } finally {
+        busy.value = false
+    }
+}
+
+type CommitResult = { file: CmsFile; created: boolean }
+
+// Attach the existing file without uploading anything - never rolled back, it pre-existed.
+async function attachExisting(item: StagedFile): Promise<CommitResult> {
+    const res = await get(apiURL + item.conflict!.existingFileGuid)
+    if (!res.success) throw new Error(res.errors?.[0] ?? `Could not load ${item.conflict!.existingFriendlyName}`)
+    return { file: res.result as CmsFile, created: false }
+}
+
+// Shared multipart body: the file plus the block's public-access flag and permissions.
+function buildUploadData(item: StagedFile): FormData {
+    const data = new FormData()
+    data.append("file", item.file)
+    data.append("allowPublicAccess", String(props.allowPublicAccess ?? false))
+    for (const permission of props.permissions) {
+        data.append("permissions", permission)
+    }
+    return data
+}
+
+// Overwrite replaces an existing record's content in place (legacy editFile), keeping its GUID.
+// It is destructive to a pre-existing file and can't be un-done, so it is NOT rolled back.
+async function overwriteInPlace(item: StagedFile, data: FormData): Promise<CommitResult> {
+    const res = await putForm(apiURL + item.conflict!.existingFileGuid, data)
+    if (!res.success) throw new Error(res.errors?.[0] ?? `Failed to overwrite ${item.file.name}`)
+    return { file: res.result as CmsFile, created: false }
+}
+
+// New record created (new upload, rename, or overwriting an orphaned on-disk file with no
+// record); folder is required. This is safe to roll back on a failed save.
+async function uploadNew(item: StagedFile, data: FormData): Promise<CommitResult> {
+    data.append("folder", props.folder!)
+    if (item.conflict && item.action === "overwrite") {
+        data.append("overwrite", "true")
+    } else if (item.conflict && item.action === "rename") {
+        data.append("fileName", item.conflict.suggestedName)
+    }
+    const res = await postForm(apiURL, data)
+    if (!res.success) throw new Error(res.errors?.[0] ?? `Failed to upload ${item.file.name}`)
+    return { file: res.result as CmsFile, created: true }
+}
+
+// Returns the resulting file and whether a NEW record was created (true = safe to roll back).
+async function commitOne(item: StagedFile): Promise<CommitResult> {
+    if (item.conflict && item.action === "existing" && item.conflict.existingFileGuid) {
+        return attachExisting(item)
+    }
+    const data = buildUploadData(item)
+    if (item.conflict && item.action === "overwrite" && item.conflict.existingFileGuid) {
+        return overwriteInPlace(item, data)
+    }
+    return uploadNew(item, data)
+}
+
+defineExpose({ commit })
+</script>
+
+<style scoped>
+.inline-upload {
+    display: flex;
+    width: 100%;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.25rem;
+    padding: 1rem;
+    text-align: center;
+    border: 2px dashed var(--q-primary);
+    border-radius: 0.25rem;
+    background-color: transparent;
+    font: inherit;
+    color: var(--ucdavis-black-60);
+    cursor: pointer;
+    appearance: none;
+    transition:
+        box-shadow 0.15s ease,
+        border-style 0.15s ease;
+}
+
+/* Emphasise via the border/ring rather than a fill so the hint text keeps its AA
+   contrast against the dialog background in every state. */
+.inline-upload--over {
+    border-style: solid;
+    box-shadow: 0 0 0 2px var(--ucdavis-blue-20);
+}
+
+.inline-upload:focus-visible {
+    outline: none;
+    box-shadow:
+        0 0 0 0.1rem white,
+        0 0 0 0.25rem var(--focus-ring-color);
+}
+
+.inline-upload:disabled {
+    border-color: var(--ucdavis-black-60);
+    cursor: not-allowed;
+    opacity: 0.85;
+}
+
+.inline-upload__icon {
+    color: var(--q-primary);
+}
+
+.inline-upload:disabled .inline-upload__icon {
+    color: var(--ucdavis-black-60);
+}
+
+.inline-upload__text {
+    font-size: 0.85rem;
+}
+
+.staged-file {
+    border: 1px solid var(--ucdavis-blue-20);
+    border-radius: 0.25rem;
+    padding: 0.5rem;
+}
+
+.staged-file__conflict {
+    margin-top: 0.25rem;
+    padding-left: 1.5rem;
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .inline-upload {
+        transition: none;
+    }
+}
+</style>
diff --git a/VueApp/src/CMS/components/LeftNavMenuDialog.vue b/VueApp/src/CMS/components/LeftNavMenuDialog.vue
new file mode 100644
index 000000000..40832979c
--- /dev/null
+++ b/VueApp/src/CMS/components/LeftNavMenuDialog.vue
@@ -0,0 +1,149 @@
+<template>
+    <q-dialog
+        :model-value="modelValue"
+        persistent
+        aria-labelledby="add-menu-title"
+        @update:model-value="emit('update:modelValue', $event)"
+        @keydown.escape="handleClose"
+    >
+        <q-card class="dialog-card-sm">
+            <q-card-section class="row items-center q-pb-none">
+                <div
+                    id="add-menu-title"
+                    class="text-h6"
+                >
+                    Add Left-Nav Menu
+                </div>
+                <q-space />
+                <q-btn
+                    icon="close"
+                    flat
+                    round
+                    dense
+                    aria-label="Close dialog"
+                    @click="handleClose"
+                />
+            </q-card-section>
+
+            <q-form
+                ref="formRef"
+                greedy
+                @submit.prevent="save"
+                @validation-error="onValidationError"
+            >
+                <q-card-section class="q-pt-sm">
+                    <LeftNavMenuSettingsFields v-model="menu" />
+
+                    <StatusBanner
+                        v-if="formError"
+                        type="error"
+                    >
+                        {{ formError }}
+                    </StatusBanner>
+                </q-card-section>
+
+                <q-card-actions align="right">
+                    <q-btn
+                        flat
+                        label="Cancel"
+                        dense
+                        no-caps
+                        @click="handleClose"
+                    />
+                    <q-btn
+                        type="submit"
+                        label="Create Menu"
+                        color="primary"
+                        dense
+                        no-caps
+                        :loading="saving"
+                    >
+                        <template #loading>
+                            <q-spinner
+                                size="1em"
+                                class="q-mr-sm"
+                            />
+                            Create Menu
+                        </template>
+                    </q-btn>
+                </q-card-actions>
+            </q-form>
+        </q-card>
+    </q-dialog>
+</template>
+
+<script setup lang="ts">
+import { inject, ref, watch } from "vue"
+import { useFetch } from "@/composables/ViperFetch"
+import { useUnsavedChanges } from "@/composables/use-unsaved-changes"
+import LeftNavMenuSettingsFields, { type MenuSettings } from "@/CMS/components/LeftNavMenuSettingsFields.vue"
+import StatusBanner from "@/components/StatusBanner.vue"
+
+const props = defineProps<{ modelValue: boolean }>()
+const emit = defineEmits<{
+    "update:modelValue": [value: boolean]
+    created: [leftNavMenuId: number]
+}>()
+
+const apiURL = inject("apiURL") + "cms/left-navs"
+const { post } = useFetch()
+
+const formRef = ref()
+const saving = ref(false)
+const formError = ref("")
+
+const emptyMenu = (): MenuSettings => ({
+    menuHeaderText: "",
+    system: "Viper",
+    viperSectionPath: null,
+    page: null,
+    friendlyName: null,
+})
+
+const menu = ref<MenuSettings>(emptyMenu())
+
+const { setInitialState, confirmClose } = useUnsavedChanges(menu)
+
+// Start each open from a clean, empty form and capture that baseline for the unsaved guard.
+watch(
+    () => props.modelValue,
+    (open) => {
+        if (open) {
+            menu.value = emptyMenu()
+            formError.value = ""
+            formRef.value?.resetValidation()
+            setInitialState()
+        }
+    },
+)
+
+async function handleClose() {
+    if (await confirmClose()) {
+        emit("update:modelValue", false)
+    }
+}
+
+function onValidationError() {
+    formError.value = "Please complete the required fields before creating this menu."
+}
+
+async function save() {
+    formError.value = ""
+    saving.value = true
+    const res = await post(apiURL, {
+        menuHeaderText: menu.value.menuHeaderText,
+        system: menu.value.system,
+        viperSectionPath: menu.value.viperSectionPath || null,
+        page: menu.value.page || null,
+        friendlyName: menu.value.friendlyName || null,
+    })
+    saving.value = false
+
+    if (!res.success) {
+        formError.value = res.errors?.[0] ?? "Failed to create menu"
+        return
+    }
+    emit("created", res.result.leftNavMenuId)
+    emit("update:modelValue", false)
+}
+</script>
diff --git a/VueApp/src/CMS/components/LeftNavMenuSettingsFields.vue b/VueApp/src/CMS/components/LeftNavMenuSettingsFields.vue
new file mode 100644
index 000000000..8f1440197
--- /dev/null
+++ b/VueApp/src/CMS/components/LeftNavMenuSettingsFields.vue
@@ -0,0 +1,69 @@
+<template>
+    <q-input
+        v-model="menu.menuHeaderText"
+        dense
+        outlined
+        label="Menu header"
+        class="required-field q-mb-sm"
+        :rules="[(v: string | null) => (v && v.trim().length > 0) || 'Menu header is required']"
+        aria-required="true"
+        hide-bottom-space
+    />
+
+    <q-select
+        v-model="menu.system"
+        dense
+        options-dense
+        outlined
+        label="System"
+        class="q-mb-sm"
+        :options="['Viper', 'Public']"
+    />
+
+    <q-input
+        v-model="menu.viperSectionPath"
+        dense
+        outlined
+        label="VIPER section path"
+        class="q-mb-sm"
+    />
+
+    <q-input
+        v-model="menu.page"
+        dense
+        outlined
+        label="Page"
+        class="q-mb-sm"
+    />
+
+    <q-input
+        v-model="menu.friendlyName"
+        dense
+        outlined
+        label="Friendly name"
+        hint="Used by pages to look up this menu"
+        class="q-mb-sm"
+    />
+</template>
+
+<script setup lang="ts">
+export type MenuSettings = {
+    menuHeaderText: string | null
+    system: string
+    viperSectionPath: string | null
+    page: string | null
+    friendlyName: string | null
+}
+
+// Shared by the add modal (LeftNavMenuDialog) and the edit page (LeftNavEdit) so the menu
+// settings form stays identical in both. The model is a shared reactive object; field edits
+// mutate it in place, which both callers observe.
+const menu = defineModel<MenuSettings>({ required: true })
+</script>
+
+<style scoped>
+.required-field :deep(.q-field__label)::after {
+    content: " *";
+    color: var(--q-negative);
+}
+</style>
diff --git a/VueApp/src/CMS/components/Link.vue b/VueApp/src/CMS/components/Link.vue
index ed1d07765..757958d32 100644
--- a/VueApp/src/CMS/components/Link.vue
+++ b/VueApp/src/CMS/components/Link.vue
@@ -1,15 +1,8 @@
 <template>
     <q-card
         :bordered="true"
-        :clickable="isSafe"
-        v-ripple="isSafe"
-        :class="['link-card', isSafe ? 'cursor-pointer q-hoverable' : '']"
-        @click="isSafe && openWebReports(props.link.url)"
+        class="link-card"
     >
-        <span
-            v-if="isSafe"
-            class="q-focus-helper"
-        ></span>
         <q-card-section class="q-py-sm">
             <div class="text-h3">
                 <a
@@ -38,14 +31,13 @@
                     v-for="tag in props.link.linkTags"
                     :key="tag.linkTagId"
                 >
-                    <q-badge
+                    <StatusBadge
                         v-if="tag.linkCollectionTagCategoryId == lct.linkCollectionTagCategoryId"
-                        :color="getTagStyle(lct.sortOrder).color"
-                        :text-color="getTagStyle(lct.sortOrder).textColor"
-                        class="link-tag q-px-sm"
+                        :color="getTagColor(lct.sortOrder)"
+                        class="q-px-sm q-mr-xs"
                     >
                         {{ tag.value }}
-                    </q-badge>
+                    </StatusBadge>
                 </template>
             </template>
         </q-card-section>
@@ -53,9 +45,10 @@
 </template>
 
 <script setup lang="ts">
-import { computed, watch } from "vue"
+import { computed } from "vue"
 import type { Link, LinkCollection } from "@/CMS/types"
 import { safeHref } from "@/CMS/utils/url"
+import StatusBadge from "@/components/StatusBadge.vue"
 const props = defineProps<{
     link: Link
     linkCollection: LinkCollection
@@ -64,34 +57,23 @@ const props = defineProps<{
 const hrefForLink = computed(() => safeHref(props.link.url))
 const isSafe = computed(() => hrefForLink.value !== "#")
 
-// Each tag category's sortOrder (1-based) indexes this palette. Gold and Tahoe
-// are light enough to require dark text for WCAG AA contrast (≥4.5:1).
-const TAG_STYLES: ReadonlyArray<{ color: string; textColor: string }> = [
-    { color: "warning", textColor: "dark" },
-    { color: "secondary", textColor: "white" },
-    { color: "negative", textColor: "white" },
-    { color: "positive", textColor: "white" },
-    { color: "info", textColor: "dark" },
-    { color: "primary", textColor: "white" },
-]
+// Each tag category's sortOrder (1-based) indexes this categorical palette. It is
+// built from non-semantic brand roles only (Aggie Blue, the secondary-palette
+// arboretum/cabernet accents, Blue 70, and Ink) so status colors — positive,
+// negative, warning, info — keep their meaning and never read as a tag category.
+// StatusBadge derives the WCAG-AA text color for each (dark on arboretum, white
+// on the rest).
+const TAG_COLORS = ["primary", "arboretum", "cabernet", "secondary", "dark"] as const
 
-function getTagStyle(order: number) {
-    const idx = order >= 1 ? (order - 1) % TAG_STYLES.length : 0
-    return TAG_STYLES[idx]!
+function getTagColor(order: number) {
+    const idx = order >= 1 ? (order - 1) % TAG_COLORS.length : 0
+    return TAG_COLORS[idx]
 }
-
-function openWebReports(url: string) {
-    const href = safeHref(url)
-    if (href === "#") return
-    window.open(href, "_blank", "noopener,noreferrer")?.focus()
-}
-
-watch(props, () => {}, { deep: true })
 </script>
 
 <style scoped>
 .link-card {
-    max-width: 350px;
+    max-width: 21.875rem;
     width: 100%;
 }
 
@@ -99,8 +81,4 @@ watch(props, () => {}, { deep: true })
     text-decoration: none;
     color: inherit;
 }
-
-.link-tag {
-    margin-right: 2px;
-}
 </style>
diff --git a/VueApp/src/CMS/components/LinkCollections.vue b/VueApp/src/CMS/components/LinkCollections.vue
index f743fe941..ea94e6429 100644
--- a/VueApp/src/CMS/components/LinkCollections.vue
+++ b/VueApp/src/CMS/components/LinkCollections.vue
@@ -17,8 +17,7 @@
             v-model="filtersExpandedComputed"
             icon="filter_list"
             label="Filters"
-            header-class="bg-grey-2 lt-md"
-            :header-style="$q.screen.gt.xs ? 'display: none' : ''"
+            header-class="bg-grey-2 lt-sm"
             class="q-mb-md"
         >
             <q-form>
@@ -30,6 +29,7 @@
                         label="Search"
                         stack-label
                         clearable
+                        debounce="300"
                         class="col-12 col-sm-6 col-md-3 col-lg-2"
                     >
                         <template #append>
@@ -80,27 +80,25 @@
             </div>
         </template>
         <template v-else-if="linkCollection != null">
-            <div
-                class="q-pa-md row q-gutter-md"
+            <template
                 v-for="groupBy in groupByValues"
                 :key="groupBy"
             >
                 <div
-                    class="col-12"
-                    v-if="getInGroup(filteredLinks, groupBy).length > 0"
-                >
-                    <h3 class="q-mt-lg q-mb-sm">{{ groupBy }}</h3>
-                </div>
-                <template
-                    v-for="li in getInGroup(filteredLinks, groupBy)"
-                    :key="li.linkId"
+                    v-if="(groupedLinks.get(groupBy)?.length ?? 0) > 0"
+                    class="q-pa-md row q-gutter-md"
                 >
+                    <div class="col-12">
+                        <h3 class="q-mt-lg q-mb-sm">{{ groupBy }}</h3>
+                    </div>
                     <LinkComponent
+                        v-for="li in groupedLinks.get(groupBy)"
+                        :key="li.linkId"
                         :link="li"
                         :link-collection="linkCollection"
-                    ></LinkComponent>
-                </template>
-            </div>
+                    />
+                </div>
+            </template>
         </template>
     </template>
 </template>
@@ -148,7 +146,7 @@ async function getLinkCollection() {
     const { get } = useFetch()
     const baseUrl = import.meta.env.VITE_API_URL + "cms/linkcollections/"
     const r = await get(baseUrl + "?linkCollectionName=" + encodeURIComponent(props.linkCollectionName))
-    linkCollection.value = r.result[0] as LinkCollection
+    linkCollection.value = r.success && Array.isArray(r.result) ? ((r.result[0] as LinkCollection) ?? null) : null
     if (linkCollection.value) {
         await loadLinks(linkCollection.value.linkCollectionId)
         await loadFilters()
@@ -170,7 +168,7 @@ async function loadLinks(collectionId: number) {
 
 function loadFilters() {
     if (linkCollection.value !== null) {
-        for (var tagCat of linkCollection.value.linkCollectionTagCategories) {
+        for (const tagCat of linkCollection.value.linkCollectionTagCategories) {
             tagFilters.value.push({
                 linkCollectionTagCategoryId: tagCat.linkCollectionTagCategoryId,
                 linkCollectionTagCategory: tagCat.linkCollectionTagCategory,
@@ -178,19 +176,21 @@ function loadFilters() {
                 selected: null,
             })
         }
-        for (var l of links.value) {
-            for (var lt of l.linkTags) {
-                var t = tagFilters.value.find((t) => t.linkCollectionTagCategoryId === lt.linkCollectionTagCategoryId)
-                if (t) {
-                    t.options.push(lt.value)
+        for (const l of links.value) {
+            for (const lt of l.linkTags) {
+                const filter = tagFilters.value.find(
+                    (f) => f.linkCollectionTagCategoryId === lt.linkCollectionTagCategoryId,
+                )
+                if (filter) {
+                    filter.options.push(lt.value)
                 }
             }
         }
-        for (var tf of tagFilters.value) {
+        for (const tf of tagFilters.value) {
             tf.options = tf.options.sort()
         }
 
-        for (var tagOptions of tagFilters.value) {
+        for (const tagOptions of tagFilters.value) {
             tagOptions.options = [...new Set(tagOptions.options)]
             if (
                 props.groupByTagCategory !== null &&
@@ -203,21 +203,32 @@ function loadFilters() {
     }
 }
 
-function getInGroup(linksIn: Link[], groupByValue: string) {
-    if (props.groupByTagCategory === null || props.groupByTagCategory.length === 0 || groupById.value === null) {
-        return linksIn
+// Bucket the filtered links by their value in the group-by category once per render,
+// so the template does an O(1) Map.get per group instead of re-filtering every link
+// (twice) for every group.
+const groupedLinks = computed(() => {
+    const buckets = new Map<string, Link[]>()
+    if (groupById.value === null) {
+        return buckets
     }
-    return linksIn.filter((l) => {
-        const findTag = l.linkTags.find((lt) => {
-            return lt.linkCollectionTagCategoryId === groupById.value && lt.value === groupByValue
-        })
-        return findTag !== undefined
-    })
-}
+    for (const value of groupByValues.value) {
+        buckets.set(value, [])
+    }
+    for (const link of filteredLinks.value) {
+        const seen = new Set<string>()
+        for (const tag of link.linkTags) {
+            if (tag.linkCollectionTagCategoryId === groupById.value && !seen.has(tag.value)) {
+                seen.add(tag.value)
+                buckets.get(tag.value)?.push(link)
+            }
+        }
+    }
+    return buckets
+})
 
 function applyFilters() {
     filteredLinks.value = links.value
-    for (var tf of tagFilters.value) {
+    for (const tf of tagFilters.value) {
         if (tf.selected !== null && tf.selected !== "") {
             filteredLinks.value = filteredLinks.value.filter((fl: Link) => {
                 const findTag = fl.linkTags.find((lt: LinkTag) => {
@@ -239,32 +250,16 @@ function applyFilters() {
     }
 }
 
-watch(
-    tagFilters,
-    () => {
-        applyFilters()
-    },
-    { deep: true },
-)
+// Re-filter only when a selection or the search term changes. Watching the
+// mapped selected values (not the whole tagFilters tree) avoids re-running
+// applyFilters for every option pushed onto a filter during loadFilters.
+const selectedTagValues = computed(() => tagFilters.value.map((tf) => tf.selected))
+watch(selectedTagValues, () => {
+    applyFilters()
+})
 watch(search, () => {
     applyFilters()
 })
 
