Merge pull request #2116 from umbraco/temp-deploy-350

changes needed for blueprints to differentiate them from content items.

.editorconfig

@@ -3,7 +3,7 @@ root=true
 [*]
 end_of_line = lf
 indent_style = space
-indent_size = 2
+indent_size = 4
 trim_trailing_whitespace = true
 
 [*.{cs,cshtml,csx,vb,vbx,vbhtml,fs,fsx,txt,ps1,sql}]

.gitignore

@@ -143,5 +143,6 @@ build/csharp-docs.zip
 build/msbuild.log
 .vs/
 src/packages/
+src/PrecompiledWeb/*
 build/tools/
 src/PrecompiledWeb/*

build/NuSpecs/UmbracoCms.Core.nuspec

@@ -21,9 +21,9 @@
       <dependency id="Microsoft.AspNet.WebApi" version="[5.2.3,6.0.0)" />
       <dependency id="Microsoft.AspNet.Identity.Owin" version="[2.2.1, 3.0.0)" />
       <dependency id="Microsoft.AspNet.SignalR.Core" version="[2.2.1, 3.0.0)" />
-      <dependency id="Microsoft.Owin.Security.Cookies" version="[3.0.1, 4.0.0)" />
-      <dependency id="Microsoft.Owin.Security.OAuth" version="[3.0.1, 4.0.0)" />
-      <dependency id="Microsoft.Owin.Host.SystemWeb" version="[3.0.1, 4.0.0)" />
+      <dependency id="Microsoft.Owin.Security.Cookies" version="[3.1.0, 4.0.0)" />
+      <dependency id="Microsoft.Owin.Security.OAuth" version="[3.1.0, 4.0.0)" />
+      <dependency id="Microsoft.Owin.Host.SystemWeb" version="[3.1.0, 4.0.0)" />
       <dependency id="MiniProfiler" version="[2.1.0, 3.0.0)" />
       <dependency id="HtmlAgilityPack" version="[1.4.9.5, 2.0.0)" />
       <dependency id="Lucene.Net" version="[2.9.4.1, 3.0.0.0)" />
@@ -40,7 +40,7 @@
       <dependency id="semver" version="[1.1.2, 3.0.0)" />
 	    <!-- Markdown can not be updated due to: https://github.com/hey-red/markdownsharp/issues/71#issuecomment-233585487 -->
       <dependency id="Markdown" version="[1.14.7, 2.0.0)" />
-      <dependency id="System.Threading.Tasks.Dataflow" version="[4.7.0, 5.0.0)" />
+      <dependency id="System.Threading.Tasks.Dataflow" version="[4.7.0, 5.0.0)" />
     </dependencies>
   </metadata>
   <files>

build/NuSpecs/tools/Web.config.install.xdt

@@ -15,6 +15,7 @@
       <section name="BaseRestExtensions" type="Umbraco.Core.Configuration.BaseRest.BaseRestSection, Umbraco.Core" requirePermission="false" xdt:Locator="Match(name)" xdt:Transform="InsertIfMissing" />
       <section name="FileSystemProviders" type="Umbraco.Core.Configuration.FileSystemProvidersSection, Umbraco.Core" requirePermission="false" xdt:Locator="Match(name)" xdt:Transform="InsertIfMissing" />
       <section name="dashBoard" type="Umbraco.Core.Configuration.Dashboard.DashboardSection, Umbraco.Core" requirePermission="false" xdt:Locator="Match(name)" xdt:Transform="InsertIfMissing" />
+      <section name="HealthChecks" type="Umbraco.Core.Configuration.HealthChecks.HealthChecksSection, Umbraco.Core" requirePermission="false" xdt:Locator="Match(name)" xdt:Transform="InsertIfMissing" />
     </sectionGroup>
   </configSections>
 
@@ -30,6 +31,7 @@
     <BaseRestExtensions configSource="config\BaseRestExtensions.config" xdt:Locator="Match(configSource)" xdt:Transform="InsertIfMissing" />
     <FileSystemProviders configSource="config\FileSystemProviders.config" xdt:Locator="Match(configSource)" xdt:Transform="InsertIfMissing" />
     <dashBoard configSource="config\Dashboard.config" xdt:Locator="Match(configSource)" xdt:Transform="InsertIfMissing" />
+    <HealthChecks configSource="config\HealthChecks.config" xdt:Locator="Match(configSource)" xdt:Transform="InsertIfMissing" />
   </umbracoConfiguration>
 
   <FileSystemProviders xdt:Transform="Remove" />
@@ -368,19 +370,19 @@
       </dependentAssembly>
       <dependentAssembly xdt:Transform="Insert">
         <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly xdt:Transform="Insert">
         <assemblyIdentity name="Microsoft.Owin.Security.OAuth" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly xdt:Transform="Insert">
         <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly xdt:Transform="Insert">
         <assemblyIdentity name="Microsoft.Owin.Security.Cookies" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly xdt:Transform="Insert">
         <assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" />

build/NuSpecs/tools/trees.config.install.xdt

@@ -102,15 +102,16 @@
        xdt:Transform="Remove" />
 
   <!--Users-->
-  <add application="users" alias="users" title="Users" type="umbraco.loadUsers, umbraco" iconClosed="icon-folder" iconOpen="icon-folder" sortOrder="0" 
+ <add initialize="true" sortOrder="0" alias="users" application="users" iconClosed="icon-folder" iconOpen="icon-folder-open" type="Umbraco.Web.Trees.UserTreeController, umbraco" 
+      xdt:Locator="Match(application,alias)"
+      xdt:Transform="SetAttributes()" />
+
+  <add application="users" alias="userTypes"
        xdt:Locator="Match(application,alias)" 
-       xdt:Transform="SetAttributes()" />
-  <add application="users" alias="userTypes" title="User Types" type="umbraco.cms.presentation.Trees.UserTypes, umbraco" iconClosed="icon-folder" iconOpen="icon-folder" sortOrder="1" 
+       xdt:Transform="Remove" />
+  <add application="users" alias="userPermissions" 
        xdt:Locator="Match(application,alias)" 
-       xdt:Transform="SetAttributes()" />
-  <add application="users" alias="userPermissions" title="User Permissions" type="umbraco.cms.presentation.Trees.UserPermissions, umbraco" iconClosed="icon-folder" iconOpen="icon-folder" sortOrder="2" 
-       xdt:Locator="Match(application,alias)" 
-       xdt:Transform="SetAttributes()" />
+       xdt:Transform="Remove" />
 
   <!--Members-->
   <add initialize="true" sortOrder="0" alias="member" application="member" title="Members" iconClosed="icon-folder" iconOpen="icon-folder-open" type="Umbraco.Web.Trees.MemberTreeController, umbraco" 

build/UmbracoVersion.txt

@@ -1,2 +1,3 @@
 # Usage: on line 2 put the release version, on line 3 put the version comment (example: beta)
-7.6.5
+7.7.0
+beta

src/SQLCE4Umbraco/app.config

@@ -16,19 +16,19 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Microsoft.Owin.Security.OAuth" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Microsoft.Owin.Security.Cookies" publicKeyToken="31bf3856ad364e35" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-3.0.1.0" newVersion="3.0.1.0" />
+        <bindingRedirect oldVersion="0.0.0.0-3.1.0.0" newVersion="3.1.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="log4net" publicKeyToken="669e0ddf0bb1aa2a" culture="neutral" />

src/SolutionInfo.cs

@@ -11,5 +11,5 @@ using System.Resources;
 
 [assembly: AssemblyVersion("1.0.*")]
 
-[assembly: AssemblyFileVersion("7.6.5")]
-[assembly: AssemblyInformationalVersion("7.6.5")]
+[assembly: AssemblyFileVersion("7.7.0")]
+[assembly: AssemblyInformationalVersion("7.7.0-beta")]

src/Umbraco.Core/Cache/CacheKeys.cs

@@ -55,8 +55,10 @@ namespace Umbraco.Core.Cache
         [Obsolete("This is no longer used and will be removed from the codebase in the future")]
         [EditorBrowsable(EditorBrowsableState.Never)]
         public const string UserCacheKey = "UmbracoUser";
-        
-        public const string UserPermissionsCacheKey = "UmbracoUserPermissions";
+
+        [Obsolete("This is no longer used and will be removed from the codebase in the future")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        public const string UserGroupPermissionsCacheKey = "UmbracoUserGroupPermissions";
 
         [UmbracoWillObsolete("This cache key is only used for legacy business logic caching, remove in v8")]
         public const string ContentTypeCacheKey = "UmbracoContentType";

src/Umbraco.Core/CodeAnnotations/ActionMetadataAttribute.cs

@@ -0,0 +1,34 @@
+using System;
+
+namespace Umbraco.Core.CodeAnnotations
+{
+    [AttributeUsage(AttributeTargets.Class, AllowMultiple = false, Inherited = false)]
+    internal class ActionMetadataAttribute : Attribute
+    {
+        public string Category { get; private set; }
+        public string Name { get; private set; }
+
+        /// <summary>
+        /// Constructor used to assign a Category, since no name is assigned it will try to be translated from the language files based on the action's alias
+        /// </summary>
+        /// <param name="category"></param>
+        public ActionMetadataAttribute(string category)
+        {
+            if (string.IsNullOrWhiteSpace(category)) throw new ArgumentException("Value cannot be null or whitespace.", "category");
+            Category = category;
+        }
+
+        /// <summary>
+        /// Constructor used to assign an explicit name and category
+        /// </summary>
+        /// <param name="category"></param>
+        /// <param name="name"></param>
+        public ActionMetadataAttribute(string category, string name)
+        {
+            if (string.IsNullOrWhiteSpace(category)) throw new ArgumentException("Value cannot be null or whitespace.", "category");
+            if (string.IsNullOrWhiteSpace(name)) throw new ArgumentException("Value cannot be null or whitespace.", "name");
+            Category = category;
+            Name = name;
+        }
+    }
+}

src/Umbraco.Core/Configuration/GlobalSettings.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Configuration;
 using System.Linq;
+using System.Net.Configuration;
 using System.Web;
 using System.Web.Configuration;
 using System.Web.Hosting;
@@ -42,7 +43,6 @@ namespace Umbraco.Core.Configuration
         //ensure the built on (non-changeable) reserved paths are there at all times
         private const string StaticReservedPaths = "~/app_plugins/,~/install/,";
         private const string StaticReservedUrls = "~/config/splashes/booting.aspx,~/config/splashes/noNodes.aspx,~/VSEnterpriseHelper.axd,";
-
         #endregion
 
         /// <summary>
@@ -53,6 +53,7 @@ namespace Umbraco.Core.Configuration
             _reservedUrlsCache = null;
             _reservedPaths = null;
             _reservedUrls = null;
+            HasSmtpServer = null;
         }
 
         /// <summary>
@@ -64,7 +65,26 @@ namespace Umbraco.Core.Configuration
             ResetInternal();
         }
 
-    	/// <summary>
+        public static bool HasSmtpServerConfigured(string appPath)
+        {
+            if (HasSmtpServer.HasValue) return HasSmtpServer.Value;
+
+            var config = WebConfigurationManager.OpenWebConfiguration(appPath);
+            var settings = (MailSettingsSectionGroup)config.GetSectionGroup("system.net/mailSettings");
+            if (settings == null || settings.Smtp == null) return false;
+            if (settings.Smtp.SpecifiedPickupDirectory != null && string.IsNullOrEmpty(settings.Smtp.SpecifiedPickupDirectory.PickupDirectoryLocation) == false)
+                return true;
+            if (settings.Smtp.Network != null && string.IsNullOrEmpty(settings.Smtp.Network.Host) == false)
+                return true;
+            return false;
+        }
+
+        /// <summary>
+        /// For testing only
+        /// </summary>
+        internal static bool? HasSmtpServer { get; set; }
+
+        /// <summary>
         /// Gets the reserved urls from web.config.
         /// </summary>
         /// <value>The reserved urls.</value>

src/Umbraco.Core/Configuration/HealthChecks/DisabledHealthCheckElement.cs

@@ -0,0 +1,42 @@
+using System;
+using System.Collections.Generic;
+using System.Configuration;
+using System.Linq;
+using System.Text;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public class DisabledHealthCheckElement : ConfigurationElement, IDisabledHealthCheck
+    {
+        private const string IdKey = "id";
+        private const string DisabledOnKey = "disabledOn";
+        private const string DisabledByKey = "disabledBy";
+
+        [ConfigurationProperty(IdKey, IsKey = true, IsRequired = true)]
+        public Guid Id
+        {
+            get
+            {
+                return ((Guid)(base[IdKey]));
+            }
+        }
+
+        [ConfigurationProperty(DisabledOnKey, IsKey = false, IsRequired = false)]
+        public DateTime DisabledOn
+        {
+            get
+            {
+                return ((DateTime)(base[DisabledOnKey]));
+            }
+        }
+
+        [ConfigurationProperty(DisabledByKey, IsKey = false, IsRequired = false)]
+        public int DisabledBy
+        {
+            get
+            {
+                return ((int)(base[DisabledByKey]));
+            }
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/DisabledHealthChecksElementCollection.cs

@@ -0,0 +1,40 @@
+using System.Collections.Generic;
+using System.Configuration;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    [ConfigurationCollection(typeof(DisabledHealthCheckElement), AddItemName = "check")]
+    public class DisabledHealthChecksElementCollection : ConfigurationElementCollection, IEnumerable<IDisabledHealthCheck> 
+    {
+        protected override ConfigurationElement CreateNewElement()
+        {
+            return new DisabledHealthCheckElement();
+        }
+
+        protected override object GetElementKey(ConfigurationElement element)
+        {
+            return ((DisabledHealthCheckElement)(element)).Id;
+        }
+
+        public new DisabledHealthCheckElement this[string key]
+        {
+            get
+            {
+                return (DisabledHealthCheckElement)BaseGet(key);
+            }
+        }
+
+        IEnumerator<IDisabledHealthCheck> IEnumerable<IDisabledHealthCheck>.GetEnumerator()
+        {
+            for (var i = 0; i < Count; i++)
+            {
+                yield return BaseGet(i) as DisabledHealthCheckElement;
+            }
+        }
+
+        System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator()
+        {
+            return GetEnumerator();
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/HealthCheckNotificationSettingsElement.cs

@@ -0,0 +1,85 @@
+using System;
+using System.Collections.Generic;
+using System.Configuration;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public class HealthCheckNotificationSettingsElement : ConfigurationElement, IHealthCheckNotificationSettings
+    {
+        private const string EnabledKey = "enabled";
+        private const string FirstRunTimeKey = "firstRunTime";
+        private const string PeriodKey = "periodInHours";
+        private const string NotificationMethodsKey = "notificationMethods";
+        private const string DisabledChecksKey = "disabledChecks";
+
+        [ConfigurationProperty(EnabledKey, IsRequired = true)]
+        public bool Enabled
+        {
+            get
+            {
+                return (bool)base[EnabledKey];
+            }
+        }
+
+        [ConfigurationProperty(FirstRunTimeKey, IsRequired = false)]
+        public string FirstRunTime
+        {
+            get
+            {
+                return (string)base[FirstRunTimeKey];
+            }
+        }
+
+        [ConfigurationProperty(PeriodKey, IsRequired = true)]
+        public int PeriodInHours
+        {
+            get
+            {
+                return (int)base[PeriodKey];
+            }
+        }
+
+        [ConfigurationProperty(NotificationMethodsKey, IsDefaultCollection = true, IsRequired = false)]
+        public NotificationMethodsElementCollection NotificationMethods
+        {
+            get
+            {
+                return (NotificationMethodsElementCollection)base[NotificationMethodsKey];
+            }
+        }
+
+        [ConfigurationProperty(DisabledChecksKey, IsDefaultCollection = false, IsRequired = false)]
+        public DisabledHealthChecksElementCollection DisabledChecks
+        {
+            get
+            {
+                return (DisabledHealthChecksElementCollection)base[DisabledChecksKey];
+            }
+        }
+
+        bool IHealthCheckNotificationSettings.Enabled
+        {
+            get { return Enabled; }
+        }
+
+        string IHealthCheckNotificationSettings.FirstRunTime
+        {
+            get { return FirstRunTime; }
+        }
+
+        int IHealthCheckNotificationSettings.PeriodInHours
+        {
+            get { return PeriodInHours; }
+        }
+
+        IReadOnlyDictionary<string, INotificationMethod> IHealthCheckNotificationSettings.NotificationMethods
+        {
+            get { return NotificationMethods; }
+        }
+
+        IEnumerable<IDisabledHealthCheck> IHealthCheckNotificationSettings.DisabledChecks
+        {
+            get { return DisabledChecks; }
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/HealthCheckNotificationVerbosity.cs

@@ -0,0 +1,8 @@
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public enum HealthCheckNotificationVerbosity
+    {
+        Summary,
+        Detailed
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/HealthChecksSection.cs

@@ -0,0 +1,34 @@
+using System;
+using System.Collections.Generic;
+using System.Configuration;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public class HealthChecksSection : ConfigurationSection, IHealthChecks
+    {
+        private const string DisabledChecksKey = "disabledChecks";
+        private const string NotificationSettingsKey = "notificationSettings";
+
+        [ConfigurationProperty(DisabledChecksKey)]
+        public DisabledHealthChecksElementCollection DisabledChecks
+        {
+            get { return ((DisabledHealthChecksElementCollection)(base[DisabledChecksKey])); }
+        }
+
+        [ConfigurationProperty(NotificationSettingsKey, IsRequired = true)]
+        public HealthCheckNotificationSettingsElement NotificationSettings
+        {
+            get { return ((HealthCheckNotificationSettingsElement)(base[NotificationSettingsKey])); }
+        }
+
+        IEnumerable<IDisabledHealthCheck> IHealthChecks.DisabledChecks
+        {
+            get { return DisabledChecks; }
+        }
+
+        IHealthCheckNotificationSettings IHealthChecks.NotificationSettings
+        {
+            get { return NotificationSettings; }
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/IDisabledHealthCheck.cs

@@ -0,0 +1,11 @@
+using System;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public interface IDisabledHealthCheck
+    {
+        Guid Id { get; }
+        DateTime DisabledOn { get; }
+        int DisabledBy { get; }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/IHealthCheckNotificationSettings.cs

@@ -0,0 +1,13 @@
+using System.Collections.Generic;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public interface IHealthCheckNotificationSettings
+    {
+        bool Enabled { get; }
+        string FirstRunTime { get; }
+        int PeriodInHours { get; }
+        IReadOnlyDictionary<string, INotificationMethod> NotificationMethods { get; }
+        IEnumerable<IDisabledHealthCheck> DisabledChecks { get; }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/IHealthChecks.cs

@@ -0,0 +1,10 @@
+using System.Collections.Generic;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public interface IHealthChecks
+    {
+        IEnumerable<IDisabledHealthCheck> DisabledChecks { get; }
+        IHealthCheckNotificationSettings NotificationSettings { get; }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/INotificationMethod.cs

@@ -0,0 +1,13 @@
+using System.Collections.Generic;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public interface INotificationMethod
+    {
+        string Alias { get; }
+        bool Enabled { get; }
+        HealthCheckNotificationVerbosity Verbosity { get; }
+        bool FailureOnly { get; }
+        IReadOnlyDictionary<string, INotificationMethodSettings> Settings { get; }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/INotificationMethodSettings.cs

@@ -0,0 +1,8 @@
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public interface INotificationMethodSettings
+    {
+        string Key { get; }
+        string Value { get; }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/NotificationMethodElement.cs

@@ -0,0 +1,85 @@
+using System;
+using System.Collections.Generic;
+using System.Configuration;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public class NotificationMethodElement : ConfigurationElement, INotificationMethod
+    {
+        private const string AliasKey = "alias";
+        private const string EnabledKey = "enabled";
+        private const string VerbosityKey = "verbosity";
+        private const string FailureonlyKey = "failureOnly";
+        private const string SettingsKey = "settings";
+
+        [ConfigurationProperty(AliasKey, IsKey = true, IsRequired = true)]
+        public string Alias 
+        {
+            get
+            {
+                return (string)base[AliasKey];
+            }
+        }
+
+        [ConfigurationProperty(EnabledKey, IsKey = true, IsRequired = true)]
+        public bool Enabled
+        {
+            get
+            {
+                return (bool)base[EnabledKey];
+            }
+        }
+
+        [ConfigurationProperty(VerbosityKey, IsRequired = true)]
+        public HealthCheckNotificationVerbosity Verbosity
+        {
+            get
+            {
+                return (HealthCheckNotificationVerbosity)base[VerbosityKey];
+            }
+        }
+
+        [ConfigurationProperty(FailureonlyKey, IsRequired = false)]
+        public bool FailureOnly
+        {
+            get
+            {
+                return (bool)base[FailureonlyKey];
+            }
+        }
+
+        [ConfigurationProperty(SettingsKey, IsDefaultCollection = true, IsRequired = false)]
+        public NotificationMethodSettingsElementCollection Settings
+        {
+            get
+            {
+                return (NotificationMethodSettingsElementCollection)base[SettingsKey];
+            }
+        }
+
+        string INotificationMethod.Alias
+        {
+            get { return Alias; }
+        }
+
+        bool INotificationMethod.Enabled
+        {
+            get { return Enabled; }
+        }
+
+        HealthCheckNotificationVerbosity INotificationMethod.Verbosity
+        {
+            get { return Verbosity; }
+        }
+
+        bool INotificationMethod.FailureOnly
+        {
+            get { return FailureOnly; }
+        }
+
+        IReadOnlyDictionary<string, INotificationMethodSettings> INotificationMethod.Settings
+        {
+            get { return Settings; }
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/NotificationMethodSettingsElement.cs

@@ -0,0 +1,28 @@
+using System.Configuration;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    public class NotificationMethodSettingsElement : ConfigurationElement, INotificationMethodSettings
+    {
+        private const string KeyKey = "key";
+        private const string ValueKey = "value";
+
+        [ConfigurationProperty(KeyKey, IsKey = true, IsRequired = true)]
+        public string Key 
+        {
+            get
+            {
+                return (string)base[KeyKey];
+            }
+        }
+
+        [ConfigurationProperty(ValueKey, IsRequired = true)]
+        public string Value
+        {
+            get
+            {
+                return (string)base[ValueKey];
+            }
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/NotificationMethodSettingsElementCollection.cs

@@ -0,0 +1,80 @@
+using System;
+using System.Collections.Generic;
+using System.Configuration;
+using System.Linq;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    [ConfigurationCollection(typeof(NotificationMethodSettingsElement), AddItemName = "add")]
+    public class NotificationMethodSettingsElementCollection : ConfigurationElementCollection, IEnumerable<INotificationMethodSettings>, IReadOnlyDictionary<string, INotificationMethodSettings>
+    {
+        protected override ConfigurationElement CreateNewElement()
+        {
+            return new NotificationMethodSettingsElement();
+        }
+
+        protected override object GetElementKey(ConfigurationElement element)
+        {
+            return ((NotificationMethodSettingsElement)(element)).Key;
+        }        
+
+        IEnumerator<KeyValuePair<string, INotificationMethodSettings>> IEnumerable<KeyValuePair<string, INotificationMethodSettings>>.GetEnumerator()
+        {
+            for (var i = 0; i < Count; i++)
+            {
+                var val = (NotificationMethodSettingsElement)BaseGet(i);
+                var key = (string)BaseGetKey(i);
+                yield return new KeyValuePair<string, INotificationMethodSettings>(key, val);
+            }
+        }
+
+        IEnumerator<INotificationMethodSettings> IEnumerable<INotificationMethodSettings>.GetEnumerator()
+        {
+            for (var i = 0; i < Count; i++)
+            {
+                yield return (NotificationMethodSettingsElement)BaseGet(i);
+            }
+        }
+
+        bool IReadOnlyDictionary<string, INotificationMethodSettings>.ContainsKey(string key)
+        {
+            return ((IReadOnlyDictionary<string, INotificationMethodSettings>)this).Keys.Any(x => x == key);
+        }
+
+        bool IReadOnlyDictionary<string, INotificationMethodSettings>.TryGetValue(string key, out INotificationMethodSettings value)
+        {
+            try
+            {
+                var val = (NotificationMethodSettingsElement)BaseGet(key);
+                value = val;
+                return true;
+            }
+            catch (Exception)
+            {
+                value = null;
+                return false;
+            }
+        }
+
+        INotificationMethodSettings IReadOnlyDictionary<string, INotificationMethodSettings>.this[string key]
+        {
+            get { return (NotificationMethodSettingsElement)BaseGet(key); }
+        }
+
+        IEnumerable<string> IReadOnlyDictionary<string, INotificationMethodSettings>.Keys
+        {
+            get { return BaseGetAllKeys().Cast<string>(); }
+        }
+
+        IEnumerable<INotificationMethodSettings> IReadOnlyDictionary<string, INotificationMethodSettings>.Values
+        {
+            get
+            {
+                for (var i = 0; i < Count; i++)
+                {
+                    yield return (NotificationMethodSettingsElement)BaseGet(i);
+                }
+            }
+        }
+    }
+}

src/Umbraco.Core/Configuration/HealthChecks/NotificationMethodsElementCollection.cs

