diff --git a/.github/workflows/toolshed.yaml b/.github/workflows/toolshed.yaml
index 95db16b404ac..48dbb860b391 100644
--- a/.github/workflows/toolshed.yaml
+++ b/.github/workflows/toolshed.yaml
@@ -61,7 +61,7 @@ jobs:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-toolshed
       - name: Install dependencies
-        run: ./scripts/common_startup.sh --skip-client-build
+        run: ./scripts/common_startup.sh --dev-wheels --skip-client-build
         working-directory: 'galaxy root'
       - name: Build Frontend
         run: |
diff --git a/client/gulpfile.js b/client/gulpfile.js
index ca806b726c76..9766e256fd16 100644
--- a/client/gulpfile.js
+++ b/client/gulpfile.js
@@ -120,6 +120,20 @@ function buildPlugins(callback, forceRebuild) {
             skipBuild = false;
         } else {
             if (fs.existsSync(hashFilePath)) {
+                const hashFileContent = fs.readFileSync(hashFilePath, "utf8").trim();
+                const isHash = /^[0-9a-f]{7,40}$/.test(hashFileContent); // Check for a 7 to 40 character hexadecimal string
+
+                if (!isHash) {
+                    console.log(`Hash file for ${pluginName} exists but does not have a valid git hash.`);
+                    skipBuild = false;
+                } else {
+                    skipBuild =
+                        child_process.spawnSync("git", ["diff", "--quiet", hashFileContent, "--", pluginDir], {
+                            stdio: "inherit",
+                            shell: true,
+                        }).status === 0;
+                }
+
                 skipBuild =
                     child_process.spawnSync("git", ["diff", "--quiet", `$(cat ${hashFilePath})`, "--", pluginDir], {
                         stdio: "inherit",
diff --git a/client/src/api/datasets.ts b/client/src/api/datasets.ts
index 09948b45ce26..ded071c812af 100644
--- a/client/src/api/datasets.ts
+++ b/client/src/api/datasets.ts
@@ -1,7 +1,7 @@
 import type { FetchArgType } from "openapi-typescript-fetch";
 
 import { DatasetDetails } from "@/api";
-import { fetcher } from "@/api/schema";
+import { components, fetcher } from "@/api/schema";
 import { withPrefix } from "@/utils/redirect";
 
 export const datasetsFetcher = fetcher.path("/api/datasets").method("get").create();
@@ -87,3 +87,6 @@ export async function copyDataset(
 export function getCompositeDatasetLink(historyDatasetId: string, path: string) {
     return withPrefix(`/api/datasets/${historyDatasetId}/display?filename=${path}`);
 }
+
+export type DatasetExtraFiles = components["schemas"]["DatasetExtraFiles"];
+export const fetchDatasetExtraFiles = fetcher.path("/api/datasets/{dataset_id}/extra_files").method("get").create();
diff --git a/client/src/api/groups.ts b/client/src/api/groups.ts
index 4f0c3e236e87..e795ccfdbf47 100644
--- a/client/src/api/groups.ts
+++ b/client/src/api/groups.ts
@@ -1,9 +1,13 @@
 import axios from "axios";
 
-import { components } from "@/api/schema";
+import { components, fetcher } from "@/api/schema";
 
 type GroupModel = components["schemas"]["GroupModel"];
 export async function getAllGroups(): Promise<GroupModel[]> {
     const { data } = await axios.get("/api/groups");
     return data;
 }
+
+export const deleteGroup = fetcher.path("/api/groups/{group_id}").method("delete").create();
+export const purgeGroup = fetcher.path("/api/groups/{group_id}/purge").method("post").create();
+export const undeleteGroup = fetcher.path("/api/groups/{group_id}/undelete").method("post").create();
diff --git a/client/src/api/jobs.ts b/client/src/api/jobs.ts
index b96b65352600..e915a9179098 100644
--- a/client/src/api/jobs.ts
+++ b/client/src/api/jobs.ts
@@ -1,4 +1,8 @@
-import { fetcher } from "@/api/schema";
+import { components, fetcher } from "@/api/schema";
+
+export type JobDestinationParams = components["schemas"]["JobDestinationParams"];
 