 getLinkCollection()
 </script>
-
-<style scoped>
-.link-card {
-    max-width: 350px;
-    width: 100%;
-}
-
-.link-card a {
-    text-decoration: none;
-    color: inherit;
-}
-
-.link-tag {
-    margin-right: 2px;
-}
-</style>
diff --git a/VueApp/src/CMS/components/ListCard.vue b/VueApp/src/CMS/components/ListCard.vue
new file mode 100644
index 000000000..9eb5a0508
--- /dev/null
+++ b/VueApp/src/CMS/components/ListCard.vue
@@ -0,0 +1,23 @@
+<template>
+    <div class="col-12 q-pa-xs">
+        <q-card
+            flat
+            bordered
+            class="list-card"
+        >
+            <q-card-section class="q-gutter-y-xs">
+                <slot name="header" />
+                <slot />
+            </q-card-section>
+            <template v-if="$slots.actions">
+                <q-separator />
+                <q-card-actions align="right">
+                    <slot name="actions" />
+                </q-card-actions>
+            </template>
+        </q-card>
+    </div>
+</template>
+
+<!-- Card shell for QTable grid (card) mode: a header region, stacked fields, and a
+     right-aligned actions row. Pairs with ListCardField for the label/value rows. -->
diff --git a/VueApp/src/CMS/components/ListCardField.vue b/VueApp/src/CMS/components/ListCardField.vue
new file mode 100644
index 000000000..8045dee4a
--- /dev/null
+++ b/VueApp/src/CMS/components/ListCardField.vue
@@ -0,0 +1,14 @@
+<template>
+    <div class="list-card-field">
+        <span class="list-card-label">{{ label }}</span>
+        <div class="list-card-value">
+            <slot>{{ value }}</slot>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+// One label/value row inside a ListCard. Pass a plain value via the prop, or richer
+// content (chips, links, a stamp) via the default slot.
+defineProps<{ label: string; value?: string | number | null }>()
+</script>
diff --git a/VueApp/src/CMS/components/ModifiedStamp.vue b/VueApp/src/CMS/components/ModifiedStamp.vue
new file mode 100644
index 000000000..7a8414ecd
--- /dev/null
+++ b/VueApp/src/CMS/components/ModifiedStamp.vue
@@ -0,0 +1,39 @@
+<template>
+    <q-td
+        v-if="cellProps"
+        :props="cellProps"
+    >
+        {{ formatted }}
+        <span class="text-grey-7">{{ stamp.modifiedBy }}</span>
+    </q-td>
+    <span v-else>
+        {{ formatted }}
+        <span class="text-grey-7">{{ stamp.modifiedBy }}</span>
+    </span>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue"
+
+type ModifiedRow = { modifiedOn: string; modifiedBy: string }
+
+// Renders a <q-td> when given table cell props, or a plain inline span when given a
+// row directly (QTable card/grid mode on small screens), so both layouts share one
+// date format.
+const props = defineProps<{
+    cellProps?: { row: ModifiedRow }
+    row?: ModifiedRow
+}>()
+
+const stamp = computed<ModifiedRow>(() => props.cellProps?.row ?? props.row ?? { modifiedOn: "", modifiedBy: "" })
+
+const formatted = computed(() =>
+    stamp.value.modifiedOn
+        ? new Date(stamp.value.modifiedOn).toLocaleDateString("en-US", {
+              year: "2-digit",
+              month: "2-digit",
+              day: "2-digit",
+          })
+        : "",
+)
+</script>
diff --git a/VueApp/src/CMS/components/PermissionChips.vue b/VueApp/src/CMS/components/PermissionChips.vue
new file mode 100644
index 000000000..cc5ed87fb
--- /dev/null
+++ b/VueApp/src/CMS/components/PermissionChips.vue
@@ -0,0 +1,62 @@
+<template>
+    <div :class="stacked ? 'column items-start chips-stacked' : ''">
+        <template v-if="permissions.length || peopleCount > 0">
+            <q-chip
+                v-for="p in permissions.slice(0, maxShown)"
+                :key="p"
+                dense
+                square
+                size="sm"
+            >
+                {{ p }}
+            </q-chip>
+            <q-chip
+                v-if="permissions.length > maxShown"
+                dense
+                square
+                size="sm"
+                color="grey-4"
+            >
+                +{{ permissions.length - maxShown }} more
+            </q-chip>
+            <q-chip
+                v-if="peopleCount > 0"
+                dense
+                square
+                size="sm"
+                icon="person"
+                color="grey-4"
+            >
+                {{ peopleCount }}
+            </q-chip>
+        </template>
+        <span
+            v-else
+            class="text-grey-7"
+        >
+            All VIPER users
+        </span>
+    </div>
+</template>
+
+<script setup lang="ts">
+withDefaults(
+    defineProps<{
+        permissions: string[]
+        peopleCount?: number
+        maxShown?: number
+        // Stack chips vertically (for narrow table columns) instead of flowing inline.
+        stacked?: boolean
+    }>(),
+    { peopleCount: 0, maxShown: 2, stacked: false },
+)
+</script>
+
+<style scoped>
+/* When stacked, drop the chips' horizontal margins so they sit flush-left
+   and tighten the vertical rhythm. */
+.chips-stacked .q-chip {
+    margin-left: 0;
+    margin-right: 0;
+}
+</style>
diff --git a/VueApp/src/CMS/components/PermissionSelector.vue b/VueApp/src/CMS/components/PermissionSelector.vue
new file mode 100644
index 000000000..90b65837b
--- /dev/null
+++ b/VueApp/src/CMS/components/PermissionSelector.vue
@@ -0,0 +1,61 @@
+<template>
+    <q-select
+        :model-value="modelValue"
+        multiple
+        use-chips
+        use-input
+        input-debounce="100"
+        dense
+        options-dense
+        clearable
+        :label="label"
+        :options="filteredOptions"
+        :loading="loading"
+        hint="Users need any one of the selected permissions"
+        @update:model-value="emit('update:modelValue', $event ?? [])"
+        @filter="filterOptions"
+    />
+</template>
+
+<script setup lang="ts">
+import { inject, ref } from "vue"
+import { useFetch } from "@/composables/ViperFetch"
+
+withDefaults(
+    defineProps<{
+        modelValue: string[]
+        label?: string
+    }>(),
+    { label: "Permissions" },
+)
+
+const emit = defineEmits<{ "update:modelValue": [value: string[]] }>()
+
+const apiURL = inject("apiURL") + "cms/options/"
+const allPermissions = ref<string[]>([])
+const filteredOptions = ref<string[]>([])
+const loading = ref(false)
+let loaded = false
+
+async function loadPermissions() {
+    loading.value = true
+    const { get } = useFetch()
+    const res = await get(apiURL + "permissions")
+    if (res.success) {
+        allPermissions.value = res.result
+        loaded = true
+    }
+    loading.value = false
+}
+
+async function filterOptions(val: string, update: (fn: () => void) => void) {
+    if (!loaded) {
+        await loadPermissions()
+    }
+    update(() => {
+        const needle = val.toLowerCase()
+        filteredOptions.value =
+            needle === "" ? allPermissions.value : allPermissions.value.filter((p) => p.toLowerCase().includes(needle))
+    })
+}
+</script>
diff --git a/VueApp/src/CMS/components/PersonSelector.vue b/VueApp/src/CMS/components/PersonSelector.vue
new file mode 100644
index 000000000..cb5dc874e
--- /dev/null
+++ b/VueApp/src/CMS/components/PersonSelector.vue
@@ -0,0 +1,81 @@
+<template>
+    <q-select
+        :model-value="modelValue"
+        multiple
+        use-chips
+        use-input
+        input-debounce="300"
+        dense
+        options-dense
+        :label="label"
+        :options="options"
+        :loading="loading"
+        option-value="iamId"
+        hint="Type at least 2 characters to search people"
+        @update:model-value="emit('update:modelValue', $event ?? [])"
+        @filter="searchPeople"
+    >
+        <template #option="{ itemProps, opt }">
+            <q-item v-bind="itemProps">
+                <q-item-section>
+                    <q-item-label>{{ opt.name }}</q-item-label>
+                    <q-item-label caption>{{ opt.loginId ?? opt.iamId }}</q-item-label>
+                </q-item-section>
+            </q-item>
+        </template>
+        <template #selected-item="scope">
+            <q-chip
+                removable
+                dense
+                :tabindex="scope.tabindex"
+                @remove="scope.removeAtIndex(scope.index)"
+            >
+                {{ scope.opt.name ?? scope.opt.iamId }}
+            </q-chip>
+        </template>
+        <template #no-option>
+            <q-item>
+                <q-item-section class="text-grey">No matching people</q-item-section>
+            </q-item>
+        </template>
+    </q-select>
+</template>
+
+<script setup lang="ts">
+import { inject, ref } from "vue"
+import { useFetch } from "@/composables/ViperFetch"
+import type { CmsPersonOption } from "@/CMS/types/"
+
+// Selected people keep { iamId, name } so chips can show names for people
+// loaded from an existing file (where only iamId + name are known).
+defineProps<{
+    modelValue: { iamId: string; name: string | null }[]
+    label?: string
+}>()
+
+const emit = defineEmits<{ "update:modelValue": [value: { iamId: string; name: string | null }[]] }>()
+
+const apiURL = inject("apiURL") + "cms/options/"
+const options = ref<CmsPersonOption[]>([])
+const loading = ref(false)
+// Guards against out-of-order responses: only the latest search may update options
+let searchSeq = 0
+
+async function searchPeople(val: string, update: (fn: () => void) => void) {
+    if (val.trim().length < 2) {
+        update(() => {
+            options.value = []
+        })
+        return
+    }
+    const seq = ++searchSeq
+    loading.value = true
+    const { get, createUrlSearchParams } = useFetch()
+    const res = await get(apiURL + "people?" + createUrlSearchParams({ search: val.trim() }))
+    if (seq !== searchSeq) return
+    loading.value = false
+    update(() => {
+        options.value = res.success ? res.result : []
+    })
+}
+</script>
diff --git a/VueApp/src/CMS/components/RecentActivity.vue b/VueApp/src/CMS/components/RecentActivity.vue
new file mode 100644
index 000000000..49e2e6178
--- /dev/null
+++ b/VueApp/src/CMS/components/RecentActivity.vue
@@ -0,0 +1,257 @@
+<template>
+    <section aria-label="Recent activity">
+        <!-- Bare h2: the compressed-heading rule renders it 1.2rem bold, matching the hub's
+             primary card title (text-h6 would drop it to 1rem regular, weaker than the rows). -->
+        <h2 class="text-primary q-my-none">Recent activity</h2>
+
+        <template v-if="loading">
+            <q-skeleton
+                v-for="n in 4"
+                :key="n"
+                type="text"
+                class="q-my-sm"
+            />
+        </template>
+
+        <div
+            v-else-if="failed"
+            class="text-body2 text-grey-8 q-mt-xs"
+        >
+            Couldn't load recent activity.
+        </div>
+
+        <div
+            v-else-if="items.length === 0"
+            class="text-body2 text-grey-8 q-mt-xs"
+        >
+            Nothing edited recently.
+        </div>
+
+        <q-list
+            v-else
+            dense
+        >
+            <ActivityRow
+                v-for="item in items"
+                :key="item.key"
+                :item="item"
+            />
+        </q-list>
+
+        <ContentDiffDialog
+            v-model="viewer.open"
+            :loading="viewer.loading"
+            :title="viewer.title"
+            :subtitle="viewer.subtitle"
+            :diff-html="viewer.content"
+            :has-comparison="viewer.hasComparison"
+            :has-changes="viewer.hasChanges"
+        />
+    </section>
+</template>
+
+<script setup lang="ts">
+import { inject, onMounted, ref } from "vue"
+import { useQuasar } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useContentDiffViewer } from "@/CMS/composables/use-content-diff-viewer"
+import ActivityRow from "@/CMS/components/ActivityRow.vue"
+import ContentDiffDialog from "@/CMS/components/ContentDiffDialog.vue"
+import type {
+    ActivityItem,
+    CmsContentBlock,
+    CmsContentHistoryAudit,
+    CmsContentHistoryDiff,
+    CmsFile,
+    CmsLeftNavMenu,
+    RailAction,
+} from "@/CMS/types/"
+
+const MAX_ITEMS = 8
+const PER_SOURCE = 5
+
+const {
+    showBlocks = false,
+    showFiles = false,
+    showLeftNavs = false,
+} = defineProps<{
+    showBlocks?: boolean
+    showFiles?: boolean
+    showLeftNavs?: boolean
+}>()
+
+const $q = useQuasar()
+const apiURL = inject("apiURL")
+const { get, post, createUrlSearchParams } = useFetch()
+const { viewer, openViewer, applyDiff, closeViewer, failViewer, diffStamp } = useContentDiffViewer()
+
+const loading = ref(true)
+const failed = ref(false)
+const items = ref<ActivityItem[]>([])
+
+// History rows hold only superseded versions, and the GET diff endpoint compares two of them —
+// so the block's latest change (newest history row -> live content) needs the POST diff with
+// the current content, exactly like the editor's compare-against-draft flow.
+async function openLatestDiff(b: CmsContentBlock, label: string) {
+    openViewer(label)
+    const listParams = createUrlSearchParams({ contentBlockId: b.contentBlockId, page: 1, perPage: 1 })
+    const [blockRes, listRes] = await Promise.all([
+        get(apiURL + "CMS/content/" + b.contentBlockId),
+        get(apiURL + "CMS/content/history?" + listParams),
+    ])
+    const previous = ((listRes.result ?? []) as CmsContentHistoryAudit[])[0]
+    if (listRes.success && !previous) {
+        closeViewer()
+        $q.notify({ type: "info", message: "No edit history for this block yet." })
+        return
+    }
+    if (!listRes.success || !blockRes.success) {
+        failViewer("Failed to load the latest change")
+        return
+    }
+    const res = await post(
+        apiURL + "CMS/content/" + b.contentBlockId + "/history/" + previous.contentHistoryId + "/diff",
+        {
+            content: (blockRes.result as CmsContentBlock).content,
+        },
+    )
+    if (res.success) {
+        const diff = res.result as CmsContentHistoryDiff
+        applyDiff(
+            diff,
+            `Changes from ${diffStamp(diff.oldModifiedOn, diff.oldModifiedBy)} to ${diffStamp(b.modifiedOn, b.modifiedBy)}`,
+        )
+    } else {
+        failViewer(res.errors?.[0] ?? "Failed to load the latest change")
+    }
+}
+
+async function loadBlocks(): Promise<ActivityItem[]> {
+    // Sort/limit server-side like loadFiles: sorting a default page client-side would only
+    // ever surface the recent-most of the first alphabetical page of blocks.
+    const params = createUrlSearchParams({
+        status: "active",
+        page: 1,
+        perPage: PER_SOURCE,
+        sortBy: "modifiedOn",
+        descending: "true",
+    })
+    const res = await get(apiURL + "CMS/content?" + params)
+    if (!res.success) throw new Error("blocks")
+    return ((res.result ?? []) as CmsContentBlock[]).map((b) => {
+        const label = b.title || b.friendlyName || "(untitled)"
+        return {
+            key: "block-" + b.contentBlockId,
+            icon: "article",
+            typeLabel: "Content block",
+            label,
+            to: { name: "CmsContentBlockEdit", params: { id: b.contentBlockId } },
+            modifiedOn: b.modifiedOn,
+            modifiedBy: b.modifiedBy,
+            actions: [
+                {
+                    icon: "difference",
+                    label: "View latest change",
+                    run: () => void openLatestDiff(b, label),
+                },
+                {
+                    icon: "history",
+                    label: "View edit history",
+                    to: { name: "CmsContentBlockHistory", query: { contentBlockId: String(b.contentBlockId) } },
+                },
+            ],
+        }
+    })
+}
+
+function fileAuditAction(fileGuid: string): RailAction {
+    return {
+        icon: "fact_check",
+        label: "View audit trail",
+        to: { name: "CmsFileAudit", query: { fileGuid } },
+    }
+}
+
+async function loadFiles(): Promise<ActivityItem[]> {
+    const params = createUrlSearchParams({
+        status: "active",
+        page: 1,
+        perPage: PER_SOURCE,
+        sortBy: "modifiedOn",
+        descending: "true",
+    })
+    const res = await get(apiURL + "cms/files/?" + params)
+    if (!res.success) throw new Error("files")
+    return ((res.result ?? []) as CmsFile[]).map((f) => ({
+        key: "file-" + f.fileGuid,
+        icon: "description",
+        typeLabel: "File",
+        label: f.friendlyName,
+        to: { name: "CmsFiles", query: { search: f.friendlyName } },
+        modifiedOn: f.modifiedOn,
+        modifiedBy: f.modifiedBy,
+        actions: [fileAuditAction(f.fileGuid)],
+    }))
+}
+
+async function loadDeletedFiles(): Promise<ActivityItem[]> {
+    const params = createUrlSearchParams({
+        status: "deleted",
+        page: 1,
+        perPage: PER_SOURCE,
+        sortBy: "deletedOn",
+        descending: "true",
+    })
+    const res = await get(apiURL + "cms/files/?" + params)
+    if (!res.success) throw new Error("deletedFiles")
+    return ((res.result ?? []) as CmsFile[]).map((f) => ({
+        key: "trash-" + f.fileGuid,
+        icon: "delete",
+        typeLabel: "File",
+        verb: "deleted",
+        label: f.friendlyName,
+        to: { name: "CmsFiles", query: { status: "deleted", search: f.friendlyName } },
+        // Soft delete stamps ModifiedOn/ModifiedBy alongside DeletedOn, so the deleter is correct.
+        modifiedOn: f.deletedOn ?? f.modifiedOn,
+        modifiedBy: f.modifiedBy,
+        actions: [fileAuditAction(f.fileGuid)],
+    }))
+}
+
+async function loadLeftNavs(): Promise<ActivityItem[]> {
+    // The left-nav list endpoint returns all menus unsorted, so sort by modifiedOn here.
+    const res = await get(apiURL + "cms/left-navs")
+    if (!res.success) throw new Error("leftNavs")
+    return [...((res.result ?? []) as CmsLeftNavMenu[])]
+        .sort((a, b) => new Date(b.modifiedOn).getTime() - new Date(a.modifiedOn).getTime())
+        .slice(0, PER_SOURCE)
+        .map((m) => ({
+            key: "leftnav-" + m.leftNavMenuId,
+            icon: "menu",
+            typeLabel: "Left-nav menu",
+            label: m.menuHeaderText || m.friendlyName || "(untitled)",
+            to: { name: "CmsLeftNavEdit", params: { id: m.leftNavMenuId } },
+            modifiedOn: m.modifiedOn,
+            modifiedBy: m.modifiedBy,
+        }))
+}
+
+async function loadActivity() {
+    const sources = [
+        ...(showBlocks ? [loadBlocks()] : []),
+        ...(showFiles ? [loadFiles(), loadDeletedFiles()] : []),
+        ...(showLeftNavs ? [loadLeftNavs()] : []),
+    ]
+    const results = await Promise.allSettled(sources)
+    const loaded = results.filter((r) => r.status === "fulfilled").flatMap((r) => r.value)
+    failed.value = sources.length > 0 && results.every((r) => r.status === "rejected")
+    items.value = loaded
+        .sort((a, b) => new Date(b.modifiedOn).getTime() - new Date(a.modifiedOn).getTime())
+        .slice(0, MAX_ITEMS)
+    loading.value = false
+}
+
+onMounted(() => {
+    void loadActivity()
+})
+</script>
diff --git a/VueApp/src/CMS/components/StatusIcon.vue b/VueApp/src/CMS/components/StatusIcon.vue
new file mode 100644
index 000000000..9dc5e659f
--- /dev/null
+++ b/VueApp/src/CMS/components/StatusIcon.vue
@@ -0,0 +1,19 @@
+<template>
+    <q-icon
+        :name="icon"
+        :color="color"
+        aria-hidden="true"
+    >
+        <q-tooltip>{{ label }}</q-tooltip>
+    </q-icon>
+    <span class="sr-only">{{ label }}</span>
+</template>
+
+<script setup lang="ts">
+// Row-status icon: tooltip for sighted users, sr-only text for screen readers.
+defineProps<{
+    icon: string
+    color: string
+    label: string
+}>()
+</script>
diff --git a/VueApp/src/CMS/composables/use-content-diff-viewer.ts b/VueApp/src/CMS/composables/use-content-diff-viewer.ts
new file mode 100644
index 000000000..0badafbda
--- /dev/null
+++ b/VueApp/src/CMS/composables/use-content-diff-viewer.ts
@@ -0,0 +1,68 @@
+import { ref } from "vue"
+import { useQuasar } from "quasar"
+import { useDateFunctions } from "@/composables/DateFunctions"
+import type { CmsContentHistoryDiff } from "@/CMS/types/"
+
+// Shared state and helpers for every ContentDiffDialog consumer (history page, block editor,
+// recent-activity rail): one open/reset shape, one way to apply a diff response, one error
+// path, and the shared "date by author" stamp wording for subtitles.
+export function useContentDiffViewer() {
+    const $q = useQuasar()
+    const { formatDateTime } = useDateFunctions()
+
+    const viewer = ref({
+        open: false,
+        loading: false,
+        title: "",
+        subtitle: "",
+        content: "",
+        hasComparison: true,
+        hasChanges: true,
+    })
+
+    function openViewer(title: string) {
+        viewer.value = {
+            open: true,
+            loading: true,
+            title,
+            subtitle: "",
+            content: "",
+            hasComparison: true,
+            hasChanges: true,
+        }
+    }
+
+    function applyDiff(diff: CmsContentHistoryDiff, subtitle: string) {
+        viewer.value.content = diff.content
+        viewer.value.hasComparison = diff.hasComparison
+        viewer.value.hasChanges = diff.hasChanges
+        viewer.value.subtitle = subtitle
+        viewer.value.loading = false
+    }
+
+    function closeViewer() {
+        viewer.value.open = false
+        viewer.value.loading = false
+    }
+
+    function failViewer(message: string) {
+        $q.notify({ type: "negative", message })
+        closeViewer()
+    }
+
+    function diffStamp(on: string | null, by: string | null): string {
+        return (
+            (on ? formatDateTime(on, { dateStyle: "short", timeStyle: "short" }) : "unknown date") +
+            (by ? ` by ${by}` : "")
+        )
+    }
+
+    // Subtitle for a saved-version diff (GET .../diff): direction reads old version -> new version.
+    function savedDiffSubtitle(diff: CmsContentHistoryDiff): string {
+        return diff.hasComparison
+            ? `Changes from ${diffStamp(diff.oldModifiedOn, diff.oldModifiedBy)} to ${diffStamp(diff.newModifiedOn, diff.newModifiedBy)}`
+            : `Original version, ${diffStamp(diff.newModifiedOn, diff.newModifiedBy)}`
+    }
+
+    return { viewer, openViewer, applyDiff, closeViewer, failViewer, diffStamp, savedDiffSubtitle }
+}
diff --git a/VueApp/src/CMS/composables/use-server-table.ts b/VueApp/src/CMS/composables/use-server-table.ts
new file mode 100644
index 000000000..7d73d580c
--- /dev/null
+++ b/VueApp/src/CMS/composables/use-server-table.ts
@@ -0,0 +1,78 @@
+import type { Ref } from "vue"
+import { ref } from "vue"
+import { useQuasar } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+
+type ServerTablePagination = {
+    sortBy: string
+    descending: boolean
+    page: number
+    rowsPerPage: number
+    rowsNumber: number
+}
+
+// Quasar's QTable @request emits pagination without a guaranteed rowsNumber.
+type TableRequestPagination = {
+    sortBy: string
+    descending: boolean
+    page: number
+    rowsPerPage: number
+    rowsNumber?: number
+}
+
+type TableRequest = { pagination: TableRequestPagination }
+
+type TableQueryParams = Record<string, string | number | null | undefined>
+
+type ServerTableOptions = {
+    url: string
+    // Build the query params for one page request from the table's current pagination.
+    buildParams: (pagination: TableRequestPagination) => TableQueryParams
+    errorMessage?: string
+    pagination?: Partial<ServerTablePagination>
+}
+
+// Server-side paged QTable core shared by the CMS list pages: owns rows/loading/pagination, issues
+// the GET on @request, and binds rowsNumber from the response envelope (falling back to the row
+// count when the API returns none). Callers supply the URL and a params builder, keeping each
+// page's filter mapping local while the fetch/pagination plumbing lives here once.
+export function useServerTable<TRow>(options: ServerTableOptions) {
+    const $q = useQuasar()
+    const { get, createUrlSearchParams } = useFetch()
+    const failureMessage = options.errorMessage ?? "Failed to load"
+
+    const rows = ref([]) as Ref<TRow[]>
+    const loading = ref(false)
+    const pagination = ref<ServerTablePagination>({
+        sortBy: "",
+        descending: false,
+        page: 1,
+        rowsPerPage: 50,
+        rowsNumber: 0,
+        ...options.pagination,
+    })
+
+    async function onRequest(request: TableRequest) {
+        const { page, rowsPerPage, sortBy, descending } = request.pagination
+        loading.value = true
+        const params = createUrlSearchParams(options.buildParams(request.pagination))
+        const res = await get(`${options.url}?${params}`)
+        if (res.success) {
+            rows.value = res.result
+            pagination.value.rowsNumber = res.pagination?.totalRecords ?? res.result.length
+            pagination.value.page = page
+            pagination.value.rowsPerPage = rowsPerPage
+            pagination.value.sortBy = sortBy
+            pagination.value.descending = descending
+        } else {
+            $q.notify({ type: "negative", message: res.errors?.[0] ?? failureMessage })
+        }
+        loading.value = false
+    }
+
+    function reloadFirstPage() {
+        return onRequest({ pagination: { ...pagination.value, page: 1 } })
+    }
+
+    return { rows, loading, pagination, onRequest, reloadFirstPage }
+}
diff --git a/VueApp/src/CMS/composables/use-url-filtered-table.ts b/VueApp/src/CMS/composables/use-url-filtered-table.ts
new file mode 100644
index 000000000..98c976e9a
--- /dev/null
+++ b/VueApp/src/CMS/composables/use-url-filtered-table.ts
@@ -0,0 +1,111 @@
+import type { Ref } from "vue"
+import type { LocationQuery, LocationQueryRaw } from "vue-router"
+import { ref, watch } from "vue"
+import { useRoute, useRouter } from "vue-router"
+import { useServerTable } from "./use-server-table"
+
+type UrlFilters = Record<string, string | null>
+
+type UrlFilteredTableOptions<F extends UrlFilters> = {
+    url: string
+    errorMessage: string
+    // The single deep-link id filter shown as a removable chip (e.g. fileGuid, contentBlockId).
+    primaryKey: string
+    // Default (empty) value for each synced filter; also defines the filter key set and order.
+    defaultFilters: () => F
+    pagination: { sortBy: string; descending: boolean }
+}
+
+// "" and null both mean "unset": collapse to null so query params and the URL omit them.
+function blankToNull(value: string | null): string | null {
+    return value || null
+}
+
+function readString(query: LocationQuery, key: string, fallback: string | null): string | null {
+    return typeof query[key] === "string" ? (query[key] as string) : fallback
+}
+
+// A URL-synced, server-paged filter table shared by the CMS audit/history views. Filters and the
+// primary id deep-link from route.query and reflect back on change (empties omitted). When in-app
+// navigation reuses the view with a different query, the watcher re-syncs and re-fetches; its
+// equality guard skips our own syncFiltersToUrl writes so they don't trigger a redundant fetch.
+export function useUrlFilteredTable<TRow, F extends UrlFilters>(options: UrlFilteredTableOptions<F>) {
+    const route = useRoute()
+    const router = useRouter()
+
+    function readFilters(query: LocationQuery): F {
+        const defaults = options.defaultFilters()
+        const next = { ...defaults }
+        for (const key of Object.keys(defaults) as (keyof F)[]) {
+            next[key] = readString(query, key as string, defaults[key]) as F[keyof F]
+        }
+        return next
+    }
+
+    const primary = ref(readString(route.query, options.primaryKey, null)) as Ref<string | null>
+    const filters = ref(readFilters(route.query)) as Ref<F>
+
+    const table = useServerTable<TRow>({
+        url: options.url,
+        errorMessage: options.errorMessage,
+        pagination: options.pagination,
+        buildParams: (p) => {
+            const params: Record<string, string | number | null | undefined> = {
+                [options.primaryKey]: primary.value,
+            }
+            for (const [key, value] of Object.entries(filters.value)) {
+                params[key] = blankToNull(value)
+            }
+            params.page = p.page
+            params.perPage = p.rowsPerPage
+            return params
+        },
+    })
+
+    function syncFiltersToUrl() {
+        const query: LocationQueryRaw = { [options.primaryKey]: primary.value || undefined }
+        for (const [key, value] of Object.entries(filters.value)) {
+            query[key] = value || undefined
+        }
+        router.replace({ query })
+    }
+
+    function reload() {
+        syncFiltersToUrl()
+        table.reloadFirstPage()
+    }
+
+    function clearPrimaryFilter() {
+        primary.value = null
+        reload()
+    }
+
+    function filtersMatch(next: F): boolean {
+        return Object.keys(next).every((key) => next[key as keyof F] === filters.value[key as keyof F])
+    }
+
+    watch(
+        () => route.query,
+        (query) => {
+            const nextPrimary = readString(query, options.primaryKey, null)
+            const next = readFilters(query)
+            if (nextPrimary === primary.value && filtersMatch(next)) {
+                return
+            }
+            primary.value = nextPrimary
+            filters.value = next
+            table.reloadFirstPage()
+        },
+    )
+
+    return {
+        rows: table.rows,
+        loading: table.loading,
+        pagination: table.pagination,
+        onRequest: table.onRequest,
+        filters,
+        primary,
+        reload,
+        clearPrimaryFilter,
+    }
+}
diff --git a/VueApp/src/CMS/file-types.ts b/VueApp/src/CMS/file-types.ts
new file mode 100644
index 000000000..bf57998af
--- /dev/null
+++ b/VueApp/src/CMS/file-types.ts
@@ -0,0 +1,5 @@
+// File extensions the CMS accepts for upload. Shared by the file manager's upload dialog and the
+// content block's inline uploader so the allow-list stays in one place. Mirrors the backend's
+// CmsFileTypes allow-list; keep the two in sync.
+export const CMS_ACCEPTED_EXTENSIONS =
+    ".pdf,.docx,.doc,.xls,.xlsx,.csv,.ppt,.pptx,.pptm,.txt,.html,.gif,.png,.jpg,.jpeg,.tiff,.mp3,.wav,.mp4,.webm,.oft,.eps,.zip,.7z,.dmg,.exe"
diff --git a/VueApp/src/CMS/pages/BulkEncrypt.vue b/VueApp/src/CMS/pages/BulkEncrypt.vue
new file mode 100644
index 000000000..019d6020c
--- /dev/null
+++ b/VueApp/src/CMS/pages/BulkEncrypt.vue
@@ -0,0 +1,264 @@
+<template>
+    <div class="q-pa-md">
+        <BreadcrumbHeading
+            label="Bulk Encrypt"
+            parent-label="Manage Files"
+            :parent-to="{ name: 'CmsFiles' }"
+        />
+
+        <p class="text-body2 text-grey-8">
+            Lists active files that are not encrypted. Select files and encrypt them in place; downloads decrypt
+            automatically for permitted users.
+        </p>
+
+        <div class="row q-col-gutter-md q-mb-sm">
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.folder"
+                    dense
+                    options-dense
+                    outlined
+                    emit-value
+                    map-options
+                    label="VIPER app"
+                    :options="folderOptions"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-12 col-sm-4 col-lg-3">
+                <q-input
+                    v-model="filters.search"
+                    dense
+                    clearable
+                    outlined
+                    debounce="400"
+                    label="Search"
+                    @update:model-value="reload"
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+            <div class="col-auto flex items-center">
+                <q-btn
+                    color="primary"
+                    icon="lock"
+                    :label="`Encrypt Selected (${selected.length})`"
+                    dense
+                    no-caps
+                    class="q-pr-md"
+                    :disable="!selected.length"
+                    :loading="encrypting"
+                    @click="encryptSelected"
+                >
+                    <template #loading>
+                        <q-spinner
+                            size="1em"
+                            class="q-mr-sm"
+                        />
+                        Encrypting...
+                    </template>
+                </q-btn>
+            </div>
+        </div>
+
+        <q-table
+            v-model:selected="selected"
+            :rows="files"
+            :columns="columns"
+            row-key="fileGuid"
+            selection="multiple"
+            :loading="loading"
+            v-model:pagination="pagination"
+            :rows-per-page-options="[25, 50, 100, 250]"
+            :grid="$q.screen.lt.sm"
+            dense
+            flat
+            bordered
+            @request="onRequest"
+        >
+            <template #body-cell-modifiedOn="cellProps">
+                <ModifiedStamp :cell-props="cellProps" />
+            </template>
+
+            <template #item="itemProps">
+                <ListCard>
+                    <template #header>
+                        <div class="row items-center no-wrap q-gutter-x-sm">
+                            <q-checkbox
+                                v-model="itemProps.selected"
+                                :aria-label="`Select ${itemProps.row.friendlyName}`"
+                            />
+                            <span class="text-weight-medium">{{ itemProps.row.friendlyName }}</span>
+                        </div>
+                    </template>
+
+                    <ListCardField
+                        label="VIPER app"
+                        :value="itemProps.row.folder"
+                    />
+                    <ListCardField label="Modified">
+                        <ModifiedStamp :row="itemProps.row" />
+                    </ListCardField>
+                </ListCard>
+            </template>
+        </q-table>
+
+        <template v-if="results.length">
+            <h2 class="text-h6 text-primary q-mb-sm q-mt-lg">Results</h2>
+            <q-list
+                bordered
+                dense
+                separator
+            >
+                <q-item
+                    v-for="r in results"
+                    :key="r.fileGuid"
+                >
+                    <q-item-section side>
+                        <q-icon
+                            :name="r.success ? 'check_circle' : 'error'"
+                            :color="r.success ? 'positive' : 'negative'"
+                        />
+                        <span class="sr-only">{{ r.success ? "Encrypted" : "Failed" }}</span>
+                    </q-item-section>
+                    <q-item-section>
+                        <q-item-label>{{ r.friendlyName ?? r.fileGuid }}</q-item-label>
+                        <q-item-label
+                            v-if="r.message"
+                            caption
+                        >
+                            {{ r.message }}
+                        </q-item-label>
+                    </q-item-section>
+                </q-item>
+            </q-list>
+        </template>
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only; the page's data logic lives in useServerTable.
+// fallow-ignore-file complexity
+import { inject, onMounted, ref } from "vue"
+import { inflect } from "inflection"
+import { useQuasar, type QTableProps } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useServerTable } from "@/CMS/composables/use-server-table"
+import BreadcrumbHeading from "@/components/BreadcrumbHeading.vue"
+import ListCard from "@/CMS/components/ListCard.vue"
+import ListCardField from "@/CMS/components/ListCardField.vue"
+import ModifiedStamp from "@/CMS/components/ModifiedStamp.vue"
+import type { CmsFile } from "@/CMS/types/"
+
+type BulkEncryptResult = {
+    fileGuid: string
+    friendlyName: string | null
+    success: boolean
+    message: string | null
+}
+
+const apiURL = inject("apiURL") + "cms/files/"
+const $q = useQuasar()
+const { get, post } = useFetch()
+
+type FolderOption = { label: string; value: string }
+
+const ALL_FOLDERS = "All"
+
+const folderOptions = ref<FolderOption[]>([{ label: ALL_FOLDERS, value: ALL_FOLDERS }])
+const selected = ref<CmsFile[]>([])
+const results = ref<BulkEncryptResult[]>([])
+const encrypting = ref(false)
+
+const filters = ref({
+    folder: ALL_FOLDERS,
+    search: "",
+})
+
+const columns: QTableProps["columns"] = [
+    { name: "friendlyName", label: "File", field: "friendlyName", align: "left", sortable: true },
+    { name: "folder", label: "VIPER app", field: "folder", align: "left", sortable: true },
+    { name: "modifiedOn", label: "Modified", field: "modifiedOn", align: "left", sortable: true },
+]
+
+const {
+    rows: files,
+    loading,
+    pagination,
+    onRequest,
+    reloadFirstPage,
+} = useServerTable<CmsFile>({
+    url: apiURL,
+    errorMessage: "Failed to load files",
+    pagination: { sortBy: "friendlyName", descending: false },
+    buildParams: (p) => ({
+        folder: filters.value.folder !== ALL_FOLDERS ? filters.value.folder : null,
+        status: "active",
+        encrypted: "false",
+        search: filters.value.search || null,
+        page: p.page,
+        perPage: p.rowsPerPage,
+        sortBy: p.sortBy ?? "friendlyName",
+        descending: p.descending.toString(),
+    }),
+})
+
+function reload() {
+    selected.value = []
+    void reloadFirstPage()
+}
+
+async function loadFolders() {
+    // Counts match what this page lists: active, unencrypted files per VIPER app.
+    const res = await get(apiURL + "folder-counts?status=active&encrypted=false")
+    const counts: { folder: string; count: number }[] = res.success ? res.result : []
+    const total = counts.reduce((sum, c) => sum + c.count, 0)
+    folderOptions.value = [
+        { label: `${ALL_FOLDERS} (${total})`, value: ALL_FOLDERS },
+        ...counts.map((c) => ({ label: `${c.folder} (${c.count})`, value: c.folder })),
+    ]
+}
+
+async function encryptSelected() {
+    const confirmed = await new Promise<boolean>((resolve) => {
+        $q.dialog({
+            title: "Encrypt Files",
+            message: `Encrypt ${selected.value.length} ${inflect("file", selected.value.length)} in place?`,
+            cancel: { label: "Cancel", flat: true },
+            persistent: true,
+            ok: { label: "Encrypt", color: "primary", unelevated: true },
+        })
+            .onOk(() => resolve(true))
+            .onCancel(() => resolve(false))
+            .onDismiss(() => resolve(false))
+    })
+    if (!confirmed) return
+
+    encrypting.value = true
+    const res = await post(
+        apiURL + "bulk-encrypt",
+        selected.value.map((f) => f.fileGuid),
+    )
+    encrypting.value = false
+
+    if (!res.success) {
+        $q.notify({ type: "negative", message: res.errors?.[0] ?? "Bulk encrypt failed" })
+        return
+    }
+    results.value = res.result
+    const succeeded = res.result.filter((r: BulkEncryptResult) => r.success).length
+    $q.notify({
+        type: succeeded === res.result.length ? "positive" : "warning",
+        message: `${succeeded} of ${res.result.length} ${inflect("file", res.result.length)} encrypted`,
+    })
+    reload()
+    void loadFolders()
+}
+
+onMounted(() => {
+    loadFolders()
+    reload()
+})
+</script>
diff --git a/VueApp/src/CMS/pages/CmsHome.vue b/VueApp/src/CMS/pages/CmsHome.vue
index 9dd275f0e..6a3575181 100644
--- a/VueApp/src/CMS/pages/CmsHome.vue
+++ b/VueApp/src/CMS/pages/CmsHome.vue
@@ -1,5 +1,222 @@
 <template>
     <div class="q-pa-md">
-        <h1 class="text-h4 text-primary q-my-none">CMS Home</h1>
+        <h1 class="q-my-none q-mb-md">Content Management System</h1>
+
+        <StatusBanner
+            v-if="visibleSections.length === 0"
+            type="info"
+        >
+            Your account does not have access to any CMS tools. Contact the VIPER team if you need access.
+        </StatusBanner>
+
+        <StatusBanner
+            v-if="purgeSoonCount > 0"
+            type="warning"
+            class="q-mb-md"
+        >
+            {{ purgeWarningText }}
+            <router-link :to="{ name: 'CmsFiles', query: { status: 'deleted' } }">Review the Trash</router-link>
+            to restore anything still needed.
+        </StatusBanner>
+
+        <div class="row q-col-gutter-lg cms-home-grid">
+            <div class="col-12 col-lg-8">
+                <div class="cms-home-cards">
+                    <q-card
+                        v-for="section in visibleSections"
+                        :key="section.title"
+                        flat
+                        bordered
+                    >
+                        <q-card-section>
+                            <h2 class="text-h6 text-primary q-my-none">
+                                <q-icon
+                                    :name="section.icon"
+                                    size="sm"
+                                    class="q-mr-sm"
+                                />
+                                {{ section.title }}
+                            </h2>
+                            <div class="text-body2 text-grey-8 q-mt-xs">{{ section.description }}</div>
+                        </q-card-section>
+                        <q-card-actions>
+                            <q-btn
+                                v-for="action in section.actions"
+                                :key="action.label"
+                                flat
+                                dense
+                                no-caps
+                                color="primary"
+                                :label="action.label"
+                                :to="action.to"
+                            />
+                        </q-card-actions>
+                    </q-card>
+                </div>
+            </div>
+            <div
+                v-if="showRecentActivity"
+                class="col-12 col-lg-4"
+            >
+                <RecentActivity
+                    :show-blocks="canManageBlocks"
+                    :show-files="canManageFiles"
+                    :show-left-navs="canManageNav"
+                />
+            </div>
+        </div>
     </div>
 </template>
+
+<script setup lang="ts">
+import { computed, inject, ref, watch } from "vue"
+import { inflect } from "inflection"
+import { useUserStore } from "@/store/UserStore"
+import { useFetch } from "@/composables/ViperFetch"
+import StatusBanner from "@/components/StatusBanner.vue"
+import RecentActivity from "@/CMS/components/RecentActivity.vue"
+import type { CmsFile } from "@/CMS/types/"
+
+const userStore = useUserStore()
+const apiURL = inject("apiURL")
+const { get, createUrlSearchParams } = useFetch()
+
+type Action = {
+    label: string
+    to: { name: string; query?: Record<string, string> }
+    // Defaults to the section's permissions when omitted.
+    permissions?: string[]
+}
+
+type Section = {
+    title: string
+    icon: string
+    description: string
+    // Any one of these grants the section (mirrors CmsNavMenu.cs).
+    permissions: string[]
+    actions: Action[]
+}
+
+// One box per left-nav group, in the nav's order (CmsNavMenu.cs: Content Blocks, Files,
+// Left Navigation Menus), with Manage Link Collections inside Content Blocks like the nav.
+const sections: Section[] = [
+    {
+        title: "Content Blocks",
+        icon: "article",
+        description:
+            "Edit the text, images, and tagged link lists displayed on VIPER pages. Every change is kept in version history.",
+        permissions: ["SVMSecure.CMS.ManageContentBlocks", "SVMSecure.CMS.CreateContentBlock"],
+        actions: [
+            {
+                label: "Manage Content Blocks",
+                to: { name: "CmsContentBlocks" },
+                permissions: ["SVMSecure.CMS.ManageContentBlocks"],
+            },
+            { label: "Add Content Block", to: { name: "CmsContentBlockEdit" } },
+            {
+                label: "Edit History",
+                to: { name: "CmsContentBlockHistory" },
+                permissions: ["SVMSecure.CMS.ManageContentBlocks"],
+            },
+            {
+                label: "Manage Link Collections",
+                to: { name: "ManageLinkCollections" },
+                permissions: ["SVMSecure.CMS.ManageContentBlocks"],
+            },
+        ],
+    },
+    {
+        title: "Files",
+        icon: "folder",
+        description:
+            "Store files for VIPER pages and share them through permission-checked download links. Every download is logged.",
+        permissions: ["SVMSecure.CMS.AllFiles"],
+        actions: [
+            { label: "Manage Files", to: { name: "CmsFiles" } },
+            // Mirrors the nav's ManageFiles?upload=1 deep-link: opens the upload dialog on arrival.
+            { label: "Add File", to: { name: "CmsFiles", query: { upload: "1" } } },
+            { label: "Audit Trail", to: { name: "CmsFileAudit" } },
+            // Home-only extra (not in the nav): file managers see their own deleted files here;
+            // admins see the whole trash (scoped by the API). Inherits the section's AllFiles gate.
+            { label: "Trash", to: { name: "CmsFiles", query: { status: "deleted" } } },
+        ],
+    },
+    {
+        title: "Left Navigation Menus",
+        icon: "menu",
+        description: "Control the left-hand menus shown on VIPER sections and pages.",
+        permissions: ["SVMSecure.CMS.ManageNavigation"],
+        actions: [
+            { label: "Manage Left-Nav Menus", to: { name: "CmsLeftNavMenus" } },
+            // Mirrors the nav's ManageLeftNav?add=1 deep-link: opens the create dialog on arrival.
+            { label: "Add Left-Nav Menu", to: { name: "CmsLeftNavMenus", query: { add: "1" } } },
+        ],
+    },
+]
+
+const hasAny = (permissions: string[]) => permissions.some((p) => userStore.userInfo.permissions.includes(p))
+
+const visibleSections = computed(() =>
+    sections
+        .filter((s) => hasAny(s.permissions))
+        .map((s) => ({ ...s, actions: s.actions.filter((a) => hasAny(a.permissions ?? s.permissions)) })),
+)
+const canManageBlocks = computed(() => userStore.userInfo.permissions.includes("SVMSecure.CMS.ManageContentBlocks"))
+const canManageFiles = computed(() => userStore.userInfo.permissions.includes("SVMSecure.CMS.AllFiles"))
+const canManageNav = computed(() => userStore.userInfo.permissions.includes("SVMSecure.CMS.ManageNavigation"))
+const showRecentActivity = computed(() => canManageBlocks.value || canManageFiles.value || canManageNav.value)
+
+// Warn file managers when trashed files approach the purge cutoff. PurgeOn comes from the API
+// (deletedOn + retention), so the warning stays correct if the retention window ever changes.
+// One ascending page bounds the check; a trash deeper than one page still warns correctly
+// because the soonest-purging files sort first.
+const PURGE_WARNING_DAYS = 7
+const purgeSoonCount = ref(0)
+
+watch(
+    canManageFiles,
+    async (canManage) => {
+        if (!canManage) {
+            purgeSoonCount.value = 0
+            return
+        }
+        const params = createUrlSearchParams({
+            status: "deleted",
+            page: 1,
+            perPage: 50,
+            sortBy: "deletedOn",
+            descending: "false",
+        })
+        const res = await get(`${apiURL}cms/files/?${params}`)
+        if (!res.success) {
+            return
+        }
+        const cutoff = Date.now() + PURGE_WARNING_DAYS * 24 * 60 * 60 * 1000
+        purgeSoonCount.value = ((res.result ?? []) as CmsFile[]).filter(
+            (f) => f.purgeOn !== null && new Date(f.purgeOn).getTime() <= cutoff,
+        ).length
+    },
+    { immediate: true },
+)
+
+const purgeWarningText = computed(
+    () =>
+        `${purgeSoonCount.value} trashed ${inflect("file", purgeSoonCount.value)} will be permanently ` +
+        `deleted within ${PURGE_WARNING_DAYS} days.`,
+)
+</script>
+
+<style scoped>
+/* One full-width card per nav group, stacked in the nav's top-to-bottom order, with the
+   activity rail beside them; cap the width so neither stretches into low-density slabs
+   on wide monitors. */
+.cms-home-grid {
+    max-width: 80rem;
+}
+
+.cms-home-cards {
+    display: flex;
+    flex-direction: column;
+    gap: 1rem;
+}
+</style>
diff --git a/VueApp/src/CMS/pages/ContentBlockEdit.vue b/VueApp/src/CMS/pages/ContentBlockEdit.vue
new file mode 100644
index 000000000..51887a04c
--- /dev/null
+++ b/VueApp/src/CMS/pages/ContentBlockEdit.vue
@@ -0,0 +1,720 @@
+<template>
+    <div class="q-pa-md">
+        <BreadcrumbHeading
+            :label="isNew ? 'Add Content Block' : 'Edit Content Block'"
+            parent-label="Manage Content Blocks"
+            :parent-to="{ name: 'CmsContentBlocks' }"
+        />
+
+        <StatusBanner
+            v-if="block.deletedOn"
+            type="warning"
+            class="q-mb-md"
+        >
+            This content block is marked as deleted. Restore it to make it available again.
+            <template #action>
+                <q-btn
+                    flat
+                    dense
+                    no-caps
+                    color="primary"
+                    label="Restore"
+                    @click="restoreBlock"
+                />
+            </template>
+        </StatusBanner>
+
+        <q-form
+            ref="formRef"
+            greedy
+            @submit.prevent="saveBlock"
+            @validation-error="onValidationError"
+        >
+            <div class="row q-col-gutter-lg">
+                <div class="col-12">
+                    <q-input
+                        v-model="block.title"
+                        dense
+                        outlined
+                        label="Title"
+                        class="q-mb-sm required-field"
+                        :rules="[(v: string | null) => (v && v.trim().length > 0) || 'Title is required']"
+                        aria-required="true"
+                        hide-bottom-space
+                    />
+
+                    <div
+                        id="content-editor-label"
+                        class="text-subtitle2 q-mb-xs"
+                    >
+                        Content
+                    </div>
+                    <q-editor
+                        ref="contentEditorRef"
+                        v-model="block.content"
+                        dense
+                        class="content-editor"
+                        min-height="20rem"
+                        :toolbar="editorToolbar"
+                        :definitions="{}"
+                    />
+
+                    <div
+                        v-if="!isNew && history.length"
+                        class="q-mt-md row items-center q-col-gutter-sm"
+                    >
+                        <div class="col-auto text-subtitle2">Version history:</div>
+                        <div class="col-12 col-sm-5 col-md-4">
+                            <q-select
+                                v-model="selectedHistory"
+                                dense
+                                options-dense
+                                outlined
+                                clearable
+                                label="Select a previous version"
+                                :options="history"
+                                :option-label="historyLabel"
+                            />
+                        </div>
+                        <div class="col-auto">
+                            <q-btn
+                                dense
+                                flat
+                                no-caps
+                                size="sm"
+                                color="secondary"
+                                icon="compare_arrows"
+                                label="Diff vs current"
+                                :disable="!selectedHistory"
+                                @click="diffAgainstCurrent"
+                            />
+                        </div>
+                        <div class="col-auto">
+                            <q-btn
+                                dense
+                                flat
+                                no-caps
+                                size="sm"
+                                color="primary"
+                                icon="history"
+                                label="Load into editor"
+                                :disable="!selectedHistory"
+                                @click="loadHistoryVersion"
+                            />
+                        </div>
+                        <div
+                            v-if="viewingVersion"
+                            class="col-auto"
+                        >
+                            <q-chip
+                                dense
+                                square
+                                class="bg-warning text-dark"
+                            >
+                                Viewing an old version, save to restore it
+                            </q-chip>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="col-12">
+                    <q-card
+                        flat
+                        bordered
+                        class="q-mb-md"
+                    >
+                        <q-card-section class="q-gutter-y-sm">
+                            <h2 class="text-h6 q-my-none">Settings</h2>
+
+                            <q-select
+                                v-model="block.system"
+                                dense
+                                options-dense
+                                outlined
+                                label="System"
+                                class="required-field"
+                                :options="['Viper', 'Public']"
+                                :rules="[(v: string | null) => !!v || 'System is required']"
+                                aria-required="true"
+                                hide-bottom-space
+                                @update:model-value="onSystemChange"
+                            />
+
+                            <q-select
+                                v-if="isNew"
+                                v-model="block.viperSectionPath"
+                                dense
+                                options-dense
+                                outlined
+                                label="VIPER section path"
+                                class="required-field"
+                                :options="folders"
+                                :rules="[(v: string | null) => !!v || 'A VIPER section path is required']"
+                                aria-required="true"
+                                hint="The VIPER app folder this block's files are stored in; it can't be changed later."
+                            />
+                            <q-input
+                                v-else
+                                :model-value="block.viperSectionPath"
+                                dense
+                                outlined
+                                readonly
+                                label="VIPER section path"
+                            >
+                                <template #append>
+                                    <q-icon
+                                        name="help"
+                                        size="xs"
+                                        tabindex="0"
+                                        role="img"
+                                        aria-label="The section path can't be edited after the block is created"
+                                    >
+                                        <q-tooltip>
+                                            The section path can't be edited after the block is created.
+                                        </q-tooltip>
+                                    </q-icon>
+                                </template>
+                            </q-input>
+
+                            <q-input
+                                v-model="block.page"
+                                dense
+                                outlined
+                                label="Page"
+                            />
+
+                            <q-input
+                                v-model.number="block.blockOrder"
+                                dense
+                                outlined
+                                type="number"
+                                label="Block order"
+                            />
+
+                            <q-input
+                                v-model="block.friendlyName"
+                                dense
+                                outlined
+                                label="Friendly name"
+                                hint="Used for URL-friendly access; must be unique"
+                            />
+
+                            <q-toggle
+                                v-model="block.allowPublicAccess"
+                                label="Public access"
+                                @update:model-value="autoEnabledPublicAccess = false"
+                            />
+
+                            <StatusBanner
+                                v-if="autoEnabledPublicAccess"
+                                type="info"
+                                live="assertive"
+                            >
+                                Public system content is visible to everyone, so we turned on Public access. Switch it
+                                off if this block should stay restricted.
+                            </StatusBanner>
+                        </q-card-section>
+                    </q-card>
+
+                    <q-card
+                        flat
+                        bordered
+                        class="q-mb-md"
+                    >
+                        <q-card-section>
+                            <h2 class="text-h6 q-my-none q-mb-sm">Permissions</h2>
+                            <PermissionSelector v-model="block.permissions" />
+                        </q-card-section>
+                    </q-card>
+
+                    <q-card
+                        v-if="canAccessFiles || block.files.length > 0"
+                        flat
+                        bordered
+                    >
+                        <q-card-section>
+                            <h2 class="text-h6 q-my-none q-mb-sm">Attached Files</h2>
+                            <div
+                                v-for="file in block.files"
+                                :key="file.fileGuid"
+                                class="row items-center q-mb-xs"
+                            >
+                                <a
+                                    :href="file.url"
+                                    target="_blank"
+                                    rel="noopener"
+                                    class="col ellipsis"
+                                >
+                                    {{ file.friendlyName }}
+                                    <span class="sr-only">(opens in new window)</span>
+                                </a>
+                                <q-btn
+                                    v-if="canAccessFiles"
+                                    dense
+                                    flat
+                                    size="sm"
+                                    icon="close"
+                                    color="negative"
+                                    aria-label="Detach file"
+                                    @click="detachFile(file)"
+                                >
+                                    <q-tooltip>Detach</q-tooltip>
+                                </q-btn>
+                            </div>
+                            <q-select
+                                v-if="canAccessFiles"
+                                v-model="fileToAttach"
+                                dense
+                                options-dense
+                                outlined
+                                use-input
+                                input-debounce="300"
+                                label="Attach a file"
+                                hint="Search managed files by name"
+                                :options="fileOptions"
+                                option-label="friendlyName"
+                                :loading="searchingFiles"
+                                @filter="searchFiles"
+                                @update:model-value="attachFile"
+                            />
+                            <InlineFileUpload
+                                v-if="canAccessFiles"
+                                ref="inlineUploadRef"
+                                class="q-mt-sm"
+                                :folder="block.viperSectionPath"
+                                :permissions="block.permissions"
+                                :allow-public-access="block.allowPublicAccess"
+                                @staged-count="stagedCount = $event"
+                            />
+                        </q-card-section>
+                    </q-card>
+                </div>
+            </div>
+
+            <StatusBanner
+                v-if="formError"
+                type="error"
+                class="q-mt-md"
+            >
+                {{ formError }}
+            </StatusBanner>
+
+            <div class="q-mt-md">
+                <q-btn
+                    type="submit"
+                    color="primary"
+                    :label="isNew ? 'Create' : 'Save'"
+                    dense
+                    no-caps
+                    :loading="saving"
+                >
+                    <template #loading>
+                        <q-spinner
+                            size="1em"
+                            class="q-mr-sm"
+                        />
+                        {{ isNew ? "Create" : "Save" }}
+                    </template>
+                </q-btn>
+                <q-btn
+                    flat
+                    label="Cancel"
+                    dense
+                    no-caps
+                    class="q-ml-sm"
+                    :to="{ name: 'CmsContentBlocks' }"
+                />
+            </div>
+        </q-form>
+
+        <ContentDiffDialog
+            v-model="diffViewer.open"
+            :loading="diffViewer.loading"
+            :title="diffViewer.title"
+            :subtitle="diffViewer.subtitle"
+            :diff-html="diffViewer.content"
+            :has-changes="diffViewer.hasChanges"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only; saveBlock is split into small helpers below.
+// fallow-ignore-file complexity
+import { computed, inject, onMounted, ref } from "vue"
+import { useRoute, useRouter, onBeforeRouteLeave } from "vue-router"
+import { useQuasar } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useUnsavedChanges } from "@/composables/use-unsaved-changes"
+import { useContentDiffViewer } from "@/CMS/composables/use-content-diff-viewer"
+import { checkHasOnePermission } from "@/composables/CheckPagePermission"
+import BreadcrumbHeading from "@/components/BreadcrumbHeading.vue"
+import PermissionSelector from "@/CMS/components/PermissionSelector.vue"
+import InlineFileUpload from "@/CMS/components/InlineFileUpload.vue"
+import StatusBanner from "@/components/StatusBanner.vue"
+import ContentDiffDialog from "@/CMS/components/ContentDiffDialog.vue"
+import type {
+    CmsContentBlock,
+    CmsContentBlockFile,
+    CmsContentHistoryDiff,
+    CmsContentHistoryItem,
+    CmsFile,
+} from "@/CMS/types/"
+
+const apiURL = inject("apiURL") + "CMS/content"
+const filesApiURL = inject("apiURL") + "cms/files/"
+const route = useRoute()
+const router = useRouter()
+const $q = useQuasar()
+const { get, post, put, del, createUrlSearchParams } = useFetch()
+
+// This route also admits CreateContentBlock-only users. The folder list (for the section path)
+// is served by a content-scoped endpoint they can reach; the file catalog (attach/upload) still
+// requires AllFiles, so gate only those.
+const canAccessFiles = checkHasOnePermission(["SVMSecure.CMS.AllFiles"])
+
+const blockId = computed(() => (route.params.id ? Number(route.params.id) : null))
+const isNew = computed(() => blockId.value === null)
+
+const formRef = ref()
+const contentEditorRef = ref()
+const saving = ref(false)
+const formError = ref("")
+
+const emptyBlock = (): CmsContentBlock => ({
+    contentBlockId: 0,
+    content: "",
+    title: null,
+    system: "Viper",
+    application: null,
+    page: null,
+    viperSectionPath: null,
+    blockOrder: 0,
+    friendlyName: null,
+    allowPublicAccess: false,
+    modifiedOn: "",
+    modifiedBy: "",
+    deletedOn: null,
+    permissions: [],
+    files: [],
+})
+
+const block = ref<CmsContentBlock>(emptyBlock())
+
+// Files chosen in the inline uploader are staged client-side and only uploaded on Save. Fold their
+// count into the dirty state so staging alone trips the unsaved-changes guard.
+const inlineUploadRef = ref<{
+    commit: () => Promise<{ attached: CmsFile[]; createdGuids: string[] }>
+} | null>(null)
+const stagedCount = ref(0)
+const dirtyState = computed(() => ({ block: block.value, staged: stagedCount.value }))
+
+const { setInitialState, resetDirtyState, confirmClose } = useUnsavedChanges(dirtyState)
+
+// Prompt before leaving with unsaved edits, matching the Effort forms' guard.
+onBeforeRouteLeave(async () => await confirmClose())
+
+const folders = ref<string[]>([])
+const history = ref<CmsContentHistoryItem[]>([])
+const selectedHistory = ref<CmsContentHistoryItem | null>(null)
+const viewingVersion = ref(false)
+const autoEnabledPublicAccess = ref(false)
+
+const fileToAttach = ref<CmsFile | null>(null)
+const fileOptions = ref<CmsFile[]>([])
+const searchingFiles = ref(false)
+
+const editorToolbar = [
+    ["bold", "italic", "underline", "strike"],
+    [{ icon: "format_size", options: ["p", "h2", "h3", "h4", "h5"] }],
+    ["unordered", "ordered", "outdent", "indent"],
+    ["link", "hr", "quote"],
+    ["removeFormat"],
+    ["undo", "redo"],
+]
+
+async function loadBlock() {
+    if (blockId.value === null) return
+    const res = await get(apiURL + "/" + blockId.value)
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Content block not found" })
+        void router.push({ name: "CmsContentBlocks" })
+        return
+    }
+    block.value = res.result
+    autoEnabledPublicAccess.value = false
+    setInitialState()
+    await loadHistory()
+}
+
+async function loadHistory() {
+    if (blockId.value === null) return
+    const res = await get(apiURL + "/" + blockId.value + "/history")
+    history.value = res.success ? res.result : []
+}
+
+// The section path IS a file folder (legacy parity): a block can only point at a real upload
+// folder, so its files always land somewhere valid. Sourced from a content-scoped endpoint so
+// create-only users (who lack AllFiles) can still populate it.
+async function loadFolders() {
+    const res = await get(apiURL + "/folders")
+    folders.value = res.success ? res.result : []
+}
+
+function historyLabel(h: CmsContentHistoryItem): string {
+    const when = h.modifiedOn ? new Date(h.modifiedOn).toLocaleString() : "unknown date"
+    return `${when} (${h.modifiedBy ?? "unknown"})`
+}
+
+async function loadHistoryVersion() {
+    if (!selectedHistory.value) {
+        viewingVersion.value = false
+        return
+    }
+    const res = await get(apiURL + "/" + blockId.value + "/history/" + selectedHistory.value.contentHistoryId)
+    if (res.success) {
+        block.value.content = res.result.content
+        viewingVersion.value = true
+        $q.notify({
+            type: "info",
+            message: "Loaded an older version into the editor. Save to make it the current version.",
+        })
+    }
+}
+
+const { viewer: diffViewer, openViewer: openDiffViewer, applyDiff, failViewer } = useContentDiffViewer()
+
+// Compare the editor's current content (the "new" side) against the selected historical version
+// (the "old" side). The current content is posted because it may include unsaved edits.
+async function diffAgainstCurrent() {
+    if (!selectedHistory.value) return
+    openDiffViewer("Current editor content vs previous version")
+    const res = await post(
+        apiURL + "/" + blockId.value + "/history/" + selectedHistory.value.contentHistoryId + "/diff",
+        { content: block.value.content },
+    )
+    if (res.success) {
+        applyDiff(
+            res.result as CmsContentHistoryDiff,
+            `Changes from ${historyLabel(selectedHistory.value)} to your current editor content`,
+        )
+    } else {
+        failViewer(res.errors?.[0] ?? "Failed to build the diff")
+    }
+}
+
+async function searchFiles(val: string, update: (fn: () => void) => void) {
+    if (val.trim().length < 2) {
+        update(() => {
+            fileOptions.value = []
+        })
+        return
+    }
+    searchingFiles.value = true
+    const params = createUrlSearchParams({ search: val.trim(), status: "active", perPage: 15 })
+    const res = await get(filesApiURL + "?" + params)
+    searchingFiles.value = false
+    update(() => {
+        const attachedGuids = new Set(block.value.files.map((f) => f.fileGuid))
+        fileOptions.value = res.success ? res.result.filter((f: CmsFile) => !attachedGuids.has(f.fileGuid)) : []
+    })
+}
+
+function attachFile() {
+    if (!fileToAttach.value) return
+    block.value.files.push({
+        fileGuid: fileToAttach.value.fileGuid,
+        friendlyName: fileToAttach.value.friendlyName,
+        url: fileToAttach.value.friendlyUrl,
+    })
+    fileToAttach.value = null
+}
+
+// Add a file that was just committed (uploaded/overwritten/reused) by the inline uploader to the
+// block's attachment list, de-duping by GUID.
+function attachUploadedFile(file: CmsFile) {
+    if (block.value.files.some((f) => f.fileGuid === file.fileGuid)) return
+    block.value.files.push({
+        fileGuid: file.fileGuid,
+        friendlyName: file.friendlyName,
+        url: file.friendlyUrl,
+    })
+}
+
+function detachFile(file: CmsContentBlockFile) {
+    block.value.files = block.value.files.filter((f) => f.fileGuid !== file.fileGuid)
+}
+
+// "Public" system content is publicly visible by convention, but AllowPublicAccess is the only
+// field that actually gates unauthenticated access. Enable it for the user and tell them, so the
+// two stay in sync without silently exposing a block they meant to keep restricted.
+function onSystemChange(value: string | null) {
+    if (value === "Public" && !block.value.allowPublicAccess) {
+        block.value.allowPublicAccess = true
+        autoEnabledPublicAccess.value = true
+    } else {
+        autoEnabledPublicAccess.value = false
+    }
+}
+
+// Fires when the form's submit-time validation fails. The q-form focuses the first invalid
+// field; this surfaces a matching message next to the Create button so the failure is obvious
+// without scrolling back up to the field.
+function onValidationError() {
+    formError.value = isNew.value
+        ? "Please complete the required fields before creating this content block."
+        : "Please complete the required fields before saving your changes."
+}
+
+// Roll back files freshly created during a Save that then failed, so a failed save leaves nothing
+// attached. The files go to the trash (soft-delete); the trash-purge job clears them later, and
+// they're recoverable meanwhile. Overwritten or reused existing files are never in this list - see
+// InlineFileUpload.commit.
+async function rollbackFiles(createdGuids: string[]) {
+    if (createdGuids.length === 0) return
+    for (const guid of createdGuids) {
+        await del(filesApiURL + guid)
+    }
+    const removed = new Set(createdGuids)
+    block.value.files = block.value.files.filter((f) => !removed.has(f.fileGuid))
+}
+
+// Commit any staged inline uploads first (this is when they're actually created on the server),
+// then attach them so they're included in fileGuids. Returns the freshly-created GUIDs so a failed
+// block save can roll them back; throws if an upload fails so the caller aborts the save.
+async function commitStagedUploads(): Promise<string[]> {
+    if (!inlineUploadRef.value) return []
+    const { attached, createdGuids } = await inlineUploadRef.value.commit()
+    attached.forEach(attachUploadedFile)
+    return createdGuids
+}
+
+function buildSavePayload() {
+    return {
+        contentBlockId: block.value.contentBlockId,
+        content: block.value.content,
+        title: block.value.title,
+        system: block.value.system,
+        application: block.value.application,
+        page: block.value.page,
+        viperSectionPath: block.value.viperSectionPath,
+        blockOrder: block.value.blockOrder,
+        friendlyName: block.value.friendlyName || null,
+        allowPublicAccess: block.value.allowPublicAccess,
+        permissions: block.value.permissions,
+        fileGuids: block.value.files.map((f) => f.fileGuid),
+        lastModifiedOn: isNew.value ? null : block.value.modifiedOn,
+    }
+}
+
+// A 409 means someone else saved first; roll back our new files and offer to reload their version.
+async function handleSaveConflict(res: { errors: string[] | null }, rollbackGuids: string[]) {
+    await rollbackFiles(rollbackGuids)
+    $q.dialog({
+        title: "Edit Conflict",
+        message:
+            (res.errors?.[0] ?? "This content block was changed by someone else.") +
+            " Reload the latest version? Your unsaved changes will be lost.",
+        cancel: { label: "Keep editing", flat: true },
+        persistent: true,
+        ok: { label: "Reload", color: "primary", unelevated: true },
+    }).onOk(() => {
+        void loadBlock()
+        viewingVersion.value = false
+        selectedHistory.value = null
+    })
+}
+
+async function applySaveSuccess(res: { result: CmsContentBlock }) {
+    $q.notify({ type: "positive", message: isNew.value ? "Content block created" : "Content block saved" })
+    viewingVersion.value = false
+    selectedHistory.value = null
+    autoEnabledPublicAccess.value = false
+    if (isNew.value) {
+        void router.push({ name: "CmsContentBlockEdit", params: { id: res.result.contentBlockId } })
+    }
+    block.value = res.result
+    resetDirtyState()
+    await loadHistory()
+}
+
+async function saveBlock() {
+    formError.value = ""
+    saving.value = true
+
+    let rollbackGuids: string[]
+    try {
+        rollbackGuids = await commitStagedUploads()
+    } catch (e) {
+        saving.value = false
+        formError.value = e instanceof Error ? e.message : "Failed to upload one or more files."
+        return
+    }
+
+    const payload = buildSavePayload()
+    const res = isNew.value
+        ? await post(apiURL, payload)
+        : await put(apiURL + "/" + block.value.contentBlockId, payload)
+    saving.value = false
+
+    if (res.status === 409) {
+        await handleSaveConflict(res, rollbackGuids)
+        return
+    }
+    if (!res.success) {
+        await rollbackFiles(rollbackGuids)
+        formError.value = res.errors?.[0] ?? "Failed to save content block"
+        return
+    }
+    await applySaveSuccess(res)
+}
+
+async function restoreBlock() {
+    const res = await post(apiURL + "/" + block.value.contentBlockId + "/restore")
+    if (res.success) {
+        $q.notify({ type: "positive", message: "Content block restored" })
+        await loadBlock()
+    }
+}
+
+onMounted(() => {
+    // QEditor renders the focusable contenteditable as an inner element, so its accessible
+    // name has to be set there rather than on the wrapper the "Content" label sits beside.
+    contentEditorRef.value?.getContentEl()?.setAttribute("aria-labelledby", "content-editor-label")
+    // Only the create form offers the (editable) section-path select; on edit it's read-only.
+    if (isNew.value) loadFolders()
+    loadBlock()
+    // loadBlock sets the baseline for an existing block after it loads; a brand-new form's
+    // baseline is just the empty block, so capture it synchronously here.
+    if (isNew.value) {
+        setInitialState()
+    }
+})
+</script>
+
+<style scoped>
+.required-field :deep(.q-field__label)::after {
+    content: " *";
+    color: var(--q-negative);
+}
+
+/* Let the editor toolbar wrap onto multiple rows on narrow screens instead of
+   scrolling horizontally; `dense` keeps each button group intact so groups wrap
+   as whole units rather than splitting mid-group. */
+.content-editor :deep(.q-editor__toolbar) {
+    flex-wrap: wrap;
+}
+
+/* On phones, trim the inter-button and inter-group gaps so the toolbar packs
+   into two rows instead of three. Only the gaps shrink - the buttons keep their
+   size, so touch targets are unchanged. */
+@media (width <= 599.98px) {
+    .content-editor :deep(.q-editor__toolbar-group) {
+        margin: 0 2px;
+    }
+
+    .content-editor :deep(.q-editor__toolbar .q-btn) {
+        margin: 2px;
+    }
+}
+</style>
diff --git a/VueApp/src/CMS/pages/ContentBlockHistory.vue b/VueApp/src/CMS/pages/ContentBlockHistory.vue
new file mode 100644
index 000000000..c08ea754f
--- /dev/null
+++ b/VueApp/src/CMS/pages/ContentBlockHistory.vue
@@ -0,0 +1,263 @@
+<template>
+    <div class="q-pa-md">
+        <BreadcrumbHeading
+            label="Edit History"
+            parent-label="Manage Content Blocks"
+            :parent-to="{ name: 'CmsContentBlocks' }"
+        />
+
+        <p class="text-body2 text-grey-8 q-mb-md">
+            Every saved edit keeps the version it replaced. This lists those past versions across all content blocks.
+            The current version of each block is on its edit page.
+        </p>
+
+        <div class="row q-col-gutter-md q-mb-sm">
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-input
+                    v-model="filters.modifiedBy"
+                    dense
+                    outlined
+                    clearable
+                    debounce="400"
+                    label="Modified By"
+                    @update:model-value="reload"
+                />
+            </div>
+            <DateRangeFilter
+                v-model:from="filters.from"
+                v-model:to="filters.to"
+                @change="reload"
+            />
+            <div class="col-12 col-sm-4 col-lg-3">
+                <q-input
+                    v-model="filters.search"
+                    dense
+                    outlined
+                    clearable
+                    debounce="400"
+                    label="Search block title or page"
+                    @update:model-value="reload"
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+        </div>
+
+        <div
+            v-if="contentBlockId"
+            class="q-mb-sm"
+        >
+            <q-chip
+                removable
+                dense
+                color="primary"
+                text-color="white"
+                @remove="clearBlockFilter"
+            >
+                Filtered to one block: {{ contentBlockId }}
+            </q-chip>
+        </div>
+
+        <q-table
+            :rows="entries"
+            :columns="columns"
+            row-key="contentHistoryId"
+            :loading="loading"
+            v-model:pagination="pagination"
+            :rows-per-page-options="[25, 50, 100, 250]"
+            :grid="$q.screen.lt.sm"
+            dense
+            flat
+            bordered
+            @request="onRequest"
+        >
+            <template #body-cell-modifiedOn="cellProps">
+                <q-td :props="cellProps">
+                    {{
+                        cellProps.row.modifiedOn
+                            ? formatDateTime(cellProps.row.modifiedOn, { dateStyle: "short", timeStyle: "short" })
+                            : ""
+                    }}
+                </q-td>
+            </template>
+            <template #body-cell-block="cellProps">
+                <q-td :props="cellProps">
+                    <router-link :to="{ name: 'CmsContentBlockEdit', params: { id: cellProps.row.contentBlockId } }">
+                        {{ blockLabel(cellProps.row) }}
+                    </router-link>
+                    <StatusBadge
+                        v-if="cellProps.row.blockDeleted"
+                        color="negative"
+                        class="q-ml-sm"
+                        label="deleted"
+                    />
+                    <div
+                        v-if="cellProps.row.page"
+                        class="text-caption text-grey-7"
+                    >
+                        {{ cellProps.row.page }}
+                    </div>
+                </q-td>
+            </template>
+            <template #body-cell-actions="cellProps">
+                <q-td :props="cellProps">
+                    <q-btn
+                        dense
+                        flat
+                        no-caps
+                        size="sm"
+                        color="secondary"
+                        icon="compare_arrows"
+                        class="diff-action-btn"
+                        aria-label="Diff with previous version"
+                        @click="viewDiff(cellProps.row)"
+                    >
+                        <q-tooltip>Diff with previous version</q-tooltip>
+                    </q-btn>
+                </q-td>
+            </template>
+
+            <template #item="{ row }">
+                <ListCard>
+                    <template #header>
+                        <div class="row items-center no-wrap q-gutter-x-xs">
+                            <router-link
+                                class="text-weight-medium"
+                                :to="{ name: 'CmsContentBlockEdit', params: { id: row.contentBlockId } }"
+                            >
+                                {{ blockLabel(row) }}
+                            </router-link>
+                            <StatusBadge
+                                v-if="row.blockDeleted"
+                                color="negative"
+                                label="deleted"
+                            />
+                        </div>
+                        <div
+                            v-if="row.page"
+                            class="text-caption text-grey-7"
+                        >
+                            {{ row.page }}
+                        </div>
+                    </template>
+
+                    <ListCardField label="Date">
+                        {{
+                            row.modifiedOn
+                                ? formatDateTime(row.modifiedOn, { dateStyle: "short", timeStyle: "short" })
+                                : ""
+                        }}
+                    </ListCardField>
+                    <ListCardField
+                        label="Modified By"
+                        :value="row.modifiedBy"
+                    />
+
+                    <template #actions>
+                        <q-btn
+                            dense
+                            flat
+                            no-caps
+                            size="sm"
+                            color="secondary"
+                            icon="compare_arrows"
+                            label="Diff"
+                            class="diff-action-btn"
+                            aria-label="Diff with previous version"
+                            @click="viewDiff(row)"
+                        />
+                    </template>
+                </ListCard>
+            </template>
+        </q-table>
+
+        <ContentDiffDialog
+            v-model="viewer.open"
+            :loading="viewer.loading"
+            :title="viewer.title"
+            :subtitle="viewer.subtitle"
+            :diff-html="viewer.content"
+            :has-comparison="viewer.hasComparison"
+            :has-changes="viewer.hasChanges"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import { inject, onMounted } from "vue"
+import { useQuasar, type QTableProps } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useDateFunctions } from "@/composables/DateFunctions"
+import { useContentDiffViewer } from "@/CMS/composables/use-content-diff-viewer"
+import { useUrlFilteredTable } from "@/CMS/composables/use-url-filtered-table"
+import BreadcrumbHeading from "@/components/BreadcrumbHeading.vue"
+import StatusBadge from "@/components/StatusBadge.vue"
+import DateRangeFilter from "@/CMS/components/DateRangeFilter.vue"
+import ContentDiffDialog from "@/CMS/components/ContentDiffDialog.vue"
+import ListCard from "@/CMS/components/ListCard.vue"
+import ListCardField from "@/CMS/components/ListCardField.vue"
+import type { CmsContentHistoryAudit, CmsContentHistoryDiff } from "@/CMS/types/"
+
+const apiBase = inject("apiURL")
+const $q = useQuasar()
+const { get } = useFetch()
+const { formatDateTime } = useDateFunctions()
+
+const columns: QTableProps["columns"] = [
+    { name: "modifiedOn", label: "Date", field: "modifiedOn", align: "left" },
+    { name: "modifiedBy", label: "Modified By", field: "modifiedBy", align: "left" },
+    { name: "block", label: "Block", field: "title", align: "left" },
+    { name: "actions", label: "Actions", field: "contentHistoryId", align: "center" },
+]
+
+function blockLabel(row: CmsContentHistoryAudit): string {
+    return row.title || row.friendlyName || "(untitled)"
+}
+
+// Filters + the per-block deep-link (?contentBlockId) sync to the URL and drive the server-paged
+// fetch; see useUrlFilteredTable.
+const {
+    rows: entries,
+    loading,
+    pagination,
+    onRequest,
+    filters,
+    primary: contentBlockId,
+    reload,
+    clearPrimaryFilter: clearBlockFilter,
+} = useUrlFilteredTable<CmsContentHistoryAudit, { modifiedBy: string; from: string; to: string; search: string }>({
+    url: apiBase + "CMS/content/history",
+    errorMessage: "Failed to load edit history",
+    primaryKey: "contentBlockId",
+    defaultFilters: () => ({ modifiedBy: "", from: "", to: "", search: "" }),
+    pagination: { sortBy: "modifiedOn", descending: true },
+})
+
+const { viewer, openViewer, applyDiff, failViewer, savedDiffSubtitle } = useContentDiffViewer()
+
+async function viewDiff(row: CmsContentHistoryAudit) {
+    openViewer(blockLabel(row))
+    const res = await get(apiBase + "CMS/content/" + row.contentBlockId + "/history/" + row.contentHistoryId + "/diff")
+    if (res.success) {
+        const diff = res.result as CmsContentHistoryDiff
+        applyDiff(diff, savedDiffSubtitle(diff))
+    } else {
+        failViewer(res.errors?.[0] ?? "Failed to load this version")
+    }
+}
+
+onMounted(reload)
+</script>
+
+<style scoped>
+/* The diff action is icon-only and its tooltip label is unavailable on touch, so give it a
+   44px touch target on coarse pointers. Mouse/trackpad keep the dense table-action size. */
+@media (pointer: coarse) {
+    .diff-action-btn {
+        min-width: 44px;
+        min-height: 44px;
+    }
+}
+</style>
diff --git a/VueApp/src/CMS/pages/ContentBlocks.vue b/VueApp/src/CMS/pages/ContentBlocks.vue
new file mode 100644
index 000000000..a823d4ef0
--- /dev/null
+++ b/VueApp/src/CMS/pages/ContentBlocks.vue
@@ -0,0 +1,362 @@
+<template>
+    <div class="q-pa-md">
+        <div class="row items-center q-mb-md list-page-header">
+            <h1 class="q-my-none">Manage Content Blocks</h1>
+            <q-space />
+            <q-btn
+                color="positive"
+                icon="add"
+                label="Add Content Block"
+                no-caps
+                dense
+                :to="{ name: 'CmsContentBlockEdit' }"
+            />
+        </div>
+
+        <div class="row q-col-gutter-md q-mb-sm">
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.status"
+                    dense
+                    options-dense
+                    outlined
+                    emit-value
+                    map-options
+                    label="Status"
+                    :options="statusOptions"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.viperSectionPath"
+                    dense
+                    options-dense
+                    outlined
+                    clearable
+                    label="VIPER section"
+                    :options="sectionPaths"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-12 col-sm-3 col-lg-3">
+                <q-input
+                    v-model="filters.search"
+                    dense
+                    clearable
+                    outlined
+                    debounce="400"
+                    label="Search title, name, page, or content"
+                    @update:model-value="reload"
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+            <div class="col-auto flex items-center">
+                <q-toggle
+                    v-model="filters.publicOnly"
+                    dense
+                    label="Public only"
+                    @update:model-value="reload"
+                />
+            </div>
+        </div>
+
+        <!-- Server-paged like Files: rows come back one page at a time, so no "All" (0) option.
+             Card mode at lt.sm matches Files (both have six columns), not the old lt.md. -->
+        <q-table
+            :rows="blocks"
+            :columns="columns"
+            row-key="contentBlockId"
+            :loading="loading"
+            v-model:pagination="pagination"
+            :rows-per-page-options="[25, 50, 100, 250]"
+            :grid="$q.screen.lt.sm"
+            dense
+            flat
+            bordered
+            @request="onRequest"
+        >
+            <template #body-cell-title="cellProps">
+                <q-td :props="cellProps">
+                    <div class="row items-center no-wrap q-gutter-x-xs">
+                        <router-link
+                            :to="{ name: 'CmsContentBlockEdit', params: { id: cellProps.row.contentBlockId } }"
+                        >
+                            {{ cellProps.row.title || "(untitled)" }}
+                        </router-link>
+                        <StatusIcon
+                            v-if="cellProps.row.allowPublicAccess"
+                            icon="public"
+                            color="positive"
+                            label="Public access"
+                        />
+                        <StatusIcon
+                            v-if="cellProps.row.deletedOn"
+                            icon="delete_outline"
+                            color="negative"
+                            label="Deleted"
+                        />
+                    </div>
+                    <div class="text-caption text-grey-7">{{ cellProps.row.friendlyName }}</div>
+                </q-td>
+            </template>
+
+            <template #body-cell-permissions="cellProps">
+                <q-td :props="cellProps">
+                    <PermissionChips
+                        :permissions="cellProps.row.permissions"
+                        stacked
+                    />
+                </q-td>
+            </template>
+
+            <template #body-cell-modifiedOn="cellProps">
+                <ModifiedStamp :cell-props="cellProps" />
+            </template>
+
+            <template #body-cell-actions="cellProps">
+                <q-td :props="cellProps">
+                    <EditButton
+                        entity-name="content block"
+                        :to="{ name: 'CmsContentBlockEdit', params: { id: cellProps.row.contentBlockId } }"
+                    />
+                    <DeleteRestoreButtons
+                        :deleted="!!cellProps.row.deletedOn"
+                        entity-name="content block"
+                        @delete="deleteBlock(cellProps.row)"
+                        @restore="restoreBlock(cellProps.row)"
+                    />
+                </q-td>
+            </template>
+
+            <template #item="{ row }">
+                <ListCard>
+                    <template #header>
+                        <div class="row items-center no-wrap q-gutter-x-xs">
+                            <router-link
+                                class="text-weight-medium"
+                                :to="{ name: 'CmsContentBlockEdit', params: { id: row.contentBlockId } }"
+                            >
+                                {{ row.title || "(untitled)" }}
+                            </router-link>
+                            <StatusIcon
+                                v-if="row.allowPublicAccess"
+                                icon="public"
+                                color="positive"
+                                label="Public access"
+                            />
+                            <StatusIcon
+                                v-if="row.deletedOn"
+                                icon="delete_outline"
+                                color="negative"
+                                label="Deleted"
+                            />
+                        </div>
+                        <div
+                            v-if="row.friendlyName"
+                            class="text-caption text-grey-7"
+                        >
+                            {{ row.friendlyName }}
+                        </div>
+                    </template>
+
+                    <ListCardField
+                        v-if="row.viperSectionPath"
+                        label="VIPER section"
+                        :value="row.viperSectionPath"
+                    />
+                    <ListCardField
+                        v-if="row.page"
+                        label="Page"
+                        :value="row.page"
+                    />
+                    <ListCardField label="Access">
+                        <PermissionChips :permissions="row.permissions" />
+                    </ListCardField>
+                    <ListCardField label="Modified">
+                        <ModifiedStamp :row="row" />
+                    </ListCardField>
+
+                    <template #actions>
+                        <EditButton
+                            entity-name="content block"
+                            :to="{ name: 'CmsContentBlockEdit', params: { id: row.contentBlockId } }"
+                        />
+                        <DeleteRestoreButtons
+                            :deleted="!!row.deletedOn"
+                            entity-name="content block"
+                            @delete="deleteBlock(row)"
+                            @restore="restoreBlock(row)"
+                        />
+                    </template>
+                </ListCard>
+            </template>
+        </q-table>
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only (large filter + table markup); script logic is small.
+// fallow-ignore-file complexity
+import { inject, onMounted, ref, watch } from "vue"
+import { useRoute, useRouter } from "vue-router"
+import { useQuasar, type QTableProps } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useServerTable } from "@/CMS/composables/use-server-table"
+import DeleteRestoreButtons from "@/CMS/components/DeleteRestoreButtons.vue"
+import EditButton from "@/CMS/components/EditButton.vue"
+import ListCard from "@/CMS/components/ListCard.vue"
+import ListCardField from "@/CMS/components/ListCardField.vue"
+import ModifiedStamp from "@/CMS/components/ModifiedStamp.vue"
+import PermissionChips from "@/CMS/components/PermissionChips.vue"
+import StatusIcon from "@/CMS/components/StatusIcon.vue"
+import type { CmsContentBlock } from "@/CMS/types/"
+
+const apiURL = inject("apiURL") + "CMS/content"
+const route = useRoute()
+const router = useRouter()
+const $q = useQuasar()
+const { get, del, post } = useFetch()
+
+const sectionPaths = ref<string[]>([])
+
+// Filters initialize from the URL so views can be shared/deep-linked, matching
+// the Files list and audit trail.
+const filters = ref({
+    status: typeof route.query.status === "string" ? route.query.status : "active",
+    viperSectionPath: typeof route.query.section === "string" ? route.query.section : null,
+    search: typeof route.query.search === "string" ? route.query.search : "",
+    publicOnly: route.query.public === "1",
+})
+
+// Reflect the active filters back into the URL (defaults are omitted).
+function syncFiltersToUrl() {
+    void router.replace({
+        query: {
+            ...route.query,
+            status: filters.value.status !== "active" ? filters.value.status : undefined,
+            section: filters.value.viperSectionPath || undefined,
+            search: filters.value.search || undefined,
+            public: filters.value.publicOnly ? "1" : undefined,
+        },
+    })
+}
+
+const statusOptions = [
+    { label: "Active", value: "active" },
+    { label: "Deleted", value: "deleted" },
+    { label: "All", value: "all" },
+]
+
+const columns: QTableProps["columns"] = [
+    { name: "title", label: "Title", field: "title", align: "left", sortable: true },
+    { name: "viperSectionPath", label: "VIPER section", field: "viperSectionPath", align: "left", sortable: true },
+    { name: "page", label: "Page", field: "page", align: "left", sortable: true },
+    { name: "permissions", label: "Access", field: "permissions", align: "left" },
+    { name: "modifiedOn", label: "Modified", field: "modifiedOn", align: "left", sortable: true },
+    { name: "actions", label: "Actions", field: "contentBlockId", align: "center" },
+]
+
+// Server-paged list, mirroring Files: useServerTable owns rows/loading/pagination and
+// issues the GET on @request; buildParams maps the current filters + page/sort each request.
+const {
+    rows: blocks,
+    loading,
+    pagination,
+    onRequest,
+    reloadFirstPage,
+} = useServerTable<CmsContentBlock>({
+    url: apiURL,
+    errorMessage: "Failed to load content blocks",
+    pagination: { sortBy: "title", descending: false },
+    buildParams: (p) => ({
+        status: filters.value.status,
+        viperSectionPath: filters.value.viperSectionPath,
+        search: filters.value.search || null,
+        isPublic: filters.value.publicOnly ? "true" : null,
+        page: p.page,
+        perPage: p.rowsPerPage,
+        sortBy: p.sortBy ?? "title",
+        descending: p.descending ? "true" : "false",
+    }),
+})
+
+// Filter changes both reload the list (from page 1) and update the URL; the route watcher
+// guards against re-fetching on our own URL write.
+function reload() {
+    syncFiltersToUrl()
+    void reloadFirstPage()
+}
+
+async function loadSectionPaths() {
+    const res = await get(apiURL + "/section-paths")
+    sectionPaths.value = res.success ? res.result : []
+}
+
+async function deleteBlock(block: CmsContentBlock) {
+    const confirmed = await new Promise<boolean>((resolve) => {
+        $q.dialog({
+            title: "Delete Content Block",
+            message: `Mark "${block.title}" as deleted? It can be restored later.`,
+            cancel: { label: "Cancel", flat: true },
+            persistent: true,
+            ok: { label: "Delete", color: "negative", unelevated: true },
+        })
+            .onOk(() => resolve(true))
+            .onCancel(() => resolve(false))
+            .onDismiss(() => resolve(false))
+    })
+    if (!confirmed) return
+    const res = await del(apiURL + "/" + block.contentBlockId)
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Failed to delete content block" })
+        return
+    }
+    $q.notify({ type: "positive", message: "Content block marked as deleted" })
+    reload()
+}
+
+async function restoreBlock(block: CmsContentBlock) {
+    const res = await post(apiURL + "/" + block.contentBlockId + "/restore")
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Failed to restore content block" })
+        return
+    }
+    $q.notify({ type: "positive", message: "Content block restored" })
+    reload()
+}
+
+// Re-sync filters when in-app navigation reuses this view with a different query
+// (e.g. a hub deep-link or re-clicked nav link). The equality guard skips our own
+// syncFiltersToUrl write, which would otherwise trigger a redundant fetch.
+watch(
+    () => route.query,
+    (query) => {
+        const next = {
+            status: typeof query.status === "string" ? query.status : "active",
+            viperSectionPath: typeof query.section === "string" ? query.section : null,
+            search: typeof query.search === "string" ? query.search : "",
+            publicOnly: query.public === "1",
+        }
+        const f = filters.value
+        if (
+            next.status === f.status &&
+            next.viperSectionPath === f.viperSectionPath &&
+            next.search === f.search &&
+            next.publicOnly === f.publicOnly
+        ) {
+            return
+        }
+        filters.value = next
+        void reloadFirstPage()
+    },
+)
+
+onMounted(() => {
+    loadSectionPaths()
+    reload()
+})
+</script>
diff --git a/VueApp/src/CMS/pages/FileAuditLog.vue b/VueApp/src/CMS/pages/FileAuditLog.vue
new file mode 100644
index 000000000..a9aae2018
--- /dev/null
+++ b/VueApp/src/CMS/pages/FileAuditLog.vue
@@ -0,0 +1,220 @@
+<template>
+    <div class="q-pa-md">
+        <BreadcrumbHeading
+            label="Audit Trail"
+            parent-label="Manage Files"
+            :parent-to="{ name: 'CmsFiles' }"
+        />
+
+        <div class="row q-col-gutter-md q-mb-sm">
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.action"
+                    dense
+                    options-dense
+                    outlined
+                    clearable
+                    label="Action"
+                    :options="actionOptions"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-input
+                    v-model="filters.loginId"
+                    dense
+                    outlined
+                    clearable
+                    debounce="400"
+                    label="Login ID"
+                    @update:model-value="reload"
+                />
+            </div>
+            <DateRangeFilter
+                v-model:from="filters.from"
+                v-model:to="filters.to"
+                @change="reload"
+            />
+        </div>
+
+        <div class="row q-mb-sm">
+            <div class="col-12 col-sm-4 col-lg-3">
+                <q-input
+                    v-model="filters.search"
+                    dense
+                    outlined
+                    clearable
+                    debounce="400"
+                    label="Search path or detail"
+                    @update:model-value="reload"
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+        </div>
+
+        <div
+            v-if="fileGuid"
+            class="q-mb-sm"
+        >
+            <q-chip
+                removable
+                dense
+                color="primary"
+                text-color="white"
+                @remove="clearFileFilter"
+            >
+                Filtered to one file: {{ fileGuid }}
+            </q-chip>
+        </div>
+
+        <q-table
+            :rows="entries"
+            :columns="columns"
+            row-key="auditId"
+            :loading="loading"
+            v-model:pagination="pagination"
+            :rows-per-page-options="[25, 50, 100, 250]"
+            :grid="$q.screen.lt.sm"
+            dense
+            flat
+            bordered
+            @request="onRequest"
+        >
+            <template #body-cell-timestamp="cellProps">
+                <q-td :props="cellProps">
+                    {{ formatDateTime(cellProps.row.timestamp, { dateStyle: "short", timeStyle: "short" }) }}
+                </q-td>
+            </template>
+            <template #body-cell-action="cellProps">
+                <q-td :props="cellProps">
+                    <StatusBadge :color="getActionColor(cellProps.row.action)">
+                        {{ cellProps.row.action }}
+                    </StatusBadge>
+                </q-td>
+            </template>
+            <template #body-cell-filePath="cellProps">
+                <q-td :props="cellProps">
+                    <span class="ellipsis file-path">
+                        {{ cellProps.row.filePath }}
+                        <q-tooltip v-if="cellProps.row.filePath">{{ cellProps.row.filePath }}</q-tooltip>
+                    </span>
+                </q-td>
+            </template>
+
+            <template #item="{ row }">
+                <ListCard>
+                    <template #header>
+                        <div class="row items-center q-gutter-x-sm">
+                            <StatusBadge :color="getActionColor(row.action)">
+                                {{ row.action }}
+                            </StatusBadge>
+                            <span class="text-caption text-grey-7">
+                                {{ formatDateTime(row.timestamp, { dateStyle: "short", timeStyle: "short" }) }}
+                            </span>
+                        </div>
+                    </template>
+
+                    <ListCardField
+                        label="Modified By"
+                        :value="row.loginid"
+                    />
+                    <ListCardField
+                        v-if="row.filePath"
+                        label="File"
+                        :value="row.filePath"
+                    />
+                    <ListCardField
+                        v-if="row.detail"
+                        label="Detail"
+                        :value="row.detail"
+                    />
+                </ListCard>
+            </template>
+        </q-table>
+    </div>
+</template>
+
+<script setup lang="ts">
+import { inject, onMounted } from "vue"
+import { useQuasar, type QTableProps } from "quasar"
+import { useDateFunctions } from "@/composables/DateFunctions"
+import { useUrlFilteredTable } from "@/CMS/composables/use-url-filtered-table"
+import BreadcrumbHeading from "@/components/BreadcrumbHeading.vue"
+import StatusBadge from "@/components/StatusBadge.vue"
+import ListCard from "@/CMS/components/ListCard.vue"
+import ListCardField from "@/CMS/components/ListCardField.vue"
+import DateRangeFilter from "@/CMS/components/DateRangeFilter.vue"
+import type { CmsFileAudit } from "@/CMS/types/"
+
+const apiURL = inject("apiURL") + "cms/files/audit"
+const $q = useQuasar()
+const { formatDateTime } = useDateFunctions()
+
+const actionOptions = [
+    "AccessFile",
+    "AccessFileDenied",
+    "AddFile",
+    "UploadFile",
+    "EditFile",
+    "DeleteFile",
+    "CancelDelete",
+    "ImportFile",
+]
+
+// Column order mirrors the Effort audit trail: date, who, what was affected,
+// then the action badge and its detail.
+const columns: QTableProps["columns"] = [
+    { name: "timestamp", label: "Date", field: "timestamp", align: "left" },
+    { name: "loginid", label: "Modified By", field: "loginid", align: "left" },
+    { name: "filePath", label: "File", field: "filePath", align: "left" },
+    { name: "action", label: "Action", field: "action", align: "left" },
+    { name: "detail", label: "Detail", field: "detail", align: "left" },
+]
+
+// Same palette logic as the Effort audit trail (AuditList.getActionColor):
+// create-like is green, edits blue, deletes red, restores teal, imports cyan.
+function getActionColor(action: string): string {
+    if (action === "AccessFileDenied") return "warning"
+    if (action.startsWith("Add") || action.startsWith("Upload")) return "positive"
+    if (action.startsWith("Edit")) return "primary"
+    if (action.startsWith("Delete")) return "negative"
+    if (action.startsWith("CancelDelete")) return "secondary"
+    if (action.startsWith("Import")) return "info"
+    return "grey-8"
+}
+
+// Filters + the per-file deep-link (?fileGuid) sync to the URL and drive the server-paged fetch;
+// see useUrlFilteredTable. The action filter defaults to null (unset) to match the clearable select.
+const {
+    rows: entries,
+    loading,
+    pagination,
+    onRequest,
+    filters,
+    primary: fileGuid,
+    reload,
+    clearPrimaryFilter: clearFileFilter,
+} = useUrlFilteredTable<
+    CmsFileAudit,
+    { action: string | null; loginId: string; from: string; to: string; search: string }
+>({
+    url: apiURL,
+    errorMessage: "Failed to load audit trail",
+    primaryKey: "fileGuid",
+    defaultFilters: () => ({ action: null, loginId: "", from: "", to: "", search: "" }),
+    pagination: { sortBy: "timestamp", descending: true },
+})
+
+onMounted(reload)
+</script>
+
+<style scoped>
+.file-path {
+    max-width: 20rem;
+    display: inline-block;
+    vertical-align: middle;
+}
+</style>
diff --git a/VueApp/src/CMS/pages/Files.vue b/VueApp/src/CMS/pages/Files.vue
new file mode 100644
index 000000000..9886493c6
--- /dev/null
+++ b/VueApp/src/CMS/pages/Files.vue
@@ -0,0 +1,538 @@
+<template>
+    <div class="q-pa-md">
+        <div class="row items-center q-mb-md list-page-header">
+            <h1 class="q-my-none">Manage Files</h1>
+            <q-space />
+            <q-btn-dropdown
+                flat
+                dense
+                no-caps
+                color="primary"
+                label="File Tools"
+                class="q-mr-sm"
+            >
+                <q-list dense>
+                    <q-item
+                        v-for="tool in fileTools"
+                        :key="tool.label"
+                        v-close-popup
+                        clickable
+                        :to="tool.to"
+                    >
+                        <q-item-section side>
+                            <q-icon
+                                :name="tool.icon"
+                                size="xs"
+                            />
+                        </q-item-section>
+                        <q-item-section>{{ tool.label }}</q-item-section>
+                    </q-item>
+                </q-list>
+            </q-btn-dropdown>
+            <q-btn
+                color="positive"
+                icon="add"
+                label="Add File"
+                no-caps
+                dense
+                @click="openUploadDialog"
+            />
+        </div>
+
+        <div class="row q-col-gutter-md q-mb-sm">
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.folder"
+                    dense
+                    options-dense
+                    outlined
+                    emit-value
+                    map-options
+                    label="VIPER app"
+                    :options="filterFolders"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.status"
+                    dense
+                    options-dense
+                    outlined
+                    emit-value
+                    map-options
+                    label="Status"
+                    :options="statusOptions"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-12 col-sm-4 col-lg-3">
+                <q-input
+                    v-model="filters.search"
+                    dense
+                    clearable
+                    outlined
+                    debounce="400"
+                    label="Search name, description, or URL"
+                    @update:model-value="reload"
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+            <div class="col-auto flex items-center">
+                <q-toggle
+                    v-model="filters.encryptedOnly"
+                    dense
+                    label="Encrypted only"
+                    @update:model-value="reload"
+                />
+            </div>
+            <div class="col-auto flex items-center">
+                <q-toggle
+                    v-model="filters.publicOnly"
+                    dense
+                    label="Public only"
+                    @update:model-value="reload"
+                />
+            </div>
+        </div>
+
+        <q-table
+            :rows="files"
+            :columns="columns"
+            row-key="fileGuid"
+            :loading="loading"
+            v-model:pagination="pagination"
+            :rows-per-page-options="[25, 50, 100, 250]"
+            :grid="$q.screen.lt.sm"
+            dense
+            flat
+            bordered
+            @request="onRequest"
+        >
+            <template #body-cell-friendlyName="cellProps">
+                <q-td :props="cellProps">
+                    <div class="row items-center no-wrap q-gutter-x-xs">
+                        <a
+                            :href="cellProps.row.friendlyUrl"
+                            target="_blank"
+                            rel="noopener"
+                        >
+                            {{ cellProps.row.friendlyName }}
+                            <span class="sr-only">(opens in new window)</span>
+                        </a>
+                        <StatusIcon
+                            v-if="cellProps.row.encrypted"
+                            icon="lock"
+                            color="warning"
+                            label="Encrypted"
+                        />
+                        <StatusIcon
+                            v-if="cellProps.row.allowPublicAccess"
+                            icon="public"
+                            color="positive"
+                            label="Public access"
+                        />
+                        <StatusIcon
+                            v-if="cellProps.row.deletedOn"
+                            icon="delete_outline"
+                            color="negative"
+                            :label="deletedLabel(cellProps.row)"
+                        />
+                    </div>
+                </q-td>
+            </template>
+
+            <template #body-cell-permissions="cellProps">
+                <q-td :props="cellProps">
+                    <PermissionChips
+                        :permissions="cellProps.row.permissions"
+                        :people-count="cellProps.row.people.length"
+                    />
+                </q-td>
+            </template>
+
+            <template #body-cell-oldUrl="cellProps">
+                <q-td :props="cellProps">
+                    <a
+                        v-if="cellProps.row.oldUrl"
+                        :href="oldUrlHref(cellProps.row.oldUrl)"
+                        target="_blank"
+                        rel="noopener"
+                    >
+                        Old URL
+                        <span class="sr-only">{{ cellProps.row.oldUrl }} (opens in new window)</span>
+                        <q-tooltip>{{ cellProps.row.oldUrl }}</q-tooltip>
+                    </a>
+                </q-td>
+            </template>
+
+            <template #body-cell-modifiedOn="cellProps">
+                <ModifiedStamp :cell-props="cellProps" />
+            </template>
+
+            <template #body-cell-actions="cellProps">
+                <q-td :props="cellProps">
+                    <EditButton
+                        entity-name="file"
+                        @click="openEditDialog(cellProps.row)"
+                    />
+                    <DeleteRestoreButtons
+                        :deleted="!!cellProps.row.deletedOn"
+                        entity-name="file"
+                        @delete="deleteFile(cellProps.row)"
+                        @restore="restoreFile(cellProps.row)"
+                    />
+                </q-td>
+            </template>
+
+            <template #item="{ row }">
+                <ListCard>
+                    <template #header>
+                        <div class="row items-center no-wrap q-gutter-x-xs">
+                            <a
+                                :href="row.friendlyUrl"
+                                target="_blank"
+                                rel="noopener"
+                            >
+                                {{ row.friendlyName }}
+                                <span class="sr-only">(opens in new window)</span>
+                            </a>
+                            <StatusIcon
+                                v-if="row.encrypted"
+                                icon="lock"
+                                color="warning"
+                                label="Encrypted"
+                            />
+                            <StatusIcon
+                                v-if="row.allowPublicAccess"
+                                icon="public"
+                                color="positive"
+                                label="Public access"
+                            />
+                            <StatusIcon
+                                v-if="row.deletedOn"
+                                icon="delete_outline"
+                                color="negative"
+                                :label="deletedLabel(row)"
+                            />
+                        </div>
+                    </template>
+
+                    <ListCardField
+                        label="VIPER app"
+                        :value="row.folder"
+                    />
+                    <ListCardField label="Access">
+                        <PermissionChips
+                            :permissions="row.permissions"
+                            :people-count="row.people.length"
+                        />
+                    </ListCardField>
+                    <ListCardField
+                        v-if="row.oldUrl"
+                        label="Old URL"
+                    >
+                        <a
+                            :href="oldUrlHref(row.oldUrl)"
+                            target="_blank"
+                            rel="noopener"
+                        >
+                            {{ row.oldUrl }}
+                            <span class="sr-only">(opens in new window)</span>
+                        </a>
+                    </ListCardField>
+                    <ListCardField label="Modified">
+                        <ModifiedStamp :row="row" />
+                    </ListCardField>
+
+                    <template #actions>
+                        <EditButton
+                            entity-name="file"
+                            @click="openEditDialog(row)"
+                        />
+                        <DeleteRestoreButtons
+                            :deleted="!!row.deletedOn"
+                            entity-name="file"
+                            @delete="deleteFile(row)"
+                            @restore="restoreFile(row)"
+                        />
+                    </template>
+                </ListCard>
+            </template>
+        </q-table>
+
+        <FileFormDialog
+            v-model="showDialog"
+            :folders="folders"
+            :file="editingFile"
+            @saved="reload"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only; the page's data logic lives in useServerTable.
+// fallow-ignore-file complexity
+import { inject, nextTick, onMounted, ref, watch } from "vue"
+import { useRoute, useRouter } from "vue-router"
+import { useQuasar, type QTableProps } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useServerTable } from "@/CMS/composables/use-server-table"
+import FileFormDialog from "@/CMS/components/FileFormDialog.vue"
+import DeleteRestoreButtons from "@/CMS/components/DeleteRestoreButtons.vue"
+import EditButton from "@/CMS/components/EditButton.vue"
+import ListCard from "@/CMS/components/ListCard.vue"
+import ListCardField from "@/CMS/components/ListCardField.vue"
+import ModifiedStamp from "@/CMS/components/ModifiedStamp.vue"
+import PermissionChips from "@/CMS/components/PermissionChips.vue"
+import StatusIcon from "@/CMS/components/StatusIcon.vue"
+import type { CmsFile } from "@/CMS/types/"
+
+const apiURL = inject("apiURL") + "cms/files/"
+const route = useRoute()
+const router = useRouter()
+const $q = useQuasar()
+const { get, del, post, createUrlSearchParams } = useFetch()
+
+const ALL_FOLDERS = "All"
+
+const folders = ref<string[]>([])
+type FolderOption = { label: string; value: string }
+
+const filterFolders = ref<FolderOption[]>([{ label: ALL_FOLDERS, value: ALL_FOLDERS }])
+const showDialog = ref(false)
+const editingFile = ref<CmsFile | null>(null)
+
+// Filters initialize from the URL so views can be shared/deep-linked
+// (the hub's recent-activity rail uses ?search=<file name>). The deleted/all views are open to all
+// file managers; the API scopes them to files the user deleted (admins see the whole trash).
+const filters = ref({
+    folder: typeof route.query.folder === "string" ? route.query.folder : ALL_FOLDERS,
+    status: typeof route.query.status === "string" ? route.query.status : "active",
+    search: typeof route.query.search === "string" ? route.query.search : "",
+    encryptedOnly: route.query.encrypted === "1",
+    publicOnly: route.query.public === "1",
+})
+
+// Reflect the active filters back into the URL (defaults are omitted).
+// `upload` is a one-shot action flag, never a persisted filter: strip it here so a
+// filter-sync write that races the upload-watcher's own strip (both fire on mount)
+// can't re-add the stale flag via the ...route.query spread.
+function syncFiltersToUrl() {
+    void router.replace({
+        query: {
+            ...route.query,
+            folder: filters.value.folder !== ALL_FOLDERS ? filters.value.folder : undefined,
+            status: filters.value.status !== "active" ? filters.value.status : undefined,
+            search: filters.value.search || undefined,
+            encrypted: filters.value.encryptedOnly ? "1" : undefined,
+            public: filters.value.publicOnly ? "1" : undefined,
+            upload: undefined,
+        },
+    })
+}
+
+// The old URL is the file's original VIPER 1 webroot path, kept so links
+// that predate the import still resolve (via the 404 -> missingFile -> CMS
+// lookup chain). Link it on the VIPER 1 host, matching the legacy UI, so
+// clicking exercises the same path end users' old links take.
+function oldUrlHref(oldUrl: string): string {
+    return import.meta.env.VITE_VIPER_1_HOME + oldUrl.replace(/^\//, "")
+}
+
+const statusOptions = [
+    { label: "Active", value: "active" },
+    { label: "Deleted", value: "deleted" },
+    { label: "All", value: "all" },
+]
+
+const fileTools = [
+    { label: "Audit Trail", icon: "history", to: { name: "CmsFileAudit" } },
+    { label: "Import Files", icon: "drive_file_move", to: { name: "CmsFileImport" } },
+    { label: "Bulk Encrypt", icon: "lock", to: { name: "CmsBulkEncrypt" } },
+]
+
+const columns: QTableProps["columns"] = [
+    { name: "friendlyName", label: "File", field: "friendlyName", align: "left", sortable: true },
+    { name: "folder", label: "VIPER app", field: "folder", align: "left", sortable: true },
+    { name: "permissions", label: "Access", field: "permissions", align: "left" },
+    { name: "oldUrl", label: "Old URL", field: "oldUrl", align: "left", sortable: true },
+    { name: "modifiedOn", label: "Modified", field: "modifiedOn", align: "left", sortable: true },
+    { name: "actions", label: "Actions", field: "fileGuid", align: "center" },
+]
+
+const {
+    rows: files,
+    loading,
+    pagination,
+    onRequest,
+    reloadFirstPage,
+} = useServerTable<CmsFile>({
+    url: apiURL,
+    errorMessage: "Failed to load files",
+    pagination: { sortBy: "friendlyName", descending: false },
+    buildParams: (p) => ({
+        folder: filters.value.folder !== ALL_FOLDERS ? filters.value.folder : null,
+        status: filters.value.status,
+        search: filters.value.search || null,
+        encrypted: filters.value.encryptedOnly ? "true" : null,
+        isPublic: filters.value.publicOnly ? "true" : null,
+        page: p.page,
+        perPage: p.rowsPerPage,
+        sortBy: p.sortBy ?? "friendlyName",
+        descending: p.descending ? "true" : "false",
+    }),
+})
+
+async function loadFolders() {
+    // Upload destinations are the disk allow-list; the filter dropdown is built
+    // separately (loadFolderOptions) from record folders plus per-folder counts.
+    const destinations = await get(apiURL + "folders")
+    folders.value = destinations.success ? destinations.result : []
+}
+
+async function loadFolderOptions() {
+    // Counts reflect the status/encrypted/public filters so they match the list;
+    // search is intentionally excluded (the dropdown is a folder inventory).
+    const countParams = createUrlSearchParams({
+        status: filters.value.status,
+        encrypted: filters.value.encryptedOnly ? "true" : null,
+        isPublic: filters.value.publicOnly ? "true" : null,
+    })
+    const [filterable, countsRes] = await Promise.all([
+        get(apiURL + "folders?includeData=true"),
+        get(apiURL + "folder-counts?" + countParams),
+    ])
+    const counts: { folder: string; count: number }[] = countsRes.success ? countsRes.result : []
+    const countByFolder = new Map(counts.map((c) => [c.folder.toLowerCase(), c.count]))
+    const names: string[] = filterable.success ? filterable.result : []
+    const total = counts.reduce((sum, c) => sum + c.count, 0)
+    filterFolders.value = [
+        { label: `${ALL_FOLDERS} (${total})`, value: ALL_FOLDERS },
+        ...names.map((n) => ({ label: `${n} (${countByFolder.get(n.toLowerCase()) ?? 0})`, value: n })),
+    ]
+}
+
+function reload() {
+    syncFiltersToUrl()
+    void loadFolderOptions()
+    void reloadFirstPage()
+}
+
+function openUploadDialog() {
+    editingFile.value = null
+    showDialog.value = true
+}
+
+function openEditDialog(file: CmsFile) {
+    editingFile.value = file
+    showDialog.value = true
+}
+
+async function deleteFile(file: CmsFile) {
+    const confirmed = await confirmAction(
+        "Delete File",
+        `Mark "${file.friendlyName}" as deleted? It can be restored later.`,
+        "Delete",
+        "negative",
+    )
+    if (!confirmed) return
+    const res = await del(apiURL + file.fileGuid)
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Failed to delete file" })
+        return
+    }
+    $q.notify({ type: "positive", message: "File marked as deleted" })
+    reload()
+}
+
+async function restoreFile(file: CmsFile) {
+    const res = await post(apiURL + file.fileGuid + "/restore")
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Failed to restore file" })
+        return
+    }
+    $q.notify({ type: "positive", message: "File restored" })
+    reload()
+}
+
+async function confirmAction(title: string, message: string, okLabel: string, okColor = "primary") {
+    return await new Promise<boolean>((resolve) => {
+        $q.dialog({
+            title,
+            message,
+            cancel: { label: "Cancel", flat: true },
+            persistent: true,
+            ok: { label: okLabel, color: okColor, unelevated: true },
+        })
+            .onOk(() => resolve(true))
+            .onCancel(() => resolve(false))
+            .onDismiss(() => resolve(false))
+    })
+}
+
+function formatDate(value: string | null): string {
+    if (!value) return ""
+    return new Date(value).toLocaleDateString("en-US", { year: "2-digit", month: "2-digit", day: "2-digit" })
+}
+
+// In the trash, show when the file will be auto-purged so it's clear it isn't kept forever.
+function deletedLabel(row: CmsFile): string {
+    const base = `Deleted ${formatDate(row.deletedOn)}`
+    return row.purgeOn ? `${base} · purges ${formatDate(row.purgeOn)}` : base
+}
+
+// When in-app navigation reuses this view with a different query (e.g. re-clicking the
+// left-nav "Manage Files" link while a filter is active, or a hub deep-link), the component
+// instance is kept, so re-sync the filters from the URL. The equality guard skips our own
+// syncFiltersToUrl write, which would otherwise trigger a redundant second fetch.
+watch(
+    () => route.query,
+    (query) => {
+        const next = {
+            folder: typeof query.folder === "string" ? query.folder : ALL_FOLDERS,
+            status: typeof query.status === "string" ? query.status : "active",
+            search: typeof query.search === "string" ? query.search : "",
+            encryptedOnly: query.encrypted === "1",
+            publicOnly: query.public === "1",
+        }
+        const f = filters.value
+        if (
+            next.folder === f.folder &&
+            next.status === f.status &&
+            next.search === f.search &&
+            next.encryptedOnly === f.encryptedOnly &&
+            next.publicOnly === f.publicOnly
+        ) {
+            return
+        }
+        filters.value = next
+        void loadFolderOptions()
+        void reloadFirstPage()
+    },
+)
+
+// The "Upload File" left-nav link targets ?upload=1; consume the flag so
+// re-clicking the link re-opens the dialog after it has been closed.
+// Strip the query BEFORE opening: route-focus moves focus to <main> after
+// each navigation (use-route-focus.ts), which would close an already-open dialog.
+watch(
+    () => route.query.upload,
+    async (upload) => {
+        if (upload !== undefined) {
+            await router.replace({ query: { ...route.query, upload: undefined } })
+            await nextTick()
+            openUploadDialog()
+        }
+    },
+    { immediate: true },
+)
+
+onMounted(() => {
+    loadFolders()
+    reload()
+})
+</script>
diff --git a/VueApp/src/CMS/pages/ImportFiles.vue b/VueApp/src/CMS/pages/ImportFiles.vue
new file mode 100644
index 000000000..9841f21ec
--- /dev/null
+++ b/VueApp/src/CMS/pages/ImportFiles.vue
@@ -0,0 +1,339 @@
+<template>
+    <div class="q-pa-md">
+        <BreadcrumbHeading
+            label="Import from VIPER"
+            parent-label="Manage Files"
+            :parent-to="{ name: 'CmsFiles' }"
+        />
+
+        <p class="text-body2 text-grey-8 intro-copy">
+            Moves files out of the legacy VIPER webroot into the managed file store. The original path is saved as the
+            file's Old URL, so existing links keep working through the file handler. Enter one path per line, relative
+            to the legacy webroot (e.g.
+            <code>/cats/docs/manual.pdf</code>).
+        </p>
+
+        <q-form
+            v-if="!preview"
+            greedy
+            @submit.prevent="runPreview"
+        >
+            <div class="import-form">
+                <q-input
+                    v-model="paths"
+                    outlined
+                    type="textarea"
+                    rows="12"
+                    label="File paths (one per line)"
+                    class="q-mb-md"
+                    :rules="[(v: string | null) => (v && v.trim().length > 0) || 'Enter at least one path']"
+                    hide-bottom-space
+                />
+                <q-select
+                    v-model="options.folder"
+                    dense
+                    options-dense
+                    outlined
+                    label="Destination folder"
+                    class="q-mb-sm"
+                    :options="folders"
+                    :rules="[(v: string | null) => !!v || 'Please select a folder']"
+                    hide-bottom-space
+                />
+                <PermissionSelector
+                    v-model="options.permissions"
+                    class="q-mb-sm"
+                />
+                <div class="column items-start">
+                    <q-toggle
+                        v-model="options.useDefaultPermission"
+                        label="Add default permission (SVMSecure.{folder})"
+                    />
+                    <q-toggle
+                        v-model="options.allowPublicAccess"
+                        label="Public access"
+                    />
+                    <q-toggle
+                        v-model="options.encrypt"
+                        label="Encrypt files"
+                    />
+                </div>
+                <div class="q-mt-md">
+                    <q-btn
+                        type="submit"
+                        color="primary"
+                        label="Preview Import"
+                        dense
+                        no-caps
+                        class="q-pr-md"
+                        :loading="previewing"
+                    >
+                        <template #loading>
+                            <q-spinner
+                                size="1em"
+                                class="q-mr-sm"
+                            />
+                            Preview Import
+                        </template>
+                    </q-btn>
+                </div>
+            </div>
+        </q-form>
+
+        <template v-else>
+            <h2 class="text-h6 text-primary q-mb-sm">Confirm Import</h2>
+            <p class="text-body2">
+                {{ importableCount }} of {{ preview.length }} {{ inflect("file", preview.length) }} will be imported
+                into <strong>{{ options.folder }}</strong
+                >. Nothing has been moved yet.
+            </p>
+            <ul class="text-body2 q-mt-none">
+                <li>
+                    Permissions:
+                    {{ effectivePermissions.length ? effectivePermissions.join(", ") : "none (any VIPER user)" }}
+                </li>
+                <li>Public access: {{ options.allowPublicAccess ? "yes" : "no" }}</li>
+                <li>Encrypt: {{ options.encrypt ? "yes" : "no" }}</li>
+            </ul>
+            <q-table
+                :rows="preview"
+                :columns="previewColumns"
+                row-key="filePath"
+                :pagination="{ rowsPerPage: 0 }"
+                hide-bottom
+                dense
+                flat
+                bordered
+            >
+                <template #body-cell-status="cellProps">
+                    <q-td :props="cellProps">
+                        <q-icon
+                            :name="previewStatus(cellProps.row).icon"
+                            :color="previewStatus(cellProps.row).color"
+                            size="sm"
+                        />
+                        <span class="sr-only">{{ previewStatus(cellProps.row).label }}</span>
+                    </q-td>
+                </template>
+                <template #body-cell-fileName="cellProps">
+                    <q-td :props="cellProps">
+                        <template v-if="cellProps.row.fileName">
+                            {{ cellProps.row.fileName }}
+                            <div
+                                v-if="cellProps.row.renamedFrom"
+                                class="text-caption text-warning"
+                            >
+                                renamed from {{ cellProps.row.renamedFrom }}
+                            </div>
+                        </template>
+                    </q-td>
+                </template>
+            </q-table>
+            <div class="q-mt-md q-gutter-sm">
+                <q-btn
+                    flat
+                    dense
+                    no-caps
+                    label="Back"
+                    @click="preview = null"
+                />
+                <q-btn
+                    color="primary"
+                    dense
+                    no-caps
+                    class="q-pr-md"
+                    :label="`Confirm and Import ${importableCount} ${inflect('file', importableCount)}`"
+                    :disable="importableCount === 0"
+                    :loading="importing"
+                    @click="runImport"
+                >
+                    <template #loading>
+                        <q-spinner
+                            size="1em"
+                            class="q-mr-sm"
+                        />
+                        Importing...
+                    </template>
+                </q-btn>
+            </div>
+        </template>
+
+        <template v-if="results.length">
+            <h2 class="text-h6 text-primary q-mb-sm q-mt-lg">Results</h2>
+            <q-table
+                :rows="results"
+                :columns="resultColumns"
+                row-key="filePath"
+                :pagination="{ rowsPerPage: 0 }"
+                hide-bottom
+                dense
+                flat
+                bordered
+            >
+                <template #body-cell-success="cellProps">
+                    <q-td :props="cellProps">
+                        <q-icon
+                            :name="cellProps.row.success ? 'check_circle' : 'error'"
+                            :color="cellProps.row.success ? 'positive' : 'negative'"
+                            size="sm"
+                        />
+                        <span class="sr-only">{{ cellProps.row.success ? "Imported" : "Failed" }}</span>
+                    </q-td>
+                </template>
+            </q-table>
+        </template>
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only (large wizard/table markup); script logic is small.
+// fallow-ignore-file complexity
+import { computed, inject, onMounted, ref } from "vue"
+import { inflect } from "inflection"
+import { useQuasar, type QTableProps } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import BreadcrumbHeading from "@/components/BreadcrumbHeading.vue"
+import PermissionSelector from "@/CMS/components/PermissionSelector.vue"
+
+type ImportResult = {
+    filePath: string
+    success: boolean
+    message: string | null
+    fileGuid: string | null
+    friendlyName: string | null
+}
+
+type ImportPreview = {
+    filePath: string
+    canImport: boolean
+    message: string | null
+    fileName: string | null
+    renamedFrom: string | null
+    friendlyName: string | null
+    oldUrl: string | null
+}
+
+const apiURL = inject("apiURL") + "cms/files/"
+const $q = useQuasar()
+const { get, post } = useFetch()
+
+const folders = ref<string[]>([])
+const paths = ref("")
+const importing = ref(false)
+const previewing = ref(false)
+const preview = ref<ImportPreview[] | null>(null)
+const results = ref<ImportResult[]>([])
+
+const options = ref({
+    folder: null as string | null,
+    permissions: [] as string[],
+    useDefaultPermission: false,
+    allowPublicAccess: false,
+    encrypt: false,
+})
+
+const resultColumns: QTableProps["columns"] = [
+    { name: "success", label: "Result", field: "success", align: "center" },
+    { name: "filePath", label: "Path", field: "filePath", align: "left" },
+    { name: "friendlyName", label: "Imported as", field: "friendlyName", align: "left" },
+    { name: "message", label: "Message", field: "message", align: "left" },
+]
+
+const previewColumns: QTableProps["columns"] = [
+    { name: "status", label: "Result", field: "canImport", align: "center" },
+    { name: "filePath", label: "Path", field: "filePath", align: "left" },
+    { name: "fileName", label: "Will be imported as", field: "fileName", align: "left" },
+    { name: "message", label: "Note", field: "message", align: "left" },
+]
+
+const importableCount = computed(() => preview.value?.filter((p) => p.canImport).length ?? 0)
+
+function previewStatus(row: ImportPreview) {
+    if (!row.canImport) return { icon: "error", color: "negative", label: "Will be skipped" }
+    if (row.message) return { icon: "warning", color: "warning", label: "Ready (with note)" }
+    return { icon: "check_circle", color: "positive", label: "Ready" }
+}
+
+const effectivePermissions = computed(() => {
+    const perms = [...options.value.permissions]
+    if (options.value.useDefaultPermission && options.value.folder) {
+        perms.push("SVMSecure." + options.value.folder.split(/[\\/]/)[0])
+    }
+    // The default permission can duplicate one already chosen; the import dedupes
+    // server-side, so collapse it here too to avoid a doubled label in the summary.
+    return [...new Set(perms)]
+})
+
+async function loadFolders() {
+    const res = await get(apiURL + "folders")
+    folders.value = res.success ? res.result : []
+}
+
+function buildRequest() {
+    return {
+        filePaths: paths.value
+            .split("\n")
+            .map((p) => p.trim())
+            .filter((p) => p.length > 0),
+        folder: options.value.folder,
+        permissions: options.value.permissions,
+        useDefaultPermission: options.value.useDefaultPermission,
+        allowPublicAccess: options.value.allowPublicAccess,
+        encrypt: options.value.encrypt,
+    }
+}
+
+async function runPreview() {
+    const request = buildRequest()
+    if (!request.filePaths.length || !request.folder) return
+
+    previewing.value = true
+    results.value = []
+    const res = await post(apiURL + "import/preview", request)
+    previewing.value = false
+
+    if (!res.success) {
+        $q.notify({ type: "negative", message: res.errors?.[0] ?? "Preview failed" })
+        return
+    }
+    preview.value = res.result
+}
+
+async function runImport() {
+    const request = buildRequest()
+    if (!request.filePaths.length || !request.folder) return
+
+    importing.value = true
+    const res = await post(apiURL + "import", request)
+    importing.value = false
+
+    if (!res.success) {
+        $q.notify({ type: "negative", message: res.errors?.[0] ?? "Import failed" })
+        return
+    }
+    preview.value = null
+    results.value = res.result
+    const succeeded = res.result.filter((r: ImportResult) => r.success).length
+    $q.notify({
+        type: succeeded === res.result.length ? "positive" : "warning",
+        message: `${succeeded} of ${res.result.length} ${inflect("file", res.result.length)} imported`,
+    })
+    // Imported paths are consumed; keep failures in the textarea for fixing.
+    paths.value = res.result
+        .filter((r: ImportResult) => !r.success)
+        .map((r: ImportResult) => r.filePath)
+        .join("\n")
+}
+
+onMounted(loadFolders)
+</script>
+
+<style scoped>
+.intro-copy {
+    max-width: 60rem;
+}
+
+.import-form {
+    max-width: 40rem;
+}
+</style>
diff --git a/VueApp/src/CMS/pages/LeftNavEdit.vue b/VueApp/src/CMS/pages/LeftNavEdit.vue
new file mode 100644
index 000000000..a53b851b6
--- /dev/null
+++ b/VueApp/src/CMS/pages/LeftNavEdit.vue
@@ -0,0 +1,559 @@
+<template>
+    <div class="q-pa-md">
+        <BreadcrumbHeading
+            :label="isNew ? 'Add Left-Nav Menu' : 'Edit Left-Nav Menu'"
+            parent-label="Manage Left-Nav Menus"
+            :parent-to="{ name: 'CmsLeftNavMenus' }"
+        />
+
+        <div class="row q-col-gutter-lg">
+            <div class="col-12 col-md-4">
+                <q-card
+                    flat
+                    bordered
+                >
+                    <q-card-section class="q-gutter-y-sm">
+                        <h2 class="text-h6 q-my-none">Menu Settings</h2>
+
+                        <q-form
+                            ref="menuFormRef"
+                            greedy
+                            @submit.prevent="saveMenu"
+                            @validation-error="onMenuValidationError"
+                        >
+                            <LeftNavMenuSettingsFields v-model="menu" />
+
+                            <StatusBanner
+                                v-if="menuFormError"
+                                type="error"
+                                class="q-mb-sm"
+                            >
+                                {{ menuFormError }}
+                            </StatusBanner>
+
+                            <div class="row items-center q-gutter-sm">
+                                <q-btn
+                                    type="submit"
+                                    color="primary"
+                                    :label="isNew ? 'Create Menu' : 'Save Menu Settings'"
+                                    dense
+                                    no-caps
+                                    :loading="savingMenu"
+                                >
+                                    <template #loading>
+                                        <q-spinner
+                                            size="1em"
+                                            class="q-mr-sm"
+                                        />
+                                        {{ isNew ? "Create Menu" : "Save Menu Settings" }}
+                                    </template>
+                                </q-btn>
+                                <span
+                                    v-if="!isNew && menuDirty"
+                                    class="unsaved-hint text-warning"
+                                >
+                                    <q-icon
+                                        name="edit"
+                                        size="1rem"
+                                    />
+                                    Unsaved changes
+                                </span>
+                            </div>
+                        </q-form>
+                    </q-card-section>
+                </q-card>
+            </div>
+
+            <div
+                v-if="!isNew"
+                class="col-12 col-md-8"
+            >
+                <q-card
+                    flat
+                    bordered
+                >
+                    <q-card-section>
+                        <div class="row items-center q-mb-sm">
+                            <h2 class="text-h6 q-my-none">Menu Items</h2>
+                            <q-space />
+                            <q-btn
+                                dense
+                                no-caps
+                                color="positive"
+                                icon="add"
+                                label="Add Header"
+                                class="q-pr-md"
+                                @click="addItem(true)"
+                            />
+                            <q-btn
+                                dense
+                                no-caps
+                                color="positive"
+                                icon="add"
+                                label="Add Link"
+                                class="q-ml-sm q-pr-md"
+                                @click="addItem(false)"
+                            />
+                        </div>
+
+                        <SortableList
+                            v-model="items"
+                            item-key="key"
+                            class="menu-items"
+                            move-up-label="Move item up"
+                            move-down-label="Move item down"
+                            :row-class="itemRowClass"
+                            :announce="announceItem"
+                            @reorder="onItemsReorder"
+                        >
+                            <template #row="{ item }">
+                                <div
+                                    class="menu-item-fields"
+                                    role="group"
+                                    :aria-label="`${item.isHeader ? 'Section header' : 'Menu link'}: ${item.menuItemText || '(untitled)'}`"
+                                >
+                                    <div class="menu-item-fields__text">
+                                        <q-input
+                                            v-model="item.menuItemText"
+                                            dense
+                                            outlined
+                                            :label="item.isHeader ? 'Header text' : 'Link text'"
+                                        />
+                                    </div>
+                                    <div class="menu-item-fields__url">
+                                        <q-input
+                                            v-if="!item.isHeader"
+                                            v-model="item.url"
+                                            dense
+                                            outlined
+                                            label="URL"
+                                        />
+                                        <div
+                                            v-else
+                                            class="text-grey-7 q-mt-sm text-caption"
+                                        >
+                                            Section header
+                                        </div>
+                                    </div>
+                                    <div class="menu-item-fields__perms">
+                                        <PermissionSelector
+                                            v-model="item.permissions"
+                                            label="Visible to"
+                                        />
+                                    </div>
+                                </div>
+                            </template>
+
+                            <template #actions="{ index }">
+                                <q-btn
+                                    dense
+                                    flat
+                                    no-caps
+                                    size="sm"
+                                    color="negative"
+                                    icon="delete"
+                                    aria-label="Remove item"
+                                    @click="removeItem(index)"
+                                >
+                                    <q-tooltip>Remove item</q-tooltip>
+                                </q-btn>
+                            </template>
+
+                            <template #empty>
+                                <div class="text-grey-7 q-my-md">No items yet — add a header or link above.</div>
+                            </template>
+                        </SortableList>
+
+                        <StatusBanner
+                            v-if="itemsError"
+                            type="error"
+                            class="q-mt-md"
+                        >
+                            {{ itemsError }}
+                        </StatusBanner>
+
+                        <div class="q-mt-md row items-center">
+                            <q-btn
+                                color="primary"
+                                label="Save Items"
+                                dense
+                                no-caps
+                                :loading="savingItems"
+                                @click="saveItems"
+                            >
+                                <template #loading>
+                                    <q-spinner
+                                        size="1em"
+                                        class="q-mr-sm"
+                                    />
+                                    Save Items
+                                </template>
+                            </q-btn>
+                            <q-btn
+                                flat
+                                label="Discard Item Changes"
+                                dense
+                                no-caps
+                                class="q-ml-sm"
+                                :disable="!itemsDirty"
+                                @click="revertItems"
+                            />
+                            <span
+                                v-if="itemsDirty"
+                                class="unsaved-hint text-warning q-ml-md"
+                            >
+                                <q-icon
+                                    name="edit"
+                                    size="1rem"
+                                />
+                                Unsaved changes
+                            </span>
+                        </div>
+                    </q-card-section>
+                </q-card>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+// Template-size synthetic complexity only; the payload build is extracted from saveMenu below.
+// fallow-ignore-file complexity
+import { computed, inject, onMounted, ref, watch } from "vue"
+import { useRoute, useRouter, onBeforeRouteLeave } from "vue-router"
+import { useQuasar } from "quasar"
+import { useFetch } from "@/composables/ViperFetch"
+import { useUnsavedChanges } from "@/composables/use-unsaved-changes"
+import BreadcrumbHeading from "@/components/BreadcrumbHeading.vue"
+import SortableList from "@/components/SortableList.vue"
+import LeftNavMenuSettingsFields from "@/CMS/components/LeftNavMenuSettingsFields.vue"
+import PermissionSelector from "@/CMS/components/PermissionSelector.vue"
+import StatusBanner from "@/components/StatusBanner.vue"
+import type { CmsLeftNavMenu } from "@/CMS/types/"
+
+const apiURL = inject("apiURL") + "cms/left-navs"
+const route = useRoute()
+const router = useRouter()
+const $q = useQuasar()
+const { get, post, put } = useFetch()
+
+const menuId = computed(() => (route.params.id ? Number(route.params.id) : null))
+const isNew = computed(() => menuId.value === null)
+
+const menuFormRef = ref()
+const savingMenu = ref(false)
+const savingItems = ref(false)
+const menuFormError = ref("")
+const itemsError = ref("")
+
+const menu = ref({
+    menuHeaderText: "" as string | null,
+    system: "Viper",
+    viperSectionPath: null as string | null,
+    page: null as string | null,
+    friendlyName: null as string | null,
+})
+
+type EditableItem = {
+    key: number
+    leftNavItemId: number
+    menuItemText: string | null
+    isHeader: boolean
+    url: string | null
+    permissions: string[]
+}
+
+const items = ref<EditableItem[]>([])
+let savedMenu: CmsLeftNavMenu | null = null
+let nextKey = -1
+
+// The settings form and the items list save independently, so track them separately:
+// saving one must not clear the other's unsaved flag, and each section shows its own
+// unsaved indicator.
+const {
+    isDirty: menuDirty,
+    setInitialState: setMenuBaseline,
+    resetDirtyState: resetMenuDirty,
+} = useUnsavedChanges(menu)
+const {
+    isDirty: itemsDirty,
+    setInitialState: setItemsBaseline,
+    resetDirtyState: resetItemsDirty,
+} = useUnsavedChanges(items)
+const hasUnsavedChanges = computed(() => menuDirty.value || itemsDirty.value)
+
+function captureBaselines() {
+    setMenuBaseline()
+    setItemsBaseline()
+}
+
+onBeforeRouteLeave(async () => {
+    if (!hasUnsavedChanges.value) {
+        return true
+    }
+    return await confirmLeave()
+})
+
+function confirmLeave(): Promise<boolean> {
+    return new Promise((resolve) => {
+        $q.dialog({
+            title: "Unsaved Changes",
+            message: "This menu has unsaved changes. Leave without saving?",
+            cancel: { label: "Keep Editing", flat: true },
+            ok: { label: "Leave", color: "negative", unelevated: true },
+            persistent: true,
+        })
+            .onOk(() => resolve(true))
+            .onCancel(() => resolve(false))
+            .onDismiss(() => resolve(false))
+    })
+}
+
+function toEditableItems(source: CmsLeftNavMenu): EditableItem[] {
+    return source.items.map((i) => ({
+        key: i.leftNavItemId,
+        leftNavItemId: i.leftNavItemId,
+        menuItemText: i.menuItemText,
+        isHeader: i.isHeader,
+        url: i.url,
+        permissions: [...i.permissions],
+    }))
+}
+
+async function loadMenu() {
+    if (menuId.value === null) return
+    const res = await get(apiURL + "/" + menuId.value)
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Menu not found" })
+        void router.push({ name: "CmsLeftNavMenus" })
+        return
+    }
+    savedMenu = res.result
+    menu.value = {
+        menuHeaderText: res.result.menuHeaderText,
+        system: res.result.system,
+        viperSectionPath: res.result.viperSectionPath,
+        page: res.result.page,
+        friendlyName: res.result.friendlyName,
+    }
+    items.value = toEditableItems(res.result)
+    captureBaselines()
+}
+
+// The q-form focuses the first invalid field on a failed submit; this surfaces a matching
+// message next to the save button so the failure is obvious without scrolling up.
+function onMenuValidationError() {
+    menuFormError.value = isNew.value
+        ? "Please complete the required fields before creating this menu."
+        : "Please complete the required fields before saving."
+}
+
+function buildMenuPayload() {
+    return {
+        menuHeaderText: menu.value.menuHeaderText,
+        system: menu.value.system,
+        viperSectionPath: menu.value.viperSectionPath || null,
+        page: menu.value.page || null,
+        friendlyName: menu.value.friendlyName || null,
+    }
+}
+
+async function saveMenu() {
+    menuFormError.value = ""
+
+    savingMenu.value = true
+    const payload = buildMenuPayload()
+    const res = isNew.value ? await post(apiURL, payload) : await put(apiURL + "/" + menuId.value, payload)
+    savingMenu.value = false
+
+    if (!res.success) {
+        menuFormError.value = res.errors?.[0] ?? "Failed to save menu"
+        return
+    }
+    $q.notify({ type: "positive", message: isNew.value ? "Menu created — now add items" : "Menu settings saved" })
+    resetMenuDirty()
+    if (isNew.value) {
+        // the menuId watch loads the created menu once the route changes
+        void router.push({ name: "CmsLeftNavEdit", params: { id: res.result.leftNavMenuId } })
+    }
+}
+
+function addItem(isHeader: boolean) {
+    items.value.push({
+        key: nextKey--,
+        leftNavItemId: 0,
+        menuItemText: "",
+        isHeader,
+        url: isHeader ? null : "",
+        permissions: [],
+    })
+}
+
+function removeItem(index: number) {
+    items.value.splice(index, 1)
+}
+
+function itemRowClass(item: EditableItem) {
+    return { "menu-item--header": item.isHeader }
+}
+
+function announceItem(item: EditableItem, newIndex: number, total: number) {
+    const kind = item.isHeader ? "header" : "link"
+    const name = item.menuItemText?.trim() || "item"
+    return `Moved ${kind} ${name} to position ${newIndex + 1} of ${total}`
+}
+
+// Reorder is staged here (commits on Save Items), so the toast stays neutral; `group`
+// collapses rapid nudges into one. The "Unsaved changes" indicator signals it needs saving.
+function onItemsReorder() {
+    $q.notify({ type: "info", message: "Order updated", group: "leftnav-order", timeout: 1500 })
+}
+
+async function saveItems() {
+    itemsError.value = ""
+    const emptyItem = items.value.find((i) => !i.menuItemText || i.menuItemText.trim() === "")
+    if (emptyItem) {
+        itemsError.value = "Every item needs text — fill in the empty item before saving."
+        return
+    }
+
+    savingItems.value = true
+    const payload = items.value.map((i) => ({
+        leftNavItemId: i.leftNavItemId,
+        menuItemText: i.menuItemText,
+        isHeader: i.isHeader,
+        url: i.isHeader ? null : i.url,
+        permissions: i.permissions,
+    }))
+    const res = await put(apiURL + "/" + menuId.value + "/items", payload)
+    savingItems.value = false
+
+    if (!res.success) {
+        itemsError.value = res.errors?.[0] ?? "Failed to save items"
+        return
+    }
+    $q.notify({ type: "positive", message: "Items saved" })
+    savedMenu = res.result
+    items.value = toEditableItems(res.result)
+    resetItemsDirty()
+}
+
+function revertItems() {
+    if (savedMenu) {
+        items.value = toEditableItems(savedMenu)
+        itemsError.value = ""
+        $q.notify({ type: "info", message: "Item changes discarded" })
+    }
+}
+
+// The create and edit routes share this component, so vue-router reuses the
+// instance and onMounted does not re-fire when navigating between them
+// (create -> redirect after save, or browser back to the create route).
+watch(menuId, (id) => {
+    if (id === null) {
+        menu.value = {
+            menuHeaderText: "",
+            system: "Viper",
+            viperSectionPath: null,
+            page: null,
+            friendlyName: null,
+        }
+        items.value = []
+        savedMenu = null
+        menuFormError.value = ""
+        itemsError.value = ""
+        captureBaselines()
+    } else {
+        void loadMenu()
+    }
+})
+
+onMounted(() => {
+    loadMenu()
+    // loadMenu sets the baseline for an existing menu; a brand-new form's baseline is empty.
+    if (isNew.value) {
+        captureBaselines()
+    }
+})
+</script>
+
+<style scoped>
+.unsaved-hint {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.25rem;
+    font-size: 0.8125rem;
+    font-weight: 500;
+}
+
+/* The row's available width (not the viewport) decides whether the three fields fit:
+   in the two-column layout the Menu Items column can be narrow even on a wide screen.
+   Query the row body so the fields stack until there's genuinely room for a row. */
+.menu-items :deep(.sortable-row__body) {
+    container-type: inline-size;
+}
+
+.menu-item-fields {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+}
+
+@container (min-width: 30rem) {
+    .menu-item-fields {
+        flex-direction: row;
+        align-items: flex-start;
+        gap: 0.75rem;
+    }
+
+    .menu-item-fields__text {
+        flex: 1 1 0;
+        min-width: 0;
+    }
+
+    .menu-item-fields__url {
+        flex: 1.3 1 0;
+        min-width: 0;
+    }
+
+    .menu-item-fields__perms {
+        flex: 1.2 1 0;
+        min-width: 0;
+    }
+}
+
+/* Match the Link Collections rows exactly: tinted cards on small/medium screens,
+   borderless grouped rows in the panel on desktop. Header rows keep a distinct tint. */
+.menu-items :deep(.sortable-row) {
+    border: 1px solid var(--ucdavis-black-10);
+    border-radius: 0.25rem;
+    padding: 0.75rem;
+    background: var(--surface-tint-raised);
+}
+
+.menu-items :deep(.sortable-row.menu-item--header) {
+    background: var(--surface-tint);
+}
+
+@media (width >= 1024px) {
+    .menu-items :deep(.sortable-list__items) {
+        gap: 0;
+    }
+
+    .menu-items :deep(.sortable-row) {
+        border: none;
+        border-bottom: 1px solid var(--ucdavis-black-10);
+        border-radius: 0;
+        padding: 0.75rem 0.5rem;
+        background: transparent;
+    }
+
+    .menu-items :deep(.sortable-row:last-child) {
+        border-bottom: none;
+    }
+
+    .menu-items :deep(.sortable-row.menu-item--header) {
+        background: var(--surface-tint);
+    }
+}
+</style>
diff --git a/VueApp/src/CMS/pages/LeftNavMenus.vue b/VueApp/src/CMS/pages/LeftNavMenus.vue
new file mode 100644
index 000000000..3d017a6c9
--- /dev/null
+++ b/VueApp/src/CMS/pages/LeftNavMenus.vue
@@ -0,0 +1,268 @@
+<template>
+    <div class="q-pa-md">
+        <div class="row items-center q-mb-md list-page-header">
+            <h1 class="q-my-none">Manage Left-Nav Menus</h1>
+            <q-space />
+            <q-btn
+                color="positive"
+                icon="add"
+                label="Add Left-Nav Menu"
+                no-caps
+                dense
+                @click="showAddDialog = true"
+            />
+        </div>
+
+        <div class="row q-col-gutter-md q-mb-sm">
+            <div class="col-12 col-sm-3 col-lg-2">
+                <q-select
+                    v-model="filters.system"
+                    dense
+                    options-dense
+                    outlined
+                    emit-value
+                    map-options
+                    label="System"
+                    :options="systemOptions"
+                    @update:model-value="loadMenus"
+                />
+            </div>
+            <div class="col-12 col-sm-4 col-lg-3">
+                <q-input
+                    v-model="filters.search"
+                    dense
+                    clearable
+                    outlined
+                    debounce="400"
+                    label="Search header, name, or page"
+                    @update:model-value="loadMenus"
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+        </div>
+
+        <!-- Left-nav menus are a small, bounded set (one row per menu), so the list stays
+             client-side; the "All" (0) rows-per-page option is dropped since even the full
+             list is a short page. -->
+        <q-table
+            :rows="menus"
+            :columns="columns"
+            row-key="leftNavMenuId"
+            :loading="loading"
+            :pagination="{ rowsPerPage: 50, sortBy: 'menuHeaderText' }"
+            :rows-per-page-options="[25, 50, 100]"
+            :grid="$q.screen.lt.sm"
+            dense
+            flat
+            bordered
+        >
+            <template #body-cell-menuHeaderText="cellProps">
+                <q-td :props="cellProps">
+                    <router-link :to="{ name: 'CmsLeftNavEdit', params: { id: cellProps.row.leftNavMenuId } }">
+                        {{ cellProps.row.menuHeaderText || "(untitled)" }}
+                    </router-link>
+                </q-td>
+            </template>
+
+            <template #body-cell-items="cellProps">
+                <q-td :props="cellProps">{{ cellProps.row.items.length }}</q-td>
+            </template>
+
+            <template #body-cell-modifiedOn="cellProps">
+                <ModifiedStamp :cell-props="cellProps" />
+            </template>
+
+            <template #body-cell-actions="cellProps">
+                <q-td :props="cellProps">
+                    <EditButton
+                        entity-name="menu"
+                        :to="{ name: 'CmsLeftNavEdit', params: { id: cellProps.row.leftNavMenuId } }"
+                    />
+                    <q-btn
+                        dense
+                        flat
+                        no-caps
+                        size="sm"
+                        color="negative"
+                        icon="delete"
+                        aria-label="Delete menu"
+                        @click="deleteMenu(cellProps.row)"
+                    >
+                        <q-tooltip>Delete</q-tooltip>
+                    </q-btn>
+                </q-td>
+            </template>
+
+            <template #item="{ row }">
+                <ListCard>
+                    <template #header>
+                        <router-link
+                            class="text-weight-medium"
+                            :to="{ name: 'CmsLeftNavEdit', params: { id: row.leftNavMenuId } }"
+                        >
+                            {{ row.menuHeaderText || "(untitled)" }}
+                        </router-link>
+                    </template>
+
+                    <ListCardField
+                        label="System"
+                        :value="row.system"
+                    />
+                    <ListCardField
+                        v-if="row.viperSectionPath"
+                        label="VIPER section"
+                        :value="row.viperSectionPath"
+                    />
+                    <ListCardField
+                        v-if="row.page"
+                        label="Page"
+                        :value="row.page"
+                    />
+                    <ListCardField
+                        v-if="row.friendlyName"
+                        label="Friendly name"
+                        :value="row.friendlyName"
+                    />
+                    <ListCardField
+                        label="Items"
+                        :value="row.items.length"
+                    />
+                    <ListCardField label="Modified">
+                        <ModifiedStamp :row="row" />
+                    </ListCardField>
+
+                    <template #actions>
+                        <EditButton
+                            entity-name="menu"
+                            :to="{ name: 'CmsLeftNavEdit', params: { id: row.leftNavMenuId } }"
+                        />
+                        <q-btn
+                            dense
+                            flat
+                            no-caps
+                            size="sm"
+                            color="negative"
+                            icon="delete"
+                            aria-label="Delete menu"
+                            @click="deleteMenu(row)"
+                        >
+                            <q-tooltip>Delete</q-tooltip>
+                        </q-btn>
+                    </template>
+                </ListCard>
+            </template>
+
+            <template #no-data>
+                <div class="full-width text-center text-grey-7 q-py-md">
+                    No left-nav menus yet. Use the "Add Left-Nav Menu" button to create one.
+                </div>
+            </template>
+        </q-table>
+
+        <LeftNavMenuDialog
+            v-model="showAddDialog"
+            @created="onMenuCreated"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import { inject, onMounted, ref } from "vue"
+import { useRoute, useRouter } from "vue-router"
+import { useQuasar, type QTableProps } from "quasar"
+import { inflect } from "inflection"
+import { useFetch } from "@/composables/ViperFetch"
+import EditButton from "@/CMS/components/EditButton.vue"
+import LeftNavMenuDialog from "@/CMS/components/LeftNavMenuDialog.vue"
+import ListCard from "@/CMS/components/ListCard.vue"
+import ListCardField from "@/CMS/components/ListCardField.vue"
+import ModifiedStamp from "@/CMS/components/ModifiedStamp.vue"
+import type { CmsLeftNavMenu } from "@/CMS/types/"
+
+const apiURL = inject("apiURL") + "cms/left-navs"
+const route = useRoute()
+const router = useRouter()
+const $q = useQuasar()
+const { get, del, createUrlSearchParams } = useFetch()
+
+const menus = ref<CmsLeftNavMenu[]>([])
+const loading = ref(false)
+const showAddDialog = ref(false)
+
+const filters = ref({
+    system: null as string | null,
+    search: "",
+})
+
+const systemOptions = [
+    { label: "All", value: null },
+    { label: "Viper", value: "Viper" },
+    { label: "Public", value: "Public" },
+]
+
+const columns: QTableProps["columns"] = [
+    { name: "menuHeaderText", label: "Menu Header", field: "menuHeaderText", align: "left", sortable: true },
+    { name: "system", label: "System", field: "system", align: "left", sortable: true },
+    { name: "viperSectionPath", label: "VIPER section", field: "viperSectionPath", align: "left", sortable: true },
+    { name: "page", label: "Page", field: "page", align: "left", sortable: true },
+    { name: "friendlyName", label: "Friendly name", field: "friendlyName", align: "left", sortable: true },
+    { name: "items", label: "Items", field: (row: CmsLeftNavMenu) => row.items.length, align: "center" },
+    { name: "modifiedOn", label: "Modified", field: "modifiedOn", align: "left", sortable: true },
+    { name: "actions", label: "Actions", field: "leftNavMenuId", align: "center" },
+]
+
+async function loadMenus() {
+    loading.value = true
+    const params = createUrlSearchParams({
+        system: filters.value.system,
+        search: filters.value.search || null,
+    })
+    const res = await get(apiURL + "?" + params)
+    if (res.success) {
+        menus.value = res.result
+    } else {
+        menus.value = []
+        $q.notify({ type: "negative", message: res.errors?.[0] ?? "Failed to load menus" })
+    }
+    loading.value = false
+}
+
+async function deleteMenu(menu: CmsLeftNavMenu) {
+    const confirmed = await new Promise<boolean>((resolve) => {
+        $q.dialog({
+            title: "Delete Menu",
+            message: `Permanently delete "${menu.menuHeaderText || "(untitled)"}" and its ${menu.items.length} ${inflect("item", menu.items.length)}? This cannot be undone.`,
+            cancel: { label: "Cancel", flat: true },
+            persistent: true,
+            ok: { label: "Delete Menu", color: "negative", unelevated: true },
+        })
+            .onOk(() => resolve(true))
+            .onCancel(() => resolve(false))
+            .onDismiss(() => resolve(false))
+    })
+    if (!confirmed) return
+    const res = await del(apiURL + "/" + menu.leftNavMenuId)
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Failed to delete menu" })
+        return
+    }
+    $q.notify({ type: "positive", message: "Menu deleted" })
+    loadMenus()
+}
+
+function onMenuCreated(leftNavMenuId: number) {
+    // After creating the menu's settings, go to the page to manage its items.
+    void router.push({ name: "CmsLeftNavEdit", params: { id: leftNavMenuId } })
+}
+
+onMounted(() => {
+    // The "Add Left-Nav Menu" nav entry deep-links here with ?add=1 to open the dialog.
+    if (route.query.add === "1") {
+        showAddDialog.value = true
+    }
+    loadMenus()
+})
+</script>
diff --git a/VueApp/src/CMS/pages/ManageLinkCollections.vue b/VueApp/src/CMS/pages/ManageLinkCollections.vue
index a372f7481..7b96f82b0 100644
--- a/VueApp/src/CMS/pages/ManageLinkCollections.vue
+++ b/VueApp/src/CMS/pages/ManageLinkCollections.vue
@@ -1,6 +1,6 @@
 <template>
     <div class="link-collections-page">
-        <h1 class="text-h4 text-primary q-mt-none q-mb-sm">Link Collections</h1>
+        <h1 class="q-mt-none q-mb-sm">Manage Link Collections</h1>
 
         <q-form>
             <div class="row items-center q-mb-md q-col-gutter-sm">
@@ -23,7 +23,7 @@
                     <q-btn
                         color="positive"
                         icon="add"
-                        label="New Collection"
+                        label="Add Collection"
                         no-caps
                         dense
                         class="q-mx-lg q-pr-md"
@@ -50,10 +50,11 @@
         <!-- Create/Edit Dialog -->
         <q-dialog
             v-model="showCollectionDialog"
+            persistent
             aria-labelledby="collection-dialog-title"
-            @hide="cancelCollectionDialog"
+            @keydown.escape="handleCollectionClose"
         >
-            <q-card style="min-width: 350px">
+            <q-card class="dialog-card">
                 <q-card-section class="row items-center q-pb-none">
                     <div
                         id="collection-dialog-title"
@@ -68,7 +69,7 @@
                         round
                         dense
                         aria-label="Close dialog"
-                        v-close-popup
+                        @click="handleCollectionClose"
                     />
                 </q-card-section>
 
@@ -91,6 +92,7 @@
                         <q-input
                             dense
                             v-model="addTag"
+                            label="New tag category"
                             class="col-auto"
                         />
                         <q-btn
@@ -105,76 +107,36 @@
                         />
                     </div>
 