@@ -0,0 +1,80 @@
+using System;
+using System.Collections.Generic;
+using System.Configuration;
+using System.Linq;
+
+namespace Umbraco.Core.Configuration.HealthChecks
+{
+    [ConfigurationCollection(typeof(NotificationMethodElement), AddItemName = "notificationMethod")]
+    public class NotificationMethodsElementCollection : ConfigurationElementCollection, IEnumerable<INotificationMethod>, IReadOnlyDictionary<string, INotificationMethod>
+    {
+        protected override ConfigurationElement CreateNewElement()
+        {
+            return new NotificationMethodElement();
+        }
+
+        protected override object GetElementKey(ConfigurationElement element)
+        {
+            return ((NotificationMethodElement)(element)).Alias;
+        }
+        
+        IEnumerator<KeyValuePair<string, INotificationMethod>> IEnumerable<KeyValuePair<string, INotificationMethod>>.GetEnumerator()
+        {
+            for (var i = 0; i < Count; i++)
+            {
+                var val = (NotificationMethodElement)BaseGet(i);
+                var key = (string)BaseGetKey(i);
+                yield return new KeyValuePair<string, INotificationMethod>(key, val);
+            }
+        }
+
+        IEnumerator<INotificationMethod> IEnumerable<INotificationMethod>.GetEnumerator()
+        {
+            for (var i = 0; i < Count; i++)
+            {
+                yield return (NotificationMethodElement)BaseGet(i);
+            }
+        }
+
+        bool IReadOnlyDictionary<string, INotificationMethod>.ContainsKey(string key)
+        {
+            return ((IReadOnlyDictionary<string, INotificationMethod>) this).Keys.Any(x => x == key);
+        }
+
+        bool IReadOnlyDictionary<string, INotificationMethod>.TryGetValue(string key, out INotificationMethod value)
+        {
+            try
+            {
+                var val = (NotificationMethodElement)BaseGet(key);
+                value = val;
+                return true;
+            }
+            catch (Exception)
+            {
+                value = null;
+                return false;
+            }
+        }
+
+        INotificationMethod IReadOnlyDictionary<string, INotificationMethod>.this[string key]
+        {
+            get { return (NotificationMethodElement)BaseGet(key); }
+        }
+
+        IEnumerable<string> IReadOnlyDictionary<string, INotificationMethod>.Keys
+        {
+            get { return BaseGetAllKeys().Cast<string>(); }
+        }
+
+        IEnumerable<INotificationMethod> IReadOnlyDictionary<string, INotificationMethod>.Values
+        {
+            get
+            {
+                for (var i = 0; i < Count; i++)
+                {
+                    yield return (NotificationMethodElement)BaseGet(i);
+                }
+            }
+        }
+    }
+}

src/Umbraco.Core/Configuration/UmbracoConfig.cs

@@ -9,6 +9,7 @@ using Umbraco.Core.Cache;
 using Umbraco.Core.Configuration.BaseRest;
 using Umbraco.Core.Configuration.Dashboard;
 using Umbraco.Core.Configuration.Grid;
+using Umbraco.Core.Configuration.HealthChecks;
 using Umbraco.Core.Configuration.UmbracoSettings;
 using Umbraco.Core.Logging;
 
@@ -52,6 +53,12 @@ namespace Umbraco.Core.Configuration
                 var dashboardConfig = ConfigurationManager.GetSection("umbracoConfiguration/dashBoard") as IDashboardSection;                
                 SetDashboardSettings(dashboardConfig);
             }
+
+            if (_healthChecks == null)
+            {
+                var healthCheckConfig = ConfigurationManager.GetSection("umbracoConfiguration/HealthChecks") as IHealthChecks;
+                SetHealthCheckSettings(healthCheckConfig);
+            }
         }
 
         /// <summary>
@@ -60,18 +67,36 @@ namespace Umbraco.Core.Configuration
         /// <param name="umbracoSettings"></param>
         /// <param name="baseRestSettings"></param>
         /// <param name="dashboardSettings"></param>
-        public UmbracoConfig(IUmbracoSettingsSection umbracoSettings, IBaseRestSection baseRestSettings, IDashboardSection dashboardSettings)
+        /// <param name="healthChecks"></param>
+        public UmbracoConfig(IUmbracoSettingsSection umbracoSettings, IBaseRestSection baseRestSettings, IDashboardSection dashboardSettings, IHealthChecks healthChecks)
         {
+            SetHealthCheckSettings(healthChecks);
             SetUmbracoSettings(umbracoSettings);
             SetBaseRestExtensions(baseRestSettings);
             SetDashboardSettings(dashboardSettings);
         }
 
+        private IHealthChecks _healthChecks;
         private IDashboardSection _dashboardSection;
         private IUmbracoSettingsSection _umbracoSettings;
         private IBaseRestSection _baseRestExtensions;
         private IGridConfig _gridConfig;
 
+        /// <summary>
+        /// Gets the IHealthCheck config
+        /// </summary>
+        public IHealthChecks HealthCheck()
+        {
+            if (_healthChecks == null)
+            {
+                var ex = new ConfigurationErrorsException("Could not load the " + typeof(IHealthChecks) + " from config file, ensure the web.config and healthchecks.config files are formatted correctly");
+                LogHelper.Error<UmbracoConfig>("Config error", ex);
+                throw ex;
+            }
+
+            return _healthChecks;
+        }
+
         /// <summary>
         /// Gets the IDashboardSection
         /// </summary>
@@ -86,14 +111,23 @@ namespace Umbraco.Core.Configuration
 
             return _dashboardSection;
         }        
+        
+        /// <summary>
+        /// Only for testing
+        /// </summary>
+        /// <param name="value"></param>
+        public void SetDashboardSettings(IDashboardSection value)
+        {
+            _dashboardSection = value;
+        }
 
         /// <summary>
         /// Only for testing
         /// </summary>
         /// <param name="value"></param>
-        internal void SetDashboardSettings(IDashboardSection value)
+        public void SetHealthCheckSettings(IHealthChecks value)
         {
-            _dashboardSection = value;
+            _healthChecks = value;
         }
 
         /// <summary>

src/Umbraco.Core/Configuration/UmbracoSettings/HelpElement.cs

@@ -1,8 +1,12 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
 using System.Configuration;
 
 namespace Umbraco.Core.Configuration.UmbracoSettings
 {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Obsolete("This is no longer used and will be removed in future versions")]
     internal class HelpElement : ConfigurationElement, IHelpSection
     {
         [ConfigurationProperty("defaultUrl", DefaultValue = "http://our.umbraco.org/wiki/umbraco-help/{0}/{1}")]

src/Umbraco.Core/Configuration/UmbracoSettings/IHelpSection.cs

@@ -1,7 +1,11 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
 
 namespace Umbraco.Core.Configuration.UmbracoSettings
-{
+{
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Obsolete("This is no longer used and will be removed in future versions")]
     public interface IHelpSection : IUmbracoConfigurationSection
     {
         string DefaultUrl { get; }

src/Umbraco.Core/Configuration/UmbracoSettings/ILink.cs

@@ -1,5 +1,10 @@
-namespace Umbraco.Core.Configuration.UmbracoSettings
+using System;
+using System.ComponentModel;
+
+namespace Umbraco.Core.Configuration.UmbracoSettings
 {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Obsolete("This is no longer used and will be removed in future versions")]
     public interface ILink
     {
         string Application { get; }

src/Umbraco.Core/Configuration/UmbracoSettings/IUmbracoSettingsSection.cs

@@ -1,4 +1,7 @@
-namespace Umbraco.Core.Configuration.UmbracoSettings
+using System;
+using System.ComponentModel;
+
+namespace Umbraco.Core.Configuration.UmbracoSettings
 {
     public interface IUmbracoSettingsSection : IUmbracoConfigurationSection
     {
@@ -24,6 +27,8 @@
 
         IProvidersSection Providers { get; }
 
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        [Obsolete("This is no longer used and will be removed in future versions")]
         IHelpSection Help { get; }
 
         IWebRoutingSection WebRouting { get; }

src/Umbraco.Core/Configuration/UmbracoSettings/LinkElement.cs

@@ -1,7 +1,11 @@
-using System.Configuration;
+using System;
+using System.ComponentModel;
+using System.Configuration;
 
 namespace Umbraco.Core.Configuration.UmbracoSettings
 {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Obsolete("This is no longer used and will be removed in future versions")]
     internal class LinkElement : ConfigurationElement, ILink
     {
         [ConfigurationProperty("application")]

src/Umbraco.Core/Configuration/UmbracoSettings/LinksCollection.cs

@@ -1,8 +1,12 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
 using System.Configuration;
 
 namespace Umbraco.Core.Configuration.UmbracoSettings
 {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Obsolete("This is no longer used and will be removed in future versions")]
     internal class LinksCollection : ConfigurationElementCollection, IEnumerable<ILink>
     {
         protected override ConfigurationElement CreateNewElement()

src/Umbraco.Core/Configuration/UmbracoSettings/UmbracoSettingsSection.cs

@@ -1,4 +1,5 @@
 using System;
+using System.ComponentModel;
 using System.Configuration;
 using System.Linq;
 
@@ -183,6 +184,8 @@ namespace Umbraco.Core.Configuration.UmbracoSettings
             get { return Providers; }
         }
 
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        [Obsolete("This is no longer used and will be removed in future versions")]
         IHelpSection IUmbracoSettingsSection.Help
         {
             get { return Help; }

src/Umbraco.Core/Configuration/UmbracoVersion.cs

@@ -6,7 +6,7 @@ namespace Umbraco.Core.Configuration
 {
     public class UmbracoVersion
     {
-        private static readonly Version Version = new Version("7.6.5");
+        private static readonly Version Version = new Version("7.7.0");
 
         /// <summary>
         /// Gets the current version of Umbraco.
@@ -24,7 +24,7 @@ namespace Umbraco.Core.Configuration
         /// Gets the version comment (like beta or RC).
         /// </summary>
         /// <value>The version comment.</value>
-        public static string CurrentComment { get { return ""; } }
+        public static string CurrentComment { get { return "beta"; } }
 
         // Get the version of the umbraco.dll by looking at a class in that dll
         // Had to do it like this due to medium trust issues, see: http://haacked.com/archive/2010/11/04/assembly-location-and-medium-trust.aspx

src/Umbraco.Core/Constants-Applications.cs

@@ -56,7 +56,12 @@
             /// <summary>
             /// alias for the content tree.
             /// </summary>
-            public const string Content = "content";
+            public const string Content = "content";
+
+            /// <summary>
+            /// alias for the content blueprint tree.
+            /// </summary>
+            public const string ContentBlueprints = "contentBlueprints";
 
             /// <summary>
             /// alias for the member tree.
@@ -118,6 +123,8 @@
 
             public const string Scripts = "scripts";
 
+            public const string Users = "users";
+
             //TODO: Fill in the rest!
         }
     }

src/Umbraco.Core/Constants-Conventions.cs

@@ -12,6 +12,14 @@ namespace Umbraco.Core
 		/// </summary>
 		public static class Conventions
 		{
+		    internal static class PermissionCategories
+		    {
+		        public const string ContentCategory = "content";
+		        public const string AdministrationCategory = "administration";
+		        public const string StructureCategory = "structure";
+		        public const string OtherCategory = "other";
+		    }
+
 		    public static class PublicAccess
 		    {
                 public const string MemberUsernameRuleType = "MemberUsername";               

src/Umbraco.Core/Constants-ObjectTypes.cs

@@ -68,12 +68,22 @@ namespace Umbraco.Core
             /// Guid for a Document object.
             /// </summary>
             public const string Document = "C66BA18E-EAF3-4CFF-8A22-41B16D66A972";
-
+            
             /// <summary>
             /// Guid for a Document object.
             /// </summary>
             public static readonly Guid DocumentGuid = new Guid(Document);
 
+            /// <summary>
+            /// Guid for a Document Blueprint object.
+            /// </summary>
+            public const string DocumentBlueprint = "6EBEF410-03AA-48CF-A792-E1C1CB087ACA";
+
+            /// <summary>
+            /// Guid for a Document object.
+            /// </summary>
+            public static readonly Guid DocumentBlueprintGuid = new Guid(DocumentBlueprint);
+
             /// <summary>
             /// Guid for a Document Type object.
             /// </summary>

src/Umbraco.Core/Constants-PropertyEditors.cs

@@ -437,6 +437,11 @@ namespace Umbraco.Core
             /// </summary>
             public const string EmailAddressAlias = "Umbraco.EmailAddress";
 
+            /// <summary>
+            /// Alias for the nested content property editor.
+            /// </summary>
+            public const string NestedContentAlias = "Umbraco.NestedContent";
+
             public static class PreValueKeys
             {
                 /// <summary>

src/Umbraco.Core/Constants-Security.cs

@@ -8,12 +8,17 @@ namespace Umbraco.Core
         public static class Security
         {
 
+            public const string AdminGroupAlias = "admin";
+            
             public const string BackOfficeAuthenticationType = "UmbracoBackOffice";
             public const string BackOfficeExternalAuthenticationType = "UmbracoExternalCookie";
             public const string BackOfficeExternalCookieName = "UMB_EXTLOGIN";
             public const string BackOfficeTokenAuthenticationType = "UmbracoBackOfficeToken";
             public const string BackOfficeTwoFactorAuthenticationType = "UmbracoTwoFactorCookie";
 
+            internal const string EmptyPasswordPrefix = "___UIDEMPTYPWORD__";
+            internal const string ForceReAuthFlag = "umbraco-force-auth";
+
             /// <summary>
             /// The prefix used for external identity providers for their authentication type
             /// </summary>

src/Umbraco.Core/DateTimeExtensions.cs

@@ -41,7 +41,43 @@ namespace Umbraco.Core
             Hour,
             Minute,
             Second
+        }
+
+        /// <summary>
+        /// Calculates the number of minutes from a date time, on a rolling daily basis (so if 
+        /// date time is before the time, calculate onto next day)
+        /// </summary>
+        /// <param name="fromDateTime">Date to start from</param>
+        /// <param name="scheduledTime">Time to compare against (in Hmm form, e.g. 330, 2200)</param>
+        /// <returns></returns>
+        public static int PeriodicMinutesFrom(this DateTime fromDateTime, string scheduledTime)
+        {
+            // Ensure time provided is 4 digits long
+            if (scheduledTime.Length == 3)
+            {
+                scheduledTime = "0" + scheduledTime;
+            }
+
+            var scheduledHour = int.Parse(scheduledTime.Substring(0, 2));
+            var scheduledMinute = int.Parse(scheduledTime.Substring(2));
+
+            DateTime scheduledDateTime;
+            if (IsScheduledInRemainingDay(fromDateTime, scheduledHour, scheduledMinute))
+            {
+                scheduledDateTime = new DateTime(fromDateTime.Year, fromDateTime.Month, fromDateTime.Day, scheduledHour, scheduledMinute, 0);
+            }
+            else
+            {
+                var nextDay = fromDateTime.AddDays(1);
+                scheduledDateTime = new DateTime(nextDay.Year, nextDay.Month, nextDay.Day, scheduledHour, scheduledMinute, 0);
+            }
+
+            return (int)(scheduledDateTime - fromDateTime).TotalMinutes;
+        }
+
+        private static bool IsScheduledInRemainingDay(DateTime fromDateTime, int scheduledHour, int scheduledMinute)
+        {
+            return scheduledHour > fromDateTime.Hour || (scheduledHour == fromDateTime.Hour && scheduledMinute >= fromDateTime.Minute);
         }
-
     }
 }

src/Umbraco.Core/EnumerableExtensions.cs

@@ -111,6 +111,9 @@ namespace Umbraco.Core
         /// <returns></returns>
         public static bool ContainsAll<TSource>(this IEnumerable<TSource> source, IEnumerable<TSource> other)
         {
+            if (source == null) throw new ArgumentNullException("source");
+            if (other == null) throw new ArgumentNullException("other");
+
             return other.Except(source).Any() == false;
         }
 

src/Umbraco.Core/ExpressionHelper.cs

@@ -217,8 +217,21 @@ namespace Umbraco.Core
 		public static MemberInfo GetMemberInfo<T, TReturn>(Expression<Func<T, TReturn>> fromExpression)
 		{
 			if (fromExpression == null) return null;
-			var body = fromExpression.Body as MemberExpression;
-			return body != null ? body.Member : null;
+
+		    MemberExpression me;
+		    switch (fromExpression.Body.NodeType)
+		    {
+		        case ExpressionType.Convert:
+		        case ExpressionType.ConvertChecked:
+		            var ue = fromExpression.Body as UnaryExpression;
+		            me = ((ue != null) ? ue.Operand : null) as MemberExpression;
+		            break;
+		        default:
+		            me = fromExpression.Body as MemberExpression;
+		            break;
+		    }
+
+		    return me != null ? me.Member : null;
 		}
 
 		/// <summary>

src/Umbraco.Core/Models/Content.cs

@@ -1,8 +1,5 @@
 using System;
-using System.Collections;
-using System.Collections.Generic;
 using System.ComponentModel;
-using System.Linq;
 using System.Reflection;
 using System.Runtime.Serialization;
 
@@ -23,7 +20,7 @@ namespace Umbraco.Core.Models
         private DateTime? _expireDate;
         private int _writer;
         private string _nodeName;//NOTE Once localization is introduced this will be the non-localized Node Name.
-        private bool _permissionsChanged;
+
         /// <summary>
         /// Constructor for creating a Content object
         /// </summary>
@@ -32,7 +29,7 @@ namespace Umbraco.Core.Models
         /// <param name="contentType">ContentType for the current Content object</param>
         public Content(string name, IContent parent, IContentType contentType)
 			: this(name, parent, contentType, new PropertyCollection())
-		{			
+		{
 		}
 
         /// <summary>
@@ -68,7 +65,7 @@ namespace Umbraco.Core.Models
         /// <param name="parentId">Id of the Parent content</param>
         /// <param name="contentType">ContentType for the current Content object</param>
         /// <param name="properties">Collection of properties</param>
-        public Content(string name, int parentId, IContentType contentType, PropertyCollection properties) 
+        public Content(string name, int parentId, IContentType contentType, PropertyCollection properties)
 			: base(name, parentId, contentType, properties)
         {
             Mandate.ParameterNotNull(contentType, "contentType");
@@ -87,7 +84,6 @@ namespace Umbraco.Core.Models
             public readonly PropertyInfo ExpireDateSelector = ExpressionHelper.GetPropertyInfo<Content, DateTime?>(x => x.ExpireDate);
             public readonly PropertyInfo WriterSelector = ExpressionHelper.GetPropertyInfo<Content, int>(x => x.WriterId);
             public readonly PropertyInfo NodeNameSelector = ExpressionHelper.GetPropertyInfo<Content, string>(x => x.NodeName);
-            public readonly PropertyInfo PermissionsChangedSelector = ExpressionHelper.GetPropertyInfo<Content, bool>(x => x.PermissionsChanged);
         }
 
         /// <summary>
@@ -95,7 +91,7 @@ namespace Umbraco.Core.Models
         /// This is used to override the default one from the ContentType.
         /// </summary>
         /// <remarks>
-        /// If no template is explicitly set on the Content object, 
+        /// If no template is explicitly set on the Content object,
         /// the Default template from the ContentType will be returned.
         /// </remarks>
         [DataMember]
@@ -197,15 +193,6 @@ namespace Umbraco.Core.Models
             set { SetPropertyValueAndDetectChanges(value, ref _nodeName, Ps.Value.NodeNameSelector); }
         }
 
-        /// <summary>
-        /// Used internally to track if permissions have been changed during the saving process for this entity
-        /// </summary>
-        [IgnoreDataMember]
-        internal bool PermissionsChanged
-        {
-            get { return _permissionsChanged; }
-            set { SetPropertyValueAndDetectChanges(value, ref _permissionsChanged, Ps.Value.PermissionsChangedSelector); }
-        }
 
         /// <summary>
         /// Gets the ContentType used by this content object
@@ -277,6 +264,9 @@ namespace Umbraco.Core.Models
         [IgnoreDataMember]
         internal DateTime PublishedDate { get; set; }
 
+        [DataMember]
+        public bool IsBlueprint { get; internal set; }
+
         /// <summary>
         /// Changes the Trashed state of the content object
         /// </summary>
@@ -293,7 +283,7 @@ namespace Umbraco.Core.Models
                 ChangePublishedState(PublishedState.Unpublished);
             }
         }
-        
+
         /// <summary>
         /// Method to call when Entity is being updated
         /// </summary>

src/Umbraco.Core/Models/ContentType.cs

@@ -54,6 +54,11 @@ namespace Umbraco.Core.Models
         {
             public readonly PropertyInfo DefaultTemplateSelector = ExpressionHelper.GetPropertyInfo<ContentType, int>(x => x.DefaultTemplateId);
             public readonly PropertyInfo AllowedTemplatesSelector = ExpressionHelper.GetPropertyInfo<ContentType, IEnumerable<ITemplate>>(x => x.AllowedTemplates);
+
+            //Custom comparer for enumerable
+            public readonly DelegateEqualityComparer<IEnumerable<ITemplate>> TemplateComparer = new DelegateEqualityComparer<IEnumerable<ITemplate>>(
+                (templates, enumerable) => templates.UnsortedSequenceEqual(enumerable),
+                templates => templates.GetHashCode());
         }
 
         /// <summary>
@@ -91,10 +96,7 @@ namespace Umbraco.Core.Models
             set
             {
                 SetPropertyValueAndDetectChanges(value, ref _allowedTemplates, Ps.Value.AllowedTemplatesSelector,
-                    //Custom comparer for enumerable
-                    new DelegateEqualityComparer<IEnumerable<ITemplate>>(
-                        (templates, enumerable) => templates.UnsortedSequenceEqual(enumerable),
-                        templates => templates.GetHashCode()));
+                   Ps.Value.TemplateComparer);
             }
         }
 

src/Umbraco.Core/Models/ContentTypeBase.cs

@@ -88,6 +88,12 @@ namespace Umbraco.Core.Models
             public readonly PropertyInfo PropertyGroupCollectionSelector = ExpressionHelper.GetPropertyInfo<ContentTypeBase, PropertyGroupCollection>(x => x.PropertyGroups);
             public readonly PropertyInfo PropertyTypeCollectionSelector = ExpressionHelper.GetPropertyInfo<ContentTypeBase, IEnumerable<PropertyType>>(x => x.PropertyTypes);
             public readonly PropertyInfo HasPropertyTypeBeenRemovedSelector = ExpressionHelper.GetPropertyInfo<ContentTypeBase, bool>(x => x.HasPropertyTypeBeenRemoved);
+
+            //Custom comparer for enumerable
+            public readonly DelegateEqualityComparer<IEnumerable<ContentTypeSort>> ContentTypeSortComparer =
+                new DelegateEqualityComparer<IEnumerable<ContentTypeSort>>(
+                    (sorts, enumerable) => sorts.UnsortedSequenceEqual(enumerable),
+                    sorts => sorts.GetHashCode());
         }
 
 
@@ -254,7 +260,7 @@ namespace Umbraco.Core.Models
             set { SetPropertyValueAndDetectChanges(value, ref _trashed, Ps.Value.TrashedSelector); }
         }
 
-        private IDictionary<string, object> _additionalData;
+        private readonly IDictionary<string, object> _additionalData;
         /// <summary>
         /// Some entities may expose additional data that other's might not, this custom data will be available in this collection
         /// </summary>
@@ -273,11 +279,8 @@ namespace Umbraco.Core.Models
             get { return _allowedContentTypes; }
             set
             {
-                SetPropertyValueAndDetectChanges(value, ref _allowedContentTypes, Ps.Value.AllowedContentTypesSelector,
-                    //Custom comparer for enumerable
-                    new DelegateEqualityComparer<IEnumerable<ContentTypeSort>>(
-                        (sorts, enumerable) => sorts.UnsortedSequenceEqual(enumerable),
-                        sorts => sorts.GetHashCode()));                
+                SetPropertyValueAndDetectChanges(value, ref _allowedContentTypes, Ps.Value.AllowedContentTypesSelector, 
+                    Ps.Value.ContentTypeSortComparer);                
             }
         }
 

src/Umbraco.Core/Models/DictionaryItem.cs

@@ -37,6 +37,12 @@ namespace Umbraco.Core.Models
             public readonly PropertyInfo ParentIdSelector = ExpressionHelper.GetPropertyInfo<DictionaryItem, Guid?>(x => x.ParentId);
             public readonly PropertyInfo ItemKeySelector = ExpressionHelper.GetPropertyInfo<DictionaryItem, string>(x => x.ItemKey);
             public readonly PropertyInfo TranslationsSelector = ExpressionHelper.GetPropertyInfo<DictionaryItem, IEnumerable<IDictionaryTranslation>>(x => x.Translations);
+
+            //Custom comparer for enumerable
+            public readonly DelegateEqualityComparer<IEnumerable<IDictionaryTranslation>> DictionaryTranslationComparer =
+                new DelegateEqualityComparer<IEnumerable<IDictionaryTranslation>>(
+                    (enumerable, translations) => enumerable.UnsortedSequenceEqual(translations),
+                    enumerable => enumerable.GetHashCode());
         }
 
         /// <summary>
@@ -79,10 +85,7 @@ namespace Umbraco.Core.Models
                 }
 
                 SetPropertyValueAndDetectChanges(asArray, ref _translations, Ps.Value.TranslationsSelector,
-                    //Custom comparer for enumerable
-                    new DelegateEqualityComparer<IEnumerable<IDictionaryTranslation>>(
-                        (enumerable, translations) => enumerable.UnsortedSequenceEqual(translations),
-                        enumerable => enumerable.GetHashCode()));                
+                    Ps.Value.DictionaryTranslationComparer);                
             }
         }
     }

src/Umbraco.Core/Models/EntityBase/Entity.cs

@@ -119,7 +119,7 @@ namespace Umbraco.Core.Models.EntityBase
             if (IsPropertyDirty("CreateDate") == false || _createDate == default(DateTime))
                 CreateDate = DateTime.Now;
             if (IsPropertyDirty("UpdateDate") == false || _updateDate == default(DateTime))
-                UpdateDate = CreateDate;
+                UpdateDate = DateTime.Now;
         }
 
         /// <summary>
@@ -129,6 +129,10 @@ namespace Umbraco.Core.Models.EntityBase
         {
             if (IsPropertyDirty("UpdateDate") == false || _updateDate == default(DateTime))
                 UpdateDate = DateTime.Now;
+
+            //this is just in case
+            if (_createDate == default(DateTime))
+                CreateDate = DateTime.Now;
         }
 