 export const jobLockStatus = fetcher.path("/api/job_lock").method("get").create();
 export const jobLockUpdate = fetcher.path("/api/job_lock").method("put").create();
+
+export const fetchJobDestinationParams = fetcher.path("/api/jobs/{job_id}/destination_params").method("get").create();
diff --git a/client/src/api/roles.ts b/client/src/api/roles.ts
index 61fde1360a92..4667ca53a2b5 100644
--- a/client/src/api/roles.ts
+++ b/client/src/api/roles.ts
@@ -5,3 +5,7 @@ export async function getAllRoles() {
     const { data } = await getRoles({});
     return data;
 }
+
+export const deleteRole = fetcher.path("/api/roles/{id}").method("delete").create();
+export const purgeRole = fetcher.path("/api/roles/{id}/purge").method("post").create();
+export const undeleteRole = fetcher.path("/api/roles/{id}/undelete").method("post").create();
diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index 7e4f142a7a05..bd06205258ec 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -155,6 +155,10 @@ export interface paths {
          */
         get: operations["converted_ext_api_datasets__dataset_id__converted__ext__get"];
     };
+    "/api/datasets/{dataset_id}/extra_files": {
+        /** Get the list of extra files/directories associated with a dataset. */
+        get: operations["extra_files_api_datasets__dataset_id__extra_files_get"];
+    };
     "/api/datasets/{dataset_id}/get_content_as_text": {
         /** Returns dataset content as Text. */
         get: operations["get_content_as_text_api_datasets__dataset_id__get_content_as_text_get"];
@@ -392,6 +396,12 @@ export interface paths {
         get: operations["show_group_api_groups__group_id__get"];
         /** Modifies a group. */
         put: operations["update_api_groups__group_id__put"];
+        /** Delete */
+        delete: operations["delete_api_groups__group_id__delete"];
+    };
+    "/api/groups/{group_id}/purge": {
+        /** Purge */
+        post: operations["purge_api_groups__group_id__purge_post"];
     };
     "/api/groups/{group_id}/roles": {
         /** Displays a collection (list) of groups. */
@@ -405,6 +415,10 @@ export interface paths {
         /** Removes a role from a group */
         delete: operations["delete_api_groups__group_id__roles__role_id__delete"];
     };
+    "/api/groups/{group_id}/undelete": {
+        /** Undelete */
+        post: operations["undelete_api_groups__group_id__undelete_post"];
+    };
     "/api/groups/{group_id}/user/{user_id}": {
         /**
          * Displays information about a group user.
@@ -640,8 +654,8 @@ export interface paths {
         head: operations["history_contents_display_api_histories__history_id__contents__history_content_id__display_head"];
     };
     "/api/histories/{history_id}/contents/{history_content_id}/extra_files": {
-        /** Generate list of extra files. */
-        get: operations["extra_files_api_histories__history_id__contents__history_content_id__extra_files_get"];
+        /** Get the list of extra files/directories associated with a dataset. */
+        get: operations["extra_files_history_api_histories__history_id__contents__history_content_id__extra_files_get"];
     };
     "/api/histories/{history_id}/contents/{history_content_id}/metadata_file": {
         /** Returns the metadata file associated with this history item. */
@@ -1361,6 +1375,16 @@ export interface paths {
     "/api/roles/{id}": {
         /** Show */
         get: operations["show_api_roles__id__get"];
+        /** Delete */
+        delete: operations["delete_api_roles__id__delete"];
+    };
+    "/api/roles/{id}/purge": {
+        /** Purge */
+        post: operations["purge_api_roles__id__purge_post"];
+    };
+    "/api/roles/{id}/undelete": {
+        /** Undelete */
+        post: operations["undelete_api_roles__id__undelete_post"];
     };
     "/api/short_term_storage/{storage_request_id}": {
         /** Serve the staged download specified by request ID. */
@@ -1592,6 +1616,14 @@ export interface paths {
         /** Remove the object from user's favorites */
         delete: operations["remove_favorite_api_users__user_id__favorites__object_type___object_id__delete"];
     };
+    "/api/users/{user_id}/recalculate_disk_usage": {
+        /** Triggers a recalculation of the current user disk usage. */
+        put: operations["recalculate_disk_usage_by_user_id_api_users__user_id__recalculate_disk_usage_put"];
+    };
+    "/api/users/{user_id}/send_activation_email": {
+        /** Sends activation email to user. */
+        post: operations["send_activation_email_api_users__user_id__send_activation_email_post"];
+    };
     "/api/users/{user_id}/theme/{theme}": {
         /** Set the user's theme choice */
         put: operations["set_theme_api_users__user_id__theme__theme__put"];
@@ -2590,6 +2622,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -3472,6 +3506,11 @@ export interface components {
              */
             error_message: string;
         };
+        /**
+         * DatasetExtraFiles
+         * @description A list of extra files associated with a dataset.
+         */
+        DatasetExtraFiles: components["schemas"]["ExtraFileEntry"][];
         /**
          * DatasetInheritanceChain
          * @default []
@@ -4340,6 +4379,16 @@ export interface components {
         };
         /** ExportTaskListResponse */
         ExportTaskListResponse: components["schemas"]["ObjectExportTaskResponse"][];
+        /** ExtraFileEntry */
+        ExtraFileEntry: {
+            /** @description The class of this entry, either File or Directory. */
+            class: components["schemas"]["ExtraFilesEntryClass"];
+            /**
+             * Path
+             * @description Relative path to the file or directory.
+             */
+            path: string;
+        };
         /** ExtraFiles */
         ExtraFiles: {
             /**
@@ -4352,6 +4401,12 @@ export interface components {
             items_from?: string;
             src: components["schemas"]["Src"];
         };
+        /**
+         * ExtraFilesEntryClass
+         * @description An enumeration.
+         * @enum {string}
+         */
+        ExtraFilesEntryClass: "Directory" | "File";
         /** FavoriteObject */
         FavoriteObject: {
             /**
@@ -4415,6 +4470,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -4633,6 +4690,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -6386,7 +6445,7 @@ export interface components {
          */
         ItemTagsCreatePayload: {
             /** value of the item tag */
-            value: string;
+            value?: string;
         };
         /**
          * ItemTagsListResponse
@@ -7540,6 +7599,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             /** Elements */