-                    <VueDraggable
+                    <SortableList
                         v-model="draftTags"
-                        :animation="200"
-                        handle=".handle"
-                        class="list-group"
-                        @end="onDragEnd"
+                        item-key="linkCollectionTagCategoryId"
+                        class="q-mt-sm"
+                        move-up-label="Move tag up"
+                        move-down-label="Move tag down"
+                        :announce="announceTag"
                     >
-                        <div
-                            v-for="(element, index) in draftTags"
-                            :key="element.linkCollectionTagCategoryId"
-                            :class="[
-                                'row items-center q-col-gutter-sm',
-                                { 'just-moved': justMovedTagId === element.linkCollectionTagCategoryId },
-                            ]"
-                        >
-                            <div class="col-auto">
-                                <q-icon
-                                    class="handle"
-                                    name="drag_handle"
-                                >
-                                    <q-tooltip>Drag to reorder</q-tooltip>
-                                </q-icon>
-                            </div>
-                            <div class="col">
-                                <q-input
-                                    dense
-                                    readonly
-                                    v-model="element.linkCollectionTagCategory"
-                                />
-                            </div>
-                            <div class="col-auto">
-                                <q-btn
-                                    dense
-                                    flat
-                                    no-caps
-                                    size="sm"
-                                    color="secondary"
-                                    icon="arrow_upward"
-                                    aria-label="Move tag up"
-                                    :disable="index === 0"
-                                    @click="moveTag(index, -1)"
-                                >
-                                    <q-tooltip>Move up</q-tooltip>
-                                </q-btn>
-                                <q-btn
-                                    dense
-                                    flat
-                                    no-caps
-                                    size="sm"
-                                    color="secondary"
-                                    icon="arrow_downward"
-                                    aria-label="Move tag down"
-                                    :disable="index === draftTags.length - 1"
-                                    @click="moveTag(index, 1)"
-                                >
-                                    <q-tooltip>Move down</q-tooltip>
-                                </q-btn>
-                                <q-btn
-                                    flat
-                                    label="Delete"
-                                    dense
-                                    no-caps
-                                    color="negative"
-                                    class="q-ml-lg q-pr-md"
-                                    icon="delete"
-                                    @click="deleteTag(element.linkCollectionTagCategoryId)"
-                                />
-                            </div>
-                        </div>
-                    </VueDraggable>
+                        <template #row="{ item }">
+                            <q-input
+                                dense
+                                readonly
+                                v-model="item.linkCollectionTagCategory"
+                            />
+                        </template>
+                        <template #actions="{ item }">
+                            <q-btn
+                                dense
+                                flat
+                                no-caps
+                                size="sm"
+                                color="negative"
+                                icon="delete"
+                                aria-label="Delete tag category"
+                                @click="deleteTag(item.linkCollectionTagCategoryId)"
+                            >
+                                <q-tooltip>Delete</q-tooltip>
+                            </q-btn>
+                        </template>
+                    </SortableList>
                 </q-card-section>
 
                 <q-card-actions
@@ -211,7 +173,7 @@
                 label="Add Link"
                 @click="showLinkDialog = true"
                 no-caps
-                class="q-pr-md q-mt-sm"
+                class="q-mt-sm q-pr-md"
             />
             <q-dialog
                 v-model="showLinkDialog"
@@ -219,7 +181,7 @@
                 aria-labelledby="link-dialog-title"
                 @keydown.escape="cancelLinkDialog"
             >
-                <q-card style="min-width: 350px">
+                <q-card class="dialog-card">
                     <q-card-section class="row items-center q-pb-none">
                         <div
                             id="link-dialog-title"
@@ -309,6 +271,14 @@
                             />
                         </fieldset>
                     </q-card-section>
+                    <q-card-section
+                        v-if="linkFormError"
+                        class="q-pt-none"
+                    >
+                        <StatusBanner type="error">
+                            {{ linkFormError }}
+                        </StatusBanner>
+                    </q-card-section>
                     <q-card-actions align="right">
                         <q-btn
                             v-if="link.linkId > 0"
@@ -317,7 +287,6 @@
                             dense
                             no-caps
                             color="negative"
-                            class="q-pr-md"
                         />
                         <q-btn
                             label="Save"
@@ -325,7 +294,6 @@
                             dense
                             no-caps
                             color="primary"
-                            class="q-pr-md"
                         />
                     </q-card-actions>
                 </q-card>
@@ -335,131 +303,108 @@
                 id="allLinks"
                 class="q-mt-md"
             >
-                <div class="row link-row header items-center q-col-gutter-sm desktop-only link-grid">
-                    <div class="col-12 col-md-auto">Actions</div>
-                    <div class="col-12 col-md-3 col-lg-2">URL</div>
-                    <div class="col-12 col-md-3 col-lg-2">Title</div>
-                    <div class="col-12 col-md-6 col-lg-4">Description</div>
-                    <div class="col-12 col-lg-3">Tags</div>
-                </div>
-                <VueDraggable
+                <SortableList
                     v-model="links"
-                    :animation="200"
-                    handle=".handle"
-                    @end="linkOrder"
+                    item-key="linkId"
+                    class="links-list"
+                    move-up-label="Move link up"
+                    move-down-label="Move link down"
+                    :announce="announceLink"
+                    @reorder="linkOrder"
                 >
-                    <div
-                        v-for="(element, index) in links"
-                        :key="element.linkId"
-                        :class="[
-                            'row link-row items-start q-col-gutter-sm link-card link-grid',
-                            { 'just-moved': justMovedLinkId === element.linkId },
-                        ]"
-                    >
-                        <div class="col-12 col-md-auto link-actions q-gutter-xs">
-                            <div class="action-buttons">
-                                <q-icon
-                                    class="handle"
-                                    name="drag_handle"
-                                >
-                                    <q-tooltip>Drag to reorder</q-tooltip>
-                                </q-icon>
-                                <q-btn
-                                    dense
-                                    no-caps
-                                    size="sm"
-                                    color="secondary"
-                                    icon="edit"
-                                    aria-label="Edit link"
-                                    @click="clickLink(element)"
-                                >
-                                    <q-tooltip>Edit</q-tooltip>
-                                </q-btn>
-                                <q-btn
-                                    dense
-                                    flat
-                                    no-caps
-                                    size="sm"
-                                    color="secondary"
-                                    icon="arrow_upward"
-                                    aria-label="Move link up"
-                                    :disable="index === 0"
-                                    @click="moveLink(index, -1)"
-                                >
-                                    <q-tooltip>Move up</q-tooltip>
-                                </q-btn>
-                                <q-btn
-                                    dense
-                                    flat
-                                    no-caps
-                                    size="sm"
-                                    color="secondary"
-                                    icon="arrow_downward"
-                                    aria-label="Move link down"
-                                    :disable="index === links.length - 1"
-                                    @click="moveLink(index, 1)"
-                                >
-                                    <q-tooltip>Move down</q-tooltip>
-                                </q-btn>
-                            </div>
-                        </div>
-                        <div class="col-12 col-md-3 col-lg-2 link-field url-field">
-                            <div class="field-label">URL</div>
-                            <div class="link-url">{{ element.url }}</div>
-                        </div>
-                        <div class="col-12 col-md-3 col-lg-2 link-field title-field">
-                            <div class="field-label">Title</div>
-                            <div>{{ element.title }}</div>
+                    <template #header>
+                        <div class="link-grid">
+                            <div>URL</div>
+                            <div>Title</div>
+                            <div>Description</div>
+                            <div>Tags</div>
                         </div>
-                        <div class="col-12 col-md-6 col-lg-4 link-field desc-field">
-                            <div class="field-label">Description</div>
-                            <div>{{ element.description }}</div>
-                        </div>
-                        <div class="col-12 col-lg-3 tag-field">
-                            <template
-                                v-for="tag in collectionTags"
-                                :key="tag.linkCollectionTagCategoryId"
-                            >
-                                <div
-                                    v-if="element.tags !== undefined"
-                                    class="row tag-row q-col-gutter-xs"
+                    </template>
+
+                    <template #row="{ item }">
+                        <div class="link-grid">
+                            <div class="link-field url-field">
+                                <div class="field-label">URL</div>
+                                <div class="link-url">{{ item.url }}</div>
+                            </div>
+                            <div class="link-field title-field">
+                                <div class="field-label">Title</div>
+                                <div>{{ item.title }}</div>
+                            </div>
+                            <div class="link-field desc-field">
+                                <div class="field-label">Description</div>
+                                <div>{{ item.description }}</div>
+                            </div>
+                            <div class="link-field tag-field">
+                                <template
+                                    v-for="tag in collectionTags"
+                                    :key="tag.linkCollectionTagCategoryId"
                                 >
-                                    <div class="tag-row-inner">
-                                        <div class="field-label">{{ tag.linkCollectionTagCategory }}</div>
-                                        <div class="tag-chips">
-                                            <q-chip
-                                                dense
-                                                square
-                                                color="primary"
-                                                text-color="white"
-                                                v-for="t in getTagsForCategory(
-                                                    element,
-                                                    tag.linkCollectionTagCategoryId,
-                                                )"
-                                                :key="tag.linkCollectionTagCategoryId.toString() + ' ' + t.toString()"
-                                                class="q-mr-xs q-mb-xs"
-                                            >
-                                                {{ t }}
-                                            </q-chip>
+                                    <div
+                                        v-if="item.tags !== undefined"
+                                        class="tag-row"
+                                    >
+                                        <div class="tag-row-inner">
+                                            <div class="field-label">{{ tag.linkCollectionTagCategory }}</div>
+                                            <div class="tag-chips">
+                                                <q-chip
+                                                    dense
+                                                    square
+                                                    color="primary"
+                                                    text-color="white"
+                                                    v-for="t in getTagsForCategory(
+                                                        item,
+                                                        tag.linkCollectionTagCategoryId,
+                                                    )"
+                                                    :key="
+                                                        tag.linkCollectionTagCategoryId.toString() + ' ' + t.toString()
+                                                    "
+                                                    class="q-mr-xs q-mb-xs"
+                                                >
+                                                    {{ t }}
+                                                </q-chip>
+                                            </div>
                                         </div>
                                     </div>
-                                </div>
-                            </template>
+                                </template>
+                            </div>
                         </div>
-                    </div>
-                </VueDraggable>
+                    </template>
+
+                    <template #actions="{ item }">
+                        <EditButton
+                            entity-name="link"
+                            @click="clickLink(item)"
+                        />
+                        <q-btn
+                            dense
+                            flat
+                            no-caps
+                            size="sm"
+                            color="negative"
+                            icon="delete"
+                            aria-label="Delete link"
+                            @click="deleteLinkRow(item)"
+                        >
+                            <q-tooltip>Delete</q-tooltip>
+                        </q-btn>
+                    </template>
+                </SortableList>
             </div>
         </template>
     </div>
 </template>
 
 <script setup lang="ts">
-import { ref, inject, watch } from "vue"
+import { ref, inject, computed, watch } from "vue"
 import { useQuasar } from "quasar"
 import type { Ref } from "vue"
-import { VueDraggable } from "vue-draggable-plus"
 import type { LinkCollection, Link, LinkCollectionTagCategory, LinkWithTags } from "@/CMS/types/"
 import { useFetch } from "@/composables/ViperFetch"
+import { useUnsavedChanges } from "@/composables/use-unsaved-changes"
+import EditButton from "@/CMS/components/EditButton.vue"
+import SortableList from "@/components/SortableList.vue"
+import StatusBanner from "@/components/StatusBanner.vue"
 import { isSafeUrl } from "@/CMS/utils/url"
 
 const apiURL = (inject("apiURL") + "cms/linkCollections/") as string
@@ -480,13 +425,41 @@ const draftTags: Ref<LinkCollectionTagCategory[]> = ref([])
 const deletedTagIds: Ref<number[]> = ref([])
 let nextTempTagId = -1
 
+// Guard the collection dialog's editable state (the name plus the staged tag adds,
+// deletes, and reorders) so the X/Escape can't silently discard unsaved tag edits —
+// mirrors the link dialog's unsaved-changes guard on the same page.
+// Iterate the arrays here (map/spread) so the snapshot deep-tracks in-place mutations
+// (SortableList reorder, createTag push, deleteTag splice), not just the ref identity.
+const collectionDialogState = computed(() => ({
+    name: collectionData.value.linkCollection ?? "",
+    draftTags: draftTags.value.map((t) => ({ id: t.linkCollectionTagCategoryId, label: t.linkCollectionTagCategory })),
+    deletedTagIds: [...deletedTagIds.value],
+}))
+const { setInitialState: setCollectionBaseline, confirmClose: confirmCollectionClose } =
+    useUnsavedChanges(collectionDialogState)
+
 const links: Ref<LinkWithTags[]> = ref([])
 const link: Ref<LinkWithTags> = ref({ linkId: 0, url: "", title: "", description: "", tags: {}, sortOrder: 0 })
 const showLinkDialog: Ref<boolean> = ref(false)
 const linkFormRef: Ref<any> = ref(null)
+const linkFormError = ref("")
+const { setInitialState: setLinkBaseline, confirmClose: confirmLinkClose } = useUnsavedChanges(link)
 
-const justMovedLinkId: Ref<number | null> = ref(null)
-const justMovedTagId: Ref<number | null> = ref(null)
+// Capture the dialog's clean baseline whenever it opens, for the unsaved-changes guard.
+watch(showLinkDialog, (open) => {
+    if (open) {
+        linkFormError.value = ""
+        setLinkBaseline()
+    }
+})
+
+function announceLink(item: LinkWithTags, newIndex: number, total: number) {
+    return `Moved ${item.title || "link"} to position ${newIndex + 1} of ${total}`
+}
+
+function announceTag(item: LinkCollectionTagCategory, newIndex: number, total: number) {
+    return `Moved tag ${item.linkCollectionTagCategory} to position ${newIndex + 1} of ${total}`
+}
 
 //collections
 async function loadCollections(preferredId?: number | null) {
@@ -629,9 +602,17 @@ watch(showCollectionDialog, (open) => {
         draftTags.value = collectionId.value === null ? [] : collectionTags.value.map((t) => ({ ...t }))
         deletedTagIds.value = []
         addTag.value = ""
+        // Capture the clean baseline after the staged state is reset, for the guard.
+        setCollectionBaseline()
     }
 })
 
+// X/Escape close: confirm before discarding staged name/tag edits, then clean up.
+async function handleCollectionClose() {
+    if (!(await confirmCollectionClose())) return
+    cancelCollectionDialog()
+}
+
 //links
 async function loadLinks() {
     const { get } = useFetch()
@@ -647,7 +628,7 @@ async function loadLinks() {
 
 function getTagRecord(r: Link) {
     let tags: Record<number, string> = {}
-    for (var lt of r.linkTags || []) {
+    for (const lt of r.linkTags || []) {
         if (tags[lt.linkCollectionTagCategoryId] === undefined) {
             tags[lt.linkCollectionTagCategoryId] = lt.value
         } else {
@@ -673,8 +654,12 @@ function getTagsForCategory(element: LinkWithTags, categoryId: number) {
 }
 
 async function saveLink() {
+    linkFormError.value = ""
     const valid = await linkFormRef.value?.validate()
-    if (!valid) return
+    if (!valid) {
+        linkFormError.value = "Please complete the required fields before saving this link."
+        return
+    }
     const { post, put } = useFetch()
     const isEdit = link.value.linkId !== 0
     let saveRes
@@ -698,13 +683,13 @@ async function saveLink() {
     }
 
     if (!saveRes.success) {
-        $q.notify({ type: "negative", message: `Failed to ${isEdit ? "update" : "create"} link` })
+        linkFormError.value = saveRes.errors?.[0] ?? `Failed to ${isEdit ? "update" : "create"} link`
         return
     }
 
     const tagsRes = await put(apiURL + collectionId.value + "/links/" + link.value.linkId + "/tags", link.value.tags)
     if (!tagsRes.success) {
-        $q.notify({ type: "negative", message: "Link saved but tags failed to update" })
+        linkFormError.value = "Link saved but tags failed to update"
         return
     }
 
@@ -719,9 +704,11 @@ function clickLink(li: LinkWithTags) {
     showLinkDialog.value = true
 }
 
-function cancelLinkDialog() {
+async function cancelLinkDialog() {
+    if (!(await confirmLinkClose())) return
     link.value = { linkId: 0, url: "", title: "", description: "", tags: {}, sortOrder: 0 }
     showLinkDialog.value = false
+    linkFormError.value = ""
     linkFormRef.value?.resetValidation()
 }
 
@@ -745,6 +732,25 @@ async function deleteLink() {
     loadLinks()
 }
 
+// Row-level delete (the dialog keeps its own Delete for the link being edited).
+async function deleteLinkRow(li: LinkWithTags) {
+    const confirmed = await confirmAction(
+        "Delete Link",
+        `This will permanently remove "${li.title}". Continue?`,
+        "Delete Link",
+        "negative",
+    )
+    if (!confirmed) return
+    const { del } = useFetch()
+    const res = await del(apiURL + collectionId.value + "/links/" + li.linkId)
+    if (!res.success) {
+        $q.notify({ type: "negative", message: "Failed to delete link" })
+        return
+    }
+    $q.notify({ type: "positive", message: "Link deleted" })
+    loadLinks()
+}
+
 async function confirmAction(title: string, message: string, okLabel: string, okColor = "primary") {
     return await new Promise<boolean>((resolve) => {
         $q.dialog({
@@ -774,21 +780,10 @@ async function linkOrder() {
     if (!res.success) {
         $q.notify({ type: "negative", message: "Failed to save link order" })
         await loadLinks()
+        return
     }
-}
-
-function moveLink(index: number, direction: -1 | 1) {
-    const newIndex = index + direction
-    if (newIndex < 0 || newIndex >= links.value.length) return
-    const item = links.value[index]
-    if (item === undefined) return
-    links.value.splice(index, 1)
-    links.value.splice(newIndex, 0, item)
-    justMovedLinkId.value = item.linkId
-    setTimeout(() => {
-        if (justMovedLinkId.value === item.linkId) justMovedLinkId.value = null
-    }, 600)
-    void linkOrder()
+    // Reorder persists immediately; confirm it. `group` collapses rapid nudges into one toast.
+    $q.notify({ type: "positive", message: "Order saved", group: "link-order", timeout: 1500 })
 }
 
 //tags
@@ -822,23 +817,6 @@ function deleteTag(tagId: number) {
     draftTags.value.splice(idx, 1)
 }
 
-function onDragEnd() {
-    // No-op: draft reorders commit on Save.
-}
-
-function moveTag(index: number, direction: -1 | 1) {
-    const newIndex = index + direction
-    if (newIndex < 0 || newIndex >= draftTags.value.length) return
-    const item = draftTags.value[index]
-    if (item === undefined) return
-    draftTags.value.splice(index, 1)
-    draftTags.value.splice(newIndex, 0, item)
-    justMovedTagId.value = item.linkCollectionTagCategoryId
-    setTimeout(() => {
-        if (justMovedTagId.value === item.linkCollectionTagCategoryId) justMovedTagId.value = null
-    }, 600)
-}
-
 watch(collectionId, () => {
     loadLinks()
     loadTags()
@@ -850,43 +828,24 @@ loadCollections()
 </script>
 
 <style scoped>
-#allLinks {
-    background: #fff;
-    border-radius: 6px;
-    box-shadow: 0 1px 3px rgb(0 0 0 / 8%);
-}
-
-#allLinks .link-row {
-    border-bottom: 1px solid silver;
-    margin-bottom: 4px;
-    padding: 8px 12px;
-    align-items: flex-start;
-    border-radius: 6px;
-}
-
-#allLinks .link-row.header {
-    font-weight: bold;
-    background: #f5f7fb;
-    color: var(--q-primary);
-    border-radius: 6px;
-    text-align: left;
+.dialog-card {
+    min-width: 21.875rem;
+    max-width: 95vw;
 }
 
-#allLinks .link-row.header > div {
-    text-align: left;
+#allLinks {
+    background: var(--surface);
+    border: 1px solid var(--ucdavis-black-10);
+    border-radius: 0.25rem;
+    padding: 0.5rem 0.75rem;
 }
 
-#allLinks .link-url {
+.link-url {
     white-space: normal;
     word-break: break-word;
     overflow-wrap: anywhere;
 }
 
-.tag-label {
-    color: var(--q-primary);
-    white-space: nowrap;
-}
-
 .tag-row-inner {
     display: flex;
     flex-direction: column;
@@ -894,47 +853,50 @@ loadCollections()
     gap: 0;
     width: 100%;
     text-align: left;
-    margin-bottom: 6px;
+    margin-bottom: 0.375rem;
 }
 
 .tag-chips {
     display: flex;
     flex-wrap: wrap;
-    gap: 4px;
+    gap: 0.25rem;
     max-width: 100%;
 }
 
-.mobile-only {
-    display: block;
-    color: var(--q-primary);
+.field-label {
     font-weight: 600;
-    width: 100%;
+    color: var(--q-primary);
+    margin-bottom: 0;
 }
 
-.link-actions {
-    display: flex;
-    align-items: center;
+.link-field {
+    word-break: break-word;
+    min-width: 0;
 }
 
-.action-buttons {
-    display: inline-flex;
-    flex-wrap: wrap;
-    align-items: center;
-    gap: 6px;
+.tag-row {
+    margin-bottom: 0.25rem;
 }
 
-.handle {
-    cursor: grab;
+/* The column header only reads as one once the fields line up in a grid (desktop). */
+.links-list :deep(.sortable-row--header) {
+    display: none;
+    font-weight: bold;
+    color: var(--q-primary);
 }
 
-.handle:active {
-    cursor: grabbing;
+/* Card-per-row on small and medium screens. */
+.links-list :deep(.sortable-row) {
+    border: 1px solid var(--ucdavis-black-10);
+    border-radius: 0.25rem;
+    padding: 0.75rem;
+    background: var(--surface-tint-raised);
 }
 
-@media screen and (prefers-reduced-motion: reduce) {
-    .reorder-move {
-        transition: none;
-    }
+/* Four actions here (up/down/edit/delete) at touch size; widen the gutter so the
+   header columns still line up with the rows. */
+.links-list :deep(.sortable-row__controls) {
+    min-width: 10rem;
 }
 
 .required-field :deep(.q-field__label)::after {
@@ -942,33 +904,9 @@ loadCollections()
     color: var(--q-negative);
 }
 
-.link-form :deep(.q-field--error .q-field__bottom) {
-    padding-top: 0.25rem;
-}
-
-.link-form :deep(.q-field--error .q-field__messages) {
-    display: inline-flex;
-    align-items: center;
-    background: var(--q-negative);
-    color: white;
-    flex: none;
-    width: fit-content;
-    padding: 0.125rem 0.5rem 0.125rem 0.25rem;
-    border-radius: 1rem;
-    font-size: 0.75rem;
-    gap: 0.125rem;
-}
-
-.link-form :deep(.q-field--error .q-field__messages)::before {
-    content: "error";
-    font-family: "Material Icons";
-    font-size: 1rem;
-    line-height: 1;
-}
-
 .tags-fieldset {
     border: 1px solid var(--q-primary);
-    border-radius: 4px;
+    border-radius: 0.25rem;
     padding: 0.75rem 1rem 0.25rem;
 }
 
@@ -977,153 +915,49 @@ loadCollections()
     font-weight: 500;
 }
 
-@keyframes just-moved-flash {
-    0% {
-        background-color: var(--q-secondary);
-    }
-
-    100% {
-        background-color: transparent;
-    }
-}
-
-@media screen and (prefers-reduced-motion: reduce) {
-    .just-moved {
-        animation: none;
-    }
-}
-
-.just-moved {
-    animation: just-moved-flash 0.6s ease-out;
-}
-
-.desktop-only {
-    display: none;
-}
-
-.desktop-only-inline {
-    display: none;
-}
-
-.field-label {
-    font-weight: 600;
-    color: var(--q-primary);
-    margin-bottom: 0;
-}
-
-.link-field {
-    word-break: break-word;
-    min-width: 0;
-}
-
-.link-card {
-    border: 1px solid #e5e7eb;
-    border-radius: 8px;
-    margin-bottom: 12px;
-    background: #fafbff;
-    padding: 12px 12px 8px;
-}
-
-.desktop-only .tag-chips {
-    justify-content: flex-start;
-}
-
-@media (width <= 1023px) {
-    #allLinks .link-row {
-        border-radius: 6px;
-        border-color: #e6e8ef;
-        padding: 12px 12px 8px;
-    }
-
-    .link-actions {
-        margin-bottom: 6px;
-    }
-
-    .tag-row {
-        margin-bottom: 4px;
-    }
-}
-
 @media (width >= 1024px) {
-    .desktop-only {
-        display: flex;
-    }
-
-    .desktop-only-inline {
-        display: inline;
-    }
-
-    .mobile-only {
-        display: none;
-    }
-
-    .link-row.link-grid {
+    /* Tabular layout: four aligned columns, labels in the header row instead of per field. */
+    .link-grid {
         display: grid;
-        grid-template-columns: 70px 2.5fr 1.2fr 2.5fr 1.5fr;
-        column-gap: 12px;
-        align-items: stretch;
+        grid-template-columns: 2.5fr 1.2fr 2.5fr 1.5fr;
+        column-gap: 0.75rem;
+        align-items: start;
     }
 
-    .link-row.link-grid > div {
-        justify-self: stretch;
-        width: 100%;
-        min-width: 0;
+    .links-list :deep(.sortable-row--header) {
+        display: flex;
     }
 
-    .link-row.header {
-        align-items: center;
+    .links-list :deep(.sortable-list__items) {
+        gap: 0;
     }
 
-    .link-card {
+    .links-list :deep(.sortable-row) {
         border: none;
+        border-bottom: 1px solid var(--ucdavis-black-10);
+        border-radius: 0;
+        padding: 0.5rem 0;
         background: transparent;
-        margin-bottom: 0;
-        padding: 8px 0;
-    }
-
-    .url-field .link-url {
-        max-width: 100%;
-        white-space: normal;
-        word-break: break-word;
-        overflow-wrap: anywhere;
     }
 
-    .title-field {
-        min-width: 140px;
-    }
-
-    .desc-field {
-        min-width: 200px;
-    }
-
-    .url-field {
-        min-width: 360px;
-    }
-
-    .tag-field {
-        overflow-wrap: anywhere;
-        max-width: 100%;
-        min-width: 0;
-        word-break: break-word;
-    }
-
-    .field-label {
-        display: none;
+    /* The visual column header is aria-hidden, so keep the URL/Title/Description labels
+       in the a11y tree (visually hidden) instead of display:none, so screen readers
+       still announce which value is which. Tag-category labels stay visible. */
+    .link-field:not(.tag-field) .field-label {
+        position: absolute;
+        width: 1px;
+        height: 1px;
+        overflow: hidden;
+        clip-path: inset(50%);
+        white-space: nowrap;
     }
 
     .tag-field .field-label {
         display: block;
     }
 
-    .link-actions {
-        flex-direction: row;
-        gap: 6px;
-        margin-bottom: 0;
-    }
-
     .tag-row {
-        margin-bottom: 6px;
-        align-items: flex-start;
+        margin-bottom: 0.375rem;
     }
 }
 </style>
diff --git a/VueApp/src/CMS/router/index.ts b/VueApp/src/CMS/router/index.ts
index 295dc9e7e..94a0fd030 100644
--- a/VueApp/src/CMS/router/index.ts
+++ b/VueApp/src/CMS/router/index.ts
@@ -1,5 +1,5 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
-import { routes } from "./routes"
+import { createSpaRouter } from "@/shared/create-spa-router"
+import { routes, cmsHomePermissions } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 import { checkHasOnePermission } from "@/composables/CheckPagePermission"
 
@@ -17,6 +17,14 @@ router.beforeEach(async (to) => {
             return { name: "CmsAuth" }
         }
     }
+    // Canonicalize the area root for CMS users so the left nav "Home" link
+    // highlights; unauthenticated and permission-less visitors stay on the
+    // CmsAuth landing (redirecting them would force a login or loop). Gate on
+    // the same set as the CmsHome route so granular-only users (no base
+    // SVMSecure.CMS) canonicalize too, instead of being stranded on /CMS/.
+    if (to.name === "CmsAuth" && checkHasOnePermission(cmsHomePermissions)) {
+        return { name: "CmsHome" }
+    }
 })
 
 export { router as cmsRouter }
diff --git a/VueApp/src/CMS/router/routes.ts b/VueApp/src/CMS/router/routes.ts
index 1e37436ac..2c4febff3 100644
--- a/VueApp/src/CMS/router/routes.ts
+++ b/VueApp/src/CMS/router/routes.ts
@@ -1,4 +1,17 @@
 import ViperLayout from "@/layouts/ViperLayout.vue"
+import type { RouteLocationNormalized } from "vue-router"
+import { checkHasOnePermission } from "@/composables/CheckPagePermission"
+
+// Granular CMS permissions that grant the Home hub. The hub adapts to whichever of these the user
+// holds, and CmsNavMenu links it for any of them, so the Home route guard and the area-root
+// canonicalization (router/index.ts) gate on this one shared set rather than two lists that drift.
+const cmsHomePermissions = [
+    "SVMSecure.CMS",
+    "SVMSecure.CMS.ManageContentBlocks",
+    "SVMSecure.CMS.CreateContentBlock",
+    "SVMSecure.CMS.AllFiles",
+    "SVMSecure.CMS.ManageNavigation",
+]
 
 const routes = [
     {
@@ -9,7 +22,10 @@ const routes = [
     },
     {
         path: "/CMS/Home",
-        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS"] },
+        meta: {
+            layout: ViperLayout,
+            permissions: cmsHomePermissions,
+        },
         component: () => import("@/CMS/pages/CmsHome.vue"),
         name: "CmsHome",
     },
@@ -19,6 +35,70 @@ const routes = [
         meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.ManageContentBlocks"] },
         component: () => import("@/CMS/pages/ManageLinkCollections.vue"),
     },
+    {
+        // Not /CMS/Files: that path is the MVC download handler (CMSController.Files),
+        // which takes precedence over the SPA shell.
+        path: "/CMS/ManageFiles",
+        name: "CmsFiles",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.AllFiles"] },
+        component: () => import("@/CMS/pages/Files.vue"),
+    },
+    {
+        path: "/CMS/ManageFiles/Audit",
+        name: "CmsFileAudit",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.AllFiles"] },
+        component: () => import("@/CMS/pages/FileAuditLog.vue"),
+    },
+    {
+        path: "/CMS/ManageFiles/Import",
+        name: "CmsFileImport",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.AllFiles"] },
+        component: () => import("@/CMS/pages/ImportFiles.vue"),
+    },
+    {
+        path: "/CMS/ManageFiles/BulkEncrypt",
+        name: "CmsBulkEncrypt",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.AllFiles"] },
+        component: () => import("@/CMS/pages/BulkEncrypt.vue"),
+    },
+    {
+        path: "/CMS/ManageContentBlocks",
+        name: "CmsContentBlocks",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.ManageContentBlocks"] },
+        component: () => import("@/CMS/pages/ContentBlocks.vue"),
+    },
+    {
+        path: "/CMS/ManageContentBlocks/History",
+        name: "CmsContentBlockHistory",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.ManageContentBlocks"] },
+        component: () => import("@/CMS/pages/ContentBlockHistory.vue"),
+    },
+    {
+        path: "/CMS/ManageContentBlocks/Edit/:id?",
+        name: "CmsContentBlockEdit",
+        // CreateContentBlock-only users may create via this route (no id);
+        // editing an existing block requires ManageContentBlocks, matching
+        // the API, which gates GET/PUT of existing blocks the same way.
+        meta: {
+            layout: ViperLayout,
+            permissions: ["SVMSecure.CMS.ManageContentBlocks", "SVMSecure.CMS.CreateContentBlock"],
+        },
+        beforeEnter: (to: RouteLocationNormalized) =>
+            !to.params.id || checkHasOnePermission(["SVMSecure.CMS.ManageContentBlocks"]) ? true : { name: "CmsAuth" },
+        component: () => import("@/CMS/pages/ContentBlockEdit.vue"),
+    },
+    {
+        path: "/CMS/ManageLeftNav",
+        name: "CmsLeftNavMenus",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.ManageNavigation"] },
+        component: () => import("@/CMS/pages/LeftNavMenus.vue"),
+    },
+    {
+        path: "/CMS/ManageLeftNav/Edit/:id?",
+        name: "CmsLeftNavEdit",
+        meta: { layout: ViperLayout, permissions: ["SVMSecure.CMS.ManageNavigation"] },
+        component: () => import("@/CMS/pages/LeftNavEdit.vue"),
+    },
     {
         path: "/:catchAll(.*)*",
         meta: { layout: ViperLayout },
@@ -26,4 +106,4 @@ const routes = [
     },
 ]
 
-export { routes }
+export { routes, cmsHomePermissions }
diff --git a/VueApp/src/CMS/types/index.ts b/VueApp/src/CMS/types/index.ts
index 8a2dedfe5..d5c4d1ac9 100644
--- a/VueApp/src/CMS/types/index.ts
+++ b/VueApp/src/CMS/types/index.ts
@@ -4,6 +4,144 @@ type ContentBlock = {
     title: string | null
 }
 
+type CmsFile = {
+    fileGuid: string
+    fileName: string
+    folder: string | null
+    friendlyName: string
+    encrypted: boolean
+    description: string
+    allowPublicAccess: boolean
+    oldUrl: string | null
+    modifiedOn: string
+    modifiedBy: string
+    deletedOn: string | null
+    purgeOn: string | null
+    permissions: string[]
+    people: CmsFilePerson[]
+    url: string
+    friendlyUrl: string
+}
+
+type CmsFilePerson = {
+    iamId: string
+    name: string | null
+}
+
+type CmsPersonOption = {
+    iamId: string
+    name: string
+    loginId: string | null
+    mailId: string | null
+}
+
+type CmsContentBlock = {
+    contentBlockId: number
+    content: string
+    title: string | null
+    system: string
+    application: string | null
+    page: string | null
+    viperSectionPath: string | null
+    blockOrder: number | null
+    friendlyName: string | null
+    allowPublicAccess: boolean
+    modifiedOn: string
+    modifiedBy: string
+    deletedOn: string | null
+    permissions: string[]
+    files: CmsContentBlockFile[]
+}
+
+type CmsContentBlockFile = {
+    fileGuid: string
+    friendlyName: string
+    url: string
+}
+
+type CmsContentHistoryItem = {
+    contentHistoryId: number
+    modifiedOn: string | null
+    modifiedBy: string | null
+}
+
+type CmsContentHistoryDiff = {
+    content: string
+    hasComparison: boolean
+    hasChanges: boolean
+    oldModifiedOn: string | null
+    oldModifiedBy: string | null
+    newModifiedOn: string | null
+    newModifiedBy: string | null
+}
+
+// One row in the hub's recent-activity rail, normalized across sources (blocks, files,
+// trashed files, left-nav menus); actions are the per-row shortcuts (history, audit, diff).
+type RailAction = {
+    icon: string
+    label: string
+    to?: { name: string; query?: Record<string, string> }
+    run?: () => void
+}
+
+type ActivityItem = {
+    key: string
+    icon: string
+    typeLabel: string
+    // Rendered before the time-ago stamp (e.g. "deleted 2 days ago"); empty means plain recency.
+    verb?: string
+    label: string
+    to: { name: string; params?: Record<string, string | number>; query?: Record<string, string> }
+    modifiedOn: string
+    modifiedBy: string
+    actions?: RailAction[]
+}
+
+type CmsLeftNavMenu = {
+    leftNavMenuId: number
+    menuHeaderText: string | null
+    system: string
+    viperSectionPath: string | null
+    page: string | null
+    friendlyName: string | null
+    modifiedOn: string
+    modifiedBy: string
+    items: CmsLeftNavItem[]
+}
+
+type CmsLeftNavItem = {
+    leftNavItemId: number
+    menuItemText: string | null
+    isHeader: boolean
+    url: string | null
+    displayOrder: number | null
+    permissions: string[]
+}
+
+type CmsFileAudit = {
+    auditId: number
+    timestamp: string
+    loginid: string | null
+    action: string
+    detail: string | null
+    fileGuid: string | null
+    filePath: string | null
+    iamId: string | null
+    fileMetaData: string | null
+    clientData: string | null
+}
+
+type CmsContentHistoryAudit = {
+    contentHistoryId: number
+    contentBlockId: number
+    title: string | null
+    friendlyName: string | null
+    page: string | null
+    modifiedOn: string | null
+    modifiedBy: string | null
+    blockDeleted: boolean
+}
+
 type LinkCollection = {
     linkCollectionId: number
     linkCollection: string
@@ -49,4 +187,24 @@ type LinkWithTags = {
     sortOrder: number
 }
 
-export type { ContentBlock, LinkCollection, LinkCollectionTagCategory, Link, LinkTag, LinkTagFilter, LinkWithTags }
+export type {
+    ContentBlock,
+    CmsContentBlock,
+    CmsContentBlockFile,
+    CmsContentHistoryItem,
+    CmsLeftNavMenu,
+    CmsFile,
+    CmsFilePerson,
+    CmsPersonOption,
+    CmsFileAudit,
+    CmsContentHistoryAudit,
+    CmsContentHistoryDiff,
+    RailAction,
+    ActivityItem,
+    LinkCollection,
+    LinkCollectionTagCategory,
+    Link,
+    LinkTag,
+    LinkTagFilter,
+    LinkWithTags,
+}
diff --git a/VueApp/src/CTS/router/index.ts b/VueApp/src/CTS/router/index.ts
index 6fc5aa690..44c1bc531 100644
--- a/VueApp/src/CTS/router/index.ts
+++ b/VueApp/src/CTS/router/index.ts
@@ -1,4 +1,4 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
+import { createSpaRouter } from "@/shared/create-spa-router"
 import { routes } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 import { checkHasOnePermission } from "@/composables/CheckPagePermission"
diff --git a/VueApp/src/ClinicalScheduler/router/index.ts b/VueApp/src/ClinicalScheduler/router/index.ts
index 67e72260b..96ea4d5ae 100644
--- a/VueApp/src/ClinicalScheduler/router/index.ts
+++ b/VueApp/src/ClinicalScheduler/router/index.ts
@@ -1,4 +1,4 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
+import { createSpaRouter } from "@/shared/create-spa-router"
 import { clinicalSchedulerRoutes as routes } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 
diff --git a/VueApp/src/Computing/router/index.ts b/VueApp/src/Computing/router/index.ts
index f31cc266c..95d689f67 100644
--- a/VueApp/src/Computing/router/index.ts
+++ b/VueApp/src/Computing/router/index.ts
@@ -1,4 +1,4 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
+import { createSpaRouter } from "@/shared/create-spa-router"
 import { routes } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 
diff --git a/VueApp/src/Effort/components/EffortLeftNav.vue b/VueApp/src/Effort/components/EffortLeftNav.vue
index 08e04a905..2ae261327 100644
--- a/VueApp/src/Effort/components/EffortLeftNav.vue
+++ b/VueApp/src/Effort/components/EffortLeftNav.vue
@@ -13,6 +13,7 @@
         <div
             class="q-pa-sm"
             id="leftNavMenu"
+            tabindex="-1"
         >
             <q-btn
                 dense
diff --git a/VueApp/src/Effort/pages/AuditList.vue b/VueApp/src/Effort/pages/AuditList.vue
index 7574edd91..5468746f9 100644
--- a/VueApp/src/Effort/pages/AuditList.vue
+++ b/VueApp/src/Effort/pages/AuditList.vue
@@ -9,7 +9,7 @@
             label="Filters"
             header-class="bg-grey-2 lt-md"
             :header-style="$q.screen.gt.sm ? 'display: none' : ''"
-            class="q-mb-md"
+            class="q-mb-sm"
         >
             <q-card flat>
                 <q-card-section :class="$q.screen.gt.sm ? 'q-pa-none' : ''">
@@ -77,15 +77,6 @@
                                 @filter="filterInstructors"
                             />
                         </div>
-                        <div :class="$q.screen.gt.sm ? 'col-12 col-md-6 col-lg-3' : 'col-12'">
-                            <q-input
-                                v-model="filter.searchText"
-                                label="Search Changes"
-                                dense
-                                outlined
-                                clearable
-                            />
-                        </div>
                         <div :class="$q.screen.gt.sm ? 'col-12 col-md-6 col-lg-3' : 'col-6'">
                             <q-input
                                 v-model="filter.dateFrom"
@@ -133,21 +124,36 @@
                             />
                         </div>
                     </div>
-                    <div class="row q-mt-sm">
-                        <div class="col-12 text-right">
-                            <q-btn
-                                label="Clear Filters"
-                                color="secondary"
-                                dense
-                                flat
-                                @click="clearFilter"
-                            />
-                        </div>
-                    </div>
                 </q-card-section>
             </q-card>
         </q-expansion-item>
 
+        <!-- Search box and clear-filters on their own row above the table, matching the CMS audit trail -->
+        <div class="row items-center q-mb-sm">
+            <div class="col-12 col-sm-4 col-lg-3">
+                <q-input
+                    v-model="filter.searchText"
+                    label="Search changes"
+                    dense
+                    outlined
+                    clearable
+                    hide-bottom-space
+                >
+                    <template #prepend>
+                        <q-icon name="search" />
+                    </template>
+                </q-input>
+            </div>
+            <q-space />
+            <q-btn
+                label="Clear Filters"
+                color="secondary"
+                dense
+                flat
+                @click="clearFilter"
+            />
+        </div>
+
         <!-- Results Table - Desktop view (lg and up) -->
         <q-table
             v-if="$q.screen.gt.md"
diff --git a/VueApp/src/Effort/router/index.ts b/VueApp/src/Effort/router/index.ts
index c88cfaf20..5a10ec945 100644
--- a/VueApp/src/Effort/router/index.ts
+++ b/VueApp/src/Effort/router/index.ts
@@ -1,4 +1,4 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
+import { createSpaRouter } from "@/shared/create-spa-router"
 import { effortRoutes as routes } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 import { checkHasOnePermission } from "@/composables/CheckPagePermission"
diff --git a/VueApp/src/Students/router/index.ts b/VueApp/src/Students/router/index.ts
index 9ce0ec118..f7d428856 100644
--- a/VueApp/src/Students/router/index.ts
+++ b/VueApp/src/Students/router/index.ts
@@ -1,4 +1,4 @@
-import { createSpaRouter } from "@/shared/createSpaRouter"
+import { createSpaRouter } from "@/shared/create-spa-router"
 import { routes } from "./routes"
 import { useRequireLogin } from "@/composables/RequireLogin"
 import { checkHasOnePermission } from "@/composables/CheckPagePermission"
diff --git a/VueApp/src/components/BreadcrumbHeading.vue b/VueApp/src/components/BreadcrumbHeading.vue
new file mode 100644
index 000000000..e3d238adc
--- /dev/null
+++ b/VueApp/src/components/BreadcrumbHeading.vue
@@ -0,0 +1,19 @@
+<template>
+    <h1 class="q-ma-none q-mb-md">
+        <router-link :to="parentTo">{{ parentLabel }}</router-link>
+        <span aria-hidden="true"> / </span>
+        {{ label }}
+    </h1>
+</template>
+
+<script setup lang="ts">
+import type { RouteLocationRaw } from "vue-router"
+
+// Breadcrumb-style page heading for subpages: the parent crumb links back, the
+// current page is plain text. Link styling comes from base.css (h1 a rules).
+defineProps<{
+    label: string
+    parentLabel: string
+    parentTo: RouteLocationRaw
+}>()
+</script>
diff --git a/VueApp/src/components/SortableList.vue b/VueApp/src/components/SortableList.vue
new file mode 100644
index 000000000..1d48d0c7b
--- /dev/null
+++ b/VueApp/src/components/SortableList.vue
@@ -0,0 +1,346 @@
+<template>
+    <div
+        ref="listEl"
+        class="sortable-list"
+    >
+        <div
+            v-if="$slots.header"
+            class="sortable-row sortable-row--header"
+            aria-hidden="true"
+        >
+            <span class="sortable-row__handle" />
+            <div class="sortable-row__body">
+                <slot name="header" />
+            </div>
+            <div class="sortable-row__controls" />
+        </div>
+
+        <VueDraggable
+            v-model="model"
+            :animation="200"
+            :disabled="disabled"
+            handle=".sortable-row__handle"
+            ghost-class="sortable-row--ghost"
+            class="sortable-list__items"
+            @end="onDragEnd"
+        >
+            <div
+                v-for="(item, index) in model"
+                :key="keyOf(item)"
+                class="sortable-row"
+                :class="[rowClass?.(item, index), { 'sortable-row--moved': keyOf(item) === justMovedKey }]"
+            >
+                <span
+                    class="sortable-row__handle"
+                    :class="{ 'sortable-row__handle--disabled': disabled }"
+                    aria-hidden="true"
+                >
+                    <q-icon name="drag_handle" />
+                    <q-tooltip v-if="!disabled">{{ handleLabel }}</q-tooltip>
+                </span>
+
+                <div class="sortable-row__body">
+                    <slot
+                        name="row"
+                        :item="item"
+                        :index="index"
+                    />
+                </div>
+
+                <div class="sortable-row__controls">
+                    <q-btn
+                        dense
+                        flat
+                        no-caps
+                        size="sm"
+                        color="secondary"
+                        icon="arrow_upward"
+                        :aria-label="moveUpLabel"
+                        :disable="index === 0"
+                        @click="onMoveUp(index)"
+                    >
+                        <q-tooltip>{{ moveUpLabel }}</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                        dense
+                        flat
+                        no-caps
+                        size="sm"
+                        color="secondary"
+                        icon="arrow_downward"
+                        :aria-label="moveDownLabel"
+                        :disable="index === model.length - 1"
+                        @click="onMoveDown(index)"
+                    >
+                        <q-tooltip>{{ moveDownLabel }}</q-tooltip>
+                    </q-btn>
+                    <slot
+                        name="actions"
+                        :item="item"
+                        :index="index"
+                    />
+                </div>
+            </div>
+        </VueDraggable>
+
+        <slot
+            v-if="model.length === 0"
+            name="empty"
+        />
+
+        <!-- Screen readers hear the result of every reorder; the drag handle is a
+             mouse/touch affordance, so non-visual users rely on the move buttons + this. -->
+        <div
+            class="sr-only"
+            role="status"
+            aria-live="polite"
+        >
+            {{ announcement }}
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts" generic="T extends Record<string, any>">
+import { nextTick, ref } from "vue"
+import { usePreferredReducedMotion } from "@vueuse/core"
+import { VueDraggable } from "vue-draggable-plus"
+import { useReorder, type ReorderKey } from "@/composables/use-reorder"
+
+const model = defineModel<T[]>({ required: true })
+
+const {
+    itemKey,
+    disabled = false,
+    handleLabel = "Drag to reorder",
+    moveUpLabel = "Move up",
+    moveDownLabel = "Move down",
+    rowClass = undefined,
+    announce = undefined,
+} = defineProps<{
+    /** Field name or getter for each item's stable, unique key. */
+    itemKey: keyof T | ((item: T) => ReorderKey)
+    disabled?: boolean
+    handleLabel?: string
+    moveUpLabel?: string
+    moveDownLabel?: string
+    /** Extra class(es) per row, e.g. to tint a section header. */
+    rowClass?: (item: T, index: number) => unknown
+    /** Builds the screen-reader announcement after a move. */
+    announce?: (item: T, newIndex: number, total: number) => string
+}>()
+
+const emit = defineEmits<{
+    reorder: [item: T, newIndex: number, oldIndex: number]
+}>()
+
+defineSlots<{
+    /** Optional column-header row, aligned to the row bodies below. */
+    header?: () => unknown
+    /** Per-row content. */
+    row: (props: { item: T; index: number }) => unknown
+    /** Per-row actions (edit, delete) placed after the move buttons. */
+    actions?: (props: { item: T; index: number }) => unknown
+    /** Shown in place of the list when it is empty. */
+    empty?: () => unknown
+}>()
+
+function keyOf(item: T): ReorderKey {
+    return typeof itemKey === "function" ? itemKey(item) : (item[itemKey] as ReorderKey)
+}
+
+const announcement = ref("")
+function announceMove(item: T, newIndex: number) {
+    const text = announce
+        ? announce(item, newIndex, model.value.length)
+        : `Moved to position ${newIndex + 1} of ${model.value.length}`
+    // Clear first so an identical message (e.g. nudged back to the same spot) re-announces.
+    announcement.value = ""
+    void nextTick(() => {
+        announcement.value = text
+    })
+}
+
+const { justMovedKey, moveUp, moveDown, commitDrag } = useReorder<T>(model, {
+    getKey: keyOf,
+    onReorder: (item, newIndex, oldIndex) => {
+        announceMove(item, newIndex)
+        emit("reorder", item, newIndex, oldIndex)
+    },
+})
+
+function onDragEnd(evt: { oldIndex?: number; newIndex?: number }) {
+    if (evt.oldIndex === undefined || evt.newIndex === undefined) {
+        return
+    }
+    commitDrag(evt.oldIndex, evt.newIndex)
+}
+
+// Drag reorders animate via SortableJS (:animation); button reorders jump instantly,
+// so FLIP them — capture positions, reorder, then slide each moved row from where it
+// was to where it landed. Makes the change easy to follow without watching closely.
+const listEl = ref<HTMLElement>()
+const reducedMotion = usePreferredReducedMotion()
+const SLIDE_MS = 300
+
+function rowElements(): HTMLElement[] {
+    const container = listEl.value?.querySelector(".sortable-list__items")
+    return container ? (Array.from(container.children) as HTMLElement[]) : []
+}
+
+function animateReorder(reorder: () => void) {
+    if (reducedMotion.value === "reduce") {
+        reorder()
+        return
+    }
+    const startTops = new Map(rowElements().map((el) => [el, el.getBoundingClientRect().top]))
+    reorder()
+    void nextTick(() => {
+        for (const el of rowElements()) {
+            const startTop = startTops.get(el)
+            if (startTop === undefined) {
+                continue
+            }
+            const delta = startTop - el.getBoundingClientRect().top
+            if (delta === 0) {
+                continue
+            }
+            el.style.transition = "none"
+            el.style.transform = `translateY(${delta}px)`
+            requestAnimationFrame(() => {
+                el.style.transition = `transform ${SLIDE_MS}ms cubic-bezier(0.22, 1, 0.36, 1)`
+                el.style.transform = ""
+            })
+            el.addEventListener(
+                "transitionend",
+                () => {
+                    el.style.transition = ""
+                    el.style.transform = ""
+                },
+                { once: true },
+            )
+        }
+    })
+}
+
+function onMoveUp(index: number) {
+    animateReorder(() => moveUp(index))
+}
+
+function onMoveDown(index: number) {
+    animateReorder(() => moveDown(index))
+}
+</script>
+
+<style scoped>
+.sortable-list__items {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+}
+
+.sortable-row {
+    display: flex;
+    align-items: flex-start;
+    gap: 0.5rem;
+    border-radius: 0.25rem;
+}
+
+.sortable-row--header {
+    align-items: center;
+}
+
+.sortable-row__handle {
+    flex: 0 0 auto;
+    width: 1.75rem;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    padding-top: 0.375rem;
+    color: var(--ucdavis-black-60);
+    cursor: grab;
+}
+
+.sortable-row--header .sortable-row__handle {
+    padding-top: 0;
+}
+
+.sortable-row__handle:active {
+    cursor: grabbing;
+}
+
+.sortable-row__handle--disabled {
+    visibility: hidden;
+}
+
+.sortable-row__body {
+    flex: 1 1 auto;
+    min-width: 0;
+}
+
+.sortable-row__controls {
+    flex: 0 0 auto;
+    min-width: 7.5rem;
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    gap: 0.25rem;
+    padding-top: 0.125rem;
+}
+
+/* Comfortable touch targets for the reorder + row-action buttons (up/down and any
+   edit/delete in the actions slot). 23px dense buttons miss the 24px minimum. */
+.sortable-row__controls :deep(.q-btn) {
+    min-width: 2.25rem;
+    min-height: 2.25rem;
+}
+
+.sortable-row--header .sortable-row__controls {
+    padding-top: 0;
+}
+
+.sortable-row--ghost {
+    opacity: 0.5;
+    background: var(--surface-tint);
+}
+
+/* "Just moved" cue: a brand-blue tint and ring that fade out. It is a colour/shadow
+   fade (no movement), so it also plays under reduced motion — where the slide is
+   skipped — keeping a clear signal that something changed. */
+@keyframes sortable-row-flash {
+    0% {
+        background-color: var(--ucdavis-blue-10);
+        box-shadow: inset 0 0 0 0.125rem var(--q-primary);
+    }
+
+    100% {
+        background-color: transparent;
+        box-shadow: inset 0 0 0 0.125rem transparent;
+    }
+}
+
+.sortable-row--moved {
+    animation: sortable-row-flash 1s ease-out;
+}
+
+/* On phones the row becomes a stacked card: handle + controls share a top bar,
+   the body drops to its own full-width line below. */
+@media (width <= 599px) {
+    .sortable-row {
+        flex-wrap: wrap;
+    }
+
+    .sortable-row__handle {
+        order: 1;
+    }
+
+    .sortable-row__controls {
+        order: 2;
+        margin-left: auto;
+    }
+
+    .sortable-row__body {
+        order: 3;
+        flex: 1 1 100%;
+    }
+}
+</style>
diff --git a/VueApp/src/components/__tests__/sortable-list.test.ts b/VueApp/src/components/__tests__/sortable-list.test.ts
new file mode 100644
index 000000000..2c9b17648
--- /dev/null
+++ b/VueApp/src/components/__tests__/sortable-list.test.ts
@@ -0,0 +1,173 @@
+import { mount } from "@vue/test-utils"
+import { Quasar } from "quasar"
+import { h, nextTick, ref } from "vue"
+import SortableList from "@/components/SortableList.vue"
+
+/**
+ * SortableList owns the shared reorder shell: drag handle, move buttons, the screen-reader
+ * announcement, and the row/header/actions/empty slots. The drag itself comes from
+ * vue-draggable (SortableJS), which needs real pointer events, so it's stubbed to a
+ * passthrough here; the button-move path (which is what these tests drive) runs through
+ * useReorder directly and is fully exercised.
+ */
+vi.mock("vue-draggable-plus", () => ({
+    VueDraggable: { name: "VueDraggable", template: "<div><slot /></div>" },
+}))
+
+type Item = { id: number; label: string }
+
+function mountList(initial: Item[], extraProps: Record<string, unknown> = {}) {
+    const model = ref(initial)
+    const wrapper = mount(SortableList, {
+        props: {
+            modelValue: model.value,
+            itemKey: "id",
+            "onUpdate:modelValue": (v) => {
+                model.value = v as Item[]
+            },
+            ...extraProps,
+        },
+        global: { plugins: [[Quasar, {}]] },
+        slots: {
+            row: (params) => h("span", { class: "row-label" }, params.item.label),
+            actions: (params) => h("button", { class: "del" }, `del ${params.item.id}`),
+            empty: () => h("div", { class: "empty" }, "Nothing here yet"),
+            header: () => h("div", { class: "hdr" }, "Label"),
+        },
+    })
+    return { wrapper, model }
+}
+
+const rowText = (wrapper: ReturnType<typeof mountList>["wrapper"]) => wrapper.findAll(".row-label").map((n) => n.text())
+
+const threeItems = (): Item[] => [
+    { id: 1, label: "Alpha" },
+    { id: 2, label: "Bravo" },
+    { id: 3, label: "Charlie" },
+]
+
+describe("SortableList - rendering", () => {
+    it("renders one row per item through the row slot", () => {
+        const { wrapper } = mountList(threeItems())
+        expect(rowText(wrapper)).toEqual(["Alpha", "Bravo", "Charlie"])
+    })
+
+    it("renders the actions slot per row", () => {
+        const { wrapper } = mountList(threeItems())
+        expect(wrapper.findAll(".del")).toHaveLength(3)
+    })
+
+    it("renders the header slot", () => {
+        const { wrapper } = mountList(threeItems())
+        expect(wrapper.find(".hdr").exists()).toBeTruthy()
+    })
+
+    it("shows the empty slot only when the list is empty", () => {
+        const { wrapper: full } = mountList(threeItems())
+        expect(full.find(".empty").exists()).toBeFalsy()
+
+        const { wrapper: empty } = mountList([])
+        expect(empty.find(".empty").exists()).toBeTruthy()
+    })
+})
+
+describe("SortableList - move buttons", () => {
+    it("disables Move up on the first row and Move down on the last", () => {
+        const { wrapper } = mountList(threeItems())
+        const ups = wrapper.findAll('[aria-label="Move up"]')
+        const downs = wrapper.findAll('[aria-label="Move down"]')
+        expect(ups[0]!.attributes("disabled")).toBeDefined()
+        expect(ups[1]!.attributes("disabled")).toBeUndefined()
+        expect(downs[2]!.attributes("disabled")).toBeDefined()
+        expect(downs[1]!.attributes("disabled")).toBeUndefined()
+    })
+
+    it("moving a row down reorders the list and emits reorder", async () => {
+        const { wrapper } = mountList(threeItems())
+        await wrapper.findAll('[aria-label="Move down"]')[0]!.trigger("click")
+
+        expect(rowText(wrapper)).toEqual(["Bravo", "Alpha", "Charlie"])
+        const events = wrapper.emitted("reorder")
+        expect(events).toHaveLength(1)
+        expect(events![0]).toEqual([{ id: 1, label: "Alpha" }, 1, 0])
+    })
+
+    it("moving a row up reorders the list", async () => {
+        const { wrapper } = mountList(threeItems())
+        await wrapper.findAll('[aria-label="Move up"]')[2]!.trigger("click")
+        expect(rowText(wrapper)).toEqual(["Alpha", "Charlie", "Bravo"])
+    })
+
+    it("uses custom move-button labels when provided", () => {
+        const { wrapper } = mountList(threeItems(), {
+            moveUpLabel: "Move link up",
+            moveDownLabel: "Move link down",
+        })
+        expect(wrapper.find('[aria-label="Move link up"]').exists()).toBeTruthy()
+        expect(wrapper.find('[aria-label="Move link down"]').exists()).toBeTruthy()
+    })
+})
+
+describe("SortableList - drag commit", () => {
+    it("announces and emits reorder when a drag ends (the array is already reordered by SortableJS)", async () => {
+        const { wrapper } = mountList(threeItems())
+
+        wrapper.findComponent({ name: "VueDraggable" }).vm.$emit("end", { oldIndex: 0, newIndex: 2 })
+        await nextTick()
+        await nextTick()
+
+        // CommitDrag doesn't move anything itself; it reports the item now sitting at newIndex.
+        const events = wrapper.emitted("reorder")
+        expect(events).toHaveLength(1)
+        expect(events![0]).toEqual([{ id: 3, label: "Charlie" }, 2, 0])
+        expect(wrapper.find('[role="status"]').text()).toBe("Moved to position 3 of 3")
+    })
+
+    it("ignores a drag end without indices (cancelled drag)", async () => {
+        const { wrapper } = mountList(threeItems())
+
+        wrapper.findComponent({ name: "VueDraggable" }).vm.$emit("end", {})
+        await nextTick()
+
+        expect(wrapper.emitted("reorder")).toBeFalsy()
+    })
+
+    it("ignores a drag that ends where it started", async () => {
+        const { wrapper } = mountList(threeItems())
+
+        wrapper.findComponent({ name: "VueDraggable" }).vm.$emit("end", { oldIndex: 1, newIndex: 1 })
+        await nextTick()
+
+        expect(wrapper.emitted("reorder")).toBeFalsy()
+    })
+})
+
+describe("SortableList - accessibility", () => {
+    it("announces the move in a polite live region", async () => {
+        const { wrapper } = mountList(threeItems())
+        await wrapper.findAll('[aria-label="Move down"]')[0]!.trigger("click")
+        await nextTick()
+        await nextTick()
+
+        const live = wrapper.find('[role="status"]')
+        expect(live.attributes("aria-live")).toBe("polite")
+        expect(live.text()).toBe("Moved to position 2 of 3")
+    })
+
+    it("uses a custom announce builder when provided", async () => {
+        const { wrapper } = mountList(threeItems(), {
+            announce: (item: Item, newIndex: number, total: number) => `${item.label} is now ${newIndex + 1}/${total}`,
+        })
+        await wrapper.findAll('[aria-label="Move down"]')[0]!.trigger("click")
+        await nextTick()
+        await nextTick()
+        expect(wrapper.find('[role="status"]').text()).toBe("Alpha is now 2/3")
+    })
+
+    it("hides the drag handle from assistive tech (move buttons are the a11y path)", () => {
+        const { wrapper } = mountList(threeItems())
+        // The header's handle is a layout spacer; the per-row handles are the real affordance.
+        const handle = wrapper.find(".sortable-list__items .sortable-row__handle")
+        expect(handle.attributes("aria-hidden")).toBe("true")
+    })
+})
diff --git a/VueApp/src/composables/ViperFetch.ts b/VueApp/src/composables/ViperFetch.ts
index caae23c58..52f1a3e0a 100644
--- a/VueApp/src/composables/ViperFetch.ts
+++ b/VueApp/src/composables/ViperFetch.ts
@@ -163,8 +163,8 @@ async function fetchWrapper(url: string, options: any = {}) {
             }
         })
     const resultObj: Result = {
-        result: result,
-        errors: errors,
+        result,
+        errors,
         success: errors.length === 0,
         pagination: null,
         status: httpStatus,
@@ -271,7 +271,21 @@ function useFetch() {
         return await fetchWrapper(url, options)
     }
 
-    return { get, post, put, del, patch, createUrlSearchParams }
+    // Multipart variants for file uploads: the browser sets the Content-Type
+    // (with boundary) itself, so no header is added here.
+    async function postForm(url: string = "", body: FormData, options: any = {}): Promise<Result> {
+        options.method = "POST"
+        options.body = body
+        return await fetchWrapper(url, options)
+    }
+
+    async function putForm(url: string = "", body: FormData, options: any = {}): Promise<Result> {
+        options.method = "PUT"
+        options.body = body
+        return await fetchWrapper(url, options)
+    }
+
+    return { get, post, put, del, patch, postForm, putForm, createUrlSearchParams }
 }
 
 function downloadBlob(blob: Blob, filename: string): void {
diff --git a/VueApp/src/composables/__tests__/use-reorder.test.ts b/VueApp/src/composables/__tests__/use-reorder.test.ts
new file mode 100644
index 000000000..c3aadbb02
--- /dev/null
+++ b/VueApp/src/composables/__tests__/use-reorder.test.ts
@@ -0,0 +1,128 @@
+import { ref } from "vue"
+import { useReorder } from "@/composables/use-reorder"
+
+/**
+ * Unit tests for useReorder: the array move math and the transient "just moved" highlight
+ * shared by every sortable list, exercised without a DOM the way SortableList drives it
+ * (button moves) and the way vue-draggable drives it (commitDrag after a drop).
+ */
+
+type Item = { id: number; name: string }
+type ReorderCallback = (item: Item, newIndex: number, oldIndex: number) => void
+
+function makeList(): Item[] {
+    return [
+        { id: 1, name: "a" },
+        { id: 2, name: "b" },
+        { id: 3, name: "c" },
+    ]
+}
+
+const ids = (list: Item[]) => list.map((i) => i.id)
+
+describe("useReorder - move math", () => {
+    it("moveDown swaps an item with its successor", () => {
+        const list = ref(makeList())
+        const { moveDown } = useReorder(list, { getKey: (i) => i.id })
+        expect(moveDown(0)).toBeTruthy()
+        expect(ids(list.value)).toEqual([2, 1, 3])
+    })
+
+    it("moveUp swaps an item with its predecessor", () => {
+        const list = ref(makeList())
+        const { moveUp } = useReorder(list, { getKey: (i) => i.id })
+        expect(moveUp(2)).toBeTruthy()
+        expect(ids(list.value)).toEqual([1, 3, 2])
+    })
+
+    it("ignores moveUp on the first item and moveDown on the last", () => {
+        const list = ref(makeList())
+        const { moveUp, moveDown } = useReorder(list, { getKey: (i) => i.id })
+        expect(moveUp(0)).toBeFalsy()
+        expect(moveDown(2)).toBeFalsy()
+        expect(ids(list.value)).toEqual([1, 2, 3])
+    })
+
+    it("ignores out-of-range indices", () => {
+        const list = ref(makeList())
+        const { moveUp, moveDown } = useReorder(list, { getKey: (i) => i.id })
+        expect(moveDown(5)).toBeFalsy()
+        expect(moveUp(-1)).toBeFalsy()
+        expect(ids(list.value)).toEqual([1, 2, 3])
+    })
+
+    it("mutates the same array reference so a parent v-model stays in sync", () => {
+        const list = ref(makeList())
+        const original = list.value
+        const { moveDown } = useReorder(list, { getKey: (i) => i.id })
+        moveDown(0)
+        expect(list.value).toBe(original)
+    })
+})
+
+describe("useReorder - onReorder callback", () => {
+    it("fires with the moved item and its new/old indices", () => {
+        const list = ref(makeList())
+        const onReorder = vi.fn<ReorderCallback>()
+        const { moveDown } = useReorder(list, { getKey: (i) => i.id, onReorder })
+        moveDown(0)
+        expect(onReorder).toHaveBeenCalledExactlyOnceWith({ id: 1, name: "a" }, 1, 0)
+    })
+
+    it("does not fire on a no-op move", () => {
+        const list = ref(makeList())
+        const onReorder = vi.fn<ReorderCallback>()
+        const { moveUp } = useReorder(list, { getKey: (i) => i.id, onReorder })
+        moveUp(0)
+        expect(onReorder).not.toHaveBeenCalled()
+    })
+
+    it("commitDrag fires for the dropped row and skips a same-slot drop", () => {
+        const list = ref(makeList())
+        const onReorder = vi.fn<ReorderCallback>()
+        const { commitDrag } = useReorder(list, { getKey: (i) => i.id, onReorder })
+
+        // After a drop, vue-draggable has already reordered the array; here item 1
+        // was dragged from index 0 to index 2.
+        list.value = [
+            { id: 2, name: "b" },
+            { id: 3, name: "c" },
+            { id: 1, name: "a" },
+        ]
+        commitDrag(0, 2)
+        expect(onReorder).toHaveBeenCalledWith({ id: 1, name: "a" }, 2, 0)
+
+        onReorder.mockClear()
+        commitDrag(1, 1)
+        expect(onReorder).not.toHaveBeenCalled()
+    })
+})
+
+describe("useReorder - flash highlight", () => {
+    beforeEach(() => vi.useFakeTimers())
+    afterEach(() => vi.useRealTimers())
+
+    it("marks the moved item, then clears it after flashMs", () => {
+        const list = ref(makeList())
+        const { moveDown, justMovedKey } = useReorder(list, { getKey: (i) => i.id, flashMs: 600 })
+        moveDown(0)
+        expect(justMovedKey.value).toBe(1)
+        vi.advanceTimersByTime(599)
+        expect(justMovedKey.value).toBe(1)
+        vi.advanceTimersByTime(1)
+        expect(justMovedKey.value).toBeNull()
+    })
+
+    it("a second move resets the clear timer", () => {
+        const list = ref(makeList())
+        const { moveDown, justMovedKey } = useReorder(list, { getKey: (i) => i.id, flashMs: 600 })
+        moveDown(0) // [2,1,3] flashes id 1
+        vi.advanceTimersByTime(400)
+        moveDown(1) // [2,3,1] flashes id 1 again, timer reset
+        expect(justMovedKey.value).toBe(1)
+        vi.advanceTimersByTime(400) // 800 since first flash but only 400 since second
+        expect(justMovedKey.value).toBe(1)
+        vi.advanceTimersByTime(200)
+        expect(justMovedKey.value).toBeNull()
+    })
+})
diff --git a/VueApp/src/composables/use-reorder.ts b/VueApp/src/composables/use-reorder.ts
new file mode 100644
index 000000000..ed98a6a00
--- /dev/null
+++ b/VueApp/src/composables/use-reorder.ts
@@ -0,0 +1,91 @@
+import type { Ref } from "vue"
+import { ref } from "vue"
+
+type ReorderKey = string | number
+
+const DEFAULT_FLASH_MS = 600
+
+interface UseReorderOptions<T> {
+    /** Stable, unique key for an item. Drives the post-move highlight. */
+    getKey: (item: T) => ReorderKey
+    /**
+     * Called after any committed reorder (button move or drag drop), with the moved
+     * item and its new/old indices. Use it to persist order immediately; omit it for
+     * lists that batch their order into an explicit save. Fire-and-forget: an async
+     * handler runs unawaited, so it owns its own error handling.
+     */
+    onReorder?: (item: T, newIndex: number, oldIndex: number) => void
+    /** Highlight duration in ms; keep in sync with the CSS flash animation. */
+    flashMs?: number
+}
+
+/**
+ * Reorder logic shared by every sortable list in the app: the up/down move math
+ * and the transient "just moved" highlight. The list is mutated in place so it
+ * stays the same array reference a parent `v-model` and vue-draggable both bind to.
+ *
+ * Pairs with SortableList.vue, which owns the drag wiring, controls, and a11y;
+ * exposed on its own so the move behaviour can be unit-tested without a DOM.
+ */
+function useReorder<T>(list: Ref<T[]>, options: UseReorderOptions<T>) {
+    const { getKey, onReorder, flashMs = DEFAULT_FLASH_MS } = options
+
+    const justMovedKey = ref<ReorderKey | null>(null)
+    // A generation counter supersedes earlier flash timers instead of clearing them, so
+    // a rapid second move's highlight wins without tracking a mutable timer handle.
+    let flashGeneration = 0
+
+    function flash(key: ReorderKey) {
+        justMovedKey.value = key
+        const generation = (flashGeneration += 1)
+        setTimeout(() => {
+            if (flashGeneration === generation && justMovedKey.value === key) {
+                justMovedKey.value = null
+            }
+        }, flashMs)
+    }
+
+    function move(from: number, to: number): boolean {
+        const items = list.value
+        if (from === to || from < 0 || to < 0 || from >= items.length || to >= items.length) {
+            return false
+        }
+        const item = items[from]
+        if (item === undefined) {
+            return false
+        }
+        items.splice(from, 1)
+        items.splice(to, 0, item)
+        flash(getKey(item))
+        onReorder?.(item, to, from)
+        return true
+    }
+
+    function moveUp(index: number): boolean {
+        return move(index, index - 1)
+    }
+
+    function moveDown(index: number): boolean {
+        return move(index, index + 1)
+    }
+
+    /**
+     * Finish a vue-draggable drag: the bound array is already reordered by the time
+     * its `end` event fires, so only flash the dropped row and fire `onReorder`.
+     */
+    function commitDrag(oldIndex: number, newIndex: number) {
+        if (oldIndex === newIndex) {
+            return
+        }
+        const item = list.value[newIndex]
+        if (item === undefined) {
+            return
+        }
+        flash(getKey(item))
+        onReorder?.(item, newIndex, oldIndex)
+    }
+
+    return { justMovedKey, move, moveUp, moveDown, commitDrag }
+}
+
+export { useReorder, type ReorderKey }
diff --git a/VueApp/src/composables/use-route-focus.ts b/VueApp/src/composables/use-route-focus.ts
index be0f20f92..7c8826674 100644
--- a/VueApp/src/composables/use-route-focus.ts
+++ b/VueApp/src/composables/use-route-focus.ts
@@ -7,7 +7,12 @@ import { nextTick } from "vue"
  * alone does not move focus.
  */
 export function useRouteFocus(router: Router) {
-    router.afterEach(() => {
+    router.afterEach((to, from) => {
+        // In-page anchor navigation (skip links): the browser already moved
+        // focus to the fragment target; don't steal it back to <main>.
+        if (to.path === from.path && to.hash) {
+            return
+        }
         nextTick(() => {
             const main = document.querySelector("#main-content") || document.querySelector("main")
             if (main instanceof HTMLElement) {
diff --git a/VueApp/src/config/colors.ts b/VueApp/src/config/colors.ts
index adddaa05d..5da0ba8c7 100644
--- a/VueApp/src/config/colors.ts
+++ b/VueApp/src/config/colors.ts
@@ -29,7 +29,8 @@ const semanticColors = {
 
 // Quasar/brand colors whose backgrounds are light enough that white foreground
 // text fails WCAG contrast. Pair these with text-color="dark".
-const LIGHT_BACKGROUND_COLORS = new Set(["warning", "info", "accent"])
+// (arboretum #00c4b3: white is 2.2:1, ink is 7.7:1 — needs dark text.)
+const LIGHT_BACKGROUND_COLORS = new Set(["warning", "info", "accent", "arboretum"])
 
 function getAccessibleTextColor(color: string | null | undefined): "dark" | "white" {
     return color && LIGHT_BACKGROUND_COLORS.has(color) ? "dark" : "white"
diff --git a/VueApp/src/layouts/LeftNav.vue b/VueApp/src/layouts/LeftNav.vue
index c1b615f83..66f161721 100644
--- a/VueApp/src/layouts/LeftNav.vue
+++ b/VueApp/src/layouts/LeftNav.vue
@@ -14,6 +14,7 @@
             <div
                 class="q-pa-sm"
                 id="leftNavMenu"
+                tabindex="-1"
             >
                 <q-btn
                     dense
@@ -29,10 +30,12 @@
                     {{ navHeader }}
                 </h2>
                 <nav :aria-label="navHeader || 'Section navigation'">
+                    <!-- QItem hardcodes role="listitem", which overrides the native link
+                         role on anchors; explicit roles restore link semantics, so no
+                         role="list" wrapper (headers/spacers are presentational). -->
                     <q-list
                         dense
                         separator
-                        role="list"
                     >
                         <template
                             v-for="(menuItem, index) in menuItems"
@@ -45,6 +48,7 @@
                                 :to="menuItem.routeTo"
                                 :active="isItemActive(menuItem.routeTo)"
                                 :class="menuItem.displayClass"
+                                role="link"
                             >
                                 <q-item-section>
                                     <q-item-label
@@ -63,6 +67,7 @@
                                 :target="menuItem.isExternalSite ? '_blank' : undefined"
                                 :rel="menuItem.isExternalSite ? 'noopener noreferrer' : undefined"
                                 :class="menuItem.displayClass"
+                                role="link"
                             >
                                 <q-item-section>
                                     <q-item-label
@@ -87,6 +92,7 @@
                             <q-item
                                 v-else
                                 :class="menuItem.displayClass"
+                                role="presentation"
                             >
                                 <q-item-section>
                                     <q-item-label
@@ -319,5 +325,10 @@ watch(
     },
 )
 
-onMounted(() => getLeftNav())
+onMounted(() => {
+    getLeftNav()
+    // QDrawer drops fallthrough attrs on its content div, so the complementary
+    // landmark (the <aside> root) must be labeled directly.
+    document.getElementById("leftNavMenu")?.closest("aside")?.setAttribute("aria-label", "Section menu")
+})
 </script>
diff --git a/VueApp/src/layouts/ViperLayout.vue b/VueApp/src/layouts/ViperLayout.vue
index 123a485e9..429282c52 100644
--- a/VueApp/src/layouts/ViperLayout.vue
+++ b/VueApp/src/layouts/ViperLayout.vue
@@ -5,6 +5,14 @@
         class="skip-to-content"
         >Skip to main content</a
     >
+    <!-- gt-sm: the drawer is hidden below QDrawer's show-if-above breakpoint,
+         so the skip link would target an invisible element on small screens -->
+    <a
+        v-if="navarea"
+        href="#leftNavMenu"
+        class="skip-to-content gt-sm"
+        >Skip to section menu</a
+    >
     <q-layout view="hHh lpR fFf">
         <q-header
             elevated
diff --git a/VueApp/src/shared/__tests__/create-spa-router.test.ts b/VueApp/src/shared/__tests__/create-spa-router.test.ts
new file mode 100644
index 000000000..7b11a2898
--- /dev/null
+++ b/VueApp/src/shared/__tests__/create-spa-router.test.ts
@@ -0,0 +1,81 @@
+import { createMemoryHistory, createRouter } from "vue-router"
+import type { RouteLocationNormalized } from "vue-router"
+import { nextTick } from "vue"
+import { createSpaRouter } from "../create-spa-router"
+import { useRouteFocus } from "@/composables/use-route-focus"
+
+const DummyPage = { template: "<div>page</div>" }
+
+function route(path: string, hash = ""): RouteLocationNormalized {
+    return { path, hash } as RouteLocationNormalized
+}
+
+describe("createSpaRouter scroll behavior", () => {
+    const router = createSpaRouter([{ path: "/", component: DummyPage }])
+    const scrollBehavior = router.options.scrollBehavior!
+
+    it("scrolls to top when navigating to a different page", () => {
+        expect(scrollBehavior(route("/b"), route("/a"), null)).toEqual({ left: 0, top: 0 })
+    })
+
+    it("keeps scroll position for query-only changes on the same page", () => {
+        expect(scrollBehavior(route("/a"), route("/a"), null)).toBeFalsy()
+    })
+
+    it("scrolls to the fragment target when navigating to a hash on another page", () => {
+        expect(scrollBehavior(route("/b", "#section"), route("/a"), null)).toEqual({ el: "#section" })
+    })
+
+    it("scrolls to the fragment target when the hash changes on the same page", () => {
+        expect(scrollBehavior(route("/a", "#section"), route("/a"), null)).toEqual({ el: "#section" })
+    })
+
+    it("keeps scroll position for query-only changes when the hash is unchanged", () => {
+        expect(scrollBehavior(route("/a", "#section"), route("/a", "#section"), null)).toBeFalsy()
+    })
+})
+
+describe("route-change focus management", () => {
+    function buildRouter() {
+        const router = createRouter({
+            history: createMemoryHistory(),
+            routes: [
+                { path: "/", component: DummyPage },
+                { path: "/other", component: DummyPage },
+            ],
+        })
+        useRouteFocus(router)
+        return router
+    }
+
+    beforeEach(() => {
+        document.body.innerHTML = [
+            '<div id="leftNavMenu" tabindex="-1"></div>',
+            '<main id="main-content"></main>',
+        ].join("")
+    })
+
+    it("moves focus to the main landmark after page navigation", async () => {
+        const router = buildRouter()
+        await router.push("/")
+        await router.isReady()
+
+        await router.push("/other")
+        await nextTick()
+
+        expect(document.activeElement?.id).toBe("main-content")
+    })
+
+    it("does not steal focus on in-page anchor navigation (skip links)", async () => {
+        const router = buildRouter()
+        await router.push("/other")
+        await router.isReady()
+
+        const skipTarget = document.querySelector<HTMLElement>("#leftNavMenu")!
+        skipTarget.focus()
+        await router.push({ path: "/other", hash: "#leftNavMenu" })
+        await nextTick()
+
+        expect(document.activeElement?.id).toBe("leftNavMenu")
+    })
+})
diff --git a/VueApp/src/shared/create-spa-router.ts b/VueApp/src/shared/create-spa-router.ts
new file mode 100644
index 000000000..f89fb345f
--- /dev/null
+++ b/VueApp/src/shared/create-spa-router.ts
@@ -0,0 +1,29 @@
+import { createRouter, createWebHistory } from "vue-router"
+import type { RouteRecordRaw, Router } from "vue-router"
+import { useRouteFocus } from "@/composables/use-route-focus"
+
+/**
+ * Standard VIPER SPA router: web history rooted at VITE_VIPER_HOME,
+ * scroll-to-top on page navigation (query-only changes keep the scroll
+ * position), hash-fragment scrolling for router-driven anchor links, and
+ * route-change focus management for accessibility.
+ * Callers wire their own `beforeEach` guard since auth/permission rules
+ * vary per SPA.
+ */
+export function createSpaRouter(routes: RouteRecordRaw[]): Router {
+    const baseUrl = import.meta.env.VITE_VIPER_HOME
+    const router = createRouter({
+        scrollBehavior: (to, from) => {
+            // Scroll to the fragment target on router-driven hash navigation,
+            // but not on query-only changes where the hash merely persists.
+            if (to.hash && (to.path !== from.path || to.hash !== from.hash)) {
+                return { el: to.hash }
+            }
+            return to.path === from.path ? false : { left: 0, top: 0 }
+        },
+        history: createWebHistory(baseUrl),
+        routes,
+    })
+    useRouteFocus(router)
+    return router
+}
diff --git a/VueApp/src/shared/createSpaRouter.ts b/VueApp/src/shared/createSpaRouter.ts
deleted file mode 100644
index b1349020d..000000000
--- a/VueApp/src/shared/createSpaRouter.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { createRouter, createWebHistory } from "vue-router"
-import type { RouteRecordRaw, Router } from "vue-router"
-import { useRouteFocus } from "@/composables/use-route-focus"
-
-/**
- * Standard VIPER SPA router: web history rooted at VITE_VIPER_HOME,
- * scroll-to-top on every navigation, and route-change focus management
- * for accessibility. Callers wire their own `beforeEach` guard since
- * auth/permission rules vary per SPA.
- */
-export function createSpaRouter(routes: RouteRecordRaw[]): Router {
-    const baseUrl = import.meta.env.VITE_VIPER_HOME
-    const router = createRouter({
-        scrollBehavior: () => ({ left: 0, top: 0 }),
-        history: createWebHistory(baseUrl),
-        routes,
-    })
-    useRouteFocus(router)
-    return router
-}
diff --git a/VueApp/src/styles/base.css b/VueApp/src/styles/base.css
index 071d7efaf..7e6ac7d4c 100644
--- a/VueApp/src/styles/base.css
+++ b/VueApp/src/styles/base.css
@@ -82,6 +82,14 @@ body {
         0 0 0 0.25rem #258cfb;
 }
 
+/* Flat q-btn links suppress Quasar's focus helper enough to fail
+   WCAG 2.4.7; restore the system focus ring for keyboard users. */
+.q-card__actions .q-btn:focus-visible {
+    box-shadow:
+        0 0 0 0.1rem white,
+        0 0 0 0.25rem #258cfb;
+}
+
 /*Placeholders used when loading*/
 #headerPlaceholder {
     height: 50px;
@@ -286,6 +294,30 @@ div.breadcrumbs {
     font-weight: bold;
 }
 
+/* Breadcrumb-style parent links inside page headings. Underlined by default so
+   they read as links: the heading text is black and bold, and the Aggie-Blue
+   link color alone is too close to it to signal a link (WCAG 1.4.1) - and on
+   touch there's no hover to reveal one. */
+.q-page-container h1 a {
+    text-decoration: underline;
+}
+
+/* List-page header: a page title beside its primary action(s). Inline (title
+   left, action right) on tablet and up; on phones the action drops below the
+   title, both left-aligned - a deliberate stack rather than an incidental wrap.
+   The .q-page-container prefix outweighs Quasar's .row so the direction flips. */
+@media (max-width: 599.98px) {
+    .q-page-container .list-page-header {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 0.5rem;
+    }
+
+    .q-page-container .list-page-header > .q-space {
+        display: none;
+    }
+}
+
 .q-dialog h2,
 .q-dialog .text-h2,
 .q-page-container h2,
@@ -350,6 +382,44 @@ header .q-avatar {
     width: 31px !important;
 }
 
+/* QTable card (grid) mode field rows — used when dense list tables collapse to
+   stacked cards on small screens. Label column is fixed-width so values align. */
+.list-card-field {
+    display: flex;
+    gap: 0.75rem;
+    align-items: baseline;
+    padding: 0.125rem 0;
+}
+
+.list-card-label {
+    flex: 0 0 7rem;
+    font-weight: 600;
+    color: var(--ucdavis-black-70);
+}
+
+.list-card-value {
+    min-width: 0;
+    overflow-wrap: anywhere;
+}
+
+/* Dialog card widths — replaces inline width styles on q-card inside q-dialog.
+   A fixed width with a 95vw cap keeps modals comfortable on desktop and off
+   the screen edges on small viewports. */
+.dialog-card-sm {
+    width: 480px;
+    max-width: 95vw;
+}
+
+.dialog-card-md {
+    width: 600px;
+    max-width: 95vw;
+}
+
+.dialog-card-lg {
+    width: 900px;
+    max-width: 95vw;
+}
+
 /* Skip to content link — visible on focus for keyboard users */
 .skip-to-content {
     position: absolute;
@@ -374,6 +444,34 @@ header .q-avatar {
     outline: none;
 }
 
+/* Same treatment for the drawer container targeted by "Skip to section menu" */
+#leftNavMenu:focus {
+    outline: none;
+}
+
+/* Workspace links carry the brand (DESIGN.md: Aggie Blue is the link color);
+   without this, content anchors fall back to browser default blue/purple.
+   Buttons, nav items, and tabs manage their own colors. */
+#main-content a:not(.q-btn):not(.q-item):not(.q-tab) {
+    color: var(--q-primary);
+}
+
+/* Dense table action buttons keep a 24px minimum hit area (WCAG 2.2 SC 2.5.8) */
+.q-td .q-btn {
+    min-width: 24px;
+    min-height: 24px;
+}
+
+/* On touch devices, give the CMS card-mode action buttons the 44px comfort
+   target (WCAG 2.5.5); pointer devices keep the dense default. Scoped to the
+   list cards so it doesn't reflow every dense table app-wide. */
+@media (pointer: coarse) {
+    .list-card .q-card__actions .q-btn {
+        min-width: 44px;
+        min-height: 44px;
+    }
+}
+
 /* Quasar palette AA contrast overrides (!important required to override Quasar's !important).
    Kept in sync with web/wwwroot/css/site.css so Razor and SPA render the same color. */
 .text-grey {
@@ -400,6 +498,25 @@ header .q-avatar {
     font-size: 1.4rem;
 }
 
+/* Headings inside sanitized CMS content (v-html). Shared by the live content
+   block (CMS/components/ContentBlock.vue) and the history diff view
+   (CMS/components/ContentDiffDialog.vue) so both render block headings the same.
+   Declared globally because scoped styles don't reach v-html children. */
+.content-block h1 {
+    font-size: 2rem;
+    line-height: 1.2;
+}
+
+.content-block h2 {
+    font-size: 1.5rem;
+    line-height: 1.25;
+}
+
+.content-block h3 {
+    font-size: 1.25rem;
+    line-height: 1.3;
+}
+
 /* Screen reader only — visually hidden but accessible to assistive technology */
 .sr-only {
     position: absolute;
diff --git a/VueApp/src/styles/colors.css b/VueApp/src/styles/colors.css
index 79b090f2a..aa9d93347 100644
--- a/VueApp/src/styles/colors.css
+++ b/VueApp/src/styles/colors.css
@@ -45,6 +45,24 @@
     /* UC Davis Secondary Palette (used as accents, never dominant) */
     --ucdavis-arboretum: #00c4b3;
     --ucdavis-cabernet: #481268;
+
+    /* Neutral surface tokens — blue-tinted near-whites with no equivalent in the
+       brand ramp (its lightest blue, --ucdavis-blue-10 #cdd6e0, is far too dark
+       for a panel fill). Borders use the existing --ucdavis-black-10 directly. */
+    --surface: #ffffff;
+    --surface-tint: #f5f7fb;
+    --surface-tint-raised: #fafbff;
+
+    /* Diff highlight tints — light green/red fills behind <ins>/<del> in the
+       content-history diff. Ink text on these clears WCAG AA; the underline/
+       strikethrough carry the meaning so color is not the only signal. */
+    --diff-add: #d7efdb;
+    --diff-remove: #f6d9dc;
+
+    /* Keyboard focus-ring color. Mirrors the literal used by the shared focus
+       ring in base.css / site.css so components can reference a token instead
+       of repeating the hex. */
+    --focus-ring-color: #258cfb;
 }
 