         /// <summary>

src/Umbraco.Core/Models/EntityBase/EntityPath.cs

@@ -0,0 +1,8 @@
+namespace Umbraco.Core.Models.EntityBase
+{
+    public class EntityPath
+    {
+        public int Id { get; set; }
+        public string Path { get; set; }
+    }
+}

src/Umbraco.Core/Models/IContent.cs

@@ -1,7 +1,5 @@
 using System;
 using System.ComponentModel;
-using System.Diagnostics;
-using Umbraco.Core.Persistence.Mappers;
 
 namespace Umbraco.Core.Models
 {
@@ -85,5 +83,10 @@ namespace Umbraco.Core.Models
         /// Gets the unique identifier of the published version, if any.
         /// </summary>
         Guid PublishedVersionGuid { get; }
+
+        /// <summary>
+        /// Gets a value indicating whether the content item is a blueprint.
+        /// </summary>
+        bool IsBlueprint { get; }
     }
 }

src/Umbraco.Core/Models/Identity/BackOfficeIdentityUser.cs

@@ -2,23 +2,69 @@ using System;
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
 using System.Collections.Specialized;
+using System.Linq;
+using System.Reflection;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using Microsoft.AspNet.Identity;
+using Umbraco.Core.Models.EntityBase;
+using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Security;
 
 namespace Umbraco.Core.Models.Identity
 {
-    public class BackOfficeIdentityUser : IdentityUser<int, IIdentityUserLogin, IdentityUserRole<string>, IdentityUserClaim<int>>
+    public class BackOfficeIdentityUser : IdentityUser<int, IIdentityUserLogin, IdentityUserRole<string>, IdentityUserClaim<int>>, IRememberBeingDirty
     {
-
-        public BackOfficeIdentityUser()
+        /// <summary>
+        ///  Used to construct a new instance without an identity
+        /// </summary>
+        /// <param name="username"></param>
+        /// <param name="email">This is allowed to be null (but would need to be filled in if trying to persist this instance)</param>
+        /// <param name="culture"></param>
+        /// <returns></returns>
+        public static BackOfficeIdentityUser CreateNew(string username, string email, string culture)
         {
-            StartMediaId = -1;
-            StartContentId = -1;
-            Culture = Configuration.GlobalSettings.DefaultUILanguage;
+            if (string.IsNullOrWhiteSpace(username)) throw new ArgumentException("Value cannot be null or whitespace.", "username");
+            if (string.IsNullOrWhiteSpace(culture)) throw new ArgumentException("Value cannot be null or whitespace.", "culture");
+
+            var user = new BackOfficeIdentityUser();
+            user.DisableChangeTracking();
+            user._userName = username;
+            user._email = email;
+            //we are setting minvalue here because the default is "0" which is the id of the admin user
+            //which we cannot allow because the admin user will always exist
+            user._id = int.MinValue;
+            user._hasIdentity = false;
+            user._culture = culture;
+            user.EnableChangeTracking();
+            return user;
         }
 
+        private BackOfficeIdentityUser()
+        {
+        }
+
+        /// <summary>
+        /// Creates an existing user with the specified groups
+        /// </summary>
+        /// <param name="userId"></param>
+        /// <param name="groups"></param>
+        public BackOfficeIdentityUser(int userId, IEnumerable<IReadOnlyUserGroup> groups)
+        {
+            _startMediaIds = new int[] { };
+            _startContentIds = new int[] { };
+            _groups = new IReadOnlyUserGroup[] { };
+            _allowedSections = new string[] { };
+            _culture = Configuration.GlobalSettings.DefaultUILanguage;
+            _groups = groups.ToArray();
+            _roles = new ObservableCollection<IdentityUserRole<string>>(_groups.Select(x => new IdentityUserRole<string>
+            {
+                RoleId = x.Alias,
+                UserId = userId.ToString()
+            }));
+            _roles.CollectionChanged += _roles_CollectionChanged;
+        }        
+
         public virtual async Task<ClaimsIdentity> GenerateUserIdentityAsync(BackOfficeUserManager<BackOfficeIdentityUser> manager)
         {
             // NOTE the authenticationType must match the umbraco one
@@ -27,16 +73,155 @@ namespace Umbraco.Core.Models.Identity
             return userIdentity;
         }
 
+        /// <summary>
+        /// Returns true if an Id has been set on this object this will be false if the object is new and not peristed to the database
+        /// </summary>
+        public bool HasIdentity
+        {
+            get { return _hasIdentity; }
+        }
+
+        public int[] CalculatedMediaStartNodeIds { get; internal set; }
+        public int[] CalculatedContentStartNodeIds { get; internal set; }
+
+        public override int Id
+        {
+            get { return _id; }
+            set
+            {
+                _id = value;
+                _hasIdentity = true;
+            }
+        }
+
+        /// <summary>
+        /// Override Email so we can track changes to it
+        /// </summary>
+        public override string Email
+        {
+            get { return _email; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _email, Ps.Value.EmailSelector); }
+        }
+
+        /// <summary>
+        /// Override UserName so we can track changes to it
+        /// </summary>
+        public override string UserName
+        {
+            get { return _userName; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _userName, Ps.Value.UserNameSelector); }
+        }
+
+        /// <summary>
+        /// Override LastLoginDateUtc so we can track changes to it
+        /// </summary>
+        public override DateTime? LastLoginDateUtc
+        {
+            get { return _lastLoginDateUtc; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _lastLoginDateUtc, Ps.Value.LastLoginDateUtcSelector); }            
+        }
+
+        /// <summary>
+        /// Override EmailConfirmed so we can track changes to it
+        /// </summary>
+        public override bool EmailConfirmed
+        {
+            get { return _emailConfirmed; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _emailConfirmed, Ps.Value.EmailConfirmedSelector); }            
+        }
+
         /// <summary>
         /// Gets/sets the user's real name
         /// </summary>
-        public string Name { get; set; }
-        public int StartContentId { get; set; }
-        public int StartMediaId { get; set; }
-        public string[] AllowedSections { get; set; }
-        public string Culture { get; set; }
+        public string Name
+        {
+            get { return _name; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _name, Ps.Value.NameSelector); }            
+        }
 
-        public string UserTypeAlias { get; set; }
+        /// <summary>
+        /// Override AccessFailedCount so we can track changes to it
+        /// </summary>
+        public override int AccessFailedCount
+        {
+            get { return _accessFailedCount; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _accessFailedCount, Ps.Value.AccessFailedCountSelector); }
+        }
+
+        /// <summary>
+        /// Override PasswordHash so we can track changes to it
+        /// </summary>
+        public override string PasswordHash
+        {
+            get { return _passwordHash; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _passwordHash, Ps.Value.PasswordHashSelector); }
+        }
+
+
+        /// <summary>
+        /// Content start nodes assigned to the User (not ones assigned to the user's groups)
+        /// </summary>
+        public int[] StartContentIds
+        {
+            get { return _startContentIds; }
+            set
+            {
+                if (value == null) value = new int[0];
+                _tracker.SetPropertyValueAndDetectChanges(value, ref _startContentIds, Ps.Value.StartContentIdsSelector, Ps.Value.StartIdsComparer);
+            }
+        }
+
+        /// <summary>
+        /// Media start nodes assigned to the User (not ones assigned to the user's groups)
+        /// </summary>
+        public int[] StartMediaIds
+        {
+            get { return _startMediaIds; }
+            set
+            {
+                if (value == null) value = new int[0];
+                _tracker.SetPropertyValueAndDetectChanges(value, ref _startMediaIds, Ps.Value.StartMediaIdsSelector, Ps.Value.StartIdsComparer);
+            }
+        }
+
+        /// <summary>
+        /// This is a readonly list of the user's allowed sections which are based on it's user groups
+        /// </summary>        
+        public string[] AllowedSections
+        {
+            get { return _allowedSections ?? (_allowedSections = _groups.SelectMany(x => x.AllowedSections).Distinct().ToArray()); }
+        }
+
+        public string Culture
+        {
+            get { return _culture; }
+            set { _tracker.SetPropertyValueAndDetectChanges(value, ref _culture, Ps.Value.CultureSelector); }
+        }
+
+        public IReadOnlyUserGroup[] Groups
+        {
+            get { return _groups; }
+            set
+            {
+                //so they recalculate
+                _allowedSections = null;
+
+                //now clear all roles and re-add them
+                _roles.CollectionChanged -= _roles_CollectionChanged;
+                _roles.Clear();
+                foreach (var identityUserRole in _groups.Select(x => new IdentityUserRole<string>
+                {
+                    RoleId = x.Alias,
+                    UserId = Id.ToString()
+                }))
+                {
+                    _roles.Add(identityUserRole);
+                }
+                _roles.CollectionChanged += _roles_CollectionChanged;
+
+                _tracker.SetPropertyValueAndDetectChanges(value, ref _groups, Ps.Value.GroupsSelector, Ps.Value.GroupsComparer);
+            }
+        }
 
         /// <summary>
         /// Lockout is always enabled
@@ -44,7 +229,7 @@ namespace Umbraco.Core.Models.Identity
         public override bool LockoutEnabled
         {
             get { return true; }
-            set 
+            set
             {
                 //do nothing 
             }
@@ -82,16 +267,42 @@ namespace Umbraco.Core.Models.Identity
                 return _logins;
             }
         }
-
-        public bool LoginsChanged { get; private set; }
-
+        
         void Logins_CollectionChanged(object sender, NotifyCollectionChangedEventArgs e)
         {
-            LoginsChanged = true;
+            _tracker.OnPropertyChanged(Ps.Value.LoginsSelector);
         }
 
-        private ObservableCollection<IIdentityUserLogin> _logins;
-        private Lazy<IEnumerable<IIdentityUserLogin>> _getLogins;
+        private void _roles_CollectionChanged(object sender, NotifyCollectionChangedEventArgs e)
+        {
+            _tracker.OnPropertyChanged(Ps.Value.RolesSelector);
+        }
+
+        private readonly ObservableCollection<IdentityUserRole<string>> _roles;
+
+        /// <summary>
+        /// helper method to easily add a role without having to deal with IdentityUserRole{T}
+        /// </summary>
+        /// <param name="role"></param>
+        /// <remarks>
+        /// Adding a role this way will not reflect on the user's group's collection or it's allowed sections until the user is persisted
+        /// </remarks>
+        public void AddRole(string role)
+        {
+            Roles.Add(new IdentityUserRole<string>
+            {
+                UserId = this.Id.ToString(),
+                RoleId = role
+            });
+        }
+
+        /// <summary>
+        /// Override Roles because the value of these are the user's group aliases
+        /// </summary>
+        public override ICollection<IdentityUserRole<string>> Roles
+        {
+            get { return _roles; }
+        }
 
         /// <summary>
         /// Used to set a lazy call back to populate the user's Login list
@@ -101,6 +312,128 @@ namespace Umbraco.Core.Models.Identity
         {
             if (callback == null) throw new ArgumentNullException("callback");
             _getLogins = callback;
+        }        
+
+        #region Change tracking
+
+        public void DisableChangeTracking()
+        {
+            _tracker.DisableChangeTracking();
         }
+
+        public void EnableChangeTracking()
+        {
+            _tracker.EnableChangeTracking();
+        }
+
+        /// <summary>
+        /// Since this class only has change tracking turned on for Email/Username this will return true if either of those have changed
+        /// </summary>
+        /// <returns></returns>
+        public bool IsDirty()
+        {
+            return _tracker.IsDirty();
+        }
+
+        /// <summary>
+        /// Returns true if the specified property is dirty
+        /// </summary>
+        /// <param name="propName"></param>
+        /// <returns></returns>
+        public bool IsPropertyDirty(string propName)
+        {
+            return _tracker.IsPropertyDirty(propName);
+        }
+
+        /// <summary>
+        /// Resets dirty properties
+        /// </summary>
+        void ICanBeDirty.ResetDirtyProperties()
+        {
+            _tracker.ResetDirtyProperties();
+        }
+
+        bool IRememberBeingDirty.WasDirty()
+        {
+            return _tracker.WasDirty();
+        }
+
+        bool IRememberBeingDirty.WasPropertyDirty(string propertyName)
+        {
+            return _tracker.WasPropertyDirty(propertyName);
+        }
+
+        void IRememberBeingDirty.ForgetPreviouslyDirtyProperties()
+        {
+            _tracker.ForgetPreviouslyDirtyProperties();
+        }
+
+        public void ResetDirtyProperties(bool rememberPreviouslyChangedProperties)
+        {
+            _tracker.ResetDirtyProperties(rememberPreviouslyChangedProperties);
+        }
+
+        private static readonly Lazy<PropertySelectors> Ps = new Lazy<PropertySelectors>();
+        private class PropertySelectors
+        {
+            public readonly PropertyInfo EmailSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, string>(x => x.Email);
+            public readonly PropertyInfo UserNameSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, string>(x => x.UserName);
+            public readonly PropertyInfo LastLoginDateUtcSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, DateTime?>(x => x.LastLoginDateUtc);
+            public readonly PropertyInfo EmailConfirmedSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, bool>(x => x.EmailConfirmed);
+            public readonly PropertyInfo NameSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, string>(x => x.Name);
+            public readonly PropertyInfo AccessFailedCountSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, int>(x => x.AccessFailedCount);
+            public readonly PropertyInfo PasswordHashSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, string>(x => x.PasswordHash);
+            public readonly PropertyInfo CultureSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, string>(x => x.Culture);
+            public readonly PropertyInfo StartMediaIdsSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, int[]>(x => x.StartMediaIds);
+            public readonly PropertyInfo StartContentIdsSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, int[]>(x => x.StartContentIds);
+            public readonly PropertyInfo GroupsSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, IReadOnlyUserGroup[]>(x => x.Groups);
+            public readonly PropertyInfo LoginsSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, IEnumerable<IIdentityUserLogin>>(x => x.Logins);
+            public readonly PropertyInfo RolesSelector = ExpressionHelper.GetPropertyInfo<BackOfficeIdentityUser, IEnumerable<IdentityUserRole<string>>>(x => x.Roles);
+
+            //Custom comparer for enumerables
+            public readonly DelegateEqualityComparer<IReadOnlyUserGroup[]> GroupsComparer = new DelegateEqualityComparer<IReadOnlyUserGroup[]>(
+                (groups, enumerable) => groups.Select(x => x.Alias).UnsortedSequenceEqual(enumerable.Select(x => x.Alias)),
+                groups => groups.GetHashCode());
+            public readonly DelegateEqualityComparer<int[]> StartIdsComparer = new DelegateEqualityComparer<int[]>(
+                (groups, enumerable) => groups.UnsortedSequenceEqual(enumerable),
+                groups => groups.GetHashCode());
+
+        }
+
+        private readonly ChangeTracker _tracker = new ChangeTracker();
+        private string _email;
+        private string _userName;
+        private int _id;
+        private bool _hasIdentity = false;
+        private DateTime? _lastLoginDateUtc;
+        private bool _emailConfirmed;
+        private string _name;
+        private int _accessFailedCount;
+        private string _passwordHash;
+        private string _culture;
+        private ObservableCollection<IIdentityUserLogin> _logins;
+        private Lazy<IEnumerable<IIdentityUserLogin>> _getLogins;
+        private IReadOnlyUserGroup[] _groups;
+        private string[] _allowedSections;
+        private int[] _startMediaIds;
+        private int[] _startContentIds;
+
+        /// <summary>
+        /// internal class used to track changes for properties that have it enabled
+        /// </summary>        
+        private class ChangeTracker : TracksChangesEntityBase
+        {
+            /// <summary>
+            /// Make this public so that it's usable
+            /// </summary>
+            /// <param name="propertyInfo"></param>
+            public new void OnPropertyChanged(PropertyInfo propertyInfo)
+            {
+                base.OnPropertyChanged(propertyInfo);
+            }
+        } 
+        #endregion
+
+
     }
 }

src/Umbraco.Core/Models/Identity/IdentityModelMappings.cs

@@ -1,7 +1,7 @@
 using System;
 using System.Linq;
 using AutoMapper;
-
+using Umbraco.Core.Models.EntityBase;
 using Umbraco.Core.Models.Mapping;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Security;
@@ -13,28 +13,42 @@ namespace Umbraco.Core.Models.Identity
         public override void ConfigureMappings(IConfiguration config, ApplicationContext applicationContext)
         {
             config.CreateMap<IUser, BackOfficeIdentityUser>()
+                .BeforeMap((user, identityUser) =>
+                {
+                    identityUser.DisableChangeTracking();
+                })
+                .ConstructUsing(user => new BackOfficeIdentityUser(user.Id, user.Groups))
                 .ForMember(user => user.LastLoginDateUtc, expression => expression.MapFrom(user => user.LastLoginDate.ToUniversalTime()))
                 .ForMember(user => user.Email, expression => expression.MapFrom(user => user.Email))
+                .ForMember(user => user.EmailConfirmed, expression => expression.MapFrom(user => user.EmailConfirmedDate.HasValue))
                 .ForMember(user => user.Id, expression => expression.MapFrom(user => user.Id))
                 .ForMember(user => user.LockoutEndDateUtc, expression => expression.MapFrom(user => user.IsLockedOut ? DateTime.MaxValue.ToUniversalTime() : (DateTime?)null))                
                 .ForMember(user => user.UserName, expression => expression.MapFrom(user => user.Username))
                 .ForMember(user => user.PasswordHash, expression => expression.MapFrom(user => GetPasswordHash(user.RawPasswordValue)))
                 .ForMember(user => user.Culture, expression => expression.MapFrom(user => user.GetUserCulture(applicationContext.Services.TextService)))
                 .ForMember(user => user.Name, expression => expression.MapFrom(user => user.Name))
-                .ForMember(user => user.StartMediaId, expression => expression.MapFrom(user => user.StartMediaId))
-                .ForMember(user => user.StartContentId, expression => expression.MapFrom(user => user.StartContentId))
-                .ForMember(user => user.UserTypeAlias, expression => expression.MapFrom(user => user.UserType.Alias))
+                .ForMember(user => user.StartMediaIds, expression => expression.MapFrom(user => user.StartMediaIds))
+                .ForMember(user => user.StartContentIds, expression => expression.MapFrom(user => user.StartContentIds))
                 .ForMember(user => user.AccessFailedCount, expression => expression.MapFrom(user => user.FailedPasswordAttempts))
-                .ForMember(user => user.AllowedSections, expression => expression.MapFrom(user => user.AllowedSections.ToArray()));
-
+                .ForMember(user => user.CalculatedContentStartNodeIds, expression => expression.MapFrom(user => user.CalculateContentStartNodeIds(applicationContext.Services.EntityService)))
+                .ForMember(user => user.CalculatedMediaStartNodeIds, expression => expression.MapFrom(user => user.CalculateMediaStartNodeIds(applicationContext.Services.EntityService)))
+                .ForMember(user => user.AllowedSections, expression => expression.MapFrom(user => user.AllowedSections.ToArray()))
+                .AfterMap((user, identityUser) =>
+                {
+                    identityUser.ResetDirtyProperties(true);
+                    identityUser.EnableChangeTracking();
+                });
+            
             config.CreateMap<BackOfficeIdentityUser, UserData>()
                 .ConstructUsing((BackOfficeIdentityUser user) => new UserData(Guid.NewGuid().ToString("N"))) //this is the 'session id'
                 .ForMember(detail => detail.Id, opt => opt.MapFrom(user => user.Id))
                 .ForMember(detail => detail.AllowedApplications, opt => opt.MapFrom(user => user.AllowedSections))
+                .ForMember(detail => detail.Roles, opt => opt.MapFrom(user => user.Roles.Select(x => x.RoleId).ToArray()))
                 .ForMember(detail => detail.RealName, opt => opt.MapFrom(user => user.Name))
-                .ForMember(detail => detail.Roles, opt => opt.MapFrom(user => new[] { user.UserTypeAlias }))
-                .ForMember(detail => detail.StartContentNode, opt => opt.MapFrom(user => user.StartContentId))
-                .ForMember(detail => detail.StartMediaNode, opt => opt.MapFrom(user => user.StartMediaId))
+                //When mapping to UserData which is used in the authcookie we want ALL start nodes including ones defined on the groups
+                .ForMember(detail => detail.StartContentNodes, opt => opt.MapFrom(user => user.CalculatedContentStartNodeIds))
+                //When mapping to UserData which is used in the authcookie we want ALL start nodes including ones defined on the groups
+                .ForMember(detail => detail.StartMediaNodes, opt => opt.MapFrom(user => user.CalculatedMediaStartNodeIds))
                 .ForMember(detail => detail.Username, opt => opt.MapFrom(user => user.UserName))
                 .ForMember(detail => detail.Culture, opt => opt.MapFrom(user => user.Culture))
                 .ForMember(detail => detail.SessionId, opt => opt.MapFrom(user => user.SecurityStamp.IsNullOrWhiteSpace() ? Guid.NewGuid().ToString("N") : user.SecurityStamp));
@@ -42,7 +56,7 @@ namespace Umbraco.Core.Models.Identity
 
         private string GetPasswordHash(string storedPass)
         {
-            return storedPass.StartsWith("___UIDEMPTYPWORD__") ? null : storedPass;
+            return storedPass.StartsWith(Constants.Security.EmptyPasswordPrefix) ? null : storedPass;
         }
     }
 }

src/Umbraco.Core/Models/Membership/ContentPermissionSet.cs

@@ -0,0 +1,54 @@
+using System;
+using System.Collections.Generic;
+using Umbraco.Core.Models.EntityBase;
+
+namespace Umbraco.Core.Models.Membership
+{
+    /// <summary>
+    /// Represents an <see cref="IContent"/> -> user group & permission key value pair collection
+    /// </summary>
+    /// <remarks>
+    /// This implements <see cref="IAggregateRoot"/> purely so it can be used with the repository layer which is why it's explicitly implemented.
+    /// </remarks>
+    public class ContentPermissionSet : EntityPermissionSet, IAggregateRoot
+    {
+        private readonly IContent _content;
+
+        public ContentPermissionSet(IContent content, EntityPermissionCollection permissionsSet)
+            : base(content.Id, permissionsSet)
+        {
+            _content = content;
+        }
+
+        public override int EntityId
+        {
+            get { return _content.Id; }
+        }
+
+        #region Explicit implementation of IAggregateRoot
+        int IEntity.Id
+        {
+            get { return EntityId; }
+            set { throw new NotImplementedException(); }
+        }
+
+        bool IEntity.HasIdentity
+        {
+            get { return EntityId > 0; }
+        }
+
+        Guid IEntity.Key { get; set; }
+
+        DateTime IEntity.CreateDate { get; set; }
+
+        DateTime IEntity.UpdateDate { get; set; }
+
+        DateTime? IDeletableEntity.DeletedDate { get; set; }
+
+        object IDeepCloneable.DeepClone()
+        {
+            throw new NotImplementedException();
+        }
+        #endregion
+    }
+}

src/Umbraco.Core/Models/Membership/EntityPermission.cs

@@ -1,26 +1,66 @@
-using System.Collections;
+using System;
 
 namespace Umbraco.Core.Models.Membership
 {
     /// <summary>
-    /// Represents a user -> entity permission
+    /// Represents an entity permission (defined on the user group and derived to retrieve permissions for a given user)
     /// </summary>
-    public class EntityPermission
+    public class EntityPermission : IEquatable<EntityPermission>
     {
-        public EntityPermission(int userId, int entityId, string[] assignedPermissions)
+        public EntityPermission(int groupId, int entityId, string[] assignedPermissions)
         {
-            UserId = userId;
+            UserGroupId = groupId;
             EntityId = entityId;
             AssignedPermissions = assignedPermissions;
+            IsDefaultPermissions = false;
+        }
+
+        public EntityPermission(int groupId, int entityId, string[] assignedPermissions, bool isDefaultPermissions)
+        {
+            UserGroupId = groupId;
+            EntityId = entityId;
+            AssignedPermissions = assignedPermissions;
+            IsDefaultPermissions = isDefaultPermissions;
         }
 
-        public int UserId { get; private set; }
         public int EntityId { get; private set; }
+        public int UserGroupId { get; private set; }
 
         /// <summary>
         /// The assigned permissions for the user/entity combo
         /// </summary>
         public string[] AssignedPermissions { get; private set; }
+
+        /// <summary>
+        /// True if the permissions assigned to this object are the group's default permissions and not explicitly defined permissions
+        /// </summary>
+        /// <remarks>
+        /// This will be the case when looking up entity permissions and falling back to the default permissions
+        /// </remarks>
+        public bool IsDefaultPermissions { get; private set; }        
+
+        public bool Equals(EntityPermission other)
+        {
+            if (ReferenceEquals(null, other)) return false;
+            if (ReferenceEquals(this, other)) return true;
+            return EntityId == other.EntityId && UserGroupId == other.UserGroupId;
+        }
+
+        public override bool Equals(object obj)
+        {
+            if (ReferenceEquals(null, obj)) return false;
+            if (ReferenceEquals(this, obj)) return true;
+            if (obj.GetType() != this.GetType()) return false;
+            return Equals((EntityPermission) obj);
+        }
+
+        public override int GetHashCode()
+        {
+            unchecked
+            {
+                return (EntityId * 397) ^ UserGroupId;
+            }
+        }
     }
 
 }

src/Umbraco.Core/Models/Membership/EntityPermissionCollection.cs

@@ -0,0 +1,34 @@
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Umbraco.Core.Models.Membership
+{
+    /// <summary>
+    /// A <see cref="HashSet{T}"/> of <see cref="EntityPermission"/>
+    /// </summary>
+    public class EntityPermissionCollection : HashSet<EntityPermission>
+    {
+        public EntityPermissionCollection()
+        {
+        }
+
+        public EntityPermissionCollection(IEnumerable<EntityPermission> collection) : base(collection)
+        {
+        }
+
+        /// <summary>
+        /// Returns the aggregate permissions in the permission set
+        /// </summary>
+        /// <returns></returns>
+        /// <remarks>
+        /// This value is only calculated once
+        /// </remarks>
+        public IEnumerable<string> GetAllPermissions()
+        {
+            return _aggregatePermissions ?? (_aggregatePermissions =
+                       this.SelectMany(x => x.AssignedPermissions).Distinct().ToArray());
+        }
+
+        private string[] _aggregatePermissions;
+    }
+}

src/Umbraco.Core/Models/Membership/EntityPermissionSet.cs

@@ -1,59 +1,55 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
+using System.Linq;
 
 namespace Umbraco.Core.Models.Membership
 {
     /// <summary>
-    /// Represents an entity -> user & permission key value pair collection
-    /// </summary>
+    /// Represents an entity -> user group & permission key value pair collection
+    /// </summary>    
     public class EntityPermissionSet
     {
+        private static readonly Lazy<EntityPermissionSet> EmptyInstance = new Lazy<EntityPermissionSet>(() => new EntityPermissionSet(-1, new EntityPermissionCollection()));
+        /// <summary>
+        /// Returns an empty permission set
+        /// </summary>
+        /// <returns></returns>
+        public static EntityPermissionSet Empty()
+        {
+            return EmptyInstance.Value;
+        }
+
+        public EntityPermissionSet(int entityId, EntityPermissionCollection permissionsSet)
+        {
+            EntityId = entityId;
+            PermissionsSet = permissionsSet;
+        }
+
         /// <summary>
         /// The entity id with permissions assigned
         /// </summary>
-        public int EntityId { get; private set; }
+        public virtual int EntityId { get; private set; }
 