             elements: (
                 | (
@@ -8135,6 +8196,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -8193,6 +8256,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -8646,6 +8711,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -9496,6 +9563,8 @@ export interface components {
              * @default false
              */
             deferred?: boolean;
+            /** Description */
+            description?: string;
             elements_from?: components["schemas"]["ElementsFromType"];
             /**
              * Ext
@@ -10775,6 +10844,33 @@ export interface operations {
             };
         };
     };
+    extra_files_api_datasets__dataset_id__extra_files_get: {
+        /** Get the list of extra files/directories associated with a dataset. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            /** @description The encoded database identifier of the dataset. */
+            path: {
+                dataset_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["DatasetExtraFiles"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     get_content_as_text_api_datasets__dataset_id__get_content_as_text_get: {
         /** Returns dataset content as Text. */
         parameters: {
@@ -12010,6 +12106,58 @@ export interface operations {
             };
         };
     };
+    delete_api_groups__group_id__delete: {
+        /** Delete */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            path: {
+                group_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    purge_api_groups__group_id__purge_post: {
+        /** Purge */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            path: {
+                group_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     group_roles_api_groups__group_id__roles_get: {
         /** Displays a collection (list) of groups. */
         parameters: {
@@ -12124,6 +12272,32 @@ export interface operations {
             };
         };
     };
+    undelete_api_groups__group_id__undelete_post: {
+        /** Undelete */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            path: {
+                group_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     group_user_api_groups__group_id__user__user_id__get: {
         /**
          * Displays information about a group user.
@@ -13621,8 +13795,8 @@ export interface operations {
             };
         };
     };
-    extra_files_api_histories__history_id__contents__history_content_id__extra_files_get: {
-        /** Generate list of extra files. */
+    extra_files_history_api_histories__history_id__contents__history_content_id__extra_files_get: {
+        /** Get the list of extra files/directories associated with a dataset. */
         parameters: {
             /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
             header?: {
@@ -13639,7 +13813,7 @@ export interface operations {
             /** @description Successful Response */
             200: {
                 content: {
-                    "application/json": Record<string, never>;
+                    "application/json": components["schemas"]["DatasetExtraFiles"];
                 };
             };
             /** @description Validation Error */
@@ -13780,7 +13954,7 @@ export interface operations {
                 history_id: string;
             };
         };
-        requestBody: {
+        requestBody?: {
             content: {
                 "application/json": components["schemas"]["ItemTagsCreatePayload"];
             };
@@ -15087,7 +15261,7 @@ export interface operations {
                 tag_name: string;
             };
         };
-        requestBody: {
+        requestBody?: {
             content: {
                 "application/json": components["schemas"]["ItemTagsCreatePayload"];
             };
@@ -17598,6 +17772,84 @@ export interface operations {
             };
         };
     };
+    delete_api_roles__id__delete: {
+        /** Delete */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            path: {
+                id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["RoleModelResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    purge_api_roles__id__purge_post: {
+        /** Purge */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            path: {
+                id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["RoleModelResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    undelete_api_roles__id__undelete_post: {
+        /** Undelete */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            path: {
+                id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["RoleModelResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     serve_api_short_term_storage__storage_request_id__get: {
         /** Serve the staged download specified by request ID. */
         parameters: {
@@ -18972,6 +19224,62 @@ export interface operations {
             };
         };
     };
+    recalculate_disk_usage_by_user_id_api_users__user_id__recalculate_disk_usage_put: {
+        /** Triggers a recalculation of the current user disk usage. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            /** @description The ID of the user to get. */
+            path: {
+                user_id: string;
+            };
+        };
+        responses: {
+            /** @description The asynchronous task summary to track the task state. */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["AsyncTaskResultSummary"];
+                };
+            };
+            /** @description The background task was submitted but there is no status tracking ID available. */
+            204: never;
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    send_activation_email_api_users__user_id__send_activation_email_post: {
+        /** Sends activation email to user. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string;
+            };
+            /** @description The ID of the user to get. */
+            path: {
+                user_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     set_theme_api_users__user_id__theme__theme__put: {
         /** Set the user's theme choice */
         parameters: {
@@ -19846,7 +20154,7 @@ export interface operations {
                 tag_name: string;
             };
         };
-        requestBody: {
+        requestBody?: {
             content: {
                 "application/json": components["schemas"]["ItemTagsCreatePayload"];
             };
diff --git a/client/src/api/users.ts b/client/src/api/users.ts
index d3a2a7ac010f..7a59d96ea839 100644
--- a/client/src/api/users.ts
+++ b/client/src/api/users.ts
@@ -1,7 +1,15 @@
 import { fetcher } from "@/api/schema";
 