 /* Background utility classes — UC Davis palette */
@@ -62,6 +80,15 @@
 .bg-ucdavis-gold-20 {
     background-color: var(--ucdavis-gold-20);
 }
+/* Secondary-palette accents for categorical distinction (charts, tags). Exposed as
+   bg-* utilities so Quasar color="arboretum"/"cabernet" resolves on badges/chips,
+   since these are not part of Quasar's registered brand palette. */
+.bg-arboretum {
+    background-color: var(--ucdavis-arboretum);
+}
+.bg-cabernet {
+    background-color: var(--ucdavis-cabernet);
+}
 /* Overrides Quasar's .text-warning; bright gold fails WCAG contrast on white.
    !important required to beat Quasar's own !important. */
 .text-warning {
diff --git a/test/CMS/CMSContentControllerTests.cs b/test/CMS/CMSContentControllerTests.cs
new file mode 100644
index 000000000..f9ce442dc
--- /dev/null
+++ b/test/CMS/CMSContentControllerTests.cs
@@ -0,0 +1,499 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.AspNetCore.Mvc.ModelBinding;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using NSubstitute;
+using NSubstitute.ReturnsExtensions;
+using NSubstitute.ExceptionExtensions;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Controllers;
+using Viper.Areas.CMS.Models;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+using Viper.Models;
+using Viper.Models.AAUD;
+using Viper.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Controller wiring tests for CMSContentController: the action layer delegates to
+/// ICmsContentBlockService and maps results to status codes (404 on null, 409 on
+/// concurrency, 400 on validation). The new history-list and version-diff endpoints
+/// are covered for passthrough and 404-on-null only; the query/diff logic itself lives
+/// in CmsContentBlockServiceTests. Permanent delete is admin-gated.
+/// </summary>
+public sealed class CMSContentControllerTests : IDisposable
+{
+    private readonly ICmsContentBlockService _blockService;
+    private readonly ICmsFileStorageService _storage;
+    private readonly IUserHelper _userHelper;
+    private readonly VIPERContext _context;
+    private readonly RAPSContext _rapsContext;
+    private readonly CMSContentController _controller;
+
+    public CMSContentControllerTests()
+    {
+        _blockService = Substitute.For<ICmsContentBlockService>();
+        _storage = Substitute.For<ICmsFileStorageService>();
+        _userHelper = Substitute.For<IUserHelper>();
+        var sanitizer = Substitute.For<IHtmlSanitizerService>();
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _rapsContext = new RAPSContext(new DbContextOptionsBuilder<RAPSContext>()
+            .UseInMemoryDatabase("RAPS_" + Guid.NewGuid()).Options);
+
+        _controller = new CMSContentController(_context, _rapsContext, sanitizer, _blockService, _storage, _userHelper);
+        SetupControllerContext();
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        _rapsContext.Dispose();
+    }
+
+    private void SetupControllerContext()
+    {
+        // ValidationProblem(string) resolves ProblemDetailsFactory from RequestServices, so a
+        // stub is registered; otherwise the call throws before producing the ObjectResult.
+        var services = new ServiceCollection();
+        services.AddSingleton<ProblemDetailsFactory, StubProblemDetailsFactory>();
+        _controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { RequestServices = services.BuildServiceProvider() }
+        };
+    }
+
+    private sealed class StubProblemDetailsFactory : ProblemDetailsFactory
+    {
+        public override ProblemDetails CreateProblemDetails(HttpContext httpContext, int? statusCode = null,
+            string? title = null, string? type = null, string? detail = null, string? instance = null)
+            => new() { Status = statusCode, Title = title, Detail = detail };
+
+        public override ValidationProblemDetails CreateValidationProblemDetails(HttpContext httpContext,
+            ModelStateDictionary modelStateDictionary, int? statusCode = null, string? title = null,
+            string? type = null, string? detail = null, string? instance = null)
+            => new(modelStateDictionary) { Status = statusCode, Title = title, Detail = detail };
+    }
+
+    private static ContentBlockDto Block(int id = 1) => new()
+    {
+        ContentBlockId = id,
+        Title = "Block",
+        System = "Viper",
+        Content = "<p>x</p>"
+    };
+
+    private static CMSBlockAddEdit Request(int id = 1) => new()
+    {
+        ContentBlockId = id,
+        Title = "Block",
+        System = "Viper",
+        Content = "<p>x</p>",
+        AllowPublicAccess = false,
+        LastModifiedOn = DateTime.Now
+    };
+
+    #region List / Get
+
+    [Fact]
+    public async Task GetContentBlocks_PassesFiltersThrough()
+    {
+        var blocks = new List<ContentBlockDto> { Block() };
+        _blockService.GetContentBlocksAsync("deleted", "Viper", "cats", "search", true, 1, 50, "title", false,
+            Arg.Any<CancellationToken>()).Returns((blocks, 1));
+
+        var result = await _controller.GetContentBlocks(null, "deleted", "Viper", "cats", "search", true,
+            ct: TestContext.Current.CancellationToken);
+
+        Assert.Same(blocks, result.Value);
+        await _blockService.Received(1).GetContentBlocksAsync("deleted", "Viper", "cats", "search", true, 1, 50,
+            "title", false, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public void GetFolders_ReturnsTopLevelUploadFolders()
+    {
+        var folders = new List<string> { "accreditation", "students" };
+        _storage.GetTopLevelFolders().Returns(folders);
+
+        var result = _controller.GetFolders();
+
+        Assert.Same(folders, result.Value);
+        _storage.Received(1).GetTopLevelFolders();
+    }
+
+    [Fact]
+    public async Task GetContentBlock_ReturnsBlock_WhenFound()
+    {
+        _blockService.GetContentBlockAsync(5, Arg.Any<CancellationToken>()).Returns(Block(5));
+
+        var result = await _controller.GetContentBlock(5, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        Assert.Equal(5, result.Value!.ContentBlockId);
+    }
+
+    [Fact]
+    public async Task GetContentBlock_ReturnsNotFound_WhenMissing()
+    {
+        _blockService.GetContentBlockAsync(999, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.GetContentBlock(999, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task GetContentBlockByFn_ReturnsNotFound_WhenMissing()
+    {
+        var result = _controller.GetContentBlockByFn("does-not-exist");
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task GetContentBlockByFn_ProjectsToDto_AndDoesNotLeakEntityInternals()
+    {
+        // Regression: this endpoint is anonymous. It must project to a DTO and never serialize the
+        // raw ContentBlock graph, which would leak each attached file's AES Key and server FilePath,
+        // the full content history, and the block's permission rows.
+        var file = new Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FriendlyName = "attached-doc",
+            FilePath = @"S:\Files\secret\attached-doc.pdf",
+            Key = "SUPER_SECRET_AES_KEY",
+            Encrypted = true,
+            AllowPublicAccess = true,
+            Description = "internal notes",
+            ModifiedBy = "author"
+        };
+        var block = new Models.VIPER.ContentBlock
+        {
+            Content = "<p>body</p>",
+            Title = "Public Block",
+            System = "Viper",
+            FriendlyName = "public-fn",
+            AllowPublicAccess = true,
+            ModifiedOn = DateTime.Now,
+            ModifiedBy = "author",
+            ContentBlockToFiles = { new Models.VIPER.ContentBlockToFile { FileGuid = file.FileGuid, File = file } },
+            ContentHistories = { new Models.VIPER.ContentHistory { ContentBlockContent = "<p>OLD SECRET VERSION</p>", ModifiedOn = DateTime.Now.AddDays(-1), ModifiedBy = "author" } }
+        };
+        _context.Files.Add(file);
+        _context.ContentBlocks.Add(block);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+
+        var result = _controller.GetContentBlockByFn("public-fn");
+
+        Assert.NotNull(result.Value);
+        var json = System.Text.Json.JsonSerializer.Serialize(result.Value,
+            new System.Text.Json.JsonSerializerOptions { PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase });
+
+        // Consumer contract (VueApp ContentBlock type) preserved.
+        Assert.Contains("\"contentBlockId\"", json);
+        Assert.Contains("\"content\"", json);
+        Assert.Contains("\"title\"", json);
+        // No entity internals or secrets.
+        Assert.DoesNotContain("\"key\"", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("filePath", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("contentHistories", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("SUPER_SECRET_AES_KEY", json);
+        Assert.DoesNotContain(@"S:\Files", json);
+    }
+
+    #endregion
+
+    #region Create
+
+    [Fact]
+    public async Task CreateContentBlock_ReturnsBadRequest_WhenTitleAndSystemMissing()
+    {
+        var request = new CMSBlockAddEdit { ContentBlockId = 0, AllowPublicAccess = false, Content = "x", Title = "", System = "" };
+
+        var result = await _controller.CreateContentBlock(request, TestContext.Current.CancellationToken);
+
+        var badRequest = Assert.IsType<BadRequestObjectResult>(result.Result);
+        Assert.Contains("Title is required", badRequest.Value?.ToString());
+        Assert.Contains("System is required", badRequest.Value?.ToString());
+        await _blockService.DidNotReceive().CreateContentBlockAsync(Arg.Any<CMSBlockAddEdit>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task CreateContentBlock_ReturnsBlock_OnSuccess()
+    {
+        var request = Request(0);
+        _blockService.CreateContentBlockAsync(request, Arg.Any<CancellationToken>()).Returns(Block(7));
+
+        var result = await _controller.CreateContentBlock(request, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        Assert.Equal(7, result.Value!.ContentBlockId);
+    }
+
+    [Fact]
+    public async Task CreateContentBlock_ReturnsValidationProblem_OnArgumentException()
+    {
+        var request = Request(0);
+        _blockService.CreateContentBlockAsync(request, Arg.Any<CancellationToken>())
+            .Throws(new ArgumentException("Friendly name already in use"));
+
+        var result = await _controller.CreateContentBlock(request, TestContext.Current.CancellationToken);
+
+        Assert.IsType<ObjectResult>(result.Result);
+        var problem = (ObjectResult)result.Result!;
+        Assert.IsType<ValidationProblemDetails>(problem.Value);
+    }
+
+    #endregion
+
+    #region Update
+
+    [Fact]
+    public async Task UpdateContentBlock_ReturnsBadRequest_WhenRouteIdMismatch()
+    {
+        var request = Request(2);
+
+        var result = await _controller.UpdateContentBlock(1, request, TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task UpdateContentBlock_ReturnsBlock_OnSuccess()
+    {
+        var request = Request(3);
+        _blockService.UpdateContentBlockAsync(3, request, Arg.Any<CancellationToken>()).Returns(Block(3));
+
+        var result = await _controller.UpdateContentBlock(3, request, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        Assert.Equal(3, result.Value!.ContentBlockId);
+    }
+
+    [Fact]
+    public async Task UpdateContentBlock_ReturnsNotFound_WhenServiceReturnsNull()
+    {
+        var request = Request(3);
+        _blockService.UpdateContentBlockAsync(3, request, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.UpdateContentBlock(3, request, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task UpdateContentBlock_ReturnsConflict_OnConcurrencyException()
+    {
+        var request = Request(3);
+        _blockService.UpdateContentBlockAsync(3, request, Arg.Any<CancellationToken>())
+            .Throws(new CmsConcurrencyException("stale"));
+
+        var result = await _controller.UpdateContentBlock(3, request, TestContext.Current.CancellationToken);
+
+        Assert.IsType<ConflictObjectResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task UpdateContentOnly_ReturnsBlock_OnSuccess()
+    {
+        var update = new ContentOnlyUpdate { Content = "<p>quick</p>", LastModifiedOn = DateTime.Now };
+        _blockService.UpdateContentOnlyAsync(4, update.Content, update.LastModifiedOn, Arg.Any<CancellationToken>())
+            .Returns(Block(4));
+
+        var result = await _controller.UpdateContentOnly(4, update, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        await _blockService.Received(1).UpdateContentOnlyAsync(4, update.Content, update.LastModifiedOn,
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task UpdateContentOnly_ReturnsConflict_OnConcurrencyException()
+    {
+        var update = new ContentOnlyUpdate { Content = "<p>quick</p>", LastModifiedOn = DateTime.Now };
+        _blockService.UpdateContentOnlyAsync(4, update.Content, update.LastModifiedOn, Arg.Any<CancellationToken>())
+            .Throws(new CmsConcurrencyException("stale"));
+
+        var result = await _controller.UpdateContentOnly(4, update, TestContext.Current.CancellationToken);
+
+        Assert.IsType<ConflictObjectResult>(result.Result);
+    }
+
+    #endregion
+
+    #region History list + version + diff
+
+    [Fact]
+    public async Task GetHistory_PassesBlockIdThrough()
+    {
+        var history = new List<ContentHistoryListItemDto> { new() { ContentHistoryId = 1 } };
+        _blockService.GetHistoryAsync(5, Arg.Any<CancellationToken>()).Returns(history);
+
+        var result = await _controller.GetHistory(5, TestContext.Current.CancellationToken);
+
+        Assert.Same(history, result.Value);
+    }
+
+    [Fact]
+    public async Task GetHistoryVersion_ReturnsNotFound_WhenMissing()
+    {
+        _blockService.GetHistoryVersionAsync(5, 12, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.GetHistoryVersion(5, 12, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task GetHistoryEntries_PassesFilterAndPaginationThrough_AndSetsTotal()
+    {
+        var entries = new List<ContentHistoryAuditDto> { new() { ContentHistoryId = 1 } };
+        _blockService.GetHistoryEntriesAsync(Arg.Any<CmsContentHistoryFilter>(), 2, 25, Arg.Any<CancellationToken>())
+            .Returns(entries);
+        _blockService.GetHistoryEntryCountAsync(Arg.Any<CmsContentHistoryFilter>(), Arg.Any<CancellationToken>())
+            .Returns(99);
+        var pagination = new ApiPagination { Page = 2, PerPage = 25 };
+        var from = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Local);
+        var to = new DateTime(2026, 2, 1, 0, 0, 0, DateTimeKind.Local);
+
+        var result = await _controller.GetHistoryEntries(7, "editorX", from, to, "needle", pagination, TestContext.Current.CancellationToken);
+
+        Assert.Same(entries, result.Value);
+        Assert.Equal(99, pagination.TotalRecords);
+        await _blockService.Received(1).GetHistoryEntriesAsync(
+            Arg.Is<CmsContentHistoryFilter>(f =>
+                f.ContentBlockId == 7 && f.ModifiedBy == "editorX" && f.From == from && f.To == to && f.Search == "needle"),
+            2, 25, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetHistoryEntries_DefaultsPageAndPerPage_AndSkipsCount_WhenNoPagination()
+    {
+        _blockService.GetHistoryEntriesAsync(Arg.Any<CmsContentHistoryFilter>(), 1, 50, Arg.Any<CancellationToken>())
+            .Returns(new List<ContentHistoryAuditDto>());
+
+        await _controller.GetHistoryEntries(null, null, null, null, null, null, TestContext.Current.CancellationToken);
+
+        await _blockService.Received(1).GetHistoryEntriesAsync(Arg.Any<CmsContentHistoryFilter>(), 1, 50,
+            Arg.Any<CancellationToken>());
+        await _blockService.DidNotReceive().GetHistoryEntryCountAsync(Arg.Any<CmsContentHistoryFilter>(),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetHistoryVersionDiff_PassesThrough_AndReturnsDto()
+    {
+        var diff = new ContentHistoryDiffDto { HasComparison = true, Content = "<ins>x</ins>" };
+        _blockService.GetHistoryVersionDiffAsync(5, 12, Arg.Any<CancellationToken>()).Returns(diff);
+
+        var result = await _controller.GetHistoryVersionDiff(5, 12, TestContext.Current.CancellationToken);
+
+        Assert.Same(diff, result.Value);
+        await _blockService.Received(1).GetHistoryVersionDiffAsync(5, 12, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetHistoryVersionDiff_ReturnsNotFound_WhenNull()
+    {
+        _blockService.GetHistoryVersionDiffAsync(5, 12, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.GetHistoryVersionDiff(5, 12, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task DiffAgainstHistoryVersion_PassesPostedContentThrough_AndReturnsDto()
+    {
+        var diff = new ContentHistoryDiffDto { HasComparison = true, Content = "<ins>draft</ins>" };
+        _blockService.DiffContentAgainstHistoryAsync(5, 12, "<p>draft</p>", Arg.Any<CancellationToken>()).Returns(diff);
+        var request = new DiffAgainstHistoryRequest { Content = "<p>draft</p>" };
+
+        var result = await _controller.DiffAgainstHistoryVersion(5, 12, request, TestContext.Current.CancellationToken);
+
+        Assert.Same(diff, result.Value);
+        await _blockService.Received(1).DiffContentAgainstHistoryAsync(5, 12, "<p>draft</p>",
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task DiffAgainstHistoryVersion_ReturnsNotFound_WhenNull()
+    {
+        _blockService.DiffContentAgainstHistoryAsync(5, 12, Arg.Any<string>(), Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.DiffAgainstHistoryVersion(5, 12, new DiffAgainstHistoryRequest { Content = "x" }, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    #endregion
+
+    #region Restore / Delete
+
+    [Fact]
+    public async Task RestoreContentBlock_ReturnsNoContent_WhenRestored()
+    {
+        _blockService.RestoreAsync(5, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.RestoreContentBlock(5, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+    }
+
+    [Fact]
+    public async Task RestoreContentBlock_ReturnsNotFound_WhenMissing()
+    {
+        _blockService.RestoreAsync(5, Arg.Any<CancellationToken>()).Returns(false);
+
+        var result = await _controller.RestoreContentBlock(5, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteContentBlock_SoftDelete_ReturnsNoContent()
+    {
+        _blockService.SoftDeleteAsync(5, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.DeleteContentBlock(5, permanent: false, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+        await _blockService.DidNotReceive().PermanentlyDeleteAsync(Arg.Any<int>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task DeleteContentBlock_PermanentWithoutAdmin_ReturnsForbidden()
+    {
+        var user = new AaudUser { AaudUserId = 1, LoginId = "user" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(false);
+
+        var result = await _controller.DeleteContentBlock(5, permanent: true, TestContext.Current.CancellationToken);
+
+        var objectResult = Assert.IsType<ObjectResult>(result);
+        Assert.Equal(StatusCodes.Status403Forbidden, objectResult.StatusCode);
+        await _blockService.DidNotReceive().PermanentlyDeleteAsync(Arg.Any<int>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task DeleteContentBlock_PermanentAsAdmin_ReturnsNoContent()
+    {
+        var user = new AaudUser { AaudUserId = 1, LoginId = "admin" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(true);
+        _blockService.PermanentlyDeleteAsync(5, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.DeleteContentBlock(5, permanent: true, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+        await _blockService.Received(1).PermanentlyDeleteAsync(5, Arg.Any<CancellationToken>());
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CMSContentPermissionTests.cs b/test/CMS/CMSContentPermissionTests.cs
new file mode 100644
index 000000000..c557a8326
--- /dev/null
+++ b/test/CMS/CMSContentPermissionTests.cs
@@ -0,0 +1,178 @@
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+using NSubstitute.ReturnsExtensions;
+using Viper.Areas.CMS.Constants;
+using Viper.Classes.SQLContext;
+using Viper.Models.AAUD;
+using Viper.Models.RAPS;
+using Viper.Models.VIPER;
+using Viper.Services;
+using DataCms = Viper.Areas.CMS.Data.CMS;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for Data.CMS.GetContentBlocksAllowed, the public-display permission gate behind the
+/// CMS content endpoint (content/fn/{friendlyName}). A public block is served to anyone; a
+/// restricted block is withheld unless the viewer is a CMS admin, the block has no permissions
+/// and the viewer is logged in, or the viewer holds one of the block's permissions. Permission
+/// scenarios are driven by mocking IUserHelper.
+/// </summary>
+public sealed class CMSContentPermissionTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly RAPSContext _rapsContext;
+    private readonly IUserHelper _userHelper;
+    private readonly DataCms _cms;
+
+    public CMSContentPermissionTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _rapsContext = new RAPSContext(new DbContextOptionsBuilder<RAPSContext>()
+            .UseInMemoryDatabase("RAPS_" + Guid.NewGuid()).Options);
+        var sanitizer = Substitute.For<IHtmlSanitizerService>();
+        sanitizer.Sanitize(Arg.Any<string>()).Returns(c => c.ArgAt<string>(0));
+        _userHelper = Substitute.For<IUserHelper>();
+
+        _cms = new DataCms(_context, _rapsContext, sanitizer) { UserHelper = _userHelper };
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        _rapsContext.Dispose();
+    }
+
+    private async Task<ContentBlock> SeedBlockAsync(bool allowPublic, params string[] permissions)
+    {
+        var block = new ContentBlock
+        {
+            Content = "<p>secret</p>",
+            Title = "Block",
+            System = "Viper",
+            FriendlyName = "block-" + Guid.NewGuid().ToString("N")[..8],
+            AllowPublicAccess = allowPublic,
+            ModifiedOn = DateTime.Now,
+            ModifiedBy = "author"
+        };
+        foreach (var permission in permissions)
+        {
+            block.ContentBlockToPermissions.Add(new ContentBlockToPermission { Permission = permission });
+        }
+        _context.ContentBlocks.Add(block);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return block;
+    }
+
+    private static AaudUser User() => new() { AaudUserId = 1, LoginId = "viewer", MothraId = "m1" };
+
+    private void GrantPermissions(AaudUser user, params string[] permissions)
+    {
+        _userHelper.GetAllPermissions(_rapsContext, user)
+            .Returns(permissions.Select(p => new TblPermission { Permission = p }).ToList());
+    }
+
+    [Fact]
+    public async Task PublicBlock_ReturnedToAnonymousUser()
+    {
+        var block = await SeedBlockAsync(allowPublic: true);
+        _userHelper.GetCurrentUser().ReturnsNull();
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Single(result);
+        Assert.Equal(block.ContentBlockId, result[0].ContentBlockId);
+    }
+
+    [Fact]
+    public async Task RestrictedBlock_WithheldFromUnprivilegedUser()
+    {
+        var block = await SeedBlockAsync(allowPublic: false, "SVMSecure.CATS");
+        var user = User();
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageContentBlocks).Returns(false);
+        _userHelper.HasPermission(_rapsContext, user, "SVMSecure").Returns(true);
+        // User holds an unrelated permission, not the block's required one.
+        GrantPermissions(user, "SVMSecure.Other");
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public async Task RestrictedBlock_ReturnedWhenUserHoldsBlockPermission()
+    {
+        var block = await SeedBlockAsync(allowPublic: false, "SVMSecure.CATS");
+        var user = User();
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageContentBlocks).Returns(false);
+        GrantPermissions(user, "SVMSecure.CATS");
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Single(result);
+    }
+
+    [Fact]
+    public async Task RestrictedBlock_PermissionMatchIsCaseInsensitive()
+    {
+        var block = await SeedBlockAsync(allowPublic: false, "SVMSecure.CATS");
+        var user = User();
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageContentBlocks).Returns(false);
+        GrantPermissions(user, "svmsecure.cats");
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Single(result);
+    }
+
+    [Fact]
+    public async Task CmsAdmin_SeesRestrictedBlock()
+    {
+        var block = await SeedBlockAsync(allowPublic: false, "SVMSecure.CATS");
+        var user = User();
+        _userHelper.GetCurrentUser().Returns(user);
+        // CMS admin override short-circuits before any block-permission match.
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageContentBlocks).Returns(true);
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Single(result);
+    }
+
+    [Fact]
+    public async Task NoPermissionBlock_ReturnedToAnyLoggedInUser()
+    {
+        // A block with no permissions is visible to any authenticated VIPER user (has "SVMSecure").
+        var block = await SeedBlockAsync(allowPublic: false);
+        var user = User();
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageContentBlocks).Returns(false);
+        _userHelper.HasPermission(_rapsContext, user, "SVMSecure").Returns(true);
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Single(result);
+    }
+
+    [Fact]
+    public async Task RestrictedBlock_WithheldFromAnonymousUser()
+    {
+        var block = await SeedBlockAsync(allowPublic: false, "SVMSecure.CATS");
+        _userHelper.GetCurrentUser().ReturnsNull();
+
+        var result = _cms.GetContentBlocksAllowed(null, block.FriendlyName, null, null, null, null, null, 1)?.ToList();
+
+        Assert.NotNull(result);
+        Assert.Empty(result);
+    }
+}
diff --git a/test/CMS/CMSFilesControllerTests.cs b/test/CMS/CMSFilesControllerTests.cs
new file mode 100644
index 000000000..cf90c6186
--- /dev/null
+++ b/test/CMS/CMSFilesControllerTests.cs
@@ -0,0 +1,462 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using NSubstitute.ReturnsExtensions;
+using NSubstitute.ExceptionExtensions;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Controllers;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+using Viper.Models;
+using Viper.Models.AAUD;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Controller wiring tests for CMSFilesController: list/paging passthrough, get/upload/update
+/// delete/restore status mapping (404 on null, 400 on bad input/conflict), import + preview +
+/// bulk-encrypt empty-input guards, and admin-only permanent delete. The service behavior is
+/// covered separately in CmsFileServiceTests / CmsFileImportServiceTests.
+/// </summary>
+public sealed class CMSFilesControllerTests : IDisposable
+{
+    private readonly ICmsFileService _fileService;
+    private readonly ICmsFileStorageService _storage;
+    private readonly ICmsFileAuditService _auditService;
+    private readonly ICmsFileImportService _importService;
+    private readonly RAPSContext _rapsContext;
+    private readonly IUserHelper _userHelper;
+    private readonly CMSFilesController _controller;
+
+    public CMSFilesControllerTests()
+    {
+        _fileService = Substitute.For<ICmsFileService>();
+        _storage = Substitute.For<ICmsFileStorageService>();
+        _auditService = Substitute.For<ICmsFileAuditService>();
+        _importService = Substitute.For<ICmsFileImportService>();
+        _rapsContext = new RAPSContext(new DbContextOptionsBuilder<RAPSContext>()
+            .UseInMemoryDatabase("RAPS_" + Guid.NewGuid()).Options);
+        _userHelper = Substitute.For<IUserHelper>();
+
+        _controller = new CMSFilesController(_fileService, _storage, _auditService, _importService, _rapsContext,
+            Substitute.For<ILogger<CMSFilesController>>(), _userHelper);
+        SetupControllerContext();
+    }
+
+    // Streams backing form files must outlive the controller call; disposed with the test instance.
+    private readonly List<MemoryStream> _formFileStreams = new();
+
+    public void Dispose()
+    {
+        _rapsContext.Dispose();
+        _formFileStreams.ForEach(s => s.Dispose());
+    }
+
+    private void SetupControllerContext()
+    {
+        var serviceProvider = new ServiceCollection().BuildServiceProvider();
+        _controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { RequestServices = serviceProvider }
+        };
+    }
+
+    private static CmsFileDto File(Guid? guid = null) => new()
+    {
+        FileGuid = guid ?? Guid.NewGuid(),
+        FileName = "report.pdf",
+        FriendlyName = "cats-report.pdf",
+        Folder = "cats"
+    };
+
+    private IFormFile MakeFormFile(string fileName = "report.pdf", long length = 3)
+    {
+        var stream = new MemoryStream(new byte[length]);
+        _formFileStreams.Add(stream);
+        return new FormFile(stream, 0, length, "file", fileName);
+    }
+
+    #region List
+
+    [Fact]
+    public async Task GetFiles_PassesFiltersAndPaginationThrough_AndSetsTotal()
+    {
+        // An admin sees the whole trash, so the owner restriction passed to the service is null.
+        var user = new AaudUser { AaudUserId = 1, LoginId = "admin" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(true);
+        var files = new List<CmsFileDto> { File() };
+        _fileService.GetFilesAsync("cats", "deleted", "budget", true, false, 2, 25, "modifiedOn", true,
+            null, Arg.Any<CancellationToken>()).Returns((files, 42));
+        var pagination = new ApiPagination { Page = 2, PerPage = 25 };
+
+        var result = await _controller.GetFiles("cats", "budget", true, false, pagination, "deleted", "modifiedOn", true, TestContext.Current.CancellationToken);
+
+        Assert.Same(files, result.Value);
+        Assert.Equal(42, pagination.TotalRecords);
+        await _fileService.Received(1).GetFilesAsync("cats", "deleted", "budget", true, false, 2, 25, "modifiedOn", true,
+            null, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetFiles_DefaultsPageAndPerPage_WhenNoPagination()
+    {
+        var user = new AaudUser { AaudUserId = 1, LoginId = "user" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _fileService.GetFilesAsync(null, "active", null, null, null, 1, 50, "friendlyName", false,
+            "user", Arg.Any<CancellationToken>()).Returns((new List<CmsFileDto>(), 0));
+
+        await _controller.GetFiles(null, null, null, null, null, ct: TestContext.Current.CancellationToken);
+
+        await _fileService.Received(1).GetFilesAsync(null, "active", null, null, null, 1, 50, "friendlyName", false,
+            "user", Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetFolders_DiskListByDefault_FilterListWhenIncludeData()
+    {
+        _storage.GetTopLevelFolders().Returns(new List<string> { "cats" });
+        _storage.GetFilterFoldersAsync(Arg.Any<CancellationToken>()).Returns(new List<string> { "cats", "legacy" });
+
+        var disk = await _controller.GetFolders(includeData: false, TestContext.Current.CancellationToken);
+        var filter = await _controller.GetFolders(includeData: true, TestContext.Current.CancellationToken);
+
+        Assert.Equal(new List<string> { "cats" }, disk.Value);
+        Assert.Equal(new List<string> { "cats", "legacy" }, filter.Value);
+    }
+
+    [Fact]
+    public async Task GetAudit_PassesFilterAndPaginationThrough_AndSetsTotal()
+    {
+        _auditService.GetAuditEntriesAsync(Arg.Any<CmsFileAuditFilter>(), 3, 10, Arg.Any<CancellationToken>())
+            .Returns(new List<Models.VIPER.FileAudit>());
+        _auditService.GetAuditEntryCountAsync(Arg.Any<CmsFileAuditFilter>(), Arg.Any<CancellationToken>()).Returns(5);
+        var fileGuid = Guid.NewGuid();
+        var pagination = new ApiPagination { Page = 3, PerPage = 10 };
+
+        await _controller.GetAudit(fileGuid, "AccessFile", "loginX", null, null, "needle", pagination, TestContext.Current.CancellationToken);
+
+        Assert.Equal(5, pagination.TotalRecords);
+        await _auditService.Received(1).GetAuditEntriesAsync(
+            Arg.Is<CmsFileAuditFilter>(f =>
+                f.FileGuid == fileGuid && f.Action == "AccessFile" && f.LoginId == "loginX" && f.Search == "needle"),
+            3, 10, Arg.Any<CancellationToken>());
+    }
+
+    #endregion
+
+    #region Get / CheckName
+
+    [Fact]
+    public async Task GetFile_ReturnsFile_WhenFound()
+    {
+        var guid = Guid.NewGuid();
+        _fileService.GetFileAsync(guid, Arg.Any<CancellationToken>()).Returns(File(guid));
+
+        var result = await _controller.GetFile(guid, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        Assert.Equal(guid, result.Value!.FileGuid);
+    }
+
+    [Fact]
+    public async Task GetFile_ReturnsNotFound_WhenMissing()
+    {
+        _fileService.GetFileAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.GetFile(Guid.NewGuid(), TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task CheckName_ReturnsBadRequest_OnArgumentException()
+    {
+        _fileService.CheckNameAsync("nope", "report.pdf", Arg.Any<CancellationToken>())
+            .Throws(new ArgumentException("Invalid folder."));
+
+        var result = await _controller.CheckName("nope", "report.pdf", TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    #endregion
+
+    #region Upload / Update
+
+    [Fact]
+    public async Task UploadFile_ReturnsBadRequest_WhenNoFile()
+    {
+        var result = await _controller.UploadFile(new CmsFileCreateRequest { Folder = "cats" }, null, TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+        await _fileService.DidNotReceive().CreateFileAsync(Arg.Any<CmsFileCreateRequest>(), Arg.Any<IFormFile>(),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task UploadFile_ReturnsFile_OnSuccess()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats" };
+        var dto = File();
+        _fileService.CreateFileAsync(request, Arg.Any<IFormFile>(), Arg.Any<CancellationToken>()).Returns(dto);
+
+        var result = await _controller.UploadFile(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        Assert.Same(dto, result.Value);
+    }
+
+    [Fact]
+    public async Task UploadFile_ReturnsBadRequest_OnConflict()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats" };
+        _fileService.CreateFileAsync(request, Arg.Any<IFormFile>(), Arg.Any<CancellationToken>())
+            .Throws(new InvalidOperationException("A file with that name already exists."));
+
+        var result = await _controller.UploadFile(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task UpdateFile_ReturnsNotFound_WhenServiceReturnsNull()
+    {
+        var guid = Guid.NewGuid();
+        var request = new CmsFileUpdateRequest { Description = "x" };
+        _fileService.UpdateFileAsync(guid, request, Arg.Any<IFormFile?>(), Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.UpdateFile(guid, request, null, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task UpdateFile_ReturnsBadRequest_OnArgumentException()
+    {
+        var guid = Guid.NewGuid();
+        var request = new CmsFileUpdateRequest { Description = "x" };
+        _fileService.UpdateFileAsync(guid, request, Arg.Any<IFormFile?>(), Arg.Any<CancellationToken>())
+            .Throws(new ArgumentException("Replacement must keep the same extension."));
+
+        var result = await _controller.UpdateFile(guid, request, MakeFormFile("x.png"), TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    #endregion
+
+    #region Delete / Restore
+
+    [Fact]
+    public async Task DeleteFile_SoftDelete_ReturnsNoContent()
+    {
+        var guid = Guid.NewGuid();
+        _fileService.SoftDeleteFileAsync(guid, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.DeleteFile(guid, permanent: false, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteFile_SoftDelete_ReturnsNotFound_WhenMissing()
+    {
+        _fileService.SoftDeleteFileAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>()).Returns(false);
+
+        var result = await _controller.DeleteFile(Guid.NewGuid(), permanent: false, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteFile_PermanentWithoutAdmin_ReturnsForbidden()
+    {
+        var user = new AaudUser { AaudUserId = 1, LoginId = "user" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(false);
+
+        var result = await _controller.DeleteFile(Guid.NewGuid(), permanent: true, TestContext.Current.CancellationToken);
+
+        var objectResult = Assert.IsType<ObjectResult>(result);
+        Assert.Equal(StatusCodes.Status403Forbidden, objectResult.StatusCode);
+        await _fileService.DidNotReceive().PermanentlyDeleteFileAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task DeleteFile_PermanentAsAdmin_ReturnsNoContent()
+    {
+        var guid = Guid.NewGuid();
+        var user = new AaudUser { AaudUserId = 1, LoginId = "admin" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(true);
+        _fileService.PermanentlyDeleteFileAsync(guid, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.DeleteFile(guid, permanent: true, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+        await _fileService.Received(1).PermanentlyDeleteFileAsync(guid, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task RestoreFile_ReturnsNoContent_WhenRestored()
+    {
+        var guid = Guid.NewGuid();
+        var user = new AaudUser { AaudUserId = 1, LoginId = "admin" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(true);
+        _fileService.RestoreFileAsync(guid, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.RestoreFile(guid, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+    }
+
+    [Fact]
+    public async Task RestoreFile_AllowsNonAdmin_WhoDeletedTheFile()
+    {
+        var guid = Guid.NewGuid();
+        var user = new AaudUser { AaudUserId = 1, LoginId = "user" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(false);
+        _fileService.GetFileAsync(guid, Arg.Any<CancellationToken>())
+            .Returns(new CmsFileDto { FileGuid = guid, DeletedOn = DateTime.Now, ModifiedBy = "user" });
+        _fileService.RestoreFileAsync(guid, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.RestoreFile(guid, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+        await _fileService.Received(1).RestoreFileAsync(guid, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task RestoreFile_Forbids_WhenNonAdminDidNotDeleteIt()
+    {
+        var guid = Guid.NewGuid();
+        var user = new AaudUser { AaudUserId = 1, LoginId = "user" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(false);
+        _fileService.GetFileAsync(guid, Arg.Any<CancellationToken>())
+            .Returns(new CmsFileDto { FileGuid = guid, DeletedOn = DateTime.Now, ModifiedBy = "someone-else" });
+
+        var result = await _controller.RestoreFile(guid, TestContext.Current.CancellationToken);
+
+        var objectResult = Assert.IsType<ObjectResult>(result);
+        Assert.Equal(StatusCodes.Status403Forbidden, objectResult.StatusCode);
+        await _fileService.DidNotReceive().RestoreFileAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetFiles_ScopesDeletedToOwner_ForNonAdmin()
+    {
+        var user = new AaudUser { AaudUserId = 1, LoginId = "user" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(_rapsContext, user, CmsPermissions.Admin).Returns(false);
+        _fileService.GetFilesAsync(null, "deleted", null, null, null, 1, 50, "friendlyName", false,
+            "user", Arg.Any<CancellationToken>()).Returns((new List<CmsFileDto>(), 0));
+
+        await _controller.GetFiles(null, null, null, null, null, "deleted", ct: TestContext.Current.CancellationToken);
+
+        // A non-admin's trash is scoped to the files they deleted (their login).
+        await _fileService.Received(1).GetFilesAsync(null, "deleted", null, null, null, 1, 50, "friendlyName", false,
+            "user", Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetFiles_FailsClosed_WhenUserContextMissing()
+    {
+        _userHelper.GetCurrentUser().ReturnsNull();
+        _fileService.GetFilesAsync(null, "deleted", null, null, null, 1, 50, "friendlyName", false,
+            string.Empty, Arg.Any<CancellationToken>()).Returns((new List<CmsFileDto>(), 0));
+
+        await _controller.GetFiles(null, null, null, null, null, "deleted", ct: TestContext.Current.CancellationToken);
+
+        // A missing user context must scope the trash to nothing, not fall through to the
+        // admin-level unrestricted (null) view.
+        await _fileService.Received(1).GetFilesAsync(null, "deleted", null, null, null, 1, 50, "friendlyName", false,
+            string.Empty, Arg.Any<CancellationToken>());
+    }
+
+    #endregion
+
+    #region Import / Preview / Bulk-encrypt
+
+    [Fact]
+    public async Task ImportFiles_ReturnsBadRequest_WhenNoPaths()
+    {
+        var result = await _controller.ImportFiles(new CmsFileImportRequest { Folder = "cats" }, TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+        await _importService.DidNotReceive().ImportFilesAsync(Arg.Any<CmsFileImportRequest>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task ImportFiles_PassesRequestThrough_OnSuccess()
+    {
+        var request = new CmsFileImportRequest { Folder = "cats", FilePaths = new List<string> { "legacy/a.pdf" } };
+        var results = new List<CmsFileImportResult> { new() { FilePath = "legacy/a.pdf", Success = true } };
+        _importService.ImportFilesAsync(request, Arg.Any<CancellationToken>()).Returns(results);
+
+        var result = await _controller.ImportFiles(request, TestContext.Current.CancellationToken);
+
+        Assert.Same(results, result.Value);
+    }
+
+    [Fact]
+    public async Task ImportFiles_ReturnsBadRequest_OnInvalidOperation()
+    {
+        var request = new CmsFileImportRequest { Folder = "cats", FilePaths = new List<string> { "legacy/a.pdf" } };
+        _importService.ImportFilesAsync(request, Arg.Any<CancellationToken>())
+            .Throws(new InvalidOperationException("Legacy webroot not configured."));
+
+        var result = await _controller.ImportFiles(request, TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task PreviewImport_ReturnsBadRequest_WhenNoPaths()
+    {
+        var result = await _controller.PreviewImport(new CmsFileImportRequest { Folder = "cats" }, TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task PreviewImport_PassesRequestThrough()
+    {
+        var request = new CmsFileImportRequest { Folder = "cats", FilePaths = new List<string> { "legacy/a.pdf" } };
+        var preview = new List<CmsFileImportPreviewResult> { new() { FilePath = "legacy/a.pdf", CanImport = true } };
+        _importService.PreviewImportAsync(request, Arg.Any<CancellationToken>()).Returns(preview);
+
+        var result = await _controller.PreviewImport(request, TestContext.Current.CancellationToken);
+
+        Assert.Same(preview, result.Value);
+    }
+
+    [Fact]
+    public async Task BulkEncrypt_ReturnsBadRequest_WhenNoGuids()
+    {
+        var result = await _controller.BulkEncrypt(new List<Guid>(), TestContext.Current.CancellationToken);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+        await _importService.DidNotReceive().BulkEncryptAsync(Arg.Any<List<Guid>>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task BulkEncrypt_PassesGuidsThrough()
+    {
+        var guids = new List<Guid> { Guid.NewGuid() };
+        var results = new List<CmsBulkEncryptResult> { new() { FileGuid = guids[0], Success = true } };
+        _importService.BulkEncryptAsync(guids, Arg.Any<CancellationToken>()).Returns(results);
+
+        var result = await _controller.BulkEncrypt(guids, TestContext.Current.CancellationToken);
+
+        Assert.Same(results, result.Value);
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CMSLeftNavControllerTests.cs b/test/CMS/CMSLeftNavControllerTests.cs
new file mode 100644
index 000000000..4a02a1ce8
--- /dev/null
+++ b/test/CMS/CMSLeftNavControllerTests.cs
@@ -0,0 +1,196 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using NSubstitute;
+using NSubstitute.ExceptionExtensions;
+using NSubstitute.ReturnsExtensions;
+using Viper.Areas.CMS.Controllers;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Controller wiring tests for CMSLeftNavController: menu CRUD status mapping, the
+/// duplicate-item-id guard on the batch item save, and cascade delete. The batch save/reorder
+/// semantics themselves are covered in the CmsLeftNavService tests.
+/// </summary>
+public sealed class CMSLeftNavControllerTests
+{
+    private readonly ICmsLeftNavService _leftNavService;
+    private readonly CMSLeftNavController _controller;
+
+    public CMSLeftNavControllerTests()
+    {
+        _leftNavService = Substitute.For<ICmsLeftNavService>();
+        _controller = new CMSLeftNavController(_leftNavService);
+
+        var serviceProvider = new ServiceCollection().BuildServiceProvider();
+        _controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { RequestServices = serviceProvider }
+        };
+    }
+
+    private static LeftNavMenuDto Menu(int id = 1) => new() { LeftNavMenuId = id, MenuHeaderText = "Cats", System = "Viper" };
+
+    #region Get
+
+    [Fact]
+    public async Task GetMenus_PassesFiltersThrough()
+    {
+        var menus = new List<LeftNavMenuDto> { Menu() };
+        _leftNavService.GetMenusAsync("Viper", "cats", "search", Arg.Any<CancellationToken>()).Returns(menus);
+
+        var result = await _controller.GetMenus("Viper", "cats", "search", TestContext.Current.CancellationToken);
+
+        Assert.Same(menus, result.Value);
+        await _leftNavService.Received(1).GetMenusAsync("Viper", "cats", "search", Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetMenu_ReturnsMenu_WhenFound()
+    {
+        _leftNavService.GetMenuAsync(5, Arg.Any<CancellationToken>()).Returns(Menu(5));
+
+        var result = await _controller.GetMenu(5, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        Assert.Equal(5, result.Value!.LeftNavMenuId);
+    }
+
+    [Fact]
+    public async Task GetMenu_ReturnsNotFound_WhenMissing()
+    {
+        _leftNavService.GetMenuAsync(999, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.GetMenu(999, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    #endregion
+
+    #region Create / Update
+
+    [Fact]
+    public async Task CreateMenu_ReturnsCreatedAtAction()
+    {
+        var request = new LeftNavMenuAddEdit { MenuHeaderText = "Cats", System = "Viper" };
+        _leftNavService.CreateMenuAsync(request, Arg.Any<CancellationToken>()).Returns(Menu(8));
+
+        var result = await _controller.CreateMenu(request, TestContext.Current.CancellationToken);
+
+        var created = Assert.IsType<CreatedAtActionResult>(result.Result);
+        Assert.Equal(nameof(CMSLeftNavController.GetMenu), created.ActionName);
+        var dto = Assert.IsType<LeftNavMenuDto>(created.Value);
+        Assert.Equal(8, dto.LeftNavMenuId);
+    }
+
+    [Fact]
+    public async Task UpdateMenu_ReturnsMenu_OnSuccess()
+    {
+        var request = new LeftNavMenuAddEdit { MenuHeaderText = "Cats", System = "Viper" };
+        _leftNavService.UpdateMenuAsync(5, request, Arg.Any<CancellationToken>()).Returns(Menu(5));
+
+        var result = await _controller.UpdateMenu(5, request, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        Assert.Equal(5, result.Value!.LeftNavMenuId);
+    }
+
+    [Fact]
+    public async Task UpdateMenu_ReturnsNotFound_WhenMissing()
+    {
+        var request = new LeftNavMenuAddEdit { MenuHeaderText = "Cats", System = "Viper" };
+        _leftNavService.UpdateMenuAsync(5, request, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.UpdateMenu(5, request, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    #endregion
+
+    #region SaveItems
+
+    [Fact]
+    public async Task SaveItems_ReturnsBadRequest_OnArgumentException()
+    {
+        // The duplicate-id guard now lives in the service; the controller maps its ArgumentException to 400.
+        var items = new List<LeftNavItemEdit> { new() { LeftNavItemId = 2, MenuItemText = "A" } };
+        _leftNavService.SaveItemsAsync(5, items, Arg.Any<CancellationToken>())
+            .Throws(new ArgumentException("Duplicate item ids are not allowed."));
+
+        var result = await _controller.SaveItems(5, items, TestContext.Current.CancellationToken);
+
+        var badRequest = Assert.IsType<BadRequestObjectResult>(result.Result);
+        Assert.Contains("Duplicate item ids", badRequest.Value?.ToString());
+    }
+
+    [Fact]
+    public async Task SaveItems_ReturnsConflict_OnStaleItemId()
+    {
+        var items = new List<LeftNavItemEdit> { new() { LeftNavItemId = 99, MenuItemText = "Stale" } };
+        _leftNavService.SaveItemsAsync(5, items, Arg.Any<CancellationToken>())
+            .Throws(new InvalidOperationException("One or more items no longer exist in this menu. Reload and try again."));
+
+        var result = await _controller.SaveItems(5, items, TestContext.Current.CancellationToken);
+
+        var conflict = Assert.IsType<ConflictObjectResult>(result.Result);
+        Assert.Contains("no longer exist", conflict.Value?.ToString());
+    }
+
+    [Fact]
+    public async Task SaveItems_AllowsMultipleNewItems_WithZeroIds()
+    {
+        var items = new List<LeftNavItemEdit>
+        {
+            new() { LeftNavItemId = 0, MenuItemText = "New 1" },
+            new() { LeftNavItemId = 0, MenuItemText = "New 2" }
+        };
+        _leftNavService.SaveItemsAsync(5, items, Arg.Any<CancellationToken>()).Returns(Menu(5));
+
+        var result = await _controller.SaveItems(5, items, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(result.Value);
+        await _leftNavService.Received(1).SaveItemsAsync(5, items, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task SaveItems_ReturnsNotFound_WhenMenuMissing()
+    {
+        var items = new List<LeftNavItemEdit> { new() { LeftNavItemId = 0, MenuItemText = "A" } };
+        _leftNavService.SaveItemsAsync(5, items, Arg.Any<CancellationToken>()).ReturnsNull();
+
+        var result = await _controller.SaveItems(5, items, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    #endregion
+
+    #region Delete
+
+    [Fact]
+    public async Task DeleteMenu_ReturnsNoContent_WhenDeleted()
+    {
+        _leftNavService.DeleteMenuAsync(5, Arg.Any<CancellationToken>()).Returns(true);
+
+        var result = await _controller.DeleteMenu(5, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NoContentResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteMenu_ReturnsNotFound_WhenMissing()
+    {
+        _leftNavService.DeleteMenuAsync(5, Arg.Any<CancellationToken>()).Returns(false);
+
+        var result = await _controller.DeleteMenu(5, TestContext.Current.CancellationToken);
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CMSLinkCollectionControllerTests.cs b/test/CMS/CMSLinkCollectionControllerTests.cs
new file mode 100644
index 000000000..f51fc213a
--- /dev/null
+++ b/test/CMS/CMSLinkCollectionControllerTests.cs
@@ -0,0 +1,364 @@
+using Areas.CMS.Models;
+using Areas.CMS.Models.DTOs;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Controllers;
+using Viper.Classes.SQLContext;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CMSLinkCollectionController, which holds its EF logic directly (no service layer).
+/// Covers collection CRUD with duplicate-name rejection and tag-category create/reorder/delete,
+/// using a fresh EF in-memory VIPERContext per test.
+/// </summary>
+public sealed class CMSLinkCollectionControllerTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly CMSLinkCollectionController _controller;
+
+    public CMSLinkCollectionControllerTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _controller = new CMSLinkCollectionController(_context);
+    }
+
+    public void Dispose() => _context.Dispose();
+
+    private async Task<LinkCollection> SeedCollectionAsync(string name = "Resources")
+    {
+        var collection = new LinkCollection { LinkCollectionName = name };
+        _context.LinkCollections.Add(collection);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return collection;
+    }
+
+    private async Task<LinkCollectionTagCategory> SeedTagCategoryAsync(int collectionId, string name, int sortOrder)
+    {
+        var category = new LinkCollectionTagCategory
+        {
+            LinkCollectionId = collectionId,
+            LinkCollectionTagCategoryName = name,
+            SortOrder = sortOrder
+        };
+        _context.LinkCollectionTagCategories.Add(category);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return category;
+    }
+
+    #region Collections
+
+    [Fact]
+    public async Task GetLinkCollections_ReturnsOrderedWithTagCategories()
+    {
+        var beta = await SeedCollectionAsync("Beta");
+        await SeedCollectionAsync("Alpha");
+        await SeedTagCategoryAsync(beta.LinkCollectionId, "Region", 2);
+        await SeedTagCategoryAsync(beta.LinkCollectionId, "Topic", 1);
+
+        var result = await _controller.GetLinkCollections();
+
+        var ok = Assert.IsType<OkObjectResult>(result.Result);
+        var collections = Assert.IsAssignableFrom<IEnumerable<LinkCollectionDto>>(ok.Value).ToList();
+        // Collections are ordered by name at the top level.
+        Assert.Equal(new[] { "Alpha", "Beta" }, collections.Select(c => c.LinkCollection));
+        var betaDto = collections.Single(c => c.LinkCollection == "Beta");
+        // Both nested tag categories are projected with their SortOrder (the in-memory provider
+        // does not honor the filtered-include OrderBy, so assert membership, not sequence).
+        Assert.Equal(new[] { "Region", "Topic" },
+            betaDto.LinkCollectionTagCategories.Select(tc => tc.LinkCollectionTagCategory).OrderBy(n => n));
+        Assert.Equal(1, betaDto.LinkCollectionTagCategories.Single(tc => tc.LinkCollectionTagCategory == "Topic").SortOrder);
+    }
+
+    [Fact]
+    public async Task PostLinkCollection_CreatesCollection()
+    {
+        var result = await _controller.PostLinkCollection(new CreateLinkCollectionDto { LinkCollection = "New" });
+
+        Assert.IsType<CreatedAtActionResult>(result.Result);
+        Assert.True(await _context.LinkCollections.AnyAsync(lc => lc.LinkCollectionName == "New",
+            TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task PostLinkCollection_RejectsDuplicateName()
+    {
+        await SeedCollectionAsync();
+
+        var result = await _controller.PostLinkCollection(new CreateLinkCollectionDto { LinkCollection = "Resources" });
+
+        var badRequest = Assert.IsType<BadRequestObjectResult>(result.Result);
+        Assert.Contains("already exists", badRequest.Value?.ToString());
+        Assert.Single(await _context.LinkCollections.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task PutLinkCollection_RenamesCollection()
+    {
+        var collection = await SeedCollectionAsync("Old Name");
+
+        var result = await _controller.PutLinkCollection(collection.LinkCollectionId,
+            new CreateLinkCollectionDto { LinkCollection = "New Name" });
+
+        Assert.IsType<OkObjectResult>(result);
+        var saved = await _context.LinkCollections.FindAsync(
+            new object[] { collection.LinkCollectionId }, TestContext.Current.CancellationToken);
+        Assert.Equal("New Name", saved!.LinkCollectionName);
+    }
+
+    [Fact]
+    public async Task PutLinkCollection_ReturnsNotFound_WhenMissing()
+    {
+        var result = await _controller.PutLinkCollection(999, new CreateLinkCollectionDto { LinkCollection = "X" });
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    [Fact]
+    public async Task PutLinkCollection_RejectsRenameToExistingName()
+    {
+        await SeedCollectionAsync("Taken");
+        var collection = await SeedCollectionAsync("Mine");
+
+        var result = await _controller.PutLinkCollection(collection.LinkCollectionId,
+            new CreateLinkCollectionDto { LinkCollection = "Taken" });
+
+        Assert.IsType<BadRequestObjectResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteLinkCollection_RemovesCollection()
+    {
+        var collection = await SeedCollectionAsync();
+
+        var result = await _controller.DeleteLinkCollection(collection.LinkCollectionId);
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Empty(await _context.LinkCollections.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task DeleteLinkCollection_RemovesLinksTagsAndCategories()
+    {
+        // A collection with a tag category, a link, and a link tag must delete cleanly.
+        // The DB FKs are not ON DELETE CASCADE, so the controller clears dependents first.
+        var collection = await SeedCollectionAsync();
+        var category = await SeedTagCategoryAsync(collection.LinkCollectionId, "Topic", 1);
+        var link = new Link
+        {
+            LinkCollectionId = collection.LinkCollectionId,
+            Url = "https://example.com",
+            Title = "Example",
+            SortOrder = 1
+        };
+        _context.Links.Add(link);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        _context.LinkTags.Add(new LinkTag
+        {
+            LinkId = link.LinkId,
+            LinkCollectionTagCategoryId = category.LinkCollectionTagCategoryId,
+            SortOrder = 1,
+            Value = "alpha"
+        });
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+
+        var result = await _controller.DeleteLinkCollection(collection.LinkCollectionId);
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Empty(await _context.LinkCollections.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.Links.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.LinkCollectionTagCategories.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.LinkTags.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task DeleteLinkCollection_ReturnsNotFound_WhenMissing()
+    {
+        var result = await _controller.DeleteLinkCollection(999);
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    #endregion
+
+    #region Tag categories
+
+    [Fact]
+    public async Task GetLinkCollectionTagCategories_ReturnsOrdered()
+    {
+        var collection = await SeedCollectionAsync();
+        await SeedTagCategoryAsync(collection.LinkCollectionId, "Second", 2);
+        await SeedTagCategoryAsync(collection.LinkCollectionId, "First", 1);
+
+        var result = await _controller.GetLinkCollectionTagCategories(collection.LinkCollectionId);
+
+        var ok = Assert.IsType<OkObjectResult>(result.Result);
+        var categories = Assert.IsAssignableFrom<IEnumerable<LinkCollectionTagCategoryDto>>(ok.Value).ToList();
+        Assert.Equal(new[] { "First", "Second" }, categories.Select(c => c.LinkCollectionTagCategory));
+    }
+
+    [Fact]
+    public async Task GetLinkCollectionTagCategories_ReturnsNotFound_WhenCollectionMissing()
+    {
+        var result = await _controller.GetLinkCollectionTagCategories(999);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task CreateLinkCollectionTagCategory_AddsCategory()
+    {
+        var collection = await SeedCollectionAsync();
+        var dto = new CreateLinkCollectionTagCategoryDto
+        {
+            LinkCollectionId = collection.LinkCollectionId,
+            LinkCollectionTagCategory = "Topic",
+            SortOrder = 1
+        };
+
+        var result = await _controller.CreateLinkCollectionTagCategory(collection.LinkCollectionId, dto);
+
+        var created = Assert.IsType<CreatedAtActionResult>(result.Result);
+        var saved = await _context.LinkCollectionTagCategories.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Equal("Topic", saved.LinkCollectionTagCategoryName);
+        Assert.Equal(collection.LinkCollectionId, saved.LinkCollectionId);
+
+        // The response must carry the generated id so the client can reorder the
+        // new category (otherwise the follow-up tag-order PUT fails validation).
+        var returned = Assert.IsType<LinkCollectionTagCategoryDto>(created.Value);
+        Assert.Equal(saved.LinkCollectionTagCategoryId, returned.LinkCollectionTagCategoryId);
+        Assert.NotEqual(0, returned.LinkCollectionTagCategoryId);
+    }
+
+    [Fact]
+    public async Task CreateLinkCollectionTagCategory_ReturnsNotFound_WhenCollectionMissing()
+    {
+        var dto = new CreateLinkCollectionTagCategoryDto
+        {
+            LinkCollectionId = 999,
+            LinkCollectionTagCategory = "Topic",
+            SortOrder = 1
+        };
+
+        var result = await _controller.CreateLinkCollectionTagCategory(999, dto);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task CreateLinkCollectionTagCategory_RejectsRouteBodyMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        var dto = new CreateLinkCollectionTagCategoryDto
+        {
+            // Body claims a different collection than the route.
+            LinkCollectionId = collection.LinkCollectionId + 1,
+            LinkCollectionTagCategory = "Topic",
+            SortOrder = 1
+        };
+
+        var result = await _controller.CreateLinkCollectionTagCategory(collection.LinkCollectionId, dto);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+        Assert.Empty(await _context.LinkCollectionTagCategories.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task CreateLinkCollectionTagCategory_RejectsDuplicateNameInCollection()
+    {
+        var collection = await SeedCollectionAsync();
+        await SeedTagCategoryAsync(collection.LinkCollectionId, "Topic", 1);
+        var dto = new CreateLinkCollectionTagCategoryDto
+        {
+            LinkCollectionId = collection.LinkCollectionId,
+            LinkCollectionTagCategory = "Topic",
+            SortOrder = 2
+        };
+
+        var result = await _controller.CreateLinkCollectionTagCategory(collection.LinkCollectionId, dto);
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task UpdateLinkCollectionTagCategoryOrder_ReassignsSortOrder()
+    {
+        var collection = await SeedCollectionAsync();
+        var first = await SeedTagCategoryAsync(collection.LinkCollectionId, "First", 1);
+        var second = await SeedTagCategoryAsync(collection.LinkCollectionId, "Second", 2);
+        var updates = new List<UpdateLinkCollectionTagCategoryOrderDto>
+        {
+            new() { LinkCollectionTagCategoryId = first.LinkCollectionTagCategoryId, SortOrder = 2 },
+            new() { LinkCollectionTagCategoryId = second.LinkCollectionTagCategoryId, SortOrder = 1 }
+        };
+
+        var result = await _controller.UpdateLinkCollectionTagCategoryOrder(collection.LinkCollectionId, updates);
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Equal(2, (await _context.LinkCollectionTagCategories.FindAsync(
+            new object[] { first.LinkCollectionTagCategoryId }, TestContext.Current.CancellationToken))!.SortOrder);
+        Assert.Equal(1, (await _context.LinkCollectionTagCategories.FindAsync(
+            new object[] { second.LinkCollectionTagCategoryId }, TestContext.Current.CancellationToken))!.SortOrder);
+    }
+
+    [Fact]
+    public async Task UpdateLinkCollectionTagCategoryOrder_RejectsCountMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        await SeedTagCategoryAsync(collection.LinkCollectionId, "First", 1);
+        await SeedTagCategoryAsync(collection.LinkCollectionId, "Second", 2);
+        var updates = new List<UpdateLinkCollectionTagCategoryOrderDto>
+        {
+            new() { LinkCollectionTagCategoryId = 1, SortOrder = 1 }
+        };
+
+        var result = await _controller.UpdateLinkCollectionTagCategoryOrder(collection.LinkCollectionId, updates);
+
+        Assert.IsType<BadRequestObjectResult>(result);
+    }
+
+    [Fact]
+    public async Task UpdateLinkCollectionTagCategoryOrder_RejectsUnknownCategoryId()
+    {
+        // Count matches, but one submitted id does not belong to the collection.
+        // The lookup must not throw (500); it returns a controlled BadRequest.
+        var collection = await SeedCollectionAsync();
+        var first = await SeedTagCategoryAsync(collection.LinkCollectionId, "First", 1);
+        await SeedTagCategoryAsync(collection.LinkCollectionId, "Second", 2);
+        var updates = new List<UpdateLinkCollectionTagCategoryOrderDto>
+        {
+            new() { LinkCollectionTagCategoryId = first.LinkCollectionTagCategoryId, SortOrder = 1 },
+            new() { LinkCollectionTagCategoryId = 999999, SortOrder = 2 }
+        };
+
+        var result = await _controller.UpdateLinkCollectionTagCategoryOrder(collection.LinkCollectionId, updates);
+
+        Assert.IsType<BadRequestObjectResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteLinkCollectionTagCategory_RemovesCategory()
+    {
+        var collection = await SeedCollectionAsync();
+        var category = await SeedTagCategoryAsync(collection.LinkCollectionId, "Topic", 1);
+
+        var result = await _controller.DeleteLinkCollectionTagCategory(collection.LinkCollectionId,
+            category.LinkCollectionTagCategoryId);
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Empty(await _context.LinkCollectionTagCategories.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task DeleteLinkCollectionTagCategory_ReturnsNotFound_WhenCategoryMissing()
+    {
+        var collection = await SeedCollectionAsync();
+
+        var result = await _controller.DeleteLinkCollectionTagCategory(collection.LinkCollectionId, 999);
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CMSLinkCollectionLinksTests.cs b/test/CMS/CMSLinkCollectionLinksTests.cs
new file mode 100644
index 000000000..79afa9d7b
--- /dev/null
+++ b/test/CMS/CMSLinkCollectionLinksTests.cs
@@ -0,0 +1,369 @@
+using Areas.CMS.Models;
+using Areas.CMS.Models.DTOs;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Viper.Areas.CMS.Controllers;
+using Viper.Classes.SQLContext;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CMSLinkCollectionLinks, which holds its EF logic directly (no service layer).
+/// Covers link CRUD, grouped-by-tag-category listing, link reordering, and the batch
+/// link-tag save (remove-and-recreate). A fresh EF in-memory VIPERContext is used per test;
+/// the in-memory provider's transaction warning is ignored so SaveLinkTags' transaction runs.
+/// </summary>
+public sealed class CMSLinkCollectionLinksTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly CMSLinkCollectionLinks _controller;
+
+    public CMSLinkCollectionLinksTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid())
+            .ConfigureWarnings(w => w.Ignore(InMemoryEventId.TransactionIgnoredWarning))
+            .Options);
+        _controller = new CMSLinkCollectionLinks(_context);
+    }
+
+    public void Dispose() => _context.Dispose();
+
+    private async Task<LinkCollection> SeedCollectionAsync(string name = "Resources")
+    {
+        var collection = new LinkCollection { LinkCollectionName = name };
+        _context.LinkCollections.Add(collection);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return collection;
+    }
+
+    private async Task<Link> SeedLinkAsync(int collectionId, string title, int sortOrder)
+    {
+        var link = new Link
+        {
+            LinkCollectionId = collectionId,
+            Url = "https://example.com/" + title,
+            Title = title,
+            SortOrder = sortOrder
+        };
+        _context.Links.Add(link);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return link;
+    }
+
+    private async Task<LinkCollectionTagCategory> SeedTagCategoryAsync(int collectionId, string name, int sortOrder)
+    {
+        var category = new LinkCollectionTagCategory
+        {
+            LinkCollectionId = collectionId,
+            LinkCollectionTagCategoryName = name,
+            SortOrder = sortOrder
+        };
+        _context.LinkCollectionTagCategories.Add(category);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return category;
+    }
+
+    private async Task SeedLinkTagAsync(int linkId, int categoryId, string value, int sortOrder)
+    {
+        _context.LinkTags.Add(new LinkTag
+        {
+            LinkId = linkId,
+            LinkCollectionTagCategoryId = categoryId,
+            Value = value,
+            SortOrder = sortOrder
+        });
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+    }
+
+    #region GetLinks
+
+    [Fact]
+    public async Task GetLinks_ReturnsLinksOrderedBySortOrder()
+    {
+        var collection = await SeedCollectionAsync();
+        await SeedLinkAsync(collection.LinkCollectionId, "Second", 2);
+        await SeedLinkAsync(collection.LinkCollectionId, "First", 1);
+
+        var result = await _controller.GetLinks(collection.LinkCollectionId);
+
+        var ok = Assert.IsType<OkObjectResult>(result.Result);
+        var links = Assert.IsAssignableFrom<IEnumerable<LinkDto>>(ok.Value).ToList();
+        Assert.Equal(new[] { "First", "Second" }, links.Select(l => l.Title));
+    }
+
+    [Fact]
+    public async Task GetLinks_ReturnsNotFound_WhenCollectionMissing()
+    {
+        var result = await _controller.GetLinks(999);
+
+        Assert.IsType<NotFoundResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task GetLinks_GroupByTagCategory_GroupsLinksSharingATagValue()
+    {
+        var collection = await SeedCollectionAsync();
+        var category = await SeedTagCategoryAsync(collection.LinkCollectionId, "Region", 1);
+        // Two links share the value "Coast"; one has "Inland". Grouping by the category emits
+        // each distinct value's links together, so the two "Coast" links must be adjacent.
+        var first = await SeedLinkAsync(collection.LinkCollectionId, "First", 1);
+        var inland = await SeedLinkAsync(collection.LinkCollectionId, "Inland", 2);
+        var third = await SeedLinkAsync(collection.LinkCollectionId, "Third", 3);
+        await SeedLinkTagAsync(first.LinkId, category.LinkCollectionTagCategoryId, "Coast", 1);
+        await SeedLinkTagAsync(inland.LinkId, category.LinkCollectionTagCategoryId, "Inland", 1);
+        await SeedLinkTagAsync(third.LinkId, category.LinkCollectionTagCategoryId, "Coast", 1);
+
+        var result = await _controller.GetLinks(collection.LinkCollectionId, groupByTagCategory: "region");
+
+        var ok = Assert.IsType<OkObjectResult>(result.Result);
+        var titles = Assert.IsAssignableFrom<IEnumerable<LinkDto>>(ok.Value).Select(l => l.Title).ToList();
+        Assert.Equal(3, titles.Count);
+        Assert.Equal(new[] { "First", "Inland", "Third" }, titles.OrderBy(t => t));
+        // The two "Coast" links group together regardless of their SortOrder.
+        Assert.Equal(1, Math.Abs(titles.IndexOf("First") - titles.IndexOf("Third")));
+    }
+
+    [Fact]
+    public async Task GetLinks_GroupByUnknownTagCategory_ReturnsBadRequest()
+    {
+        var collection = await SeedCollectionAsync();
+        await SeedLinkAsync(collection.LinkCollectionId, "A", 1);
+
+        var result = await _controller.GetLinks(collection.LinkCollectionId, groupByTagCategory: "missing");
+
+        Assert.IsType<BadRequestObjectResult>(result.Result);
+    }
+
+    #endregion
+
+    #region Link CRUD
+
+    [Fact]
+    public async Task PostLink_CreatesLink()
+    {
+        var collection = await SeedCollectionAsync();
+        var dto = new CreateLinkDto
+        {
+            LinkCollectionId = collection.LinkCollectionId,
+            Url = "https://example.com",
+            Title = "Example",
+            SortOrder = 1
+        };
+
+        var result = await _controller.PostLink(collection.LinkCollectionId, dto);
+
+        Assert.IsType<CreatedAtActionResult>(result.Result);
+        Assert.Single(await _context.Links.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task PostLink_ReturnsBadRequest_WhenCollectionIdMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        var dto = new CreateLinkDto
+        {
+            LinkCollectionId = collection.LinkCollectionId + 1,
+            Url = "https://example.com",
+            Title = "Example",
+            SortOrder = 1
+        };
+
+        var result = await _controller.PostLink(collection.LinkCollectionId, dto);
+
+        Assert.IsType<BadRequestResult>(result.Result);
+    }
+
+    [Fact]
+    public async Task PutLink_UpdatesLink()
+    {
+        var collection = await SeedCollectionAsync();
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "Old", 1);
+        var dto = new CreateLinkDto
+        {
+            LinkCollectionId = collection.LinkCollectionId,
+            Url = "https://example.com/new",
+            Title = "New",
+            SortOrder = 5
+        };
+
+        var result = await _controller.PutLink(link.LinkId, collection.LinkCollectionId, dto);
+
+        Assert.IsType<NoContentResult>(result);
+        var saved = await _context.Links.FindAsync(new object[] { link.LinkId }, TestContext.Current.CancellationToken);
+        Assert.Equal("New", saved!.Title);
+        Assert.Equal(5, saved.SortOrder);
+    }
+
+    [Fact]
+    public async Task PutLink_ReturnsNotFound_WhenLinkMissing()
+    {
+        var collection = await SeedCollectionAsync();
+        var dto = new CreateLinkDto
+        {
+            LinkCollectionId = collection.LinkCollectionId,
+            Url = "https://example.com",
+            Title = "X",
+            SortOrder = 1
+        };
+
+        var result = await _controller.PutLink(999, collection.LinkCollectionId, dto);
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    [Fact]
+    public async Task PutLink_ReturnsBadRequest_WhenCollectionMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "Old", 1);
+        var dto = new CreateLinkDto
+        {
+            LinkCollectionId = collection.LinkCollectionId + 1,
+            Url = "https://example.com",
+            Title = "X",
+            SortOrder = 1
+        };
+
+        var result = await _controller.PutLink(link.LinkId, collection.LinkCollectionId + 1, dto);
+
+        Assert.IsType<BadRequestResult>(result);
+    }
+
+    [Fact]
+    public async Task DeleteLink_RemovesLinkAndTags()
+    {
+        var collection = await SeedCollectionAsync();
+        var category = await SeedTagCategoryAsync(collection.LinkCollectionId, "Region", 1);
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "ToDelete", 1);
+        await SeedLinkTagAsync(link.LinkId, category.LinkCollectionTagCategoryId, "West", 1);
+
+        var result = await _controller.DeleteLink(collection.LinkCollectionId, link.LinkId);
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Empty(await _context.Links.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.LinkTags.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task DeleteLink_ReturnsBadRequest_WhenCollectionMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "X", 1);
+
+        var result = await _controller.DeleteLink(collection.LinkCollectionId + 1, link.LinkId);
+
+        Assert.IsType<BadRequestResult>(result);
+        Assert.Single(await _context.Links.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    #endregion
+
+    #region Reorder
+
+    [Fact]
+    public async Task UpdateLinkOrder_ReassignsSortOrder()
+    {
+        var collection = await SeedCollectionAsync();
+        var first = await SeedLinkAsync(collection.LinkCollectionId, "First", 1);
+        var second = await SeedLinkAsync(collection.LinkCollectionId, "Second", 2);
+        var updates = new List<UpdateLinkOrderDto>
+        {
+            new() { LinkId = first.LinkId, SortOrder = 2 },
+            new() { LinkId = second.LinkId, SortOrder = 1 }
+        };
+
+        var result = await _controller.UpdateLinkOrder(collection.LinkCollectionId, updates);
+
+        Assert.IsType<NoContentResult>(result);
+        Assert.Equal(2, (await _context.Links.FindAsync(
+            new object[] { first.LinkId }, TestContext.Current.CancellationToken))!.SortOrder);
+        Assert.Equal(1, (await _context.Links.FindAsync(
+            new object[] { second.LinkId }, TestContext.Current.CancellationToken))!.SortOrder);
+    }
+
+    [Fact]
+    public async Task UpdateLinkOrder_ReturnsNotFound_WhenCollectionMissing()
+    {
+        var result = await _controller.UpdateLinkOrder(999, new List<UpdateLinkOrderDto>());
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    [Fact]
+    public async Task UpdateLinkOrder_RejectsCountMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        await SeedLinkAsync(collection.LinkCollectionId, "First", 1);
+        await SeedLinkAsync(collection.LinkCollectionId, "Second", 2);
+        var updates = new List<UpdateLinkOrderDto> { new() { LinkId = 1, SortOrder = 1 } };
+
+        var result = await _controller.UpdateLinkOrder(collection.LinkCollectionId, updates);
+
+        Assert.IsType<BadRequestObjectResult>(result);
+    }
+
+    #endregion
+
+    #region SaveLinkTags
+
+    [Fact]
+    public async Task SaveLinkTags_ReplacesTagsFromCommaSeparatedValues()
+    {
+        var collection = await SeedCollectionAsync();
+        var category = await SeedTagCategoryAsync(collection.LinkCollectionId, "Region", 1);
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "Link", 1);
+        await SeedLinkTagAsync(link.LinkId, category.LinkCollectionTagCategoryId, "Stale", 1);
+        var tagValues = new Dictionary<int, string>
+        {
+            { category.LinkCollectionTagCategoryId, "West,East" }
+        };
+
+        var result = await _controller.SaveLinkTags(link.LinkId, collection.LinkCollectionId, tagValues);
+
+        Assert.IsType<NoContentResult>(result);
+        var tags = await _context.LinkTags.Where(lt => lt.LinkId == link.LinkId)
+            .ToListAsync(TestContext.Current.CancellationToken);
+        Assert.Equal(2, tags.Count);
+        Assert.DoesNotContain(tags, t => t.Value == "Stale");
+        Assert.Contains(tags, t => t.Value == "West");
+        Assert.Contains(tags, t => t.Value == "East");
+    }
+
+    [Fact]
+    public async Task SaveLinkTags_ReturnsNotFound_WhenLinkMissing()
+    {
+        var collection = await SeedCollectionAsync();
+
+        var result = await _controller.SaveLinkTags(999, collection.LinkCollectionId, new Dictionary<int, string>());
+
+        Assert.IsType<NotFoundResult>(result);
+    }
+
+    [Fact]
+    public async Task SaveLinkTags_ReturnsBadRequest_WhenCollectionMismatch()
+    {
+        var collection = await SeedCollectionAsync();
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "Link", 1);
+
+        var result = await _controller.SaveLinkTags(link.LinkId, collection.LinkCollectionId + 1,
+            new Dictionary<int, string>());
+
+        Assert.IsType<BadRequestResult>(result);
+    }
+
+    [Fact]
+    public async Task SaveLinkTags_ReturnsBadRequest_WhenTagCategoryNotInCollection()
+    {
+        var collection = await SeedCollectionAsync();
+        var link = await SeedLinkAsync(collection.LinkCollectionId, "Link", 1);
+        var tagValues = new Dictionary<int, string> { { 9999, "West" } };
+
+        var result = await _controller.SaveLinkTags(link.LinkId, collection.LinkCollectionId, tagValues);
+
+        Assert.IsType<BadRequestObjectResult>(result);
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CMSUserPhotoControllerTests.cs b/test/CMS/CMSUserPhotoControllerTests.cs
new file mode 100644
index 000000000..8435c55cc
--- /dev/null
+++ b/test/CMS/CMSUserPhotoControllerTests.cs
@@ -0,0 +1,82 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
+using NSubstitute;
+using Viper.Areas.CMS.Controllers;
+using Viper.Areas.CMS.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Controller wiring tests for CMSUserPhotoController: each by-id-type endpoint forwards only
+/// its identifier (and the altPhoto flag) to ICmsUserPhotoService and returns the bytes as an
+/// image/jpeg file response with a private cache header.
+/// </summary>
+public sealed class CMSUserPhotoControllerTests
+{
+    private readonly ICmsUserPhotoService _photoService;
+    private readonly CMSUserPhotoController _controller;
+
+    public CMSUserPhotoControllerTests()
+    {
+        _photoService = Substitute.For<ICmsUserPhotoService>();
+        _controller = new CMSUserPhotoController(_photoService);
+
+        var serviceProvider = new ServiceCollection().BuildServiceProvider();
+        _controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext { RequestServices = serviceProvider }
+        };
+    }
+
+    [Fact]
+    public async Task GetByMailId_ForwardsMailIdOnly()
+    {
+        var bytes = new byte[] { 1, 2, 3 };
+        _photoService.GetUserPhotoAsync("mail@example.com", null, null, false, Arg.Any<CancellationToken>())
+            .Returns(bytes);
+
+        var result = await _controller.GetByMailId("mail@example.com", ct: TestContext.Current.CancellationToken);
+
+        var file = Assert.IsType<FileContentResult>(result);
+        Assert.Equal("image/jpeg", file.ContentType);
+        Assert.Equal(bytes, file.FileContents);
+        await _photoService.Received(1).GetUserPhotoAsync("mail@example.com", null, null, false,
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetByLoginId_ForwardsLoginIdAndAltPhotoFlag()
+    {
+        _photoService.GetUserPhotoAsync(null, "loginX", null, true, Arg.Any<CancellationToken>())
+            .Returns(new byte[] { 9 });
+
+        var result = await _controller.GetByLoginId("loginX", altPhoto: true, TestContext.Current.CancellationToken);
+
+        Assert.IsType<FileContentResult>(result);
+        await _photoService.Received(1).GetUserPhotoAsync(null, "loginX", null, true, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetByIamId_ForwardsIamIdOnly()
+    {
+        _photoService.GetUserPhotoAsync(null, null, "1000123", false, Arg.Any<CancellationToken>())
+            .Returns(new byte[] { 7 });
+
+        var result = await _controller.GetByIamId("1000123", ct: TestContext.Current.CancellationToken);
+
+        Assert.IsType<FileContentResult>(result);
+        await _photoService.Received(1).GetUserPhotoAsync(null, null, "1000123", false, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task ServePhoto_SetsPrivateCacheHeader()
+    {
+        _photoService.GetUserPhotoAsync(Arg.Any<string?>(), Arg.Any<string?>(), Arg.Any<string?>(), Arg.Any<bool>(),
+            Arg.Any<CancellationToken>()).Returns(new byte[] { 1 });
+
+        await _controller.GetByMailId("mail@example.com", ct: TestContext.Current.CancellationToken);
+
+        Assert.Contains("private", _controller.Response.Headers.CacheControl.ToString());
+    }
+}
diff --git a/test/CMS/CmsContentBlockServiceTests.cs b/test/CMS/CmsContentBlockServiceTests.cs
new file mode 100644
index 000000000..a23b57acd
--- /dev/null
+++ b/test/CMS/CmsContentBlockServiceTests.cs
@@ -0,0 +1,543 @@
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+using Viper.Areas.CMS.Models;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+using Viper.Models.VIPER;
+using Viper.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CmsContentBlockService: filtering, create/update with permission and file deltas,
+/// history semantics (previous version is stored, stamped with its original author/time),
+/// concurrency conflicts, soft delete/restore, and permanent delete cascade.
+/// </summary>
+public sealed class CmsContentBlockServiceTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly IHtmlSanitizerService _sanitizer;
+    private readonly CmsContentBlockService _service;
+
+    public CmsContentBlockServiceTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _sanitizer = Substitute.For<IHtmlSanitizerService>();
+        _sanitizer.Sanitize(Arg.Any<string>()).Returns(callInfo => callInfo.ArgAt<string>(0));
+        // Pass-through so diff tests assert on the real htmldiff.net markers, not a sanitized copy.
+        _sanitizer.SanitizeDiff(Arg.Any<string>()).Returns(callInfo => callInfo.ArgAt<string>(0));
+
+        _service = new CmsContentBlockService(_context, _sanitizer, Substitute.For<IUserHelper>());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+    }
+
+    private async Task<ContentBlock> SeedBlockAsync(Action<ContentBlock>? customize = null)
+    {
+        var block = new ContentBlock
+        {
+            Content = "<p>original</p>",
+            Title = "Seeded Block",
+            System = "Viper",
+            ViperSectionPath = "cats",
+            Page = "home",
+            BlockOrder = 1,
+            FriendlyName = "seeded-block-" + Guid.NewGuid().ToString("N")[..8],
+            ModifiedOn = DateTime.Now.AddDays(-2),
+            ModifiedBy = "originalAuthor"
+        };
+        customize?.Invoke(block);
+        _context.ContentBlocks.Add(block);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return block;
+    }
+
+    private static CMSBlockAddEdit MakeRequest(ContentBlock block, Action<CMSBlockAddEdit>? customize = null)
+    {
+        var request = new CMSBlockAddEdit
+        {
+            ContentBlockId = block.ContentBlockId,
+            Content = block.Content,
+            Title = block.Title,
+            System = block.System,
+            Page = block.Page,
+            ViperSectionPath = block.ViperSectionPath,
+            BlockOrder = block.BlockOrder,
+            FriendlyName = block.FriendlyName,
+            AllowPublicAccess = block.AllowPublicAccess,
+            LastModifiedOn = block.ModifiedOn
+        };
+        customize?.Invoke(request);
+        return request;
+    }
+
+    #region List / Get
+
+    [Fact]
+    public async Task GetContentBlocks_FiltersByStatus()
+    {
+        await SeedBlockAsync();
+        await SeedBlockAsync(b => b.DeletedOn = DateTime.Now);
+
+        var active = await _service.GetContentBlocksAsync("active", null, null, null, null, 1, 50, "title", false, TestContext.Current.CancellationToken);
+        var deleted = await _service.GetContentBlocksAsync("deleted", null, null, null, null, 1, 50, "title", false, TestContext.Current.CancellationToken);
+        var all = await _service.GetContentBlocksAsync("all", null, null, null, null, 1, 50, "title", false, TestContext.Current.CancellationToken);
+
+        Assert.Single(active.Blocks);
+        Assert.Single(deleted.Blocks);
+        Assert.Equal(2, all.Blocks.Count);
+        Assert.Equal(2, all.Total);
+    }
+
+    [Fact]
+    public async Task GetContentBlocks_PagesSortsAndReturnsTotal()
+    {
+        await SeedBlockAsync(b => b.Title = "Charlie");
+        await SeedBlockAsync(b => b.Title = "Alpha");
+        await SeedBlockAsync(b => b.Title = "Bravo");
+
+        var page1 = await _service.GetContentBlocksAsync("active", null, null, null, null, 1, 2, "title", false,
+            TestContext.Current.CancellationToken);
+        var page2 = await _service.GetContentBlocksAsync("active", null, null, null, null, 2, 2, "title", false,
+            TestContext.Current.CancellationToken);
+
+        // Total counts all matches; the page returns only its slice, sorted by title across pages.
+        Assert.Equal(3, page1.Total);
+        Assert.Equal(new[] { "Alpha", "Bravo" }, page1.Blocks.Select(b => b.Title));
+        Assert.Single(page2.Blocks);
+        Assert.Equal("Charlie", page2.Blocks[0].Title);
+
+        var desc = await _service.GetContentBlocksAsync("active", null, null, null, null, 1, 1, "title", true,
+            TestContext.Current.CancellationToken);
+        Assert.Equal("Charlie", desc.Blocks[0].Title);
+    }
+
+    [Fact]
+    public async Task GetContentBlocks_ListOmitsContent()
+    {
+        await SeedBlockAsync();
+
+        var list = await _service.GetContentBlocksAsync("active", null, null, null, null, 1, 50, "title", false, TestContext.Current.CancellationToken);
+
+        Assert.Equal(string.Empty, list.Blocks[0].Content);
+    }
+
+    [Fact]
+    public async Task GetContentBlock_ReturnsContentAndRelations()
+    {
+        var block = await SeedBlockAsync(b =>
+            b.ContentBlockToPermissions.Add(new ContentBlockToPermission { Permission = "SVMSecure.CATS" }));
+
+        var dto = await _service.GetContentBlockAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(dto);
+        Assert.Equal("<p>original</p>", dto.Content);
+        Assert.Equal(new List<string> { "SVMSecure.CATS" }, dto.Permissions);
+    }
+
+    #endregion
+
+    #region Create
+
+    [Fact]
+    public async Task Create_SavesBlockWithPermissionsAndNoHistory()
+    {
+        var request = new CMSBlockAddEdit
+        {
+            ContentBlockId = 0,
+            Content = "<p>new</p>",
+            Title = "New Block",
+            System = "Viper",
+            AllowPublicAccess = false,
+            Permissions = new List<string> { "SVMSecure.CATS" }
+        };
+
+        var dto = await _service.CreateContentBlockAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.True(dto.ContentBlockId > 0);
+        Assert.Equal(new List<string> { "SVMSecure.CATS" }, dto.Permissions);
+        // Legacy semantics: history holds previous versions only, so a new block has none.
+        Assert.Empty(_context.ContentHistories.Where(h => h.ContentBlockId == dto.ContentBlockId));
+    }
+
+    [Fact]
+    public async Task Create_DuplicateFriendlyName_Throws()
+    {
+        var existing = await SeedBlockAsync();
+        var request = new CMSBlockAddEdit
+        {
+            ContentBlockId = 0,
+            Content = "x",
+            Title = "Dup",
+            System = "Viper",
+            AllowPublicAccess = false,
+            FriendlyName = existing.FriendlyName
+        };
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.CreateContentBlockAsync(request, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Create_UnknownFileGuid_Throws()
+    {
+        var request = new CMSBlockAddEdit
+        {
+            ContentBlockId = 0,
+            Content = "x",
+            Title = "Has Bad File",
+            System = "Viper",
+            AllowPublicAccess = false,
+            FileGuids = new List<Guid> { Guid.NewGuid() }
+        };
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.CreateContentBlockAsync(request, TestContext.Current.CancellationToken));
+    }
+
+    #endregion
+
+    #region Update
+
+    [Fact]
+    public async Task Update_WritesPreviousVersionToHistory()
+    {
+        var block = await SeedBlockAsync();
+        var originalModifiedOn = block.ModifiedOn;
+        var request = MakeRequest(block, r => r.Content = "<p>updated</p>");
+
+        var dto = await _service.UpdateContentBlockAsync(block.ContentBlockId, request, TestContext.Current.CancellationToken);
+
+        Assert.Equal("<p>updated</p>", dto!.Content);
+        var history = Assert.Single(_context.ContentHistories.Where(h => h.ContentBlockId == block.ContentBlockId));
+        Assert.Equal("<p>original</p>", history.ContentBlockContent);
+        Assert.Equal("originalAuthor", history.ModifiedBy);
+        Assert.Equal(originalModifiedOn, history.ModifiedOn);
+    }
+
+    [Fact]
+    public async Task Update_StaleLastModifiedOn_ThrowsConcurrency()
+    {
+        var block = await SeedBlockAsync();
+        var request = MakeRequest(block, r => r.LastModifiedOn = block.ModifiedOn.AddMinutes(-5));
+
+        await Assert.ThrowsAsync<CmsConcurrencyException>(
+            () => _service.UpdateContentBlockAsync(block.ContentBlockId, request, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Update_NullLastModifiedOn_Throws()
+    {
+        var block = await SeedBlockAsync();
+        var request = MakeRequest(block, r => r.LastModifiedOn = null);
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.UpdateContentBlockAsync(block.ContentBlockId, request, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Update_UnknownFileGuid_Throws()
+    {
+        var block = await SeedBlockAsync();
+        var request = MakeRequest(block, r => r.FileGuids = new List<Guid> { Guid.NewGuid() });
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.UpdateContentBlockAsync(block.ContentBlockId, request, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Update_AppliesPermissionAndFileDeltas()
+    {
+        var file = new Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = @"C:\FakeRoot\cats\attach.pdf",
+            Folder = "cats",
+            FriendlyName = "cats-attach.pdf",
+            Description = "",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now
+        };
+        _context.Files.Add(file);
+        var block = await SeedBlockAsync(b =>
+            b.ContentBlockToPermissions.Add(new ContentBlockToPermission { Permission = "SVMSecure.Old" }));
+
+        var request = MakeRequest(block, r =>
+        {
+            r.Permissions = new List<string> { "SVMSecure.New" };
+            r.FileGuids = new List<Guid> { file.FileGuid };
+        });
+
+        var dto = await _service.UpdateContentBlockAsync(block.ContentBlockId, request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(new List<string> { "SVMSecure.New" }, dto!.Permissions);
+        Assert.Single(dto.Files);
+        Assert.Equal("cats-attach.pdf", dto.Files[0].FriendlyName);
+    }
+
+    [Fact]
+    public async Task UpdateContentOnly_PreservesOtherFieldsAndWritesHistory()
+    {
+        var block = await SeedBlockAsync();
+
+        var dto = await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>quick edit</p>", block.ModifiedOn,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal("<p>quick edit</p>", dto!.Content);
+        Assert.Equal("Seeded Block", dto.Title);
+        var history = Assert.Single(_context.ContentHistories.Where(h => h.ContentBlockId == block.ContentBlockId));
+        Assert.Equal("<p>original</p>", history.ContentBlockContent);
+    }
+
+    #endregion
+
+    #region Delete / Restore / History
+
+    [Fact]
+    public async Task SoftDeleteAndRestore_ToggleDeletedOn()
+    {
+        var block = await SeedBlockAsync();
+
+        Assert.True(await _service.SoftDeleteAsync(block.ContentBlockId, TestContext.Current.CancellationToken));
+        Assert.NotNull((await _context.ContentBlocks.SingleAsync(TestContext.Current.CancellationToken)).DeletedOn);
+
+        Assert.True(await _service.RestoreAsync(block.ContentBlockId, TestContext.Current.CancellationToken));
+        Assert.Null((await _context.ContentBlocks.SingleAsync(TestContext.Current.CancellationToken)).DeletedOn);
+    }
+
+    [Fact]
+    public async Task PermanentDelete_RemovesBlockAndChildren()
+    {
+        var block = await SeedBlockAsync(b =>
+        {
+            b.ContentBlockToPermissions.Add(new ContentBlockToPermission { Permission = "SVMSecure" });
+            b.ContentHistories.Add(new ContentHistory
+            {
+                ContentBlockContent = "old",
+                ModifiedOn = DateTime.Now.AddDays(-3),
+                ModifiedBy = "x"
+            });
+        });
+
+        var result = await _service.PermanentlyDeleteAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+
+        Assert.True(result);
+        Assert.Empty(await _context.ContentBlocks.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.ContentHistories.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.ContentBlockToPermissions.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task History_ListAndVersionRetrieval()
+    {
+        var block = await SeedBlockAsync();
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v2</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v3</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+
+        var history = await _service.GetHistoryAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+        Assert.Equal(2, history.Count);
+
+        var oldest = await _service.GetHistoryVersionAsync(block.ContentBlockId, history[^1].ContentHistoryId,
+            TestContext.Current.CancellationToken);
+        Assert.Equal("<p>original</p>", oldest!.Content);
+    }
+
+    #endregion
+
+    #region Cross-block edit history
+
+    private async Task<ContentBlock> SeedBlockWithHistoryAsync(string title, string page, bool deleted,
+        params (string author, DateTime when)[] versions)
+    {
+        var block = await SeedBlockAsync(b =>
+        {
+            b.Title = title;
+            b.Page = page;
+            b.DeletedOn = deleted ? DateTime.Now : null;
+            foreach (var (author, when) in versions)
+            {
+                b.ContentHistories.Add(new ContentHistory
+                {
+                    ContentBlockContent = $"<p>{author}@{when:o}</p>",
+                    ModifiedOn = when,
+                    ModifiedBy = author
+                });
+            }
+        });
+        return block;
+    }
+
+    [Fact]
+    public async Task GetHistoryEntries_ReturnsAcrossBlocks_NewestFirst_WithBlockInfo()
+    {
+        var now = DateTime.Now;
+        await SeedBlockWithHistoryAsync("Alpha", "home", deleted: false,
+            ("editorX", now.AddDays(-3)), ("editorY", now.AddDays(-1)));
+        await SeedBlockWithHistoryAsync("Beta", "about", deleted: true,
+            ("editorX", now.AddDays(-2)));
+
+        var entries = await _service.GetHistoryEntriesAsync(new CmsContentHistoryFilter(), 1, 50,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(3, entries.Count);
+        // Newest first: editorY@-1 (Alpha), editorX@-2 (Beta), editorX@-3 (Alpha).
+        Assert.Equal("editorY", entries[0].ModifiedBy);
+        Assert.Equal("Alpha", entries[0].Title);
+        Assert.Equal("home", entries[0].Page);
+        Assert.False(entries[0].BlockDeleted);
+        Assert.Equal("Beta", entries[1].Title);
+        Assert.True(entries[1].BlockDeleted);
+    }
+
+    [Fact]
+    public async Task GetHistoryEntries_FiltersByEditorBlockSearchAndDate()
+    {
+        var now = DateTime.Now;
+        var alpha = await SeedBlockWithHistoryAsync("Alpha", "home", deleted: false,
+            ("editorX", now.AddDays(-3)), ("editorY", now.AddDays(-1)));
+        await SeedBlockWithHistoryAsync("Beta", "about", deleted: false,
+            ("editorX", now.AddDays(-2)));
+
+        var byEditor = await _service.GetHistoryEntriesAsync(new CmsContentHistoryFilter { ModifiedBy = "editorX" },
+            1, 50, TestContext.Current.CancellationToken);
+        Assert.Equal(2, byEditor.Count);
+        Assert.All(byEditor, e => Assert.Equal("editorX", e.ModifiedBy));
+
+        var byBlock = await _service.GetHistoryEntriesAsync(new CmsContentHistoryFilter { ContentBlockId = alpha.ContentBlockId },
+            1, 50, TestContext.Current.CancellationToken);
+        Assert.Equal(2, byBlock.Count);
+        Assert.All(byBlock, e => Assert.Equal(alpha.ContentBlockId, e.ContentBlockId));
+
+        var bySearch = await _service.GetHistoryEntriesAsync(new CmsContentHistoryFilter { Search = "Beta" },
+            1, 50, TestContext.Current.CancellationToken);
+        Assert.Single(bySearch);
+        Assert.Equal("Beta", bySearch[0].Title);
+
+        // To is inclusive through end of the given day; From excludes older rows.
+        var byDate = await _service.GetHistoryEntriesAsync(
+            new CmsContentHistoryFilter { From = now.AddDays(-2).Date, To = now.Date },
+            1, 50, TestContext.Current.CancellationToken);
+        Assert.DoesNotContain(byDate, e => e.ModifiedOn < now.AddDays(-2).Date);
+    }
+
+    [Fact]
+    public async Task GetHistoryEntries_PaginatesAndCounts()
+    {
+        var now = DateTime.Now;
+        await SeedBlockWithHistoryAsync("Alpha", "home", deleted: false,
+            ("a", now.AddDays(-3)), ("b", now.AddDays(-2)), ("c", now.AddDays(-1)));
+
+        var filter = new CmsContentHistoryFilter();
+        var firstPage = await _service.GetHistoryEntriesAsync(filter, 1, 2, TestContext.Current.CancellationToken);
+        var secondPage = await _service.GetHistoryEntriesAsync(filter, 2, 2, TestContext.Current.CancellationToken);
+        var total = await _service.GetHistoryEntryCountAsync(filter, TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, firstPage.Count);
+        Assert.Single(secondPage);
+        Assert.Equal(3, total);
+    }
+
+    #endregion
+
+    #region Version diff
+
+    [Fact]
+    public async Task GetHistoryVersionDiff_AgainstPreviousVersion_MarksChangesAndReSanitizes()
+    {
+        var block = await SeedBlockAsync();
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v2</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v3</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+
+        // History newest-first is [v2, original]; v2 has a predecessor (original) to diff against.
+        var history = await _service.GetHistoryAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+        var v2 = history[0];
+
+        var diff = await _service.GetHistoryVersionDiffAsync(block.ContentBlockId, v2.ContentHistoryId,
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(diff);
+        Assert.True(diff.HasComparison);
+        Assert.True(diff.HasChanges);
+        Assert.Equal("originalAuthor", diff.OldModifiedBy);
+        Assert.Contains("<ins", diff.Content);
+        Assert.Contains("<del", diff.Content);
+        Assert.Contains("v2", diff.Content);
+        // The merged diff is re-sanitized (not the raw library output) before it leaves the service.
+        _sanitizer.Received().SanitizeDiff(Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task GetHistoryVersionDiff_OriginalVersion_HasNoComparison()
+    {
+        var block = await SeedBlockAsync();
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v2</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+
+        var history = await _service.GetHistoryAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+        var original = history[^1];
+
+        var diff = await _service.GetHistoryVersionDiffAsync(block.ContentBlockId, original.ContentHistoryId,
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(diff);
+        Assert.False(diff.HasComparison);
+        Assert.Equal("<p>original</p>", diff.Content);
+        Assert.DoesNotContain("<ins", diff.Content);
+    }
+
+    [Fact]
+    public async Task GetHistoryVersionDiff_UnknownVersion_ReturnsNull()
+    {
+        var block = await SeedBlockAsync();
+
+        var diff = await _service.GetHistoryVersionDiffAsync(block.ContentBlockId, 999999,
+            TestContext.Current.CancellationToken);
+
+        Assert.Null(diff);
+    }
+
+    [Fact]
+    public async Task DiffContentAgainstHistory_ComparesDraftToSelectedVersion()
+    {
+        var block = await SeedBlockAsync();
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v2</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+
+        var history = await _service.GetHistoryAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+        var original = history[^1];
+
+        var diff = await _service.DiffContentAgainstHistoryAsync(block.ContentBlockId, original.ContentHistoryId,
+            "<p>current draft</p>", TestContext.Current.CancellationToken);
+
+        Assert.NotNull(diff);
+        Assert.True(diff.HasComparison);
+        Assert.True(diff.HasChanges);
+        Assert.Equal("originalAuthor", diff.OldModifiedBy);
+        Assert.Contains("<ins", diff.Content);
+        Assert.Contains("current draft", diff.Content);
+    }
+
+    [Fact]
+    public async Task DiffContentAgainstHistory_IdenticalContent_ReportsNoChanges()
+    {
+        var block = await SeedBlockAsync();
+        await _service.UpdateContentOnlyAsync(block.ContentBlockId, "<p>v2</p>", block.ModifiedOn, TestContext.Current.CancellationToken);
+
+        var history = await _service.GetHistoryAsync(block.ContentBlockId, TestContext.Current.CancellationToken);
+        var original = history[^1]; // holds "<p>original</p>"
+
+        // Current draft is byte-identical to the selected version: htmldiff emits no ins/del.
+        var diff = await _service.DiffContentAgainstHistoryAsync(block.ContentBlockId, original.ContentHistoryId,
+            "<p>original</p>", TestContext.Current.CancellationToken);
+
+        Assert.NotNull(diff);
+        Assert.True(diff.HasComparison);
+        Assert.False(diff.HasChanges);
+        Assert.DoesNotContain("<ins", diff.Content);
+        Assert.DoesNotContain("<del", diff.Content);
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CmsDownloadRateLimitingTests.cs b/test/CMS/CmsDownloadRateLimitingTests.cs
new file mode 100644
index 000000000..4d47c538f
--- /dev/null
+++ b/test/CMS/CmsDownloadRateLimitingTests.cs
@@ -0,0 +1,88 @@
+using System.Net;
+using System.Security.Claims;
+using Microsoft.AspNetCore.Http;
+using Viper.Areas.CMS.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for the CMS download rate-limit partitioning: ZIP and single-file requests get
+/// separate buckets, keyed by login when authenticated and client IP otherwise.
+/// </summary>
+public sealed class CmsDownloadRateLimitingTests
+{
+    private static DefaultHttpContext MakeContext(string? queryString = null, string? login = null, string? ip = null)
+    {
+        var context = new DefaultHttpContext();
+        if (queryString != null)
+        {
+            context.Request.QueryString = new QueryString(queryString);
+        }
+        if (login != null)
+        {
+            context.User = new ClaimsPrincipal(new ClaimsIdentity(
+                new[] { new Claim(ClaimTypes.Name, login) }, authenticationType: "test"));
+        }
+        if (ip != null)
+        {
+            context.Connection.RemoteIpAddress = IPAddress.Parse(ip);
+        }
+        return context;
+    }
+
+    [Theory]
+    [InlineData("?ids=abc", true)]
+    [InlineData("?ids=abc,def&fileName=x.zip", true)]
+    [InlineData("?ids=", false)]
+    [InlineData("?id=abc", false)]
+    [InlineData("?fn=somefile.pdf", false)]
+    [InlineData(null, false)]
+    public void IsZipRequest_DetectsIdsParameter(string? query, bool expected)
+    {
+        var context = MakeContext(query);
+
+        Assert.Equal(expected, CmsDownloadRateLimiting.IsZipRequest(context));
+    }
+
+    [Fact]
+    public void PartitionKey_ZipAndFileRequests_GetSeparateBuckets()
+    {
+        var zipKey = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?ids=a,b", login: "rexl"));
+        var fileKey = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf", login: "rexl"));
+
+        Assert.NotEqual(zipKey, fileKey);
+        Assert.StartsWith("zip|", zipKey);
+        Assert.StartsWith("file|", fileKey);
+    }
+
+    [Fact]
+    public void PartitionKey_AuthenticatedUser_KeysOnLoginNotIp()
+    {
+        var sameUserIp1 = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf", login: "rexl", ip: "10.0.0.1"));
+        var sameUserIp2 = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf", login: "rexl", ip: "10.0.0.2"));
+        var otherUserSameIp = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf", login: "bob", ip: "10.0.0.1"));
+
+        Assert.Equal(sameUserIp1, sameUserIp2);
+        Assert.NotEqual(sameUserIp1, otherUserSameIp);
+    }
+
+    [Fact]
+    public void PartitionKey_Anonymous_KeysOnClientIp()
+    {
+        var ip1 = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf", ip: "10.0.0.1"));
+        var ip2 = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf", ip: "10.0.0.2"));
+
+        Assert.NotEqual(ip1, ip2);
+        Assert.Contains("10.0.0.1", ip1);
+    }
+
+    [Fact]
+    public void PartitionKey_AnonymousWithoutIp_UsesStableFallback()
+    {
+        var key1 = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=x.pdf"));
+        var key2 = CmsDownloadRateLimiting.GetPartitionKey(MakeContext("?fn=y.pdf"));
+
+        Assert.Equal("file|unknown", key1);
+        Assert.Equal(key1, key2);
+    }
+}
diff --git a/test/CMS/CmsFileCryptoTests.cs b/test/CMS/CmsFileCryptoTests.cs
new file mode 100644
index 000000000..f0ec27114
--- /dev/null
+++ b/test/CMS/CmsFileCryptoTests.cs
@@ -0,0 +1,110 @@
+using System.Security.Cryptography;
+using System.Text;
+using Viper.Areas.CMS.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for the CF-compatible CMS file crypto primitives. The DB key format