         /// <summary>
-        /// The key/value pairs of user id & single permission
+        /// The key/value pairs of user group id & single permission
         /// </summary>
-        public IEnumerable<UserPermission> UserPermissionsSet { get; private set; }
+        public EntityPermissionCollection PermissionsSet { get; private set; }
 
-        public EntityPermissionSet(int entityId, IEnumerable<UserPermission> userPermissionsSet)
+
+        /// <summary>
+        /// Returns the aggregate permissions in the permission set
+        /// </summary>
+        /// <returns></returns>
+        /// <remarks>
+        /// This value is only calculated once
+        /// </remarks>
+        public IEnumerable<string> GetAllPermissions()
         {
-            EntityId = entityId;
-            UserPermissionsSet = userPermissionsSet;
+            return PermissionsSet.GetAllPermissions();
         }
 
-        public class UserPermission
-        {
-            public UserPermission(int userId, string permission)
-            {
-                UserId = userId;
-                Permission = permission;
-            }
 
-            public int UserId { get; private set; }
-            public string Permission { get; private set; }
 
-            protected bool Equals(UserPermission other)
-            {
-                return UserId == other.UserId && string.Equals(Permission, other.Permission);
-            }
 
-            public override bool Equals(object obj)
-            {
-                if (ReferenceEquals(null, obj)) return false;
-                if (ReferenceEquals(this, obj)) return true;
-                if (obj.GetType() != this.GetType()) return false;
-                return Equals((UserPermission) obj);
-            }
-
-            public override int GetHashCode()
-            {
-                unchecked
-                {
-                    return (UserId*397) ^ Permission.GetHashCode();
-                }
-            }
-        }
     }
 }

src/Umbraco.Core/Models/Membership/IProfile.cs

@@ -1,15 +1,11 @@
 namespace Umbraco.Core.Models.Membership
 {
     /// <summary>
-    /// Defines the the Profile interface
-    /// </summary>
-    /// <remarks>
-    /// This interface is pretty useless but has been exposed publicly from 6.x so we're stuck with it. It would make more sense 
-    /// if the Id was an int but since it's not people have to cast it to int all of the time!
-    /// </remarks>
+    /// Defines the the User Profile interface
+    /// </summary>   
     public interface IProfile
     {
-        object Id { get; set; }
-        string Name { get; set; }
+        int Id { get; }
+        string Name { get; }
     }
 }

src/Umbraco.Core/Models/Membership/IReadOnlyUserGroup.cs

@@ -0,0 +1,31 @@
+using System.Collections.Generic;
+
+namespace Umbraco.Core.Models.Membership
+{
+    /// <summary>
+    /// A readonly user group providing basic information
+    /// </summary>
+    public interface IReadOnlyUserGroup
+    {
+        string Name { get; }
+        string Icon { get; }
+        int Id { get; }
+        int? StartContentId { get; }
+        int? StartMediaId { get; }
+
+        /// <summary>
+        /// The alias
+        /// </summary>
+        string Alias { get; }
+
+        /// <summary>
+        /// The set of default permissions
+        /// </summary>
+        /// <remarks>
+        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
+        /// </remarks>
+        IEnumerable<string> Permissions { get; set; }
+
+        IEnumerable<string> AllowedSections { get; }
+    }
+}

src/Umbraco.Core/Models/Membership/IUser.cs

@@ -1,6 +1,7 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
 using Umbraco.Core.Models.EntityBase;
-using Umbraco.Core.Persistence.Mappers;
 
 namespace Umbraco.Core.Models.Membership
 {
@@ -10,29 +11,39 @@ namespace Umbraco.Core.Models.Membership
     /// <remarks>Will be left internal until a proper Membership implementation is part of the roadmap</remarks>
     public interface IUser : IMembershipUser, IRememberBeingDirty, ICanBeDirty
     {
+        UserState UserState { get; }
+
         string Name { get; set; }
         int SessionTimeout { get; set; }
-        int StartContentId { get; set; }
-        int StartMediaId { get; set; }
-        string Language { get; set; }
+        int[] StartContentIds { get; set; }
+        int[] StartMediaIds { get; set; }
+        string Language { get; set; }
+
+        [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        IUserType UserType { get; set; }
+
+        DateTime? EmailConfirmedDate { get; set; }
+        DateTime? InvitedDate { get; set; }
+
+        /// <summary>
+        /// Gets the groups that user is part of
+        /// </summary>
+        IEnumerable<IReadOnlyUserGroup> Groups { get; }        
+
+        void RemoveGroup(string group);
+        void ClearGroups();
+        void AddGroup(IReadOnlyUserGroup group);
         
-        /// <summary>
-        /// Gets/sets the user type for the user
-        /// </summary>
-        IUserType UserType { get; set; }
-
-        //TODO: This should be a private set 
-        /// <summary>
-        /// The default permission set for the user
-        /// </summary>
-        /// <remarks>
-        /// Currently in umbraco each permission is a single char but with an Enumerable{string} collection this allows for flexible changes to this in the future
-        /// </remarks>
-        IEnumerable<string> DefaultPermissions { get; set; }
-
         IEnumerable<string> AllowedSections { get; }
+
+        [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
         void RemoveAllowedSection(string sectionAlias);
-        void AddAllowedSection(string sectionAlias);
+
+        [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        void AddAllowedSection(string sectionAlias);
 
         /// <summary>
         /// Exposes the basic profile data
@@ -43,5 +54,10 @@ namespace Umbraco.Core.Models.Membership
         /// The security stamp used by ASP.Net identity
         /// </summary>
         string SecurityStamp { get; set; }
+
+        /// <summary>
+        /// Will hold the media file system relative path of the users custom avatar if they uploaded one
+        /// </summary>
+        string Avatar { get; set; }
     }
 }

src/Umbraco.Core/Models/Membership/IUserGroup.cs

@@ -0,0 +1,44 @@
+using System.Collections.Generic;
+using Umbraco.Core.Models.EntityBase;
+
+namespace Umbraco.Core.Models.Membership
+{
+    public interface IUserGroup : IAggregateRoot
+    {
+        string Alias { get; set; }
+
+        int? StartContentId { get; set; }
+        int? StartMediaId { get; set; }
+
+        /// <summary>
+        /// The icon
+        /// </summary>
+        string Icon { get; set; }
+        
+        /// <summary>
+        /// The name
+        /// </summary>
+        string Name { get; set; }
+
+        /// <summary>
+        /// The set of default permissions
+        /// </summary>
+        /// <remarks>
+        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
+        /// </remarks>
+        IEnumerable<string> Permissions { get; set; }
+
+        IEnumerable<string> AllowedSections { get; }
+
+        void RemoveAllowedSection(string sectionAlias);
+
+        void AddAllowedSection(string sectionAlias);
+
+        void ClearAllowedSections();
+
+        /// <summary>
+        /// Specifies the number of users assigned to this group
+        /// </summary>
+        int UserCount { get; }
+    }
+}

src/Umbraco.Core/Models/Membership/IUserType.cs

@@ -1,28 +1,17 @@
-using System.Collections.Generic;
-using Umbraco.Core.Models.EntityBase;
-using Umbraco.Core.Persistence.Mappers;
-
-namespace Umbraco.Core.Models.Membership
-{
-
-    public interface IUserType : IAggregateRoot
-    {
-        /// <summary>
-        /// The user type alias
-        /// </summary>
-        string Alias { get; set; }
-
-        /// <summary>
-        /// The user type name
-        /// </summary>
-        string Name { get; set; }
-
-        /// <summary>
-        /// The set of default permissions for the user type
-        /// </summary>
-        /// <remarks>
-        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
-        /// </remarks>
-        IEnumerable<string> Permissions { get; set; }
-    }
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using Umbraco.Core.Models.EntityBase;
+
+namespace Umbraco.Core.Models.Membership
+{
+    [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public interface IUserType : IAggregateRoot
+    {
+        string Alias { get; set; }
+        string Name { get; set; }        
+        IEnumerable<string> Permissions { get; set; }
+
+    }
 }

src/Umbraco.Core/Models/Membership/ReadOnlyUserGroup.cs

@@ -0,0 +1,70 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Umbraco.Core.Models.Membership
+{
+    public class ReadOnlyUserGroup : IReadOnlyUserGroup, IEquatable<ReadOnlyUserGroup>
+    {
+        public ReadOnlyUserGroup(int id, string name, string icon, int? startContentId, int? startMediaId, string @alias, 
+            IEnumerable<string> allowedSections, IEnumerable<string> permissions)
+        {
+            Name = name;
+            Icon = icon;
+            Id = id;
+            Alias = alias;
+            AllowedSections = allowedSections.ToArray();
+            Permissions = permissions.ToArray();
+
+            //Zero is invalid and will be treated as Null
+            StartContentId = startContentId == 0 ? null : startContentId;
+            StartMediaId = startMediaId == 0 ? null : startMediaId;
+        }
+
+        public int Id { get; private set; }
+        public string Name { get; private set; }
+        public string Icon { get; private set; }
+        public int? StartContentId { get; private set; }
+        public int? StartMediaId { get; private set; }
+        public string Alias { get; private set; }
+
+        /// <summary>
+        /// The set of default permissions
+        /// </summary>
+        /// <remarks>
+        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
+        /// </remarks>
+        public IEnumerable<string> Permissions { get; set; }
+        public IEnumerable<string> AllowedSections { get; private set; }
+
+        public bool Equals(ReadOnlyUserGroup other)
+        {
+            if (ReferenceEquals(null, other)) return false;
+            if (ReferenceEquals(this, other)) return true;
+            return string.Equals(Alias, other.Alias);
+        }
+
+        public override bool Equals(object obj)
+        {
+            if (ReferenceEquals(null, obj)) return false;
+            if (ReferenceEquals(this, obj)) return true;
+            if (obj.GetType() != this.GetType()) return false;
+            return Equals((ReadOnlyUserGroup) obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return Alias.GetHashCode();
+        }
+
+        public static bool operator ==(ReadOnlyUserGroup left, ReadOnlyUserGroup right)
+        {
+            return Equals(left, right);
+        }
+
+        public static bool operator !=(ReadOnlyUserGroup left, ReadOnlyUserGroup right)
+        {
+            return !Equals(left, right);
+        }
+    }
+}

src/Umbraco.Core/Models/Membership/UmbracoMembershipUser.cs

@@ -34,12 +34,11 @@ namespace Umbraco.Core.Models.Membership
         /// <param name="lastLockoutDate">The last lockout date.</param>
         /// <param name="fullName">The full name.</param>
         /// <param name="language">The language.</param>
-        /// <param name="userType">Type of the user.</param>
         /// <param name="user"></param>
         public UmbracoMembershipUser(string providerName, string name, object providerUserKey, string email, 
             string passwordQuestion, string comment, bool isApproved, bool isLockedOut, 
             DateTime creationDate, DateTime lastLoginDate, DateTime lastActivityDate, DateTime lastPasswordChangedDate,
-            DateTime lastLockoutDate, string fullName, string language, IUserType userType, T user) 
+            DateTime lastLockoutDate, string fullName, string language, T user) 
             : base( providerName, name, providerUserKey, email, passwordQuestion, comment, isApproved, isLockedOut, 
                 creationDate, lastLoginDate, lastActivityDate, lastPasswordChangedDate, lastLockoutDate)
         {

src/Umbraco.Core/Models/Membership/User.cs

@@ -2,13 +2,14 @@
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
 using System.Collections.Specialized;
+using System.ComponentModel;
 using System.Linq;
 using System.Reflection;
 using System.Runtime.Serialization;
 using Umbraco.Core.Configuration;
+using Umbraco.Core.Logging;
 using Umbraco.Core.Models.EntityBase;
 
-
 namespace Umbraco.Core.Models.Membership
 {
     /// <summary>
@@ -18,64 +19,107 @@ namespace Umbraco.Core.Models.Membership
     [DataContract(IsReference = true)]
     public class User : Entity, IUser
     {
-        public User(IUserType userType)
+        /// <summary>
+        /// Constructor for creating a new/empty user
+        /// </summary>
+        public User()
         {
-            if (userType == null) throw new ArgumentNullException("userType");
-
-            _userType = userType;
-            _defaultPermissions = _userType.Permissions == null ? Enumerable.Empty<string>() : new List<string>(_userType.Permissions);
-            //Groups = new List<object> { userType };
             SessionTimeout = 60;
-            _sectionCollection = new ObservableCollection<string>();
-            _addedSections = new List<string>();
-            _removedSections = new List<string>();
+            _userGroups = new HashSet<IReadOnlyUserGroup>();
             _language = GlobalSettings.DefaultUILanguage;
-            _sectionCollection.CollectionChanged += SectionCollectionChanged;
             _isApproved = true;
             _isLockedOut = false;
-            _startContentId = -1;
-            _startMediaId = -1;
+            _startContentIds = new int[] { };
+            _startMediaIds = new int[] { };
             //cannot be null
             _rawPasswordValue = "";
         }
 
-        public User(string name, string email, string username, string rawPasswordValue, IUserType userType)
-            : this(userType)
+        /// <summary>
+        /// Constructor for creating a new/empty user
+        /// </summary>
+        /// <param name="name"></param>
+        /// <param name="email"></param>
+        /// <param name="username"></param>
+        /// <param name="rawPasswordValue"></param>
+        public User(string name, string email, string username, string rawPasswordValue)
+            : this()
         {
+            if (string.IsNullOrWhiteSpace(name)) throw new ArgumentException("Value cannot be null or whitespace.", "name");
+            if (string.IsNullOrWhiteSpace(email)) throw new ArgumentException("Value cannot be null or whitespace.", "email");
+            if (string.IsNullOrWhiteSpace(username)) throw new ArgumentException("Value cannot be null or whitespace.", "username");
+            if (string.IsNullOrEmpty(rawPasswordValue)) throw new ArgumentException("Value cannot be null or empty.", "rawPasswordValue");
+
             _name = name;
             _email = email;
             _username = username;
             _rawPasswordValue = rawPasswordValue;
+            _userGroups = new HashSet<IReadOnlyUserGroup>();
             _isApproved = true;
             _isLockedOut = false;
-            _startContentId = -1;
-            _startMediaId = -1;
+            _startContentIds = new int[] { };
+            _startMediaIds = new int[] { };
+            
+        }
+
+        /// <summary>
+        /// Constructor for creating a new User instance for an existing user
+        /// </summary>
+        /// <param name="id"></param>
+        /// <param name="name"></param>
+        /// <param name="email"></param>
+        /// <param name="username"></param>
+        /// <param name="rawPasswordValue"></param>
+        /// <param name="userGroups"></param>
+        /// <param name="startContentIds"></param>
+        /// <param name="startMediaIds"></param>
+        public User(int id, string name, string email, string username, string rawPasswordValue, IEnumerable<IReadOnlyUserGroup> userGroups, int[] startContentIds, int[] startMediaIds)
+            : this()
+        {
+            //we allow whitespace for this value so just check null
+            if (rawPasswordValue == null) throw new ArgumentNullException("rawPasswordValue");
+            if (userGroups == null) throw new ArgumentNullException("userGroups");
+            if (startContentIds == null) throw new ArgumentNullException("startContentIds");
+            if (startMediaIds == null) throw new ArgumentNullException("startMediaIds");
+            if (string.IsNullOrWhiteSpace(name)) throw new ArgumentException("Value cannot be null or whitespace.", "name");
+            if (string.IsNullOrWhiteSpace(username)) throw new ArgumentException("Value cannot be null or whitespace.", "username");            
+
+            Id = id;
+            _name = name;
+            _email = email;
+            _username = username;
+            _rawPasswordValue = rawPasswordValue;
+            _userGroups = new HashSet<IReadOnlyUserGroup>(userGroups);
+            _isApproved = true;
+            _isLockedOut = false;
+            _startContentIds = startContentIds;
+            _startMediaIds = startMediaIds;
         }
 
-        private IUserType _userType;
         private string _name;
         private string _securityStamp;
-        private List<string> _addedSections;
-        private List<string> _removedSections;
-        private ObservableCollection<string> _sectionCollection;
+        private string _avatar;
         private int _sessionTimeout;
-        private int _startContentId;
-        private int _startMediaId;
+        private int[] _startContentIds;
+        private int[] _startMediaIds;
         private int _failedLoginAttempts;
 
         private string _username;
+        private DateTime? _emailConfirmedDate;
+        private DateTime? _invitedDate;
         private string _email;
         private string _rawPasswordValue;
+        private IEnumerable<string> _allowedSections;
+        private HashSet<IReadOnlyUserGroup> _userGroups;
         private bool _isApproved;
         private bool _isLockedOut;
         private string _language;
         private DateTime _lastPasswordChangedDate;
         private DateTime _lastLoginDate;
         private DateTime _lastLockoutDate;
-
-        private IEnumerable<string> _defaultPermissions; 
-        
         private bool _defaultToLiveEditing;
+        private IDictionary<string, object> _additionalData;
+        private object _additionalDataLock = new object();
 
         private static readonly Lazy<PropertySelectors> Ps = new Lazy<PropertySelectors>();
 
@@ -87,10 +131,10 @@ namespace Umbraco.Core.Models.Membership
             public readonly PropertyInfo LastPasswordChangeDateSelector = ExpressionHelper.GetPropertyInfo<User, DateTime>(x => x.LastPasswordChangeDate);
 
             public readonly PropertyInfo SecurityStampSelector = ExpressionHelper.GetPropertyInfo<User, string>(x => x.SecurityStamp);
+            public readonly PropertyInfo AvatarSelector = ExpressionHelper.GetPropertyInfo<User, string>(x => x.Avatar);
             public readonly PropertyInfo SessionTimeoutSelector = ExpressionHelper.GetPropertyInfo<User, int>(x => x.SessionTimeout);
-            public readonly PropertyInfo StartContentIdSelector = ExpressionHelper.GetPropertyInfo<User, int>(x => x.StartContentId);
-            public readonly PropertyInfo StartMediaIdSelector = ExpressionHelper.GetPropertyInfo<User, int>(x => x.StartMediaId);
-            public readonly PropertyInfo AllowedSectionsSelector = ExpressionHelper.GetPropertyInfo<User, IEnumerable<string>>(x => x.AllowedSections);
+            public readonly PropertyInfo StartContentIdSelector = ExpressionHelper.GetPropertyInfo<User, int[]>(x => x.StartContentIds);
+            public readonly PropertyInfo StartMediaIdSelector = ExpressionHelper.GetPropertyInfo<User, int[]>(x => x.StartMediaIds);
             public readonly PropertyInfo NameSelector = ExpressionHelper.GetPropertyInfo<User, string>(x => x.Name);
 
             public readonly PropertyInfo UsernameSelector = ExpressionHelper.GetPropertyInfo<User, string>(x => x.Username);
@@ -99,9 +143,18 @@ namespace Umbraco.Core.Models.Membership
             public readonly PropertyInfo IsLockedOutSelector = ExpressionHelper.GetPropertyInfo<User, bool>(x => x.IsLockedOut);
             public readonly PropertyInfo IsApprovedSelector = ExpressionHelper.GetPropertyInfo<User, bool>(x => x.IsApproved);
             public readonly PropertyInfo LanguageSelector = ExpressionHelper.GetPropertyInfo<User, string>(x => x.Language);
+            public readonly PropertyInfo EmailConfirmedDateSelector = ExpressionHelper.GetPropertyInfo<User, DateTime?>(x => x.EmailConfirmedDate);
+            public readonly PropertyInfo InvitedDateSelector = ExpressionHelper.GetPropertyInfo<User, DateTime?>(x => x.InvitedDate);
 
             public readonly PropertyInfo DefaultToLiveEditingSelector = ExpressionHelper.GetPropertyInfo<User, bool>(x => x.DefaultToLiveEditing);
-            public readonly PropertyInfo UserTypeSelector = ExpressionHelper.GetPropertyInfo<User, IUserType>(x => x.UserType);
+
+            public readonly PropertyInfo UserGroupsSelector = ExpressionHelper.GetPropertyInfo<User, IEnumerable<IReadOnlyUserGroup>>(x => x.Groups);
+
+            //Custom comparer for enumerable
+            public readonly DelegateEqualityComparer<IEnumerable<int>> IntegerEnumerableComparer =
+                new DelegateEqualityComparer<IEnumerable<int>>(
+                    (enum1, enum2) => enum1.UnsortedSequenceEqual(enum2),
+                    enum1 => enum1.GetHashCode());
         }
         
         #region Implementation of IMembershipUser
@@ -112,8 +165,19 @@ namespace Umbraco.Core.Models.Membership
             get { return Id; }
             set { throw new NotSupportedException("Cannot set the provider user key for a user"); }
         }
-
-
+        
+        [DataMember]
+        public DateTime? EmailConfirmedDate
+        {
+            get { return _emailConfirmedDate; }
+            set { SetPropertyValueAndDetectChanges(value, ref _emailConfirmedDate, Ps.Value.EmailConfirmedDateSelector); }
+        }
+        [DataMember]
+        public DateTime? InvitedDate
+        {
+            get { return _invitedDate; }
+            set { SetPropertyValueAndDetectChanges(value, ref _invitedDate, Ps.Value.InvitedDateSelector); }
+        }
         [DataMember]
         public string Username
         {
@@ -189,6 +253,22 @@ namespace Umbraco.Core.Models.Membership
         
         #region Implementation of IUser
 
+        public UserState UserState
+        {
+            get
+            {
+                if (LastLoginDate == default(DateTime) && IsApproved == false && InvitedDate != null)
+                    return UserState.Invited;
+
+                if (IsLockedOut)
+                    return UserState.LockedOut;
+                if (IsApproved == false)
+                    return UserState.Disabled;
+
+                return UserState.Active;
+            }
+        }
+
         [DataMember]
         public string Name
         {
@@ -198,28 +278,171 @@ namespace Umbraco.Core.Models.Membership
 
         public IEnumerable<string> AllowedSections
         {
-            get { return _sectionCollection; }
+            get { return _allowedSections ?? (_allowedSections = new List<string>(_userGroups.SelectMany(x => x.AllowedSections).Distinct())); }
         }
 
-        public void RemoveAllowedSection(string sectionAlias)
+        [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        IUserType IUser.UserType
         {
-            if (_sectionCollection.Contains(sectionAlias))
+            get
             {
-                _sectionCollection.Remove(sectionAlias);
+                //the best we can do here is to return the user's first user group as a IUserType object
+                //but we should attempt to return any group that is the built in ones first
+                var groups = Groups.ToArray();
+                if (groups.Length == 0)
+                {
+                    //In backwards compatibility land, a user type cannot be null! so we need to return a fake one. 
+                    return new UserType
+                    {
+                        Alias = "temp",
+                        Id = int.MinValue,
+                        Key = Guid.Empty,
+                        CreateDate = default(DateTime),
+                        DeletedDate = null,
+                        Name = "Temp",
+                        Permissions = new List<string>(),
+                        UpdateDate = default(DateTime)
+                    };
+                }
+                var builtIns = new[] { Constants.Security.AdminGroupAlias, "writer", "editor", "translator" };
+                var foundBuiltIn = groups.FirstOrDefault(x => builtIns.Contains(x.Alias));
+                IUserGroup realGroup;
+                if (foundBuiltIn != null)
+                {
+                    //if the group isn't IUserGroup we'll need to look it up
+                    realGroup = foundBuiltIn as IUserGroup ?? ApplicationContext.Current.Services.UserService.GetUserGroupById(foundBuiltIn.Id);
+
+                    //return a mapped version of the group
+                    return new UserType
+                    {
+                        Alias = realGroup.Alias,
+                        Id = realGroup.Id,
+                        Key = realGroup.Key,
+                        CreateDate = realGroup.CreateDate,
+                        DeletedDate = realGroup.DeletedDate,
+                        Name = realGroup.Name,
+                        Permissions = realGroup.Permissions,
+                        UpdateDate = realGroup.UpdateDate
+                    };
+                }
+
+                //otherwise return the first
+                //if the group isn't IUserGroup we'll need to look it up
+                realGroup = groups[0] as IUserGroup ?? ApplicationContext.Current.Services.UserService.GetUserGroupById(groups[0].Id);
+                //return a mapped version of the group
+                return new UserType
+                {
+                    Alias = realGroup.Alias,
+                    Id = realGroup.Id,
+                    Key = realGroup.Key,
+                    CreateDate = realGroup.CreateDate,
+                    DeletedDate = realGroup.DeletedDate,
+                    Name = realGroup.Name,
+                    Permissions = realGroup.Permissions,
+                    UpdateDate = realGroup.UpdateDate
+                };
             }
+            set
+            {
+                //if old APIs are still using this lets first check if  the user is part of the user group with the alias specified
+                if (Groups.Any(x => x.Alias == value.Alias))
+                    return;
+
+                //the only other option we have here is to lookup the group (and we'll need to use singletons here :( )
+                var found = ApplicationContext.Current.Services.UserService.GetUserGroupByAlias(value.Alias);
+                if (found == null)
+                    throw new InvalidOperationException("No user group was found with the alias " + value.Alias + ", this API (IUser.UserType) is obsolete, use user groups instead");
+
+                //if it's found, all we can do is add it, we can't really replace them
+                AddGroup(found.ToReadOnlyGroup());
+            }
+        }
+
+        [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        void IUser.RemoveAllowedSection(string sectionAlias)
+        {
+            //don't do anything if they aren't allowed it already
+            if (AllowedSections.Contains(sectionAlias) == false)
+                return;
+
+            var groups = Groups.ToArray();
+            //our only option here is to check if a custom group is created for this user, if so we can remove it from that group, otherwise we'll throw
+            //now we'll check if the user has a special 1:1 user group created for itself. This will occur if this method is used and also during an upgrade.
+            //this comes in the alias form of userName + 'Group'
+            var customUserGroup = groups.FirstOrDefault(x => x.Alias == (Username + "Group"));
+            if (customUserGroup != null)
+            {
+                //if the group isn't IUserGroup we'll need to look it up
+                var realGroup = customUserGroup as IUserGroup ?? ApplicationContext.Current.Services.UserService.GetUserGroupById(customUserGroup.Id);
+                realGroup.RemoveAllowedSection(sectionAlias);
+                //now we need to flag this for saving (hack!) 
+                GroupsToSave.Add(realGroup);
+            }
+            else
+            {
+                throw new InvalidOperationException("Cannot remove the allowed section using this obsolete API. Modify the user's groups instead");
+            }
+            
         }
 