-export const recalculateDiskUsage = fetcher.path("/api/users/current/recalculate_disk_usage").method("put").create();
+export const createApiKey = fetcher.path("/api/users/{user_id}/api_key").method("post").create();
+export const deleteUser = fetcher.path("/api/users/{user_id}").method("delete").create();
 export const fetchQuotaUsages = fetcher.path("/api/users/{user_id}/usage").method("get").create();
+export const recalculateDiskUsage = fetcher.path("/api/users/current/recalculate_disk_usage").method("put").create();
+export const recalculateDiskUsageByUserId = fetcher
+    .path("/api/users/{user_id}/recalculate_disk_usage")
+    .method("put")
+    .create();
+export const sendActivationEmail = fetcher.path("/api/users/{user_id}/send_activation_email").method("post").create();
+export const undeleteUser = fetcher.path("/api/users/deleted/{user_id}/undelete").method("post").create();
 
 const getUsers = fetcher.path("/api/users").method("get").create();
 export async function getAllUsers() {
diff --git a/client/src/components/Dataset/compositeDatasetUtils.js b/client/src/components/Dataset/compositeDatasetUtils.js
deleted file mode 100644
index 087f61ad9696..000000000000
--- a/client/src/components/Dataset/compositeDatasetUtils.js
+++ /dev/null
@@ -1,36 +0,0 @@
-import { getCompositeDatasetLink } from "@/api/datasets";
-
-import store from "../../store/index";
-
-export const getPathDestination = async (history_dataset_id, path) => {
-    const computePathDestination = (pathDestination) => {
-        if (path === undefined || path === "undefined") {
-            return pathDestination;
-        }
-
-        const filepath = path;
-
-        const datasetEntry = datasetContent.find((datasetEntry) => {
-            return filepath === datasetEntry.path;
-        });
-
-        if (datasetEntry) {
-            if (datasetEntry.class === "Directory") {
-                pathDestination.isDirectory = true;
-                pathDestination.filepath = filepath;
-                return pathDestination;
-            }
-            pathDestination.fileLink = getCompositeDatasetLink(history_dataset_id, datasetEntry.path);
-        }
-        return pathDestination;
-    };
-
-    let datasetContent = store.getters.getDatasetExtFiles(history_dataset_id);
-
-    if (datasetContent == null) {
-        await store.dispatch("fetchDatasetExtFiles", history_dataset_id);
-        datasetContent = store.getters.getDatasetExtFiles(history_dataset_id);
-    }
-
-    return computePathDestination({ datasetContent: datasetContent });
-};
diff --git a/client/src/components/Dataset/compositeDatasetUtils.ts b/client/src/components/Dataset/compositeDatasetUtils.ts
new file mode 100644
index 000000000000..763bb846306a
--- /dev/null
+++ b/client/src/components/Dataset/compositeDatasetUtils.ts
@@ -0,0 +1,45 @@
+import { DatasetExtraFiles, getCompositeDatasetLink } from "@/api/datasets";
+import { useDatasetExtraFilesStore } from "@/stores/datasetExtraFilesStore";
+
+interface PathDestination {
+    datasetContent: DatasetExtraFiles;
+    isDirectory: boolean;
+    filepath?: string;
+    fileLink?: string;
+}
+
+export async function getPathDestination(dataset_id: string, path?: string): Promise<PathDestination | null> {
+    const datasetExtraFilesStore = useDatasetExtraFilesStore();
+
+    let datasetExtraFiles = datasetExtraFilesStore.getDatasetExtraFiles(dataset_id);
+    if (!datasetExtraFiles) {
+        await datasetExtraFilesStore.fetchDatasetExtFilesByDatasetId({ id: dataset_id });
+        datasetExtraFiles = datasetExtraFilesStore.getDatasetExtraFiles(dataset_id);
+    }
+
+    if (datasetExtraFiles === null) {
+        return null;
+    }
+
+    const pathDestination: PathDestination = { datasetContent: datasetExtraFiles, isDirectory: false, filepath: path };
+
+    if (path === undefined || path === "undefined") {
+        return pathDestination;
+    }
+
+    const filepath = path;
+
+    const datasetEntry = datasetExtraFiles?.find((entry) => {
+        return filepath === entry.path;
+    });
+
+    if (datasetEntry) {
+        if (datasetEntry.class === "Directory") {
+            pathDestination.isDirectory = true;
+            pathDestination.filepath = filepath;
+            return pathDestination;
+        }
+        pathDestination.fileLink = getCompositeDatasetLink(dataset_id, datasetEntry.path);
+    }
+    return pathDestination;
+}
diff --git a/client/src/components/Grid/GridElements/GridBoolean.vue b/client/src/components/Grid/GridElements/GridBoolean.vue
new file mode 100644
index 000000000000..c98c590290a3
--- /dev/null
+++ b/client/src/components/Grid/GridElements/GridBoolean.vue
@@ -0,0 +1,14 @@
+<script setup lang="ts">
+import { faCheck, faTimes } from "@fortawesome/free-solid-svg-icons";
+
+interface Props {
+    value?: boolean;
+}
+
+defineProps<Props>();
+</script>
+
+<template>
+    <icon v-if="value" :icon="faCheck" />
+    <icon v-else :icon="faTimes" />
+</template>
diff --git a/client/src/components/Grid/GridElements/GridOperations.vue b/client/src/components/Grid/GridElements/GridOperations.vue
index d135109286fc..8f1fae493d6b 100644
--- a/client/src/components/Grid/GridElements/GridOperations.vue
+++ b/client/src/components/Grid/GridElements/GridOperations.vue
@@ -4,12 +4,17 @@ import { faCaretDown } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 
 import type { Operation, RowData } from "@/components/Grid/configs/types";
+import { useConfig } from "@/composables/config";
+import type { GalaxyConfiguration } from "@/stores/configurationStore";
 
 library.add(faCaretDown);
 
+const { config, isConfigLoaded } = useConfig();
+
 interface Props {
     rowData: RowData;
     operations: Array<Operation>;
+    title: string;
 }
 
 const props = defineProps<Props>();
@@ -21,13 +26,13 @@ const emit = defineEmits<{
 /**
  * Availibility of operations might required certain conditions
  */
-function hasCondition(conditionHandler: (rowData: RowData) => Boolean) {
-    return conditionHandler ? conditionHandler(props.rowData) : true;
+function hasCondition(conditionHandler: (rowData: RowData, config: GalaxyConfiguration) => Boolean) {
+    return conditionHandler ? conditionHandler(props.rowData, config) : true;
 }
 </script>
 