+/// (UUEncode over AES-ECB) and content encryption must round-trip so files written
+/// by the new system stay readable by the legacy ColdFusion CMS and vice versa.
+/// </summary>
+public sealed class CmsFileCryptoTests
+{
+    private static string NewMasterKey() => Convert.ToBase64String(RandomNumberGenerator.GetBytes(16));
+
+    [Fact]
+    public void GenerateFileKey_IsBase64Of128BitKey()
+    {
+        var key = CmsFileCrypto.GenerateFileKey();
+
+        var bytes = Convert.FromBase64String(key);
+        Assert.Equal(16, bytes.Length);
+    }
+
+    [Fact]
+    public void DbKey_RoundTrips_ThroughEncryptAndDecrypt()
+    {
+        var masterKey = NewMasterKey();
+        var fileKey = CmsFileCrypto.GenerateFileKey();
+
+        var dbKey = CmsFileCrypto.EncryptDbKey(fileKey, masterKey);
+        var decrypted = CmsFileCrypto.DecryptDbKey(dbKey, masterKey);
+
+        Assert.Equal(fileKey, decrypted);
+        // Stored keys must be printable (UU-encoded) for the varchar column.
+        Assert.All(dbKey, c => Assert.True(c < 127));
+    }
+
+    [Fact]
+    public void DbKey_DiffersPerCall_EvenForSameFileKey()
+    {
+        // Same plaintext under different master keys must never produce the same stored key.
+        var fileKey = CmsFileCrypto.GenerateFileKey();
+
+        var dbKey1 = CmsFileCrypto.EncryptDbKey(fileKey, NewMasterKey());
+        var dbKey2 = CmsFileCrypto.EncryptDbKey(fileKey, NewMasterKey());
+
+        Assert.NotEqual(dbKey1, dbKey2);
+    }
+
+    [Fact]
+    public void FileContents_RoundTrip_ThroughEncryptAndDecrypt()
+    {
+        var fileKey = CmsFileCrypto.GenerateFileKey();
+        var contents = Encoding.UTF8.GetBytes("PDF-1.7 pretend file contents éü with some length to cross a block boundary.");
+
+        var encrypted = CmsFileCrypto.EncryptBytes(contents, fileKey);
+        var decrypted = CmsFileCrypto.DecryptBytes(encrypted, fileKey);
+
+        Assert.NotEqual(contents, encrypted);
+        Assert.Equal(contents, decrypted);
+    }
+
+    [Fact]
+    public void FullFlow_DbKeyPlusContents_MatchesLegacyDecryptPath()
+    {
+        // Mirrors CMS.DecryptFile: db key -> per-file key -> ECB decrypt of contents.
+        var masterKey = NewMasterKey();
+        var fileKey = CmsFileCrypto.GenerateFileKey();
+        var dbKey = CmsFileCrypto.EncryptDbKey(fileKey, masterKey);
+        var contents = RandomNumberGenerator.GetBytes(1024);
+
+        var encrypted = CmsFileCrypto.EncryptBytes(contents, fileKey);
+        var decrypted = CmsFileCrypto.DecryptBytes(encrypted, CmsFileCrypto.DecryptDbKey(dbKey, masterKey));
+
+        Assert.Equal(contents, decrypted);
+    }
+
+    [Fact]
+    public void ReadMasterKey_ReadsSecondLine()
+    {
+        var path = Path.Join(Path.GetTempPath(), Guid.NewGuid().ToString("N") + ".txt");
+        try
+        {
+            File.WriteAllLines(path, new[] { "first line is ignored", "  the-master-key  ", "third" });
+
+            Assert.Equal("the-master-key", CmsFileCrypto.ReadMasterKey(path));
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+
+    [Fact]
+    public void ReadMasterKey_MissingKeyLine_Throws()
+    {
+        var path = Path.Join(Path.GetTempPath(), Guid.NewGuid().ToString("N") + ".txt");
+        try
+        {
+            File.WriteAllLines(path, new[] { "only one line" });
+
+            Assert.Throws<InvalidOperationException>(() => CmsFileCrypto.ReadMasterKey(path));
+        }
+        finally
+        {
+            File.Delete(path);
+        }
+    }
+}
diff --git a/test/CMS/CmsFileImportServiceTests.cs b/test/CMS/CmsFileImportServiceTests.cs
new file mode 100644
index 000000000..bbc16a42c
--- /dev/null
+++ b/test/CMS/CmsFileImportServiceTests.cs
@@ -0,0 +1,476 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CmsFileImportService: importing from the legacy webroot (source containment,
+/// move semantics, oldURL tracking, default permission) and bulk encryption.
+/// </summary>
+public sealed class CmsFileImportServiceTests : IDisposable
+{
+    private readonly string _webroot;
+    private readonly VIPERContext _context;
+    private readonly ICmsFileStorageService _storage;
+    private readonly ICmsFileEncryptionService _encryption;
+    private readonly ICmsFileAuditService _audit;
+    private readonly CmsFileImportService _service;
+
+    public CmsFileImportServiceTests()
+    {
+        _webroot = Path.Join(Path.GetTempPath(), "ViperCmsImportTests_" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(Path.Join(_webroot, "cats", "docs"));
+
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+
+        _storage = Substitute.For<ICmsFileStorageService>();
+        _storage.IsValidFolder(Arg.Any<string>()).Returns(true);
+        // Default: available name echoes the input (no rename needed).
+        _storage.GetAvailableFileName(Arg.Any<string>(), Arg.Any<string>())
+            .Returns(callInfo => callInfo.ArgAt<string>(1));
+        _storage.MoveIntoPlace(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<bool>())
+            .Returns(callInfo =>
+            {
+                // emulate the real move so source-removal logic can be tested
+                File.Delete(callInfo.ArgAt<string>(0));
+                return Path.Join(@"C:\FakeRoot", callInfo.ArgAt<string>(1), Path.GetFileName(callInfo.ArgAt<string>(2)));
+            });
+
+        _encryption = Substitute.For<ICmsFileEncryptionService>();
+        _encryption.GenerateKeyForDb().Returns("encrypted-db-key");
+        _audit = Substitute.For<ICmsFileAuditService>();
+
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["CMS:LegacyWebrootPath"] = _webroot })
+            .Build();
+
+        _service = new CmsFileImportService(_context, _storage, _encryption, _audit,
+            Substitute.For<IUserHelper>(), configuration, Substitute.For<ILogger<CmsFileImportService>>());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        if (Directory.Exists(_webroot))
+        {
+            Directory.Delete(_webroot, recursive: true);
+        }
+    }
+
+    private string CreateWebrootFile(string relativePath, string contents = "legacy file")
+    {
+        // Split on both separator styles: on Linux a raw @"cats\docs\x.pdf" would otherwise
+        // become one literal file name in the webroot root instead of a nested path.
+        var segments = relativePath.Replace('\\', '/').Split('/', StringSplitOptions.RemoveEmptyEntries);
+        var path = Path.Join(_webroot, Path.Join(segments));
+        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+        File.WriteAllText(path, contents);
+        return path;
+    }
+
+    [Fact]
+    public async Task Import_MovesFileAndRecordsOldUrl()
+    {
+        var source = CreateWebrootFile(@"cats\docs\manual.pdf");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "/cats/docs/manual.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.ImportFilesAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.True(result.Success, result.Message);
+        Assert.Equal("cats-manual.pdf", result.FriendlyName);
+        Assert.False(File.Exists(source));
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Equal("/cats/docs/manual.pdf", saved.OldUrl);
+        Assert.Equal("Automatically imported from Viper", saved.Description);
+        _audit.Received(1).Audit(Arg.Any<Viper.Models.VIPER.File>(), CmsFileAuditActions.ImportFile, Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task Import_DefaultPermission_AddsSvmSecureFolder()
+    {
+        CreateWebrootFile(@"cats\docs\manual.pdf");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/docs/manual.pdf" },
+            Folder = @"cats\docs",
+            UseDefaultPermission = true,
+            Permissions = new List<string> { "SVMSecure.Extra" }
+        };
+
+        await _service.ImportFilesAsync(request, TestContext.Current.CancellationToken);
+
+        var saved = await _context.Files.Include(f => f.FileToPermissions).SingleAsync(TestContext.Current.CancellationToken);
+        var permissions = saved.FileToPermissions.Select(p => p.Permission).ToList();
+        Assert.Equal(2, permissions.Count);
+        Assert.Contains("SVMSecure.Extra", permissions);
+        Assert.Contains("SVMSecure.cats", permissions);
+    }
+
+    [Fact]
+    public async Task Import_TraversalOutsideWebroot_Fails()
+    {
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { @"..\..\Windows\system.ini" },
+            Folder = "cats"
+        };
+
+        var results = await _service.ImportFilesAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.Success);
+        Assert.Contains("outside", result.Message);
+        Assert.Empty(await _context.Files.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Import_MissingAndDisallowedFiles_ReportPerFileErrors()
+    {
+        CreateWebrootFile(@"cats\evil.bat", "nope");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/missing.pdf", "cats/evil.bat" },
+            Folder = "cats"
+        };
+
+        var results = await _service.ImportFilesAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, results.Count);
+        Assert.All(results, r => Assert.False(r.Success));
+        Assert.Contains("not found", results[0].Message);
+        Assert.Contains("not allowed", results[1].Message);
+    }
+
+    [Fact]
+    public async Task Import_WithEncrypt_EncryptsBeforeMove()
+    {
+        CreateWebrootFile(@"cats\docs\secret.pdf");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/docs/secret.pdf" },
+            Folder = "cats",
+            Encrypt = true
+        };
+
+        var results = await _service.ImportFilesAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.True(results[0].Success);
+        _encryption.Received(1).EncryptFileInPlace(Arg.Any<string>(), "encrypted-db-key");
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.True(saved.Encrypted);
+        Assert.Equal("encrypted-db-key", saved.Key);
+    }
+
+    #region Preview
+
+    [Fact]
+    public async Task Preview_ValidFile_ReportsNamesWithoutMoving()
+    {
+        var source = CreateWebrootFile(@"cats\docs\manual.pdf");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "/cats/docs/manual.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.True(result.CanImport, result.Message);
+        Assert.Equal("manual.pdf", result.FileName);
+        Assert.Equal("cats-manual.pdf", result.FriendlyName);
+        Assert.Equal("/cats/docs/manual.pdf", result.OldUrl);
+        Assert.Null(result.RenamedFrom);
+        // Source must not be moved or deleted.
+        Assert.True(File.Exists(source));
+        // No DB rows must be created.
+        Assert.Empty(await _context.Files.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Preview_MissingFile_ReportsNotFound()
+    {
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/docs/missing.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.CanImport);
+        Assert.Contains("not found", result.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Preview_TraversalPath_ReportsOutsideWebroot()
+    {
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "../outside.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.CanImport);
+        Assert.Contains("outside", result.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Preview_DuplicateLines_FlagsSecondAsDuplicate()
+    {
+        CreateWebrootFile(@"cats\docs\manual.pdf");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string>
+            {
+                "cats/docs/manual.pdf",
+                "cats/docs/manual.pdf"
+            },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, results.Count);
+        Assert.True(results[0].CanImport);
+        Assert.False(results[1].CanImport);
+        Assert.Contains("Duplicate", results[1].Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Preview_ExistingFriendlyName_Blocks()
+    {
+        CreateWebrootFile(@"cats\docs\manual.pdf");
+
+        // Seed a Files row whose FriendlyName matches what the preview would compute.
+        _context.Files.Add(new Viper.Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = @"C:\FakeRoot\cats\manual.pdf",
+            Folder = "cats",
+            FriendlyName = "cats-manual.pdf",
+            Description = "existing",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now
+        });
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/docs/manual.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.CanImport);
+        Assert.Contains("cats-manual.pdf", result.Message);
+    }
+
+    [Fact]
+    public async Task Preview_InvalidPathCharacters_ReportsInvalidPath()
+    {
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/bad\0name.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.CanImport);
+        Assert.Contains("not valid", result.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Preview_DisallowedFileType_ReportsNotAllowed()
+    {
+        CreateWebrootFile(@"cats\evil.bat", "nope");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/evil.bat" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.CanImport);
+        Assert.Contains("not allowed", result.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Preview_DiskConflict_ReportsAutoRename()
+    {
+        CreateWebrootFile(@"cats\docs\manual.pdf");
+        _storage.GetAvailableFileName("cats", "manual.pdf").Returns("manual_0.pdf");
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string> { "cats/docs/manual.pdf" },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.True(result.CanImport, result.Message);
+        Assert.Equal("manual_0.pdf", result.FileName);
+        Assert.Equal("manual.pdf", result.RenamedFrom);
+        Assert.Equal("cats-manual_0.pdf", result.FriendlyName);
+    }
+
+    [Fact]
+    public async Task Preview_TwoLinesSameBasename_SecondPreviewsImportRenamedName()
+    {
+        CreateWebrootFile(@"cats\docs\manual.pdf");
+        // A second file in a different sub-path that produces the same final name after rename.
+        Directory.CreateDirectory(Path.Join(_webroot, "cats", "other"));
+        CreateWebrootFile(@"cats\other\manual.pdf");
+
+        // Disk/DB alone leaves the name free, so both lines resolve to "manual.pdf" on their own.
+        _storage.GetAvailableFileName("cats", "manual.pdf").Returns("manual.pdf");
+        // But once the first line reserves "manual.pdf", the import would rename the second; the
+        // preview must reserve names across the batch and show that same renamed name up front.
+        _storage.GetAvailableFileName("cats", "manual.pdf",
+            Arg.Is<IReadOnlySet<string>?>(s => s != null && s.Contains("manual.pdf"))).Returns("manual_0.pdf");
+
+        var request = new CmsFileImportRequest
+        {
+            FilePaths = new List<string>
+            {
+                "cats/docs/manual.pdf",
+                "cats/other/manual.pdf"
+            },
+            Folder = "cats"
+        };
+
+        var results = await _service.PreviewImportAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, results.Count);
+        // First entry: keeps the name, no message.
+        Assert.True(results[0].CanImport);
+        Assert.Equal("manual.pdf", results[0].FileName);
+        Assert.Null(results[0].Message);
+        // Second entry: previews the exact renamed name the import will assign (not the colliding
+        // name), with a non-blocking message explaining the rename.
+        Assert.True(results[1].CanImport);
+        Assert.Equal("manual_0.pdf", results[1].FileName);
+        Assert.Equal("manual.pdf", results[1].RenamedFrom);
+        Assert.Equal("cats-manual_0.pdf", results[1].FriendlyName);
+        Assert.NotNull(results[1].Message);
+        Assert.Contains("renamed", results[1].Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    #endregion
+
+    [Fact]
+    public async Task BulkEncrypt_EncryptsUnencryptedAndSkipsOthers()
+    {
+        var plain = new Viper.Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = @"C:\FakeRoot\cats\plain.pdf",
+            Folder = "cats",
+            FriendlyName = "cats-plain.pdf",
+            Description = "",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now
+        };
+        var already = new Viper.Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = @"C:\FakeRoot\cats\already.pdf",
+            Folder = "cats",
+            FriendlyName = "cats-already.pdf",
+            Description = "",
+            Encrypted = true,
+            Key = "existing-key",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now
+        };
+        _context.Files.AddRange(plain, already);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        _storage.ManagedFileExists(plain.FilePath).Returns(true);
+
+        var results = await _service.BulkEncryptAsync(
+            new List<Guid> { plain.FileGuid, already.FileGuid, Guid.NewGuid() }, TestContext.Current.CancellationToken);
+
+        Assert.Equal(3, results.Count);
+        Assert.True(results[0].Success);
+        Assert.False(results[1].Success);
+        Assert.Contains("Already encrypted", results[1].Message);
+        Assert.False(results[2].Success);
+        _encryption.Received(1).EncryptFileInPlace(plain.FilePath, "encrypted-db-key");
+        var saved = await _context.Files.SingleAsync(f => f.FileGuid == plain.FileGuid, TestContext.Current.CancellationToken);
+        Assert.True(saved.Encrypted);
+    }
+
+    [Fact]
+    public async Task BulkEncrypt_NonDatabaseSaveFailure_DecryptsFileBack()
+    {
+        // Named in-memory stores are shared, so the seeding context and the failing
+        // context (whose interceptor throws a non-DB exception on save) see the same data.
+        var storeName = "VIPER_" + Guid.NewGuid();
+        var plain = new Viper.Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = @"C:\FakeRoot\cats\plain.pdf",
+            Folder = "cats",
+            FriendlyName = "cats-plain.pdf",
+            Description = "",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now
+        };
+        await using (var seedContext = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase(storeName).Options))
+        {
+            seedContext.Files.Add(plain);
+            await seedContext.SaveChangesAsync(TestContext.Current.CancellationToken);
+        }
+
+        await using var failingContext = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase(storeName)
+            .AddInterceptors(new ThrowingSaveInterceptor())
+            .Options);
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["CMS:LegacyWebrootPath"] = _webroot })
+            .Build();
+        var service = new CmsFileImportService(failingContext, _storage, _encryption, _audit,
+            Substitute.For<IUserHelper>(), configuration, Substitute.For<ILogger<CmsFileImportService>>());
+        _storage.ManagedFileExists(plain.FilePath).Returns(true);
+
+        var results = await service.BulkEncryptAsync(new List<Guid> { plain.FileGuid }, TestContext.Current.CancellationToken);
+
+        var result = Assert.Single(results);
+        Assert.False(result.Success);
+        Assert.Contains("simulated save failure", result.Message);
+        _encryption.Received(1).DecryptFileInPlace(plain.FilePath, "encrypted-db-key");
+    }
+
+    private sealed class ThrowingSaveInterceptor : SaveChangesInterceptor
+    {
+        public override ValueTask<InterceptionResult<int>> SavingChangesAsync(DbContextEventData eventData,
+            InterceptionResult<int> result, CancellationToken cancellationToken = default)
+        {
+            throw new InvalidOperationException("simulated save failure");
+        }
+    }
+}
diff --git a/test/CMS/CmsFileResponseTests.cs b/test/CMS/CmsFileResponseTests.cs
new file mode 100644
index 000000000..b199b3dc5
--- /dev/null
+++ b/test/CMS/CmsFileResponseTests.cs
@@ -0,0 +1,47 @@
+using Microsoft.AspNetCore.Http;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Services;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for the /CMS/Files download-response hardening: X-Content-Type-Options: nosniff on every
+/// file response, and forcing inline-unsafe types (html/svg) to download instead of rendering in
+/// the app origin (stored-XSS guard). Legacy .html files stay downloadable, just never inline.
+/// </summary>
+public sealed class CmsFileResponseTests
+{
+    [Fact]
+    public void SetNoSniff_SetsHeader()
+    {
+        var response = new DefaultHttpContext().Response;
+
+        CmsFileResponse.SetNoSniff(response);
+
+        Assert.Equal("nosniff", response.Headers["X-Content-Type-Options"]);
+    }
+
+    [Theory]
+    [InlineData("page.html")]
+    [InlineData("PAGE.HTM")]
+    [InlineData("doc.xhtml")]
+    [InlineData("logo.svg")]
+    [InlineData(@"S:\Files\cats\evil.HTML")]
+    public void DispositionType_InlineUnsafe_ForcesAttachment(string fileName)
+    {
+        Assert.Equal("attachment", CmsFileResponse.DispositionType(fileName));
+        Assert.True(CmsFileTypes.ShouldForceAttachment(fileName));
+    }
+
+    [Theory]
+    [InlineData("report.pdf")]
+    [InlineData("image.png")]
+    [InlineData("notes.txt")]
+    [InlineData("sheet.xlsx")]
+    [InlineData("noextension")]
+    public void DispositionType_SafeTypes_StayInline(string fileName)
+    {
+        Assert.Equal("inline", CmsFileResponse.DispositionType(fileName));
+        Assert.False(CmsFileTypes.ShouldForceAttachment(fileName));
+    }
+}
diff --git a/test/CMS/CmsFileServiceTests.cs b/test/CMS/CmsFileServiceTests.cs
new file mode 100644
index 000000000..ea2ccb14c
--- /dev/null
+++ b/test/CMS/CmsFileServiceTests.cs
@@ -0,0 +1,990 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+using Viper.Models.VIPER;
+using File = Viper.Models.VIPER.File;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CmsFileService CRUD orchestration: friendly-name generation, permission and
+/// person deltas, soft delete/restore, and audit calls. Storage and encryption are mocked;
+/// the database is EF in-memory.
+/// </summary>
+public sealed class CmsFileServiceTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly AAUDContext _aaudContext;
+    private readonly ICmsFileStorageService _storage;
+    private readonly ICmsFileEncryptionService _encryption;
+    private readonly ICmsFileAuditService _audit;
+    private readonly IUserHelper _userHelper;
+    private readonly CmsFileService _service;
+    private readonly List<VIPERContext> _extraContexts = new();
+    private readonly List<MemoryStream> _formFileStreams = new();
+
+    public CmsFileServiceTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _aaudContext = new AAUDContext(new DbContextOptionsBuilder<AAUDContext>()
+            .UseInMemoryDatabase("AAUD_" + Guid.NewGuid()).Options);
+
+        _storage = Substitute.For<ICmsFileStorageService>();
+        _storage.RootFolder.Returns(@"C:\FakeRoot");
+        _storage.IsValidFolder(Arg.Any<string>()).Returns(true);
+        _storage.SaveToTempAsync(Arg.Any<IFormFile>(), Arg.Any<CancellationToken>())
+            .Returns(_ => Task.FromResult(@"C:\FakeTemp\" + Guid.NewGuid().ToString("N")));
+        _storage.MoveIntoPlace(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<bool>())
+            .Returns(callInfo => Path.Join(@"C:\FakeRoot", callInfo.ArgAt<string>(1), Path.GetFileName(callInfo.ArgAt<string>(2))));
+
+        _encryption = Substitute.For<ICmsFileEncryptionService>();
+        _encryption.GenerateKeyForDb().Returns("encrypted-db-key");
+
+        _audit = Substitute.For<ICmsFileAuditService>();
+        _userHelper = Substitute.For<IUserHelper>();
+
+        _service = new CmsFileService(_context, _aaudContext, _storage, _encryption, _audit, _userHelper,
+            Substitute.For<ILogger<CmsFileService>>());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        _aaudContext.Dispose();
+        foreach (var ctx in _extraContexts)
+        {
+            ctx.Dispose();
+        }
+        foreach (var stream in _formFileStreams)
+        {
+            stream.Dispose();
+        }
+    }
+
+    private IFormFile MakeFormFile(string fileName = "report.pdf")
+    {
+        // Tracked so the backing stream is disposed in Dispose rather than left to the GC.
+        var stream = new MemoryStream(new byte[] { 1, 2, 3 });
+        _formFileStreams.Add(stream);
+        return new FormFile(stream, 0, stream.Length, "file", fileName);
+    }
+
+    /// <summary>
+    /// Writes a real temp file to stand in for a backup the service returns from BackupManagedFile.
+    /// A real path lets the cleanup branch (System.IO.File.Exists/Delete) actually execute rather
+    /// than short-circuiting on a fake path that never exists. Callers delete it in a finally.
+    /// </summary>
+    private static string MakeRealBackupFile()
+    {
+        string path = Path.Join(Path.GetTempPath(), "Viper-CMS-Test-" + Guid.NewGuid().ToString("N"));
+        System.IO.File.WriteAllBytes(path, new byte[] { 9, 9, 9 });
+        return path;
+    }
+
+    private async Task<File> SeedFileAsync(Action<File>? customize = null)
+    {
+        var file = new File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = @"C:\FakeRoot\cats\seeded.pdf",
+            Folder = "cats",
+            FriendlyName = "cats-seeded.pdf",
+            Description = "seeded",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now.AddDays(-1)
+        };
+        customize?.Invoke(file);
+        _context.Files.Add(file);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return file;
+    }
+
+    /// <summary>
+    /// Seeds a file into a shared named store, then returns a service backed by a second context
+    /// on that store whose interceptor throws on save. Lets the rollback path be exercised without
+    /// a real database. Reuses the mocked storage/encryption so their calls can be asserted.
+    /// </summary>
+    private async Task<(CmsFileService Service, Guid FileGuid, string FilePath)> BuildServiceOverFailingSaveAsync(
+        Action<File>? customize = null)
+    {
+        const string filePath = @"C:\FakeRoot\cats\plain.pdf";
+        var storeName = "VIPER_" + Guid.NewGuid();
+        var file = new File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = filePath,
+            Folder = "cats",
+            FriendlyName = "cats-plain.pdf",
+            Description = "seeded",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now.AddDays(-1)
+        };
+        customize?.Invoke(file);
+        await using (var seedContext = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase(storeName).Options))
+        {
+            seedContext.Files.Add(file);
+            await seedContext.SaveChangesAsync(TestContext.Current.CancellationToken);
+        }
+
+        var failingContext = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase(storeName)
+            .AddInterceptors(new ThrowingSaveInterceptor())
+            .Options);
+        _extraContexts.Add(failingContext);
+        var service = new CmsFileService(failingContext, _aaudContext, _storage, _encryption, _audit, _userHelper,
+            Substitute.For<ILogger<CmsFileService>>());
+        return (service, file.FileGuid, filePath);
+    }
+
+    private sealed class ThrowingSaveInterceptor : SaveChangesInterceptor
+    {
+        public override ValueTask<InterceptionResult<int>> SavingChangesAsync(DbContextEventData eventData,
+            InterceptionResult<int> result, CancellationToken cancellationToken = default)
+        {
+            throw new InvalidOperationException("simulated save failure");
+        }
+    }
+
+    #region Create
+
+    [Fact]
+    public async Task CreateFile_BuildsFriendlyNameFromFolderAndFileName()
+    {
+        var request = new CmsFileCreateRequest { Folder = @"cats\photos" };
+
+        var dto = await _service.CreateFileAsync(request, MakeFormFile("pic.jpg"), TestContext.Current.CancellationToken);
+
+        Assert.Equal("cats-photos-pic.jpg", dto.FriendlyName);
+        Assert.Equal("pic.jpg", dto.FileName);
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Equal(@"cats\photos", saved.Folder);
+        Assert.False(saved.Encrypted);
+        Assert.Null(saved.Key);
+    }
+
+    [Fact]
+    public async Task CreateFile_SavesPermissionsAndPeople_Deduplicated()
+    {
+        var request = new CmsFileCreateRequest
+        {
+            Folder = "cats",
+            Permissions = new List<string> { "SVMSecure.CATS", "svmsecure.cats", " SVMSecure.Admin " },
+            IamIds = new List<string> { "1000123", "1000123", "1000456" }
+        };
+
+        var dto = await _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, dto.Permissions.Count);
+        Assert.Contains("SVMSecure.Admin", dto.Permissions);
+        Assert.Equal(2, dto.People.Count);
+    }
+
+    [Fact]
+    public async Task CreateFile_WithEncrypt_GeneratesKeyAndEncryptsTemp()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats", Encrypt = true };
+
+        var dto = await _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        Assert.True(dto.Encrypted);
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Equal("encrypted-db-key", saved.Key);
+        _encryption.Received(1).EncryptFileInPlace(Arg.Any<string>(), "encrypted-db-key");
+    }
+
+    [Fact]
+    public async Task CreateFile_AuditsAddAndUpload()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats" };
+
+        await _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.AddFile, Arg.Any<string>());
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.UploadFile, "NewFile");
+    }
+
+    [Fact]
+    public async Task CreateFile_DuplicateFriendlyName_DeletesMovedFileAndThrows()
+    {
+        await SeedFileAsync(f => f.FriendlyName = "cats-report.pdf");
+        var request = new CmsFileCreateRequest { Folder = "cats" };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken));
+
+        _storage.Received(1).DeleteManagedFile(Path.Join(@"C:\FakeRoot", "cats", "report.pdf"));
+    }
+
+    [Fact]
+    public async Task CreateFile_InvalidFolder_Throws()
+    {
+        _storage.IsValidFolder("badfolder").Returns(false);
+        var request = new CmsFileCreateRequest { Folder = "badfolder" };
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task CreateFile_DisallowedExtension_Throws()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats" };
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.CreateFileAsync(request, MakeFormFile("evil.bat"), TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task CreateFile_FileNameOverride_StoresUnderOverrideName()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats", FileName = "custom.pdf" };
+
+        var dto = await _service.CreateFileAsync(request, MakeFormFile("orig.pdf"), TestContext.Current.CancellationToken);
+
+        // MoveIntoPlace should have been called with the override name, not the upload name.
+        _storage.Received(1).MoveIntoPlace(Arg.Any<string>(), "cats", "custom.pdf", Arg.Any<bool>());
+        Assert.Equal("custom.pdf", dto.FileName);
+        Assert.Equal("cats-custom.pdf", dto.FriendlyName);
+    }
+
+    [Fact]
+    public async Task CreateFile_OverwriteDiskOnly_ReplacesInPlace()
+    {
+        const string targetPath = @"C:\FakeRoot\cats\report.pdf";
+        _storage.FileNameInUse("cats", "report.pdf").Returns(true);
+        _storage.BuildManagedPath("cats", "report.pdf").Returns(targetPath);
+
+        var request = new CmsFileCreateRequest { Folder = "cats", Overwrite = true };
+
+        await _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        _storage.Received(1).ReplaceInPlace(Arg.Any<string>(), targetPath);
+        _storage.DidNotReceive().MoveIntoPlace(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<bool>());
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Equal(targetPath, saved.FilePath);
+    }
+
+    [Fact]
+    public async Task CreateFile_OverwriteManagedRecord_Throws()
+    {
+        const string targetPath = @"C:\FakeRoot\cats\report.pdf";
+        _storage.FileNameInUse("cats", "report.pdf").Returns(true);
+        _storage.BuildManagedPath("cats", "report.pdf").Returns(targetPath);
+
+        // Seed a Files row whose FilePath matches the target path.
+        await SeedFileAsync(f =>
+        {
+            f.FilePath = targetPath;
+            f.FriendlyName = "cats-report.pdf";
+        });
+
+        var request = new CmsFileCreateRequest { Folder = "cats", Overwrite = true };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken));
+
+        _storage.DidNotReceive().ReplaceInPlace(Arg.Any<string>(), Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task CreateFile_OverwriteWithoutConflict_StoresNormally()
+    {
+        var request = new CmsFileCreateRequest { Folder = "cats", Overwrite = true };
+
+        await _service.CreateFileAsync(request, MakeFormFile(), TestContext.Current.CancellationToken);
+
+        _storage.Received(1).MoveIntoPlace(Arg.Any<string>(), "cats", "report.pdf", Arg.Any<bool>());
+        _storage.DidNotReceive().ReplaceInPlace(Arg.Any<string>(), Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task CreateFile_OverwriteOrphan_SaveFails_RestoresOriginalFile()
+    {
+        const string targetPath = @"C:\FakeRoot\cats\orphan.pdf";
+        const string backupPath = @"C:\FakeTemp\backup-orphan";
+        _storage.FileNameInUse("cats", "orphan.pdf").Returns(true);
+        _storage.BuildManagedPath("cats", "orphan.pdf").Returns(targetPath);
+        _storage.ManagedFileExists(targetPath).Returns(true);
+        _storage.BackupManagedFile(targetPath).Returns(backupPath);
+
+        var (service, _, _) = await BuildServiceOverFailingSaveAsync();
+        var request = new CmsFileCreateRequest { Folder = "cats", Overwrite = true };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.CreateFileAsync(request, MakeFormFile("orphan.pdf"), TestContext.Current.CancellationToken));
+
+        // The orphaned original (no DB row) was overwritten on disk; the failed save must move the
+        // pre-overwrite backup back into place rather than deleting it, so the file isn't lost.
+        _storage.Received(1).BackupManagedFile(targetPath);
+        _storage.Received(1).ReplaceInPlace(backupPath, targetPath);
+        _storage.DidNotReceive().DeleteManagedFile(targetPath);
+    }
+
+    [Fact]
+    public async Task CreateFile_OverwriteOrphan_SaveFails_RestoreFails_PreservesBackup()
+    {
+        const string targetPath = @"C:\FakeRoot\cats\orphan.pdf";
+        _storage.FileNameInUse("cats", "orphan.pdf").Returns(true);
+        _storage.BuildManagedPath("cats", "orphan.pdf").Returns(targetPath);
+        _storage.ManagedFileExists(targetPath).Returns(true);
+
+        // A real temp file stands in for the backup so the cleanup branch (File.Exists/Delete)
+        // actually runs instead of short-circuiting on a non-existent fake path.
+        string backupPath = MakeRealBackupFile();
+        try
+        {
+            _storage.BackupManagedFile(targetPath).Returns(backupPath);
+            // The restore attempt itself fails (e.g., the target is locked); the backup is then the
+            // only surviving copy of the original bytes and must not be deleted.
+            _storage.When(s => s.ReplaceInPlace(backupPath, targetPath))
+                .Do(_ => throw new IOException("restore failed"));
+
+            var (service, _, _) = await BuildServiceOverFailingSaveAsync();
+            var request = new CmsFileCreateRequest { Folder = "cats", Overwrite = true };
+
+            await Assert.ThrowsAsync<InvalidOperationException>(
+                () => service.CreateFileAsync(request, MakeFormFile("orphan.pdf"), TestContext.Current.CancellationToken));
+
+            _storage.Received(1).ReplaceInPlace(backupPath, targetPath);
+            Assert.True(System.IO.File.Exists(backupPath));
+        }
+        finally
+        {
+            if (System.IO.File.Exists(backupPath))
+            {
+                System.IO.File.Delete(backupPath);
+            }
+        }
+    }
+
+    #endregion
+
+    #region Update
+
+    [Fact]
+    public async Task UpdateFile_AppliesPermissionDeltas()
+    {
+        var file = await SeedFileAsync(f =>
+        {
+            f.FileToPermissions.Add(new FileToPermission { FileGuid = f.FileGuid, Permission = "SVMSecure.Old" });
+            f.FileToPermissions.Add(new FileToPermission { FileGuid = f.FileGuid, Permission = "SVMSecure.Keep" });
+        });
+        var request = new CmsFileUpdateRequest
+        {
+            Description = "seeded",
+            Permissions = new List<string> { "SVMSecure.Keep", "SVMSecure.New" }
+        };
+
+        var dto = await _service.UpdateFileAsync(file.FileGuid, request, null, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(dto);
+        Assert.Equal(new List<string> { "SVMSecure.Keep", "SVMSecure.New" }, dto.Permissions);
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.EditFile,
+            Arg.Is<string>(d => d.Contains("Permission removed: SVMSecure.Old") && d.Contains("Permission added: SVMSecure.New")));
+    }
+
+    [Fact]
+    public async Task UpdateFile_AppliesPersonDeltas()
+    {
+        var file = await SeedFileAsync(f =>
+            f.FileToPeople.Add(new FileToPerson { FileGuid = f.FileGuid, IamId = "100OLD" }));
+        var request = new CmsFileUpdateRequest
+        {
+            Description = "seeded",
+            IamIds = new List<string> { "100NEW" }
+        };
+
+        var dto = await _service.UpdateFileAsync(file.FileGuid, request, null, TestContext.Current.CancellationToken);
+
+        Assert.NotNull(dto);
+        Assert.Single(dto.People);
+        Assert.Equal("100NEW", dto.People[0].IamId);
+    }
+
+    [Fact]
+    public async Task UpdateFile_EncryptToggleOn_EncryptsExistingFile()
+    {
+        var file = await SeedFileAsync();
+        _storage.ManagedFileExists(file.FilePath).Returns(true);
+        var request = new CmsFileUpdateRequest { Description = "seeded", Encrypt = true };
+
+        var dto = await _service.UpdateFileAsync(file.FileGuid, request, null, TestContext.Current.CancellationToken);
+
+        Assert.True(dto!.Encrypted);
+        _encryption.Received(1).EncryptFileInPlace(file.FilePath, "encrypted-db-key");
+    }
+
+    [Fact]
+    public async Task UpdateFile_EncryptToggleOff_DecryptsExistingFile()
+    {
+        var file = await SeedFileAsync(f =>
+        {
+            f.Encrypted = true;
+            f.Key = "old-key";
+        });
+        _storage.ManagedFileExists(file.FilePath).Returns(true);
+        var request = new CmsFileUpdateRequest { Description = "seeded", Encrypt = false };
+
+        var dto = await _service.UpdateFileAsync(file.FileGuid, request, null, TestContext.Current.CancellationToken);
+
+        Assert.False(dto!.Encrypted);
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Null(saved.Key);
+        _encryption.Received(1).DecryptFileInPlace(file.FilePath, "old-key");
+    }
+
+    [Fact]
+    public async Task UpdateFile_WithReplacementUpload_ReplacesInPlaceAndAudits()
+    {
+        var file = await SeedFileAsync();
+        var request = new CmsFileUpdateRequest { Description = "seeded" };
+
+        await _service.UpdateFileAsync(file.FileGuid, request, MakeFormFile("newversion.pdf"), TestContext.Current.CancellationToken);
+
+        _storage.Received(1).ReplaceInPlace(Arg.Any<string>(), file.FilePath);
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.UploadFile, "ReplacingFile");
+    }
+
+    [Fact]
+    public async Task UpdateFile_ReplacementWithDifferentExtension_Throws()
+    {
+        // The record keeps its name/path on replacement, so a .png swapped for the seeded
+        // .pdf would leave the stored .pdf holding .png bytes; the upload must be rejected.
+        var file = await SeedFileAsync();
+        var request = new CmsFileUpdateRequest { Description = "seeded" };
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.UpdateFileAsync(file.FileGuid, request, MakeFormFile("newversion.png"), TestContext.Current.CancellationToken));
+        _storage.DidNotReceive().ReplaceInPlace(Arg.Any<string>(), Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task UpdateFile_WithReplacementUpload_RestoresSoftDeletedFile()
+    {
+        var file = await SeedFileAsync(f => f.DeletedOn = DateTime.Now);
+        var request = new CmsFileUpdateRequest { Description = "seeded" };
+
+        await _service.UpdateFileAsync(file.FileGuid, request, MakeFormFile("newversion.pdf"), TestContext.Current.CancellationToken);
+
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Null(saved.DeletedOn);
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.EditFile,
+            Arg.Is<string>(d => d.Contains("Restored file")));
+    }
+
+    [Fact]
+    public async Task UpdateFile_MetadataOnly_DoesNotRestoreSoftDeletedFile()
+    {
+        var file = await SeedFileAsync(f => f.DeletedOn = DateTime.Now);
+        var request = new CmsFileUpdateRequest { Description = "updated" };
+
+        await _service.UpdateFileAsync(file.FileGuid, request, null, TestContext.Current.CancellationToken);
+
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.NotNull(saved.DeletedOn);
+    }
+
+    [Fact]
+    public async Task UpdateFile_UnknownGuid_ReturnsNull()
+    {
+        var dto = await _service.UpdateFileAsync(Guid.NewGuid(), new CmsFileUpdateRequest(), null, TestContext.Current.CancellationToken);
+
+        Assert.Null(dto);
+    }
+
+    [Fact]
+    public async Task UpdateFile_EncryptToggleOn_SaveFails_DecryptsFileBack()
+    {
+        var (service, fileGuid, filePath) = await BuildServiceOverFailingSaveAsync();
+        _storage.ManagedFileExists(filePath).Returns(true);
+        var request = new CmsFileUpdateRequest { Description = "seeded", Encrypt = true };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.UpdateFileAsync(fileGuid, request, null, TestContext.Current.CancellationToken));
+
+        // The file was encrypted on disk but the save failed, so it must be decrypted back with
+        // the same key or it would be unreadable (no key persisted).
+        _encryption.Received(1).DecryptFileInPlace(filePath, "encrypted-db-key");
+    }
+
+    [Fact]
+    public async Task UpdateFile_EncryptToggleOff_SaveFails_ReEncryptsFile()
+    {
+        var (service, fileGuid, filePath) = await BuildServiceOverFailingSaveAsync(f =>
+        {
+            f.Encrypted = true;
+            f.Key = "old-key";
+        });
+        _storage.ManagedFileExists(filePath).Returns(true);
+        var request = new CmsFileUpdateRequest { Description = "seeded", Encrypt = false };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.UpdateFileAsync(fileGuid, request, null, TestContext.Current.CancellationToken));
+
+        // The file was decrypted on disk but the save failed, so it must be re-encrypted with the
+        // original key to stay consistent with the rolled-back (still-encrypted) database row.
+        _encryption.Received(1).EncryptFileInPlace(filePath, "old-key");
+    }
+
+    [Fact]
+    public async Task UpdateFile_ReplacementUpload_SaveFails_RestoresOriginalFile()
+    {
+        var (service, fileGuid, filePath) = await BuildServiceOverFailingSaveAsync();
+        _storage.ManagedFileExists(filePath).Returns(true);
+        const string backupPath = @"C:\FakeTemp\backup-original";
+        _storage.BackupManagedFile(filePath).Returns(backupPath);
+        var request = new CmsFileUpdateRequest { Description = "seeded" };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.UpdateFileAsync(fileGuid, request, MakeFormFile("newversion.pdf"), TestContext.Current.CancellationToken));
+
+        // ReplaceInPlace swapped in the new upload, but the save failed, so the pre-replacement
+        // backup must be moved back over the managed path to restore the original bytes.
+        _storage.Received(1).BackupManagedFile(filePath);
+        _storage.Received(1).ReplaceInPlace(backupPath, filePath);
+    }
+
+    [Fact]
+    public async Task UpdateFile_ReplacementUpload_SaveFails_RestoreFails_PreservesBackup()
+    {
+        var (service, fileGuid, filePath) = await BuildServiceOverFailingSaveAsync();
+        _storage.ManagedFileExists(filePath).Returns(true);
+
+        string backupPath = MakeRealBackupFile();
+        try
+        {
+            _storage.BackupManagedFile(filePath).Returns(backupPath);
+            // The restore attempt fails, so the backup holds the only copy of the pre-update bytes
+            // (the database rolled back to that older record) and must be preserved, not deleted.
+            _storage.When(s => s.ReplaceInPlace(backupPath, filePath))
+                .Do(_ => throw new IOException("restore failed"));
+            var request = new CmsFileUpdateRequest { Description = "seeded" };
+
+            await Assert.ThrowsAsync<InvalidOperationException>(
+                () => service.UpdateFileAsync(fileGuid, request, MakeFormFile("newversion.pdf"), TestContext.Current.CancellationToken));
+
+            _storage.Received(1).ReplaceInPlace(backupPath, filePath);
+            Assert.True(System.IO.File.Exists(backupPath));
+        }
+        finally
+        {
+            if (System.IO.File.Exists(backupPath))
+            {
+                System.IO.File.Delete(backupPath);
+            }
+        }
+    }
+
+    [Fact]
+    public async Task UpdateFile_ReplacementUpload_SaveSucceeds_DeletesBackup()
+    {
+        var file = await SeedFileAsync();
+        _storage.ManagedFileExists(file.FilePath).Returns(true);
+
+        string backupPath = MakeRealBackupFile();
+        try
+        {
+            _storage.BackupManagedFile(file.FilePath).Returns(backupPath);
+            var request = new CmsFileUpdateRequest { Description = "seeded" };
+
+            await _service.UpdateFileAsync(file.FileGuid, request, MakeFormFile("newversion.pdf"), TestContext.Current.CancellationToken);
+
+            // A committed save makes the pre-replacement backup obsolete; it must be cleaned up.
+            Assert.False(System.IO.File.Exists(backupPath));
+        }
+        finally
+        {
+            if (System.IO.File.Exists(backupPath))
+            {
+                System.IO.File.Delete(backupPath);
+            }
+        }
+    }
+
+    #endregion
+
+    #region Delete / Restore
+
+    [Fact]
+    public async Task SoftDelete_SetsDeletedOn_AndAudits()
+    {
+        var file = await SeedFileAsync();
+
+        var result = await _service.SoftDeleteFileAsync(file.FileGuid, TestContext.Current.CancellationToken);
+
+        Assert.True(result);
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.NotNull(saved.DeletedOn);
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.DeleteFile, "File Marked for Deletion");
+    }
+
+    [Fact]
+    public async Task Restore_ClearsDeletedOn_AndAudits()
+    {
+        var file = await SeedFileAsync(f => f.DeletedOn = DateTime.Now);
+
+        var result = await _service.RestoreFileAsync(file.FileGuid, TestContext.Current.CancellationToken);
+
+        Assert.True(result);
+        var saved = await _context.Files.SingleAsync(TestContext.Current.CancellationToken);
+        Assert.Null(saved.DeletedOn);
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.CancelDelete, Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task PermanentDelete_RemovesRowAndDiskFile()
+    {
+        var file = await SeedFileAsync(f =>
+            f.FileToPermissions.Add(new FileToPermission { FileGuid = f.FileGuid, Permission = "SVMSecure" }));
+        _storage.ManagedFileExists(file.FilePath).Returns(true);
+
+        var result = await _service.PermanentlyDeleteFileAsync(file.FileGuid, TestContext.Current.CancellationToken);
+
+        Assert.True(result);
+        Assert.Empty(await _context.Files.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.FileToPermissions.ToListAsync(TestContext.Current.CancellationToken));
+        _storage.Received(1).DeleteManagedFile(file.FilePath);
+        _audit.Received(1).Audit(Arg.Any<File>(), CmsFileAuditActions.DeleteFile, "File Deleted");
+    }
+
+    [Fact]
+    public async Task PermanentDelete_StillSucceeds_WhenDiskDeleteFails()
+    {
+        var file = await SeedFileAsync();
+        _storage.ManagedFileExists(file.FilePath).Returns(true);
+        _storage.When(s => s.DeleteManagedFile(file.FilePath)).Do(_ => throw new IOException("file is locked"));
+
+        var result = await _service.PermanentlyDeleteFileAsync(file.FileGuid, TestContext.Current.CancellationToken);
+
+        // The record is gone by the time the disk delete runs, so a storage failure is logged
+        // (orphaned bytes) rather than surfaced as a failure of the whole delete.
+        Assert.True(result);
+        Assert.Empty(await _context.Files.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task PurgeDeletedFiles_RemovesOnlyFilesPastRetention()
+    {
+        var stale = await SeedFileAsync(f => f.DeletedOn = DateTime.Now.AddDays(-40));
+        var recent = await SeedFileAsync(f => f.DeletedOn = DateTime.Now.AddDays(-5));
+        var active = await SeedFileAsync();
+
+        var purged = await _service.PurgeDeletedFilesAsync(30, TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, purged);
+        var remaining = await _context.Files.Select(f => f.FileGuid).ToListAsync(TestContext.Current.CancellationToken);
+        Assert.DoesNotContain(stale.FileGuid, remaining);
+        Assert.Contains(recent.FileGuid, remaining);
+        Assert.Contains(active.FileGuid, remaining);
+    }
+
+    [Fact]
+    public async Task PurgeDeletedFiles_DetachesFromContentBlocks()
+    {
+        var file = await SeedFileAsync(f => f.DeletedOn = DateTime.Now.AddDays(-40));
+        _context.ContentBlockToFiles.Add(new ContentBlockToFile
+        {
+            ContentBlockId = 1,
+            FileGuid = file.FileGuid
+        });
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+
+        var purged = await _service.PurgeDeletedFilesAsync(30, TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, purged);
+        Assert.Empty(await _context.Files.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.ContentBlockToFiles.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    #endregion
+
+    #region CheckName
+
+    [Fact]
+    public async Task CheckName_FreeName_ReturnsNotInUse()
+    {
+        _storage.FileNameInUse("cats", "report.pdf").Returns(false);
+        _storage.BuildManagedPath("cats", "report.pdf").Returns(@"C:\FakeRoot\cats\report.pdf");
+
+        var dto = await _service.CheckNameAsync("cats", "report.pdf", TestContext.Current.CancellationToken);
+
+        Assert.False(dto.InUse);
+        Assert.Equal("report.pdf", dto.SuggestedName);
+        Assert.Null(dto.ExistingFileGuid);
+    }
+
+    [Fact]
+    public async Task CheckName_DiskConflictOnly_SuggestsRename()
+    {
+        _storage.BuildManagedPath("cats", "report.pdf").Returns(@"C:\FakeRoot\cats\report.pdf");
+        _storage.FileNameInUse("cats", "report.pdf").Returns(true);
+        _storage.GetAvailableFileName("cats", "report.pdf").Returns("report_0.pdf");
+
+        var dto = await _service.CheckNameAsync("cats", "report.pdf", TestContext.Current.CancellationToken);
+
+        Assert.True(dto.InUse);
+        Assert.Equal("report_0.pdf", dto.SuggestedName);
+        Assert.Null(dto.ExistingFileGuid);
+    }
+
+    [Fact]
+    public async Task CheckName_ManagedRecordConflict_ReturnsExistingFile()
+    {
+        const string targetPath = @"C:\FakeRoot\cats\report.pdf";
+        _storage.BuildManagedPath("cats", "report.pdf").Returns(targetPath);
+        _storage.FileNameInUse("cats", "report.pdf").Returns(false);
+        _storage.GetAvailableFileName("cats", "report.pdf").Returns("report_0.pdf");
+
+        var seeded = await SeedFileAsync(f =>
+        {
+            f.FilePath = targetPath;
+            f.FriendlyName = "cats-report.pdf";
+            f.DeletedOn = null;
+        });
+
+        var dto = await _service.CheckNameAsync("cats", "report.pdf", TestContext.Current.CancellationToken);
+
+        Assert.True(dto.InUse);
+        Assert.Equal(seeded.FileGuid, dto.ExistingFileGuid);
+        Assert.Equal("cats-report.pdf", dto.ExistingFriendlyName);
+        Assert.False(dto.ExistingDeleted);
+    }
+
+    [Fact]
+    public async Task CheckName_ManagedRecordConflict_SetsExistingDeleted_WhenSoftDeleted()
+    {
+        const string targetPath = @"C:\FakeRoot\cats\report.pdf";
+        _storage.BuildManagedPath("cats", "report.pdf").Returns(targetPath);
+        _storage.FileNameInUse("cats", "report.pdf").Returns(false);
+        _storage.GetAvailableFileName("cats", "report.pdf").Returns("report_0.pdf");
+
+        await SeedFileAsync(f =>
+        {
+            f.FilePath = targetPath;
+            f.FriendlyName = "cats-report.pdf";
+            f.DeletedOn = DateTime.Now;
+        });
+
+        var dto = await _service.CheckNameAsync("cats", "report.pdf", TestContext.Current.CancellationToken);
+
+        Assert.True(dto.InUse);
+        Assert.True(dto.ExistingDeleted);
+    }
+
+    [Fact]
+    public async Task CheckName_InvalidFolder_Throws()
+    {
+        _storage.IsValidFolder("nope").Returns(false);
+
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.CheckNameAsync("nope", "report.pdf", TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task CheckName_DisallowedFileType_Throws()
+    {
+        await Assert.ThrowsAsync<ArgumentException>(
+            () => _service.CheckNameAsync("cats", "evil.bat", TestContext.Current.CancellationToken));
+    }
+
+    #endregion
+
+    #region List
+
+    [Fact]
+    public async Task GetFiles_FiltersByStatus()
+    {
+        await SeedFileAsync();
+        await SeedFileAsync(f =>
+        {
+            f.FriendlyName = "cats-deleted.pdf";
+            f.FilePath = @"C:\FakeRoot\cats\deleted.pdf";
+            f.DeletedOn = DateTime.Now;
+        });
+
+        var (active, activeTotal) = await _service.GetFilesAsync(null, "active", null, null, null, 1, 50, null, false, ct: TestContext.Current.CancellationToken);
+        var (deleted, deletedTotal) = await _service.GetFilesAsync(null, "deleted", null, null, null, 1, 50, null, false, ct: TestContext.Current.CancellationToken);
+        var (all, allTotal) = await _service.GetFilesAsync(null, "all", null, null, null, 1, 50, null, false, ct: TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, activeTotal);
+        Assert.Single(active);
+        Assert.Equal(1, deletedTotal);
+        Assert.Single(deleted);
+        Assert.Equal(2, allTotal);
+        Assert.Equal(2, all.Count);
+    }
+
+    [Fact]
+    public async Task GetFiles_SortsByDeletedOn_OldestFirstForPurgeViews()
+    {
+        await SeedFileAsync(f =>
+        {
+            f.FriendlyName = "cats-newer.pdf";
+            f.FilePath = @"C:\FakeRoot\cats\newer.pdf";
+            f.DeletedOn = DateTime.Now.AddDays(-1);
+        });
+        await SeedFileAsync(f =>
+        {
+            f.FriendlyName = "cats-older.pdf";
+            f.FilePath = @"C:\FakeRoot\cats\older.pdf";
+            f.DeletedOn = DateTime.Now.AddDays(-20);
+        });
+
+        var (ascending, _) = await _service.GetFilesAsync(null, "deleted", null, null, null, 1, 50,
+            "deletedOn", false, ct: TestContext.Current.CancellationToken);
+        var (descending, _) = await _service.GetFilesAsync(null, "deleted", null, null, null, 1, 50,
+            "deletedOn", true, ct: TestContext.Current.CancellationToken);
+
+        Assert.Equal(new[] { "cats-older.pdf", "cats-newer.pdf" }, ascending.Select(f => f.FriendlyName));
+        Assert.Equal(new[] { "cats-newer.pdf", "cats-older.pdf" }, descending.Select(f => f.FriendlyName));
+    }
+
+    [Fact]
+    public async Task GetFiles_Deleted_ScopedToOwner_ReturnsOnlyFilesTheyDeleted()
+    {
+        var mine = await SeedFileAsync(f =>
+        {
+            f.FriendlyName = "cats-mine.pdf";
+            f.DeletedOn = DateTime.Now;
+            f.ModifiedBy = "me";
+        });
+        await SeedFileAsync(f =>
+        {
+            f.FriendlyName = "cats-theirs.pdf";
+            f.DeletedOn = DateTime.Now;
+            f.ModifiedBy = "them";
+        });
+
+        var (files, total) = await _service.GetFilesAsync(null, "deleted", null, null, null, 1, 50, null, false,
+            "me", TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, total);
+        Assert.Equal(mine.FileGuid, Assert.Single(files).FileGuid);
+    }
+
+    [Fact]
+    public async Task GetFiles_FiltersByFolderIncludingSubfolders()
+    {
+        await SeedFileAsync();
+        await SeedFileAsync(f =>
+        {
+            f.Folder = @"cats\photos";
+            f.FriendlyName = "cats-photos-pic.jpg";
+            f.FilePath = @"C:\FakeRoot\cats\photos\pic.jpg";
+        });
+        await SeedFileAsync(f =>
+        {
+            f.Folder = "students";
+            f.FriendlyName = "students-doc.pdf";
+            f.FilePath = @"C:\FakeRoot\students\doc.pdf";
+        });
+
+        var (files, total) = await _service.GetFilesAsync("cats", "active", null, null, null, 1, 50, null, false, ct: TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, total);
+        Assert.All(files, f => Assert.StartsWith("cats", f.Folder));
+    }
+
+    [Fact]
+    public async Task GetFiles_SearchMatchesFriendlyNameAndDescription()
+    {
+        await SeedFileAsync(f => f.Description = "the yearly budget");
+        await SeedFileAsync(f =>
+        {
+            f.FriendlyName = "cats-other.pdf";
+            f.FilePath = @"C:\FakeRoot\cats\other.pdf";
+            f.Description = "unrelated";
+        });
+
+        var (files, total) = await _service.GetFilesAsync(null, "active", "budget", null, null, 1, 50, null, false, ct: TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, total);
+        Assert.Equal("cats-seeded.pdf", files[0].FriendlyName);
+    }
+
+    [Fact]
+    public async Task GetFiles_PaginationAppliesSkipTake()
+    {
+        for (int i = 0; i < 5; i++)
+        {
+            var index = i;
+            await SeedFileAsync(f =>
+            {
+                f.FriendlyName = $"cats-file{index}.pdf";
+                f.FilePath = $@"C:\FakeRoot\cats\file{index}.pdf";
+            });
+        }
+
+        var (page2, total) = await _service.GetFilesAsync(null, "active", null, null, null, 2, 2, "friendlyName", false, ct: TestContext.Current.CancellationToken);
+
+        Assert.Equal(5, total);
+        Assert.Equal(2, page2.Count);
+        Assert.Equal("cats-file2.pdf", page2[0].FriendlyName);
+    }
+
+    [Fact]
+    public async Task GetFolderCounts_RollsUpSubfolders_AndFiltersStatusEncryptedAndPublic()
+    {
+        await SeedFileAsync(f => f.AllowPublicAccess = true);
+        await SeedFileAsync(f =>
+        {
+            f.Folder = @"cats\photos";
+            f.FriendlyName = "cats-photos-pic.jpg";
+            f.FilePath = @"C:\FakeRoot\cats\photos\pic.jpg";
+        });
+        await SeedFileAsync(f =>
+        {
+            f.Folder = "students";
+            f.FriendlyName = "students-doc.pdf";
+            f.FilePath = @"C:\FakeRoot\students\doc.pdf";
+            f.Encrypted = true;
+        });
+        await SeedFileAsync(f =>
+        {
+            f.Folder = "students";
+            f.FriendlyName = "students-deleted.pdf";
+            f.FilePath = @"C:\FakeRoot\students\deleted.pdf";
+            f.DeletedOn = DateTime.Now;
+        });
+
+        var active = await _service.GetFolderCountsAsync("active", null, null, ct: TestContext.Current.CancellationToken);
+        var unencrypted = await _service.GetFolderCountsAsync("active", false, null, ct: TestContext.Current.CancellationToken);
+        var publicOnly = await _service.GetFolderCountsAsync("active", null, true, ct: TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, active.Count);
+        Assert.Equal(2, active.Single(c => c.Folder == "cats").Count);
+        Assert.Equal(1, active.Single(c => c.Folder == "students").Count);
+        var onlyCats = Assert.Single(unencrypted);
+        Assert.Equal("cats", onlyCats.Folder);
+        Assert.Equal(2, onlyCats.Count);
+        var publicCats = Assert.Single(publicOnly);
+        Assert.Equal("cats", publicCats.Folder);
+        Assert.Equal(1, publicCats.Count);
+    }
+
+    [Fact]
+    public async Task GetFolderCounts_MergesFolderCasings()
+    {
+        await SeedFileAsync(f => f.Folder = "Accreditation");
+        await SeedFileAsync(f =>
+        {
+            f.Folder = "accreditation";
+            f.FriendlyName = "accreditation-two.pdf";
+            f.FilePath = @"C:\FakeRoot\accreditation\two.pdf";
+        });
+
+        var counts = await _service.GetFolderCountsAsync("active", null, null, ct: TestContext.Current.CancellationToken);
+
+        var entry = Assert.Single(counts);
+        Assert.Equal(2, entry.Count);
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CmsFileStorageServiceTests.cs b/test/CMS/CmsFileStorageServiceTests.cs
new file mode 100644
index 000000000..dfd6da80f
--- /dev/null
+++ b/test/CMS/CmsFileStorageServiceTests.cs
@@ -0,0 +1,290 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CmsFileStorageService: folder validation (user input must never escape the
+/// storage root), name-collision handling, and managed-file containment checks.
+/// </summary>
+public sealed class CmsFileStorageServiceTests : IDisposable
+{
+    private readonly string _root;
+    private readonly VIPERContext _context;
+    private readonly CmsFileStorageService _service;
+
+    public CmsFileStorageServiceTests()
+    {
+        _root = Path.Join(Path.GetTempPath(), "ViperCmsStorageTests_" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(Path.Join(_root, "cats"));
+        Directory.CreateDirectory(Path.Join(_root, "students"));
+
+        var options = new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
+            .Options;
+        _context = new VIPERContext(options);
+
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["CMS:FileStorageRoot"] = _root })
+            .Build();
+        _service = new CmsFileStorageService(_context, configuration);
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        if (Directory.Exists(_root))
+        {
+            Directory.Delete(_root, recursive: true);
+        }
+    }
+
+    private static string CreateTempFile(string contents = "test contents")
+    {
+        var path = Path.Join(Path.GetTempPath(), Guid.NewGuid().ToString("N"));
+        File.WriteAllText(path, contents);
+        return path;
+    }
+
+    #region GetTopLevelFolders / IsValidFolder
+
+    [Fact]
+    public void GetTopLevelFolders_ReturnsDirectoriesUnderRoot()
+    {
+        var folders = _service.GetTopLevelFolders();
+
+        Assert.Equal(new[] { "cats", "students" }, folders);
+    }
+
+    [Theory]
+    [InlineData("cats")]
+    [InlineData("students")]
+    [InlineData(@"cats\photos")]
+    [InlineData("cats/photos/2026")]
+    public void IsValidFolder_AcceptsExistingTopLevelAndSubfolders(string folder)
+    {
+        Assert.True(_service.IsValidFolder(folder));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("doesnotexist")]
+    [InlineData(@"..\cats")]
+    [InlineData(@"cats\..\..\evil")]
+    [InlineData(@"cats\.")]
+    [InlineData(@"C:\Windows")]
+    [InlineData(@"\\server\share")]
+    [InlineData("cats\\sub<dir>")]
+    public void IsValidFolder_RejectsUnknownTraversalAndInvalid(string folder)
+    {
+        Assert.False(_service.IsValidFolder(folder));
+    }
+
+    #endregion
+
+    #region MoveIntoPlace
+
+    [Fact]
+    public void MoveIntoPlace_MovesTempFileIntoFolder()
+    {
+        var temp = CreateTempFile();
+
+        var finalPath = _service.MoveIntoPlace(temp, "cats", "report.pdf", makeUnique: false);
+
+        Assert.Equal(Path.Join(_root, "cats", "report.pdf"), finalPath);
+        Assert.True(File.Exists(finalPath));
+        Assert.False(File.Exists(temp));
+    }
+
+    [Fact]
+    public void MoveIntoPlace_CreatesSubfolders()
+    {
+        var temp = CreateTempFile();
+
+        var finalPath = _service.MoveIntoPlace(temp, @"cats\photos", "pic.jpg", makeUnique: false);
+
+        Assert.Equal(Path.Join(_root, "cats", "photos", "pic.jpg"), finalPath);
+        Assert.True(File.Exists(finalPath));
+    }
+
+    [Fact]
+    public void MoveIntoPlace_Conflict_WithoutMakeUnique_Throws()
+    {
+        File.WriteAllText(Path.Join(_root, "cats", "report.pdf"), "existing");
+        var temp = CreateTempFile();
+
+        Assert.Throws<InvalidOperationException>(() => _service.MoveIntoPlace(temp, "cats", "report.pdf", makeUnique: false));
+    }
+
+    [Fact]
+    public void MoveIntoPlace_Conflict_WithMakeUnique_AppendsCounter()
+    {
+        File.WriteAllText(Path.Join(_root, "cats", "report.pdf"), "existing");
+        File.WriteAllText(Path.Join(_root, "cats", "report_0.pdf"), "existing");
+        var temp = CreateTempFile();
+
+        var finalPath = _service.MoveIntoPlace(temp, "cats", "report.pdf", makeUnique: true);
+
+        Assert.Equal(Path.Join(_root, "cats", "report_1.pdf"), finalPath);
+    }
+
+    [Fact]
+    public void MoveIntoPlace_StripsPathComponentsFromFileName()
+    {
+        var temp = CreateTempFile();
+
+        var finalPath = _service.MoveIntoPlace(temp, "cats", @"..\..\evil.pdf", makeUnique: false);
+
+        Assert.Equal(Path.Join(_root, "cats", "evil.pdf"), finalPath);
+    }
+
+    [Theory]
+    [InlineData("malware.bat")]
+    [InlineData("script.ps1")]
+    [InlineData("noextension")]
+    public void MoveIntoPlace_DisallowedExtension_Throws(string fileName)
+    {
+        var temp = CreateTempFile();
+
+        try
+        {
+            Assert.Throws<ArgumentException>(() => _service.MoveIntoPlace(temp, "cats", fileName, makeUnique: false));
+        }
+        finally
+        {
+            File.Delete(temp);
+        }
+    }
+
+    [Fact]
+    public void MoveIntoPlace_InvalidFolder_Throws()
+    {
+        var temp = CreateTempFile();
+
+        try
+        {
+            Assert.Throws<ArgumentException>(() => _service.MoveIntoPlace(temp, @"..\evil", "report.pdf", makeUnique: false));
+        }
+        finally
+        {
+            File.Delete(temp);
+        }
+    }
+
+    #endregion
+
+    #region FileNameInUse
+
+    [Fact]
+    public void FileNameInUse_DetectsFileOnDisk()
+    {
+        File.WriteAllText(Path.Join(_root, "cats", "ondisk.pdf"), "x");
+
+        Assert.True(_service.FileNameInUse("cats", "ondisk.pdf"));
+        Assert.False(_service.FileNameInUse("cats", "notthere.pdf"));
+    }
+
+    [Fact]
+    public void FileNameInUse_DetectsDatabaseRecordWithoutDiskFile()
+    {
+        _context.Files.Add(new Viper.Models.VIPER.File
+        {
+            FileGuid = Guid.NewGuid(),
+            FilePath = Path.Join(_root, "cats", "dbonly.pdf"),
+            Folder = "cats",
+            FriendlyName = "cats-dbonly.pdf",
+            Description = "",
+            ModifiedBy = "test",
+            ModifiedOn = DateTime.Now
+        });
+        _context.SaveChanges();
+
+        Assert.True(_service.FileNameInUse("cats", "dbonly.pdf"));
+    }
+
+    #endregion
+
+    #region SaveToTempAsync / ReplaceInPlace / DeleteManagedFile
+
+    [Fact]
+    public async Task SaveToTempAsync_WritesUploadOutsideStorageRoot()
+    {
+        using var stream = new MemoryStream(new byte[] { 1, 2, 3 });
+        var formFile = new FormFile(stream, 0, stream.Length, "file", "upload.pdf");
+
+        var tempPath = await _service.SaveToTempAsync(formFile, TestContext.Current.CancellationToken);
+
+        try
+        {
+            Assert.True(File.Exists(tempPath));
+            Assert.False(tempPath.StartsWith(_root, StringComparison.OrdinalIgnoreCase));
+        }
+        finally
+        {
+            File.Delete(tempPath);
+        }
+    }
+
+    [Fact]
+    public void ReplaceInPlace_OverwritesManagedFile()
+    {
+        var managed = Path.Join(_root, "cats", "replace.pdf");
+        File.WriteAllText(managed, "old");
+        var temp = CreateTempFile("new");
+
+        _service.ReplaceInPlace(temp, managed);
+
+        Assert.Equal("new", File.ReadAllText(managed));
+        Assert.False(File.Exists(temp));
+    }
+
+    [Fact]
+    public void ReplaceInPlace_TargetOutsideRoot_Throws()
+    {
+        var outside = CreateTempFile("victim");
+        var temp = CreateTempFile("new");
+
+        try
+        {
+            Assert.Throws<ArgumentException>(() => _service.ReplaceInPlace(temp, outside));
+        }
+        finally
+        {
+            File.Delete(outside);
+            File.Delete(temp);
+        }
+    }
+
+    [Fact]
+    public void DeleteManagedFile_DeletesUnderRoot()
+    {
+        var managed = Path.Join(_root, "cats", "todelete.pdf");
+        File.WriteAllText(managed, "x");
+
+        _service.DeleteManagedFile(managed);
+
+        Assert.False(File.Exists(managed));
+    }
+
+    [Fact]
+    public void DeleteManagedFile_OutsideRoot_Throws()
+    {
+        var outside = CreateTempFile();
+
+        try
+        {
+            Assert.Throws<ArgumentException>(() => _service.DeleteManagedFile(outside));
+            Assert.True(File.Exists(outside));
+        }
+        finally
+        {
+            File.Delete(outside);
+        }
+    }
+
+    #endregion
+}
diff --git a/test/CMS/CmsLeftNavDisplayTests.cs b/test/CMS/CmsLeftNavDisplayTests.cs
new file mode 100644
index 000000000..e2262d48e
--- /dev/null
+++ b/test/CMS/CmsLeftNavDisplayTests.cs
@@ -0,0 +1,97 @@
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+using Viper.Classes.SQLContext;
+using Viper.Models.AAUD;
+using Viper.Models.VIPER;
+using DataLeftNav = Viper.Areas.CMS.Data.LeftNavMenu;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for Data.LeftNavMenu.GetLeftNavMenus display-time permission filtering (legacy CMS
+/// left-nav parity): an item with no permissions is visible to any logged-in user, an item is
+/// shown when the user holds any one of its permissions and hidden otherwise, and filtering is
+/// bypassed for management callers. Permission scenarios are driven by mocking IUserHelper.
+/// </summary>
+public sealed class CmsLeftNavDisplayTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly RAPSContext _rapsContext;
+    private readonly IUserHelper _userHelper;
+
+    public CmsLeftNavDisplayTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _rapsContext = new RAPSContext(new DbContextOptionsBuilder<RAPSContext>()
+            .UseInMemoryDatabase("RAPS_" + Guid.NewGuid()).Options);
+        _userHelper = Substitute.For<IUserHelper>();
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+        _rapsContext.Dispose();
+    }
+
+    private async Task<string> SeedMixedMenuAsync()
+    {
+        var friendlyName = "display-menu-" + Guid.NewGuid().ToString("N")[..8];
+        var menu = new LeftNavMenu
+        {
+            MenuHeaderText = "Display Menu",
+            System = "Viper",
+            FriendlyName = friendlyName,
+            ModifiedOn = DateTime.Now,
+            ModifiedBy = "test"
+        };
+        menu.LeftNavItems.Add(Item("Public", 1));                          // no permissions
+        menu.LeftNavItems.Add(Item("Allowed", 2, "SVMSecure.Allowed"));    // user holds this
+        menu.LeftNavItems.Add(Item("Forbidden", 3, "SVMSecure.Forbidden")); // user lacks this
+        _context.LeftNavMenus.Add(menu);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return friendlyName;
+    }
+
+    private static LeftNavItem Item(string text, int order, params string[] permissions)
+    {
+        var item = new LeftNavItem { MenuItemText = text, IsHeader = false, Url = "/" + text, DisplayOrder = order };
+        foreach (var p in permissions)
+        {
+            item.LeftNavItemToPermissions.Add(new LeftNavItemToPermission { Permission = p });
+        }
+        return item;
+    }
+
+    [Fact]
+    public async Task GetLeftNavMenus_HidesItemsTheUserLacksPermissionFor()
+    {
+        var friendlyName = await SeedMixedMenuAsync();
+        var user = new AaudUser { AaudUserId = 1, LoginId = "viewer" };
+        _userHelper.GetCurrentUser().Returns(user);
+        _userHelper.HasPermission(Arg.Any<RAPSContext?>(), Arg.Any<AaudUser?>(), "SVMSecure.Allowed").Returns(true);
+        // HasPermission for "SVMSecure.Forbidden" defaults to false.
+
+        var menus = new DataLeftNav(_context, _rapsContext, _userHelper)
+            .GetLeftNavMenus(friendlyName: friendlyName);
+
+        var items = Assert.Single(menus!).MenuItems!;
+        // No-permission item and the held-permission item are visible; the unheld one is hidden.
+        // (Assert membership, not sequence — the in-memory provider does not honor the include OrderBy.)
+        Assert.Equal(new[] { "Allowed", "Public" }, items.Select(i => i.MenuItemText).OrderBy(t => t));
+    }
+
+    [Fact]
+    public async Task GetLeftNavMenus_ReturnsAllItems_WhenFilteringDisabled()
+    {
+        var friendlyName = await SeedMixedMenuAsync();
+        _userHelper.GetCurrentUser().Returns(new AaudUser { AaudUserId = 1, LoginId = "viewer" });
+        // HasPermission would return false for every permission, but management callers bypass filtering.
+
+        var menus = new DataLeftNav(_context, _rapsContext, _userHelper)
+            .GetLeftNavMenus(friendlyName: friendlyName, filterItemsByPermissions: false);
+
+        var items = Assert.Single(menus!).MenuItems!;
+        Assert.Equal(new[] { "Allowed", "Forbidden", "Public" }, items.Select(i => i.MenuItemText).OrderBy(t => t));
+    }
+}
diff --git a/test/CMS/CmsLeftNavServiceTests.cs b/test/CMS/CmsLeftNavServiceTests.cs
new file mode 100644
index 000000000..1daee40d2
--- /dev/null
+++ b/test/CMS/CmsLeftNavServiceTests.cs
@@ -0,0 +1,243 @@
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes.SQLContext;
+using Viper.Models.VIPER;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CmsLeftNavService: menu CRUD with cascade delete and the batch item save
+/// (add/update/delete/reorder in one call, replacing the legacy DataTables editor).
+/// </summary>
+public sealed class CmsLeftNavServiceTests : IDisposable
+{
+    private readonly VIPERContext _context;
+    private readonly CmsLeftNavService _service;
+
+    public CmsLeftNavServiceTests()
+    {
+        _context = new VIPERContext(new DbContextOptionsBuilder<VIPERContext>()
+            .UseInMemoryDatabase("VIPER_" + Guid.NewGuid()).Options);
+        _service = new CmsLeftNavService(_context, Substitute.For<IUserHelper>());
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+    }
+
+    private async Task<LeftNavMenu> SeedMenuAsync(Action<LeftNavMenu>? customize = null)
+    {
+        var menu = new LeftNavMenu
+        {
+            MenuHeaderText = "Seeded Menu",
+            System = "Viper",
+            ViperSectionPath = "cats",
+            FriendlyName = "seeded-menu-" + Guid.NewGuid().ToString("N")[..8],
+            ModifiedOn = DateTime.Now.AddDays(-1),
+            ModifiedBy = "test"
+        };
+        customize?.Invoke(menu);
+        _context.LeftNavMenus.Add(menu);
+        await _context.SaveChangesAsync(TestContext.Current.CancellationToken);
+        return menu;
+    }
+
+    private static LeftNavItem MakeItem(string text, int order, bool isHeader = false, string? url = null, params string[] permissions)
+    {
+        var item = new LeftNavItem
+        {
+            MenuItemText = text,
+            IsHeader = isHeader,
+            Url = url,
+            DisplayOrder = order
+        };
+        foreach (var p in permissions)
+        {
+            item.LeftNavItemToPermissions.Add(new LeftNavItemToPermission { Permission = p });
+        }
+        return item;
+    }
+
+    [Fact]
+    public async Task GetMenus_FiltersBySystemAndSearch()
+    {
+        await SeedMenuAsync();
+        await SeedMenuAsync(m =>
+        {
+            m.MenuHeaderText = "Public Menu";
+            m.System = "Public";
+        });
+
+        var viperMenus = await _service.GetMenusAsync("Viper", null, null, TestContext.Current.CancellationToken);
+        var searched = await _service.GetMenusAsync(null, null, "Public", TestContext.Current.CancellationToken);
+
+        Assert.Single(viperMenus);
+        Assert.Single(searched);
+        Assert.Equal("Public Menu", searched[0].MenuHeaderText);
+    }
+
+    [Fact]
+    public async Task GetMenu_ReturnsItemsInDisplayOrder()
+    {
+        var menu = await SeedMenuAsync(m =>
+        {
+            m.LeftNavItems.Add(MakeItem("Second", 2, url: "/two"));
+            m.LeftNavItems.Add(MakeItem("First", 1, isHeader: true));
+        });
+
+        var dto = await _service.GetMenuAsync(menu.LeftNavMenuId, TestContext.Current.CancellationToken);
+
+        Assert.Equal(new[] { "First", "Second" }, dto!.Items.Select(i => i.MenuItemText).ToArray());
+        Assert.True(dto.Items[0].IsHeader);
+    }
+
+    [Fact]
+    public async Task CreateAndUpdateMenu_PersistFields()
+    {
+        var created = await _service.CreateMenuAsync(new LeftNavMenuAddEdit
+        {
+            MenuHeaderText = "New Menu",
+            System = "Viper",
+            ViperSectionPath = "students",
+            Page = "home",
+            FriendlyName = "new-menu"
+        }, TestContext.Current.CancellationToken);
+
+        Assert.True(created.LeftNavMenuId > 0);
+
+        var updated = await _service.UpdateMenuAsync(created.LeftNavMenuId, new LeftNavMenuAddEdit
+        {
+            MenuHeaderText = "Renamed Menu",
+            System = "Viper"
+        }, TestContext.Current.CancellationToken);
+
+        Assert.Equal("Renamed Menu", updated!.MenuHeaderText);
+        Assert.Null(updated.ViperSectionPath);
+    }
+
+    [Fact]
+    public async Task CreateMenu_DuplicateFriendlyName_ThrowsCaseInsensitive()
+    {
+        await SeedMenuAsync(m => m.FriendlyName = "cats-home");
+
+        await Assert.ThrowsAsync<ArgumentException>(() => _service.CreateMenuAsync(new LeftNavMenuAddEdit
+        {
+            MenuHeaderText = "Dup",
+            System = "Viper",
+            FriendlyName = "CATS-HOME"
+        }, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task UpdateMenu_DuplicateFriendlyName_Rejected_ButKeepingOwnIsAllowed()
+    {
+        var alpha = await SeedMenuAsync(m => m.FriendlyName = "alpha");
+        var beta = await SeedMenuAsync(m => m.FriendlyName = "beta");
+
+        // Renaming beta onto alpha's friendly name (any case) is rejected.
+        await Assert.ThrowsAsync<ArgumentException>(() => _service.UpdateMenuAsync(beta.LeftNavMenuId,
+            new LeftNavMenuAddEdit { MenuHeaderText = "B", System = "Viper", FriendlyName = "ALPHA" },
+            TestContext.Current.CancellationToken));
+
+        // Keeping its own friendly name (self-match excluded) is allowed.
+        var updated = await _service.UpdateMenuAsync(alpha.LeftNavMenuId,
+            new LeftNavMenuAddEdit { MenuHeaderText = "A renamed", System = "Viper", FriendlyName = "ALPHA" },
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(updated);
+    }
+
+    [Fact]
+    public async Task DeleteMenu_CascadesToItemsAndPermissions()
+    {
+        var menu = await SeedMenuAsync(m => m.LeftNavItems.Add(MakeItem("Link", 1, url: "/x", permissions: "SVMSecure.CATS")));
+
+        var result = await _service.DeleteMenuAsync(menu.LeftNavMenuId, TestContext.Current.CancellationToken);
+
+        Assert.True(result);
+        Assert.Empty(await _context.LeftNavMenus.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.LeftNavItems.ToListAsync(TestContext.Current.CancellationToken));
+        Assert.Empty(await _context.LeftNavItemToPermissions.ToListAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task SaveItems_AddsUpdatesDeletesAndReorders()
+    {
+        var menu = await SeedMenuAsync(m =>
+        {
+            m.LeftNavItems.Add(MakeItem("Keep Me", 1, url: "/keep", permissions: "SVMSecure.Old"));
+            m.LeftNavItems.Add(MakeItem("Delete Me", 2, url: "/delete"));
+        });
+        var keepId = menu.LeftNavItems.First(i => i.MenuItemText == "Keep Me").LeftNavItemId;
+
+        var dto = await _service.SaveItemsAsync(menu.LeftNavMenuId, new List<LeftNavItemEdit>
+        {
+            new() { LeftNavItemId = 0, MenuItemText = "New Header", IsHeader = true },
+            new() { LeftNavItemId = keepId, MenuItemText = "Keep Me Renamed", Url = "/kept", Permissions = new List<string> { "SVMSecure.New" } },
+        }, TestContext.Current.CancellationToken);
+
+        Assert.Equal(2, dto!.Items.Count);
+        Assert.Equal("New Header", dto.Items[0].MenuItemText);
+        Assert.Equal(1, dto.Items[0].DisplayOrder);
+        Assert.True(dto.Items[0].IsHeader);
+        Assert.Equal("Keep Me Renamed", dto.Items[1].MenuItemText);
+        Assert.Equal(2, dto.Items[1].DisplayOrder);
+        Assert.Equal(new List<string> { "SVMSecure.New" }, dto.Items[1].Permissions);
+        // Deleted item's permissions are gone too
+        Assert.Equal(1, await _context.LeftNavItemToPermissions.CountAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task SaveItems_HeaderItems_DropUrl()
+    {
+        var menu = await SeedMenuAsync();
+
+        var dto = await _service.SaveItemsAsync(menu.LeftNavMenuId, new List<LeftNavItemEdit>
+        {
+            new() { LeftNavItemId = 0, MenuItemText = "Header", IsHeader = true, Url = "/should-be-dropped" },
+        }, TestContext.Current.CancellationToken);
+
+        Assert.Null(dto!.Items[0].Url);
+    }
+
+    [Fact]
+    public async Task SaveItems_UnknownMenu_ReturnsNull()
+    {
+        var dto = await _service.SaveItemsAsync(9999, new List<LeftNavItemEdit>(), TestContext.Current.CancellationToken);
+
+        Assert.Null(dto);
+    }
+
+    [Fact]
+    public async Task SaveItems_UnknownItemId_Throws_AndDoesNotResurrect()
+    {
+        var menu = await SeedMenuAsync(m => m.LeftNavItems.Add(MakeItem("Keep Me", 1, url: "/keep")));
+
+        // A stale client posts an id that no longer exists in the menu.
+        await Assert.ThrowsAsync<InvalidOperationException>(() => _service.SaveItemsAsync(menu.LeftNavMenuId,
+            new List<LeftNavItemEdit>
+            {
+                new() { LeftNavItemId = 987654, MenuItemText = "Deleted Elsewhere" }
+            }, TestContext.Current.CancellationToken));
+
+        // Nothing was created; the menu still holds only its original item.
+        Assert.Equal(1, await _context.LeftNavItems.CountAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task SaveItems_DuplicateItemIds_ThrowsArgumentException()
+    {
+        var menu = await SeedMenuAsync(m => m.LeftNavItems.Add(MakeItem("Keep Me", 1, url: "/keep")));
+        var keepId = menu.LeftNavItems.First().LeftNavItemId;
+
+        await Assert.ThrowsAsync<ArgumentException>(() => _service.SaveItemsAsync(menu.LeftNavMenuId,
+            new List<LeftNavItemEdit>
+            {
+                new() { LeftNavItemId = keepId, MenuItemText = "A" },
+                new() { LeftNavItemId = keepId, MenuItemText = "B" }
+            }, TestContext.Current.CancellationToken));
+    }
+}
diff --git a/test/CMS/CmsTrashPurgeScheduledJobTests.cs b/test/CMS/CmsTrashPurgeScheduledJobTests.cs
new file mode 100644
index 000000000..ffdab6d37
--- /dev/null
+++ b/test/CMS/CmsTrashPurgeScheduledJobTests.cs
@@ -0,0 +1,64 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Jobs;
+using Viper.Areas.CMS.Services;
+using Viper.Areas.Scheduler.Models;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// The trash-purge job permanently deletes files, so its config gate is safety-critical: it must
+/// stay off unless an environment explicitly opts in via <see cref="CmsTrash.PurgeEnabledConfigKey"/>.
+/// </summary>
+public sealed class CmsTrashPurgeScheduledJobTests
+{
+    private static CmsTrashPurgeScheduledJob MakeJob(ICmsFileService fileService, bool? enabled)
+    {
+        var settings = new Dictionary<string, string?>();
+        if (enabled != null)
+        {
+            settings[CmsTrash.PurgeEnabledConfigKey] = enabled.Value ? "true" : "false";
+        }
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(settings).Build();
+        return new CmsTrashPurgeScheduledJob(
+            fileService, configuration, Substitute.For<ILogger<CmsTrashPurgeScheduledJob>>());
+    }
+
+    private static ScheduledJobContext Context() => new(ScheduledJobContext.SchedulerActor);
+
+    [Fact]
+    public async Task RunAsync_DoesNotPurge_WhenFlagMissing()
+    {
+        var fileService = Substitute.For<ICmsFileService>();
+        var job = MakeJob(fileService, enabled: null);
+
+        await job.RunAsync(Context(), CancellationToken.None);
+
+        await fileService.DidNotReceiveWithAnyArgs().PurgeDeletedFilesAsync(default, TestContext.Current.CancellationToken);
+    }
+
+    [Fact]
+    public async Task RunAsync_DoesNotPurge_WhenDisabled()
+    {
+        var fileService = Substitute.For<ICmsFileService>();
+        var job = MakeJob(fileService, enabled: false);
+
+        await job.RunAsync(Context(), CancellationToken.None);
+
+        await fileService.DidNotReceiveWithAnyArgs().PurgeDeletedFilesAsync(default, TestContext.Current.CancellationToken);
+    }
+
+    [Fact]
+    public async Task RunAsync_Purges_WhenEnabled()
+    {
+        var fileService = Substitute.For<ICmsFileService>();
+        fileService.PurgeDeletedFilesAsync(Arg.Any<int>(), Arg.Any<CancellationToken>()).Returns(3);
+        var job = MakeJob(fileService, enabled: true);
+
+        await job.RunAsync(Context(), CancellationToken.None);
+
+        await fileService.Received(1).PurgeDeletedFilesAsync(CmsTrash.RetentionDays, Arg.Any<CancellationToken>());
+    }
+}
diff --git a/test/CMS/CmsUserPhotoServiceTests.cs b/test/CMS/CmsUserPhotoServiceTests.cs
new file mode 100644
index 000000000..e3efb7fa0
--- /dev/null
+++ b/test/CMS/CmsUserPhotoServiceTests.cs
@@ -0,0 +1,162 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Viper.Areas.CMS.Services;
+using Viper.Areas.Students.Services;
+using Viper.Classes.SQLContext;
+using Viper.Models.AAUD;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for CmsUserPhotoService: AAUD id resolution, alternate ProfilePhotos lookup with
+/// traversal protection, and delegation to the Students photo pipeline.
+/// </summary>
+public sealed class CmsUserPhotoServiceTests : IDisposable
+{
+    private readonly string _profilePhotoRoot;
+    private readonly AAUDContext _aaudContext;
+    private readonly IPhotoService _photoService;
+    private readonly CmsUserPhotoService _service;
+
+    private static readonly byte[] IdCardPhotoBytes = { 1, 1, 1 };
+    private static readonly byte[] AltPhotoBytes = { 2, 2, 2 };
+
+    public CmsUserPhotoServiceTests()
+    {
+        _profilePhotoRoot = Path.Join(Path.GetTempPath(), "ViperCmsPhotoTests_" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(_profilePhotoRoot);
+
+        _aaudContext = new AAUDContext(new DbContextOptionsBuilder<AAUDContext>()
+            .UseInMemoryDatabase("AAUD_" + Guid.NewGuid()).Options);
+
+        _photoService = Substitute.For<IPhotoService>();
+        _photoService.GetStudentPhotoAsync(Arg.Any<string>()).Returns(Task.FromResult(IdCardPhotoBytes));
+
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["CMS:ProfilePhotoPath"] = _profilePhotoRoot })
+            .Build();
+
+        _service = new CmsUserPhotoService(_aaudContext, _photoService, configuration,
+            Substitute.For<ILogger<CmsUserPhotoService>>());
+    }
+
+    public void Dispose()
+    {
+        _aaudContext.Dispose();
+        if (Directory.Exists(_profilePhotoRoot))
+        {
+            Directory.Delete(_profilePhotoRoot, recursive: true);
+        }
+    }
+
+    private void SeedUser(string loginId = "jdoe", string mailId = "jdoe", string iamId = "1000999")
+    {
+        _aaudContext.AaudUsers.Add(new AaudUser
+        {
+            AaudUserId = 1,
+            ClientId = "test-client",
+            LoginId = loginId,
+            MailId = mailId,
+            IamId = iamId,
+            Current = 1,
+            LastName = "Doe",
+            FirstName = "Jane",
+            DisplayLastName = "Doe",
+            DisplayFirstName = "Jane",
+            DisplayFullName = "Doe, Jane",
+            MothraId = "m1",
+            SpridenId = null,
+            Pidm = null,
+            EmployeeId = null,
+            VmacsId = null,
+            VmcasId = null,
+            UnexId = null
+        });
+        _aaudContext.SaveChanges();
+    }
+
+    [Fact]
+    public async Task GetUserPhoto_ByMailId_DelegatesToStudentPipeline()
+    {
+        var photo = await _service.GetUserPhotoAsync("jdoe", null, null, preferAltPhoto: false,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(IdCardPhotoBytes, photo);
+        await _photoService.Received(1).GetStudentPhotoAsync("jdoe");
+    }
+
+    [Fact]
+    public async Task GetUserPhoto_ByLoginId_ResolvesMailIdThroughAaud()
+    {
+        SeedUser(loginId: "jdoe", mailId: "janedoe");
+
+        await _service.GetUserPhotoAsync(null, "jdoe", null, preferAltPhoto: false,
+            TestContext.Current.CancellationToken);
+
+        await _photoService.Received(1).GetStudentPhotoAsync("janedoe");
+    }
+
+    [Fact]
+    public async Task GetUserPhoto_UnknownLoginId_FallsBackToDefaultPipeline()
+    {
+        var photo = await _service.GetUserPhotoAsync(null, "nosuchuser", null, preferAltPhoto: false,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(IdCardPhotoBytes, photo);
+        await _photoService.Received(1).GetStudentPhotoAsync(string.Empty);
+    }
+
+    [Fact]
+    public async Task GetUserPhoto_PreferAltPhoto_ServesProfilePhoto()
+    {
+        SeedUser(iamId: "1000999");
+        await File.WriteAllBytesAsync(Path.Join(_profilePhotoRoot, "1000999.jpg"), AltPhotoBytes,
+            TestContext.Current.CancellationToken);
+
+        var photo = await _service.GetUserPhotoAsync(null, "jdoe", null, preferAltPhoto: true,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(AltPhotoBytes, photo);
+        await _photoService.DidNotReceive().GetStudentPhotoAsync(Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task GetUserPhoto_ByMailIdPreferAltPhoto_ResolvesIamIdAndServesProfilePhoto()
+    {
+        SeedUser(mailId: "jdoe", iamId: "1000999");
+        await File.WriteAllBytesAsync(Path.Join(_profilePhotoRoot, "1000999.jpg"), AltPhotoBytes,
+            TestContext.Current.CancellationToken);
+
+        var photo = await _service.GetUserPhotoAsync("jdoe", null, null, preferAltPhoto: true,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(AltPhotoBytes, photo);
+        await _photoService.DidNotReceive().GetStudentPhotoAsync(Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task GetUserPhoto_PreferAltPhoto_MissingAltFallsBackToIdCard()
+    {
+        SeedUser(mailId: "janedoe", iamId: "1000999");
+
+        var photo = await _service.GetUserPhotoAsync(null, "jdoe", null, preferAltPhoto: true,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(IdCardPhotoBytes, photo);
+        await _photoService.Received(1).GetStudentPhotoAsync("janedoe");
+    }
+
+    [Theory]
+    [InlineData("../1000999")]
+    [InlineData("..\\secrets")]
+    [InlineData("a/b")]
+    public async Task GetUserPhoto_TraversalShapedIamId_IgnoresAltPhoto(string iamId)
+    {
+        var photo = await _service.GetUserPhotoAsync(null, null, iamId, preferAltPhoto: true,
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(IdCardPhotoBytes, photo);
+    }
+}
diff --git a/test/CMS/MaxLengthEachAttributeTests.cs b/test/CMS/MaxLengthEachAttributeTests.cs
new file mode 100644
index 000000000..1a57c9806
--- /dev/null
+++ b/test/CMS/MaxLengthEachAttributeTests.cs
@@ -0,0 +1,45 @@
+using System.ComponentModel.DataAnnotations;
+using Viper.Areas.CMS.Validation;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for MaxLengthEachAttribute, which bounds each string element of a collection (used for
+/// left-nav item permission strings vs the varchar(500) permission column).
+/// </summary>
+public sealed class MaxLengthEachAttributeTests
+{
+    private static ValidationResult? Validate(object? value, int length)
+    {
+        var attribute = new MaxLengthEachAttribute(length);
+        return attribute.GetValidationResult(value, new ValidationContext(new object()));
+    }
+
+    [Fact]
+    public void AllElementsWithinLimit_Succeeds()
+    {
+        var value = new List<string> { "SVMSecure.CATS", new string('a', 500) };
+
+        Assert.Equal(ValidationResult.Success, Validate(value, 500));
+    }
+
+    [Fact]
+    public void AnyElementOverLimit_Fails()
+    {
+        var value = new List<string> { "ok", new string('a', 501) };
+
+        Assert.NotEqual(ValidationResult.Success, Validate(value, 500));
+    }
+
+    [Fact]
+    public void NullValue_Succeeds()
+    {
+        Assert.Equal(ValidationResult.Success, Validate(null, 500));
+    }
+
+    [Fact]
+    public void EmptyCollection_Succeeds()
+    {
+        Assert.Equal(ValidationResult.Success, Validate(new List<string>(), 500));
+    }
+}
diff --git a/test/CMS/SafeUrlAttributeTests.cs b/test/CMS/SafeUrlAttributeTests.cs
new file mode 100644
index 000000000..c8d52cc7d
--- /dev/null
+++ b/test/CMS/SafeUrlAttributeTests.cs
@@ -0,0 +1,84 @@
+using System.ComponentModel.DataAnnotations;
+using Viper.Areas.CMS.Validation;
+
+namespace Viper.test.CMS;
+
+/// <summary>
+/// Tests for SafeUrlAttribute, in both absolute-only mode (link collections) and
+/// AllowRelative mode (left nav item URLs).
+/// </summary>
+public sealed class SafeUrlAttributeTests
+{
+    private static ValidationResult? Validate(string? url, bool allowRelative)
+    {
+        var attribute = new SafeUrlAttribute { AllowRelative = allowRelative };
+        return attribute.GetValidationResult(url, new ValidationContext(new object()));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("https://example.com/page")]
+    [InlineData("http://example.com")]
+    [InlineData("mailto:someone@example.com")]
+    [InlineData("tel:+15305551234")]
+    public void AbsoluteMode_AllowsSafeSchemesAndEmpty(string? url)
+    {
+        Assert.Equal(ValidationResult.Success, Validate(url, allowRelative: false));
+    }
+
+    [Theory]
+    [InlineData("javascript:alert(document.cookie)")]
+    [InlineData("JAVASCRIPT:alert(1)")]
+    [InlineData("data:text/html,<script>alert(1)</script>")]
+    [InlineData("vbscript:msgbox(1)")]
+    [InlineData("java\tscript:alert(1)")]
+    [InlineData("java\nscript:alert(1)")]
+    public void BothModes_RejectDangerousUrls(string url)
+    {
+        Assert.NotEqual(ValidationResult.Success, Validate(url, allowRelative: false));
+        Assert.NotEqual(ValidationResult.Success, Validate(url, allowRelative: true));
+    }
+
+    [Theory]
+    [InlineData("/CMS/files")]
+    [InlineData("~/ManageLeftNav")]
+    [InlineData("page.cfm?x=1")]
+    [InlineData("path/to/page#section")]
+    public void RelativeMode_AllowsRelativeUrls(string url)
+    {
+        Assert.Equal(ValidationResult.Success, Validate(url, allowRelative: true));
+    }
+
+    [Fact]
+    public void AbsoluteMode_RejectsRelativeUrls()
+    {
+        Assert.NotEqual(ValidationResult.Success, Validate("/CMS/files", allowRelative: false));
+    }
+
+    [Fact]
+    public void RelativeMode_RejectsColonInFirstSegment()
+    {
+        Assert.NotEqual(ValidationResult.Success, Validate("foo:bar/baz", allowRelative: true));
+    }
+
+    [Theory]
+    [InlineData("//evil.example/path")]
+    [InlineData("//evil.example")]
+    [InlineData("/\\evil.example/path")]
+    [InlineData("\\\\evil.example\\path")]
+    [InlineData("\\/evil.example")]
+    public void BothModes_RejectProtocolRelativeUrls(string url)
+    {
+        // A scheme-less "//host" (or its backslash variants) navigates off-site, so it must be
+        // rejected even in relative mode, where bare relative paths are otherwise allowed.
+        Assert.NotEqual(ValidationResult.Success, Validate(url, allowRelative: true));
+        Assert.NotEqual(ValidationResult.Success, Validate(url, allowRelative: false));
+    }
+
+    [Fact]
+    public void RelativeMode_AllowsColonAfterFirstSegment()
+    {
+        Assert.Equal(ValidationResult.Success, Validate("path/page:1", allowRelative: true));
+    }
+}
diff --git a/test/Classes/Utilities/DateRangeHelperTests.cs b/test/Classes/Utilities/DateRangeHelperTests.cs
new file mode 100644
index 000000000..733642575
--- /dev/null
+++ b/test/Classes/Utilities/DateRangeHelperTests.cs
@@ -0,0 +1,44 @@
+using Viper.Classes.Utilities;
+
+namespace Viper.test.Classes.Utilities;
+
+/// <summary>
+/// Tests for DateRangeHelper.ExclusiveUpperBound, the shared "To" filter bound used by both
+/// the CMS file-audit and content-history date filters. A date-only value is inclusive through
+/// the end of that day (the next midnight is returned, to compare with &lt;); any value that
+/// carries a time of day, even a single tick past midnight, is returned unchanged.
+/// </summary>
+public class DateRangeHelperTests
+{
+    [Fact]
+    public void ExclusiveUpperBound_DateOnly_AdvancesOneDay()
+    {
+        var to = new DateTime(2026, 6, 15, 0, 0, 0, DateTimeKind.Local);
+
+        var result = DateRangeHelper.ExclusiveUpperBound(to);
+
+        Assert.Equal(new DateTime(2026, 6, 16, 0, 0, 0, DateTimeKind.Local), result);
+    }
+
+    [Fact]
+    public void ExclusiveUpperBound_WithTimeComponent_ReturnedUnchanged()
+    {
+        // A single tick past midnight already counts as carrying a time of day, so the bound is
+        // used as-is. This pins the non-obvious "to.Date == to" midnight check in the helper.
+        var to = new DateTime(2026, 6, 15, 0, 0, 0, DateTimeKind.Local).AddTicks(1);
+
+        var result = DateRangeHelper.ExclusiveUpperBound(to);
+
+        Assert.Equal(to, result);
+    }
+
+    [Fact]
+    public void ExclusiveUpperBound_MaxValueDate_ClampsToMaxValueWithoutOverflow()
+    {
+        // A user-suppliable "To" at the DateTime ceiling has no next midnight to advance to, so
+        // advancing by a day would overflow. The helper clamps to MaxValue instead.
+        var result = DateRangeHelper.ExclusiveUpperBound(DateTime.MaxValue.Date);
+
+        Assert.Equal(DateTime.MaxValue, result);
+    }
+}
diff --git a/test/Services/HtmlSanitizerServiceTests.cs b/test/Services/HtmlSanitizerServiceTests.cs
index 3b7802fa1..bb34d3489 100644
--- a/test/Services/HtmlSanitizerServiceTests.cs
+++ b/test/Services/HtmlSanitizerServiceTests.cs
@@ -220,4 +220,51 @@ public void Preserves_realworld_inline_styles(string input, params string[] must
             Assert.Contains(token, output, StringComparison.OrdinalIgnoreCase);
         }
     }
+
+    // === SanitizeDiff — the diff-specific variant adds <ins>/<del> to the allowlist, but its
+    // output is rendered with v-html on the content-block diff pages, so it must keep the same
+    // XSS guarantees as the base sanitizer. These lock that down. ===
+
+    [Theory]
+    [InlineData("<ins class=\"diffins\"><script>alert(1)</script>added</ins>")]
+    [InlineData("<del class=\"diffdel\"><img src=\"x\" onerror=\"alert(1)\" alt=\"x\"></del>")]
+    [InlineData("<ins class=\"diffmod\"><a href=\"javascript:alert(1)\">x</a></ins>")]
+    public void SanitizeDiff_strips_xss_payloads_inside_change_markers(string input)
+    {
+        var output = _sanitizer.SanitizeDiff(input);
+        Assert.DoesNotContain("<script", output, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("alert(1)", output);
+        Assert.DoesNotContain("onerror", output, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("javascript:", output, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void SanitizeDiff_strips_data_uri_in_img_src()
+    {
+        var input = "<ins class=\"diffins\"><img src=\"data:image/svg+xml;base64,PHN2Zw==\" alt=\"x\"></ins>";
+        var output = _sanitizer.SanitizeDiff(input);
+        Assert.DoesNotContain("data:", output);
+    }
+
+    [Theory]
+    [InlineData("<ins class=\"diffins\">added</ins>", "<ins", "diffins")]
+    [InlineData("<del class=\"diffdel\">removed</del>", "<del", "diffdel")]
+    [InlineData("<ins class=\"diffmod\">changed</ins>", "<ins", "diffmod")]
+    public void SanitizeDiff_preserves_change_markers_and_classes(string input, string tagFragment, string className)
+    {
+        var output = _sanitizer.SanitizeDiff(input);
+        Assert.Contains(tagFragment, output, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains(className, output);
+    }
+
+    [Theory]
+    [InlineData("<ins>added</ins>", "<ins")]
+    [InlineData("<del>removed</del>", "<del")]
+    public void Sanitize_strips_diff_markers_that_SanitizeDiff_keeps(string input, string tagFragment)
+    {
+        // The base content sanitizer does not allow <ins>/<del>; only the diff variant does.
+        // This proves the two policies genuinely differ rather than sharing one allowlist.
+        var output = _sanitizer.Sanitize(input);
+        Assert.DoesNotContain(tagFragment, output, StringComparison.OrdinalIgnoreCase);
+    }
 }
diff --git a/web/Areas/CMS/Constants/CmsFileNaming.cs b/web/Areas/CMS/Constants/CmsFileNaming.cs
new file mode 100644
index 000000000..221d57c17
--- /dev/null
+++ b/web/Areas/CMS/Constants/CmsFileNaming.cs
@@ -0,0 +1,14 @@
+namespace Viper.Areas.CMS.Constants
+{
+    /// <summary>
+    /// Shared CMS file naming rules. Mirrors the legacy ColdFusion Files.cfc:
+    /// friendly names are the folder path with separators dashed, plus the file name.
+    /// </summary>
+    public static class CmsFileNaming
+    {
+        public static string BuildFriendlyName(string folder, string fileName)
+        {
+            return folder.Replace('\\', '-').Replace('/', '-') + "-" + fileName;
+        }
+    }
+}
diff --git a/web/Areas/CMS/Constants/CmsFileTypes.cs b/web/Areas/CMS/Constants/CmsFileTypes.cs
new file mode 100644
index 000000000..4f2bf6313
--- /dev/null
+++ b/web/Areas/CMS/Constants/CmsFileTypes.cs
@@ -0,0 +1,73 @@
+namespace Viper.Areas.CMS.Constants
+{
+    /// <summary>
+    /// Allowed CMS file extensions and their MIME types. Mirrors the legacy
+    /// ColdFusion Lookups.cfc allow-list; extensions not in this map are rejected on upload.
+    /// </summary>
+    public static class CmsFileTypes
+    {
+        public static readonly IReadOnlyDictionary<string, string> MimeTypes = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["pdf"] = "application/pdf",
+            ["docx"] = "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+            ["doc"] = "application/msword",
+            ["xls"] = "application/vnd.ms-excel",
+            ["xlsx"] = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+            ["csv"] = "text/csv",
+            ["ppt"] = "application/vnd.ms-powerpoint",
+            ["pptx"] = "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+            ["pptm"] = "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
+            ["txt"] = "text/plain",
+            ["html"] = "application/xhtml+xml",
+            ["gif"] = "image/gif",
+            ["png"] = "image/png",
+            ["jpg"] = "image/jpeg",
+            ["jpeg"] = "image/jpeg",
+            ["tiff"] = "image/tiff",
+            ["mp3"] = "audio/mpeg",
+            ["wav"] = "audio/wav",
+            ["mp4"] = "video/mp4",
+            ["webm"] = "video/webm",
+            ["oft"] = "application/vnd.ms-outlook",
+            ["eps"] = "application/postscript",
+            ["zip"] = "application/zip",
+            ["7z"] = "application/x-7z-compressed",
+            ["dmg"] = "application/x-apple-diskimage",
+            ["exe"] = "application/vnd.microsoft.portable-executable"
+        };
+
+        /// <summary>
+        /// Extensions the browser would render as active markup (script execution / inline SVG)
+        /// rather than download. Legacy .html files must stay downloadable, so instead of removing
+        /// them from the allow-list we serve these as an attachment, never inline, to close the
+        /// stored-XSS path from an uploaded .html/.svg running in the app origin.
+        /// </summary>
+        public static readonly IReadOnlySet<string> InlineUnsafeExtensions = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+        {
+            "html", "htm", "xhtml", "svg"
+        };
+
+        public static bool IsAllowedFileName(string fileName)
+        {
+            return MimeTypes.ContainsKey(GetExtension(fileName));
+        }
+
+        /// <summary>True when a file must be served as a download rather than rendered inline.</summary>
+        public static bool ShouldForceAttachment(string fileName)
+        {
+            return InlineUnsafeExtensions.Contains(GetExtension(fileName));
+        }
+
+        public static string GetMimeType(string fileName)
+        {
+            return MimeTypes.TryGetValue(GetExtension(fileName), out var mimeType)
+                ? mimeType
+                : "application/octet-stream";
+        }
+
+        private static string GetExtension(string fileName)
+        {
+            return Path.GetExtension(fileName).TrimStart('.');
+        }
+    }
+}
diff --git a/web/Areas/CMS/Constants/CmsPermissions.cs b/web/Areas/CMS/Constants/CmsPermissions.cs
new file mode 100644
index 000000000..6c65899cd
--- /dev/null
+++ b/web/Areas/CMS/Constants/CmsPermissions.cs
@@ -0,0 +1,20 @@
+namespace Viper.Areas.CMS.Constants
+{
+    /// <summary>
+    /// RAPS permission strings used by the CMS area.
+    /// </summary>
+    public static class CmsPermissions
+    {
+        public const string Base = "SVMSecure.CMS";
+        public const string AllFiles = "SVMSecure.CMS.AllFiles";
+        public const string ManageContentBlocks = "SVMSecure.CMS.ManageContentBlocks";
+        public const string CreateContentBlock = "SVMSecure.CMS.CreateContentBlock";
+        public const string ManageNavigation = "SVMSecure.CMS.ManageNavigation";
+
+        // Legacy parity: the ColdFusion CMS gated permanent ("dev only") content-block delete on
+        // SVMSecure.CATS.Admin (cms/views/contentBlock.cfm, cms/inc_contentBlock.cfm). VIPER 2 reuses
+        // it for permanent delete of blocks and files; legacy file permanent delete was AllFiles-only,
+        // so hard delete of files is deliberately narrowed to admins here.
+        public const string Admin = "SVMSecure.CATS.Admin";
+    }
+}
diff --git a/web/Areas/CMS/Constants/CmsTrash.cs b/web/Areas/CMS/Constants/CmsTrash.cs
new file mode 100644
index 000000000..2bad43fa2
--- /dev/null
+++ b/web/Areas/CMS/Constants/CmsTrash.cs
@@ -0,0 +1,20 @@
+namespace Viper.Areas.CMS.Constants
+{
+    /// <summary>
+    /// Trash (soft-delete) retention policy. A soft-deleted CMS file stays recoverable for this
+    /// many days, then the CmsTrashPurgeScheduledJob permanently deletes it (record + disk),
+    /// matching the legacy 30-day "will be permanently deleted on ..." behavior.
+    /// </summary>
+    public static class CmsTrash
+    {
+        public const int RetentionDays = 30;
+
+        /// <summary>
+        /// Config key gating the trash-purge job. Absent/false means the job never permanently
+        /// deletes, so it can ship disabled and stay off across app restarts and IIS recycles
+        /// (unlike a dashboard tweak). Kept false until the legacy VIPER 1 30-day purge is retired,
+        /// so the two never purge in parallel; flipped to true (via SSM in deployed envs) at cutover.
+        /// </summary>
+        public const string PurgeEnabledConfigKey = "Cms:TrashPurgeEnabled";
+    }
+}
diff --git a/web/Areas/CMS/Controllers/CMSContentController.cs b/web/Areas/CMS/Controllers/CMSContentController.cs
index 8b0399f31..76696185c 100644
--- a/web/Areas/CMS/Controllers/CMSContentController.cs
+++ b/web/Areas/CMS/Controllers/CMSContentController.cs
@@ -1,9 +1,11 @@
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Constants;
 using Viper.Areas.CMS.Models;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
 using Viper.Classes;
 using Viper.Classes.SQLContext;
-using Viper.Models.VIPER;
+using Viper.Models;
 using Viper.Services;
 using Web.Authorization;
 