-        public void AddAllowedSection(string sectionAlias)
+        [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+        [EditorBrowsable(EditorBrowsableState.Never)]
+        void IUser.AddAllowedSection(string sectionAlias)
         {
-            if (_sectionCollection.Contains(sectionAlias) == false)
+            //don't do anything if they are allowed it already
+            if (AllowedSections.Contains(sectionAlias))
+                return;
+
+            //This is here for backwards compat only.
+            //First we'll check if the user is part of the 'admin' group. If so then we can ensure that the admin group has this section available to it.
+            //otherwise, the only thing we can do is create a custom user group for this user and add this section.
+            //We are checking for admin here because if the user is an admin and an allowed section is being added, then it's assumed it's to be added 
+            //for the whole admin group (i.e. Forms installer does this for admins)
+            var groups = Groups.ToArray();
+            var admin = groups.FirstOrDefault(x => x.Alias == Constants.Security.AdminGroupAlias);
+            if (admin != null)
+            {                
+                //if the group isn't IUserGroup we'll need to look it up
+                var realGroup = admin as IUserGroup ?? ApplicationContext.Current.Services.UserService.GetUserGroupById(admin.Id);
+                realGroup.AddAllowedSection(sectionAlias);
+                //now we need to flag this for saving (hack!) 
+                GroupsToSave.Add(realGroup);
+            }
+
+            //now we'll check if the user has a special 1:1 user group created for itself. This will occur if this method is used and also during an upgrade.
+            //this comes in the alias form of userName + 'Group'
+            var customUserGroup = groups.FirstOrDefault(x => x.Alias == (Username + "Group"));
+            if (customUserGroup != null)
             {
-                _sectionCollection.Add(sectionAlias);
-            }
-        }
+                //if the group isn't IUserGroup we'll need to look it up
+                var realGroup = customUserGroup as IUserGroup ?? ApplicationContext.Current.Services.UserService.GetUserGroupById(customUserGroup.Id);
+                realGroup.AddAllowedSection(sectionAlias);
+                //now we need to flag this for saving (hack!) 
+                GroupsToSave.Add(realGroup);
+            }
+
+            //ok, so the user doesn't have a 1:1 group, we'll need to flag it for creation
+            var newUserGroup = new UserGroup
+            {
+                Alias = Username + "Group",
+                Name = "Group for " + Username
+            };
+            newUserGroup.AddAllowedSection(sectionAlias);
+            GroupsToSave.Add(newUserGroup);
+        }
+
+        /// <summary>
+        /// This used purely for hacking backwards compatibility into this class for &lt; 7.7 compat
+        /// </summary>
+        [DoNotClone]
+        [IgnoreDataMember]
+        internal List<IUserGroup> GroupsToSave = new List<IUserGroup>();        
 
         public IProfile ProfileData
         {
-            get { return new UserProfile(this); }
+            get { return new WrappedUserProfile(this); }
         }
 
         /// <summary>
@@ -232,21 +455,12 @@ namespace Umbraco.Core.Models.Membership
             set { SetPropertyValueAndDetectChanges(value, ref _securityStamp, Ps.Value.SecurityStampSelector); }
         }
 
-        /// <summary>
-        /// Used internally to check if we need to add a section in the repository to the db
-        /// </summary>
-        internal IEnumerable<string> AddedSections
+        [DataMember]
+        public string Avatar
         {
-            get { return _addedSections; }
-        }
-
-        /// <summary>
-        /// Used internally to check if we need to remove  a section in the repository to the db
-        /// </summary>
-        internal IEnumerable<string> RemovedSections
-        {
-            get { return _removedSections; }
-        }
+            get { return _avatar; }
+            set { SetPropertyValueAndDetectChanges(value, ref _avatar, Ps.Value.AvatarSelector); }
+        }        
 
         /// <summary>
         /// Gets or sets the session timeout.
@@ -268,10 +482,11 @@ namespace Umbraco.Core.Models.Membership
         /// The start content id.
         /// </value>
         [DataMember]
-        public int StartContentId
+        [DoNotClone]
+        public int[] StartContentIds
         {
-            get { return _startContentId; }
-            set { SetPropertyValueAndDetectChanges(value, ref _startContentId, Ps.Value.StartContentIdSelector); }
+            get { return _startContentIds; }
+            set { SetPropertyValueAndDetectChanges(value, ref _startContentIds, Ps.Value.StartContentIdSelector, Ps.Value.IntegerEnumerableComparer); }
         }
 
         /// <summary>
@@ -281,10 +496,11 @@ namespace Umbraco.Core.Models.Membership
         /// The start media id.
         /// </value>
         [DataMember]
-        public int StartMediaId
+        [DoNotClone]
+        public int[] StartMediaIds
         {
-            get { return _startMediaId; }
-            set { SetPropertyValueAndDetectChanges(value, ref _startMediaId, Ps.Value.StartMediaIdSelector); }
+            get { return _startMediaIds; }
+            set { SetPropertyValueAndDetectChanges(value, ref _startMediaIds, Ps.Value.StartMediaIdSelector, Ps.Value.IntegerEnumerableComparer); }
         }
 
         [DataMember]
@@ -294,14 +510,6 @@ namespace Umbraco.Core.Models.Membership
             set { SetPropertyValueAndDetectChanges(value, ref _language, Ps.Value.LanguageSelector); }
         }
 
-        //TODO: This should be a private set
-        [DataMember]
-        public IEnumerable<string> DefaultPermissions
-        {
-            get {  return _defaultPermissions;}
-            set { _defaultPermissions = value; }
-        }
-
         [IgnoreDataMember]
         internal bool DefaultToLiveEditing
         {
@@ -309,78 +517,107 @@ namespace Umbraco.Core.Models.Membership
             set { SetPropertyValueAndDetectChanges(value, ref _defaultToLiveEditing, Ps.Value.DefaultToLiveEditingSelector); }
         }
 
-        [IgnoreDataMember]
-        public IUserType UserType
+        /// <summary>
+        /// Gets the groups that user is part of
+        /// </summary>
+        [DataMember]
+        public IEnumerable<IReadOnlyUserGroup> Groups
         {
-            get { return _userType; }
-            set
+            get { return _userGroups; }
+        }
+        
+        public void RemoveGroup(string group)
+        {
+            foreach (var userGroup in _userGroups.ToArray())
             {
-                if (value.HasIdentity == false)
+                if (userGroup.Alias == group)
                 {
-                    throw new InvalidOperationException("Cannot assign a User Type that has not been persisted");
+                    _userGroups.Remove(userGroup);
+                    //reset this flag so it's rebuilt with the assigned groups
+                    _allowedSections = null;
+                    OnPropertyChanged(Ps.Value.UserGroupsSelector);
                 }
-
-                SetPropertyValueAndDetectChanges(value, ref _userType, Ps.Value.UserTypeSelector);                
             }
         }
 
+        public void ClearGroups()
+        {
+            if (_userGroups.Count > 0)
+            {
+                _userGroups.Clear();
+                //reset this flag so it's rebuilt with the assigned groups
+                _allowedSections = null;
+                OnPropertyChanged(Ps.Value.UserGroupsSelector);
+            }        
+        }
+
+        public void AddGroup(IReadOnlyUserGroup group)
+        {
+            if (_userGroups.Add(group))
+            {
+                //reset this flag so it's rebuilt with the assigned groups
+                _allowedSections = null;
+                OnPropertyChanged(Ps.Value.UserGroupsSelector);
+            }            
+        }
+
         #endregion
 
         /// <summary>
-        /// Whenever resetting occurs, clear the remembered add/removed collections, even if 
-        /// rememberPreviouslyChangedProperties is true, the AllowedSections property will still
-        /// be flagged as dirty.
+        /// This is used as an internal cache for this entity - specifically for calculating start nodes so we don't re-calculated all of the time
         /// </summary>
-        /// <param name="rememberPreviouslyChangedProperties"></param>
-        public override void ResetDirtyProperties(bool rememberPreviouslyChangedProperties)
+        [IgnoreDataMember]
+        [DoNotClone]
+        internal IDictionary<string, object> AdditionalData
         {
-            _addedSections.Clear();
-            _removedSections.Clear();
-            base.ResetDirtyProperties(rememberPreviouslyChangedProperties);
-        }
-
-        /// <summary>
-        /// Handles the collection changed event in order for us to flag the AllowedSections property as changed
-        /// </summary>
-        /// <param name="sender"></param>
-        /// <param name="e"></param>
-        void SectionCollectionChanged(object sender, NotifyCollectionChangedEventArgs e)
-        {
-            OnPropertyChanged(Ps.Value.AllowedSectionsSelector);
-
-            if (e.Action == NotifyCollectionChangedAction.Add)
+            get
             {
-                var item = e.NewItems.Cast<string>().First();
-
-                if (_addedSections.Contains(item) == false)
+                lock (_additionalDataLock)
                 {
-                    _addedSections.Add(item);
+                    return _additionalData ?? (_additionalData = new Dictionary<string, object>());
                 }
             }
-            else if (e.Action == NotifyCollectionChangedAction.Remove)
-            {
-                var item = e.OldItems.Cast<string>().First();
-
-                if (_removedSections.Contains(item) == false)
-                {
-                    _removedSections.Add(item);    
-                }
-
-            }
         }
 
+        [IgnoreDataMember]
+        [DoNotClone]
+        internal object AdditionalDataLock { get { return _additionalDataLock; } }
+
         public override object DeepClone()
         {
             var clone = (User)base.DeepClone();
             //turn off change tracking
             clone.DisableChangeTracking();
+            //manually clone the start node props
+            clone._startContentIds = _startContentIds.ToArray();
+            clone._startMediaIds = _startMediaIds.ToArray();
+
+            // this value has been cloned and points to the same object
+            // which obviously is bad - needs to point to a new object
+            clone._additionalDataLock = new object();
+
+            if (_additionalData != null)
+            {
+                // clone._additionalData points to the same dictionary, which is bad, because
+                // changing one clone impacts all of them - so we need to reset it with a fresh
+                // dictionary that will contain the same values - and, if some values are deep
+                // cloneable, they should be deep-cloned too
+                var cloneAdditionalData = clone._additionalData = new Dictionary<string, object>();
+
+                lock (_additionalDataLock)
+                {
+                    foreach (var kvp in _additionalData)
+                    {
+                        var deepCloneable = kvp.Value as IDeepCloneable;
+                        cloneAdditionalData[kvp.Key] = deepCloneable == null ? kvp.Value : deepCloneable.DeepClone();
+                    } 
+                }
+            }
+                   
             //need to create new collections otherwise they'll get copied by ref
-            clone._addedSections = new List<string>();
-            clone._removedSections = new List<string>();
-            clone._sectionCollection = new ObservableCollection<string>(_sectionCollection.ToList());
-            clone._defaultPermissions = new List<string>(_defaultPermissions.ToList());
+            clone._userGroups = new HashSet<IReadOnlyUserGroup>(_userGroups);
+            clone._allowedSections = _allowedSections != null ? new List<string>(_allowedSections) : null;
             //re-create the event handler
-            clone._sectionCollection.CollectionChanged += clone.SectionCollectionChanged;
             //this shouldn't really be needed since we're not tracking
             clone.ResetDirtyProperties(false);
             //re-enable tracking
@@ -392,28 +629,26 @@ namespace Umbraco.Core.Models.Membership
         /// <summary>
         /// Internal class used to wrap the user in a profile
         /// </summary>
-        private class UserProfile : IProfile
+        private class WrappedUserProfile : IProfile
         {
             private readonly IUser _user;
 
-            public UserProfile(IUser user)
+            public WrappedUserProfile(IUser user)
             {
                 _user = user;
             }
 
-            public object Id
+            public int Id
             {
                 get { return _user.Id; }
-                set { _user.Id = (int)value; }
             }
 
             public string Name
             {
                 get { return _user.Name; }
-                set { _user.Name = value; }
             }
 
-            protected bool Equals(UserProfile other)
+            private bool Equals(WrappedUserProfile other)
             {
                 return _user.Equals(other._user);
             }
@@ -423,7 +658,7 @@ namespace Umbraco.Core.Models.Membership
                 if (ReferenceEquals(null, obj)) return false;
                 if (ReferenceEquals(this, obj)) return true;
                 if (obj.GetType() != this.GetType()) return false;
-                return Equals((UserProfile) obj);
+                return Equals((WrappedUserProfile) obj);
             }
 
             public override int GetHashCode()

src/Umbraco.Core/Models/Membership/UserGroup.cs

@@ -1,20 +1,155 @@
 using System;
+using System.Collections.Generic;
+using System.Reflection;
 using System.Runtime.Serialization;
 using Umbraco.Core.Models.EntityBase;
+using Umbraco.Core.Strings;
 
 namespace Umbraco.Core.Models.Membership
 {
     /// <summary>
     /// Represents a Group for a Backoffice User
     /// </summary>
-    /// <remarks>
-    /// Should be internal until a proper user/membership implementation
-    /// is part of the roadmap.
-    /// </remarks>
     [Serializable]
     [DataContract(IsReference = true)]
-    internal class UserGroup : Entity
+    internal class UserGroup : Entity, IUserGroup, IReadOnlyUserGroup
     {
-         //Add UserCollection ?
+        private int? _startContentId;
+        private int? _startMediaId;
+        private string _alias;
+        private string _icon;
+        private string _name;
+        private IEnumerable<string> _permissions;
+        private readonly List<string> _sectionCollection;
+
+        private static readonly Lazy<PropertySelectors> Ps = new Lazy<PropertySelectors>();
+
+        private class PropertySelectors
+        {
+            public readonly PropertyInfo NameSelector = ExpressionHelper.GetPropertyInfo<UserGroup, string>(x => x.Name);
+            public readonly PropertyInfo AliasSelector = ExpressionHelper.GetPropertyInfo<UserGroup, string>(x => x.Alias);
+            public readonly PropertyInfo PermissionsSelector = ExpressionHelper.GetPropertyInfo<UserGroup, IEnumerable<string>>(x => x.Permissions);
+            public readonly PropertyInfo IconSelector = ExpressionHelper.GetPropertyInfo<UserGroup, string>(x => x.Icon);
+            public readonly PropertyInfo StartContentIdSelector = ExpressionHelper.GetPropertyInfo<UserGroup, int?>(x => x.StartContentId);
+            public readonly PropertyInfo StartMediaIdSelector = ExpressionHelper.GetPropertyInfo<UserGroup, int?>(x => x.StartMediaId);
+
+            //Custom comparer for enumerable
+            public readonly DelegateEqualityComparer<IEnumerable<string>> StringEnumerableComparer =
+                new DelegateEqualityComparer<IEnumerable<string>>(
+                    (enum1, enum2) => enum1.UnsortedSequenceEqual(enum2),
+                    enum1 => enum1.GetHashCode());
+        }
+
+        /// <summary>
+        /// Constructor to create a new user group
+        /// </summary>
+        public UserGroup()
+        {
+            _sectionCollection = new List<string>();
+        }
+
+        /// <summary>
+        /// Constructor to create an existing user group
+        /// </summary>
+        /// <param name="userCount"></param>
+        /// <param name="alias"></param>
+        /// <param name="name"></param>
+        /// <param name="permissions"></param>
+        /// <param name="icon"></param>
+        public UserGroup(int userCount, string alias, string name, IEnumerable<string> permissions, string icon)
+            : this()
+        {
+            UserCount = userCount;
+            _alias = alias;
+            _name = name;
+            _permissions = permissions;            
+            _icon = icon;
+        }
+
+        [DataMember]
+        public int? StartMediaId
+        {
+            get { return _startMediaId; }
+            set { SetPropertyValueAndDetectChanges(value, ref _startMediaId, Ps.Value.StartMediaIdSelector); }
+        }
+
+        [DataMember]
+        public int? StartContentId
+        {
+            get { return _startContentId; }
+            set { SetPropertyValueAndDetectChanges(value, ref _startContentId, Ps.Value.StartContentIdSelector); }
+        }
+
+        [DataMember]
+        public string Icon
+        {
+            get { return _icon; }
+            set { SetPropertyValueAndDetectChanges(value, ref _icon, Ps.Value.IconSelector); }
+        }
+
+        [DataMember]
+        public string Alias
+        {
+            get { return _alias; }
+            set
+            {
+                SetPropertyValueAndDetectChanges(
+                    value.ToCleanString(CleanStringType.Alias | CleanStringType.UmbracoCase),
+                    ref _alias,
+                    Ps.Value.AliasSelector);
+            }
+        }
+
+        [DataMember]
+        public string Name
+        {
+            get { return _name; }
+            set { SetPropertyValueAndDetectChanges(value, ref _name, Ps.Value.NameSelector); }
+        }
+
+        /// <summary>
+        /// The set of default permissions for the user group
+        /// </summary>
+        /// <remarks>
+        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
+        /// </remarks>
+        [DataMember]
+        public IEnumerable<string> Permissions
+        {
+            get { return _permissions; }
+            set
+            {
+                SetPropertyValueAndDetectChanges(value, ref _permissions, Ps.Value.PermissionsSelector,
+                    Ps.Value.StringEnumerableComparer);
+            }
+        }
+
+        public IEnumerable<string> AllowedSections
+        {
+            get { return _sectionCollection; }
+        }
+
+        public void RemoveAllowedSection(string sectionAlias)
+        {
+            if (_sectionCollection.Contains(sectionAlias))
+            {
+                _sectionCollection.Remove(sectionAlias);
+            }
+        }
+
+        public void AddAllowedSection(string sectionAlias)
+        {
+            if (_sectionCollection.Contains(sectionAlias) == false)
+            {
+                _sectionCollection.Add(sectionAlias);
+            }
+        }
+
+        public void ClearAllowedSections()
+        {
+            _sectionCollection.Clear();
+        }
+
+        public int UserCount { get; private set; }
     }
 }

src/Umbraco.Core/Models/Membership/UserGroupExtensions.cs

@@ -0,0 +1,26 @@
+using Umbraco.Core.Models.Rdbms;
+using System.Linq;
+
+namespace Umbraco.Core.Models.Membership
+{
+    internal static class UserGroupExtensions
+    {
+        public static IReadOnlyUserGroup ToReadOnlyGroup(this IUserGroup group)
+        {
+            //this will generally always be the case
+            var readonlyGroup = group as IReadOnlyUserGroup;
+            if (readonlyGroup != null) return readonlyGroup;
+
+            //otherwise create one
+            return new ReadOnlyUserGroup(group.Id, group.Name, group.Icon, group.StartContentId, group.StartMediaId, group.Alias, group.AllowedSections, group.Permissions);
+        }
+
+        public static IReadOnlyUserGroup ToReadOnlyGroup(this UserGroupDto group)
+        {
+            return new ReadOnlyUserGroup(group.Id, group.Name, group.Icon, 
+                group.StartContentId, group.StartMediaId, group.Alias, 
+                group.UserGroup2AppDtos.Select(x => x.AppAlias).ToArray(),
+                group.DefaultPermissions == null ? Enumerable.Empty<string>() : group.DefaultPermissions.ToCharArray().Select(x => x.ToString()));
+        }
+    }
+}

src/Umbraco.Core/Models/Membership/UserProfile.cs

@@ -0,0 +1,46 @@
+using System;
+
+namespace Umbraco.Core.Models.Membership
+{
+    internal class UserProfile : IProfile, IEquatable<UserProfile>
+    {
+        public UserProfile(int id, string name)
+        {
+            Id = id;
+            Name = name;
+        }
+
+        public int Id { get; private set; }
+        public string Name { get; private set; }
+
+        public bool Equals(UserProfile other)
+        {
+            if (ReferenceEquals(null, other)) return false;
+            if (ReferenceEquals(this, other)) return true;
+            return Id == other.Id;
+        }
+
+        public override bool Equals(object obj)
+        {
+            if (ReferenceEquals(null, obj)) return false;
+            if (ReferenceEquals(this, obj)) return true;
+            if (obj.GetType() != this.GetType()) return false;
+            return Equals((UserProfile) obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return Id;
+        }
+
+        public static bool operator ==(UserProfile left, UserProfile right)
+        {
+            return Equals(left, right);
+        }
+
+        public static bool operator !=(UserProfile left, UserProfile right)
+        {
+            return Equals(left, right) == false;
+        }
+    }
+}

src/Umbraco.Core/Models/Membership/UserState.cs

@@ -0,0 +1,14 @@
+namespace Umbraco.Core.Models.Membership
+{
+    /// <summary>
+    /// The state of a user
+    /// </summary>
+    public enum UserState
+    {
+        All = -1,
+        Active = 0,
+        Disabled = 1,
+        LockedOut = 2,
+        Invited = 3
+    }
+}

src/Umbraco.Core/Models/Membership/UserType.cs

@@ -1,72 +1,68 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Reflection;
-using System.Runtime.Serialization;
-using Umbraco.Core.Models.EntityBase;
-using Umbraco.Core.Persistence.Mappers;
-using Umbraco.Core.Strings;
-
-namespace Umbraco.Core.Models.Membership
-{
-    /// <summary>
-    /// Represents the Type for a Backoffice User
-    /// </summary>    
-    [Serializable]
-    [DataContract(IsReference = true)]
-    internal class UserType : Entity, IUserType
-    {
-        private string _alias;
-        private string _name;
-        private IEnumerable<string> _permissions;
-
-        private static readonly Lazy<PropertySelectors> Ps = new Lazy<PropertySelectors>();
-
-        private class PropertySelectors
-        {
-            public readonly PropertyInfo NameSelector = ExpressionHelper.GetPropertyInfo<UserType, string>(x => x.Name);
-            public readonly PropertyInfo AliasSelector = ExpressionHelper.GetPropertyInfo<UserType, string>(x => x.Alias);
-            public readonly PropertyInfo PermissionsSelector = ExpressionHelper.GetPropertyInfo<UserType, IEnumerable<string>>(x => x.Permissions);
-        }
-
-        [DataMember]
-        public string Alias
-        {
-            get { return _alias; }
-            set
-            {
-                SetPropertyValueAndDetectChanges(
-                    value.ToCleanString(CleanStringType.Alias | CleanStringType.UmbracoCase), 
-                    ref _alias, 
-                    Ps.Value.AliasSelector);                
-            }
-        }
-
-        [DataMember]
-        public string Name
-        {
-            get { return _name; }
-            set { SetPropertyValueAndDetectChanges(value, ref _name, Ps.Value.NameSelector); }
-        }
-
-        /// <summary>
-        /// The set of default permissions for the user type
-        /// </summary>
-        /// <remarks>
-        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
-        /// </remarks>
-        [DataMember]
-        public IEnumerable<string> Permissions
-        {
-            get { return _permissions; }
-            set
-            {
-                SetPropertyValueAndDetectChanges(value, ref _permissions, Ps.Value.PermissionsSelector,
-                    //Custom comparer for enumerable
-                    new DelegateEqualityComparer<IEnumerable<string>>(
-                        (enum1, enum2) => enum1.UnsortedSequenceEqual(enum2),
-                        enum1 => enum1.GetHashCode()));
-            }
-        }
-    }
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Reflection;
+using System.Runtime.Serialization;
+using Umbraco.Core.Models.EntityBase;
+using Umbraco.Core.Strings;
+
+namespace Umbraco.Core.Models.Membership
+{
+    [Obsolete("This should not be used it exists for legacy reasons only, use user groups instead, it will be removed in future versions")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Serializable]
+    [DataContract(IsReference = true)]
+    internal class UserType : Entity, IUserType
+    {
+        private string _alias;
+        private string _name;
+        private IEnumerable<string> _permissions;
+        private static readonly Lazy<PropertySelectors> Ps = new Lazy<PropertySelectors>();
+        private class PropertySelectors
+        {
+            public readonly PropertyInfo NameSelector = ExpressionHelper.GetPropertyInfo<UserType, string>(x => x.Name);
+            public readonly PropertyInfo AliasSelector = ExpressionHelper.GetPropertyInfo<UserType, string>(x => x.Alias);
+            public readonly PropertyInfo PermissionsSelector = ExpressionHelper.GetPropertyInfo<UserType, IEnumerable<string>>(x => x.Permissions);
+        }
+
+        [DataMember]
+        public string Alias
+        {
+            get { return _alias; }
+            set
+            {
+                SetPropertyValueAndDetectChanges(
+                    value.ToCleanString(CleanStringType.Alias | CleanStringType.UmbracoCase),
+                    ref _alias,
+                    Ps.Value.AliasSelector);
+            }
+        }
+
+        [DataMember]
+        public string Name
+        {
+            get { return _name; }
+            set { SetPropertyValueAndDetectChanges(value, ref _name, Ps.Value.NameSelector); }
+        }
+
+        /// <summary>
+        /// The set of default permissions for the user type
+        /// </summary>
+        /// <remarks>
+        /// By default each permission is simply a single char but we've made this an enumerable{string} to support a more flexible permissions structure in the future.
+        /// </remarks>
+        [DataMember]
+        public IEnumerable<string> Permissions
+        {
+            get { return _permissions; }
+            set
+            {
+                SetPropertyValueAndDetectChanges(value, ref _permissions, Ps.Value.PermissionsSelector,
+                    //Custom comparer for enumerable
+                    new DelegateEqualityComparer<IEnumerable<string>>(
+                        (enum1, enum2) => enum1.UnsortedSequenceEqual(enum2),
+                        enum1 => enum1.GetHashCode()));
+            }
+        }
+    }
 }

src/Umbraco.Core/Models/Property.cs

@@ -49,36 +49,36 @@ namespace Umbraco.Core.Models
         {
             public readonly PropertyInfo ValueSelector = ExpressionHelper.GetPropertyInfo<Property, object>(x => x.Value);
             public readonly PropertyInfo VersionSelector = ExpressionHelper.GetPropertyInfo<Property, Guid>(x => x.Version);
-        }
 