 <template>
-    <span>
+    <span v-if="isConfigLoaded">
         <button
             id="grid-operations"
             data-toggle="dropdown"
@@ -35,9 +40,9 @@ function hasCondition(conditionHandler: (rowData: RowData) => Boolean) {
             aria-expanded="false"
             class="ui-link font-weight-bold">
             <FontAwesomeIcon icon="caret-down" class="fa-lg" />
-            <span class="font-weight-bold">{{ rowData.title }}</span>
+            <span class="font-weight-bold">{{ title }}</span>
         </button>
-        <div v-if="operations" class="dropdown-menu" aria-labelledby="dataset-dropdown">
+        <div class="dropdown-menu" aria-labelledby="dataset-dropdown">
             <span v-for="(operation, operationIndex) in operations" :key="operationIndex">
                 <button
                     v-if="operation && operation.condition && hasCondition(operation.condition)"
diff --git a/client/src/components/Grid/GridElements/GridText.vue b/client/src/components/Grid/GridElements/GridText.vue
index 7128471a6ccc..5b6ba76c81bf 100644
--- a/client/src/components/Grid/GridElements/GridText.vue
+++ b/client/src/components/Grid/GridElements/GridText.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 interface Props {
-    text?: string;
+    text?: string | number;
 }
 defineProps<Props>();
 </script>
diff --git a/client/src/components/Grid/GridList.test.js b/client/src/components/Grid/GridList.test.js
index 055e2ea625a1..6ed744727143 100644
--- a/client/src/components/Grid/GridList.test.js
+++ b/client/src/components/Grid/GridList.test.js
@@ -1,15 +1,32 @@
+import { createTestingPinia } from "@pinia/testing";
 import { mount } from "@vue/test-utils";
 import flushPromises from "flush-promises";
+import { PiniaVuePlugin } from "pinia";
 import { getLocalVue } from "tests/jest/helpers";
 
+import { useConfig } from "@/composables/config";
 import Filtering from "@/utils/filtering";
 
 import MountTarget from "./GridList.vue";
 
-const localVue = getLocalVue();
-
 jest.useFakeTimers();
 
+jest.mock("composables/config");
+useConfig.mockReturnValue({
+    config: {
+        value: {
+            disabled: false,
+            enabled: true,
+        },
+    },
+    isConfigLoaded: true,
+});
+
+jest.mock("vue-router/composables");
+
+const localVue = getLocalVue();
+localVue.use(PiniaVuePlugin);
+
 const testGrid = {
     actions: [
         {
@@ -33,24 +50,24 @@ const testGrid = {
             key: "operation",
             title: "operation",
             type: "operations",
-            condition: jest.fn(),
+            condition: jest.fn(() => true),
             operations: [
                 {
                     title: "operation-title-1",
                     icon: "operation-icon-1",
-                    condition: () => true,
+                    condition: (_, config) => config.value.enabled,
                     handler: jest.fn(),
                 },
                 {
                     title: "operation-title-2",
                     icon: "operation-icon-2",
-                    condition: () => false,
+                    condition: (_, config) => config.value.disabled,
                     handler: jest.fn(),
                 },
                 {
                     title: "operation-title-3",
                     icon: "operation-icon-3",
-                    condition: () => true,
+                    condition: (_, config) => config.value.enabled,
                     handler: () => ({
                         status: "success",
                         message: "Operation-3 has been executed.",
@@ -79,9 +96,11 @@ const testGrid = {
 };
 
 function createTarget(propsData) {
+    const pinia = createTestingPinia({ stubActions: false });
     return mount(MountTarget, {
         localVue,
         propsData,
+        pinia,
         stubs: {
             Icon: true,
         },
@@ -91,7 +110,7 @@ function createTarget(propsData) {
 describe("GridList", () => {
     it("basic rendering", async () => {
         const wrapper = createTarget({
-            config: testGrid,
+            gridConfig: testGrid,
         });
         const findInput = wrapper.find("[data-description='filter text input']");
         expect(findInput.attributes().placeholder).toBe("search tests");
@@ -123,7 +142,7 @@ describe("GridList", () => {
 
     it("header rendering", async () => {
         const wrapper = createTarget({
-            config: testGrid,
+            gridConfig: testGrid,
         });
         await wrapper.vm.$nextTick();
         for (const [fieldIndex, field] of Object.entries(testGrid.fields)) {
@@ -133,7 +152,7 @@ describe("GridList", () => {
 
     it("operation handling", async () => {
         const wrapper = createTarget({
-            config: testGrid,
+            gridConfig: testGrid,
         });
         await wrapper.vm.$nextTick();
         const dropdown = wrapper.find("[data-description='grid cell 0-2']");
@@ -155,7 +174,7 @@ describe("GridList", () => {
 
     it("filter handling", async () => {
         const wrapper = createTarget({
-            config: testGrid,
+            gridConfig: testGrid,
         });
         await wrapper.vm.$nextTick();
         const filterInput = wrapper.find("[data-description='filter text input']");
@@ -168,7 +187,7 @@ describe("GridList", () => {
 