@@ -16,150 +18,291 @@ public class CMSContentController : ApiController
         private readonly VIPERContext _context;
         private readonly RAPSContext _rapsContext;
         private readonly IHtmlSanitizerService _sanitizerService;
-        public IUserHelper UserHelper { get; private set; }
+        private readonly ICmsContentBlockService _blockService;
+        private readonly ICmsFileStorageService _storage;
+        private readonly IUserHelper _userHelper;
 
-        public CMSContentController(VIPERContext context, RAPSContext rapsContext, IHtmlSanitizerService sanitizerService)
+        public CMSContentController(VIPERContext context, RAPSContext rapsContext,
+            IHtmlSanitizerService sanitizerService, ICmsContentBlockService blockService,
+            ICmsFileStorageService storage, IUserHelper userHelper)
         {
             _context = context;
             _rapsContext = rapsContext;
             _sanitizerService = sanitizerService;
-            UserHelper = new UserHelper();
+            _blockService = blockService;
+            _storage = storage;
+            _userHelper = userHelper;
         }
 
         //GET: content
         [HttpGet]
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
-        public ActionResult<List<ContentBlock>> GetContentBlocks()
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        [ApiPagination(DefaultPerPage = 50, MaxPerPage = 500)]
+        public async Task<ActionResult<List<ContentBlockDto>>> GetContentBlocks(
+            ApiPagination? pagination,
+            string status = "active",
+            string? system = null,
+            string? viperSectionPath = null,
+            string? search = null,
+            bool? isPublic = null,
+            string? sortBy = "title",
+            bool descending = false,
+            CancellationToken ct = default)
         {
-            if (_context.ContentBlocks == null)
+            var page = pagination?.Page ?? 1;
+            var perPage = pagination?.PerPage ?? 50;
+            var (blocks, total) = await _blockService.GetContentBlocksAsync(status, system, viperSectionPath, search,
+                isPublic, page, perPage, sortBy, descending, ct);
+            if (pagination != null)
             {
-                return NotFound();
+                pagination.TotalRecords = total;
             }
-            return new Data.CMS(_context, _rapsContext, _sanitizerService).GetContentBlocks()?.ToList() ?? new List<ContentBlock>();
+            return blocks;
         }
 
-        //GET: content/fn/{friendlyName}
-        [HttpGet("fn/{friendlyName}")]
-        public ActionResult<ContentBlock?> GetContentBlockByFn(string friendlyName)
+        //GET: content/section-paths
+        [HttpGet("section-paths")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<List<string>>> GetViperSectionPaths(CancellationToken ct = default)
         {
-            var blocks = new Data.CMS(_context, _rapsContext, _sanitizerService).GetContentBlocksAllowed(null, friendlyName, null, null, null, null, null, null)?.ToList();
-            if (blocks == null || blocks.Count == 0)
-            {
-                return NotFound();
-            }
+            return await _blockService.GetViperSectionPathsAsync(ct);
+        }
 
-            return blocks[0];
+        // GET: content/folders
+        // The section path IS a file folder (legacy parity): a block's files live in this folder.
+        // Exposed to content-block editors so the section path can be chosen from the real upload
+        // folders without requiring AllFiles (the /api/cms/files/folders endpoint is AllFiles-gated).
+        [HttpGet("folders")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks + "," + CmsPermissions.CreateContentBlock)]
+        public ActionResult<List<string>> GetFolders()
+        {
+            return _storage.GetTopLevelFolders();
         }
 
-        //PUT: content/5
-        [HttpPut("{contentBlockId}")]
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
-        public async Task<ActionResult<ContentBlock>> UpdateContentBlock(int contentBlockId, CMSBlockAddEdit block)
+        //GET: content/5
+        [HttpGet("{contentBlockId:int}")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentBlockDto>> GetContentBlock(int contentBlockId, CancellationToken ct = default)
         {
-            //check data is valid and block is found
-            var existingBlock = await _context.ContentBlocks.FindAsync(contentBlockId);
-            if (existingBlock == null)
+            var block = await _blockService.GetContentBlockAsync(contentBlockId, ct);
+            if (block == null)
             {
                 return NotFound();
             }
+            return block;
+        }
 
-            if (contentBlockId != block.ContentBlockId)
+        //GET: content/fn/{friendlyName} — public display endpoint; permission filtering happens
+        //inside GetContentBlocksAllowed (public flag, block permissions, or CMS admin).
+        [HttpGet("fn/{friendlyName}")]
+        public ActionResult<ContentBlockDto> GetContentBlockByFn(string friendlyName)
+        {
+            // status: 1 = active only. A public display endpoint must never serve soft-deleted
+            // blocks (passing null would include DeletedOn != null rows).
+            var blocks = new Data.CMS(_context, _rapsContext, _sanitizerService)
+                .GetContentBlocksAllowed(null, friendlyName, null, null, null, null, null, 1)?.ToList();
+            if (blocks == null || blocks.Count == 0)
             {
-                return BadRequest();
+                return NotFound();
             }
 
-            string inputCheck = CheckBlockForRequiredFields(block);
-            if (!string.IsNullOrEmpty(inputCheck))
+            // Project to a DTO so this anonymous endpoint never serializes the raw entity graph:
+            // returning the entity would leak each attached file's encryption Key and server
+            // FilePath, the full (unsanitized) ContentHistory, and the block's permission rows.
+            // Content is already render-sanitized by GetContentBlocksAllowed.
+            return CmsContentBlockMapper.ToDto(blocks[0]);
+        }
+
+        //GET: content/5/history
+        [HttpGet("{contentBlockId:int}/history")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<List<ContentHistoryListItemDto>>> GetHistory(int contentBlockId, CancellationToken ct = default)
+        {
+            return await _blockService.GetHistoryAsync(contentBlockId, ct);
+        }
+
+        //GET: content/5/history/12
+        [HttpGet("{contentBlockId:int}/history/{contentHistoryId:int}")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentHistoryDto>> GetHistoryVersion(int contentBlockId, int contentHistoryId,
+            CancellationToken ct = default)
+        {
+            var version = await _blockService.GetHistoryVersionAsync(contentBlockId, contentHistoryId, ct);
+            if (version == null)
             {
-                return BadRequest(inputCheck);
+                return NotFound();
             }
+            return version;
+        }
 
-            var friendlyNameCheck = new Data.CMS(_context, _rapsContext, _sanitizerService).GetContentBlocks(friendlyName: block.FriendlyName)?.FirstOrDefault();
-            if (friendlyNameCheck != null && friendlyNameCheck.ContentBlockId != contentBlockId)
+        //GET: content/5/history/12/diff — rendered diff of this version against the previous version
+        [HttpGet("{contentBlockId:int}/history/{contentHistoryId:int}/diff")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentHistoryDiffDto>> GetHistoryVersionDiff(int contentBlockId, int contentHistoryId,
+            CancellationToken ct = default)
+        {
+            var diff = await _blockService.GetHistoryVersionDiffAsync(contentBlockId, contentHistoryId, ct);
+            if (diff == null)
             {
-                return ValidationProblem("Friendly name must be unique");
+                return NotFound();
             }
+            return diff;
+        }
 
-            if (friendlyNameCheck != null)
+        //POST: content/5/history/12/diff — rendered diff of a posted draft against this version.
+        //POST (not GET) because the editor's current content rides in the body.
+        [HttpPost("{contentBlockId:int}/history/{contentHistoryId:int}/diff")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentHistoryDiffDto>> DiffAgainstHistoryVersion(int contentBlockId, int contentHistoryId,
+            DiffAgainstHistoryRequest request, CancellationToken ct = default)
+        {
+            var diff = await _blockService.DiffContentAgainstHistoryAsync(contentBlockId, contentHistoryId, request.Content, ct);
+            if (diff == null)
             {
-                _context.Entry(friendlyNameCheck).State = EntityState.Detached;
+                return NotFound();
             }
+            return diff;
+        }
 
-            //modify database object
-            ModifyBlockWithUserInput(existingBlock, block);
-            _context.Entry(existingBlock).State = EntityState.Modified;
-
-            //save history
-            var contentHistory = new ContentHistory
+        //GET: content/history — cross-block edit-history viewer (the literal segment does not
+        //collide with the int-constrained {contentBlockId}/history route).
+        [HttpGet("history")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        [ApiPagination(DefaultPerPage = 50, MaxPerPage = 500)]
+        public async Task<ActionResult<List<ContentHistoryAuditDto>>> GetHistoryEntries(
+            int? contentBlockId,
+            string? modifiedBy,
+            DateTime? from,
+            DateTime? to,
+            string? search,
+            ApiPagination? pagination,
+            CancellationToken ct = default)
+        {
+            var filter = new CmsContentHistoryFilter
             {
                 ContentBlockId = contentBlockId,
-                ContentBlockContent = block.Content,
-                ModifiedOn = DateTime.Now,
-                ModifiedBy = UserHelper.GetCurrentUser()?.LoginId
+                ModifiedBy = modifiedBy,
+                From = from,
+                To = to,
+                Search = search
             };
-            _context.ContentHistories.Add(contentHistory);
-
-            //save and return the saved block
-            await _context.SaveChangesAsync();
-            var returnBlock = new Data.CMS(_context, _rapsContext, _sanitizerService).GetContentBlocks(contentBlockID: contentBlockId)?.FirstOrDefault();
-            if (returnBlock == null)
+            var page = pagination?.Page ?? 1;
+            var perPage = pagination?.PerPage ?? 50;
+            var entries = await _blockService.GetHistoryEntriesAsync(filter, page, perPage, ct);
+            if (pagination != null)
             {
-                return NotFound();
+                pagination.TotalRecords = await _blockService.GetHistoryEntryCountAsync(filter, ct);
             }
-            return returnBlock;
+            return entries;
         }
 
         //POST: content
         [HttpPost]
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
-        public async Task<ActionResult<ContentBlock>> CreateContentBlock(CMSBlockAddEdit block)
+        [Permission(Allow = CmsPermissions.CreateContentBlock + "," + CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentBlockDto>> CreateContentBlock(CMSBlockAddEdit block, CancellationToken ct = default)
         {
             string inputCheck = CheckBlockForRequiredFields(block);
             if (!string.IsNullOrEmpty(inputCheck))
             {
                 return BadRequest(inputCheck);
             }
-            var friendlyNameCheck = new Data.CMS(_context, _rapsContext, _sanitizerService).GetContentBlocks(friendlyName: block.FriendlyName)?.FirstOrDefault();
-            if (friendlyNameCheck != null)
+
+            try
             {
-                return ValidationProblem("Friendly name must be unique");
+                return await _blockService.CreateContentBlockAsync(block, ct);
             }
+            catch (ArgumentException ex)
+            {
+                return ValidationProblem(ex.Message);
+            }
+        }
 
-            var newBlock = new ContentBlock();
-            ModifyBlockWithUserInput(newBlock, block);
-
-            _context.ContentBlocks.Add(newBlock);
-            await _context.SaveChangesAsync();
+        //PUT: content/5
+        [HttpPut("{contentBlockId:int}")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentBlockDto>> UpdateContentBlock(int contentBlockId, CMSBlockAddEdit block,
+            CancellationToken ct = default)
+        {
+            if (contentBlockId != block.ContentBlockId)
+            {
+                return BadRequest();
+            }
 
-            var contentHistory = new ContentHistory
+            string inputCheck = CheckBlockForRequiredFields(block);
+            if (!string.IsNullOrEmpty(inputCheck))
             {
-                ContentBlockId = block.ContentBlockId,
-                ContentBlockContent = block.Content,
-                ModifiedOn = DateTime.Now,
-                ModifiedBy = UserHelper.GetCurrentUser()?.LoginId
-            };
-            _context.ContentHistories.Add(contentHistory);
-            await _context.SaveChangesAsync();
+                return BadRequest(inputCheck);
+            }
 
-            return newBlock;
+            try
+            {
+                var updated = await _blockService.UpdateContentBlockAsync(contentBlockId, block, ct);
+                if (updated == null)
+                {
+                    return NotFound();
+                }
+                return updated;
+            }
+            catch (CmsConcurrencyException ex)
+            {
+                return Conflict(ex.Message);
+            }
+            catch (ArgumentException ex)
+            {
+                return ValidationProblem(ex.Message);
+            }
         }
 
-        //DELETE: content/5
-        [HttpDelete("{contentBlockId}")]
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
-        public async Task<ActionResult<ContentBlock>> DeleteContentBlock(int contentBlockId)
+        //PATCH: content/5/content — quick save for content-only edits
+        [HttpPatch("{contentBlockId:int}/content")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<ActionResult<ContentBlockDto>> UpdateContentOnly(int contentBlockId,
+            ContentOnlyUpdate update, CancellationToken ct = default)
         {
-            var block = new Data.CMS(_context, _rapsContext, _sanitizerService).GetContentBlocks(contentBlockID: contentBlockId)?.FirstOrDefault();
-            if (block == null)
+            try
             {
-                return NotFound();
+                var updated = await _blockService.UpdateContentOnlyAsync(contentBlockId, update.Content, update.LastModifiedOn, ct);
+                if (updated == null)
+                {
+                    return NotFound();
+                }
+                return updated;
             }
+            catch (CmsConcurrencyException ex)
+            {
+                return Conflict(ex.Message);
+            }
+            catch (ArgumentException ex)
+            {
+                return ValidationProblem(ex.Message);
+            }
+        }
 
-            block.DeletedOn = DateTime.Now;
-            block.ModifiedBy = UserHelper.GetCurrentUser()?.LoginId;
-            _context.Entry(block).State = EntityState.Modified;
-            await _context.SaveChangesAsync();
-            return block;
+        //POST: content/5/restore
+        [HttpPost("{contentBlockId:int}/restore")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<IActionResult> RestoreContentBlock(int contentBlockId, CancellationToken ct = default)
+        {
+            return await _blockService.RestoreAsync(contentBlockId, ct) ? NoContent() : NotFound();
+        }
+
+        //DELETE: content/5?permanent=true|false
+        [HttpDelete("{contentBlockId:int}")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
+        public async Task<IActionResult> DeleteContentBlock(int contentBlockId, bool permanent = false,
+            CancellationToken ct = default)
+        {
+            if (permanent)
+            {
+                // Permanent delete removes history and cannot be undone; admin only, matching the
+                // legacy "dev only" (SVMSecure.CATS.Admin) gate on permanent content-block delete.
+                if (!_userHelper.HasPermission(_rapsContext, _userHelper.GetCurrentUser(), CmsPermissions.Admin))
+                {
+                    return ForbidApi();
+                }
+                return await _blockService.PermanentlyDeleteAsync(contentBlockId, ct) ? NoContent() : NotFound();
+            }
+            return await _blockService.SoftDeleteAsync(contentBlockId, ct) ? NoContent() : NotFound();
         }
 
         private static string CheckBlockForRequiredFields(CMSBlockAddEdit userInput)
@@ -175,39 +318,16 @@ private static string CheckBlockForRequiredFields(CMSBlockAddEdit userInput)
             }
             return errors;
         }
+    }
 
-        private void ModifyBlockWithUserInput(ContentBlock contentBlock, CMSBlockAddEdit userInput)
-        {
-            //update info
-            contentBlock.Title = userInput.Title;
-            contentBlock.Content = userInput.Content;
-            contentBlock.FriendlyName = userInput.FriendlyName;
-            contentBlock.System = userInput.System;
-            contentBlock.Application = userInput.Application;
-            contentBlock.Page = userInput.Page;
-            contentBlock.ViperSectionPath = userInput.ViperSectionPath;
-            contentBlock.AllowPublicAccess = userInput.AllowPublicAccess;
-            contentBlock.BlockOrder = userInput.BlockOrder;
-            contentBlock.ModifiedOn = DateTime.Now;
-            contentBlock.ModifiedBy = UserHelper.GetCurrentUser()?.LoginId;
-
-            //adjust permissions
-            //remove content block permisisons that are not in the user input
-            foreach (var cbp in contentBlock.ContentBlockToPermissions.Where(cbp => !userInput.Permissions.Contains(cbp.Permission)))
-            {
-                contentBlock.ContentBlockToPermissions.Remove(cbp);
-            }
+    public class ContentOnlyUpdate
+    {
+        public string Content { get; set; } = string.Empty;
+        public DateTime? LastModifiedOn { get; set; }
+    }
 
-            //add new content block permissions, if they are not in the existing list
-            var existingPermissions = contentBlock.ContentBlockToPermissions.Select(p => p.Permission).ToList();
-            foreach (var p in userInput.Permissions.Where(p => !existingPermissions.Contains(p)))
-            {
-                contentBlock.ContentBlockToPermissions.Add(new ContentBlockToPermission
-                {
-                    Permission = p,
-                    ContentBlockId = userInput.ContentBlockId
-                });
-            }
-        }
+    public class DiffAgainstHistoryRequest
+    {
+        public string Content { get; set; } = string.Empty;
     }
 }
diff --git a/web/Areas/CMS/Controllers/CMSController.cs b/web/Areas/CMS/Controllers/CMSController.cs
index e7703e074..c6232b931 100644
--- a/web/Areas/CMS/Controllers/CMSController.cs
+++ b/web/Areas/CMS/Controllers/CMSController.cs
@@ -1,4 +1,6 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using Viper.Areas.CMS.Services;
 using Viper.Classes.SQLContext;
 using Viper.Services;
 
@@ -21,6 +23,7 @@ public CMSController(RAPSContext rapsContext, VIPERContext viperContext, IHtmlSa
         }
 
         [HttpGet]
+        [EnableRateLimiting(CmsDownloadRateLimiting.PolicyName)]
         public IActionResult Files(string id = "", string fn = "", string oldURL = "", string ids = "", string fileName = "")
         {
             Data.CMS cms = new(_viperContext, _rapsContext, _sanitizerService, _cmsLogger);
diff --git a/web/Areas/CMS/Controllers/CMSFilesController.cs b/web/Areas/CMS/Controllers/CMSFilesController.cs
new file mode 100644
index 000000000..6eeb3b0e3
--- /dev/null
+++ b/web/Areas/CMS/Controllers/CMSFilesController.cs
@@ -0,0 +1,321 @@
+using Microsoft.AspNetCore.Mvc;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes;
+using Viper.Classes.SQLContext;
+using Viper.Classes.Utilities;
+using Viper.Models;
+using Viper.Models.VIPER;
+using Web.Authorization;
+
+namespace Viper.Areas.CMS.Controllers
+{
+    /// <summary>
+    /// File management API (list/upload/edit/delete/restore/audit). Downloads are served by
+    /// the existing permission-checked CMSController (/CMS/Files), which legacy URLs point at.
+    /// </summary>
+    [Route("/api/cms/files")]
+    [Permission(Allow = CmsPermissions.AllFiles)]
+    public class CMSFilesController : ApiController
+    {
+        private const long MaxUploadBytes = 100_000_000;
+
+        private readonly ICmsFileService _fileService;
+        private readonly ICmsFileStorageService _storage;
+        private readonly ICmsFileAuditService _auditService;
+        private readonly ICmsFileImportService _importService;
+        private readonly RAPSContext _rapsContext;
+        private readonly ILogger<CMSFilesController> _logger;
+        private readonly IUserHelper _userHelper;
+
+        public CMSFilesController(ICmsFileService fileService, ICmsFileStorageService storage,
+            ICmsFileAuditService auditService, ICmsFileImportService importService, RAPSContext rapsContext,
+            ILogger<CMSFilesController> logger, IUserHelper userHelper)
+        {
+            _fileService = fileService;
+            _storage = storage;
+            _auditService = auditService;
+            _importService = importService;
+            _rapsContext = rapsContext;
+            _logger = logger;
+            _userHelper = userHelper;
+        }
+
+        // GET /api/cms/files
+        [HttpGet]
+        [ApiPagination(DefaultPerPage = 50, MaxPerPage = 500)]
+        public async Task<ActionResult<List<CmsFileDto>>> GetFiles(
+            string? folder,
+            string? search,
+            bool? encrypted,
+            bool? isPublic,
+            ApiPagination? pagination,
+            string status = "active",
+            string? sortBy = "friendlyName",
+            bool descending = false,
+            CancellationToken ct = default)
+        {
+            var page = pagination?.Page ?? 1;
+            var perPage = pagination?.PerPage ?? 50;
+            var (files, total) = await _fileService.GetFilesAsync(folder, status, search, encrypted, isPublic,
+                page, perPage, sortBy, descending, OwnerRestriction(), ct);
+            if (pagination != null)
+            {
+                pagination.TotalRecords = total;
+            }
+            return files;
+        }
+
+        // GET /api/cms/files/folders
+        // includeData=true unions in folders that exist only on file records (for
+        // filtering); the default disk-backed list is the upload destination allow-list.
+        [HttpGet("folders")]
+        public async Task<ActionResult<List<string>>> GetFolders(bool includeData = false, CancellationToken ct = default)
+        {
+            return includeData ? await _storage.GetFilterFoldersAsync(ct) : _storage.GetTopLevelFolders();
+        }
+
+        // GET /api/cms/files/folder-counts
+        // File counts per top-level folder for filter dropdowns; same status/encrypted/isPublic
+        // semantics as the list endpoint.
+        [HttpGet("folder-counts")]
+        public async Task<ActionResult<List<CmsFolderCountDto>>> GetFolderCounts(
+            bool? encrypted, bool? isPublic, string status = "active", CancellationToken ct = default)
+        {
+            return await _fileService.GetFolderCountsAsync(status, encrypted, isPublic, OwnerRestriction(), ct);
+        }
+
+        // GET /api/cms/files/audit
+        [HttpGet("audit")]
+        [ApiPagination(DefaultPerPage = 50, MaxPerPage = 500)]
+        public async Task<ActionResult<List<FileAudit>>> GetAudit(
+            Guid? fileGuid,
+            string? action,
+            string? loginId,
+            DateTime? from,
+            DateTime? to,
+            string? search,
+            ApiPagination? pagination,
+            CancellationToken ct = default)
+        {
+            var filter = new CmsFileAuditFilter
+            {
+                FileGuid = fileGuid,
+                Action = action,
+                LoginId = loginId,
+                From = from,
+                To = to,
+                Search = search
+            };
+            var page = pagination?.Page ?? 1;
+            var perPage = pagination?.PerPage ?? 50;
+            var entries = await _auditService.GetAuditEntriesAsync(filter, page, perPage, ct);
+            if (pagination != null)
+            {
+                pagination.TotalRecords = await _auditService.GetAuditEntryCountAsync(filter, ct);
+            }
+            return entries;
+        }
+
+        // GET /api/cms/files/{fileGuid}
+        [HttpGet("{fileGuid:guid}")]
+        public async Task<ActionResult<CmsFileDto>> GetFile(Guid fileGuid, CancellationToken ct = default)
+        {
+            var file = await _fileService.GetFileAsync(fileGuid, ct);
+            if (file == null)
+            {
+                return NotFound();
+            }
+            return file;
+        }
+
+        // GET /api/cms/files/check-name — pre-upload conflict check for a folder + file name
+        [HttpGet("check-name")]
+        public async Task<ActionResult<CmsFileNameCheckDto>> CheckName(string folder, string fileName,
+            CancellationToken ct = default)
+        {
+            try
+            {
+                return await _fileService.CheckNameAsync(folder, fileName, ct);
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // POST /api/cms/files
+        [HttpPost]
+        [RequestSizeLimit(MaxUploadBytes)]
+        [RequestFormLimits(MultipartBodyLengthLimit = MaxUploadBytes)]
+        public async Task<ActionResult<CmsFileDto>> UploadFile([FromForm] CmsFileCreateRequest request, IFormFile? file,
+            CancellationToken ct = default)
+        {
+            if (file == null || file.Length == 0)
+            {
+                return BadRequest("A file is required.");
+            }
+
+            try
+            {
+                return await _fileService.CreateFileAsync(request, file, ct);
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+            catch (InvalidOperationException ex)
+            {
+                LogFileConflict(nameof(UploadFile), request.Folder, file.FileName, ex);
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // PUT /api/cms/files/{fileGuid}
+        [HttpPut("{fileGuid:guid}")]
+        [RequestSizeLimit(MaxUploadBytes)]
+        [RequestFormLimits(MultipartBodyLengthLimit = MaxUploadBytes)]
+        public async Task<ActionResult<CmsFileDto>> UpdateFile(Guid fileGuid, [FromForm] CmsFileUpdateRequest request,
+            IFormFile? file, CancellationToken ct = default)
+        {
+            try
+            {
+                var updated = await _fileService.UpdateFileAsync(fileGuid, request, file, ct);
+                if (updated == null)
+                {
+                    return NotFound();
+                }
+                return updated;
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+            catch (InvalidOperationException ex)
+            {
+                LogFileConflict(nameof(UpdateFile), null, file?.FileName, ex);
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // DELETE /api/cms/files/{fileGuid}?permanent=true|false
+        [HttpDelete("{fileGuid:guid}")]
+        public async Task<IActionResult> DeleteFile(Guid fileGuid, bool permanent = false, CancellationToken ct = default)
+        {
+            if (permanent)
+            {
+                // Hard delete is restricted to admins; soft delete is available to all file managers.
+                if (!IsCmsAdmin())
+                {
+                    return ForbidApi();
+                }
+                return await _fileService.PermanentlyDeleteFileAsync(fileGuid, ct) ? NoContent() : NotFound();
+            }
+            return await _fileService.SoftDeleteFileAsync(fileGuid, ct) ? NoContent() : NotFound();
+        }
+
+        // POST /api/cms/files/{fileGuid}/restore
+        [HttpPost("{fileGuid:guid}/restore")]
+        public async Task<IActionResult> RestoreFile(Guid fileGuid, CancellationToken ct = default)
+        {
+            if (!IsCmsAdmin())
+            {
+                // Non-admins may only restore files they trashed themselves.
+                var file = await _fileService.GetFileAsync(fileGuid, ct);
+                var login = _userHelper.GetCurrentUser()?.LoginId;
+                if (file?.DeletedOn == null || login == null
+                    || !string.Equals(file.ModifiedBy, login, StringComparison.OrdinalIgnoreCase))
+                {
+                    return ForbidApi();
+                }
+            }
+            return await _fileService.RestoreFileAsync(fileGuid, ct) ? NoContent() : NotFound();
+        }
+
+        private bool IsCmsAdmin() =>
+            _userHelper.HasPermission(_rapsContext, _userHelper.GetCurrentUser(), CmsPermissions.Admin);
+
+        // Scopes trash queries: admins see the whole trash (null); everyone else only the files they
+        // deleted (matched by ModifiedBy), so nothing leaks across users but people can recover their own.
+        // A missing user context fails closed (empty string matches no ModifiedBy) rather than falling
+        // through to the admin-level unrestricted view.
+        private string? OwnerRestriction()
+        {
+            var user = _userHelper.GetCurrentUser();
+            if (user == null)
+            {
+                return string.Empty;
+            }
+            return IsCmsAdmin() ? null : user.LoginId;
+        }
+
+        // POST /api/cms/files/import — move files from the legacy VIPER webroot into the store
+        [HttpPost("import")]
+        public async Task<ActionResult<List<CmsFileImportResult>>> ImportFiles(CmsFileImportRequest request,
+            CancellationToken ct = default)
+        {
+            if (request.FilePaths.Count == 0)
+            {
+                return BadRequest("At least one file path is required.");
+            }
+
+            try
+            {
+                return await _importService.ImportFilesAsync(request, ct);
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+            catch (InvalidOperationException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // POST /api/cms/files/import/preview — dry-run validation of an import request
+        [HttpPost("import/preview")]
+        public async Task<ActionResult<List<CmsFileImportPreviewResult>>> PreviewImport(CmsFileImportRequest request,
+            CancellationToken ct = default)
+        {
+            if (request.FilePaths.Count == 0)
+            {
+                return BadRequest("At least one file path is required.");
+            }
+
+            try
+            {
+                return await _importService.PreviewImportAsync(request, ct);
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+            catch (InvalidOperationException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // POST /api/cms/files/bulk-encrypt
+        [HttpPost("bulk-encrypt")]
+        public async Task<ActionResult<List<CmsBulkEncryptResult>>> BulkEncrypt(List<Guid> fileGuids,
+            CancellationToken ct = default)
+        {
+            if (fileGuids.Count == 0)
+            {
+                return BadRequest("At least one file is required.");
+            }
+            return await _importService.BulkEncryptAsync(fileGuids, ct);
+        }
+
+        private void LogFileConflict(string operation, string? folder, string? fileName, Exception ex)
+        {
+            _logger.LogWarning(ex, "CMS file {Operation} conflict folder={Folder} fileName={FileName}",
+                LogSanitizer.SanitizeString(operation),
+                LogSanitizer.SanitizeString(folder),
+                LogSanitizer.SanitizeString(fileName));
+        }
+    }
+}
diff --git a/web/Areas/CMS/Controllers/CMSLeftNavController.cs b/web/Areas/CMS/Controllers/CMSLeftNavController.cs
new file mode 100644
index 000000000..f57e5ac8f
--- /dev/null
+++ b/web/Areas/CMS/Controllers/CMSLeftNavController.cs
@@ -0,0 +1,113 @@
+using Microsoft.AspNetCore.Mvc;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Areas.CMS.Services;
+using Viper.Classes;
+using Web.Authorization;
+
+namespace Viper.Areas.CMS.Controllers
+{
+    /// <summary>
+    /// Left navigation menu management. Display of menus to end users goes through
+    /// LayoutController / Data.LeftNavMenu, which filters items by user permission.
+    /// </summary>
+    [Route("/api/cms/left-navs")]
+    [Permission(Allow = CmsPermissions.ManageNavigation)]
+    public class CMSLeftNavController : ApiController
+    {
+        private readonly ICmsLeftNavService _leftNavService;
+
+        public CMSLeftNavController(ICmsLeftNavService leftNavService)
+        {
+            _leftNavService = leftNavService;
+        }
+
+        // GET /api/cms/left-navs
+        [HttpGet]
+        public async Task<ActionResult<List<LeftNavMenuDto>>> GetMenus(
+            string? system, string? viperSectionPath, string? search, CancellationToken ct = default)
+        {
+            return await _leftNavService.GetMenusAsync(system, viperSectionPath, search, ct);
+        }
+
+        // GET /api/cms/left-navs/5
+        [HttpGet("{leftNavMenuId:int}")]
+        public async Task<ActionResult<LeftNavMenuDto>> GetMenu(int leftNavMenuId, CancellationToken ct = default)
+        {
+            var menu = await _leftNavService.GetMenuAsync(leftNavMenuId, ct);
+            if (menu == null)
+            {
+                return NotFound();
+            }
+            return menu;
+        }
+
+        // POST /api/cms/left-navs
+        [HttpPost]
+        public async Task<ActionResult<LeftNavMenuDto>> CreateMenu(LeftNavMenuAddEdit menu, CancellationToken ct = default)
+        {
+            try
+            {
+                var created = await _leftNavService.CreateMenuAsync(menu, ct);
+                return CreatedAtAction(nameof(GetMenu), new { leftNavMenuId = created.LeftNavMenuId }, created);
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // PUT /api/cms/left-navs/5
+        [HttpPut("{leftNavMenuId:int}")]
+        public async Task<ActionResult<LeftNavMenuDto>> UpdateMenu(int leftNavMenuId, LeftNavMenuAddEdit menu,
+            CancellationToken ct = default)
+        {
+            try
+            {
+                var updated = await _leftNavService.UpdateMenuAsync(leftNavMenuId, menu, ct);
+                if (updated == null)
+                {
+                    return NotFound();
+                }
+                return updated;
+            }
+            catch (ArgumentException ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        // PUT /api/cms/left-navs/5/items — full item list; order follows the array
+        [HttpPut("{leftNavMenuId:int}/items")]
+        public async Task<ActionResult<LeftNavMenuDto>> SaveItems(int leftNavMenuId, List<LeftNavItemEdit> items,
+            CancellationToken ct = default)
+        {
+            try
+            {
+                var updated = await _leftNavService.SaveItemsAsync(leftNavMenuId, items, ct);
+                if (updated == null)
+                {
+                    return NotFound();
+                }
+                return updated;
+            }
+            catch (ArgumentException ex)
+            {
+                // Malformed request (e.g. duplicate item ids).
+                return BadRequest(ex.Message);
+            }
+            catch (InvalidOperationException ex)
+            {
+                // Stale client: a supplied item id no longer exists in the menu.
+                return Conflict(ex.Message);
+            }
+        }
+
+        // DELETE /api/cms/left-navs/5 — deletes the menu and all items (no soft delete, matching legacy)
+        [HttpDelete("{leftNavMenuId:int}")]
+        public async Task<IActionResult> DeleteMenu(int leftNavMenuId, CancellationToken ct = default)
+        {
+            return await _leftNavService.DeleteMenuAsync(leftNavMenuId, ct) ? NoContent() : NotFound();
+        }
+    }
+}
diff --git a/web/Areas/CMS/Controllers/CMSLinkCollectionController.cs b/web/Areas/CMS/Controllers/CMSLinkCollectionController.cs
index edfb0696c..0dfe939c2 100644
--- a/web/Areas/CMS/Controllers/CMSLinkCollectionController.cs
+++ b/web/Areas/CMS/Controllers/CMSLinkCollectionController.cs
@@ -2,6 +2,7 @@
 using Areas.CMS.Models.DTOs;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Constants;
 using Viper.Classes;
 using Viper.Classes.SQLContext;
 using Web.Authorization;
@@ -31,19 +32,13 @@ public async Task<ActionResult<IEnumerable<LinkCollectionDto>>> GetLinkCollectio
             {
                 LinkCollectionId = lc.LinkCollectionId,
                 LinkCollection = lc.LinkCollectionName,
-                LinkCollectionTagCategories = lc.LinkCollectionTagCategories.Select(tc => new LinkCollectionTagCategoryDto
-                {
-                    LinkCollectionTagCategoryId = tc.LinkCollectionTagCategoryId,
-                    LinkCollectionId = tc.LinkCollectionId,
-                    LinkCollectionTagCategory = tc.LinkCollectionTagCategoryName,
-                    SortOrder = tc.SortOrder
-                }).ToList()
+                LinkCollectionTagCategories = lc.LinkCollectionTagCategories.Select(ToTagCategoryDto).ToList()
             });
 
             return Ok(result);
         }
 
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
         [HttpPost]
         public async Task<ActionResult<LinkCollectionDto>> PostLinkCollection(CreateLinkCollectionDto createDto)
         {
@@ -68,10 +63,10 @@ public async Task<ActionResult<LinkCollectionDto>> PostLinkCollection(CreateLink
                 LinkCollectionTagCategories = new List<LinkCollectionTagCategoryDto>()
             };
 
-            return CreatedAtAction(nameof(linkCollection), new { id = linkCollection.LinkCollectionId }, result);
+            return CreatedAtAction(nameof(GetLinkCollections), new { linkCollectionName = linkCollection.LinkCollectionName }, result);
         }
 
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
         [HttpPut("{id}")]
         public async Task<IActionResult> PutLinkCollection(int id, CreateLinkCollectionDto updateDto)
         {
@@ -94,7 +89,7 @@ public async Task<IActionResult> PutLinkCollection(int id, CreateLinkCollectionD
             return Ok(updateDto);
         }
 
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
         [HttpDelete("{id}")]
         public async Task<IActionResult> DeleteLinkCollection(int id)
         {
@@ -104,6 +99,17 @@ public async Task<IActionResult> DeleteLinkCollection(int id)
                 return NotFound();
             }
 
+            // FK constraints are not ON DELETE CASCADE, so remove dependents before
+            // the collection. Queuing all removals into a single SaveChanges keeps it
+            // atomic. Order: link tags -> links -> tag categories -> collection.
+            var collectionLinkIds = _context.Links
+                .Where(l => l.LinkCollectionId == id)
+                .Select(l => l.LinkId);
+            _context.LinkTags.RemoveRange(
+                _context.LinkTags.Where(lt => collectionLinkIds.Contains(lt.LinkId)));
+            _context.Links.RemoveRange(_context.Links.Where(l => l.LinkCollectionId == id));
+            _context.LinkCollectionTagCategories.RemoveRange(
+                _context.LinkCollectionTagCategories.Where(tc => tc.LinkCollectionId == id));
             _context.LinkCollections.Remove(linkCollection);
             await _context.SaveChangesAsync();
 
@@ -124,28 +130,25 @@ public async Task<ActionResult<IEnumerable<LinkCollectionTagCategoryDto>>> GetLi
                 .OrderBy(lc => lc.SortOrder)
                 .ToListAsync();
 
-            var results = categories
-                .Select(c => new LinkCollectionTagCategoryDto
-                {
-                    LinkCollectionTagCategoryId = c.LinkCollectionTagCategoryId,
-                    LinkCollectionId = c.LinkCollectionId,
-                    LinkCollectionTagCategory = c.LinkCollectionTagCategoryName,
-                    SortOrder = c.SortOrder
-                })
-                .ToList();
+            var results = categories.Select(ToTagCategoryDto).ToList();
 
             return Ok(results);
         }
 
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
         [HttpPost("{collectionId}/tags")]
-        public async Task<ActionResult<CreateLinkCollectionTagCategoryDto>> CreateLinkCollectionTagCategory(int collectionId, CreateLinkCollectionTagCategoryDto createLinkTagCategoryDto)
+        public async Task<ActionResult<LinkCollectionTagCategoryDto>> CreateLinkCollectionTagCategory(int collectionId, CreateLinkCollectionTagCategoryDto createLinkTagCategoryDto)
         {
             if (!await _context.LinkCollections.AnyAsync(lc => lc.LinkCollectionId == collectionId))
             {
                 return NotFound();
             }
 
+            if (createLinkTagCategoryDto.LinkCollectionId != collectionId)
+            {
+                return BadRequest("Collection ID in route does not match the request body.");
+            }
+
             if (await _context.LinkCollectionTagCategories
                 .AnyAsync(tc => tc.LinkCollectionTagCategoryName == createLinkTagCategoryDto.LinkCollectionTagCategory
                     && tc.LinkCollectionId == collectionId))
@@ -161,10 +164,13 @@ public async Task<ActionResult<CreateLinkCollectionTagCategoryDto>> CreateLinkCo
             };
             _context.LinkCollectionTagCategories.Add(tagCategory);
             await _context.SaveChangesAsync();
-            return CreatedAtAction(nameof(tagCategory), new { id = tagCategory.LinkCollectionTagCategoryId }, createLinkTagCategoryDto);
+
+            // Return the saved DTO so the client receives the generated id. The follow-up
+            // tag-order PUT needs that id to address the newly created category.
+            return CreatedAtAction(nameof(GetLinkCollectionTagCategories), new { collectionId }, ToTagCategoryDto(tagCategory));
         }
 
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
         [HttpPut("{collectionId}/tags/order")]
         public async Task<IActionResult> UpdateLinkCollectionTagCategoryOrder(int collectionId, List<UpdateLinkCollectionTagCategoryOrderDto> updateDto)
         {
@@ -184,7 +190,11 @@ public async Task<IActionResult> UpdateLinkCollectionTagCategoryOrder(int collec
 
             foreach (var dto in updateDto)
             {
-                var tagCategory = tagCategories.First(tc => tc.LinkCollectionTagCategoryId == dto.LinkCollectionTagCategoryId);
+                var tagCategory = tagCategories.FirstOrDefault(tc => tc.LinkCollectionTagCategoryId == dto.LinkCollectionTagCategoryId);
+                if (tagCategory == null)
+                {
+                    return BadRequest($"Tag category with ID {dto.LinkCollectionTagCategoryId} not found in this collection.");
+                }
                 tagCategory.SortOrder = dto.SortOrder;
             }
 
@@ -192,7 +202,7 @@ public async Task<IActionResult> UpdateLinkCollectionTagCategoryOrder(int collec
             return NoContent();
         }
 
-        [Permission(Allow = "SVMSecure.CMS.ManageContentBlocks")]
+        [Permission(Allow = CmsPermissions.ManageContentBlocks)]
         [HttpDelete("{collectionId}/tags/{tagCategoryId}")]
         public async Task<IActionResult> DeleteLinkCollectionTagCategory(int collectionId, int tagCategoryId)
         {
@@ -210,5 +220,13 @@ public async Task<IActionResult> DeleteLinkCollectionTagCategory(int collectionI
             await _context.SaveChangesAsync();
             return NoContent();
         }
+
+        private static LinkCollectionTagCategoryDto ToTagCategoryDto(LinkCollectionTagCategory tagCategory) => new()
+        {
+            LinkCollectionTagCategoryId = tagCategory.LinkCollectionTagCategoryId,
+            LinkCollectionId = tagCategory.LinkCollectionId,
+            LinkCollectionTagCategory = tagCategory.LinkCollectionTagCategoryName,
+            SortOrder = tagCategory.SortOrder
+        };
     }
 }
diff --git a/web/Areas/CMS/Controllers/CMSLinkCollectionLinks.cs b/web/Areas/CMS/Controllers/CMSLinkCollectionLinks.cs
index f4ec728e9..f7d6987a4 100644
--- a/web/Areas/CMS/Controllers/CMSLinkCollectionLinks.cs
+++ b/web/Areas/CMS/Controllers/CMSLinkCollectionLinks.cs
@@ -117,7 +117,7 @@ public async Task<ActionResult<LinkDto>> PostLink(int collectionId, CreateLinkDt
             _context.Links.Add(link);
             await _context.SaveChangesAsync();
 
-            return CreatedAtAction(nameof(link), new { id = link.LinkId }, new LinkDto
+            return CreatedAtAction(nameof(GetLinks), new { collectionId }, new LinkDto
             {
                 LinkId = link.LinkId,
                 LinkCollectionId = link.LinkCollectionId,
diff --git a/web/Areas/CMS/Controllers/CMSOptionsController.cs b/web/Areas/CMS/Controllers/CMSOptionsController.cs
new file mode 100644
index 000000000..cc6d9d342
--- /dev/null
+++ b/web/Areas/CMS/Controllers/CMSOptionsController.cs
@@ -0,0 +1,84 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.RAPS.Services;
+using Viper.Classes;
+using Viper.Classes.SQLContext;
+using Web.Authorization;
+
+namespace Viper.Areas.CMS.Controllers
+{
+    /// <summary>
+    /// Option lists for CMS management forms (permission and person selectors). The RAPS
+    /// permissions API requires RAPS roles + 2FA, which CMS content managers don't have,
+    /// so the CMS exposes its own read-only lists gated by the CMS manage permissions.
+    /// </summary>
+    [Route("/api/cms/options")]
+    [Permission(Allow = CmsPermissions.AllFiles + "," + CmsPermissions.ManageContentBlocks + "," + CmsPermissions.ManageNavigation)]
+    public class CMSOptionsController : ApiController
+    {
+        private readonly RAPSContext _rapsContext;
+        private readonly AAUDContext _aaudContext;
+
+        public CMSOptionsController(RAPSContext rapsContext, AAUDContext aaudContext)
+        {
+            _rapsContext = rapsContext;
+            _aaudContext = aaudContext;
+        }
+
+        /// <summary>
+        /// All VIPER-instance permission names, for tagging files/blocks/nav items with
+        /// required permissions (matches the legacy CMS permission multi-select).
+        /// </summary>
+        [HttpGet("permissions")]
+        public async Task<ActionResult<List<string>>> GetPermissions(CancellationToken ct = default)
+        {
+            return await _rapsContext.TblPermissions
+                .AsNoTracking()
+                .Where(RAPSSecurityService.FilterPermissionsToInstance("VIPER"))
+                .OrderBy(p => p.Permission)
+                .Select(p => p.Permission)
+                .ToListAsync(ct);
+        }
+
+        /// <summary>
+        /// Search current people by name, login id, or mail id for person-level file access.
+        /// </summary>
+        [HttpGet("people")]
+        public async Task<ActionResult<List<CmsPersonOption>>> SearchPeople(string search, CancellationToken ct = default)
+        {
+            if (string.IsNullOrWhiteSpace(search) || search.Trim().Length < 2)
+            {
+                return new List<CmsPersonOption>();
+            }
+            search = search.Trim();
+
+            return await _aaudContext.AaudUsers
+                .AsNoTracking()
+                .Where(u => u.Current != 0 && u.IamId != null)
+                .Where(u => (u.DisplayLastName + ", " + u.DisplayFirstName).Contains(search)
+                    || (u.DisplayFirstName + " " + u.DisplayLastName).Contains(search)
+                    || (u.LoginId != null && u.LoginId.Contains(search))
+                    || (u.MailId != null && u.MailId.Contains(search)))
+                .OrderBy(u => u.DisplayLastName)
+                .ThenBy(u => u.DisplayFirstName)
+                .Take(25)
+                .Select(u => new CmsPersonOption
+                {
+                    IamId = u.IamId!,
+                    Name = u.DisplayLastName + ", " + u.DisplayFirstName,
+                    LoginId = u.LoginId,
+                    MailId = u.MailId
+                })
+                .ToListAsync(ct);
+        }
+    }
+
+    public class CmsPersonOption
+    {
+        public string IamId { get; set; } = string.Empty;
+        public string Name { get; set; } = string.Empty;
+        public string? LoginId { get; set; }
+        public string? MailId { get; set; }
+    }
+}
diff --git a/web/Areas/CMS/Controllers/CMSUserPhotoController.cs b/web/Areas/CMS/Controllers/CMSUserPhotoController.cs
new file mode 100644
index 000000000..c299e1d1e
--- /dev/null
+++ b/web/Areas/CMS/Controllers/CMSUserPhotoController.cs
@@ -0,0 +1,57 @@
+using Microsoft.AspNetCore.Mvc;
+using Viper.Areas.CMS.Services;
+using Viper.Classes;
+using Web.Authorization;
+
+namespace Viper.Areas.CMS.Controllers
+{
+    /// <summary>
+    /// User photos for authenticated VIPER pages (legacy userPhoto.cfc). Photos are visible
+    /// to any logged-in user, matching legacy behavior; gallery-style browsing with its own
+    /// permissions lives in the Students area.
+    /// </summary>
+    [Route("/api/cms/photos")]
+    [Permission(Allow = "SVMSecure")]
+    public class CMSUserPhotoController : ApiController
+    {
+        private const int CacheSeconds = 3600;
+
+        private readonly ICmsUserPhotoService _photoService;
+
+        public CMSUserPhotoController(ICmsUserPhotoService photoService)
+        {
+            _photoService = photoService;
+        }
+
+        // GET /api/cms/photos/by-mail/{mailId}?altPhoto=true|false
+        [HttpGet("by-mail/{mailId}")]
+        public async Task<IActionResult> GetByMailId(string mailId, bool altPhoto = false, CancellationToken ct = default)
+        {
+            return await ServePhoto(mailId: mailId, loginId: null, iamId: null, altPhoto, ct);
+        }
+
+        // GET /api/cms/photos/by-login/{loginId}?altPhoto=true|false
+        [HttpGet("by-login/{loginId}")]
+        public async Task<IActionResult> GetByLoginId(string loginId, bool altPhoto = false, CancellationToken ct = default)
+        {
+            return await ServePhoto(mailId: null, loginId: loginId, iamId: null, altPhoto, ct);
+        }
+
+        // GET /api/cms/photos/by-iam/{iamId}?altPhoto=true|false
+        [HttpGet("by-iam/{iamId}")]
+        public async Task<IActionResult> GetByIamId(string iamId, bool altPhoto = false, CancellationToken ct = default)
+        {
+            return await ServePhoto(mailId: null, loginId: null, iamId: iamId, altPhoto, ct);
+        }
+
+        private async Task<IActionResult> ServePhoto(string? mailId, string? loginId, string? iamId,
+            bool altPhoto, CancellationToken ct)
+        {
+            var photo = await _photoService.GetUserPhotoAsync(mailId, loginId, iamId, altPhoto, ct);
+            // Photos change rarely; let browsers cache for an hour (legacy used short-lived
+            // cache headers with long stale-while-revalidate).
+            Response.Headers.CacheControl = $"private, max-age={CacheSeconds}";
+            return File(photo, "image/jpeg");
+        }
+    }
+}
diff --git a/web/Areas/CMS/Data/CMS.cs b/web/Areas/CMS/Data/CMS.cs
index 1cf19d991..798fbd7d1 100644
--- a/web/Areas/CMS/Data/CMS.cs
+++ b/web/Areas/CMS/Data/CMS.cs
@@ -1,8 +1,6 @@
 using System.IO.Compression;
 using System.Net;
-using System.Security.Cryptography;
 using System.Text.Json;
-using Microsoft.AspNetCore.Http.Extensions;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Net.Http.Headers;
@@ -27,35 +25,8 @@ public class CMS : ICMS
 
         public IUserHelper UserHelper { get; set; }
 
-        public Dictionary<string, string> MimeTypes { get; set; } = new()
-        {
-            ["pdf"] = "application/pdf",
-            ["docx"] = "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-            ["doc"] = "application/msword",
-            ["xls"] = "application/vnd.ms-excel",
-            ["xlsx"] = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-            ["csv"] = "text/csv",
-            ["ppt"] = "application/vnd.ms-powerpoint",
-            ["pptx"] = "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-            ["pptm"] = "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
-            ["txt"] = "text/plain",
-            ["html"] = "application/xhtml+xml",
-            ["gif"] = "image/gif",
-            ["png"] = "image/png",
-            ["jpg"] = "image/jpeg",
-            ["jpeg"] = "image/jpeg",
-            ["tiff"] = "image/tiff",
-            ["mp3"] = "audio/mpeg",
-            ["wav"] = "audio/wav",
-            ["mp4"] = "video/mp4",
-            ["webm"] = "video/webm",
-            ["oft"] = "application/vnd.ms-outlook",
-            ["eps"] = "application/postscript",
-            ["zip"] = "application/zip",
-            ["7z"] = "application/x-7z-compressed",
-            ["dmg"] = "application/x-apple-diskimage",
-            ["exe"] = "application/vnd.microsoft.portable-executable"
-        };
+        public Dictionary<string, string> MimeTypes { get; set; } =
+            new(Constants.CmsFileTypes.MimeTypes, StringComparer.OrdinalIgnoreCase);
 
         #endregion
 
@@ -306,20 +277,24 @@ public IEnumerable<CMSFile> GetAllFiles(string? folder, bool? isPublic, string?
 