-        private static readonly DelegateEqualityComparer<object> ValueComparer = new DelegateEqualityComparer<object>(
-            (o, o1) =>
-            {
-                if (o == null && o1 == null) return true;
-
-                //custom comparer for strings.                        
-                if (o is string || o1 is string)
+            public readonly DelegateEqualityComparer<object> PropertyValueComparer = new DelegateEqualityComparer<object>(
+                (o, o1) =>
                 {
-                    //if one is null and another is empty then they are the same
-                    if ((o as string).IsNullOrWhiteSpace() && (o1 as string).IsNullOrWhiteSpace())
+                    if (o == null && o1 == null) return true;
+
+                    //custom comparer for strings.                        
+                    if (o is string || o1 is string)
                     {
-                        return true;
+                        //if one is null and another is empty then they are the same
+                        if ((o as string).IsNullOrWhiteSpace() && (o1 as string).IsNullOrWhiteSpace())
+                        {
+                            return true;
+                        }
+                        if (o == null || o1 == null) return false;
+                        return o.Equals(o1);
                     }
+
                     if (o == null || o1 == null) return false;
+
+                    //Custom comparer for enumerable if it is enumerable
+                    var enum1 = o as IEnumerable;
+                    var enum2 = o1 as IEnumerable;
+                    if (enum1 != null && enum2 != null)
+                    {
+                        return enum1.Cast<object>().UnsortedSequenceEqual(enum2.Cast<object>());
+                    }
                     return o.Equals(o1);
-                }
-
-                if (o == null || o1 == null) return false;
-
-                //Custom comparer for enumerable if it is enumerable
-                var enum1 = o as IEnumerable;
-                var enum2 = o1 as IEnumerable;
-                if (enum1 != null && enum2 != null)
-                {
-                    return enum1.Cast<object>().UnsortedSequenceEqual(enum2.Cast<object>());
-                }
-                return o.Equals(o1);
-            }, o => o.GetHashCode());
+                }, o => o.GetHashCode());
+        }
         
         /// <summary>
         /// Returns the instance of the tag support, by default tags are not enabled
@@ -200,7 +200,7 @@ namespace Umbraco.Core.Models
                     }
                 }
 
-                SetPropertyValueAndDetectChanges(value, ref _value, Ps.Value.ValueSelector, ValueComparer);
+                SetPropertyValueAndDetectChanges(value, ref _value, Ps.Value.ValueSelector, Ps.Value.PropertyValueComparer);
             }
         }
 

src/Umbraco.Core/Models/PublishedContent/PublishedContentExtended.cs

@@ -28,7 +28,7 @@ namespace Umbraco.Core.Models.PublishedContent
             if (_index.HasValue) return _index.Value;
 
             // slow -- and don't cache, not in a set
-            if (_contentSet == null) return Content.GetIndex();
+            if (_contentSet == null) return WrappedContentInternal.GetIndex();
 
             // slow -- but cache for next time
             var index = _contentSet.FindIndex(x => x.Id == Id);
@@ -147,7 +147,7 @@ namespace Umbraco.Core.Models.PublishedContent
 
         public override IEnumerable<IPublishedContent> ContentSet
         {
-            get { return _contentSet ?? Content.ContentSet; }
+            get { return _contentSet ?? WrappedContentInternal.ContentSet; }
         }
 
         #endregion
@@ -161,8 +161,8 @@ namespace Umbraco.Core.Models.PublishedContent
             get
             {
                 return _properties == null
-                    ? Content.Properties
-                    : Content.Properties.Union(_properties).ToList();
+                    ? WrappedContentInternal.Properties
+                    : WrappedContentInternal.Properties.Union(_properties).ToList();
             }
         }
 
@@ -175,15 +175,15 @@ namespace Umbraco.Core.Models.PublishedContent
                     var property = _properties.FirstOrDefault(prop => prop.PropertyTypeAlias.InvariantEquals(alias));
                     if (property != null) return property.HasValue ? property.Value : null;
                 }
-                return Content[alias];
+                return WrappedContentInternal[alias];
             }
         }
 
         public override IPublishedProperty GetProperty(string alias)
         {
             return _properties == null
-                ? Content.GetProperty(alias)
-                : _properties.FirstOrDefault(prop => prop.PropertyTypeAlias.InvariantEquals(alias)) ?? Content.GetProperty(alias);
+                ? WrappedContentInternal.GetProperty(alias)
+                : _properties.FirstOrDefault(prop => prop.PropertyTypeAlias.InvariantEquals(alias)) ?? WrappedContentInternal.GetProperty(alias);
         }
 
         #endregion

src/Umbraco.Core/Models/PublishedContent/PublishedContentWithKeyExtended.cs

@@ -9,6 +9,6 @@ namespace Umbraco.Core.Models.PublishedContent
             : base(content)
         { }
 
-        public Guid Key { get { return ((IPublishedContentWithKey) Content).Key; } }
+        public Guid Key { get { return ((IPublishedContentWithKey) WrappedContentInternal).Key; } }
     }
 }

src/Umbraco.Core/Models/PublishedContent/PublishedContentWithKeyModel.cs

@@ -8,6 +8,6 @@ namespace Umbraco.Core.Models.PublishedContent
             : base (content)
         { }
 
-        public Guid Key { get { return ((IPublishedContentWithKey) Content).Key; } }
+        public Guid Key { get { return ((IPublishedContentWithKey) WrappedContentInternal).Key; } }
     }
 }

src/Umbraco.Core/Models/PublishedContent/PublishedContentWithKeyWrapped.cs

@@ -12,6 +12,6 @@ namespace Umbraco.Core.Models.PublishedContent
             : base(content)
         { }
 
-        public virtual Guid Key { get { return ((IPublishedContentWithKey) Content).Key; } }
+        public virtual Guid Key { get { return ((IPublishedContentWithKey) WrappedContentInternal).Key; } }
     }
 }

src/Umbraco.Core/Models/PublishedContent/PublishedContentWrapped.cs

@@ -27,7 +27,7 @@ namespace Umbraco.Core.Models.PublishedContent
     /// </summary>
     public abstract class PublishedContentWrapped : IPublishedContent
     {
-        protected readonly IPublishedContent Content;
+        protected readonly IPublishedContent WrappedContentInternal;
 
         /// <summary>
         /// Initialize a new instance of the <see cref="PublishedContentWrapped"/> class
@@ -36,7 +36,7 @@ namespace Umbraco.Core.Models.PublishedContent
         /// <param name="content">The content to wrap and extend.</param>
         protected PublishedContentWrapped(IPublishedContent content)
         {
-            Content = content;
+            WrappedContentInternal = content;
         }
 
         /// <summary>
@@ -45,21 +45,21 @@ namespace Umbraco.Core.Models.PublishedContent
         /// <returns>The wrapped content, that was passed as an argument to the constructor.</returns>
         public IPublishedContent Unwrap()
         {
-            return Content;
+            return WrappedContentInternal;
         }
 
         #region ContentSet
 
         public virtual IEnumerable<IPublishedContent> ContentSet
         {
-            get { return Content.ContentSet; }
+            get { return WrappedContentInternal.ContentSet; }
         }
 
         #endregion
 
         #region ContentType
 
-        public virtual PublishedContentType ContentType { get { return Content.ContentType; } }
+        public virtual PublishedContentType ContentType { get { return WrappedContentInternal.ContentType; } }
 
         #endregion
 
@@ -67,102 +67,102 @@ namespace Umbraco.Core.Models.PublishedContent
 
         public virtual int Id
         {
-            get { return Content.Id; }
+            get { return WrappedContentInternal.Id; }
         }
 
         public virtual int TemplateId
         {
-            get { return Content.TemplateId; }
+            get { return WrappedContentInternal.TemplateId; }
         }
 
         public virtual int SortOrder
         {
-            get { return Content.SortOrder; }
+            get { return WrappedContentInternal.SortOrder; }
         }
 
         public virtual string Name
         {
-            get { return Content.Name; }
+            get { return WrappedContentInternal.Name; }
         }
 
         public virtual string UrlName
         {
-            get { return Content.UrlName; }
+            get { return WrappedContentInternal.UrlName; }
         }
 
         public virtual string DocumentTypeAlias
         {
-            get { return Content.DocumentTypeAlias; }
+            get { return WrappedContentInternal.DocumentTypeAlias; }
         }
 
         public virtual int DocumentTypeId
         {
-            get { return Content.DocumentTypeId; }
+            get { return WrappedContentInternal.DocumentTypeId; }
         }
 
         public virtual string WriterName
         {
-            get { return Content.WriterName; }
+            get { return WrappedContentInternal.WriterName; }
         }
 
         public virtual string CreatorName
         {
-            get { return Content.CreatorName; }
+            get { return WrappedContentInternal.CreatorName; }
         }
 
         public virtual int WriterId
         {
-            get { return Content.WriterId; }
+            get { return WrappedContentInternal.WriterId; }
         }
 
         public virtual int CreatorId
         {
-            get { return Content.CreatorId; }
+            get { return WrappedContentInternal.CreatorId; }
         }
 
         public virtual string Path
         {
-            get { return Content.Path; }
+            get { return WrappedContentInternal.Path; }
         }
 
         public virtual DateTime CreateDate
         {
-            get { return Content.CreateDate; }
+            get { return WrappedContentInternal.CreateDate; }
         }
 
         public virtual DateTime UpdateDate
         {
-            get { return Content.UpdateDate; }
+            get { return WrappedContentInternal.UpdateDate; }
         }
 
         public virtual Guid Version
         {
-            get { return Content.Version; }
+            get { return WrappedContentInternal.Version; }
         }
 
         public virtual int Level
         {
-            get { return Content.Level; }
+            get { return WrappedContentInternal.Level; }
         }
 
         public virtual string Url
         {
-            get { return Content.Url; }
+            get { return WrappedContentInternal.Url; }
         }
 
         public virtual PublishedItemType ItemType
         {
-            get { return Content.ItemType; }
+            get { return WrappedContentInternal.ItemType; }
         }
 
         public virtual bool IsDraft
         {
-            get { return Content.IsDraft; }
+            get { return WrappedContentInternal.IsDraft; }
         }
 
         public virtual int GetIndex()
         {
-            return Content.GetIndex();
+            return WrappedContentInternal.GetIndex();
         }
 
         #endregion
@@ -171,12 +171,12 @@ namespace Umbraco.Core.Models.PublishedContent
 
         public virtual IPublishedContent Parent
         {
-            get { return Content.Parent; }
+            get { return WrappedContentInternal.Parent; }
         }
 
         public virtual IEnumerable<IPublishedContent> Children
         {
-            get { return Content.Children; }
+            get { return WrappedContentInternal.Children; }
         }
 
         #endregion
@@ -185,22 +185,22 @@ namespace Umbraco.Core.Models.PublishedContent
 
         public virtual ICollection<IPublishedProperty> Properties
         {
-            get { return Content.Properties; }
+            get { return WrappedContentInternal.Properties; }
         }
 
         public virtual object this[string alias]
         {
-            get { return Content[alias]; }
+            get { return WrappedContentInternal[alias]; }
         }
 
         public virtual IPublishedProperty GetProperty(string alias)
         {
-            return Content.GetProperty(alias);
+            return WrappedContentInternal.GetProperty(alias);
         }
 
         public virtual IPublishedProperty GetProperty(string alias, bool recurse)
         {
-            return Content.GetProperty(alias, recurse);
+            return WrappedContentInternal.GetProperty(alias, recurse);
         }
 
         #endregion

src/Umbraco.Core/Models/Rdbms/DictionaryDto.cs

@@ -24,7 +24,8 @@ namespace Umbraco.Core.Models.Rdbms
         public Guid? Parent { get; set; }
 
         [Column("key")]
-        [Length(1000)]
+        [Length(450)]
+        [Index(IndexTypes.NonClustered, Name = "IX_cmsDictionary_key")]
         public string Key { get; set; }
 
         [ResultColumn]

src/Umbraco.Core/Models/Rdbms/User2UserGroupDto.cs

@@ -0,0 +1,19 @@
+using Umbraco.Core.Persistence;
+using Umbraco.Core.Persistence.DatabaseAnnotations;
+
+namespace Umbraco.Core.Models.Rdbms
+{
+    [TableName("umbracoUser2UserGroup")]
+    [ExplicitColumns]
+    internal class User2UserGroupDto
+    {
+        [Column("userId")]
+        [PrimaryKeyColumn(AutoIncrement = false, Name = "PK_user2userGroup", OnColumns = "userId, userGroupId")]
+        [ForeignKey(typeof(UserDto))]
+        public int UserId { get; set; }
+
+        [Column("userGroupId")]
+        [ForeignKey(typeof(UserGroupDto))]
+        public int UserGroupId { get; set; }
+    }
+}

src/Umbraco.Core/Models/Rdbms/UserDto.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using Umbraco.Core.Persistence;
 using Umbraco.Core.Persistence.DatabaseAnnotations;
+using Umbraco.Core.Persistence.DatabaseModelDefinitions;
 
 namespace Umbraco.Core.Models.Rdbms
 {
@@ -10,6 +11,12 @@ namespace Umbraco.Core.Models.Rdbms
     [ExplicitColumns]
     internal class UserDto
     {
+        public UserDto()
+        {
+            UserGroupDtos = new List<UserGroupDto>();
+            UserStartNodeDtos = new HashSet<UserStartNodeDto>();
+        }
+
         [Column("id")]
         [PrimaryKeyColumn(Name = "PK_user")]
         public int Id { get; set; }
@@ -21,18 +28,7 @@ namespace Umbraco.Core.Models.Rdbms
         [Column("userNoConsole")]
         [Constraint(Default = "0")]
         public bool NoConsole { get; set; }
-
-        [Column("userType")]
-        [ForeignKey(typeof(UserTypeDto))]
-        public short Type { get; set; }
-
-        [Column("startStructureID")]
-        public int ContentStartId { get; set; }
-
-        [Column("startMediaID")]
-        [NullSetting(NullSetting = NullSettings.Null)]
-        public int? MediaStartId { get; set; }
-
+        
         [Column("userName")]
         public string UserName { get; set; }
 
@@ -44,6 +40,14 @@ namespace Umbraco.Core.Models.Rdbms
         [Column("userPassword")]
         [Length(500)]
         public string Password { get; set; }
+
+        /// <summary>
+        /// This will represent a JSON structure of how the password has been created (i.e hash algorithm, iterations)
+        /// </summary>
+        [Column("passwordConfig")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        [Length(500)]
+        public string PasswordConfig { get; set; }
 
         [Column("userEmail")]
         public string Email { get; set; }
@@ -73,8 +77,36 @@ namespace Umbraco.Core.Models.Rdbms
         [Column("lastLoginDate")]
         [NullSetting(NullSetting = NullSettings.Null)]
         public DateTime? LastLoginDate { get; set; }
-        
+
+        [Column("emailConfirmedDate")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public DateTime? EmailConfirmedDate { get; set; }
+
+        [Column("invitedDate")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public DateTime? InvitedDate { get; set; }
+
+        [Column("createDate")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [Constraint(Default = SystemMethods.CurrentDateTime)]
+        public DateTime CreateDate { get; set; }
+
+        [Column("updateDate")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [Constraint(Default = SystemMethods.CurrentDateTime)]
+        public DateTime UpdateDate { get; set; }
+
+        /// <summary>
+        /// Will hold the media file system relative path of the users custom avatar if they uploaded one
+        /// </summary>
+        [Column("avatar")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public string Avatar { get; set; }
+
         [ResultColumn]
-        public List<User2AppDto> User2AppDtos { get; set; }
+        public List<UserGroupDto> UserGroupDtos { get; set; }
+
+        [ResultColumn]
+        public HashSet<UserStartNodeDto> UserStartNodeDtos { get; set; }
     }
 }

src/Umbraco.Core/Models/Rdbms/UserGroup2AppDto.cs

@@ -1,20 +1,19 @@
-using Umbraco.Core.Persistence;
-using Umbraco.Core.Persistence.DatabaseAnnotations;
-
-namespace Umbraco.Core.Models.Rdbms
-{
-    [TableName("umbracoUser2app")]
-    [PrimaryKey("user", autoIncrement = false)]
-    [ExplicitColumns]
-    internal class User2AppDto
-    {
-        [Column("user")]
-        [PrimaryKeyColumn(AutoIncrement = false, Name = "PK_user2app", OnColumns = "user, app")]
-        [ForeignKey(typeof(UserDto))]
-        public int UserId { get; set; }
-
-        [Column("app")]
-        [Length(50)]
-        public string AppAlias { get; set; }
-    }
+using Umbraco.Core.Persistence;
+using Umbraco.Core.Persistence.DatabaseAnnotations;
+
+namespace Umbraco.Core.Models.Rdbms
+{
+    [TableName("umbracoUserGroup2App")]
+    [ExplicitColumns]
+    internal class UserGroup2AppDto
+    {
+        [Column("userGroupId")]
+        [PrimaryKeyColumn(AutoIncrement = false, Name = "PK_userGroup2App", OnColumns = "userGroupId, app")]
+        [ForeignKey(typeof(UserGroupDto))]
+        public int UserGroupId { get; set; }
+
+        [Column("app")]
+        [Length(50)]
+        public string AppAlias { get; set; }
+    }
 }

src/Umbraco.Core/Models/Rdbms/UserGroup2NodePermissionDto.cs

@@ -3,15 +3,14 @@ using Umbraco.Core.Persistence.DatabaseAnnotations;
 
 namespace Umbraco.Core.Models.Rdbms
 {
-    [TableName("umbracoUser2NodePermission")]
-    [PrimaryKey("userId", autoIncrement = false)]
+    [TableName("umbracoUserGroup2NodePermission")]
     [ExplicitColumns]
-    internal class User2NodePermissionDto
+    internal class UserGroup2NodePermissionDto
     {
-        [Column("userId")]
-        [PrimaryKeyColumn(AutoIncrement = false, Name = "PK_umbracoUser2NodePermission", OnColumns = "userId, nodeId, permission")]
-        [ForeignKey(typeof(UserDto))]
-        public int UserId { get; set; }
+        [Column("userGroupId")]
+        [PrimaryKeyColumn(AutoIncrement = false, Name = "PK_umbracoUserGroup2NodePermission", OnColumns = "userGroupId, nodeId, permission")]
+        [ForeignKey(typeof(UserGroupDto))]
+        public int UserGroupId { get; set; }
 
         [Column("nodeId")]
         [ForeignKey(typeof(NodeDto))]

src/Umbraco.Core/Models/Rdbms/UserGroupDto.cs

@@ -0,0 +1,69 @@
+using System;
+using System.Collections.Generic;
+using Umbraco.Core.Persistence;
+using Umbraco.Core.Persistence.DatabaseAnnotations;
+using Umbraco.Core.Persistence.DatabaseModelDefinitions;
+
+namespace Umbraco.Core.Models.Rdbms
+{
+    [TableName("umbracoUserGroup")]
+    [PrimaryKey("id")]
+    [ExplicitColumns]
+    internal class UserGroupDto
+    {
+        public UserGroupDto()
+        {
+            UserGroup2AppDtos = new List<UserGroup2AppDto>();
+        }
+
+        [Column("id")]
+        [PrimaryKeyColumn(IdentitySeed = 5)]
+        public int Id { get; set; }
+
+        [Column("userGroupAlias")]
+        [Length(200)]
+        [Index(IndexTypes.UniqueNonClustered, Name = "IX_umbracoUserGroup_userGroupAlias")]
+        public string Alias { get; set; }
+
+        [Column("userGroupName")]
+        [Length(200)]
+        [Index(IndexTypes.UniqueNonClustered, Name = "IX_umbracoUserGroup_userGroupName")]
+        public string Name { get; set; }
+
+        [Column("userGroupDefaultPermissions")]
+        [Length(50)]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public string DefaultPermissions { get; set; }
+
+        [Column("createDate")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [Constraint(Default = SystemMethods.CurrentDateTime)]
+        public DateTime CreateDate { get; set; }
+
+        [Column("updateDate")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [Constraint(Default = SystemMethods.CurrentDateTime)]
+        public DateTime UpdateDate { get; set; }
+
+        [Column("icon")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public string Icon { get; set; }
+
+        [Column("startContentId")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public int? StartContentId { get; set; }
+
+        [Column("startMediaId")]
+        [NullSetting(NullSetting = NullSettings.Null)]
+        public int? StartMediaId { get; set; }
+
+        [ResultColumn]
+        public List<UserGroup2AppDto> UserGroup2AppDtos { get; set; }
+
+        /// <summary>
+        /// This is only relevant when this column is included in the results (i.e. GetUserGroupsWithUserCounts)
+        /// </summary>
+        [ResultColumn]
+        public int UserCount { get; set; }
+    }
+}

src/Umbraco.Core/Models/Rdbms/UserStartNodeDto.cs

@@ -0,0 +1,67 @@
+using System;
+using Umbraco.Core.Persistence;
+using Umbraco.Core.Persistence.DatabaseAnnotations;
+
+namespace Umbraco.Core.Models.Rdbms
+{
+    [TableName("umbracoUserStartNode")]
+    [PrimaryKey("id", autoIncrement = true)]
+    [ExplicitColumns]
+    internal class UserStartNodeDto : IEquatable<UserStartNodeDto>
+    {
+        [Column("id")]
+        [PrimaryKeyColumn(Name = "PK_userStartNode")]
+        public int Id { get; set; }
+
+        [Column("userId")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [ForeignKey(typeof(UserDto))]
+        public int UserId { get; set; }
+
+        [Column("startNode")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [ForeignKey(typeof(NodeDto))]
+        public int StartNode { get; set; }
+
+        [Column("startNodeType")]
+        [NullSetting(NullSetting = NullSettings.NotNull)]
+        [Index(IndexTypes.UniqueNonClustered, ForColumns = "startNodeType, startNode, userId", Name = "IX_umbracoUserStartNode_startNodeType")]
+        public int StartNodeType { get; set; }
+
+        public enum StartNodeTypeValue
+        {
+            Content = 1,
+            Media = 2
+        }
+
+        public bool Equals(UserStartNodeDto other)
+        {
+            if (ReferenceEquals(null, other)) return false;
+            if (ReferenceEquals(this, other)) return true;
+            return Id == other.Id;
+        }
+
+        public override bool Equals(object obj)
+        {
+            if (ReferenceEquals(null, obj)) return false;
+            if (ReferenceEquals(this, obj)) return true;
+            if (obj.GetType() != this.GetType()) return false;
+            return Equals((UserStartNodeDto) obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return Id;
+        }
+
+        public static bool operator ==(UserStartNodeDto left, UserStartNodeDto right)
+        {
+            return Equals(left, right);
+        }
+
+        public static bool operator !=(UserStartNodeDto left, UserStartNodeDto right)
+        {
+            return !Equals(left, right);
+        }
+    }
+}

src/Umbraco.Core/Models/Rdbms/UserTypeDto.cs

@@ -1,8 +1,10 @@
-using Umbraco.Core.Persistence;
+using System;
+using Umbraco.Core.Persistence;
 using Umbraco.Core.Persistence.DatabaseAnnotations;
 
 namespace Umbraco.Core.Models.Rdbms
 {
+    [Obsolete("Table no longer exists as of 7.6 - retained only to support migrations from previous versions")]
     [TableName("umbracoUserType")]
     [PrimaryKey("id")]
     [ExplicitColumns]

src/Umbraco.Core/Models/UmbracoObjectTypes.cs

@@ -185,6 +185,14 @@ namespace Umbraco.Core.Models
         /// </summary>
         [UmbracoObjectType(Constants.ObjectTypes.Language)]
         [FriendlyName("Language")]
-        Language
+        Language,
+
+        /// <summary>
+        /// Document
+        /// </summary>
+        [UmbracoObjectType(Constants.ObjectTypes.DocumentBlueprint, typeof(IContent))]
+        [FriendlyName("DocumentBlueprint")]
+        [UmbracoUdiType(Constants.UdiEntityType.DocumentBluePrint)]
+        DocumentBlueprint
     }
 }

src/Umbraco.Core/Models/UmbracoObjectTypesExtensions.cs

@@ -68,15 +68,14 @@ namespace Umbraco.Core.Models
         {
             return UmbracoObjectTypeCache.GetOrAdd(umbracoObjectType, types =>
                 {
-                    var type = typeof(UmbracoObjectTypes);
-                    var memInfo = type.GetMember(umbracoObjectType.ToString());
-                    var attributes = memInfo[0].GetCustomAttributes(typeof(UmbracoObjectTypeAttribute),
-                        false);
+                    var type = typeof (UmbracoObjectTypes);
+                    var memberInfo = type.GetMember(umbracoObjectType.ToString());
+                    var attributes = memberInfo[0].GetCustomAttributes(typeof (UmbracoObjectTypeAttribute), false);
 
                     if (attributes.Length == 0)
                         return Guid.Empty;
 
-                    var attribute = ((UmbracoObjectTypeAttribute)attributes[0]);
+                    var attribute = (UmbracoObjectTypeAttribute) attributes[0];
                     if (attribute == null)
                         return Guid.Empty;
 

src/Umbraco.Core/Models/UserExtensions.cs

@@ -1,5 +1,11 @@
 using System;
+using System.Collections.Generic;
 using System.Globalization;
+using System.Linq;
+using System.Net;
+using Umbraco.Core.Cache;
+using Umbraco.Core.IO;
+using Umbraco.Core.Models.Identity;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Services;
 