     it("pagination", async () => {
         const wrapper = createTarget({
-            config: testGrid,
+            gridConfig: testGrid,
             limit: 2,
         });
         await wrapper.vm.$nextTick();
diff --git a/client/src/components/Grid/GridList.vue b/client/src/components/Grid/GridList.vue
index 16254deeec9a..c5de3f921608 100644
--- a/client/src/components/Grid/GridList.vue
+++ b/client/src/components/Grid/GridList.vue
@@ -1,14 +1,15 @@
 <script setup lang="ts">
 import { library } from "@fortawesome/fontawesome-svg-core";
-import { faCaretDown, faCaretUp } from "@fortawesome/free-solid-svg-icons";
+import { faCaretDown, faCaretUp, faShieldAlt } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 import { useDebounceFn, useEventBus } from "@vueuse/core";
 import { BAlert, BButton, BLink, BPagination } from "bootstrap-vue";
 import { computed, onMounted, onUnmounted, ref, watch } from "vue";
 import { useRouter } from "vue-router/composables";
 
-import { Config, FieldHandler, Operation, RowData } from "./configs/types";
+import { FieldHandler, GridConfig, Operation, RowData } from "./configs/types";
 
+import GridBoolean from "./GridElements/GridBoolean.vue";
 import GridLink from "./GridElements/GridLink.vue";
 import GridOperations from "./GridElements/GridOperations.vue";
 import GridText from "./GridElements/GridText.vue";
@@ -21,11 +22,13 @@ import UtcDate from "@/components/UtcDate.vue";
 const eventBus = useEventBus<string>("grid-router-push");
 const router = useRouter();
 
-library.add(faCaretDown, faCaretUp);
+library.add(faCaretDown, faCaretUp, faShieldAlt);
 
 interface Props {
     // provide a grid configuration
-    config: Config;
+    gridConfig: GridConfig;
+    // incoming initial message
+    gridMessage?: string;
     // debounce delay
     delay?: number;
     // rows per page to be shown
@@ -56,8 +59,8 @@ const loading = ref(true);
 const isAvailable = computed(() => !loading.value && totalRows.value > 0);
 
 // sort references
-const sortBy = ref(props.config ? props.config.sortBy : "");
-const sortDesc = ref(props.config ? props.config.sortDesc : false);
+const sortBy = ref(props.gridConfig ? props.gridConfig.sortBy : "");
+const sortDesc = ref(props.gridConfig ? props.gridConfig.sortDesc : false);
 
 // filtering refs and handlers
 const filterText = ref("");
@@ -73,21 +76,31 @@ const hideMessage = useDebounceFn(() => {
  * Manually set filter value, used for tags and `SharingIndicators`
  */
 function applyFilter(filter: string, value: string | boolean, quoted = false) {
-    const filtering = props.config?.filtering;
+    const filtering = props.gridConfig?.filtering;
     const quotedValue = quoted ? `'${value}'` : value;
     if (filtering) {
         filterText.value = filtering.setFilterValue(filterText.value, filter, quotedValue.toString()) || "";
     }
 }
 
+/**
+ * Display initial message parsed through route query
+ */
+function displayInitialMessage() {
+    if (props.gridMessage) {
+        operationMessage.value = props.gridMessage;
+        operationStatus.value = "success";
+    }
+}
+
 /**
  * Request grid data
  */
 async function getGridData() {
-    if (props.config) {
+    if (props.gridConfig) {
         try {
             const offset = props.limit * (currentPage.value - 1);
-            const [responseData, responseTotal] = await props.config.getData(
+            const [responseData, responseTotal] = await props.gridConfig.getData(
                 offset,
                 props.limit,
                 searchTerm.value,
@@ -163,6 +176,7 @@ function onFilter(filter?: string) {
 onMounted(() => {
     getGridData();
     eventBus.on(onRouterPush);
+    displayInitialMessage();
 });
 
 onUnmounted(() => {
@@ -183,19 +197,19 @@ watch(operationMessage, () => {
 </script>
 