         #region public static string GetFriendlyURL(string friendlyName, bool allowPublicAccess = false)
         /// <summary>
-        /// Get Friendly URL for a friendly name. Currently, always points to ColdFusion Viper
+        /// Get Friendly URL for a friendly name. Points to the VIPER 2 download handler
+        /// (CMSController.Files), which checks permissions internally and serves public
+        /// files anonymously, so no separate /public URL shape is needed.
         /// </summary>
         public static string GetFriendlyURL(string friendlyName, bool allowPublicAccess = false)
         {
             string rootURL = String.Empty;
+            string pathBase = String.Empty;
             HttpRequest? thisRequest = HttpHelper.HttpContext?.Request;
 
             if (thisRequest != null)
             {
-                Uri url = new(thisRequest.GetDisplayUrl());
-                rootURL = url.Scheme + Uri.SchemeDelimiter + url.Host;
+                // Request.Host keeps any non-default port (url.Host would drop it)
+                rootURL = thisRequest.Scheme + Uri.SchemeDelimiter + thisRequest.Host;
+                pathBase = thisRequest.PathBase;
             }
 
-            return rootURL + (allowPublicAccess ? @"/public" : "") + @"/cms/files/?fn=" + WebUtility.UrlEncode(friendlyName);
+            return rootURL + pathBase + @"/CMS/Files?fn=" + WebUtility.UrlEncode(friendlyName);
         }
         #endregion
 
@@ -329,7 +304,8 @@ public static string GetFriendlyURL(string friendlyName, bool allowPublicAccess
         /// </summary>
         public static string GetURL(string fileGUID, bool allowPublicAccess = false)
         {
-            return (allowPublicAccess ? @"/public" : "") + @"/cms/files/?id=" + fileGUID;
+            string pathBase = HttpHelper.HttpContext?.Request.PathBase ?? String.Empty;
+            return pathBase + @"/CMS/Files?id=" + fileGUID;
         }
         #endregion
 
@@ -496,6 +472,9 @@ public IActionResult DownloadZip(Controller controller, string[] fileGUIDs, stri
                 }
 
                 byte[] bytes = System.IO.File.ReadAllBytes(tempFileName);
+                // The zip itself is inert, but keep the whole /CMS/Files surface consistent:
+                // no MIME sniffing on any download response.
+                CmsFileResponse.SetNoSniff(controller.Response);
                 return controller.File(bytes, MimeTypes["zip"], safeDownloadName);
             }
             finally
@@ -577,11 +556,15 @@ public IActionResult ProvideFile(Controller controller, string id, string friend
                 contentType = "application/octet-stream";
             }
 
+            // Stop the browser from MIME-sniffing a benign type into an active one.
+            CmsFileResponse.SetNoSniff(controller.Response);
+
             // Build Content-Disposition from the stored record's name, not the user-supplied
             // friendlyName param, and let the framework encode it so a hostile fn cannot shape
-            // the header. Mirrors the DownloadZip download-name hardening.
+            // the header. Mirrors the DownloadZip download-name hardening. Inline-unsafe types
+            // (html/svg) are forced to download so an uploaded page cannot run in the app origin.
             var downloadName = CmsFilePathSafety.SanitizeZipEntryName(file.FriendlyName, file.FilePath);
-            var contentDisposition = new ContentDispositionHeaderValue("inline");
+            var contentDisposition = new ContentDispositionHeaderValue(CmsFileResponse.DispositionType(file.FilePath));
             contentDisposition.SetHttpFileName(downloadName);
             controller.Response.Headers.ContentDisposition = contentDisposition.ToString();
 
@@ -664,81 +647,19 @@ public static void AuditFileAccess(VIPERContext viperContext, CMSFile file, Aaud
         #region public byte[] DecryptFile(byte[] encryptedData, string keystring)
         public byte[] DecryptFile(byte[] encryptedData, string keystring)
         {
-            byte[] secretkey = GetSecretKey(keystring);
-
-            using Aes aes = Aes.Create();
-            aes.Mode = CipherMode.ECB;
-
-            using var ms = new MemoryStream();
-            using (var cs = new CryptoStream(ms, aes.CreateDecryptor(secretkey, null), CryptoStreamMode.Write))
-            {
-                cs.Write(encryptedData, 0, encryptedData.Length);
-            }
-            byte[] decryptedData = ms.ToArray();
-
-            return decryptedData;
-
+            string masterKey = CmsFileCrypto.ReadMasterKey(CmsFileCrypto.GetDefaultKeyFilePath());
+            return CmsFileCrypto.DecryptBytes(encryptedData, CmsFileCrypto.DecryptDbKey(keystring, masterKey));
         }
         #endregion
 
         #region public string DecryptAES(string encryptedString, string Key)
         /// <summary>
-        /// Required for Unix decoding FROM https://rextester.com/TGN19503
+        /// Decrypt a CF-format (UU-encoded AES-ECB) string with the given base64 key.
         /// </summary>
         /// <returns>decoded string</returns>
         public string DecryptAES(string encryptedString, string Key)
         {
-            //First write to memory
-            using MemoryStream mmsStream = new();
-            using StreamWriter srwTemp = new(mmsStream);
-            srwTemp.Write(encryptedString);
-            srwTemp.Flush();
-            mmsStream.Position = 0;
-
-            using MemoryStream outstream = new();
-
-            //CallingUUDecode
-            Codecs.UUDecode(mmsStream, outstream);
-
-            //Extract the bytes of each of the values
-            byte[] input = outstream.ToArray();
-            byte[] key = Convert.FromBase64String(Key);
-
-            string? decryptedText = null;
-
-            using (Aes aes = Aes.Create())
-            {
-                // initialize settings to match those used by CF
-                aes.Mode = CipherMode.ECB;
-                aes.Padding = PaddingMode.PKCS7;
-                aes.BlockSize = 128;
-                aes.KeySize = 128;
-                aes.Key = key;
-
-                ICryptoTransform decryptor = aes.CreateDecryptor();
-
-                using MemoryStream msDecrypt = new(input);
-                using CryptoStream csDecrypt = new(msDecrypt, decryptor, CryptoStreamMode.Read);
-                using StreamReader srDecrypt = new(csDecrypt);
-                decryptedText = srDecrypt.ReadToEnd();
-            }
-            return decryptedText;
-        }
-        #endregion
-
-        #region private byte[] getSecretKey(string key)
-        private byte[] GetSecretKey(string key)
-        {
-            string keyFileFolder = @"S:\Settings\";
-
-            if (HttpHelper.Environment?.EnvironmentName == "Development")
-            {
-                keyFileFolder = @"C:\Sites\Settings\";
-            }
-            string keyString = System.IO.File.ReadLines(keyFileFolder + "viperfiles.txt").Skip(1).Take(1).First();
-
-            byte[] hiddenKey = Convert.FromBase64String(DecryptAES(key, keyString));
-            return hiddenKey;
+            return CmsFileCrypto.DecryptDbKey(encryptedString, Key);
         }
         #endregion
 
diff --git a/web/Areas/CMS/Data/LeftNavMenu.cs b/web/Areas/CMS/Data/LeftNavMenu.cs
index 6f9d83387..5381c6d3f 100644
--- a/web/Areas/CMS/Data/LeftNavMenu.cs
+++ b/web/Areas/CMS/Data/LeftNavMenu.cs
@@ -8,14 +8,13 @@ public class LeftNavMenu
     {
         private readonly VIPERContext? _viperContext;
         private readonly RAPSContext? _rapsContext;
+        private readonly IUserHelper _userHelper;
 
-        public IUserHelper UserHelper { get; private set; }
-
-        public LeftNavMenu(VIPERContext viperContext, RAPSContext rapsContext)
+        public LeftNavMenu(VIPERContext viperContext, RAPSContext rapsContext, IUserHelper? userHelper = null)
         {
             this._viperContext = viperContext;
             this._rapsContext = rapsContext;
-            UserHelper = new UserHelper();
+            _userHelper = userHelper ?? new UserHelper();
         }
 
         /// <summary>
@@ -46,14 +45,16 @@ public LeftNavMenu(VIPERContext viperContext, RAPSContext rapsContext)
                 return null;
             }
 
-            var currentUser = UserHelper.GetCurrentUser();
+            var currentUser = _userHelper.GetCurrentUser();
             List<NavMenu> cmsMenus = new();
             foreach (var m in menus)
             {
-                //by default, filter items based on user permissions
+                //by default, filter items based on user permissions; items with no
+                //permissions are visible to any logged-in user (legacy CMS behavior)
                 List<NavMenuItem> items = m.LeftNavItems
                     .Where(item => !filterItemsByPermissions
-                        || item.LeftNavItemToPermissions.Any(p => UserHelper.HasPermission(_rapsContext, currentUser, p.Permission)))
+                        || item.LeftNavItemToPermissions.Count == 0
+                        || item.LeftNavItemToPermissions.Any(p => _userHelper.HasPermission(_rapsContext, currentUser, p.Permission)))
                     .Select(item => new NavMenuItem(item))
                     .ToList();
                 cmsMenus.Add(new(m.MenuHeaderText, items));
diff --git a/web/Areas/CMS/Jobs/CmsTrashPurgeScheduledJob.cs b/web/Areas/CMS/Jobs/CmsTrashPurgeScheduledJob.cs
new file mode 100644
index 000000000..64fc4084c
--- /dev/null
+++ b/web/Areas/CMS/Jobs/CmsTrashPurgeScheduledJob.cs
@@ -0,0 +1,51 @@
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Services;
+using Viper.Areas.Scheduler.Models;
+using Viper.Areas.Scheduler.Services;
+
+namespace Viper.Areas.CMS.Jobs
+{
+    /// <summary>
+    /// Daily purge of the CMS file trash: permanently deletes files that were soft-deleted more than
+    /// <see cref="CmsTrash.RetentionDays"/> days ago (record + disk), restoring the legacy 30-day
+    /// retention routine that VIPER 1 ran but the migration hadn't yet reimplemented.
+    ///
+    /// Gated by <see cref="CmsTrash.PurgeEnabledConfigKey"/> (default false): the job stays
+    /// registered and fires on cron, but no-ops until an environment opts in via config. That lets
+    /// it ship disabled and be enabled only once the legacy VIPER 1 purge is retired, without a
+    /// dashboard change that the next app restart would silently undo.
+    /// </summary>
+    [ScheduledJob(id: "cms:trash-purge", cron: "0 3 * * *")]
+    public sealed class CmsTrashPurgeScheduledJob : IScheduledJob
+    {
+        private readonly ICmsFileService _fileService;
+        private readonly IConfiguration _configuration;
+        private readonly ILogger<CmsTrashPurgeScheduledJob> _logger;
+
+        public CmsTrashPurgeScheduledJob(ICmsFileService fileService, IConfiguration configuration,
+            ILogger<CmsTrashPurgeScheduledJob> logger)
+        {
+            _fileService = fileService;
+            _configuration = configuration;
+            _logger = logger;
+        }
+
+        public async Task RunAsync(ScheduledJobContext context, CancellationToken ct)
+        {
+            if (!_configuration.GetValue<bool>(CmsTrash.PurgeEnabledConfigKey))
+            {
+                context.WriteLine(
+                    $"CMS trash purge is disabled ({CmsTrash.PurgeEnabledConfigKey} is not true); skipping.");
+                _logger.LogInformation(
+                    "CMS trash purge skipped: {ConfigKey} is not enabled", CmsTrash.PurgeEnabledConfigKey);
+                return;
+            }
+
+            context.WriteLine($"CMS trash purge starting (retention={CmsTrash.RetentionDays}d, modBy={context.ModBy})");
+            var purged = await _fileService.PurgeDeletedFilesAsync(CmsTrash.RetentionDays, ct);
+            context.WriteLine($"Purged {purged} trashed file(s) older than {CmsTrash.RetentionDays} days.");
+            _logger.LogInformation(
+                "CMS trash purge removed {Count} file(s) older than {Days} days", purged, CmsTrash.RetentionDays);
+        }
+    }
+}
diff --git a/web/Areas/CMS/Models/CMSBlockAddEdit.cs b/web/Areas/CMS/Models/CMSBlockAddEdit.cs
index c1ba7dafe..fa9bac352 100644
--- a/web/Areas/CMS/Models/CMSBlockAddEdit.cs
+++ b/web/Areas/CMS/Models/CMSBlockAddEdit.cs
@@ -23,5 +23,13 @@ public class CMSBlockAddEdit
         public required bool AllowPublicAccess { get; set; }
 
         public ICollection<string> Permissions { get; set; } = new List<string>();
+
+        public List<Guid> FileGuids { get; set; } = new();
+
+        /// <summary>
+        /// ModifiedOn value the client loaded; updates with a stale value get 409 Conflict.
+        /// Required for updates (null gets 400); ignored on create.
+        /// </summary>
+        public DateTime? LastModifiedOn { get; set; }
     }
 }
diff --git a/web/Areas/CMS/Models/CmsContentBlockMapper.cs b/web/Areas/CMS/Models/CmsContentBlockMapper.cs
new file mode 100644
index 000000000..9a8fa5a61
--- /dev/null
+++ b/web/Areas/CMS/Models/CmsContentBlockMapper.cs
@@ -0,0 +1,30 @@
+using Riok.Mapperly.Abstractions;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Models.VIPER;
+
+namespace Viper.Areas.CMS.Models
+{
+    [Mapper(RequiredMappingStrategy = RequiredMappingStrategy.None)]
+    public static partial class CmsContentBlockMapper
+    {
+        public static ContentBlockDto ToDto(ContentBlock block)
+        {
+            var dto = ToDtoBase(block);
+            dto.Permissions = block.ContentBlockToPermissions.Select(p => p.Permission).OrderBy(p => p).ToList();
+            dto.Files = block.ContentBlockToFiles
+                .Select(f => new ContentBlockFileDto
+                {
+                    FileGuid = f.FileGuid,
+                    FriendlyName = f.File.FriendlyName,
+                    Url = Data.CMS.GetFriendlyURL(f.File.FriendlyName, f.File.AllowPublicAccess)
+                })
+                .OrderBy(f => f.FriendlyName)
+                .ToList();
+            return dto;
+        }
+
+        [MapperIgnoreTarget(nameof(ContentBlockDto.Permissions))]
+        [MapperIgnoreTarget(nameof(ContentBlockDto.Files))]
+        private static partial ContentBlockDto ToDtoBase(ContentBlock block);
+    }
+}
diff --git a/web/Areas/CMS/Models/CmsFileMapper.cs b/web/Areas/CMS/Models/CmsFileMapper.cs
new file mode 100644
index 000000000..48744b71b
--- /dev/null
+++ b/web/Areas/CMS/Models/CmsFileMapper.cs
@@ -0,0 +1,43 @@
+using Riok.Mapperly.Abstractions;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Models.DTOs;
+using File = Viper.Models.VIPER.File;
+
+namespace Viper.Areas.CMS.Models
+{
+    [Mapper(RequiredMappingStrategy = RequiredMappingStrategy.None)]
+    public static partial class CmsFileMapper
+    {
+        /// <summary>
+        /// Map a file entity to its DTO; permission/person collections and computed URLs are
+        /// filled in here rather than by the generated mapping.
+        /// </summary>
+        public static CmsFileDto ToCmsFileDto(File file, IReadOnlyDictionary<string, string>? namesByIamId = null)
+        {
+            var dto = ToCmsFileDtoBase(file);
+            dto.FileName = Path.GetFileName(file.FilePath);
+            dto.Permissions = file.FileToPermissions.Select(p => p.Permission).OrderBy(p => p).ToList();
+            dto.People = file.FileToPeople
+                .Select(p => new CmsFilePersonDto
+                {
+                    IamId = p.IamId,
+                    Name = namesByIamId != null && namesByIamId.TryGetValue(p.IamId, out var name) ? name : null
+                })
+                .OrderBy(p => p.Name ?? p.IamId)
+                .ToList();
+            dto.Url = Data.CMS.GetURL(file.FileGuid.ToString(), file.AllowPublicAccess);
+            dto.FriendlyUrl = Data.CMS.GetFriendlyURL(file.FriendlyName, file.AllowPublicAccess);
+            // When a file is in the trash, surface the date the purge job will permanently delete it.
+            dto.PurgeOn = file.DeletedOn?.AddDays(CmsTrash.RetentionDays);
+            return dto;
+        }
+
+        [MapperIgnoreTarget(nameof(CmsFileDto.FileName))]
+        [MapperIgnoreTarget(nameof(CmsFileDto.Permissions))]
+        [MapperIgnoreTarget(nameof(CmsFileDto.People))]
+        [MapperIgnoreTarget(nameof(CmsFileDto.Url))]
+        [MapperIgnoreTarget(nameof(CmsFileDto.FriendlyUrl))]
+        [MapperIgnoreTarget(nameof(CmsFileDto.PurgeOn))]
+        private static partial CmsFileDto ToCmsFileDtoBase(File file);
+    }
+}
diff --git a/web/Areas/CMS/Models/DTOs/CmsFileDto.cs b/web/Areas/CMS/Models/DTOs/CmsFileDto.cs
new file mode 100644
index 000000000..c2ce15b2a
--- /dev/null
+++ b/web/Areas/CMS/Models/DTOs/CmsFileDto.cs
@@ -0,0 +1,53 @@
+namespace Viper.Areas.CMS.Models.DTOs
+{
+    public class CmsFileDto
+    {
+        public Guid FileGuid { get; set; }
+        public string FileName { get; set; } = string.Empty;
+        public string? Folder { get; set; }
+        public string FriendlyName { get; set; } = string.Empty;
+        public bool Encrypted { get; set; }
+        public string Description { get; set; } = string.Empty;
+        public bool AllowPublicAccess { get; set; }
+        public string? OldUrl { get; set; }
+        public DateTime ModifiedOn { get; set; }
+        public string ModifiedBy { get; set; } = string.Empty;
+        public DateTime? DeletedOn { get; set; }
+
+        /// <summary>When a trashed file will be permanently purged (DeletedOn + retention); null if not deleted.</summary>
+        public DateTime? PurgeOn { get; set; }
+
+        public List<string> Permissions { get; set; } = new();
+        public List<CmsFilePersonDto> People { get; set; } = new();
+        public string Url { get; set; } = string.Empty;
+        public string FriendlyUrl { get; set; } = string.Empty;
+    }
+
+    public class CmsFilePersonDto
+    {
+        public string IamId { get; set; } = string.Empty;
+        public string? Name { get; set; }
+    }
+
+    public class CmsFolderCountDto
+    {
+        public string Folder { get; set; } = string.Empty;
+        public int Count { get; set; }
+    }
+
+    /// <summary>Result of a pre-upload name availability check for a folder.</summary>
+    public class CmsFileNameCheckDto
+    {
+        public bool InUse { get; set; }
+
+        /// <summary>The name an auto-rename would store the file under (the name itself when free).</summary>
+        public string SuggestedName { get; set; } = string.Empty;
+
+        /// <summary>Set when the conflicting name belongs to an existing file record.</summary>
+        public Guid? ExistingFileGuid { get; set; }
+
+        public string? ExistingFriendlyName { get; set; }
+
+        public bool ExistingDeleted { get; set; }
+    }
+}
diff --git a/web/Areas/CMS/Models/DTOs/CmsFileImportDtos.cs b/web/Areas/CMS/Models/DTOs/CmsFileImportDtos.cs
new file mode 100644
index 000000000..ac51338aa
--- /dev/null
+++ b/web/Areas/CMS/Models/DTOs/CmsFileImportDtos.cs
@@ -0,0 +1,64 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Viper.Areas.CMS.Models.DTOs
+{
+    /// <summary>
+    /// Import existing files from the legacy VIPER webroot into the managed file store.
+    /// Paths are relative to the configured legacy webroot.
+    /// </summary>
+    public class CmsFileImportRequest
+    {
+        [Required]
+        public List<string> FilePaths { get; set; } = new();
+
+        [Required]
+        public string Folder { get; set; } = string.Empty;
+
+        public List<string> Permissions { get; set; } = new();
+
+        /// <summary>Add the folder's default permission (SVMSecure.{folder}) to each file.</summary>
+        public bool? UseDefaultPermission { get; set; }
+
+        public bool? AllowPublicAccess { get; set; }
+
+        public bool? Encrypt { get; set; }
+    }
+
+    public class CmsFileImportResult
+    {
+        public string FilePath { get; set; } = string.Empty;
+        public bool Success { get; set; }
+        public string? Message { get; set; }
+        public Guid? FileGuid { get; set; }
+        public string? FriendlyName { get; set; }
+    }
+
+    /// <summary>Dry-run result for one path of an import request; nothing is moved or saved.</summary>
+    public class CmsFileImportPreviewResult
+    {
+        public string FilePath { get; set; } = string.Empty;
+
+        public bool CanImport { get; set; }
+
+        /// <summary>Blocking issue (CanImport false) or informational note (CanImport true).</summary>
+        public string? Message { get; set; }
+
+        /// <summary>Name the file will be stored under, after any auto-rename.</summary>
+        public string? FileName { get; set; }
+
+        /// <summary>Original name when an auto-rename will occur.</summary>
+        public string? RenamedFrom { get; set; }
+
+        public string? FriendlyName { get; set; }
+
+        public string? OldUrl { get; set; }
+    }
+
+    public class CmsBulkEncryptResult
+    {
+        public Guid FileGuid { get; set; }
+        public string? FriendlyName { get; set; }
+        public bool Success { get; set; }
+        public string? Message { get; set; }
+    }
+}
diff --git a/web/Areas/CMS/Models/DTOs/CmsFileRequests.cs b/web/Areas/CMS/Models/DTOs/CmsFileRequests.cs
new file mode 100644
index 000000000..b1d372823
--- /dev/null
+++ b/web/Areas/CMS/Models/DTOs/CmsFileRequests.cs
@@ -0,0 +1,57 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Viper.Areas.CMS.Models.DTOs
+{
+    /// <summary>
+    /// Form fields accompanying a new file upload (multipart/form-data).
+    /// </summary>
+    public class CmsFileCreateRequest
+    {
+        [Required]
+        public string Folder { get; set; } = string.Empty;
+
+        [MaxLength(1000)]
+        public string? Description { get; set; }
+
+        public bool? AllowPublicAccess { get; set; }
+
+        [MaxLength(256)]
+        public string? OldUrl { get; set; }
+
+        public List<string> Permissions { get; set; } = new();
+
+        public List<string> IamIds { get; set; } = new();
+
+        public bool? Encrypt { get; set; }
+
+        /// <summary>Optional stored-name override; defaults to the uploaded file's name.</summary>
+        [MaxLength(256)]
+        public string? FileName { get; set; }
+
+        /// <summary>
+        /// When true, overwrite a same-named disk file that has no file record. A conflict with
+        /// a managed record still fails (replace it by editing that record instead).
+        /// </summary>
+        public bool? Overwrite { get; set; }
+    }
+
+    /// <summary>
+    /// Form fields for editing file metadata; the file itself is an optional replacement upload.
+    /// </summary>
+    public class CmsFileUpdateRequest
+    {
+        [MaxLength(1000)]
+        public string? Description { get; set; }
+
+        public bool? AllowPublicAccess { get; set; }
+
+        [MaxLength(256)]
+        public string? OldUrl { get; set; }
+
+        public List<string> Permissions { get; set; } = new();
+
+        public List<string> IamIds { get; set; } = new();
+
+        public bool? Encrypt { get; set; }
+    }
+}
diff --git a/web/Areas/CMS/Models/DTOs/ContentBlockDto.cs b/web/Areas/CMS/Models/DTOs/ContentBlockDto.cs
new file mode 100644
index 000000000..efa49df76
--- /dev/null
+++ b/web/Areas/CMS/Models/DTOs/ContentBlockDto.cs
@@ -0,0 +1,76 @@
+namespace Viper.Areas.CMS.Models.DTOs
+{
+    public class ContentBlockDto
+    {
+        public int ContentBlockId { get; set; }
+        public string Content { get; set; } = string.Empty;
+        public string? Title { get; set; }
+        public string System { get; set; } = string.Empty;
+        public string? Application { get; set; }
+        public string? Page { get; set; }
+        public string? ViperSectionPath { get; set; }
+        public int? BlockOrder { get; set; }
+        public string? FriendlyName { get; set; }
+        public bool AllowPublicAccess { get; set; }
+        public DateTime ModifiedOn { get; set; }
+        public string ModifiedBy { get; set; } = string.Empty;
+        public DateTime? DeletedOn { get; set; }
+        public List<string> Permissions { get; set; } = new();
+        public List<ContentBlockFileDto> Files { get; set; } = new();
+    }
+
+    public class ContentBlockFileDto
+    {
+        public Guid FileGuid { get; set; }
+        public string FriendlyName { get; set; } = string.Empty;
+        public string Url { get; set; } = string.Empty;
+    }
+
+    public class ContentHistoryListItemDto
+    {
+        public int ContentHistoryId { get; set; }
+        public DateTime? ModifiedOn { get; set; }
+        public string? ModifiedBy { get; set; }
+    }
+
+    public class ContentHistoryDto : ContentHistoryListItemDto
+    {
+        public string Content { get; set; } = string.Empty;
+    }
+
+    /// <summary>
+    /// A rendered HTML diff between two versions of a content block. Content holds the merged
+    /// markup with htmldiff.net's ins/del (diffins/diffdel/diffmod) markers. The Old/New stamps
+    /// describe each side so the viewer can label the comparison direction. HasComparison is false
+    /// when there is no other version to compare against (e.g. the original version); Content then
+    /// holds the version's own markup with no diff markers.
+    /// </summary>
+    public class ContentHistoryDiffDto
+    {
+        public string Content { get; set; } = string.Empty;
+        public bool HasComparison { get; set; }
+        // False when the two compared versions are identical (the diff carries no ins/del markers),
+        // so the viewer can say "identical" instead of showing an unchanged body that looks broken.
+        public bool HasChanges { get; set; }
+        public DateTime? OldModifiedOn { get; set; }
+        public string? OldModifiedBy { get; set; }
+        public DateTime? NewModifiedOn { get; set; }
+        public string? NewModifiedBy { get; set; }
+    }
+
+    /// <summary>
+    /// A single cross-block edit-history entry: a superseded content version with the block
+    /// it belongs to. Used by the content-block edit-history viewer.
+    /// </summary>
+    public class ContentHistoryAuditDto
+    {
+        public int ContentHistoryId { get; set; }
+        public int ContentBlockId { get; set; }
+        public string? Title { get; set; }
+        public string? FriendlyName { get; set; }
+        public string? Page { get; set; }
+        public DateTime? ModifiedOn { get; set; }
+        public string? ModifiedBy { get; set; }
+        public bool BlockDeleted { get; set; }
+    }
+}
diff --git a/web/Areas/CMS/Models/DTOs/CreateLinkDto.cs b/web/Areas/CMS/Models/DTOs/CreateLinkDto.cs
index 7c3091130..719cf5c69 100644
--- a/web/Areas/CMS/Models/DTOs/CreateLinkDto.cs
+++ b/web/Areas/CMS/Models/DTOs/CreateLinkDto.cs
@@ -1,5 +1,5 @@
 using System.ComponentModel.DataAnnotations;
-using Areas.CMS.Validation;
+using Viper.Areas.CMS.Validation;
 
 namespace Areas.CMS.Models.DTOs;
 