@@ -7,12 +13,81 @@ namespace Umbraco.Core.Models
 {
     public static class UserExtensions
     {
+        /// <summary>
+        /// Tries to lookup the user's gravatar to see if the endpoint can be reached, if so it returns the valid URL
+        /// </summary>
+        /// <param name="user"></param>
+        /// <param name="userService"></param>
+        /// <param name="staticCache"></param>
+        /// <returns>
+        /// A list of 5 different sized avatar URLs
+        /// </returns>
+        internal static string[] GetCurrentUserAvatarUrls(this IUser user, IUserService userService, ICacheProvider staticCache)
+        {
+            //check if the user has explicitly removed all avatars including a gravatar, this will be possible and the value will be "none"
+            if (user.Avatar == "none")
+            {
+                return new string[0];
+            }
+
+            if (user.Avatar.IsNullOrWhiteSpace())
+            {
+                var gravatarHash = user.Email.ToMd5();
+                var gravatarUrl = "https://www.gravatar.com/avatar/" + gravatarHash + "?d=404";
+
+                //try gravatar
+                var gravatarAccess = staticCache.GetCacheItem<bool>("UserAvatar" + user.Id, () =>
+                {
+                    // Test if we can reach this URL, will fail when there's network or firewall errors
+                    var request = (HttpWebRequest)WebRequest.Create(gravatarUrl);
+                    // Require response within 10 seconds
+                    request.Timeout = 10000;
+                    try
+                    {
+                        using ((HttpWebResponse)request.GetResponse()) { }
+                    }
+                    catch (Exception)
+                    {
+                        // There was an HTTP or other error, return an null instead
+                        return false;
+                    }
+                    return true;
+                });
+
+                if (gravatarAccess)
+                {
+                    return new[]
+                    {
+                        gravatarUrl  + "&s=30",
+                        gravatarUrl  + "&s=60",
+                        gravatarUrl  + "&s=90",
+                        gravatarUrl  + "&s=150",
+                        gravatarUrl  + "&s=300"
+                    };
+                }
+
+                return new string[0];
+            }
+
+            //use the custom avatar
+            var avatarUrl = FileSystemProviderManager.Current.MediaFileSystem.GetUrl(user.Avatar);
+            return new[]
+            {
+                avatarUrl  + "?width=30&height=30&mode=crop",
+                avatarUrl  + "?width=60&height=60&mode=crop",
+                avatarUrl  + "?width=90&height=90&mode=crop",
+                avatarUrl  + "?width=150&height=150&mode=crop",
+                avatarUrl  + "?width=300&height=300&mode=crop"
+            };
+
+        }
+
         /// <summary>
         /// Returns the culture info associated with this user, based on the language they're assigned to in the back office
         /// </summary>
         /// <param name="user"></param>
         /// <param name="textService"></param>
-        /// <returns></returns>      
+        /// <returns></returns>
         public static CultureInfo GetUserCulture(this IUser user, ILocalizedTextService textService)
         {
             if (user == null) throw new ArgumentNullException("user");
@@ -25,7 +100,7 @@ namespace Umbraco.Core.Models
             try
             {
                 var culture = CultureInfo.GetCultureInfo(userLanguage.Replace("_", "-"));
-                //TODO: This is a hack because we store the user language as 2 chars instead of the full culture 
+                //TODO: This is a hack because we store the user language as 2 chars instead of the full culture
                 // which is actually stored in the language files (which are also named with 2 chars!) so we need to attempt
                 // to convert to a supported full culture
                 var result = textService.ConvertToSupportedCultureWithRegionCode(culture);
@@ -38,50 +113,59 @@ namespace Umbraco.Core.Models
             }
         }
 
-        /// <summary>
-        /// Checks if the user has access to the content item based on their start noe
-        /// </summary>
-        /// <param name="user"></param>
-        /// <param name="content"></param>
-        /// <returns></returns>
-        internal static bool HasPathAccess(this IUser user, IContent content)
+        internal static bool HasContentRootAccess(this IUser user, IEntityService entityService)
         {
-            if (user == null) throw new ArgumentNullException("user");
-            if (content == null) throw new ArgumentNullException("content");
-            return HasPathAccess(content.Path, user.StartContentId, Constants.System.RecycleBinContent);
+            return HasPathAccess(Constants.System.Root.ToInvariantString(), user.CalculateContentStartNodeIds(entityService), Constants.System.RecycleBinContent);
         }
 
-        internal static bool HasPathAccess(string path, int startNodeId, int recycleBinId)
+        internal static bool HasContentBinAccess(this IUser user, IEntityService entityService)
         {
-            Mandate.ParameterNotNullOrEmpty(path, "path");
+            return HasPathAccess(Constants.System.RecycleBinContent.ToInvariantString(), user.CalculateContentStartNodeIds(entityService), Constants.System.RecycleBinContent);
+        }
+
+        internal static bool HasMediaRootAccess(this IUser user, IEntityService entityService)
+        {
+            return HasPathAccess(Constants.System.Root.ToInvariantString(), user.CalculateMediaStartNodeIds(entityService), Constants.System.RecycleBinMedia);
+        }
+
+        internal static bool HasMediaBinAccess(this IUser user, IEntityService entityService)
+        {
+            return HasPathAccess(Constants.System.RecycleBinMedia.ToInvariantString(), user.CalculateMediaStartNodeIds(entityService), Constants.System.RecycleBinMedia);
+        }
+
+        internal static bool HasPathAccess(this IUser user, IContent content, IEntityService entityService)
+        {
+            return HasPathAccess(content.Path, user.CalculateContentStartNodeIds(entityService), Constants.System.RecycleBinContent);
+        }
+
+        internal static bool HasPathAccess(this IUser user, IMedia media, IEntityService entityService)
+        {
+            return HasPathAccess(media.Path, user.CalculateMediaStartNodeIds(entityService), Constants.System.RecycleBinMedia);
+        }
+
+        internal static bool HasPathAccess(string path, int[] startNodeIds, int recycleBinId)
+        {
+            if (string.IsNullOrWhiteSpace(path)) throw new ArgumentException("Value cannot be null or whitespace.", "path");
+
+            // check for no access
+            if (startNodeIds.Length == 0)
+                return false;
+
+            // check for root access
+            if (startNodeIds.Contains(Constants.System.Root))
+                return true;
 
             var formattedPath = "," + path + ",";
-            var formattedStartNodeId = "," + startNodeId.ToInvariantString() + ",";
-            var formattedRecycleBinId = "," + recycleBinId.ToInvariantString() + ",";
 
-            //only users with root access have access to the recycle bin
-            if (formattedPath.Contains(formattedRecycleBinId))
-            {
-                return startNodeId == Constants.System.Root;
-            }
+            // only users with root access have access to the recycle bin,
+            // if the above check didn't pass then access is denied
+            if (formattedPath.Contains("," + recycleBinId + ","))
+                return false;
 
-            return formattedPath.Contains(formattedStartNodeId);
+            // check for a start node in the path
+            return startNodeIds.Any(x => formattedPath.Contains("," + x + ","));
         }
 
-        /// <summary>
-        /// Checks if the user has access to the media item based on their start noe
-        /// </summary>
-        /// <param name="user"></param>
-        /// <param name="media"></param>
-        /// <returns></returns>
-        internal static bool HasPathAccess(this IUser user, IMedia media)
-        {
-            if (user == null) throw new ArgumentNullException("user");
-            if (media == null) throw new ArgumentNullException("media");
-            return HasPathAccess(media.Path, user.StartMediaId, Constants.System.RecycleBinMedia);
-        }
-
-
         /// <summary>
         /// Determines whether this user is an admin.
         /// </summary>
@@ -92,7 +176,133 @@ namespace Umbraco.Core.Models
         public static bool IsAdmin(this IUser user)
         {
             if (user == null) throw new ArgumentNullException("user");
-            return user.UserType.Alias == "admin";
+            return user.Groups != null && user.Groups.Any(x => x.Alias == Constants.Security.AdminGroupAlias);
+        }
+
+        // calc. start nodes, combining groups' and user's, and excluding what's in the bin
+        public static int[] CalculateContentStartNodeIds(this IUser user, IEntityService entityService)
+        {
+            const string cacheKey = "AllContentStartNodes";
+            //try to look them up from cache so we don't recalculate
+            var valuesInUserCache = FromUserCache(user, cacheKey);
+            if (valuesInUserCache != null) return valuesInUserCache;
+
+            var gsn = user.Groups.Where(x => x.StartContentId.HasValue).Select(x => x.StartContentId.Value).Distinct().ToArray();
+            var usn = user.StartContentIds;
+            var vals = CombineStartNodes(UmbracoObjectTypes.Document, gsn, usn, entityService);
+            ToUserCache(user, cacheKey, vals);
+            return vals;
+        }
+
+        // calc. start nodes, combining groups' and user's, and excluding what's in the bin
+        public static int[] CalculateMediaStartNodeIds(this IUser user, IEntityService entityService)
+        {
+            const string cacheKey = "AllMediaStartNodes";
+            //try to look them up from cache so we don't recalculate
+            var valuesInUserCache = FromUserCache(user, cacheKey);
+            if (valuesInUserCache != null) return valuesInUserCache;
+
+            var gsn = user.Groups.Where(x => x.StartMediaId.HasValue).Select(x => x.StartMediaId.Value).Distinct().ToArray();
+            var usn = user.StartMediaIds;
+            var vals = CombineStartNodes(UmbracoObjectTypes.Media, gsn, usn, entityService);
+            ToUserCache(user, cacheKey, vals);
+            return vals;
+        }
+
+        private static int[] FromUserCache(IUser user, string cacheKey)
+        {
+            var entityUser = user as User;
+            if (entityUser == null) return null;
+
+            lock (entityUser.AdditionalDataLock)
+            {
+                object allContentStartNodes;
+                return entityUser.AdditionalData.TryGetValue(cacheKey, out allContentStartNodes)
+                    ? allContentStartNodes as int[]
+                    : null;
+            }
+        }
+
+        private static void ToUserCache(IUser user, string cacheKey, int[] vals)
+        {
+            var entityUser = user as User;
+            if (entityUser == null) return;
+
+            lock (entityUser.AdditionalDataLock)
+            {
+                entityUser.AdditionalData[cacheKey] = vals;
+            }
+        }
+
+        private static bool StartsWithPath(string test, string path)
+        {
+            return test.StartsWith(path) && test.Length > path.Length && test[path.Length] == ',';
+        }
+
+        private static string GetBinPath(UmbracoObjectTypes objectType)
+        {
+            var binPath = Constants.System.Root + ",";
+            switch (objectType)
+            {
+                case UmbracoObjectTypes.Document:
+                    binPath += Constants.System.RecycleBinContent;
+                    break;
+                case UmbracoObjectTypes.Media:
+                    binPath += Constants.System.RecycleBinMedia;
+                    break;
+                default:
+                    throw new ArgumentOutOfRangeException("objectType");
+            }
+            return binPath;
+        }
+
+        internal static int[] CombineStartNodes(UmbracoObjectTypes objectType, int[] groupSn, int[] userSn, IEntityService entityService)
+        {
+            // assume groupSn and userSn each don't contain duplicates
+
+            var asn = groupSn.Concat(userSn).Distinct().ToArray();
+            var paths = entityService.GetAllPaths(objectType, asn).ToDictionary(x => x.Id, x => x.Path);
+
+            paths[Constants.System.Root] = Constants.System.Root.ToString(); // entityService does not get that one
+
+            var binPath = GetBinPath(objectType);
+
+            var lsn = new List<int>();
+            foreach (var sn in groupSn)
+            {
+                string snp;
+                if (paths.TryGetValue(sn, out snp) == false) continue; // ignore rogue node (no path)
+
+                if (StartsWithPath(snp, binPath)) continue; // ignore bin
+
+                if (lsn.Any(x => StartsWithPath(snp, paths[x]))) continue; // skip if something above this sn
+                lsn.RemoveAll(x => StartsWithPath(paths[x], snp)); // remove anything below this sn
+                lsn.Add(sn);
+            }
+
+            var usn = new List<int>();
+            foreach (var sn in userSn)
+            {
+                if (groupSn.Contains(sn)) continue; // ignore, already there
+
+                string snp;
+                if (paths.TryGetValue(sn, out snp) == false) continue; // ignore rogue node (no path)
+
+                if (StartsWithPath(snp, binPath)) continue; // ignore bin
+
+                if (usn.Any(x => StartsWithPath(paths[x], snp))) continue; // skip if something below this sn
+                usn.RemoveAll(x => StartsWithPath(snp, paths[x])); // remove anything above this sn
+                usn.Add(sn);
+            }
+
+            foreach (var sn in usn)
+            {
+                var snp = paths[sn]; // has to be here now
+                lsn.RemoveAll(x => StartsWithPath(snp, paths[x]) || StartsWithPath(paths[x], snp)); // remove anything above or below this sn
+                lsn.Add(sn);
+            }
+
+            return lsn.ToArray();
         }
     }
 }

src/Umbraco.Core/Persistence/Factories/UmbracoEntityFactory.cs

@@ -36,7 +36,7 @@ namespace Umbraco.Core.Persistence.Factories
                 entity.DisableChangeTracking();
 
                 entity.CreateDate = d.createDate;
-                entity.CreatorId = d.nodeUser;
+                entity.CreatorId = d.nodeUser == null ? 0 : d.nodeUser;
                 entity.Id = d.id;
                 entity.Key = d.uniqueID;
                 entity.Level = d.level;

src/Umbraco.Core/Persistence/Factories/UserFactory.cs

@@ -7,47 +7,35 @@ using Umbraco.Core.Models.Rdbms;
 
 namespace Umbraco.Core.Persistence.Factories
 {
-    internal class UserFactory 
+    internal static class UserFactory 
     {
-        private readonly IUserType _userType;
-
-        public UserFactory(IUserType userType)
+        public static IUser BuildEntity(UserDto dto)
         {
-            _userType = userType;
-        }
-
-        #region Implementation of IEntityFactory<IUser,UserDto>
-
-        public IUser BuildEntity(UserDto dto)
-        {
-            var guidId = dto.Id.ToGuid();
-            var user = new User(_userType);
+            var guidId = dto.Id.ToGuid();
+            
+            var user = new User(dto.Id, dto.UserName, dto.Email, dto.Login,dto.Password, 
+                dto.UserGroupDtos.Select(x => x.ToReadOnlyGroup()).ToArray(),
+                dto.UserStartNodeDtos.Where(x => x.StartNodeType == (int)UserStartNodeDto.StartNodeTypeValue.Content).Select(x => x.StartNode).ToArray(),
+                dto.UserStartNodeDtos.Where(x => x.StartNodeType == (int)UserStartNodeDto.StartNodeTypeValue.Media).Select(x => x.StartNode).ToArray());
 
             try
             {
                 user.DisableChangeTracking();
-
-                user.Id = dto.Id;
+                
                 user.Key = guidId;
-                user.StartContentId = dto.ContentStartId;
-                user.StartMediaId = dto.MediaStartId.HasValue ? dto.MediaStartId.Value : -1;
-                user.RawPasswordValue = dto.Password;
-                user.Username = dto.Login;
-                user.Name = dto.UserName;
                 user.IsLockedOut = dto.NoConsole;
                 user.IsApproved = dto.Disabled == false;
-                user.Email = dto.Email;
                 user.Language = dto.UserLanguage;
                 user.SecurityStamp = dto.SecurityStampToken;
                 user.FailedPasswordAttempts = dto.FailedLoginAttempts ?? 0;
                 user.LastLockoutDate = dto.LastLockoutDate ?? DateTime.MinValue;
                 user.LastLoginDate = dto.LastLoginDate ?? DateTime.MinValue;
                 user.LastPasswordChangeDate = dto.LastPasswordChangeDate ?? DateTime.MinValue;
-
-                foreach (var app in dto.User2AppDtos)
-                {
-                    user.AddAllowedSection(app.AppAlias);
-                }
+                user.CreateDate = dto.CreateDate;
+                user.UpdateDate = dto.UpdateDate;
+                user.Avatar = dto.Avatar;
+                user.EmailConfirmedDate = dto.EmailConfirmedDate;
+                user.InvitedDate = dto.InvitedDate;
 
                 //on initial construction we don't want to have dirty properties tracked
                 // http://issues.umbraco.org/issue/U4-1946
@@ -61,48 +49,55 @@ namespace Umbraco.Core.Persistence.Factories
             }
         }
 
-        public UserDto BuildDto(IUser entity)
+        public static UserDto BuildDto(IUser entity)
         {
             var dto = new UserDto
-                          {
-                              ContentStartId = entity.StartContentId,
-                              MediaStartId = entity.StartMediaId,
-                              Disabled = entity.IsApproved == false,
-                              Email = entity.Email,
-                              Login = entity.Username,
-                              NoConsole = entity.IsLockedOut,
-                              Password = entity.RawPasswordValue,
-                              UserLanguage = entity.Language,
-                              UserName = entity.Name,
-                              Type = short.Parse(entity.UserType.Id.ToString(CultureInfo.InvariantCulture)),
-                              User2AppDtos = new List<User2AppDto>(),
-                              SecurityStampToken = entity.SecurityStamp,
-                              FailedLoginAttempts = entity.FailedPasswordAttempts,
-                              LastLockoutDate = entity.LastLockoutDate == DateTime.MinValue ? (DateTime?)null : entity.LastLockoutDate,
-                              LastLoginDate = entity.LastLoginDate == DateTime.MinValue ? (DateTime?)null : entity.LastLoginDate,
-                              LastPasswordChangeDate = entity.LastPasswordChangeDate == DateTime.MinValue ? (DateTime?)null : entity.LastPasswordChangeDate,
-                          };
+            {                
+                Disabled = entity.IsApproved == false,
+                Email = entity.Email,
+                Login = entity.Username,
+                NoConsole = entity.IsLockedOut,
+                Password = entity.RawPasswordValue,
+                UserLanguage = entity.Language,
+                UserName = entity.Name,
+                SecurityStampToken = entity.SecurityStamp,
+                FailedLoginAttempts = entity.FailedPasswordAttempts,
+                LastLockoutDate = entity.LastLockoutDate == DateTime.MinValue ? (DateTime?)null : entity.LastLockoutDate,
+                LastLoginDate = entity.LastLoginDate == DateTime.MinValue ? (DateTime?)null : entity.LastLoginDate,
+                LastPasswordChangeDate = entity.LastPasswordChangeDate == DateTime.MinValue ? (DateTime?)null : entity.LastPasswordChangeDate,
+                CreateDate = entity.CreateDate,
+                UpdateDate = entity.UpdateDate,
+                Avatar = entity.Avatar,
+                EmailConfirmedDate = entity.EmailConfirmedDate,
+                InvitedDate = entity.InvitedDate
+            };
 
-            foreach (var app in entity.AllowedSections)
+            foreach (var startNodeId in entity.StartContentIds)
             {
-                var appDto = new User2AppDto
-                    {
-                        AppAlias = app
-                    };
-                if (entity.HasIdentity)
+                dto.UserStartNodeDtos.Add(new UserStartNodeDto
                 {
-                    appDto.UserId = (int) entity.Id;
-                }
+                    StartNode = startNodeId,
+                    StartNodeType = (int)UserStartNodeDto.StartNodeTypeValue.Content,
+                    UserId = entity.Id
+                });
+            }
 
-                dto.User2AppDtos.Add(appDto);
+            foreach (var startNodeId in entity.StartMediaIds)
+            {
+                dto.UserStartNodeDtos.Add(new UserStartNodeDto
+                {
+                    StartNode = startNodeId,
+                    StartNodeType = (int)UserStartNodeDto.StartNodeTypeValue.Media,
+                    UserId = entity.Id
+                });
             }
 
             if (entity.HasIdentity)
+            {
                 dto.Id = entity.Id.SafeCast<int>();
+            }
 
             return dto;
-        }
-
-        #endregion
+        }        
     }
 }

src/Umbraco.Core/Persistence/Factories/UserGroupFactory.cs

@@ -0,0 +1,80 @@
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Models.Rdbms;
+
+namespace Umbraco.Core.Persistence.Factories
+{
+    internal static class UserGroupFactory
+    {
+        public static IUserGroup BuildEntity(UserGroupDto dto)
+        {
+            var userGroup = new UserGroup(dto.UserCount, dto.Alias, dto.Name,
+                dto.DefaultPermissions.IsNullOrWhiteSpace()
+                    ? Enumerable.Empty<string>()
+                    : dto.DefaultPermissions.ToCharArray().Select(x => x.ToString(CultureInfo.InvariantCulture)).ToList(),
+                dto.Icon);
+
+            try
+            {
+                userGroup.DisableChangeTracking();
+                userGroup.Id = dto.Id;                
+                userGroup.CreateDate = dto.CreateDate;
+                userGroup.UpdateDate = dto.UpdateDate;                
+                userGroup.StartContentId = dto.StartContentId;                
+                userGroup.StartMediaId = dto.StartMediaId;                
+                if (dto.UserGroup2AppDtos != null)
+                {
+                    foreach (var app in dto.UserGroup2AppDtos)
+                    {
+                        userGroup.AddAllowedSection(app.AppAlias);
+                    }
+                }
+
+                userGroup.ResetDirtyProperties(false);
+                return userGroup;
+            }
+            finally
+            {
+                userGroup.EnableChangeTracking();
+            }
+        }
+
+        public static UserGroupDto BuildDto(IUserGroup entity)
+        {
+            var dto = new UserGroupDto
+            {
+                Alias = entity.Alias,
+                DefaultPermissions = entity.Permissions == null ? "" : string.Join("", entity.Permissions),
+                Name = entity.Name,
+                UserGroup2AppDtos = new List<UserGroup2AppDto>(),
+                CreateDate = entity.CreateDate,
+                UpdateDate = entity.UpdateDate,
+                Icon = entity.Icon,
+                StartMediaId = entity.StartMediaId,
+                StartContentId = entity.StartContentId
+            };
+
+            foreach (var app in entity.AllowedSections)
+            {
+                var appDto = new UserGroup2AppDto
+                {
+                    AppAlias = app
+                };
+                if (entity.HasIdentity)
+                {
+                    appDto.UserGroupId = entity.Id;
+                }
+
+                dto.UserGroup2AppDtos.Add(appDto);
+            }
+
+            if (entity.HasIdentity)
+                dto.Id = short.Parse(entity.Id.ToString());
+
+            return dto;
+        }
+
+    }
+}

src/Umbraco.Core/Persistence/Factories/UserSectionFactory.cs

@@ -1,35 +0,0 @@
-using System.Collections.Generic;
-using System.Linq;
-using AutoMapper;
-using Umbraco.Core.Models;
-using Umbraco.Core.Models.Membership;
-using Umbraco.Core.Models.Rdbms;
-
-namespace Umbraco.Core.Persistence.Factories
-{
-    internal class UserSectionFactory 
-    {
-        private readonly IUser _user;
-
-        public UserSectionFactory(IUser user)
-        {
-            _user = user;
-        }
-
-        public IEnumerable<string> BuildEntity(IEnumerable<User2AppDto> dto)
-        {
-            return dto.Select(x => x.AppAlias);
-        }
-
-        public IEnumerable<User2AppDto> BuildDto(IEnumerable<string> entity)
-        {
-            return entity.Select(x => new User2AppDto
-                {
-                    //NOTE: We're force casting to int here! this might not work in the future
-                    UserId = (int)_user.Id,
-                    AppAlias = x
-                });
-        }
-
-    }
-}

src/Umbraco.Core/Persistence/Factories/UserTypeFactory.cs

@@ -1,54 +0,0 @@
-using System.Globalization;
-using System.Linq;
-using Umbraco.Core.Models.Membership;
-using Umbraco.Core.Models.Rdbms;
-
-namespace Umbraco.Core.Persistence.Factories
-{
-    internal class UserTypeFactory
-    {
-        #region Implementation of IEntityFactory<IUserType,UserTypeDto>
-
-        public IUserType BuildEntity(UserTypeDto dto)
-        {
-            var userType = new UserType();
-
-            try
-            {
-                userType.DisableChangeTracking();
-
-                userType.Alias = dto.Alias;
-                userType.Id = dto.Id;
-                userType.Name = dto.Name;
-                userType.Permissions = dto.DefaultPermissions.IsNullOrWhiteSpace()
-                    ? Enumerable.Empty<string>()
-                    : dto.DefaultPermissions.ToCharArray().Select(x => x.ToString(CultureInfo.InvariantCulture));
-                //on initial construction we don't want to have dirty properties tracked
-                // http://issues.umbraco.org/issue/U4-1946
-                userType.ResetDirtyProperties(false);
-                return userType;
-            }
-            finally
-            {
-                userType.EnableChangeTracking();
-            }
-        }
-
-        public UserTypeDto BuildDto(IUserType entity)
-        {
-            var userType = new UserTypeDto
-                               {
-                                   Alias = entity.Alias,
-                                   DefaultPermissions = entity.Permissions == null ? "" : string.Join("", entity.Permissions),
-                                   Name = entity.Name
-                               };
-
-            if(entity.HasIdentity)
-                userType.Id = short.Parse(entity.Id.ToString());
-
-            return userType;
-        }
-
-        #endregion
-    }
-}

src/Umbraco.Core/Persistence/Mappers/ExternalLoginMapper.cs

@@ -0,0 +1,35 @@
+using System.Collections.Concurrent;
+using Umbraco.Core.Models.Identity;
+using Umbraco.Core.Models.Rdbms;
+
+namespace Umbraco.Core.Persistence.Mappers
+{
+    [MapperFor(typeof(IIdentityUserLogin))]
+    [MapperFor(typeof(IdentityUserLogin))]
+    public sealed class ExternalLoginMapper : BaseMapper
+    {
+        private static readonly ConcurrentDictionary<string, DtoMapModel> PropertyInfoCacheInstance = new ConcurrentDictionary<string, DtoMapModel>();
+        public ExternalLoginMapper()
+        {
+            BuildMap();
+        }
+
+        #region Overrides of BaseMapper
+
+        internal override ConcurrentDictionary<string, DtoMapModel> PropertyInfoCache
+        {
+            get { return PropertyInfoCacheInstance; }
+        }
+
+        internal override void BuildMap()
+        {
+            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.Id, dto => dto.Id);
+            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.CreateDate, dto => dto.CreateDate);
+            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.LoginProvider, dto => dto.LoginProvider);
+            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.ProviderKey, dto => dto.ProviderKey);
+            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.UserId, dto => dto.UserId);
+        }
+
+        #endregion
+    }
+}