 <template>
-    <div class="d-flex flex-column overflow-auto">
+    <div :id="gridConfig.id" class="d-flex flex-column overflow-auto">
         <BAlert v-if="!!errorMessage" variant="danger" show>{{ errorMessage }}</BAlert>
         <BAlert v-if="!!operationMessage" :variant="operationStatus" fade show>{{ operationMessage }}</BAlert>
         <div class="grid-header d-flex justify-content-between pb-2">
             <div>
                 <h1 class="m-0" data-description="grid title">
-                    {{ config.title }}
+                    {{ gridConfig.title }}
                 </h1>
                 <FilterMenu
                     class="py-2"
-                    :name="config.plural"
-                    :placeholder="`search ${config.plural.toLowerCase()}`"
-                    :filter-class="config.filtering"
+                    :name="gridConfig.plural"
+                    :placeholder="`search ${gridConfig.plural.toLowerCase()}`"
+                    :filter-class="gridConfig.filtering"
                     :filter-text.sync="filterText"
                     :loading="loading"
                     :show-advanced.sync="showAdvanced"
@@ -204,7 +218,7 @@ watch(operationMessage, () => {
             </div>
             <div v-if="!showAdvanced" class="py-3">
                 <BButton
-                    v-for="(action, actionIndex) in config.actions"
+                    v-for="(action, actionIndex) in gridConfig.actions"
                     :key="actionIndex"
                     class="m-1"
                     size="sm"
@@ -218,20 +232,20 @@ watch(operationMessage, () => {
         </div>
         <LoadingSpan v-if="loading" />
         <BAlert v-else-if="!isAvailable" variant="info" show>
-            <span v-if="searchTerm" v-localize>
-                No entries found for: <b>{{ searchTerm }}</b
-                >.
+            <span v-if="searchTerm">
+                <span v-localize>Nothing found with:</span>
+                <b>{{ searchTerm }}</b>
             </span>
             <span v-else v-localize> No entries found. </span>
         </BAlert>
         <table v-else class="grid-table">
             <thead>
                 <th
-                    v-for="(fieldEntry, fieldIndex) in config.fields"
+                    v-for="(fieldEntry, fieldIndex) in gridConfig.fields"
                     :key="fieldIndex"
                     class="text-nowrap px-2"
                     :data-description="`grid header ${fieldIndex}`">
-                    <span v-if="config.sortKeys.includes(fieldEntry.key)">
+                    <span v-if="gridConfig.sortKeys.includes(fieldEntry.key)">
                         <BLink @click="onSort(fieldEntry.key)">
                             <span>{{ fieldEntry.title || fieldEntry.key }}</span>
                             <span v-if="sortBy === fieldEntry.key">
@@ -245,34 +259,40 @@ watch(operationMessage, () => {
             </thead>
             <tr v-for="(rowData, rowIndex) in gridData" :key="rowIndex" :class="{ 'grid-dark-row': rowIndex % 2 }">
                 <td
-                    v-for="(fieldEntry, fieldIndex) in config.fields"
+                    v-for="(fieldEntry, fieldIndex) in gridConfig.fields"
                     :key="fieldIndex"
                     class="px-2 py-3"
-                    :style="{ width: `${fieldEntry.width}%` }"
-                    :data-description="`grid cell ${rowIndex}-${fieldIndex}`">
-                    <GridOperations
-                        v-if="fieldEntry.type == 'operations' && fieldEntry.operations"
-                        :operations="fieldEntry.operations"
-                        :row-data="rowData"
-                        @execute="onOperation($event, rowData)" />
-                    <GridText v-else-if="fieldEntry.type == 'text'" :text="rowData[fieldEntry.key]" />
-                    <GridLink
-                        v-else-if="fieldEntry.type == 'link'"
-                        :text="rowData[fieldEntry.key]"
-                        @click="fieldEntry.handler && fieldEntry.handler(rowData)" />
-                    <SharingIndicators
-                        v-else-if="fieldEntry.type == 'sharing'"
-                        :object="rowData"
-                        @filter="onFilter($event)" />
-                    <UtcDate v-else-if="fieldEntry.type == 'date'" :date="rowData[fieldEntry.key]" mode="elapsed" />
-                    <StatelessTags
-                        v-else-if="fieldEntry.type == 'tags'"
-                        clickable
-                        :value="rowData[fieldEntry.key]"
-                        :disabled="fieldEntry.disabled"
-                        @input="onTagInput(rowData, $event, fieldEntry.handler)"
-                        @tag-click="applyFilter('tag', $event, true)" />
-                    <span v-else v-localize> Data not available. </span>
+                    :style="{ width: `${fieldEntry.width}%` }">
+                    <div
+                        v-if="!fieldEntry.condition || fieldEntry.condition(rowData)"
+                        :data-description="`grid cell ${rowIndex}-${fieldIndex}`">
+                        <GridOperations
+                            v-if="fieldEntry.type == 'operations' && fieldEntry.operations"
+                            :operations="fieldEntry.operations"
+                            :row-data="rowData"
+                            :title="rowData[fieldEntry.key]"
+                            @execute="onOperation($event, rowData)" />
+                        <GridBoolean v-else-if="fieldEntry.type == 'boolean'" :value="rowData[fieldEntry.key]" />
+                        <GridText v-else-if="fieldEntry.type == 'text'" :text="rowData[fieldEntry.key]" />
+                        <GridLink
+                            v-else-if="fieldEntry.type == 'link'"
+                            :text="rowData[fieldEntry.key]"
+                            @click="fieldEntry.handler && fieldEntry.handler(rowData)" />
+                        <SharingIndicators
+                            v-else-if="fieldEntry.type == 'sharing'"
+                            :object="rowData"
+                            @filter="onFilter($event)" />
+                        <UtcDate v-else-if="fieldEntry.type == 'date'" :date="rowData[fieldEntry.key]" mode="elapsed" />
+                        <StatelessTags
+                            v-else-if="fieldEntry.type == 'tags'"
+                            clickable
+                            :value="rowData[fieldEntry.key]"
+                            :disabled="fieldEntry.disabled"
+                            @input="onTagInput(rowData, $event, fieldEntry.handler)"
+                            @tag-click="applyFilter('tag', $event, true)" />