diff --git a/web/Areas/CMS/Models/DTOs/LeftNavDtos.cs b/web/Areas/CMS/Models/DTOs/LeftNavDtos.cs
new file mode 100644
index 000000000..e77a7ac43
--- /dev/null
+++ b/web/Areas/CMS/Models/DTOs/LeftNavDtos.cs
@@ -0,0 +1,78 @@
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+using Viper.Areas.CMS.Validation;
+
+namespace Viper.Areas.CMS.Models.DTOs
+{
+    public class LeftNavMenuDto
+    {
+        public int LeftNavMenuId { get; set; }
+        public string? MenuHeaderText { get; set; }
+        public string System { get; set; } = string.Empty;
+        public string? ViperSectionPath { get; set; }
+        public string? Page { get; set; }
+        public string? FriendlyName { get; set; }
+        public DateTime ModifiedOn { get; set; }
+        public string ModifiedBy { get; set; } = string.Empty;
+        public List<LeftNavItemDto> Items { get; set; } = new();
+    }
+
+    public class LeftNavItemDto
+    {
+        public int LeftNavItemId { get; set; }
+        public string? MenuItemText { get; set; }
+        public bool IsHeader { get; set; }
+        public string? Url { get; set; }
+        public int? DisplayOrder { get; set; }
+        public List<string> Permissions { get; set; } = new();
+    }
+
+    // MaxLength values mirror the LeftNavMenu column sizes in VIPERContext so an over-long value
+    // is rejected as a 400 rather than surfacing as a 500 when SQL Server truncates/rejects it.
+    public class LeftNavMenuAddEdit
+    {
+        [Required]
+        [MaxLength(100)]
+        public string MenuHeaderText { get; set; } = string.Empty;
+
+        [Required]
+        [MaxLength(50)]
+        public string System { get; set; } = "Viper";
+
+        [MaxLength(100)]
+        public string? ViperSectionPath { get; set; }
+
+        [MaxLength(200)]
+        public string? Page { get; set; }
+
+        [MaxLength(100)]
+        public string? FriendlyName { get; set; }
+    }
+
+    /// <summary>
+    /// Full item list for a menu; saving replaces the menu's items (new items have id 0,
+    /// omitted ids are deleted, order follows the array).
+    /// </summary>
+    public class LeftNavItemEdit
+    {
+        // JsonRequired (not defaulting on omission): an under-posted id would silently turn an
+        // update into a new item, and an omitted isHeader would silently clear a header.
+        [JsonRequired]
+        public int LeftNavItemId { get; set; }
+
+        [Required]
+        [MaxLength(250)]
+        public string MenuItemText { get; set; } = string.Empty;
+
+        [JsonRequired]
+        public bool IsHeader { get; set; }
+
+        [MaxLength(250)]
+        [SafeUrl(AllowRelative = true)]
+        public string? Url { get; set; }
+
+        // Each permission is stored in the varchar(500) LeftNavItemToPermission.permission column.
+        [MaxLengthEach(500)]
+        public List<string> Permissions { get; set; } = new();
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsContentBlockService.cs b/web/Areas/CMS/Services/CmsContentBlockService.cs
new file mode 100644
index 000000000..72f7f3ce6
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsContentBlockService.cs
@@ -0,0 +1,673 @@
+using Microsoft.EntityFrameworkCore;
+using HtmlDiffer = HtmlDiff.HtmlDiff;
+using Viper.Areas.CMS.Models;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Classes.SQLContext;
+using Viper.Classes.Utilities;
+using Viper.Models.VIPER;
+using Viper.Services;
+
+namespace Viper.Areas.CMS.Services
+{
+    /// <summary>
+    /// Thrown when an update is based on a stale copy of a block (someone else saved since
+    /// the editor loaded it). Controllers translate this to 409 Conflict.
+    /// </summary>
+    public class CmsConcurrencyException : InvalidOperationException
+    {
+        public CmsConcurrencyException(string message) : base(message) { }
+    }
+
+    public interface ICmsContentBlockService
+    {
+        Task<(List<ContentBlockDto> Blocks, int Total)> GetContentBlocksAsync(string status, string? system,
+            string? viperSectionPath, string? search, bool? isPublic, int page, int perPage, string? sortBy,
+            bool descending, CancellationToken ct = default);
+
+        Task<ContentBlockDto?> GetContentBlockAsync(int contentBlockId, CancellationToken ct = default);
+
+        Task<ContentBlockDto> CreateContentBlockAsync(CMSBlockAddEdit request, CancellationToken ct = default);
+
+        Task<ContentBlockDto?> UpdateContentBlockAsync(int contentBlockId, CMSBlockAddEdit request, CancellationToken ct = default);
+
+        Task<ContentBlockDto?> UpdateContentOnlyAsync(int contentBlockId, string content, DateTime? lastModifiedOn, CancellationToken ct = default);
+
+        Task<bool> SoftDeleteAsync(int contentBlockId, CancellationToken ct = default);
+
+        Task<bool> RestoreAsync(int contentBlockId, CancellationToken ct = default);
+
+        Task<bool> PermanentlyDeleteAsync(int contentBlockId, CancellationToken ct = default);
+
+        Task<List<ContentHistoryListItemDto>> GetHistoryAsync(int contentBlockId, CancellationToken ct = default);
+
+        Task<ContentHistoryDto?> GetHistoryVersionAsync(int contentBlockId, int contentHistoryId, CancellationToken ct = default);
+
+        Task<ContentHistoryDiffDto?> GetHistoryVersionDiffAsync(int contentBlockId, int contentHistoryId, CancellationToken ct = default);
+
+        Task<ContentHistoryDiffDto?> DiffContentAgainstHistoryAsync(int contentBlockId, int contentHistoryId, string currentContent, CancellationToken ct = default);
+
+        Task<List<ContentHistoryAuditDto>> GetHistoryEntriesAsync(CmsContentHistoryFilter filter, int page, int perPage, CancellationToken ct = default);
+
+        Task<int> GetHistoryEntryCountAsync(CmsContentHistoryFilter filter, CancellationToken ct = default);
+
+        Task<List<string>> GetViperSectionPathsAsync(CancellationToken ct = default);
+    }
+
+    /// <summary>
+    /// Filters for the cross-block edit-history viewer. Mirrors CmsFileAuditFilter so the
+    /// content-history page can reuse the file-audit page's filter UX.
+    /// </summary>
+    public class CmsContentHistoryFilter
+    {
+        public int? ContentBlockId { get; set; }
+        public string? ModifiedBy { get; set; }
+        public DateTime? From { get; set; }
+        public DateTime? To { get; set; }
+        public string? Search { get; set; }
+    }
+
+    /// <summary>
+    /// Management operations for CMS content blocks. Mirrors legacy ColdFusion
+    /// ContentBlocks.cfc semantics: content is stored raw and sanitized on render,
+    /// and ContentHistory receives the PREVIOUS content/author before each update
+    /// so history entries are the older versions, not copies of the current one.
+    /// </summary>
+    public class CmsContentBlockService : ICmsContentBlockService
+    {
+        private readonly VIPERContext _context;
+        private readonly IHtmlSanitizerService _sanitizer;
+        private readonly IUserHelper _userHelper;
+
+        public CmsContentBlockService(VIPERContext context, IHtmlSanitizerService sanitizer, IUserHelper userHelper)
+        {
+            _context = context;
+            _sanitizer = sanitizer;
+            _userHelper = userHelper;
+        }
+
+        public async Task<(List<ContentBlockDto> Blocks, int Total)> GetContentBlocksAsync(string status, string? system,
+            string? viperSectionPath, string? search, bool? isPublic, int page, int perPage, string? sortBy,
+            bool descending, CancellationToken ct = default)
+        {
+            var query = _context.ContentBlocks
+                .AsNoTracking()
+                .AsSplitQuery()
+                .TagWith("CmsContentBlockService.GetContentBlocks")
+                .AsQueryable();
+
+            query = status.ToLowerInvariant() switch
+            {
+                "active" => query.Where(b => b.DeletedOn == null),
+                "deleted" => query.Where(b => b.DeletedOn != null),
+                _ => query
+            };
+
+            if (!string.IsNullOrEmpty(system))
+            {
+                query = query.Where(b => b.System == system);
+            }
+            if (!string.IsNullOrEmpty(viperSectionPath))
+            {
+                query = query.Where(b => b.ViperSectionPath == viperSectionPath);
+            }
+            if (isPublic != null)
+            {
+                query = query.Where(b => b.AllowPublicAccess == isPublic);
+            }
+            if (!string.IsNullOrEmpty(search))
+            {
+                // Coalescing null columns to "" (never a match: search is non-empty here) keeps
+                // this a flat OR chain the SQL and in-memory providers both translate.
+                query = query.Where(b => (b.Title ?? "").Contains(search)
+                    || (b.FriendlyName ?? "").Contains(search)
+                    || (b.Page ?? "").Contains(search)
+                    || b.Content.Contains(search));
+            }
+
+            int total = await query.CountAsync(ct);
+
+            query = (sortBy?.ToLowerInvariant(), descending) switch
+            {
+                ("vipersectionpath", false) => query.OrderBy(b => b.ViperSectionPath).ThenBy(b => b.Title),
+                ("vipersectionpath", true) => query.OrderByDescending(b => b.ViperSectionPath).ThenBy(b => b.Title),
+                ("page", false) => query.OrderBy(b => b.Page).ThenBy(b => b.Title),
+                ("page", true) => query.OrderByDescending(b => b.Page).ThenBy(b => b.Title),
+                ("modifiedon", false) => query.OrderBy(b => b.ModifiedOn),
+                ("modifiedon", true) => query.OrderByDescending(b => b.ModifiedOn),
+                (_, true) => query.OrderByDescending(b => b.Title),
+                _ => query.OrderBy(b => b.Title)
+            };
+
+            // List view: project without Content (it can be large) — the editor loads the full
+            // block. Two stages because GetFriendlyURL reads HttpContext and can't translate to SQL.
+            var blocks = await query
+                .Skip((page - 1) * perPage)
+                .Take(perPage)
+                .Select(b => new
+                {
+                    b.ContentBlockId,
+                    b.Title,
+                    b.System,
+                    b.Application,
+                    b.Page,
+                    b.ViperSectionPath,
+                    b.BlockOrder,
+                    b.FriendlyName,
+                    b.AllowPublicAccess,
+                    b.ModifiedOn,
+                    b.ModifiedBy,
+                    b.DeletedOn,
+                    Permissions = b.ContentBlockToPermissions
+                        .Select(p => p.Permission)
+                        .OrderBy(p => p)
+                        .ToList(),
+                    Files = b.ContentBlockToFiles
+                        .Select(f => new
+                        {
+                            f.FileGuid,
+                            f.File.FriendlyName,
+                            f.File.AllowPublicAccess
+                        })
+                        .OrderBy(f => f.FriendlyName)
+                        .ToList()
+                })
+                .ToListAsync(ct);
+
+            var dtos = blocks.Select(b => new ContentBlockDto
+            {
+                ContentBlockId = b.ContentBlockId,
+                Title = b.Title,
+                System = b.System,
+                Application = b.Application,
+                Page = b.Page,
+                ViperSectionPath = b.ViperSectionPath,
+                BlockOrder = b.BlockOrder,
+                FriendlyName = b.FriendlyName,
+                AllowPublicAccess = b.AllowPublicAccess,
+                ModifiedOn = b.ModifiedOn,
+                ModifiedBy = b.ModifiedBy,
+                DeletedOn = b.DeletedOn,
+                Permissions = b.Permissions,
+                Files = b.Files.Select(f => new ContentBlockFileDto
+                {
+                    FileGuid = f.FileGuid,
+                    FriendlyName = f.FriendlyName,
+                    Url = Data.CMS.GetFriendlyURL(f.FriendlyName, f.AllowPublicAccess)
+                }).ToList()
+            }).ToList();
+
+            return (dtos, total);
+        }
+
+        public async Task<ContentBlockDto?> GetContentBlockAsync(int contentBlockId, CancellationToken ct = default)
+        {
+            var block = await LoadBlockAsync(contentBlockId, tracking: false, ct);
+            if (block == null)
+            {
+                return null;
+            }
+            var dto = CmsContentBlockMapper.ToDto(block);
+            // Sanitize for the editor with the same policy used on render, so what the
+            // editor shows matches what viewers will see.
+            dto.Content = _sanitizer.Sanitize(dto.Content);
+            return dto;
+        }
+
+        public async Task<ContentBlockDto> CreateContentBlockAsync(CMSBlockAddEdit request, CancellationToken ct = default)
+        {
+            await AssertFriendlyNameUniqueAsync(request.FriendlyName, null, ct);
+            var fileGuids = request.FileGuids.Distinct().ToList();
+            await AssertFilesExistAsync(fileGuids, ct);
+
+            var block = new ContentBlock();
+            ApplyScalarFields(block, request);
+            block.ModifiedOn = DateTime.Now;
+            block.ModifiedBy = CurrentLoginId();
+
+            foreach (var permission in CleanList(request.Permissions))
+            {
+                block.ContentBlockToPermissions.Add(new ContentBlockToPermission { Permission = permission });
+            }
+            foreach (var fileGuid in fileGuids)
+            {
+                block.ContentBlockToFiles.Add(new ContentBlockToFile { FileGuid = fileGuid });
+            }
+
+            _context.ContentBlocks.Add(block);
+            await _context.SaveChangesAsync(ct);
+
+            return (await GetContentBlockAsync(block.ContentBlockId, ct))!;
+        }
+
+        public async Task<ContentBlockDto?> UpdateContentBlockAsync(int contentBlockId, CMSBlockAddEdit request, CancellationToken ct = default)
+        {
+            var block = await LoadBlockAsync(contentBlockId, tracking: true, ct);
+            if (block == null)
+            {
+                return null;
+            }
+
+            AssertNotStale(block, request.LastModifiedOn);
+            await AssertFriendlyNameUniqueAsync(request.FriendlyName, contentBlockId, ct);
+            var fileGuids = request.FileGuids.Distinct().ToList();
+            await AssertFilesExistAsync(fileGuids, ct);
+
+            SavePreviousVersionToHistory(block);
+            ApplyScalarFields(block, request);
+            block.ModifiedOn = DateTime.Now;
+            block.ModifiedBy = CurrentLoginId();
+
+            ApplyPermissionDeltas(block, CleanList(request.Permissions));
+            ApplyFileDeltas(block, fileGuids);
+
+            await _context.SaveChangesAsync(ct);
+            return await GetContentBlockAsync(contentBlockId, ct);
+        }
+
+        public async Task<ContentBlockDto?> UpdateContentOnlyAsync(int contentBlockId, string content,
+            DateTime? lastModifiedOn, CancellationToken ct = default)
+        {
+            var block = await LoadBlockAsync(contentBlockId, tracking: true, ct);
+            if (block == null)
+            {
+                return null;
+            }
+
+            AssertNotStale(block, lastModifiedOn);
+            SavePreviousVersionToHistory(block);
+            block.Content = content;
+            block.ModifiedOn = DateTime.Now;
+            block.ModifiedBy = CurrentLoginId();
+
+            await _context.SaveChangesAsync(ct);
+            return await GetContentBlockAsync(contentBlockId, ct);
+        }
+
+        public async Task<bool> SoftDeleteAsync(int contentBlockId, CancellationToken ct = default)
+        {
+            var block = await _context.ContentBlocks.FindAsync(new object[] { contentBlockId }, ct);
+            if (block == null)
+            {
+                return false;
+            }
+            block.DeletedOn = DateTime.Now;
+            block.ModifiedOn = DateTime.Now;
+            block.ModifiedBy = CurrentLoginId();
+            await _context.SaveChangesAsync(ct);
+            return true;
+        }
+
+        public async Task<bool> RestoreAsync(int contentBlockId, CancellationToken ct = default)
+        {
+            var block = await _context.ContentBlocks.FindAsync(new object[] { contentBlockId }, ct);
+            if (block == null)
+            {
+                return false;
+            }
+            block.DeletedOn = null;
+            block.ModifiedOn = DateTime.Now;
+            block.ModifiedBy = CurrentLoginId();
+            await _context.SaveChangesAsync(ct);
+            return true;
+        }
+
+        public async Task<bool> PermanentlyDeleteAsync(int contentBlockId, CancellationToken ct = default)
+        {
+            var block = await _context.ContentBlocks
+                .Include(b => b.ContentBlockToPermissions)
+                .Include(b => b.ContentBlockToFiles)
+                .Include(b => b.ContentHistories)
+                .AsSplitQuery()
+                .FirstOrDefaultAsync(b => b.ContentBlockId == contentBlockId, ct);
+            if (block == null)
+            {
+                return false;
+            }
+
+            _context.RemoveRange(block.ContentHistories);
+            _context.RemoveRange(block.ContentBlockToFiles);
+            _context.RemoveRange(block.ContentBlockToPermissions);
+            _context.Remove(block);
+            await _context.SaveChangesAsync(ct);
+            return true;
+        }
+
+        public async Task<List<ContentHistoryListItemDto>> GetHistoryAsync(int contentBlockId, CancellationToken ct = default)
+        {
+            return await _context.ContentHistories
+                .AsNoTracking()
+                .Where(h => h.ContentBlockId == contentBlockId)
+                .OrderByDescending(h => h.ModifiedOn)
+                .ThenByDescending(h => h.ContentHistoryId)
+                .Select(h => new ContentHistoryListItemDto
+                {
+                    ContentHistoryId = h.ContentHistoryId,
+                    ModifiedOn = h.ModifiedOn,
+                    ModifiedBy = h.ModifiedBy
+                })
+                .ToListAsync(ct);
+        }
+
+        public async Task<ContentHistoryDto?> GetHistoryVersionAsync(int contentBlockId, int contentHistoryId, CancellationToken ct = default)
+        {
+            var history = await _context.ContentHistories
+                .AsNoTracking()
+                .FirstOrDefaultAsync(h => h.ContentBlockId == contentBlockId && h.ContentHistoryId == contentHistoryId, ct);
+            if (history == null)
+            {
+                return null;
+            }
+            return new ContentHistoryDto
+            {
+                ContentHistoryId = history.ContentHistoryId,
+                ModifiedOn = history.ModifiedOn,
+                ModifiedBy = history.ModifiedBy,
+                Content = _sanitizer.Sanitize(history.ContentBlockContent)
+            };
+        }
+
+        public async Task<ContentHistoryDiffDto?> GetHistoryVersionDiffAsync(int contentBlockId, int contentHistoryId, CancellationToken ct = default)
+        {
+            var selected = await _context.ContentHistories
+                .AsNoTracking()
+                .FirstOrDefaultAsync(h => h.ContentBlockId == contentBlockId && h.ContentHistoryId == contentHistoryId, ct);
+            if (selected == null)
+            {
+                return null;
+            }
+
+            // The "previous version" is the next-older history row for this block, by the same
+            // newest-first ordering the history list uses. History holds superseded versions only,
+            // so the current live block is never the comparison target here.
+            var previous = await _context.ContentHistories
+                .AsNoTracking()
+                .Where(h => h.ContentBlockId == contentBlockId
+                    && (h.ModifiedOn < selected.ModifiedOn
+                        || (h.ModifiedOn == selected.ModifiedOn && h.ContentHistoryId < selected.ContentHistoryId)))
+                .OrderByDescending(h => h.ModifiedOn)
+                .ThenByDescending(h => h.ContentHistoryId)
+                .FirstOrDefaultAsync(ct);
+
+            if (previous == null)
+            {
+                // Original version: nothing older to diff against. Return its own sanitized markup.
+                return new ContentHistoryDiffDto
+                {
+                    Content = _sanitizer.Sanitize(selected.ContentBlockContent),
+                    HasComparison = false,
+                    NewModifiedOn = selected.ModifiedOn,
+                    NewModifiedBy = selected.ModifiedBy
+                };
+            }
+
+            var diffHtml = BuildDiffHtml(previous.ContentBlockContent, selected.ContentBlockContent);
+            return new ContentHistoryDiffDto
+            {
+                Content = diffHtml,
+                HasComparison = true,
+                HasChanges = DiffHasChanges(diffHtml),
+                OldModifiedOn = previous.ModifiedOn,
+                OldModifiedBy = previous.ModifiedBy,
+                NewModifiedOn = selected.ModifiedOn,
+                NewModifiedBy = selected.ModifiedBy
+            };
+        }
+
+        public async Task<ContentHistoryDiffDto?> DiffContentAgainstHistoryAsync(int contentBlockId, int contentHistoryId, string currentContent, CancellationToken ct = default)
+        {
+            var selected = await _context.ContentHistories
+                .AsNoTracking()
+                .FirstOrDefaultAsync(h => h.ContentBlockId == contentBlockId && h.ContentHistoryId == contentHistoryId, ct);
+            if (selected == null)
+            {
+                return null;
+            }
+
+            // The history version is the "old" side and the editor's current draft is the "new" side,
+            // so ins/del read as what the draft adds/removes relative to that version.
+            var diffHtml = BuildDiffHtml(selected.ContentBlockContent, currentContent);
+            return new ContentHistoryDiffDto
+            {
+                Content = diffHtml,
+                HasComparison = true,
+                HasChanges = DiffHasChanges(diffHtml),
+                OldModifiedOn = selected.ModifiedOn,
+                OldModifiedBy = selected.ModifiedBy
+            };
+        }
+
+        // Sanitize both sides with the render-time policy first so the diff compares what actually
+        // renders, then diff, then re-sanitize the merged result. The second pass re-parses through
+        // AngleSharp (balancing/closing the malformed tags htmldiff.net can emit) and strips anything
+        // off-policy, so we no longer trust the diff library's output — SanitizeDiff keeps only the
+        // <ins>/<del> change markers on top of our normal allowlist.
+        private string BuildDiffHtml(string oldContent, string newContent)
+        {
+            var oldSafe = _sanitizer.Sanitize(oldContent);
+            var newSafe = _sanitizer.Sanitize(newContent);
+            var diff = HtmlDiffer.Execute(oldSafe, newSafe);
+            return _sanitizer.SanitizeDiff(diff);
+        }
+
+        // htmldiff.net only wraps actual changes in <ins>/<del>; identical inputs come back with
+        // neither. Their absence means the two versions render the same.
+        private static bool DiffHasChanges(string diffHtml)
+        {
+            return diffHtml.Contains("<ins", StringComparison.OrdinalIgnoreCase)
+                || diffHtml.Contains("<del", StringComparison.OrdinalIgnoreCase);
+        }
+
+        public async Task<List<ContentHistoryAuditDto>> GetHistoryEntriesAsync(CmsContentHistoryFilter filter, int page, int perPage, CancellationToken ct = default)
+        {
+            return await BuildHistoryQuery(filter)
+                .OrderByDescending(x => x.History.ModifiedOn)
+                .ThenByDescending(x => x.History.ContentHistoryId)
+                .Skip((page - 1) * perPage)
+                .Take(perPage)
+                .Select(x => new ContentHistoryAuditDto
+                {
+                    ContentHistoryId = x.History.ContentHistoryId,
+                    ContentBlockId = x.History.ContentBlockId,
+                    Title = x.Block.Title,
+                    FriendlyName = x.Block.FriendlyName,
+                    Page = x.Block.Page,
+                    ModifiedOn = x.History.ModifiedOn,
+                    ModifiedBy = x.History.ModifiedBy,
+                    BlockDeleted = x.Block.DeletedOn != null
+                })
+                .ToListAsync(ct);
+        }
+
+        public async Task<int> GetHistoryEntryCountAsync(CmsContentHistoryFilter filter, CancellationToken ct = default)
+        {
+            return await BuildHistoryQuery(filter).CountAsync(ct);
+        }
+
+        // Join history to its block so the block's title/page are filterable and projectable
+        // (a join, not a correlated subquery). Each row is a superseded prior version.
+        private IQueryable<HistoryWithBlock> BuildHistoryQuery(CmsContentHistoryFilter filter)
+        {
+            var query =
+                from h in _context.ContentHistories.AsNoTracking()
+                join b in _context.ContentBlocks.AsNoTracking() on h.ContentBlockId equals b.ContentBlockId
+                select new HistoryWithBlock { History = h, Block = b };
+
+            if (filter.ContentBlockId != null)
+            {
+                query = query.Where(x => x.History.ContentBlockId == filter.ContentBlockId);
+            }
+            if (!string.IsNullOrEmpty(filter.ModifiedBy))
+            {
+                query = query.Where(x => x.History.ModifiedBy == filter.ModifiedBy);
+            }
+            if (filter.From != null)
+            {
+                query = query.Where(x => x.History.ModifiedOn >= filter.From);
+            }
+            if (filter.To != null)
+            {
+                // Treat the To date as inclusive through end of day.
+                var to = DateRangeHelper.ExclusiveUpperBound(filter.To.Value);
+                query = query.Where(x => x.History.ModifiedOn < to);
+            }
+            if (!string.IsNullOrEmpty(filter.Search))
+            {
+                query = query.Where(x => (x.Block.Title ?? "").Contains(filter.Search)
+                    || (x.Block.FriendlyName ?? "").Contains(filter.Search)
+                    || (x.Block.Page ?? "").Contains(filter.Search));
+            }
+            return query;
+        }
+
+        public async Task<List<string>> GetViperSectionPathsAsync(CancellationToken ct = default)
+        {
+            return await _context.ContentBlocks
+                .AsNoTracking()
+                .Where(b => b.ViperSectionPath != null && b.ViperSectionPath != "")
+                .Select(b => b.ViperSectionPath!)
+                .Distinct()
+                .OrderBy(p => p)
+                .ToListAsync(ct);
+        }
+
+        private async Task<ContentBlock?> LoadBlockAsync(int contentBlockId, bool tracking, CancellationToken ct)
+        {
+            var query = _context.ContentBlocks
+                .Include(b => b.ContentBlockToPermissions)
+                .Include(b => b.ContentBlockToFiles)
+                    .ThenInclude(f => f.File)
+                .AsSplitQuery();
+            if (!tracking)
+            {
+                query = query.AsNoTracking();
+            }
+            return await query.FirstOrDefaultAsync(b => b.ContentBlockId == contentBlockId, ct);
+        }
+
+        private static void AssertNotStale(ContentBlock block, DateTime? lastModifiedOn)
+        {
+            if (lastModifiedOn == null)
+            {
+                throw new ArgumentException("LastModifiedOn is required so concurrent edits can be detected.");
+            }
+            // Compare to the second: serialized timestamps lose sub-second precision round-tripping
+            // through the client.
+            if (Math.Abs((block.ModifiedOn - lastModifiedOn.Value).TotalSeconds) >= 1)
+            {
+                throw new CmsConcurrencyException(
+                    $"This content block was modified by {block.ModifiedBy} on {block.ModifiedOn:g}. Reload to get the latest version.");
+            }
+        }
+
+        private async Task AssertFilesExistAsync(List<Guid> fileGuids, CancellationToken ct)
+        {
+            if (fileGuids.Count == 0)
+            {
+                return;
+            }
+            int existing = await _context.Files.CountAsync(f => EF.Parameter(fileGuids).Contains(f.FileGuid), ct);
+            if (existing != fileGuids.Count)
+            {
+                throw new ArgumentException("One or more attached files do not exist.");
+            }
+        }
+
+        private async Task AssertFriendlyNameUniqueAsync(string? friendlyName, int? exceptBlockId, CancellationToken ct)
+        {
+            if (string.IsNullOrEmpty(friendlyName))
+            {
+                return;
+            }
+            bool taken = await _context.ContentBlocks
+                .AnyAsync(b => b.FriendlyName == friendlyName && (exceptBlockId == null || b.ContentBlockId != exceptBlockId), ct);
+            if (taken)
+            {
+                throw new ArgumentException("Friendly name must be unique");
+            }
+        }
+
+        private void SavePreviousVersionToHistory(ContentBlock block)
+        {
+            // Store the version being replaced, stamped with ITS author/time (legacy semantics).
+            _context.ContentHistories.Add(new ContentHistory
+            {
+                ContentBlockId = block.ContentBlockId,
+                ContentBlockContent = block.Content,
+                ModifiedOn = block.ModifiedOn,
+                ModifiedBy = block.ModifiedBy
+            });
+        }
+
+        private static void ApplyScalarFields(ContentBlock block, CMSBlockAddEdit request)
+        {
+            block.Title = request.Title;
+            block.Content = request.Content;
+            block.FriendlyName = request.FriendlyName;
+            block.System = request.System;
+            block.Application = request.Application;
+            block.Page = request.Page;
+            block.ViperSectionPath = request.ViperSectionPath;
+            block.AllowPublicAccess = request.AllowPublicAccess;
+            block.BlockOrder = request.BlockOrder;
+        }
+
+        private void ApplyPermissionDeltas(ContentBlock block, List<string> requested)
+        {
+            var existing = block.ContentBlockToPermissions.ToList();
+            foreach (var cbp in existing.Where(cbp => !requested.Contains(cbp.Permission, StringComparer.OrdinalIgnoreCase)))
+            {
+                block.ContentBlockToPermissions.Remove(cbp);
+                _context.Remove(cbp);
+            }
+            var existingNames = existing.Select(p => p.Permission).ToHashSet(StringComparer.OrdinalIgnoreCase);
+            foreach (var permission in requested.Where(p => !existingNames.Contains(p)))
+            {
+                block.ContentBlockToPermissions.Add(new ContentBlockToPermission
+                {
+                    ContentBlockId = block.ContentBlockId,
+                    Permission = permission
+                });
+            }
+        }
+
+        private void ApplyFileDeltas(ContentBlock block, List<Guid> requested)
+        {
+            var existing = block.ContentBlockToFiles.ToList();
+            foreach (var cbf in existing.Where(cbf => !requested.Contains(cbf.FileGuid)))
+            {
+                block.ContentBlockToFiles.Remove(cbf);
+                _context.Remove(cbf);
+            }
+            var existingGuids = existing.Select(f => f.FileGuid).ToHashSet();
+            foreach (var fileGuid in requested.Where(g => !existingGuids.Contains(g)))
+            {
+                block.ContentBlockToFiles.Add(new ContentBlockToFile
+                {
+                    ContentBlockId = block.ContentBlockId,
+                    FileGuid = fileGuid
+                });
+            }
+        }
+
+        private string CurrentLoginId()
+        {
+            return _userHelper.GetCurrentUser()?.LoginId ?? "unknown";
+        }
+
+        // Wrapper so the history/block join can be filtered and ordered before projection.
+        private sealed class HistoryWithBlock
+        {
+            public ContentHistory History { get; set; } = null!;
+            public ContentBlock Block { get; set; } = null!;
+        }
+
+        private static List<string> CleanList(ICollection<string> values)
+        {
+            return values
+                .Where(v => !string.IsNullOrWhiteSpace(v))
+                .Select(v => v.Trim())
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsDownloadRateLimiting.cs b/web/Areas/CMS/Services/CmsDownloadRateLimiting.cs
new file mode 100644
index 000000000..c3a8cf90d
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsDownloadRateLimiting.cs
@@ -0,0 +1,118 @@
+using System.Globalization;
+using System.Threading.RateLimiting;
+using Viper.Classes.Utilities;
+
+namespace Viper.Areas.CMS.Services
+{
+    /// <summary>
+    /// Rate limiting for the CMS download endpoint (/CMS/Files). ZIP requests assemble
+    /// multi-file archives in memory, so they get a strict token bucket; single-file
+    /// downloads get a generous sliding window that allows image-heavy pages but stops
+    /// sustained scraping. Buckets are per login id when authenticated, per client IP
+    /// otherwise (forwarded headers are already resolved for the Cloudflare/F5 chain,
+    /// so RemoteIpAddress is the real client on TEST/PROD).
+    /// </summary>
+    public static class CmsDownloadRateLimiting
+    {
+        public const string PolicyName = "CmsDownloads";
+
+        private const string ZipPrefix = "zip|";
+        private const string FilePrefix = "file|";
+
+        // Defaults; override under CMS:DownloadRateLimit in appsettings.
+        private const int DefaultFilePermitsPerMinute = 100;
+        private const int DefaultZipTokenLimit = 5;
+        private const int DefaultZipTokensPerMinute = 1;
+
+        public static IServiceCollection AddCmsDownloadRateLimiting(this IServiceCollection services, IConfiguration configuration)
+        {
+            int filePermits = configuration.GetValue("CMS:DownloadRateLimit:FilePermitsPerMinute", DefaultFilePermitsPerMinute);
+            int zipTokenLimit = configuration.GetValue("CMS:DownloadRateLimit:ZipTokenLimit", DefaultZipTokenLimit);
+            int zipTokensPerMinute = configuration.GetValue("CMS:DownloadRateLimit:ZipTokensPerMinute", DefaultZipTokensPerMinute);
+
+            // Misconfigured (zero/negative) values would make the limiter option
+            // constructors throw on the first request, so fall back to defaults.
+            if (filePermits <= 0) filePermits = DefaultFilePermitsPerMinute;
+            if (zipTokenLimit <= 0) zipTokenLimit = DefaultZipTokenLimit;
+            if (zipTokensPerMinute <= 0) zipTokensPerMinute = DefaultZipTokensPerMinute;
+
+            services.AddRateLimiter(options =>
+            {
+                options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+                options.OnRejected = async (context, ct) =>
+                {
+                    var httpContext = context.HttpContext;
+
+                    // Visibility for tuning the limits on TEST/PROD. Partition key is the
+                    // CAS login or proxy-resolved client IP, not raw user input.
+                    httpContext.RequestServices
+                        .GetRequiredService<ILoggerFactory>()
+                        .CreateLogger(nameof(CmsDownloadRateLimiting))
+                        .LogInformation("Download rate limit hit for {PartitionKey} on {Path}",
+                            GetPartitionKey(httpContext),
+                            LogSanitizer.SanitizeString(httpContext.Request.Path));
+
+                    // A response already in flight can't take headers or a new body.
+                    if (httpContext.Response.HasStarted)
+                    {
+                        return;
+                    }
+
+                    if (context.Lease.TryGetMetadata(MetadataName.RetryAfter, out var retryAfter))
+                    {
+                        httpContext.Response.Headers.RetryAfter =
+                            ((int)Math.Ceiling(retryAfter.TotalSeconds)).ToString(CultureInfo.InvariantCulture);
+                    }
+                    httpContext.Response.ContentType = "text/plain";
+                    await httpContext.Response.WriteAsync(
+                        "Too many download requests. Please wait a moment and try again.", ct);
+                };
+
+                options.AddPolicy(PolicyName, httpContext =>
+                {
+                    var key = GetPartitionKey(httpContext);
+                    return key.StartsWith(ZipPrefix, StringComparison.Ordinal)
+                        ? RateLimitPartition.GetTokenBucketLimiter(key, _ => new TokenBucketRateLimiterOptions
+                        {
+                            TokenLimit = zipTokenLimit,
+                            ReplenishmentPeriod = TimeSpan.FromMinutes(1),
+                            TokensPerPeriod = zipTokensPerMinute,
+                            AutoReplenishment = true,
+                            QueueLimit = 0
+                        })
+                        : RateLimitPartition.GetSlidingWindowLimiter(key, _ => new SlidingWindowRateLimiterOptions
+                        {
+                            PermitLimit = filePermits,
+                            Window = TimeSpan.FromMinutes(1),
+                            SegmentsPerWindow = 6,
+                            QueueLimit = 0
+                        });
+                });
+            });
+
+            return services;
+        }
+
+        /// <summary>
+        /// Partition key: request type (zip vs single file, matching CMSController.Files'
+        /// dispatch on the ids parameter) plus the caller's login id, or client IP for
+        /// anonymous/public requests.
+        /// </summary>
+        public static string GetPartitionKey(HttpContext httpContext)
+        {
+            string prefix = IsZipRequest(httpContext) ? ZipPrefix : FilePrefix;
+            string? login = httpContext.User.Identity?.IsAuthenticated == true
+                ? httpContext.User.Identity.Name
+                : null;
+            string caller = !string.IsNullOrEmpty(login)
+                ? login
+                : httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown";
+            return prefix + caller;
+        }
+
+        public static bool IsZipRequest(HttpContext httpContext)
+        {
+            return !string.IsNullOrEmpty(httpContext.Request.Query["ids"]);
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileAuditService.cs b/web/Areas/CMS/Services/CmsFileAuditService.cs
new file mode 100644
index 000000000..7b9cccee1
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileAuditService.cs
@@ -0,0 +1,132 @@
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Models;
+using Viper.Classes.SQLContext;
+using Viper.Classes.Utilities;
+using Viper.Models.VIPER;
+using File = Viper.Models.VIPER.File;
+
+namespace Viper.Areas.CMS.Services
+{
+    /// <summary>
+    /// File audit actions, matching the legacy ColdFusion FileAudit.cfc action names so the
+    /// shared fileAudit table stays consistent across both systems.
+    /// </summary>
+    public static class CmsFileAuditActions
+    {
+        public const string UploadFile = "UploadFile";
+        public const string AddFile = "AddFile";
+        public const string EditFile = "EditFile";
+        public const string DeleteFile = "DeleteFile";
+        public const string CancelDelete = "CancelDelete";
+        public const string ImportFile = "ImportFile";
+        public const string AccessFile = "AccessFile";
+        public const string AccessFileDenied = "AccessFileDenied";
+    }
+
+    public class CmsFileAuditFilter
+    {
+        public Guid? FileGuid { get; set; }
+        public string? Action { get; set; }
+        public string? LoginId { get; set; }
+        public DateTime? From { get; set; }
+        public DateTime? To { get; set; }
+        public string? Search { get; set; }
+    }
+
+    public interface ICmsFileAuditService
+    {
+        /// <summary>Add an audit row for a file operation. Does not call SaveChanges.</summary>
+        void Audit(File file, string action, string detail = "");
+
+        Task<List<FileAudit>> GetAuditEntriesAsync(CmsFileAuditFilter filter, int page, int perPage, CancellationToken ct = default);
+
+        Task<int> GetAuditEntryCountAsync(CmsFileAuditFilter filter, CancellationToken ct = default);
+    }
+
+    public class CmsFileAuditService : ICmsFileAuditService
+    {
+        private readonly VIPERContext _context;
+        private readonly IUserHelper _userHelper;
+
+        public CmsFileAuditService(VIPERContext context, IUserHelper userHelper)
+        {
+            _context = context;
+            _userHelper = userHelper;
+        }
+
+        public void Audit(File file, string action, string detail = "")
+        {
+            var user = _userHelper.GetCurrentUser();
+            var metaData = new CMSFileMetaData
+            {
+                Folder = file.Folder,
+                Encrypted = file.Encrypted,
+                Public = file.AllowPublicAccess,
+                Modified = file.ModifiedOn.ToString("yyyy-MM-dd HH:mm:ss"),
+                ModifiedBy = file.ModifiedBy
+            };
+
+            _context.FileAudits.Add(new FileAudit
+            {
+                Timestamp = DateTime.Now,
+                Loginid = user?.LoginId,
+                Action = action,
+                Detail = detail,
+                FileGuid = file.FileGuid,
+                FilePath = file.FilePath,
+                IamId = user?.IamId,
+                FileMetaData = JsonSerializer.Serialize(metaData),
+                ClientData = JsonSerializer.Serialize(_userHelper.GetClientData())
+            });
+        }
+
+        public async Task<List<FileAudit>> GetAuditEntriesAsync(CmsFileAuditFilter filter, int page, int perPage, CancellationToken ct = default)
+        {
+            return await BuildQuery(filter)
+                .OrderByDescending(a => a.Timestamp)
+                .ThenByDescending(a => a.AuditId)
+                .Skip((page - 1) * perPage)
+                .Take(perPage)
+                .ToListAsync(ct);
+        }
+
+        public async Task<int> GetAuditEntryCountAsync(CmsFileAuditFilter filter, CancellationToken ct = default)
+        {
+            return await BuildQuery(filter).CountAsync(ct);
+        }
+
+        private IQueryable<FileAudit> BuildQuery(CmsFileAuditFilter filter)
+        {
+            var query = _context.FileAudits.AsNoTracking();
+            if (filter.FileGuid != null)
+            {
+                query = query.Where(a => a.FileGuid == filter.FileGuid);
+            }
+            if (!string.IsNullOrEmpty(filter.Action))
+            {
+                query = query.Where(a => a.Action == filter.Action);
+            }
+            if (!string.IsNullOrEmpty(filter.LoginId))
+            {
+                query = query.Where(a => a.Loginid == filter.LoginId);
+            }
+            if (filter.From != null)
+            {
+                query = query.Where(a => a.Timestamp >= filter.From);
+            }
+            if (filter.To != null)
+            {
+                // Treat the To date as inclusive through end of day.
+                var to = DateRangeHelper.ExclusiveUpperBound(filter.To.Value);
+                query = query.Where(a => a.Timestamp < to);
+            }
+            if (!string.IsNullOrEmpty(filter.Search))
+            {
+                query = query.Where(a => a.FilePath.Contains(filter.Search)
+                    || (a.Detail != null && a.Detail.Contains(filter.Search)));
+            }
+            return query;
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileCrypto.cs b/web/Areas/CMS/Services/CmsFileCrypto.cs
new file mode 100644
index 000000000..88cd0fa5d
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileCrypto.cs
@@ -0,0 +1,121 @@
+using System.Security.Cryptography;
+using System.Text;
+using Viper.Areas.CMS.Data;
+
+namespace Viper.Areas.CMS.Services
+{
+    /// <summary>
+    /// CMS file encryption primitives, byte-for-byte compatible with the legacy ColdFusion CMS
+    /// (CF encrypt()/encryptBinary() with algorithm "AES" = AES-128-ECB-PKCS7, key strings UU-encoded).
+    /// Both systems share the same files and database during the migration, so the format cannot
+    /// change until ColdFusion is decommissioned (see PLAN-CMS.md §12.6 for the GCM migration plan).
+    ///
+    /// Key model:
+    ///  - The master key is a base64 string on line 2 of viperfiles.txt.
+    ///  - Each file has its own random AES-128 key. The DB "key" column stores
+    ///    UUEncode(AES-ECB(masterKey, base64(fileKey))).
+    ///  - File contents are AES-ECB encrypted with the per-file key.
+    /// </summary>
+    public static class CmsFileCrypto
+    {
+        /// <summary>
+        /// Default location of the master key file for the current environment.
+        /// </summary>
+        public static string GetDefaultKeyFilePath()
+        {
+            string settingsFolder = HttpHelper.Environment?.EnvironmentName == "Development"
+                ? @"C:\Sites\Settings"
+                : @"S:\Settings";
+            return Path.Join(settingsFolder, "viperfiles.txt");
+        }
+
+        /// <summary>
+        /// Read the master key (base64 string) from line 2 of the key file.
+        /// </summary>
+        public static string ReadMasterKey(string keyFilePath)
+        {
+            string? masterKey = File.ReadLines(keyFilePath).Skip(1).FirstOrDefault();
+            if (string.IsNullOrWhiteSpace(masterKey))
+            {
+                throw new InvalidOperationException("CMS master key file is missing the key line.");
+            }
+            return masterKey.Trim();
+        }
+
+        /// <summary>
+        /// Generate a new random per-file AES-128 key, returned as base64 (the format CF
+        /// generateSecretKey("AES") produced).
+        /// </summary>
+        public static string GenerateFileKey()
+        {
+            return Convert.ToBase64String(RandomNumberGenerator.GetBytes(16));
+        }
+
+        /// <summary>
+        /// Encrypt a per-file key for storage in the files.key column:
+        /// UUEncode(AES-ECB(masterKey, UTF8(fileKeyBase64))).
+        /// </summary>
+        public static string EncryptDbKey(string fileKeyBase64, string masterKeyBase64)
+        {
+            byte[] cipher = EncryptEcb(Encoding.UTF8.GetBytes(fileKeyBase64), Convert.FromBase64String(masterKeyBase64));
+            using MemoryStream input = new(cipher);
+            using MemoryStream output = new();
+            Codecs.UUEncode(input, output);
+            return Encoding.ASCII.GetString(output.ToArray());
+        }
+
+        /// <summary>
+        /// Decrypt a files.key column value back to the per-file key (base64 string).
+        /// Mirrors legacy CF decrypt(key, masterKey, "AES") with default UU encoding.
+        /// </summary>
+        public static string DecryptDbKey(string dbKey, string masterKeyBase64)
+        {
+            using MemoryStream input = new(Encoding.ASCII.GetBytes(dbKey));
+            using MemoryStream decoded = new();
+            Codecs.UUDecode(input, decoded);
+            byte[] plain = DecryptEcb(decoded.ToArray(), Convert.FromBase64String(masterKeyBase64));
+            return Encoding.UTF8.GetString(plain);
+        }
+
+        /// <summary>
+        /// Encrypt file contents with a per-file key (base64), matching CF encryptBinary(data, key, "AES").
+        /// </summary>
+        public static byte[] EncryptBytes(byte[] data, string fileKeyBase64)
+        {
+            return EncryptEcb(data, Convert.FromBase64String(fileKeyBase64));
+        }
+
+        /// <summary>
+        /// Decrypt file contents with a per-file key (base64), matching CF decryptBinary(data, key, "AES").
+        /// </summary>
+        public static byte[] DecryptBytes(byte[] data, string fileKeyBase64)
+        {
+            return DecryptEcb(data, Convert.FromBase64String(fileKeyBase64));
+        }
+
+        private static byte[] EncryptEcb(byte[] data, byte[] key)
+        {
+            using Aes aes = CreateCfCompatibleAes(key);
+            using ICryptoTransform encryptor = aes.CreateEncryptor();
+            return encryptor.TransformFinalBlock(data, 0, data.Length);
+        }
+
+        private static byte[] DecryptEcb(byte[] data, byte[] key)
+        {
+            using Aes aes = CreateCfCompatibleAes(key);
+            using ICryptoTransform decryptor = aes.CreateDecryptor();
+            return decryptor.TransformFinalBlock(data, 0, data.Length);
+        }
+
+        private static Aes CreateCfCompatibleAes(byte[] key)
+        {
+            Aes aes = Aes.Create();
+            // Settings match ColdFusion's "AES" algorithm defaults; ECB is required for
+            // compatibility with existing encrypted files (GCM migration is planned post-CF).
+            aes.Mode = CipherMode.ECB;
+            aes.Padding = PaddingMode.PKCS7;
+            aes.Key = key;
+            return aes;
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileEncryptionService.cs b/web/Areas/CMS/Services/CmsFileEncryptionService.cs
new file mode 100644
index 000000000..44d5e5488
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileEncryptionService.cs
@@ -0,0 +1,99 @@
+namespace Viper.Areas.CMS.Services
+{
+    public interface ICmsFileEncryptionService
+    {
+        /// <summary>
+        /// Generate a new per-file key, returned in the encrypted form stored in files.key.
+        /// </summary>
+        string GenerateKeyForDb();
+
+        byte[] Encrypt(byte[] data, string dbKey);
+
+        byte[] Decrypt(byte[] data, string dbKey);
+
+        void EncryptFileInPlace(string filePath, string dbKey);
+
+        void DecryptFileInPlace(string filePath, string dbKey);
+    }
+
+    /// <summary>
+    /// DI wrapper around <see cref="CmsFileCrypto"/> that resolves and caches the master key.
+    /// Registered by the Scrutor convention scan of Viper.Areas.CMS.Services.
+    /// </summary>
+    public class CmsFileEncryptionService : ICmsFileEncryptionService
+    {
+        private readonly Lazy<string> _masterKey;
+
+        public CmsFileEncryptionService(IConfiguration configuration)
+        {
+            string keyFilePath = configuration["CMS:EncryptionKeyFile"] ?? CmsFileCrypto.GetDefaultKeyFilePath();
+            _masterKey = new Lazy<string>(() => CmsFileCrypto.ReadMasterKey(keyFilePath));
+        }
+
+        public string GenerateKeyForDb()
+        {
+            return CmsFileCrypto.EncryptDbKey(CmsFileCrypto.GenerateFileKey(), _masterKey.Value);
+        }
+
+        public byte[] Encrypt(byte[] data, string dbKey)
+        {
+            return CmsFileCrypto.EncryptBytes(data, CmsFileCrypto.DecryptDbKey(dbKey, _masterKey.Value));
+        }
+
+        public byte[] Decrypt(byte[] data, string dbKey)
+        {
+            return CmsFileCrypto.DecryptBytes(data, CmsFileCrypto.DecryptDbKey(dbKey, _masterKey.Value));
+        }
+
+        public void EncryptFileInPlace(string filePath, string dbKey)
+        {
+            ReplaceFileContents(filePath, contents => Encrypt(contents, dbKey));
+        }
+
+        public void DecryptFileInPlace(string filePath, string dbKey)
+        {
+            ReplaceFileContents(filePath, contents => Decrypt(contents, dbKey));
+        }
+
+        /// <summary>
+        /// Rewrite a file via a temp file in the same directory so an interrupted write
+        /// can't leave the target truncated or half-transformed.
+        /// </summary>
+        private static void ReplaceFileContents(string filePath, Func<byte[], byte[]> transform)
+        {
+            byte[] contents = File.ReadAllBytes(filePath);
+            string tempPath = filePath + ".tmp";
+            try
+            {
+                File.WriteAllBytes(tempPath, transform(contents));
+                File.Move(tempPath, filePath, overwrite: true);
+            }
+            catch (IOException)
+            {
+                CleanUpTempFile(tempPath);
+                throw;
+            }
+            catch (UnauthorizedAccessException)
+            {
+                CleanUpTempFile(tempPath);
+                throw;
+            }
+        }
+
+        private static void CleanUpTempFile(string tempPath)
+        {
+            try
+            {
+                File.Delete(tempPath);
+            }
+            catch (IOException)
+            {
+                // Best effort; the orphaned .tmp file is harmless and the original error matters more.
+            }
+            catch (UnauthorizedAccessException)
+            {
+                // Best effort; see above.
+            }
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileImportService.cs b/web/Areas/CMS/Services/CmsFileImportService.cs
new file mode 100644
index 000000000..e5b6e8c6e
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileImportService.cs
@@ -0,0 +1,415 @@
+using Microsoft.Data.SqlClient;
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Classes.SQLContext;
+using Viper.Classes.Utilities;
+using File = Viper.Models.VIPER.File;
+
+namespace Viper.Areas.CMS.Services
+{
+    public interface ICmsFileImportService
+    {
+        Task<List<CmsFileImportResult>> ImportFilesAsync(CmsFileImportRequest request, CancellationToken ct = default);
+
+        /// <summary>Dry-run of an import request: validates each path and reports the resulting names without moving anything.</summary>
+        Task<List<CmsFileImportPreviewResult>> PreviewImportAsync(CmsFileImportRequest request, CancellationToken ct = default);
+
+        Task<List<CmsBulkEncryptResult>> BulkEncryptAsync(List<Guid> fileGuids, CancellationToken ct = default);
+    }
+
+    /// <summary>
+    /// Bulk file tools mirroring the legacy CMS: import loose files from the legacy VIPER
+    /// webroot into the managed store (recording the original path as oldURL so legacy links
+    /// keep working via the oldURL lookup), and bulk-encrypt existing unencrypted files.
+    /// </summary>
+    public class CmsFileImportService : ICmsFileImportService
+    {
+        private readonly VIPERContext _context;
+        private readonly ICmsFileStorageService _storage;
+        private readonly ICmsFileEncryptionService _encryption;
+        private readonly ICmsFileAuditService _audit;
+        private readonly IUserHelper _userHelper;
+        private readonly ILogger<CmsFileImportService> _logger;
+        private readonly string? _legacyWebroot;
+
+        public CmsFileImportService(VIPERContext context, ICmsFileStorageService storage,
+            ICmsFileEncryptionService encryption, ICmsFileAuditService audit, IUserHelper userHelper,
+            IConfiguration configuration, ILogger<CmsFileImportService> logger)
+        {
+            _context = context;
+            _storage = storage;
+            _encryption = encryption;
+            _audit = audit;
+            _userHelper = userHelper;
+            _logger = logger;
+            _legacyWebroot = configuration["CMS:LegacyWebrootPath"]
+                ?? (HttpHelper.Environment?.EnvironmentName == "Development" ? @"C:\Sites\https\VIPER" : null);
+        }
+
+        public async Task<List<CmsFileImportResult>> ImportFilesAsync(CmsFileImportRequest request, CancellationToken ct = default)
+        {
+            if (string.IsNullOrEmpty(_legacyWebroot))
+            {
+                throw new InvalidOperationException("CMS:LegacyWebrootPath is not configured for this environment.");
+            }
+            if (!_storage.IsValidFolder(request.Folder))
+            {
+                throw new ArgumentException("Invalid folder.");
+            }
+
+            var permissions = request.Permissions
+                .Where(p => !string.IsNullOrWhiteSpace(p))
+                .Select(p => p.Trim())
+                .ToList();
+            if (request.UseDefaultPermission == true)
+            {
+                string topFolder = request.Folder.Split(['\\', '/'], StringSplitOptions.None)[0];
+                permissions.Add("SVMSecure." + topFolder);
+            }
+            permissions = permissions.Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+
+            var results = new List<CmsFileImportResult>();
+            foreach (var rawPath in request.FilePaths.Where(p => !string.IsNullOrWhiteSpace(p)))
+            {
+                results.Add(await ImportSingleFileAsync(rawPath.Trim(), request, permissions, ct));
+            }
+            return results;
+        }
+
+        public async Task<List<CmsFileImportPreviewResult>> PreviewImportAsync(CmsFileImportRequest request, CancellationToken ct = default)
+        {
+            if (string.IsNullOrEmpty(_legacyWebroot))
+            {
+                throw new InvalidOperationException("CMS:LegacyWebrootPath is not configured for this environment.");
+            }
+            if (!_storage.IsValidFolder(request.Folder))
+            {
+                throw new ArgumentException("Invalid folder.");
+            }
+
+            var results = new List<CmsFileImportPreviewResult>();
+            var seenSources = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            var plannedNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+            foreach (var rawPath in request.FilePaths.Where(p => !string.IsNullOrWhiteSpace(p)).Select(p => p.Trim()))
+            {
+                var result = new CmsFileImportPreviewResult { FilePath = rawPath };
+                results.Add(result);
+
+                var source = ResolveSource(rawPath);
+                if (source.Error != null)
+                {
+                    result.Message = source.Error;
+                    continue;
+                }
+                if (!seenSources.Add(source.SourcePath))
+                {
+                    result.Message = "Duplicate of an earlier line.";
+                    continue;
+                }
+
+                // GetAvailableFileName only sees disk + DB, so two source files sharing a basename
+                // would both preview the same name. Reserving each planned name (as the sequential
+                // import writes would) makes a later line resolve to the same unique name the import
+                // actually assigns it, instead of advertising one it will lose.
+                string availableOnStore = _storage.GetAvailableFileName(request.Folder, source.FileName);
+                bool sharesNameWithEarlierLine = plannedNames.Contains(availableOnStore);
+                string finalName = sharesNameWithEarlierLine
+                    ? _storage.GetAvailableFileName(request.Folder, source.FileName, plannedNames)
+                    : availableOnStore;
+                string friendlyName = CmsFileNaming.BuildFriendlyName(request.Folder, finalName);
+                if (await _context.Files.AnyAsync(f => f.FriendlyName == friendlyName, ct))
+                {
+                    result.Message = $"A file with the name {friendlyName} already exists.";
+                    continue;
+                }
+                plannedNames.Add(finalName);
+
+                result.CanImport = true;
+                result.FileName = finalName;
+                if (!string.Equals(finalName, source.FileName, StringComparison.OrdinalIgnoreCase))
+                {
+                    result.RenamedFrom = source.FileName;
+                }
+                result.FriendlyName = friendlyName;
+                result.OldUrl = "/" + source.Relative.Replace('\\', '/');
+                if (sharesNameWithEarlierLine)
+                {
+                    result.Message = "Shares a name with an earlier line in this import; renamed to keep both.";
+                }
+            }
+            return results;
+        }
+
+        private sealed record SourceResolution(string Relative, string SourcePath, string FileName, string? Error);
+
+        /// <summary>
+        /// Resolves a legacy-webroot path and runs the validations shared by preview and
+        /// import, so the preview can't promise something the import would reject.
+        /// </summary>
+        private SourceResolution ResolveSource(string rawPath)
+        {
+            // Import lines are legacy Windows webroot paths; treat both separator styles as separators
+            // and rejoin with the host separator so parsing and traversal detection are identical on
+            // every OS. Path APIs only honor the host separator, so on Linux a "..\" segment would
+            // otherwise be read as part of a filename and slip past the outside-webroot check.
+            var segments = rawPath.Replace('\\', '/').Split('/', StringSplitOptions.RemoveEmptyEntries);
+            string relative = string.Join('/', segments);
+            string sourcePath;
+            string fileName;
+            try
+            {
+                sourcePath = Path.GetFullPath(Path.Join(_legacyWebroot, Path.Join(segments)));
+                fileName = Path.GetFileName(sourcePath);
+            }
+            catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+            {
+                return new SourceResolution(relative, string.Empty, string.Empty, "Path is not valid.");
+            }
+            string webroot = Path.GetFullPath(_legacyWebroot! + Path.DirectorySeparatorChar);
+
+            string? error = null;
+            if (!sourcePath.StartsWith(webroot, StringComparison.OrdinalIgnoreCase))
+            {
+                error = "Path is outside the legacy webroot.";
+            }
+            else if (!System.IO.File.Exists(sourcePath))
+            {
+                error = "File not found.";
+            }
+            else if (!CmsFileTypes.IsAllowedFileName(fileName))
+            {
+                error = "File type is not allowed.";
+            }
+            return new SourceResolution(relative, sourcePath, fileName, error);
+        }
+
+        private async Task<CmsFileImportResult> ImportSingleFileAsync(string rawPath, CmsFileImportRequest request,
+            List<string> permissions, CancellationToken ct)
+        {
+            var result = new CmsFileImportResult { FilePath = rawPath };
+            try
+            {
+                var source = ResolveSource(rawPath);
+                if (source.Error != null)
+                {
+                    result.Message = source.Error;
+                    return result;
+                }
+                string sourcePath = source.SourcePath;
+
+                bool encrypt = request.Encrypt ?? false;
+                string? dbKey = encrypt ? _encryption.GenerateKeyForDb() : null;
+
+                // Copy to temp, transform, move into the store; the source is removed only
+                // after the import fully succeeds (legacy used move semantics).
+                string tempPath = Path.Join(Path.GetTempPath(), "Viper-CMS-Uploads", Guid.NewGuid().ToString("N"));
+                System.IO.Directory.CreateDirectory(Path.GetDirectoryName(tempPath)!);
+
+                string finalPath;
+                try
+                {
+                    // Copy inside the try so a partial copy (e.g. disk full) is removed by the finally.
+                    System.IO.File.Copy(sourcePath, tempPath);
+                    if (dbKey != null)
+                    {
+                        _encryption.EncryptFileInPlace(tempPath, dbKey);
+                    }
+                    finalPath = _storage.MoveIntoPlace(tempPath, request.Folder, source.FileName, makeUnique: true);
+                }
+                finally
+                {
+                    if (System.IO.File.Exists(tempPath))
+                    {
+                        System.IO.File.Delete(tempPath);
+                    }
+                }
+
+                string friendlyName = CmsFileNaming.BuildFriendlyName(request.Folder, Path.GetFileName(finalPath));
+                if (await _context.Files.AnyAsync(f => f.FriendlyName == friendlyName, ct))
+                {
+                    _storage.DeleteManagedFile(finalPath);
+                    result.Message = $"A file with the name {friendlyName} already exists.";
+                    return result;
+                }
+
+                var entity = new File
+                {
+                    FileGuid = Guid.NewGuid(),
+                    FilePath = finalPath,
+                    Folder = request.Folder,
+                    FriendlyName = friendlyName,
+                    Encrypted = encrypt,
+                    Key = dbKey,
+                    Description = "Automatically imported from Viper",
+                    AllowPublicAccess = request.AllowPublicAccess ?? false,
+                    OldUrl = "/" + source.Relative.Replace('\\', '/'),
+                    ModifiedOn = DateTime.Now,
+                    ModifiedBy = CurrentLoginId()
+                };
+                foreach (var permission in permissions)
+                {
+                    entity.FileToPermissions.Add(new Viper.Models.VIPER.FileToPermission { FileGuid = entity.FileGuid, Permission = permission });
+                }
+
+                _context.Files.Add(entity);
+                _audit.Audit(entity, CmsFileAuditActions.ImportFile, $"Imported from {entity.OldUrl}");
+                try
+                {
+                    await _context.SaveChangesAsync(ct);
+                }
+                catch (OperationCanceledException)
+                {
+                    // A cancelled save never persisted the record: drop the pending entity and the
+                    // stored copy so the abort leaves nothing orphaned, then let it propagate.
+                    _context.ChangeTracker.Clear();
+                    _storage.DeleteManagedFile(finalPath);
+                    throw;
+                }
+                catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
+                {
+                    // Drop the failed entities so they can't poison later saves in this batch,
+                    // and remove the stored copy; the untouched source can be re-imported.
+                    _context.ChangeTracker.Clear();
+                    _storage.DeleteManagedFile(finalPath);
+                    result.Message = ex.InnerException?.Message ?? ex.Message;
+                    return result;
+                }
+
+                try
+                {
+                    System.IO.File.Delete(sourcePath);
+                }
+                catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+                {
+                    // The record is saved and the managed copy is in place, so the import
+                    // succeeded; only the legacy source could not be removed. Re-importing it
+                    // would now fail on the duplicate name, so report success with a note.
+                    _logger.LogWarning(ex, "CMS import succeeded but the legacy source could not be removed: {Path}",
+                        LogSanitizer.SanitizeString(sourcePath));
+                    result.Message = "Imported, but the original file could not be removed from the legacy webroot.";
+                }
+
+                result.Success = true;
+                result.FileGuid = entity.FileGuid;
+                result.FriendlyName = friendlyName;
+                return result;
+            }
+            catch (IOException ex)
+            {
+                result.Message = ex.Message;
+                return result;
+            }
+            catch (UnauthorizedAccessException ex)
+            {
+                result.Message = ex.Message;
+                return result;
+            }
+            catch (InvalidOperationException ex)
+            {
+                result.Message = ex.Message;
+                return result;
+            }
+            catch (ArgumentException ex)
+            {
+                result.Message = ex.Message;
+                return result;
+            }
+        }
+
+        public async Task<List<CmsBulkEncryptResult>> BulkEncryptAsync(List<Guid> fileGuids, CancellationToken ct = default)
+        {
+            var results = new List<CmsBulkEncryptResult>();
+            foreach (var fileGuid in fileGuids.Distinct())
+            {
+                results.Add(await EncryptSingleFileAsync(fileGuid, ct));
+            }
+            return results;
+        }
+
+        private async Task<CmsBulkEncryptResult> EncryptSingleFileAsync(Guid fileGuid, CancellationToken ct)
+        {
+            var result = new CmsBulkEncryptResult { FileGuid = fileGuid };
+            var file = await _context.Files.FirstOrDefaultAsync(f => f.FileGuid == fileGuid, ct);
+            if (file == null)
+            {
+                result.Message = "File not found.";
+                return result;
+            }
+            result.FriendlyName = file.FriendlyName;
+            if (file.Encrypted)
+            {
+                result.Message = "Already encrypted.";
+                return result;
+            }
+            if (!_storage.ManagedFileExists(file.FilePath))
+            {
+                result.Message = "File is missing on disk.";
+                return result;
+            }
+
+            try
+            {
+                string dbKey = _encryption.GenerateKeyForDb();
+                _encryption.EncryptFileInPlace(file.FilePath, dbKey);
+                file.Key = dbKey;
+                file.Encrypted = true;
+                file.ModifiedOn = DateTime.Now;
+                file.ModifiedBy = CurrentLoginId();
+                _audit.Audit(file, CmsFileAuditActions.EditFile, "Encrypted file (bulk)");
+                try
+                {
+                    // The file is already encrypted on disk; cancelling this save would lose the
+                    // key, so it runs to completion even if the request is aborted.
+                    await _context.SaveChangesAsync(CancellationToken.None);
+                    result.Success = true;
+                }
+                catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException)
+                {
+                    // A save failure (DB, SQL, or invalid entity state) means the key was never
+                    // persisted; the file must be decrypted back or it is unrecoverable. Anything
+                    // else is truly unexpected and is left to propagate.
+                    RollBackUnsavedEncryption(file, dbKey, ex, result);
+                }
+            }
+            catch (IOException ex)
+            {
+                result.Message = ex.Message;
+            }
+            catch (UnauthorizedAccessException ex)
+            {
+                result.Message = ex.Message;
+            }
+            catch (InvalidOperationException ex)
+            {
+                result.Message = ex.Message;
+            }
+            return result;
+        }
+
+        /// <summary>
+        /// A failed save means the key was never persisted, so decrypt the file back to plain
+        /// text and drop the pending changes so they can't poison later saves in the batch.
+        /// </summary>
+        private void RollBackUnsavedEncryption(File file, string dbKey, Exception saveEx, CmsBulkEncryptResult result)
+        {
+            _context.ChangeTracker.Clear();
+            try
+            {
+                _encryption.DecryptFileInPlace(file.FilePath, dbKey);
+                result.Message = saveEx.InnerException?.Message ?? saveEx.Message;
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                result.Message = $"{saveEx.Message} The file could not be restored ({ex.Message}); "
+                    + "it is encrypted on disk but the key was not saved. Restore it from backup.";
+            }
+        }
+
+        private string CurrentLoginId()
+        {
+            return _userHelper.GetCurrentUser()?.LoginId ?? "unknown";
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileResponse.cs b/web/Areas/CMS/Services/CmsFileResponse.cs
new file mode 100644
index 000000000..5b740423d
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileResponse.cs
@@ -0,0 +1,28 @@
+using Microsoft.Net.Http.Headers;
+using Viper.Areas.CMS.Constants;
+
+namespace Viper.Areas.CMS.Services
+{
+    /// <summary>
+    /// Response hardening shared by the CMS file download paths (/CMS/Files). Every file response
+    /// gets X-Content-Type-Options: nosniff so a benign-typed upload cannot be MIME-sniffed into an
+    /// active type, and inline-unsafe types (html/svg/...) are forced to download instead of
+    /// rendering in the app origin.
+    /// </summary>
+    public static class CmsFileResponse
+    {
+        public static void SetNoSniff(HttpResponse response)
+        {
+            response.Headers[HeaderNames.XContentTypeOptions] = "nosniff";
+        }
+
+        /// <summary>
+        /// Content-Disposition type for a served file: "attachment" for types a browser would
+        /// execute/render inline, "inline" for everything else.
+        /// </summary>
+        public static string DispositionType(string fileName)
+        {
+            return CmsFileTypes.ShouldForceAttachment(fileName) ? "attachment" : "inline";
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileService.cs b/web/Areas/CMS/Services/CmsFileService.cs
new file mode 100644
index 000000000..6cd6f8793
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileService.cs
@@ -0,0 +1,850 @@
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Constants;
+using Viper.Areas.CMS.Models;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Classes.SQLContext;
+using Viper.Classes.Utilities;
+using File = Viper.Models.VIPER.File;
+
+namespace Viper.Areas.CMS.Services
+{
+    public interface ICmsFileService
+    {
+        Task<(List<CmsFileDto> Files, int Total)> GetFilesAsync(string? folder, string status, string? search,
+            bool? encrypted, bool? isPublic, int page, int perPage, string? sortBy, bool descending,
+            string? restrictDeletedToOwner = null, CancellationToken ct = default);
+
+        Task<List<CmsFolderCountDto>> GetFolderCountsAsync(string status, bool? encrypted, bool? isPublic,
+            string? restrictDeletedToOwner = null, CancellationToken ct = default);
+
+        Task<CmsFileNameCheckDto> CheckNameAsync(string folder, string fileName, CancellationToken ct = default);
+
+        Task<CmsFileDto?> GetFileAsync(Guid fileGuid, CancellationToken ct = default);
+
+        Task<CmsFileDto> CreateFileAsync(CmsFileCreateRequest request, IFormFile file, CancellationToken ct = default);
+
+        Task<CmsFileDto?> UpdateFileAsync(Guid fileGuid, CmsFileUpdateRequest request, IFormFile? file, CancellationToken ct = default);
+
+        Task<bool> SoftDeleteFileAsync(Guid fileGuid, CancellationToken ct = default);
+
+        Task<bool> RestoreFileAsync(Guid fileGuid, CancellationToken ct = default);
+
+        Task<bool> PermanentlyDeleteFileAsync(Guid fileGuid, CancellationToken ct = default);
+
+        /// <summary>
+        /// Permanently deletes trashed files whose DeletedOn is older than <paramref name="retentionDays"/>.
+        /// Used by the trash-purge scheduled job. Returns the number of files purged.
+        /// </summary>
+        Task<int> PurgeDeletedFilesAsync(int retentionDays, CancellationToken ct = default);
+    }
+
+    /// <summary>
+    /// Management operations for CMS files (the admin side; downloads are served by
+    /// CMSController/Data.CMS). Behavior mirrors the legacy ColdFusion Files.cfc:
+    /// friendly names are folder-filename with backslashes dashed, permission and person
+    /// lists are replaced as deltas, and every operation writes a fileAudit row.
+    /// </summary>
+    public class CmsFileService : ICmsFileService
+    {
+        private readonly VIPERContext _context;
+        private readonly AAUDContext _aaudContext;
+        private readonly ICmsFileStorageService _storage;
+        private readonly ICmsFileEncryptionService _encryption;
+        private readonly ICmsFileAuditService _audit;
+        private readonly IUserHelper _userHelper;
+        private readonly ILogger<CmsFileService> _logger;
+
+        public CmsFileService(VIPERContext context, AAUDContext aaudContext, ICmsFileStorageService storage,
+            ICmsFileEncryptionService encryption, ICmsFileAuditService audit, IUserHelper userHelper,
+            ILogger<CmsFileService> logger)
+        {
+            _context = context;
+            _aaudContext = aaudContext;
+            _storage = storage;
+            _encryption = encryption;
+            _audit = audit;
+            _userHelper = userHelper;
+            _logger = logger;
+        }
+
+        public async Task<(List<CmsFileDto> Files, int Total)> GetFilesAsync(string? folder, string status, string? search,
+            bool? encrypted, bool? isPublic, int page, int perPage, string? sortBy, bool descending,
+            string? restrictDeletedToOwner = null, CancellationToken ct = default)
+        {
+            var query = _context.Files
+                .AsNoTracking()
+                .Include(f => f.FileToPermissions)
+                .Include(f => f.FileToPeople)
+                .AsSplitQuery()
+                .TagWith("CmsFileService.GetFiles")
+                .AsQueryable();
+
+            if (!string.IsNullOrEmpty(folder))
+            {
+                // Folder may have subfolders stored as "folder\sub"; match the top-level folder.
+                var folderPrefix = folder + @"\";
+                query = query.Where(f => f.Folder == folder || (f.Folder != null && f.Folder.StartsWith(folderPrefix)));
+            }
+
+            query = ApplyStatusFilter(query, status, restrictDeletedToOwner);
+
+            if (encrypted != null)
+            {
+                query = query.Where(f => f.Encrypted == encrypted);
+            }
+
+            if (isPublic != null)
+            {
+                query = query.Where(f => f.AllowPublicAccess == isPublic);
+            }
+
+            if (!string.IsNullOrEmpty(search))
+            {
+                query = query.Where(f => f.FriendlyName.Contains(search)
+                    || f.Description.Contains(search)
+                    || (f.OldUrl != null && f.OldUrl.Contains(search))
+                    || f.FilePath.Contains(search));
+            }
+
+            int total = await query.CountAsync(ct);
+
+            query = (sortBy?.ToLowerInvariant(), descending) switch
+            {
+                ("folder", false) => query.OrderBy(f => f.Folder).ThenBy(f => f.FriendlyName),
+                ("folder", true) => query.OrderByDescending(f => f.Folder).ThenBy(f => f.FriendlyName),
+                ("modifiedon", false) => query.OrderBy(f => f.ModifiedOn),
+                ("modifiedon", true) => query.OrderByDescending(f => f.ModifiedOn),
+                ("oldurl", false) => query.OrderBy(f => f.OldUrl),
+                ("oldurl", true) => query.OrderByDescending(f => f.OldUrl),
+                // Trash views: ascending = closest to the purge cutoff first.
+                ("deletedon", false) => query.OrderBy(f => f.DeletedOn).ThenBy(f => f.FriendlyName),
+                ("deletedon", true) => query.OrderByDescending(f => f.DeletedOn).ThenBy(f => f.FriendlyName),
+                (_, true) => query.OrderByDescending(f => f.FriendlyName),
+                _ => query.OrderBy(f => f.FriendlyName)
+            };
+
+            var files = await query
+                .Skip((page - 1) * perPage)
+                .Take(perPage)
+                .ToListAsync(ct);
+
+            var names = await GetNamesByIamIdAsync(files.SelectMany(f => f.FileToPeople.Select(p => p.IamId)), ct);
+            return (files.Select(f => CmsFileMapper.ToCmsFileDto(f, names)).ToList(), total);
+        }
+
+        public async Task<List<CmsFolderCountDto>> GetFolderCountsAsync(string status, bool? encrypted, bool? isPublic,
+            string? restrictDeletedToOwner = null, CancellationToken ct = default)
+        {
+            var query = _context.Files
+                .AsNoTracking()
+                .TagWith("CmsFileService.GetFolderCounts")
+                .AsQueryable();
+
+            query = ApplyStatusFilter(query, status, restrictDeletedToOwner);
+
+            if (encrypted != null)
+            {
+                query = query.Where(f => f.Encrypted == encrypted);
+            }
+
+            if (isPublic != null)
+            {
+                query = query.Where(f => f.AllowPublicAccess == isPublic);
+            }
+
+            var byFolder = await query
+                .GroupBy(f => f.Folder)
+                .Select(g => new { g.Key, Count = g.Count() })
+                .ToListAsync(ct);
+
+            // Folders may have subfolders stored as "folder\sub"; roll counts up to the
+            // top-level folder so they match the list's folder filter (GetFilesAsync).
+            return byFolder
+                .GroupBy(x => (x.Key ?? string.Empty).Split(['\\', '/'], StringSplitOptions.None)[0], StringComparer.OrdinalIgnoreCase)
+                .Where(g => !string.IsNullOrWhiteSpace(g.Key))
+                .Select(g => new CmsFolderCountDto { Folder = g.Key, Count = g.Sum(x => x.Count) })
+                .OrderBy(c => c.Folder, StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+
+        // restrictDeletedToOwner scopes deleted files to the login that deleted them (ModifiedBy),
+        // so non-admins only see files they trashed. Admins pass null and see the whole trash.
+        private static IQueryable<File> ApplyStatusFilter(IQueryable<File> query, string? status,
+            string? restrictDeletedToOwner = null)
+        {
+            return status?.ToLowerInvariant() switch
+            {
+                "active" => query.Where(f => f.DeletedOn == null),
+                "deleted" => restrictDeletedToOwner == null
+                    ? query.Where(f => f.DeletedOn != null)
+                    : query.Where(f => f.DeletedOn != null && f.ModifiedBy == restrictDeletedToOwner),
+                _ => restrictDeletedToOwner == null
+                    ? query
+                    : query.Where(f => f.DeletedOn == null || f.ModifiedBy == restrictDeletedToOwner)
+            };
+        }
+
+        public async Task<CmsFileDto?> GetFileAsync(Guid fileGuid, CancellationToken ct = default)
+        {
+            var file = await LoadFileAsync(fileGuid, tracking: false, ct);
+            if (file == null)
+            {
+                return null;
+            }
+            var names = await GetNamesByIamIdAsync(file.FileToPeople.Select(p => p.IamId), ct);
+            return CmsFileMapper.ToCmsFileDto(file, names);
+        }
+
+        public async Task<CmsFileNameCheckDto> CheckNameAsync(string folder, string fileName, CancellationToken ct = default)
+        {
+            if (!_storage.IsValidFolder(folder))
+            {
+                throw new ArgumentException("Invalid folder.");
+            }
+            string name = Path.GetFileName(fileName);
+            if (string.IsNullOrWhiteSpace(name) || !CmsFileTypes.IsAllowedFileName(name))
+            {
+                throw new ArgumentException("File type is not allowed.");
+            }
+
+            string targetPath = _storage.BuildManagedPath(folder, name);
+            var existing = await _context.Files
+                .AsNoTracking()
+                .FirstOrDefaultAsync(f => f.FilePath == targetPath, ct);
+            bool inUse = existing != null || _storage.FileNameInUse(folder, name);
+            return new CmsFileNameCheckDto
+            {
+                InUse = inUse,
+                SuggestedName = inUse ? _storage.GetAvailableFileName(folder, name) : name,
+                ExistingFileGuid = existing?.FileGuid,
+                ExistingFriendlyName = existing?.FriendlyName,
+                ExistingDeleted = existing?.DeletedOn != null
+            };
+        }
+
+        public async Task<CmsFileDto> CreateFileAsync(CmsFileCreateRequest request, IFormFile file, CancellationToken ct = default)
+        {
+            if (!_storage.IsValidFolder(request.Folder))
+            {
+                throw new ArgumentException("Invalid folder.");
+            }
+            string uploadName = Path.GetFileName(
+                string.IsNullOrWhiteSpace(request.FileName) ? file.FileName : request.FileName);
+            if (string.IsNullOrWhiteSpace(uploadName) || !CmsFileTypes.IsAllowedFileName(uploadName))
+            {
+                throw new ArgumentException("File type is not allowed.");
+            }
+
+            bool encrypt = request.Encrypt ?? false;
+            string? dbKey = encrypt ? _encryption.GenerateKeyForDb() : null;
+
+            string tempPath = await _storage.SaveToTempAsync(file, ct);
+            string finalPath;
+            // Overwriting an orphaned on-disk file (no DB row) destroys its bytes; snapshot them first
+            // so a later failure can roll the original back instead of leaving nothing in its place.
+            string? overwriteBackup = null;
+            try
+            {
+                if (dbKey != null)
+                {
+                    _encryption.EncryptFileInPlace(tempPath, dbKey);
+                }
+                if (request.Overwrite == true && _storage.FileNameInUse(request.Folder, uploadName))
+                {
+                    string targetPath = _storage.BuildManagedPath(request.Folder, uploadName);
+                    if (await _context.Files.AnyAsync(f => f.FilePath == targetPath, ct))
+                    {
+                        throw new InvalidOperationException(
+                            $"{uploadName} belongs to an existing file record; replace its content by editing that file.");
+                    }
+                    if (_storage.ManagedFileExists(targetPath))
+                    {
+                        overwriteBackup = _storage.BackupManagedFile(targetPath);
+                    }
+                    _storage.ReplaceInPlace(tempPath, targetPath);
+                    finalPath = targetPath;
+                }
+                else
+                {
+                    finalPath = _storage.MoveIntoPlace(tempPath, request.Folder, uploadName, makeUnique: false);
+                }
+            }
+            finally
+            {
+                if (System.IO.File.Exists(tempPath))
+                {
+                    System.IO.File.Delete(tempPath);
+                }
+            }
+
+            string friendlyName = CmsFileNaming.BuildFriendlyName(request.Folder, Path.GetFileName(finalPath));
+            if (await _context.Files.AnyAsync(f => f.FriendlyName == friendlyName, ct))
+            {
+                // The new bytes are already on disk; reconcile the store (restore an overwritten
+                // original, or delete a fresh copy) before failing so nothing is left behind.
+                ReconcileStoreAfterFailedCreate(finalPath, overwriteBackup);
+                throw new InvalidOperationException($"A file with the name {friendlyName} already exists.");
+            }
+
+            var entity = new File
+            {
+                FileGuid = Guid.NewGuid(),
+                FilePath = finalPath,
+                Folder = request.Folder,
+                FriendlyName = friendlyName,
+                Encrypted = encrypt,
+                Key = dbKey,
+                Description = request.Description ?? string.Empty,
+                AllowPublicAccess = request.AllowPublicAccess ?? false,
+                OldUrl = NullIfEmpty(request.OldUrl),
+                ModifiedOn = DateTime.Now,
+                ModifiedBy = CurrentLoginId()
+            };
+
+            foreach (var permission in CleanList(request.Permissions))
+            {
+                entity.FileToPermissions.Add(new Viper.Models.VIPER.FileToPermission { FileGuid = entity.FileGuid, Permission = permission });
+            }
+            foreach (var iamId in CleanList(request.IamIds))
+            {
+                entity.FileToPeople.Add(new Viper.Models.VIPER.FileToPerson { FileGuid = entity.FileGuid, IamId = iamId });
+            }
+
+            _context.Files.Add(entity);
+            _audit.Audit(entity, CmsFileAuditActions.AddFile, BuildCreateDetail(entity));
+            _audit.Audit(entity, CmsFileAuditActions.UploadFile, "NewFile");
+            bool saved = false;
+            try
+            {
+                await _context.SaveChangesAsync(ct);
+                saved = true;
+            }
+            catch (Exception)
+            {
+                // A failed save never persisted the record. Drop the pending changes, then reconcile
+                // the managed store: restore an overwritten file's original bytes, or remove the
+                // freshly stored copy, so nothing is left orphaned or destroyed.
+                _context.ChangeTracker.Clear();
+                ReconcileStoreAfterFailedCreate(finalPath, overwriteBackup);
+                throw;
+            }
+            finally
+            {
+                // Only clean up on a committed save (the backup is then obsolete). On a failed save the
+                // reconcile above owns the backup: a successful restore already consumed it via Move, and
+                // a FAILED restore must keep it as the last copy of the original bytes.
+                if (saved && overwriteBackup != null && System.IO.File.Exists(overwriteBackup))
+                {
+                    System.IO.File.Delete(overwriteBackup);
+                }
+            }
+
+            var names = await GetNamesByIamIdAsync(entity.FileToPeople.Select(p => p.IamId), ct);
+            return CmsFileMapper.ToCmsFileDto(entity, names);
+        }
+
+        public async Task<CmsFileDto?> UpdateFileAsync(Guid fileGuid, CmsFileUpdateRequest request, IFormFile? file, CancellationToken ct = default)
+        {
+            var entity = await LoadFileAsync(fileGuid, tracking: true, ct);
+            if (entity == null)
+            {
+                return null;
+            }
+
+            // Validate a replacement upload before anything touches the file on disk, so a bad type
+            // can't leave the file half-transformed or strand a backup copy.
+            if (file != null)
+            {
+                ValidateReplacementUpload(entity, file);
+            }
+
+            // The crypto toggle and any replacement upload below transform the file on disk before
+            // the metadata save. Capture the pre-change state so a failed save can reconcile the
+            // on-disk file back to it (mirrors the import service's encryption rollback).
+            bool originalEncrypted = entity.Encrypted;
+            string? originalKey = entity.Key;
+
+            // A replacement overwrites the bytes on disk before the save commits. Snapshot the
+            // original file first (it carries the original encryption state too) so a failed save
+            // can roll it back; restoring it supersedes the crypto-only reconcile below.
+            string? originalFileBackup = file != null && _storage.ManagedFileExists(entity.FilePath)
+                ? _storage.BackupManagedFile(entity.FilePath)
+                : null;
+
+            var changes = new List<string>();
+            ApplyEncryptionToggle(entity, request.Encrypt ?? false, changes);
+            ApplyScalarFieldChanges(entity, request, changes);
+
+            ApplyPermissionDeltas(entity, CleanList(request.Permissions), changes);
+            ApplyPersonDeltas(entity, CleanList(request.IamIds), changes);
+
+            if (file != null)
+            {
+                await WriteReplacementUploadAsync(entity, file, changes, ct);
+            }
+
+            entity.ModifiedOn = DateTime.Now;
+            entity.ModifiedBy = CurrentLoginId();
+
+            _audit.Audit(entity, CmsFileAuditActions.EditFile, string.Join("; ", changes));
+            await SaveUpdateAndReconcileAsync(entity, originalFileBackup, originalEncrypted, originalKey);
+
+            var names = await GetNamesByIamIdAsync(entity.FileToPeople.Select(p => p.IamId), ct);
+            return CmsFileMapper.ToCmsFileDto(entity, names);
+        }
+
+        /// <summary>
+        /// A replacement upload keeps the record's name and path, so its bytes must be an allowed
+        /// type and match the original extension; otherwise the stored file would hold mismatched
+        /// content and serve a corrupt download. Runs before anything touches disk.
+        /// </summary>
+        private static void ValidateReplacementUpload(File entity, IFormFile file)
+        {
+            if (!CmsFileTypes.IsAllowedFileName(file.FileName))
+            {
+                throw new ArgumentException("File type is not allowed.");
+            }
+            string replacementExt = Path.GetExtension(entity.FilePath);
+            if (!string.Equals(replacementExt, Path.GetExtension(file.FileName), StringComparison.OrdinalIgnoreCase))
+            {
+                throw new ArgumentException($"The replacement file must be the same type as the original ({replacementExt}).");
+            }
+        }
+
+        /// <summary>
+        /// Applies the encryption toggle in place before any replacement upload, so the replacement
+        /// is written with the file's final encryption state. Records the change for the audit trail.
+        /// </summary>
+        private void ApplyEncryptionToggle(File entity, bool encrypt, List<string> changes)
+        {
+            if (encrypt && !entity.Encrypted)
+            {
+                string dbKey = _encryption.GenerateKeyForDb();
+                if (_storage.ManagedFileExists(entity.FilePath))
+                {
+                    _encryption.EncryptFileInPlace(entity.FilePath, dbKey);
+                }
+                entity.Key = dbKey;
+                entity.Encrypted = true;
+                changes.Add("Encrypted file");
+            }
+            else if (!encrypt && entity.Encrypted)
+            {
+                if (!string.IsNullOrEmpty(entity.Key) && _storage.ManagedFileExists(entity.FilePath))
+                {
+                    _encryption.DecryptFileInPlace(entity.FilePath, entity.Key);
+                }
+                entity.Key = null;
+                entity.Encrypted = false;
+                changes.Add("Decrypted file");
+            }
+        }
+
+        /// <summary>
+        /// Applies the description, public-access, and Old URL edits, recording each that actually
+        /// changes for the audit trail.
+        /// </summary>
+        private static void ApplyScalarFieldChanges(File entity, CmsFileUpdateRequest request, List<string> changes)
+        {
+            string newDescription = request.Description ?? string.Empty;
+            if (entity.Description != newDescription)
+            {
+                entity.Description = newDescription;
+                changes.Add("Description updated");
+            }
+            bool allowPublicAccess = request.AllowPublicAccess ?? false;
+            if (entity.AllowPublicAccess != allowPublicAccess)
+            {
+                entity.AllowPublicAccess = allowPublicAccess;
+                changes.Add($"Public access changed to {allowPublicAccess}");
+            }
+            string? newOldUrl = NullIfEmpty(request.OldUrl);
+            if (entity.OldUrl != newOldUrl)
+            {
+                entity.OldUrl = newOldUrl;
+                changes.Add("Old URL updated");
+            }
+        }
+
+        /// <summary>
+        /// Writes a replacement upload over the record's file: encrypts the temp copy to the file's
+        /// current state if needed, swaps it in, audits the replacement, and revives a soft-deleted
+        /// record (the overwrite-conflict flow). The temp copy is always cleaned up.
+        /// </summary>
+        private async Task WriteReplacementUploadAsync(File entity, IFormFile file, List<string> changes, CancellationToken ct)
+        {
+            string tempPath = await _storage.SaveToTempAsync(file, ct);
+            try
+            {
+                if (entity.Encrypted && !string.IsNullOrEmpty(entity.Key))
+                {
+                    _encryption.EncryptFileInPlace(tempPath, entity.Key);
+                }
+                _storage.ReplaceInPlace(tempPath, entity.FilePath);
+            }
+            finally
+            {
+                if (System.IO.File.Exists(tempPath))
+                {
+                    System.IO.File.Delete(tempPath);
+                }
+            }
+            _audit.Audit(entity, CmsFileAuditActions.UploadFile, "ReplacingFile");
+
+            // Uploading new content into a soft-deleted record (the overwrite-conflict flow) makes
+            // it live again; metadata-only edits leave deletion state alone.
+            if (entity.DeletedOn != null)
+            {
+                entity.DeletedOn = null;
+                changes.Add("Restored file");
+            }
+        }
+
+        /// <summary>
+        /// Persists the metadata edit, reconciling the on-disk file when the save fails: restore the
+        /// pre-replacement backup (which also restores the original encryption state) or, with no
+        /// replacement, revert just the crypto transform. The backup is deleted once the save commits;
+        /// if a restore fails it is left in place as the last copy of the original bytes.
+        /// </summary>
+        private async Task SaveUpdateAndReconcileAsync(File entity, string? originalFileBackup,
+            bool originalEncrypted, string? originalKey)
+        {
+            bool saved = false;
+            try
+            {
+                // The file on disk may already be in its new encryption state; cancelling the save
+                // would strand it without a matching key, so it runs to completion even if aborted.
+                await _context.SaveChangesAsync(CancellationToken.None);
+                saved = true;
+            }
+            catch (Exception)
+            {
+                // Any failure type means the new state was not persisted; drop the pending changes
+                // and reconcile the on-disk file back to its original state before rethrowing.
+                _context.ChangeTracker.Clear();
+                if (originalFileBackup != null)
+                {
+                    // A replacement overwrote the file; restoring the original bytes also restores
+                    // the original encryption state, so the crypto-only reconcile is skipped.
+                    RestoreOriginalFileOnSaveFailure(entity, originalFileBackup);
+                }
+                else
+                {
+                    RevertCryptoOnSaveFailure(entity, originalEncrypted, originalKey);
+                }
+                throw;
+            }
+            finally
+            {
+                // Only clean up on a committed save (the backup is then obsolete). On a failed save the
+                // reconcile above owns the backup: a successful restore already consumed it via Move, and
+                // a FAILED restore must keep it as the last copy of the original bytes.
+                if (saved && originalFileBackup != null && System.IO.File.Exists(originalFileBackup))
+                {
+                    System.IO.File.Delete(originalFileBackup);
+                }
+            }
+        }
+
+        /// <summary>
+        /// A failed metadata save rolls the database back to the file's original encryption state,
+        /// but the on-disk file was already transformed to the new state. Reconcile it back, or a
+        /// download would read bytes that don't match the stored key. A failure to revert leaves the
+        /// file unreadable, so it is logged as critical rather than swallowed.
+        /// </summary>
+        private void RevertCryptoOnSaveFailure(File entity, bool originalEncrypted, string? originalKey)
+        {
+            if (entity.Encrypted == originalEncrypted || !_storage.ManagedFileExists(entity.FilePath))
+            {
+                return;
+            }
+            try
+            {
+                if (originalEncrypted && !string.IsNullOrEmpty(originalKey))
+                {
+                    // The file had been decrypted; re-encrypt it with the original key.
+                    _encryption.EncryptFileInPlace(entity.FilePath, originalKey);
+                }
+                else if (!originalEncrypted && !string.IsNullOrEmpty(entity.Key))
+                {
+                    // The file had been encrypted; decrypt it with the key that was generated.
+                    _encryption.DecryptFileInPlace(entity.FilePath, entity.Key);
+                }
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                _logger.LogCritical(ex, "CMS file {FileGuid} could not be reverted after a failed save; "
+                    + "its on-disk encryption no longer matches the database.", entity.FileGuid);
+            }
+        }
+
+        /// <summary>
+        /// A failed save after a replacement upload leaves the new bytes on disk while the database
+        /// rolled back to the original record. Move the pre-replacement backup back into place so a
+        /// download serves the original content (and its original encryption state). A failure to
+        /// restore is logged as critical (with the preserved backup path) rather than swallowed; the
+        /// caller leaves the backup in place so it remains the last copy of the original bytes.
+        /// </summary>
+        private void RestoreOriginalFileOnSaveFailure(File entity, string backupPath)
+        {
+            try
+            {
+                _storage.ReplaceInPlace(backupPath, entity.FilePath);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+            {
+                _logger.LogCritical(ex, "CMS file {FileGuid} could not be restored after a failed save; "
+                    + "the on-disk content may not match the database. The original bytes are preserved "
+                    + "at {BackupPath} for manual recovery.", entity.FileGuid, backupPath);
+            }
+        }
+
+        /// <summary>
+        /// A create that has already written its bytes but then fails (friendly-name clash or save
+        /// error) must not leave the store changed. When the write overwrote an orphaned file, move
+        /// its pre-overwrite backup back so the original content survives; otherwise just delete the
+        /// freshly stored copy. A failed restore is logged as critical (with the preserved backup
+        /// path) rather than swallowed; the caller leaves the backup in place for recovery.
+        /// </summary>
+        private void ReconcileStoreAfterFailedCreate(string finalPath, string? overwriteBackup)
+        {
+            if (overwriteBackup == null)
+            {
+                _storage.DeleteManagedFile(finalPath);
+                return;
+            }
+            try
+            {
+                _storage.ReplaceInPlace(overwriteBackup, finalPath);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or ArgumentException)
+            {
+                _logger.LogCritical(ex, "CMS overwrite at {FilePath} could not be restored after a failed "
+                    + "create; the original bytes are preserved at {BackupPath} for manual recovery.",
+                    LogSanitizer.SanitizeString(finalPath), overwriteBackup);
+            }
+        }
+
+        public async Task<bool> SoftDeleteFileAsync(Guid fileGuid, CancellationToken ct = default)
+        {
+            var entity = await LoadFileAsync(fileGuid, tracking: true, ct);
+            if (entity == null)
+            {
+                return false;
+            }
+            entity.DeletedOn = DateTime.Now;
+            entity.ModifiedOn = DateTime.Now;
+            entity.ModifiedBy = CurrentLoginId();
+            _audit.Audit(entity, CmsFileAuditActions.DeleteFile, "File Marked for Deletion");
+            await _context.SaveChangesAsync(ct);
+            return true;
+        }
+
+        public async Task<bool> RestoreFileAsync(Guid fileGuid, CancellationToken ct = default)
+        {
+            var entity = await LoadFileAsync(fileGuid, tracking: true, ct);
+            if (entity == null)
+            {
+                return false;
+            }
+            entity.DeletedOn = null;
+            entity.ModifiedOn = DateTime.Now;
+            entity.ModifiedBy = CurrentLoginId();
+            _audit.Audit(entity, CmsFileAuditActions.CancelDelete, "Delete cancelled");
+            await _context.SaveChangesAsync(ct);
+            return true;
+        }
+
+        public async Task<bool> PermanentlyDeleteFileAsync(Guid fileGuid, CancellationToken ct = default)
+        {
+            var entity = await LoadFileAsync(fileGuid, tracking: true, ct);
+            if (entity == null)
+            {
+                return false;
+            }
+
+            _audit.Audit(entity, CmsFileAuditActions.DeleteFile, "File Deleted");
+            // Remove every dependent row before the File delete: content-block attachments use
+            // ClientSetNull (no DB cascade), so a still-attached file would otherwise trip the FK.
+            // Purging a still-attached file detaches it from those blocks.
+            var blockLinks = await _context.ContentBlockToFiles.Where(l => l.FileGuid == fileGuid).ToListAsync(ct);
+            _context.RemoveRange(blockLinks);
+            _context.RemoveRange(entity.FileToPermissions);
+            _context.RemoveRange(entity.FileToPeople);
+            _context.Remove(entity);
+            await _context.SaveChangesAsync(ct);
+
+            // The DB row is already gone at this point, so a failed disk delete only strands bytes;
+            // log it for manual cleanup rather than failing an operation that did delete the record.
+            try
+            {
+                if (_storage.ManagedFileExists(entity.FilePath))
+                {
+                    _storage.DeleteManagedFile(entity.FilePath);
+                }
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+                _logger.LogError(ex, "CMS file record {FileGuid} was deleted but its bytes at {FilePath} "
+                    + "could not be removed from disk.",
+                    fileGuid, LogSanitizer.SanitizeString(entity.FilePath));
+            }
+            return true;
+        }
+
+        public async Task<int> PurgeDeletedFilesAsync(int retentionDays, CancellationToken ct = default)
+        {
+            var cutoff = DateTime.Now.AddDays(-retentionDays);
+            var guids = await _context.Files
+                .Where(f => f.DeletedOn != null && f.DeletedOn < cutoff)
+                .Select(f => f.FileGuid)
+                .ToListAsync(ct);
+
+            int purged = 0;
+            foreach (var guid in guids)
+            {
+                try
+                {
+                    if (await PermanentlyDeleteFileAsync(guid, ct))
+                    {
+                        purged++;
+                    }
+                }
+                catch (Exception ex) when (ex is DbUpdateException or IOException or InvalidOperationException)
+                {
+                    // Isolate per-file failures so one bad file doesn't abort the whole purge run.
+                    _context.ChangeTracker.Clear();
+                    _logger.LogError(ex, "CMS trash purge failed to delete file {FileGuid}", guid);
+                }
+            }
+            return purged;
+        }
+
+        private async Task<File?> LoadFileAsync(Guid fileGuid, bool tracking, CancellationToken ct)
+        {
+            var query = _context.Files
+                .Include(f => f.FileToPermissions)
+                .Include(f => f.FileToPeople)
+                .AsSplitQuery();
+            if (!tracking)
+            {
+                query = query.AsNoTracking();
+            }
+            var file = await query.FirstOrDefaultAsync(f => f.FileGuid == fileGuid, ct);
+            if (file != null)
+            {
+                file.FilePath = NormalizeRootFolder(file.FilePath);
+            }
+            return file;
+        }
+
+        /// <summary>
+        /// Fix up the storage root if the record was created on another environment
+        /// (e.g. a dev path on prod), mirroring Data.CMS.ReplaceRootFolder but guarded
+        /// against paths that don't contain a \Files segment.
+        /// </summary>
+        private string NormalizeRootFolder(string filePath)
+        {
+            string root = _storage.RootFolder;
+            if (!filePath.StartsWith(root, StringComparison.OrdinalIgnoreCase))
+            {
+                int filesIndex = filePath.IndexOf(@"\Files\", StringComparison.OrdinalIgnoreCase);
+                if (filesIndex >= 0)
+                {
+                    return root + filePath[(filesIndex + @"\Files".Length)..];
+                }
+            }
+            return filePath;
+        }
+
+        private void ApplyPermissionDeltas(File entity, List<string> requested, List<string> changes)
+        {
+            var existing = entity.FileToPermissions.ToList();
+            foreach (var fp in existing.Where(fp => !requested.Contains(fp.Permission, StringComparer.OrdinalIgnoreCase)))
+            {
+                entity.FileToPermissions.Remove(fp);
+                _context.Remove(fp);
+                changes.Add($"Permission removed: {fp.Permission}");
+            }
+            var existingNames = existing.Select(p => p.Permission).ToHashSet(StringComparer.OrdinalIgnoreCase);
+            foreach (var permission in requested.Where(p => !existingNames.Contains(p)))
+            {
+                entity.FileToPermissions.Add(new Viper.Models.VIPER.FileToPermission { FileGuid = entity.FileGuid, Permission = permission });
+                changes.Add($"Permission added: {permission}");
+            }
+        }
+
+        private void ApplyPersonDeltas(File entity, List<string> requested, List<string> changes)
+        {
+            var existing = entity.FileToPeople.ToList();
+            foreach (var fp in existing.Where(fp => !requested.Contains(fp.IamId, StringComparer.OrdinalIgnoreCase)))
+            {
+                entity.FileToPeople.Remove(fp);
+                _context.Remove(fp);
+                changes.Add($"Person removed: {fp.IamId}");
+            }
+            var existingIds = existing.Select(p => p.IamId).ToHashSet(StringComparer.OrdinalIgnoreCase);
+            foreach (var iamId in requested.Where(p => !existingIds.Contains(p)))
+            {
+                entity.FileToPeople.Add(new Viper.Models.VIPER.FileToPerson { FileGuid = entity.FileGuid, IamId = iamId });
+                changes.Add($"Person added: {iamId}");
+            }
+        }
+
+        private async Task<Dictionary<string, string>> GetNamesByIamIdAsync(IEnumerable<string> iamIds, CancellationToken ct)
+        {
+            var ids = iamIds.Distinct().ToList();
+            if (ids.Count == 0)
+            {
+                return new Dictionary<string, string>();
+            }
+            return await _aaudContext.AaudUsers
+                .AsNoTracking()
+                .Where(u => u.IamId != null && EF.Parameter(ids).Contains(u.IamId))
+                .GroupBy(u => u.IamId!)
+                .Select(g => new { IamId = g.Key, Name = g.Select(u => u.DisplayFullName).First() })
+                .ToDictionaryAsync(x => x.IamId, x => x.Name, ct);
+        }
+
+        private string CurrentLoginId()
+        {
+            return _userHelper.GetCurrentUser()?.LoginId ?? "unknown";
+        }
+
+        private static string BuildCreateDetail(File entity)
+        {
+            var parts = new List<string> { $"Folder: {entity.Folder}" };
+            if (entity.AllowPublicAccess)
+            {
+                parts.Add("Public access: true");
+            }
+            if (entity.Encrypted)
+            {
+                parts.Add("Encrypted: true");
+            }
+            if (entity.FileToPermissions.Count > 0)
+            {
+                parts.Add("Permissions: " + string.Join(", ", entity.FileToPermissions.Select(p => p.Permission)));
+            }
+            if (entity.FileToPeople.Count > 0)
+            {
+                parts.Add("People: " + string.Join(", ", entity.FileToPeople.Select(p => p.IamId)));
+            }
+            return string.Join("; ", parts);
+        }
+
+        private static List<string> CleanList(List<string> values)
+        {
+            return values
+                .Where(v => !string.IsNullOrWhiteSpace(v))
+                .Select(v => v.Trim())
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+
+        private static string? NullIfEmpty(string? value)
+        {
+            return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsFileStorageService.cs b/web/Areas/CMS/Services/CmsFileStorageService.cs
new file mode 100644
index 000000000..79f148ee3
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsFileStorageService.cs
@@ -0,0 +1,293 @@
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Constants;
+using Viper.Classes.SQLContext;
+
+namespace Viper.Areas.CMS.Services
+{
+    public interface ICmsFileStorageService
+    {
+        string RootFolder { get; }
+
+        /// <summary>Top-level folders ("VIPER apps") that files can be stored under.</summary>
+        List<string> GetTopLevelFolders();
+
+        /// <summary>
+        /// Top-level folders for FILTERING: the upload allow-list (disk) unioned with
+        /// folders that only exist on file records (e.g. created on another environment's
+        /// disk). Not valid as upload destinations.
+        /// </summary>
+        Task<List<string>> GetFilterFoldersAsync(CancellationToken ct = default);
+
+        /// <summary>
+        /// Validate a user-supplied folder (may contain subfolders, e.g. "cats\photos").
+        /// The first segment must be an existing top-level folder and the resolved path
+        /// must stay inside the root.
+        /// </summary>
+        bool IsValidFolder(string folder);
+
+        /// <summary>True if the name exists on disk or in the files table for this folder.</summary>
+        bool FileNameInUse(string folder, string fileName);
+
+        /// <summary>
+        /// The name MoveIntoPlace would store folder\fileName under: the name itself when free,
+        /// otherwise the first free name_0..name_999 candidate. <paramref name="reservedNames"/>
+        /// (optional) are treated as already taken, so callers planning several writes in one
+        /// batch get the same unique names the sequential moves would actually assign.
+        /// </summary>
+        string GetAvailableFileName(string folder, string fileName, IReadOnlySet<string>? reservedNames = null);
+
+        /// <summary>Resolved managed path for folder\fileName (validated to stay under the root).</summary>
+        string BuildManagedPath(string folder, string fileName);
+
+        /// <summary>Save an upload to a temp file (outside the storage root); returns the temp path.</summary>
+        Task<string> SaveToTempAsync(IFormFile file, CancellationToken ct = default);
+
+        /// <summary>
+        /// Move a temp file into the storage root at folder\fileName. On name conflict, either
+        /// auto-rename (name_0..name_999) or throw, per <paramref name="makeUnique"/>.
+        /// Returns the final absolute path.
+        /// </summary>
+        string MoveIntoPlace(string tempPath, string folder, string fileName, bool makeUnique);
+
+        /// <summary>Overwrite the managed file at <paramref name="existingFilePath"/> with a temp file.</summary>
+        void ReplaceInPlace(string tempPath, string existingFilePath);
+
+        /// <summary>
+        /// Copy a managed file to a temp backup outside the storage root and return its path. Pair
+        /// with ReplaceInPlace(backupPath, originalPath) to roll the original bytes back into place
+        /// after a failed save.
+        /// </summary>
+        string BackupManagedFile(string filePath);
+
+        /// <summary>Delete a file, verifying it lives under the storage root first.</summary>
+        void DeleteManagedFile(string filePath);
+
+        bool ManagedFileExists(string filePath);
+    }
+
+    /// <summary>
+    /// On-disk storage for CMS-managed files. User input never becomes a path without
+    /// validation: folders are checked against the top-level folder list and resolved-path
+    /// containment, and file names are stripped to their final segment (see PLAN-CMS.md §11.7).
+    /// </summary>
+    public class CmsFileStorageService : ICmsFileStorageService
+    {
+        private readonly VIPERContext _context;
+
+        public string RootFolder { get; }
+
+        public CmsFileStorageService(VIPERContext context, IConfiguration configuration)
+        {
+            _context = context;
+            RootFolder = configuration["CMS:FileStorageRoot"] ?? Data.CMS.GetRootFileFolder();
+        }
+
+        public List<string> GetTopLevelFolders()
+        {
+            if (!System.IO.Directory.Exists(RootFolder))
+            {
+                return new List<string>();
+            }
+            // DirectoryInfo.Name gives the (non-null) leaf folder name directly, avoiding the
+            // Path.GetFileName nullable return that would otherwise need coalescing.
+            return new DirectoryInfo(RootFolder).GetDirectories()
+                .Select(d => d.Name)
+                .Where(d => !string.IsNullOrEmpty(d))
+                .OrderBy(d => d)
+                .ToList();
+        }
+
+        public async Task<List<string>> GetFilterFoldersAsync(CancellationToken ct = default)
+        {
+            var dbFolders = await _context.Files.Select(f => f.Folder).Distinct().ToListAsync(ct);
+            var topLevel = dbFolders
+                .Where(f => !string.IsNullOrWhiteSpace(f))
+                .Select(f => f!.Split(['\\', '/'], StringSplitOptions.None)[0]);
+            return GetTopLevelFolders()
+                .Union(topLevel, StringComparer.OrdinalIgnoreCase)
+                .OrderBy(f => f, StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+
+        public bool IsValidFolder(string folder)
+        {
+            if (string.IsNullOrWhiteSpace(folder))
+            {
+                return false;
+            }
+
+            var segments = folder.Split(['\\', '/'], StringSplitOptions.None);
+            if (segments.Any(s => string.IsNullOrWhiteSpace(s) || s == "." || s == ".."
+                    || HasInvalidNameChar(s)))
+            {
+                return false;
+            }
+
+            // First segment must be an existing top-level folder (legacy rule); subfolders
+            // may be created on demand by MoveIntoPlace.
+            if (!GetTopLevelFolders().Any(f => string.Equals(f, segments[0], StringComparison.OrdinalIgnoreCase)))
+            {
+                return false;
+            }
+
+            return IsUnderRoot(Path.Join(RootFolder, Path.Join(segments)));
+        }
+
+        public bool FileNameInUse(string folder, string fileName)
+        {
+            string targetPath = BuildTargetPath(folder, fileName);
+            if (File.Exists(targetPath))
+            {
+                return true;
+            }
+            // Also check the DB in case a record exists whose disk file is missing; a new file
+            // at that path would be served under the orphaned record's permissions.
+            return _context.Files.Any(f => f.FilePath == targetPath);
+        }
+
+        public string GetAvailableFileName(string folder, string fileName, IReadOnlySet<string>? reservedNames = null)
+        {
+            string finalName = GetLeafName(fileName);
+            bool taken = FileNameInUse(folder, finalName)
+                || (reservedNames != null && reservedNames.Contains(finalName));
+            return taken ? GetUniqueFileName(folder, finalName, reservedNames) : finalName;
+        }
+
+        public string BuildManagedPath(string folder, string fileName)
+        {
+            return BuildTargetPath(folder, fileName);
+        }
+
+        public async Task<string> SaveToTempAsync(IFormFile file, CancellationToken ct = default)
+        {
+            string tempFolder = Path.Join(Path.GetTempPath(), "Viper-CMS-Uploads");
+            System.IO.Directory.CreateDirectory(tempFolder);
+            string tempPath = Path.Join(tempFolder, Guid.NewGuid().ToString("N"));
+            await using FileStream stream = new(tempPath, FileMode.CreateNew);
+            await file.CopyToAsync(stream, ct);
+            return tempPath;
+        }
+
+        public string MoveIntoPlace(string tempPath, string folder, string fileName, bool makeUnique)
+        {
+            if (!IsValidFolder(folder))
+            {
+                throw new ArgumentException($"Invalid folder", nameof(folder));
+            }
+
+            string finalName = GetLeafName(fileName);
+            if (string.IsNullOrWhiteSpace(finalName) || !CmsFileTypes.IsAllowedFileName(finalName))
+            {
+                throw new ArgumentException("Invalid file name", nameof(fileName));
+            }
+
+            if (FileNameInUse(folder, finalName))
+            {
+                if (!makeUnique)
+                {
+                    throw new InvalidOperationException($"File {finalName} already exists in folder {folder}.");
+                }
+                finalName = GetUniqueFileName(folder, finalName);
+            }
+
+            string targetPath = BuildTargetPath(folder, finalName);
+            System.IO.Directory.CreateDirectory(Path.GetDirectoryName(targetPath)!);
+            File.Move(tempPath, targetPath);
+            return targetPath;
+        }
+
+        public void ReplaceInPlace(string tempPath, string existingFilePath)
+        {
+            AssertUnderRoot(existingFilePath);
+            File.Move(tempPath, existingFilePath, overwrite: true);
+        }
+
+        public string BackupManagedFile(string filePath)
+        {
+            AssertUnderRoot(filePath);
+            string tempFolder = Path.Join(Path.GetTempPath(), "Viper-CMS-Uploads");
+            System.IO.Directory.CreateDirectory(tempFolder);
+            string backupPath = Path.Join(tempFolder, Guid.NewGuid().ToString("N"));
+            File.Copy(filePath, backupPath, overwrite: true);
+            return backupPath;
+        }
+
+        public void DeleteManagedFile(string filePath)
+        {
+            AssertUnderRoot(filePath);
+            if (File.Exists(filePath))
+            {
+                File.Delete(filePath);
+            }
+        }
+
+        public bool ManagedFileExists(string filePath)
+        {
+            return IsUnderRoot(filePath) && File.Exists(filePath);
+        }
+
+        private string GetUniqueFileName(string folder, string fileName, IReadOnlySet<string>? reservedNames = null)
+        {
+            string baseName = Path.GetFileNameWithoutExtension(fileName);
+            string extension = Path.GetExtension(fileName);
+            // Match legacy behavior: append _0, _1, ... _999 until unique.
+            for (int i = 0; i < 1000; i++)
+            {
+                string candidate = $"{baseName}_{i}{extension}";
+                if (!FileNameInUse(folder, candidate)
+                    && (reservedNames == null || !reservedNames.Contains(candidate)))
+                {
+                    return candidate;
+                }
+            }
+            throw new InvalidOperationException($"Unable to generate a unique name for {fileName} in {folder}.");
+        }
+
+        private string BuildTargetPath(string folder, string fileName)
+        {
+            // Split the folder on both separator styles and rejoin with the host separator so a
+            // user-supplied "sub\dir" resolves to real nested folders on Linux too (Path.Join would
+            // otherwise treat "sub\dir" as one literal directory name there).
+            string[] folderSegments = folder.Split(['\\', '/'], StringSplitOptions.RemoveEmptyEntries);
+            string path = Path.GetFullPath(Path.Join(RootFolder, Path.Join(folderSegments), GetLeafName(fileName)));
+            AssertUnderRoot(path);
+            return path;
+        }
+
+        private void AssertUnderRoot(string filePath)
+        {
+            if (!IsUnderRoot(filePath))
+            {
+                throw new ArgumentException("Path is outside the CMS file storage root.", nameof(filePath));
+            }
+        }
+
+        private bool IsUnderRoot(string filePath)
+        {
+            string fullPath = Path.GetFullPath(filePath);
+            string root = Path.GetFullPath(RootFolder + Path.DirectorySeparatorChar);
+            return fullPath.StartsWith(root, StringComparison.OrdinalIgnoreCase);
+        }
+
+        /// <summary>
+        /// Final path segment of a name, treating both '\' and '/' as separators so path components
+        /// are stripped identically on every OS (Path.GetFileName only honors the host separator, so
+        /// on Linux it would keep a "sub\file" prefix from a legacy Windows-style name).
+        /// </summary>
+        private static string GetLeafName(string name)
+        {
+            int lastSeparator = name.LastIndexOfAny(['\\', '/']);
+            return lastSeparator >= 0 ? name[(lastSeparator + 1)..] : name;
+        }
+
+        // Reject on an explicit, OS-independent set rather than Path.GetInvalidFileNameChars, which
+        // on Linux returns only { '\0', '/' } and would let '<', '>', ':' etc. through. Stricter than
+        // the host filesystem on purpose (defense in depth).
+        private static readonly char[] InvalidNameChars = ['<', '>', ':', '"', '|', '?', '*'];
+
+        private static bool HasInvalidNameChar(string segment)
+        {
+            return segment.Any(c => c < ' ' || Array.IndexOf(InvalidNameChars, c) >= 0);
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsLeftNavService.cs b/web/Areas/CMS/Services/CmsLeftNavService.cs
new file mode 100644
index 000000000..fb0e39987
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsLeftNavService.cs
@@ -0,0 +1,305 @@
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.CMS.Models.DTOs;
+using Viper.Classes.SQLContext;
+using Viper.Models.VIPER;
+
+namespace Viper.Areas.CMS.Services
+{
+    public interface ICmsLeftNavService
+    {
+        Task<List<LeftNavMenuDto>> GetMenusAsync(string? system, string? viperSectionPath, string? search, CancellationToken ct = default);
+
+        Task<LeftNavMenuDto?> GetMenuAsync(int leftNavMenuId, CancellationToken ct = default);
+
+        Task<LeftNavMenuDto> CreateMenuAsync(LeftNavMenuAddEdit request, CancellationToken ct = default);
+
+        Task<LeftNavMenuDto?> UpdateMenuAsync(int leftNavMenuId, LeftNavMenuAddEdit request, CancellationToken ct = default);
+
+        Task<bool> DeleteMenuAsync(int leftNavMenuId, CancellationToken ct = default);
+
+        /// <summary>
+        /// Replace the menu's items with the supplied list: items with id 0 are added,
+        /// existing ids are updated, omitted ids are deleted, and DisplayOrder follows
+        /// the array order. Matches the legacy editor's batch save.
+        /// </summary>
+        Task<LeftNavMenuDto?> SaveItemsAsync(int leftNavMenuId, List<LeftNavItemEdit> items, CancellationToken ct = default);
+    }
+
+    /// <summary>
+    /// Management operations for CMS left navigation menus (legacy LeftNavs.cfc /
+    /// LeftNavAjax.cfc). Menu deletes cascade to items and item permissions; there is
+    /// no soft delete for menus, matching legacy.
+    /// </summary>
+    public class CmsLeftNavService : ICmsLeftNavService
+    {
+        private readonly VIPERContext _context;
+        private readonly IUserHelper _userHelper;
+
+        public CmsLeftNavService(VIPERContext context, IUserHelper userHelper)
+        {
+            _context = context;
+            _userHelper = userHelper;
+        }
+
+        public async Task<List<LeftNavMenuDto>> GetMenusAsync(string? system, string? viperSectionPath, string? search, CancellationToken ct = default)
+        {
+            var query = _context.LeftNavMenus
+                .AsNoTracking()
+                .Include(m => m.LeftNavItems)
+                    .ThenInclude(i => i.LeftNavItemToPermissions)
+                .AsSplitQuery()
+                .TagWith("CmsLeftNavService.GetMenus")
+                .AsQueryable();
+
+            if (!string.IsNullOrEmpty(system))
+            {
+                query = query.Where(m => m.System == system);
+            }
+            if (!string.IsNullOrEmpty(viperSectionPath))
+            {
+                query = query.Where(m => m.ViperSectionPath == viperSectionPath);
+            }
+            if (!string.IsNullOrEmpty(search))
+            {
+                query = query.Where(m => (m.MenuHeaderText != null && m.MenuHeaderText.Contains(search))
+                    || (m.FriendlyName != null && m.FriendlyName.Contains(search))
+                    || (m.Page != null && m.Page.Contains(search)));
+            }
+
+            var menus = await query
+                .OrderBy(m => m.MenuHeaderText)
+                .ToListAsync(ct);
+            return menus.Select(ToDto).ToList();
+        }
+
+        public async Task<LeftNavMenuDto?> GetMenuAsync(int leftNavMenuId, CancellationToken ct = default)
+        {
+            var menu = await LoadMenuAsync(leftNavMenuId, tracking: false, ct);
+            return menu == null ? null : ToDto(menu);
+        }
+
+        public async Task<LeftNavMenuDto> CreateMenuAsync(LeftNavMenuAddEdit request, CancellationToken ct = default)
+        {
+            await AssertFriendlyNameUniqueAsync(request.FriendlyName, null, ct);
+
+            var menu = new LeftNavMenu();
+            ApplyMenuFields(menu, request);
+            menu.ModifiedOn = DateTime.Now;
+            menu.ModifiedBy = CurrentLoginId();
+
+            _context.LeftNavMenus.Add(menu);
+            await _context.SaveChangesAsync(ct);
+            return ToDto(menu);
+        }
+
+        public async Task<LeftNavMenuDto?> UpdateMenuAsync(int leftNavMenuId, LeftNavMenuAddEdit request, CancellationToken ct = default)
+        {
+            var menu = await LoadMenuAsync(leftNavMenuId, tracking: true, ct);
+            if (menu == null)
+            {
+                return null;
+            }
+
+            await AssertFriendlyNameUniqueAsync(request.FriendlyName, leftNavMenuId, ct);
+
+            ApplyMenuFields(menu, request);
+            menu.ModifiedOn = DateTime.Now;
+            menu.ModifiedBy = CurrentLoginId();
+
+            await _context.SaveChangesAsync(ct);
+            return ToDto(menu);
+        }
+
+        public async Task<bool> DeleteMenuAsync(int leftNavMenuId, CancellationToken ct = default)
+        {
+            var menu = await LoadMenuAsync(leftNavMenuId, tracking: true, ct);
+            if (menu == null)
+            {
+                return false;
+            }
+
+            foreach (var item in menu.LeftNavItems)
+            {
+                _context.RemoveRange(item.LeftNavItemToPermissions);
+            }
+            _context.RemoveRange(menu.LeftNavItems);
+            _context.Remove(menu);
+            await _context.SaveChangesAsync(ct);
+            return true;
+        }
+
+        public async Task<LeftNavMenuDto?> SaveItemsAsync(int leftNavMenuId, List<LeftNavItemEdit> items, CancellationToken ct = default)
+        {
+            // Reject duplicate ids up front so every caller gets the guard (was in the controller).
+            if (items.Where(i => i.LeftNavItemId > 0).GroupBy(i => i.LeftNavItemId).Any(g => g.Count() > 1))
+            {
+                throw new ArgumentException("Duplicate item ids are not allowed.");
+            }
+
+            var menu = await LoadMenuAsync(leftNavMenuId, tracking: true, ct);
+            if (menu == null)
+            {
+                return null;
+            }
+
+            var existingById = menu.LeftNavItems.ToDictionary(i => i.LeftNavItemId);
+
+            // A supplied id that isn't in this menu means the client's copy is stale (the item was
+            // deleted, or belongs to another menu). Reject rather than silently resurrecting it as a
+            // new row.
+            if (items.Any(i => i.LeftNavItemId > 0 && !existingById.ContainsKey(i.LeftNavItemId)))
+            {
+                throw new InvalidOperationException(
+                    "One or more items no longer exist in this menu. Reload and try again.");
+            }
+
+            var requestedIds = items.Where(i => i.LeftNavItemId > 0).Select(i => i.LeftNavItemId).ToHashSet();
+
+            // Delete items not present in the request.
+            foreach (var item in menu.LeftNavItems.Where(i => !requestedIds.Contains(i.LeftNavItemId)).ToList())
+            {
+                _context.RemoveRange(item.LeftNavItemToPermissions);
+                _context.Remove(item);
+                menu.LeftNavItems.Remove(item);
+            }
+
+            int order = 1;
+            foreach (var requested in items)
+            {
+                if (requested.LeftNavItemId > 0 && existingById.TryGetValue(requested.LeftNavItemId, out var existing))
+                {
+                    existing.MenuItemText = requested.MenuItemText;
+                    existing.IsHeader = requested.IsHeader;
+                    existing.Url = requested.IsHeader ? null : requested.Url;
+                    existing.DisplayOrder = order;
+                    ApplyItemPermissionDeltas(existing, CleanList(requested.Permissions));
+                }
+                else
+                {
+                    var newItem = new LeftNavItem
+                    {
+                        LeftNavMenuId = leftNavMenuId,
+                        MenuItemText = requested.MenuItemText,
+                        IsHeader = requested.IsHeader,
+                        Url = requested.IsHeader ? null : requested.Url,
+                        DisplayOrder = order
+                    };
+                    foreach (var permission in CleanList(requested.Permissions))
+                    {
+                        newItem.LeftNavItemToPermissions.Add(new LeftNavItemToPermission { Permission = permission });
+                    }
+                    menu.LeftNavItems.Add(newItem);
+                }
+                order++;
+            }
+
+            menu.ModifiedOn = DateTime.Now;
+            menu.ModifiedBy = CurrentLoginId();
+
+            await _context.SaveChangesAsync(ct);
+            return await GetMenuAsync(leftNavMenuId, ct);
+        }
+
+        // FriendlyName resolves menus in LayoutController via FirstOrDefault, so duplicates make
+        // resolution nondeterministic. Reject them case-insensitively at write time. SQL Server's
+        // default collation is case-insensitive; ToLower keeps the check correct on other providers.
+        private async Task AssertFriendlyNameUniqueAsync(string? friendlyName, int? exceptMenuId, CancellationToken ct)
+        {
+            if (string.IsNullOrEmpty(friendlyName))
+            {
+                return;
+            }
+
+            var normalized = friendlyName.ToLower();
+            bool taken = await _context.LeftNavMenus
+                .AnyAsync(m => m.FriendlyName != null && m.FriendlyName.ToLower() == normalized
+                    && (exceptMenuId == null || m.LeftNavMenuId != exceptMenuId), ct);
+            if (taken)
+            {
+                throw new ArgumentException("Friendly name must be unique.");
+            }
+        }
+
+        private async Task<LeftNavMenu?> LoadMenuAsync(int leftNavMenuId, bool tracking, CancellationToken ct)
+        {
+            var query = _context.LeftNavMenus
+                .Include(m => m.LeftNavItems)
+                    .ThenInclude(i => i.LeftNavItemToPermissions)
+                .AsSplitQuery();
+            if (!tracking)
+            {
+                query = query.AsNoTracking();
+            }
+            return await query.FirstOrDefaultAsync(m => m.LeftNavMenuId == leftNavMenuId, ct);
+        }
+
+        private void ApplyItemPermissionDeltas(LeftNavItem item, List<string> requested)
+        {
+            var existing = item.LeftNavItemToPermissions.ToList();
+            foreach (var p in existing.Where(p => !requested.Contains(p.Permission, StringComparer.OrdinalIgnoreCase)))
+            {
+                item.LeftNavItemToPermissions.Remove(p);
+                _context.Remove(p);
+            }
+            var existingNames = existing.Select(p => p.Permission).ToHashSet(StringComparer.OrdinalIgnoreCase);
+            foreach (var permission in requested.Where(p => !existingNames.Contains(p)))
+            {
+                item.LeftNavItemToPermissions.Add(new LeftNavItemToPermission
+                {
+                    LeftNavItemId = item.LeftNavItemId,
+                    Permission = permission
+                });
+            }
+        }
+
+        private static void ApplyMenuFields(LeftNavMenu menu, LeftNavMenuAddEdit request)
+        {
+            menu.MenuHeaderText = request.MenuHeaderText;
+            menu.System = request.System;
+            menu.ViperSectionPath = request.ViperSectionPath;
+            menu.Page = request.Page;
+            menu.FriendlyName = request.FriendlyName;
+        }
+
+        private static LeftNavMenuDto ToDto(LeftNavMenu menu)
+        {
+            return new LeftNavMenuDto
+            {
+                LeftNavMenuId = menu.LeftNavMenuId,
+                MenuHeaderText = menu.MenuHeaderText,
+                System = menu.System,
+                ViperSectionPath = menu.ViperSectionPath,
+                Page = menu.Page,
+                FriendlyName = menu.FriendlyName,
+                ModifiedOn = menu.ModifiedOn,
+                ModifiedBy = menu.ModifiedBy,
+                Items = menu.LeftNavItems
+                    .OrderBy(i => i.DisplayOrder)
+                    .Select(i => new LeftNavItemDto
+                    {
+                        LeftNavItemId = i.LeftNavItemId,
+                        MenuItemText = i.MenuItemText,
+                        IsHeader = i.IsHeader,
+                        Url = i.Url,
+                        DisplayOrder = i.DisplayOrder,
+                        Permissions = i.LeftNavItemToPermissions.Select(p => p.Permission).OrderBy(p => p).ToList()
+                    })
+                    .ToList()
+            };
+        }
+
+        private string CurrentLoginId()
+        {
+            return _userHelper.GetCurrentUser()?.LoginId ?? "unknown";
+        }
+
+        private static List<string> CleanList(List<string> values)
+        {
+            return values
+                .Where(v => !string.IsNullOrWhiteSpace(v))
+                .Select(v => v.Trim())
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
+    }
+}
diff --git a/web/Areas/CMS/Services/CmsNavMenu.cs b/web/Areas/CMS/Services/CmsNavMenu.cs
index 0b151aeee..4d2b893d6 100644
--- a/web/Areas/CMS/Services/CmsNavMenu.cs
+++ b/web/Areas/CMS/Services/CmsNavMenu.cs
@@ -1,3 +1,4 @@
+using Viper.Areas.CMS.Constants;
 using Viper.Classes;
 using Viper.Classes.SQLContext;
 
@@ -6,20 +7,60 @@ namespace Viper.Areas.CMS.Services
     public class CmsNavMenu
     {
         private readonly RAPSContext _rapsContext;
-        public CmsNavMenu(RAPSContext context)
+        private readonly IUserHelper _userHelper;
+
+        public CmsNavMenu(RAPSContext context, IUserHelper? userHelper = null)
         {
             _rapsContext = context;
+            _userHelper = userHelper ?? new UserHelper();
         }
 
         public NavMenu Nav()
         {
-            UserHelper userHelper = new UserHelper();
+            var user = _userHelper.GetCurrentUser();
+            bool canManageBlocks = _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageContentBlocks);
+            bool canCreateBlocks = _userHelper.HasPermission(_rapsContext, user, CmsPermissions.CreateContentBlock);
+            bool canManageFiles = _userHelper.HasPermission(_rapsContext, user, CmsPermissions.AllFiles);
+            bool canManageNav = _userHelper.HasPermission(_rapsContext, user, CmsPermissions.ManageNavigation);
 
             var nav = new List<NavMenuItem>();
 
-            if (userHelper.HasPermission(_rapsContext, userHelper.GetCurrentUser(), "SVMSecure.CMS.ManageContentBlocks"))
+            if (canManageBlocks || canCreateBlocks || canManageFiles || canManageNav)
+            {
+                nav.Add(new NavMenuItem { MenuItemText = "Home", MenuItemURL = "Home", IndentLevel = 1 });
+            }
+
+            if (canManageBlocks || canCreateBlocks)
+            {
+                nav.Add(new NavMenuItem { MenuItemText = "Content Blocks", IsHeader = true });
+                if (canManageBlocks)
+                {
+                    nav.Add(new NavMenuItem { MenuItemText = "Manage Content Blocks", MenuItemURL = "ManageContentBlocks", IndentLevel = 1 });
+                }
+                if (canCreateBlocks)
+                {
+                    nav.Add(new NavMenuItem { MenuItemText = "Add Content Block", MenuItemURL = "ManageContentBlocks/Edit", IndentLevel = 1 });
+                }
+                if (canManageBlocks)
+                {
+                    nav.Add(new NavMenuItem { MenuItemText = "Edit History", MenuItemURL = "ManageContentBlocks/History", IndentLevel = 1 });
+                    nav.Add(new NavMenuItem { MenuItemText = "Manage Link Collections", MenuItemURL = "ManageLinkCollections", IndentLevel = 1 });
+                }
+            }
+
+            if (canManageFiles)
+            {
+                nav.Add(new NavMenuItem { MenuItemText = "Files", IsHeader = true });
+                nav.Add(new NavMenuItem { MenuItemText = "Manage Files", MenuItemURL = "ManageFiles", IndentLevel = 1 });
+                nav.Add(new NavMenuItem { MenuItemText = "Add File", MenuItemURL = "ManageFiles?upload=1", IndentLevel = 1 });
+                nav.Add(new NavMenuItem { MenuItemText = "Audit Trail", MenuItemURL = "ManageFiles/Audit", IndentLevel = 1 });
+            }
+
+            if (canManageNav)
             {
-                nav.Add(new NavMenuItem { MenuItemText = "Manage Link Collections", MenuItemURL = "ManageLinkCollections" });
+                nav.Add(new NavMenuItem { MenuItemText = "Left Navigation Menus", IsHeader = true });
+                nav.Add(new NavMenuItem { MenuItemText = "Manage Left-Nav Menus", MenuItemURL = "ManageLeftNav", IndentLevel = 1 });
+                nav.Add(new NavMenuItem { MenuItemText = "Add Left-Nav Menu", MenuItemURL = "ManageLeftNav?add=1", IndentLevel = 1 });
             }
 
             return new NavMenu("Content Management System", nav);
diff --git a/web/Areas/CMS/Services/CmsUserPhotoService.cs b/web/Areas/CMS/Services/CmsUserPhotoService.cs
new file mode 100644
index 000000000..619819ad2
--- /dev/null
+++ b/web/Areas/CMS/Services/CmsUserPhotoService.cs
@@ -0,0 +1,129 @@
+using System.Text.RegularExpressions;
+using Microsoft.EntityFrameworkCore;
+using Viper.Areas.Students.Services;
+using Viper.Classes.SQLContext;
+using Viper.Classes.Utilities;
+
+namespace Viper.Areas.CMS.Services
+{
+    public interface ICmsUserPhotoService
+    {
+        /// <summary>
+        /// Get a user photo by any supported id. Resolution order matches legacy userPhoto.cfc:
+        /// alternate profile photo (by IamId, only when requested via preferAltPhoto),
+        /// then id-card photo (by MailId), then the default "no picture" image.
+        /// </summary>
+        Task<byte[]> GetUserPhotoAsync(string? mailId, string? loginId, string? iamId, bool preferAltPhoto, CancellationToken ct = default);
+    }
+
+    /// <summary>
+    /// User photos for the CMS area (legacy userPhoto.cfc). Id-card photo lookup, caching, and
+    /// the default-photo fallback are delegated to the Students area IPhotoService so there is
+    /// a single photo pipeline; this service adds AAUD id resolution and the alternate
+    /// ProfilePhotos store.
+    /// </summary>
+    public partial class CmsUserPhotoService : ICmsUserPhotoService
+    {
+        private readonly AAUDContext _aaudContext;
+        private readonly IPhotoService _photoService;
+        private readonly ILogger<CmsUserPhotoService> _logger;
+        private readonly string _profilePhotoPath;
+
+        [GeneratedRegex("^[a-zA-Z0-9.-]+$")]
+        private static partial Regex SafeIdRegex();
+
+        public CmsUserPhotoService(AAUDContext aaudContext, IPhotoService photoService,
+            IConfiguration configuration, ILogger<CmsUserPhotoService> logger)
+        {
+            _aaudContext = aaudContext;
+            _photoService = photoService;
+            _logger = logger;
+            // Alternate profile photos live beside IDCardPhotos under the file storage root.
+            _profilePhotoPath = configuration["CMS:ProfilePhotoPath"]
+                ?? Path.Join(Data.CMS.GetRootFileFolder(), "ProfilePhotos");
+        }
+
+        public async Task<byte[]> GetUserPhotoAsync(string? mailId, string? loginId, string? iamId,
+            bool preferAltPhoto, CancellationToken ct = default)
+        {
+            // Resolve whichever id was provided to the person's mailId (+ iamId when needed).
+            (mailId, iamId) = await ResolveIdsAsync(mailId, loginId, iamId, needIamId: preferAltPhoto, ct);
+
+            if (preferAltPhoto && iamId != null)
+            {
+                var altPhoto = await ReadAltPhotoAsync(iamId, ct);
+                if (altPhoto != null)
+                {
+                    return altPhoto;
+                }
+            }
+
+            return await _photoService.GetStudentPhotoAsync(mailId ?? string.Empty);
+        }
+
+        private async Task<(string? MailId, string? IamId)> ResolveIdsAsync(string? mailId, string? loginId,
+            string? iamId, bool needIamId, CancellationToken ct)
+        {
+            // Skip the lookup when every id the caller needs is already known. A mailId alone
+            // serves the id-card photo with no DB query (the legacy hot path for <img> tags).
+            if (!string.IsNullOrEmpty(mailId) && (!string.IsNullOrEmpty(iamId) || !needIamId))
+            {
+                return (mailId, iamId);
+            }
+
+            var query = _aaudContext.AaudUsers.AsNoTracking().Where(u => u.Current != 0);
+            if (!string.IsNullOrEmpty(mailId))
+            {
+                query = query.Where(u => u.MailId == mailId);
+            }
+            else if (!string.IsNullOrEmpty(loginId))
+            {
+                query = query.Where(u => u.LoginId == loginId);
+            }
+            else if (!string.IsNullOrEmpty(iamId))
+            {
+                query = query.Where(u => u.IamId == iamId);
+            }
+            else
+            {
+                return (null, null);
+            }
+
+            var user = await query
+                .Select(u => new { u.MailId, u.IamId })
+                .FirstOrDefaultAsync(ct);
+            return user == null ? (mailId, iamId) : (user.MailId ?? mailId, user.IamId ?? iamId);
+        }
+
+        private async Task<byte[]?> ReadAltPhotoAsync(string iamId, CancellationToken ct)
+        {
+            if (!SafeIdRegex().IsMatch(iamId))
+            {
+                _logger.LogWarning("Rejected alt photo request with invalid iamId {IamId}", LogSanitizer.SanitizeId(iamId));
+                return null;
+            }
+
+            var photoPath = Path.GetFullPath(Path.Join(_profilePhotoPath, Path.GetFileName(iamId) + ".jpg"));
+            var root = Path.GetFullPath(_profilePhotoPath + Path.DirectorySeparatorChar);
+            if (!photoPath.StartsWith(root, StringComparison.OrdinalIgnoreCase) || !File.Exists(photoPath))
+            {
+                return null;
+            }
+
+            try
+            {
+                return await File.ReadAllBytesAsync(photoPath, ct);
+            }
+            catch (IOException ex)
+            {
+                _logger.LogError(ex, "Error reading alt photo for {IamId}", LogSanitizer.SanitizeId(iamId));
+                return null;
+            }
+            catch (UnauthorizedAccessException ex)
+            {
+                _logger.LogError(ex, "Access denied reading alt photo for {IamId}", LogSanitizer.SanitizeId(iamId));
+                return null;
+            }
+        }
+    }
+}
diff --git a/web/Areas/CMS/Validation/MaxLengthEachAttribute.cs b/web/Areas/CMS/Validation/MaxLengthEachAttribute.cs
new file mode 100644
index 000000000..2241ab080
--- /dev/null
+++ b/web/Areas/CMS/Validation/MaxLengthEachAttribute.cs
@@ -0,0 +1,39 @@
+using System.Collections;
+using System.ComponentModel.DataAnnotations;
+
+namespace Viper.Areas.CMS.Validation;
+
+/// <summary>
+/// Validates that every string element in a collection is at most <see cref="Length"/> characters.
+/// [MaxLength] on a collection property bounds only the element count, not each element, so this
+/// guards individual entries against their backing column size (e.g. permission strings vs the
+/// varchar(500) LeftNavItemToPermission.permission column).
+/// </summary>
+[AttributeUsage(AttributeTargets.Property | AttributeTargets.Field)]
+public sealed class MaxLengthEachAttribute : ValidationAttribute
+{
+    public MaxLengthEachAttribute(int length)
+    {
+        Length = length;
+    }
+
+    public int Length { get; }
+
+    protected override ValidationResult? IsValid(object? value, ValidationContext validationContext)
+    {
+        if (value is not IEnumerable items)
+        {
+            return ValidationResult.Success;
+        }
+
+        foreach (var item in items)
+        {
+            if (item is string s && s.Length > Length)
+            {
+                return new ValidationResult($"Each value must be {Length} characters or fewer.");
+            }
+        }
+
+        return ValidationResult.Success;
+    }
+}
diff --git a/web/Areas/CMS/Validation/SafeUrlAttribute.cs b/web/Areas/CMS/Validation/SafeUrlAttribute.cs
index 8b7f893d7..72c90357c 100644
--- a/web/Areas/CMS/Validation/SafeUrlAttribute.cs
+++ b/web/Areas/CMS/Validation/SafeUrlAttribute.cs
@@ -1,12 +1,18 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace Areas.CMS.Validation;
+namespace Viper.Areas.CMS.Validation;
 
 [AttributeUsage(AttributeTargets.Property | AttributeTargets.Field)]
 public sealed class SafeUrlAttribute : ValidationAttribute
 {
     private static readonly string[] AllowedSchemes = { "http", "https", "mailto", "tel" };
 
+    /// <summary>
+    /// Also accept relative URLs (e.g. "/CMS/files", "~/page", "page.cfm?x=1").
+    /// Anything a browser could parse as a scheme is still restricted to the allowlist.
+    /// </summary>
+    public bool AllowRelative { get; set; }
+
     protected override ValidationResult? IsValid(object? value, ValidationContext validationContext)
     {
         if (value is not string url || string.IsNullOrEmpty(url))
@@ -14,16 +20,39 @@ public sealed class SafeUrlAttribute : ValidationAttribute
             return ValidationResult.Success;
         }
 
-        if (!Uri.TryCreate(url.Trim(), UriKind.Absolute, out var uri))
+        url = url.Trim();
+
+        // Browsers strip tabs/newlines when parsing hrefs, so "java\tscript:" still runs
+        if (url.Any(char.IsControl))
         {
-            return new ValidationResult("URL must be a full address starting with http, https, mailto, or tel.");
+            return new ValidationResult("URL contains invalid characters.");
         }
 
-        if (!AllowedSchemes.Contains(uri.Scheme, StringComparer.OrdinalIgnoreCase))
+        // A colon in the first path segment is what browsers parse as a scheme;
+        // checking it directly avoids Uri's platform-dependent handling of
+        // rooted paths like "/CMS/files" (parsed as file:// on Unix)
+        if (!url.Split('/', '?', '#')[0].Contains(':'))
         {
-            return new ValidationResult("URL protocol must be http, https, mailto, or tel.");
+            if (!AllowRelative)
+            {
+                return new ValidationResult("URL must be a full address starting with http, https, mailto, or tel.");
+            }
+
+            // Reject protocol-relative ("network-path") references like "//evil.example/x":
+            // a browser navigates those off-site even though they carry no scheme. Backslashes
+            // are normalized to forward slashes when parsing URLs, so "/\", "\\", and "\/" are
+            // equivalent bypasses and must be rejected too.
+            if (url.Length >= 2 && (url[0] == '/' || url[0] == '\\') && (url[1] == '/' || url[1] == '\\'))
+            {
+                return new ValidationResult("URL must not start with // (that would point to another site).");
+            }
+
+            return ValidationResult.Success;
         }
 
-        return ValidationResult.Success;
+        return Uri.TryCreate(url, UriKind.Absolute, out var uri)
+            && AllowedSchemes.Contains(uri.Scheme, StringComparer.OrdinalIgnoreCase)
+            ? ValidationResult.Success
+            : new ValidationResult("URL protocol must be http, https, mailto, or tel.");
     }
 }
diff --git a/web/Classes/Utilities/DateRangeHelper.cs b/web/Classes/Utilities/DateRangeHelper.cs
new file mode 100644
index 000000000..9ffb4c873
--- /dev/null
+++ b/web/Classes/Utilities/DateRangeHelper.cs
@@ -0,0 +1,26 @@
+namespace Viper.Classes.Utilities;
+
+/// <summary>
+/// Helpers for date-range query filters.
+/// </summary>
+public static class DateRangeHelper
+{
+    /// <summary>
+    /// Exclusive upper bound for an inclusive "To" date filter. A value with no time component
+    /// (midnight) is treated as "through the end of that day", so the next midnight is returned;
+    /// a value that already carries a time of day is returned unchanged. Compare with
+    /// &lt; against the result.
+    /// </summary>
+    public static DateTime ExclusiveUpperBound(DateTime to)
+    {
+        // There is no day after DateTime.MaxValue.Date to advance to, so AddDays(1) would throw
+        // for a user-suppliable filter value at the ceiling. Clamp to MaxValue, which is still a
+        // safe exclusive upper bound (nothing sorts after it).
+        if (to >= DateTime.MaxValue.Date)
+        {
+            return DateTime.MaxValue;
+        }
+
+        return to.Date == to ? to.AddDays(1) : to;
+    }
+}
diff --git a/web/Program.cs b/web/Program.cs
index 8f87dc1e7..669006b0f 100644
--- a/web/Program.cs
+++ b/web/Program.cs
@@ -27,6 +27,7 @@
 using QuestPDF.Infrastructure;
 using Scrutor;
 using Viper;
+using Viper.Areas.CMS.Services;
 using Viper.Areas.Effort;
 using Viper.Areas.Effort.Data;
 using Viper.Areas.Effort.Services.Harvest;
@@ -96,6 +97,9 @@
     // in Development. See ForwardedHeadersExtensions.
     builder.Services.AddViperForwardedHeaders(builder.Environment, logger);
 
+    // Rate limiting for CMS downloads (single files + ZIP archives). See CmsDownloadRateLimiting.
+    builder.Services.AddCmsDownloadRateLimiting(builder.Configuration);
+
     // Add services to the container.
     builder.Services.AddControllersWithViews(options =>
         {
@@ -495,6 +499,9 @@ void RegisterDbContext<TContext>(string connectionStringKey) where TContext : Db
     // still before health checks, Hangfire, and controllers, which need an authenticated user.
     app.UseAuthentication();
     app.UseAuthorization();
+    // After auth so download rate-limit buckets can key on the logged-in user
+    // instead of the client IP (kinder to shared campus NAT).
+    app.UseRateLimiter();
     app.UseCookiePolicy();
     app.UseSession();
 
diff --git a/web/Services/HtmlSanitizerService.cs b/web/Services/HtmlSanitizerService.cs
index 7a9de7841..0001f47ec 100644
--- a/web/Services/HtmlSanitizerService.cs
+++ b/web/Services/HtmlSanitizerService.cs
@@ -9,12 +9,19 @@ namespace Viper.Services
     public class HtmlSanitizerService : IHtmlSanitizerService
     {
         private readonly HtmlSanitizer _sanitizer;
+        private readonly HtmlSanitizer _diffSanitizer;
 
         public HtmlSanitizerService()
         {
-            _sanitizer = new HtmlSanitizer();
+            _sanitizer = BuildSanitizer(allowDiffMarkers: false);
+            _diffSanitizer = BuildSanitizer(allowDiffMarkers: true);
+        }
+
+        private static HtmlSanitizer BuildSanitizer(bool allowDiffMarkers)
+        {
+            var sanitizer = new HtmlSanitizer();
 
-            _sanitizer.AllowedTags.Clear();
+            sanitizer.AllowedTags.Clear();
             foreach (var tag in new[]
             {
                 "p", "br", "hr", "strong", "b", "em", "i", "u", "s", "strike",
@@ -26,10 +33,20 @@ public HtmlSanitizerService()
                 "sub", "sup", "small", "abbr", "cite", "q"
             })
             {
-                _sanitizer.AllowedTags.Add(tag);
+                sanitizer.AllowedTags.Add(tag);
+            }
+
+            if (allowDiffMarkers)
+            {
+                // htmldiff.net wraps changes in <ins>/<del> (classes diffins/diffdel/diffmod).
+                // Allowing just these two tags lets a diff be re-sanitized to balance the library's
+                // markup and strip anything off-policy while keeping the change markers. The class
+                // attribute is already allowed below, so the diff* classes survive.
+                sanitizer.AllowedTags.Add("ins");
+                sanitizer.AllowedTags.Add("del");
             }
 
-            _sanitizer.AllowedAttributes.Clear();
+            sanitizer.AllowedAttributes.Clear();
             foreach (var attr in new[]
             {
                 "href", "src", "alt", "title", "class", "id", "name",
@@ -38,7 +55,7 @@ public HtmlSanitizerService()
                 "style"
             })
             {
-                _sanitizer.AllowedAttributes.Add(attr);
+                sanitizer.AllowedAttributes.Add(attr);
             }
 
             // Curated CSS property allowlist. Mirrors legacy antisamy-cms.xml plus font-size, which
@@ -46,7 +63,7 @@ public HtmlSanitizerService()
             // dangerous CSS value constructs are blocked by Ganss.Xss regardless of this list.
             // Shorthand properties (text-decoration, list-style) get expanded to longhands by
             // AngleSharp; both forms must be allowed or the entire declaration is dropped.
-            _sanitizer.AllowedCssProperties.Clear();
+            sanitizer.AllowedCssProperties.Clear();
             foreach (var prop in new[]
             {
                 "color", "font-family", "font-size", "font-style", "font-weight",
@@ -60,25 +77,25 @@ public HtmlSanitizerService()
                 "list-style", "list-style-type", "list-style-position", "list-style-image"
             })
             {
-                _sanitizer.AllowedCssProperties.Add(prop);
+                sanitizer.AllowedCssProperties.Add(prop);
             }
 
-            _sanitizer.AllowedSchemes.Clear();
-            _sanitizer.AllowedSchemes.Add("http");
-            _sanitizer.AllowedSchemes.Add("https");
-            _sanitizer.AllowedSchemes.Add("mailto");
-            _sanitizer.AllowedSchemes.Add("tel");
+            sanitizer.AllowedSchemes.Clear();
+            sanitizer.AllowedSchemes.Add("http");
+            sanitizer.AllowedSchemes.Add("https");
+            sanitizer.AllowedSchemes.Add("mailto");
+            sanitizer.AllowedSchemes.Add("tel");
 
             // Block all CSS at-rules (@import, @font-face, etc.). At-rules are not valid inside
             // an inline style attribute, but clearing the set is defense in depth against parser
             // edge cases.
-            _sanitizer.AllowedAtRules.Clear();
+            sanitizer.AllowedAtRules.Clear();
 
             // Block data: URIs in any URL (image XSS vector) on top of the scheme allowlist.
             // Also lock <img src> to relative URLs only — matches the legacy antisamy-cms.xml
             // onsiteURL regex and prevents editor-authored content from embedding third-party
             // tracking beacons or any absolute-URL image (same-origin absolutes included).
-            _sanitizer.FilterUrl += (sender, args) =>
+            sanitizer.FilterUrl += (_, args) =>
             {
                 if (args.OriginalUrl.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
                 {
@@ -92,6 +109,8 @@ public HtmlSanitizerService()
                     args.SanitizedUrl = null;
                 }
             };
+
+            return sanitizer;
         }
 
         private static bool IsOffSiteUrl(string url)
@@ -103,5 +122,7 @@ private static bool IsOffSiteUrl(string url)
         }
 
         public string Sanitize(string html) => _sanitizer.Sanitize(html);
+
+        public string SanitizeDiff(string html) => _diffSanitizer.Sanitize(html);
     }
 }
diff --git a/web/Services/IHtmlSanitizerService.cs b/web/Services/IHtmlSanitizerService.cs
index ab451e0a3..0225b525b 100644
--- a/web/Services/IHtmlSanitizerService.cs
+++ b/web/Services/IHtmlSanitizerService.cs
@@ -3,5 +3,12 @@ namespace Viper.Services
     public interface IHtmlSanitizerService
     {
         string Sanitize(string html);
+
+        /// <summary>
+        /// Sanitize generated diff markup. Same policy as <see cref="Sanitize"/> but additionally
+        /// permits the &lt;ins&gt;/&lt;del&gt; markers htmldiff.net wraps changes in, so a diff can be
+        /// re-parsed (balancing the library's malformed tags) and stripped to policy before render.
+        /// </summary>
+        string SanitizeDiff(string html);
     }
 }
diff --git a/web/Viper.csproj b/web/Viper.csproj
index 4ccb2a6ac..eafc1ba5a 100644
--- a/web/Viper.csproj
+++ b/web/Viper.csproj
@@ -54,6 +54,7 @@
     <PackageReference Include="Hangfire.Heartbeat" Version="0.6.0" />
     <PackageReference Include="Hangfire.SqlServer" Version="1.8.23" />
     <PackageReference Include="HtmlAgilityPack" Version="1.12.4" />
+    <PackageReference Include="htmldiff.net" Version="1.5.0" />
     <PackageReference Include="HtmlSanitizer" Version="9.0.892" />
     <PackageReference Include="JetBrains.Annotations" Version="2025.2.4" />
     <PackageReference Include="Joonasw.AspNetCore.SecurityHeaders" Version="6.0.0" />
diff --git a/web/appsettings.json b/web/appsettings.json
index 39f5bbfe9..804b7e799 100644
--- a/web/appsettings.json
+++ b/web/appsettings.json
@@ -39,5 +39,11 @@
     "Hangfire": {
         // Hangfire's tables live in ConnectionStrings:VIPER.
         "Enabled": true
+    },
+    "Cms": {
+        // Gates the cms:trash-purge scheduled job. Keep false until the legacy VIPER 1 30-day
+        // trash purge is retired, so the two never purge in parallel. Flip to true (via SSM in
+        // deployed envs) at cutover to let the daily job permanently delete files trashed > 30 days ago.
+        "TrashPurgeEnabled": false
     }
 }