src/Umbraco.Core/Persistence/Mappers/UserGroupMapper.cs

@@ -1,44 +1,43 @@
-using System;
-using System.Collections.Concurrent;
-using System.Linq.Expressions;
-using Umbraco.Core.Models.Membership;
-using Umbraco.Core.Models.Rdbms;
-
-namespace Umbraco.Core.Persistence.Mappers
-{
-    /// <summary>
-    /// Represents a <see cref="UserType"/> to DTO mapper used to translate the properties of the public api 
-    /// implementation to that of the database's DTO as sql: [tableName].[columnName].
-    /// </summary>
-    [MapperFor(typeof(IUserType))]
-    [MapperFor(typeof(UserType))]
-    public sealed class UserTypeMapper : BaseMapper
-    {
-        private static readonly ConcurrentDictionary<string, DtoMapModel> PropertyInfoCacheInstance = new ConcurrentDictionary<string, DtoMapModel>();
-
-        //NOTE: its an internal class but the ctor must be public since we're using Activator.CreateInstance to create it
-        // otherwise that would fail because there is no public constructor.
-        public UserTypeMapper()
-        {
-            BuildMap();
-        }
-
-        #region Overrides of BaseMapper
-
-        internal override ConcurrentDictionary<string, DtoMapModel> PropertyInfoCache
-        {
-            get { return PropertyInfoCacheInstance; }
-        }
-
-        internal override void BuildMap()
-        {
-            CacheMap<UserType, UserTypeDto>(src => src.Id, dto => dto.Id);
-            CacheMap<UserType, UserTypeDto>(src => src.Alias, dto => dto.Alias);
-            CacheMap<UserType, UserTypeDto>(src => src.Name, dto => dto.Name);
-            CacheMap<UserType, UserTypeDto>(src => src.Permissions, dto => dto.DefaultPermissions);
-        }
-
-
-        #endregion
-    }
+using System.Collections.Concurrent;
+using Umbraco.Core.Models.Membership;
+using Umbraco.Core.Models.Rdbms;
+
+namespace Umbraco.Core.Persistence.Mappers
+{
+    /// <summary>
+    /// Represents a <see cref="UserGroup"/> to DTO mapper used to translate the properties of the public api 
+    /// implementation to that of the database's DTO as sql: [tableName].[columnName].
+    /// </summary>
+    [MapperFor(typeof(IUserGroup))]
+    [MapperFor(typeof(UserGroup))]
+    public sealed class UserGroupMapper : BaseMapper
+    {
+        private static readonly ConcurrentDictionary<string, DtoMapModel> PropertyInfoCacheInstance = new ConcurrentDictionary<string, DtoMapModel>();
+
+        //NOTE: its an internal class but the ctor must be public since we're using Activator.CreateInstance to create it
+        // otherwise that would fail because there is no public constructor.
+        public UserGroupMapper()
+        {
+            BuildMap();
+        }
+
+        #region Overrides of BaseMapper
+
+        internal override ConcurrentDictionary<string, DtoMapModel> PropertyInfoCache
+        {
+            get { return PropertyInfoCacheInstance; }
+        }
+
+        internal override void BuildMap()
+        {
+            CacheMap<UserGroup, UserGroupDto>(src => src.Id, dto => dto.Id);
+            CacheMap<UserGroup, UserGroupDto>(src => src.Alias, dto => dto.Alias);
+            CacheMap<UserGroup, UserGroupDto>(src => src.Name, dto => dto.Name);
+            CacheMap<UserGroup, UserGroupDto>(src => src.Icon, dto => dto.Icon);
+            CacheMap<UserGroup, UserGroupDto>(src => src.StartContentId, dto => dto.StartContentId);
+            CacheMap<UserGroup, UserGroupDto>(src => src.StartMediaId, dto => dto.StartMediaId);
+        }
+
+        #endregion
+    }
 }

src/Umbraco.Core/Persistence/Mappers/UserMapper.cs

@@ -1,41 +1,11 @@
 using System;
 using System.Collections.Concurrent;
 using System.Linq.Expressions;
-using Umbraco.Core.Models.Identity;
 using Umbraco.Core.Models.Membership;
 using Umbraco.Core.Models.Rdbms;
 
 namespace Umbraco.Core.Persistence.Mappers
 {
-    [MapperFor(typeof(IIdentityUserLogin))]
-    [MapperFor(typeof(IdentityUserLogin))]
-    public sealed class ExternalLoginMapper : BaseMapper
-    {
-        private static readonly ConcurrentDictionary<string, DtoMapModel> PropertyInfoCacheInstance = new ConcurrentDictionary<string, DtoMapModel>();
-        public ExternalLoginMapper()
-        {
-            BuildMap();
-        }
-
-        #region Overrides of BaseMapper
-
-        internal override ConcurrentDictionary<string, DtoMapModel> PropertyInfoCache
-        {
-            get { return PropertyInfoCacheInstance; }
-        }
-
-        internal override void BuildMap()
-        {
-            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.Id, dto => dto.Id);
-            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.CreateDate, dto => dto.CreateDate);
-            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.LoginProvider, dto => dto.LoginProvider);
-            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.ProviderKey, dto => dto.ProviderKey);
-            CacheMap<IdentityUserLogin, ExternalLoginDto>(src => src.UserId, dto => dto.UserId);
-        }
-
-        #endregion
-    }
-
     [MapperFor(typeof(IUser))]
     [MapperFor(typeof(User))]
     public sealed class UserMapper : BaseMapper
@@ -64,13 +34,16 @@ namespace Umbraco.Core.Persistence.Mappers
             CacheMap<User, UserDto>(src => src.RawPasswordValue, dto => dto.Password);
             CacheMap<User, UserDto>(src => src.Name, dto => dto.UserName);
             //NOTE: This column in the db is *not* used!
-            //CacheMap<User, UserDto>(src => src.DefaultPermissions, dto => dto.DefaultPermissions);
-            CacheMap<User, UserDto>(src => src.StartMediaId, dto => dto.MediaStartId);
-            CacheMap<User, UserDto>(src => src.StartContentId, dto => dto.ContentStartId);
+            //CacheMap<User, UserDto>(src => src.DefaultPermissions, dto => dto.DefaultPermissions);         
             CacheMap<User, UserDto>(src => src.IsApproved, dto => dto.Disabled);
             CacheMap<User, UserDto>(src => src.IsLockedOut, dto => dto.NoConsole);
-            CacheMap<User, UserDto>(src => src.UserType, dto => dto.Type);
             CacheMap<User, UserDto>(src => src.Language, dto => dto.UserLanguage);
+            CacheMap<User, UserDto>(src => src.CreateDate, dto => dto.CreateDate);
+            CacheMap<User, UserDto>(src => src.UpdateDate, dto => dto.UpdateDate);
+            CacheMap<User, UserDto>(src => src.LastLockoutDate, dto => dto.LastLockoutDate);
+            CacheMap<User, UserDto>(src => src.LastLoginDate, dto => dto.LastLoginDate);
+            CacheMap<User, UserDto>(src => src.LastPasswordChangeDate, dto => dto.LastPasswordChangeDate);
+            CacheMap<User, UserDto>(src => src.SecurityStamp, dto => dto.SecurityStampToken);
         }
 
         #endregion

src/Umbraco.Core/Persistence/Migrations/Initial/BaseDataCreation.cs

@@ -48,14 +48,19 @@ namespace Umbraco.Core.Persistence.Migrations.Initial
                 CreateUmbracoUserData();
             }
 
-            if (tableName.Equals("umbracoUserType"))
+            if (tableName.Equals("umbracoUserGroup"))
             {
-                CreateUmbracoUserTypeData();
+                CreateUmbracoUserGroupData();
             }
 
-            if (tableName.Equals("umbracoUser2app"))
+            if (tableName.Equals("umbracoUser2UserGroup"))
             {
-                CreateUmbracoUser2AppData();
+                CreateUmbracoUser2UserGroupData();
+            }
+
+            if (tableName.Equals("umbracoUserGroup2App"))
+            {
+                CreateUmbracoUserGroup2AppData();
             }
 
             if (tableName.Equals("cmsPropertyTypeGroup"))
@@ -164,27 +169,34 @@ namespace Umbraco.Core.Persistence.Migrations.Initial
 
         private void CreateUmbracoUserData()
         {
-            _database.Insert("umbracoUser", "id", false, new UserDto { Id = 0, Disabled = false, NoConsole = false, Type = 1, ContentStartId = -1, MediaStartId = -1, UserName = "Administrator", Login = "admin", Password = "default", Email = "", UserLanguage = "en" });
-            //_database.Update<UserDto>("SET id = @IdAfter WHERE id = @IdBefore AND userLogin = @Login", new { IdAfter = 0, IdBefore = 1, Login = "admin" });
+            _database.Insert("umbracoUser", "id", false, new UserDto { Id = 0, Disabled = false, NoConsole = false, UserName = "Administrator", Login = "admin", Password = "default", Email = "", UserLanguage = "en", CreateDate = DateTime.Now, UpdateDate = DateTime.Now });
         }
         
-        private void CreateUmbracoUserTypeData()
+        private void CreateUmbracoUserGroupData()
         {
-            _database.Insert("umbracoUserType", "id", false, new UserTypeDto { Id = 1, Alias = "admin", Name = "Administrators", DefaultPermissions = "CADMOSKTPIURZ:5F7" });
-            _database.Insert("umbracoUserType", "id", false, new UserTypeDto { Id = 2, Alias = "writer", Name = "Writer", DefaultPermissions = "CAH:F" });
-            _database.Insert("umbracoUserType", "id", false, new UserTypeDto { Id = 3, Alias = "editor", Name = "Editors", DefaultPermissions = "CADMOSKTPUZ:5F" });
-            _database.Insert("umbracoUserType", "id", false, new UserTypeDto { Id = 4, Alias = "translator", Name = "Translator", DefaultPermissions = "AF" });
+            _database.Insert("umbracoUserGroup", "id", false, new UserGroupDto { Id = 1, StartMediaId = -1, StartContentId = -1, Alias = Constants.Security.AdminGroupAlias, Name = "Administrators", DefaultPermissions = "CADMOSKTPIURZ:5F7ï", CreateDate = DateTime.Now, UpdateDate = DateTime.Now, Icon = "icon-medal" });
+            _database.Insert("umbracoUserGroup", "id", false, new UserGroupDto { Id = 2, StartMediaId = -1, StartContentId = -1, Alias = "writer", Name = "Writers", DefaultPermissions = "CAH:F", CreateDate = DateTime.Now, UpdateDate = DateTime.Now, Icon = "icon-edit" });
+            _database.Insert("umbracoUserGroup", "id", false, new UserGroupDto { Id = 3, StartMediaId = -1, StartContentId = -1, Alias = "editor", Name = "Editors", DefaultPermissions = "CADMOSKTPUZ:5Fï", CreateDate = DateTime.Now, UpdateDate = DateTime.Now, Icon = "icon-tools" });
+            _database.Insert("umbracoUserGroup", "id", false, new UserGroupDto { Id = 4, StartMediaId = -1, StartContentId = -1, Alias = "translator", Name = "Translators", DefaultPermissions = "AF", CreateDate = DateTime.Now, UpdateDate = DateTime.Now, Icon = "icon-globe" });
         }
 
-        private void CreateUmbracoUser2AppData()
+        private void CreateUmbracoUser2UserGroupData()
         {
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Content });
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Developer });
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Media });
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Members });
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Settings });
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Users });
-            _database.Insert("umbracoUser2app", "user", false, new User2AppDto { UserId = 0, AppAlias = Constants.Applications.Forms });
+            _database.Insert(new User2UserGroupDto { UserGroupId = 1, UserId = 0 });
+        }
+
+        private void CreateUmbracoUserGroup2AppData()
+        {
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 1, AppAlias = Constants.Applications.Content });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 1, AppAlias = Constants.Applications.Media });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 1, AppAlias = Constants.Applications.Settings });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 1, AppAlias = Constants.Applications.Developer });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 1, AppAlias = Constants.Applications.Users });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 1, AppAlias = Constants.Applications.Members });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 2, AppAlias = Constants.Applications.Content });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 3, AppAlias = Constants.Applications.Content });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 3, AppAlias = Constants.Applications.Media });
+            _database.Insert(new UserGroup2AppDto { UserGroupId = 4, AppAlias = Constants.Applications.Translation });
         }
         
         private void CreateCmsPropertyTypeGroupData()

src/Umbraco.Core/Persistence/Migrations/Initial/DatabaseSchemaCreation.cs

@@ -67,15 +67,15 @@ namespace Umbraco.Core.Persistence.Migrations.Initial
                                                                               
                                                                               {28, typeof (TagDto)},
                                                                               {29, typeof (TagRelationshipDto)},
-                                                                              {31, typeof (UserTypeDto)},
+                                                                              // Removed in 7.6 {31, typeof (UserTypeDto)},
                                                                               {32, typeof (UserDto)},
                                                                               {33, typeof (TaskTypeDto)},
                                                                               {34, typeof (TaskDto)},
                                                                               {35, typeof (ContentType2ContentTypeDto)},
                                                                               {36, typeof (ContentTypeAllowedContentTypeDto)},
-                                                                              {37, typeof (User2AppDto)},
+                                                                              // Removed in 7.6 {37, typeof (User2AppDto)},
                                                                               {38, typeof (User2NodeNotifyDto)},
-                                                                              {39, typeof (User2NodePermissionDto)},
+                                                                              // Removed in 7.6 {39, typeof (User2NodePermissionDto)},
                                                                               {40, typeof (ServerRegistrationDto)},
                                                                               {41, typeof (AccessDto)},
                                                                               {42, typeof (AccessRuleDto)},
@@ -85,7 +85,12 @@ namespace Umbraco.Core.Persistence.Migrations.Initial
                                                                               //46, removed: UmbracoDeployChecksumDto
                                                                               //47, removed: UmbracoDeployDependencyDto
                                                                               {48, typeof (RedirectUrlDto) },
-                                                                              {49, typeof (LockDto) }
+                                                                              {49, typeof (LockDto) },
+                                                                              {50, typeof (UserGroupDto) },
+                                                                              {51, typeof (User2UserGroupDto) },
+                                                                              {52, typeof (UserGroup2NodePermissionDto) },
+                                                                              {53, typeof (UserGroup2AppDto) },
+                                                                              {54, typeof (UserStartNodeDto) },
                                                                           };
         #endregion
         

src/Umbraco.Core/Persistence/Migrations/Initial/DatabaseSchemaResult.cs

@@ -142,6 +142,12 @@ namespace Umbraco.Core.Persistence.Migrations.Initial
                 return new Version(7, 5, 0);
             }
 
+            //if the error is for umbracoUserGroup it must be the previous version to 7.7 since that is when it is added
+            if (Errors.Any(x => x.Item1.Equals("Table") && (x.Item2.InvariantEquals("umbracoUserStartNode"))))
+            {
+                return new Version(7, 6, 0);
+            }
+
             return UmbracoVersion.Current;
         }
 

src/Umbraco.Core/Persistence/Migrations/LocalMigrationContext.cs

@@ -1,10 +1,12 @@
 using System.Linq;
+using System.Runtime.Remoting.Contexts;
 using System.Text;
 using Umbraco.Core.Logging;
 using Umbraco.Core.Persistence.Migrations.Syntax.Alter;
 using Umbraco.Core.Persistence.Migrations.Syntax.Create;
 using Umbraco.Core.Persistence.Migrations.Syntax.Delete;
 using Umbraco.Core.Persistence.Migrations.Syntax.Execute;
+using Umbraco.Core.Persistence.Migrations.Syntax.Update;
 using Umbraco.Core.Persistence.SqlSyntax;
 
 namespace Umbraco.Core.Persistence.Migrations
@@ -29,6 +31,11 @@ namespace Umbraco.Core.Persistence.Migrations
             get { return new DeleteBuilder(this, _sqlSyntax); }
         }
 
+        public IUpdateBuilder Update
+        {
+            get { return new UpdateBuilder(this, _sqlSyntax); }
+        }        
+
         public IAlterSyntaxBuilder Alter
         {
             get { return new AlterSyntaxBuilder(this, _sqlSyntax); }

src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenFiveZero/AddRedirectUrlTable.cs

@@ -33,7 +33,7 @@ namespace Umbraco.Core.Persistence.Migrations.Upgrades.TargetVersionSevenFiveZer
                     return null;
                 localContext.Delete.Table(umbracoRedirectUrlTableName);
             }
-
+            
             localContext.Create.Table(umbracoRedirectUrlTableName)
                 .WithColumn("id").AsGuid().NotNullable().PrimaryKey("PK_" + umbracoRedirectUrlTableName)
                 .WithColumn("createDateUtc").AsDateTime().NotNullable()

src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenSevenZero/AddIndexToDictionaryKeyColumn.cs

@@ -0,0 +1,63 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Runtime.Remoting.Contexts;
+using System.Text;
+using System.Threading.Tasks;
+using Umbraco.Core.Logging;
+using Umbraco.Core.Persistence.SqlSyntax;
+
+namespace Umbraco.Core.Persistence.Migrations.Upgrades.TargetVersionSevenSevenZero
+{
+    [Migration("7.7.0", 5, Constants.System.UmbracoMigrationName)]
+    public class AddIndexToDictionaryKeyColumn : MigrationBase
+    {
+        public AddIndexToDictionaryKeyColumn(ISqlSyntaxProvider sqlSyntax, ILogger logger)
+            : base(sqlSyntax, logger)
+        { }
+
+        public override void Up()
+        {
+            Execute.Code(database =>
+            {
+                //Now we need to check if we can actually do this because we won't be able to if there's data in there that is too long
+                var colLen = (SqlSyntax is MySqlSyntaxProvider)
+                    ? database.ExecuteScalar<int?>(string.Format("select max(LENGTH({0})) from cmsDictionary", SqlSyntax.GetQuotedColumnName("key")))
+                    : database.ExecuteScalar<int?>(string.Format("select max(datalength({0})) from cmsDictionary", SqlSyntax.GetQuotedColumnName("key")));
+
+                if (colLen < 900 == false && colLen != null)
+                {
+                    return null;
+                }
+
+                var dbIndexes = SqlSyntax.GetDefinedIndexesDefinitions(Context.Database);
+
+                //make sure it doesn't already exist
+                if (dbIndexes.Any(x => x.IndexName.InvariantEquals("IX_cmsDictionary_key")) == false)
+                {
+                    var localContext = new LocalMigrationContext(Context.CurrentDatabaseProvider, database, SqlSyntax, Logger);
+
+                    //we can apply the index
+                    localContext.Create.Index("IX_cmsDictionary_key").OnTable("cmsDictionary")
+                        .OnColumn("key")
+                        .Ascending()
+                        .WithOptions()
+                        .NonClustered();
+
+                    return localContext.GetSql();
+                }
+
+                return null;
+
+            });
+
+
+        }
+
+        public override void Down()
+        {
+            Delete.Index("IX_cmsDictionary_key").OnTable("cmsDictionary");
+        }
+
+    }
+}

src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenSevenZero/AddUserGroupTables.cs

@@ -0,0 +1,184 @@
+using System;
+using System.Data;
+using System.Linq;
+using Umbraco.Core.Configuration;
+using Umbraco.Core.Logging;
+using Umbraco.Core.Models;
+using Umbraco.Core.Models.Rdbms;
+using Umbraco.Core.Persistence.SqlSyntax;
+
+namespace Umbraco.Core.Persistence.Migrations.Upgrades.TargetVersionSevenSevenZero
+{
+    [Migration("7.7.0", 1, Constants.System.UmbracoMigrationName)]
+    public class AddUserGroupTables : MigrationBase
+    {
+        public AddUserGroupTables(ISqlSyntaxProvider sqlSyntax, ILogger logger)
+            : base(sqlSyntax, logger)
+        { }
+
+        public override void Up()
+        {
+            var tables = SqlSyntax.GetTablesInSchema(Context.Database).ToArray();
+            var constraints = SqlSyntax.GetConstraintsPerColumn(Context.Database).Distinct().ToArray();
+
+            if (AddNewTables(tables))
+            {
+                MigrateUserPermissions();
+                MigrateUserTypesToGroups();
+                DeleteOldTables(tables, constraints);
+                SetDefaultIcons();
+            }
+        }
+
+        private void SetDefaultIcons()
+        {
+            Execute.Sql(string.Format("UPDATE umbracoUserGroup SET icon = '{0}' WHERE userGroupAlias = '{1}'", "", Constants.Security.AdminGroupAlias));
+            Execute.Sql(string.Format("UPDATE umbracoUserGroup SET icon = '{0}' WHERE userGroupAlias = '{1}'", "icon-edit", "writer"));
+            Execute.Sql(string.Format("UPDATE umbracoUserGroup SET icon = '{0}' WHERE userGroupAlias = '{1}'", "icon-tools", "editor"));
+            Execute.Sql(string.Format("UPDATE umbracoUserGroup SET icon = '{0}' WHERE userGroupAlias = '{1}'", "icon-globe", "translator"));
+        }
+
+        private bool AddNewTables(string[] tables)
+        {
+            var updated = false;
+            if (tables.InvariantContains("umbracoUserGroup") == false)
+            {
+                Create.Table<UserGroupDto>();
+                updated = true;
+            }
+
+            if (tables.InvariantContains("umbracoUser2UserGroup") == false)
+            {
+                Create.Table<User2UserGroupDto>();
+                updated = true;
+            }
+
+            if (tables.InvariantContains("umbracoUserGroup2App") == false)
+            {
+                Create.Table<UserGroup2AppDto>();
+                updated = true;
+            }
+
+            if (tables.InvariantContains("umbracoUserGroup2NodePermission") == false)
+            {
+                Create.Table<UserGroup2NodePermissionDto>();
+                updated = true;
+            }
+
+            
+
+            return updated;
+        }       
+
+        private void MigrateUserTypesToGroups()
+        {
+            // Create a user group for each user type
+            Execute.Sql(@"INSERT INTO umbracoUserGroup (userGroupAlias, userGroupName, userGroupDefaultPermissions)
+                SELECT userTypeAlias, userTypeName, userTypeDefaultPermissions
+                FROM umbracoUserType");
+
+            // Add each user to the group created from their type
+            Execute.Sql(@"INSERT INTO umbracoUser2UserGroup (userId, userGroupId)
+                SELECT u.id, ug.id
+                FROM umbracoUser u
+                INNER JOIN umbracoUserType ut ON ut.id = u.userType
+                INNER JOIN umbracoUserGroup ug ON ug.userGroupAlias = ut.userTypeAlias");
+
+            // Add the built-in administrator account to all apps
+            Execute.Sql(@"INSERT INTO umbracoUserGroup2app (userGroupId,app)
+                SELECT ug.id, app
+                FROM umbracoUserGroup ug
+                INNER JOIN umbracoUser2UserGroup u2ug ON u2ug.userGroupId = ug.id
+                INNER JOIN umbracoUser u ON u.id = u2ug.userId
+                INNER JOIN umbracoUser2app u2a ON u2a." + SqlSyntax.GetQuotedColumnName("user") + @" = u.id
+				WHERE u.id = 0");
+
+            // Rename some groups for consistency (plural form)
+            Execute.Sql("UPDATE umbracoUserGroup SET userGroupName = 'Writers' WHERE userGroupAlias = 'writer'");
+            Execute.Sql("UPDATE umbracoUserGroup SET userGroupName = 'Translators' WHERE userGroupAlias = 'translator'");
+
+            //Ensure all built in groups have a start node of -1
+            Execute.Sql("UPDATE umbracoUserGroup SET startContentId = -1 WHERE userGroupAlias = 'editor'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startMediaId = -1 WHERE userGroupAlias = 'editor'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startContentId = -1 WHERE userGroupAlias = 'writer'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startMediaId = -1 WHERE userGroupAlias = 'writer'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startContentId = -1 WHERE userGroupAlias = 'translator'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startMediaId = -1 WHERE userGroupAlias = 'translator'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startContentId = -1 WHERE userGroupAlias = 'admin'");
+            Execute.Sql("UPDATE umbracoUserGroup SET startMediaId = -1 WHERE userGroupAlias = 'admin'");
+        }
+
+        private void MigrateUserPermissions()
+        {
+            // Create user group records for all non-admin users that have specific permissions set
+            Execute.Sql(@"INSERT INTO umbracoUserGroup(userGroupAlias, userGroupName)
+                SELECT userName + 'Group', 'Group for ' + userName
+                FROM umbracoUser
+                WHERE (id IN (
+	                SELECT " + SqlSyntax.GetQuotedColumnName("user") + @"
+	                FROM umbracoUser2app
+                ) OR id IN (
+	                SELECT userid
+	                FROM umbracoUser2NodePermission
+                ))
+                AND id > 0");
+
+            // Associate those groups with the users
+            Execute.Sql(@"INSERT INTO umbracoUser2UserGroup (userId, userGroupId)
+                SELECT u.id, ug.id
+                FROM umbracoUser u
+                INNER JOIN umbracoUserGroup ug ON ug.userGroupAlias = userName + 'Group'");
+
+            // Create node permissions on the groups
+            Execute.Sql(@"INSERT INTO umbracoUserGroup2NodePermission (userGroupId,nodeId,permission)
+                SELECT ug.id, nodeId, permission
+                FROM umbracoUserGroup ug
+                INNER JOIN umbracoUser2UserGroup u2ug ON u2ug.userGroupId = ug.id
+                INNER JOIN umbracoUser u ON u.id = u2ug.userId
+                INNER JOIN umbracoUser2NodePermission u2np ON u2np.userId = u.id
+				WHERE ug.userGroupAlias NOT IN (
+					SELECT userTypeAlias
+					FROM umbracoUserType
+				)");
+
+            // Create app permissions on the groups
+            Execute.Sql(@"INSERT INTO umbracoUserGroup2app (userGroupId,app)
+                SELECT ug.id, app
+                FROM umbracoUserGroup ug
+                INNER JOIN umbracoUser2UserGroup u2ug ON u2ug.userGroupId = ug.id
+                INNER JOIN umbracoUser u ON u.id = u2ug.userId
+                INNER JOIN umbracoUser2app u2a ON u2a." + SqlSyntax.GetQuotedColumnName("user") + @" = u.id
+				WHERE ug.userGroupAlias NOT IN (
+					SELECT userTypeAlias
+					FROM umbracoUserType
+				)");
+        }
+
+        private void DeleteOldTables(string[] tables, Tuple<string, string, string>[] constraints)
+        {
+            if (tables.InvariantContains("umbracoUser2App"))
+            {
+                Delete.Table("umbracoUser2App");
+            }
+
+            if (tables.InvariantContains("umbracoUser2NodePermission"))
+            {
+                Delete.Table("umbracoUser2NodePermission");
+            }
+
+            if (tables.InvariantContains("umbracoUserType") && tables.InvariantContains("umbracoUser"))
+            {
+                if (constraints.Any(x => x.Item1.InvariantEquals("umbracoUser") && x.Item3.InvariantEquals("FK_umbracoUser_umbracoUserType_id")))
+                {
+                    Delete.ForeignKey("FK_umbracoUser_umbracoUserType_id").OnTable("umbracoUser");
+                }
+
+                Delete.Column("userType").FromTable("umbracoUser");
+                Delete.Table("umbracoUserType");
+            }
+        }
+
+        public override void Down()
+        { }
+    }
+}