+                        <span v-else v-localize> Not available. </span>
+                    </div>
+                    <FontAwesomeIcon v-else icon="fa-shield-alt" />
                 </td>
             </tr>
         </table>
diff --git a/client/src/components/Grid/configs/adminGroups.ts b/client/src/components/Grid/configs/adminGroups.ts
new file mode 100644
index 000000000000..495d73f2fb42
--- /dev/null
+++ b/client/src/components/Grid/configs/adminGroups.ts
@@ -0,0 +1,181 @@
+import { faEdit, faKey, faPlus, faTrash, faTrashRestore } from "@fortawesome/free-solid-svg-icons";
+import { useEventBus } from "@vueuse/core";
+import axios from "axios";
+
+import { deleteGroup, purgeGroup, undeleteGroup } from "@/api/groups";
+import Filtering, { contains, equals, toBool, type ValidFilter } from "@/utils/filtering";
+import _l from "@/utils/localization";
+import { withPrefix } from "@/utils/redirect";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import type { ActionArray, FieldArray, GridConfig } from "./types";
+
+const { emit } = useEventBus<string>("grid-router-push");
+
+/**
+ * Local types
+ */
+type GroupEntry = Record<string, unknown>;
+
+/**
+ * Request and return data from server
+ */
+async function getData(offset: number, limit: number, search: string, sort_by: string, sort_desc: boolean) {
+    const query = {
+        limit: String(limit),
+        offset: String(offset),
+        search: search,
+        sort_by: sort_by,
+        sort_desc: String(sort_desc),
+    };
+    const queryString = new URLSearchParams(query).toString();
+    const { data } = await axios.get(withPrefix(`/admin/groups_list?${queryString}`));
+    return [data.rows, data.rows_total];
+}
+
+/**
+ * Actions are grid-wide operations
+ */
+const actions: ActionArray = [
+    {
+        title: "Create New Group",
+        icon: faPlus,
+        handler: () => {
+            emit("/admin/form/create_group");
+        },
+    },
+];
+
+/**
+ * Declare columns to be displayed
+ */
+const fields: FieldArray = [
+    {
+        key: "name",
+        title: "Name",
+        type: "operations",
+        operations: [
+            {
+                title: "Edit Name",
+                icon: faEdit,
+                condition: (data: GroupEntry) => !data.deleted,
+                handler: (data: GroupEntry) => {
+                    emit(`/admin/form/rename_group?id=${data.id}`);
+                },
+            },
+            {
+                title: "Edit Permissions",
+                icon: faKey,
+                condition: (data: GroupEntry) => !data.deleted,
+                handler: (data: GroupEntry) => {
+                    emit(`/admin/form/manage_users_and_roles_for_group?id=${data.id}`);
+                },
+            },
+            {
+                title: "Delete",
+                icon: faTrash,
+                condition: (data: GroupEntry) => !data.deleted,
+                handler: async (data: GroupEntry) => {
+                    if (confirm(_l("Are you sure that you want to delete this group?"))) {
+                        try {
+                            await deleteGroup({ group_id: String(data.id) });
+                            return {
+                                status: "success",
+                                message: `'${data.name}' has been deleted.`,
+                            };
+                        } catch (e) {
+                            return {
+                                status: "danger",
+                                message: `Failed to delete '${data.name}': ${errorMessageAsString(e)}`,
+                            };
+                        }
+                    }
+                },
+            },
+            {
+                title: "Purge",
+                icon: faTrash,
+                condition: (data: GroupEntry) => !!data.deleted,
+                handler: async (data: GroupEntry) => {
+                    if (confirm(_l("Are you sure that you want to purge this group?"))) {
+                        try {
+                            await purgeGroup({ group_id: String(data.id) });
+                            return {
+                                status: "success",
+                                message: `'${data.name}' has been purged.`,
+                            };
+                        } catch (e) {
+                            return {
+                                status: "danger",
+                                message: `Failed to purge '${data.name}': ${errorMessageAsString(e)}`,
+                            };
+                        }
+                    }
+                },
+            },
+            {
+                title: "Restore",
+                icon: faTrashRestore,
+                condition: (data: GroupEntry) => !!data.deleted,
+                handler: async (data: GroupEntry) => {
+                    try {
+                        await undeleteGroup({ group_id: String(data.id) });
+                        return {
+                            status: "success",
+                            message: `'${data.name}' has been restored.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to restore '${data.name}': ${errorMessageAsString(e)}`,
+                        };
+                    }
+                },
+            },
+        ],
+    },
+    {
+        key: "roles",
+        title: "Roles",
+        type: "text",
+    },
+    {
+        key: "users",
+        title: "Users",
+        type: "text",
+    },
+    {
+        key: "update_time",
+        title: "Updated",
+        type: "date",
+    },
+];
+
+const validFilters: Record<string, ValidFilter<string | boolean | undefined>> = {
+    name: { placeholder: "name", type: String, handler: contains("name"), menuItem: true },
+    deleted: {
+        placeholder: "Filter on deleted entries",
+        type: Boolean,
+        boolType: "is",
+        handler: equals("deleted", "deleted", toBool),
+        menuItem: true,
+    },
+};
+
+/**
+ * Grid configuration
+ */
+const gridConfig: GridConfig = {
+    id: "groups-grid",
+    actions: actions,
+    fields: fields,
+    filtering: new Filtering(validFilters, undefined, false, false),
+    getData: getData,
+    plural: "Groups",
+    sortBy: "name",
+    sortDesc: true,
+    sortKeys: ["name", "update_time"],
+    title: "Groups",
+};
+
+export default gridConfig;
diff --git a/client/src/components/Grid/configs/adminRoles.ts b/client/src/components/Grid/configs/adminRoles.ts
new file mode 100644
index 000000000000..f1f08012c326
--- /dev/null
+++ b/client/src/components/Grid/configs/adminRoles.ts
@@ -0,0 +1,192 @@
+import { faEdit, faKey, faPlus, faTrash, faTrashRestore } from "@fortawesome/free-solid-svg-icons";
+import { useEventBus } from "@vueuse/core";
+import axios from "axios";
+
+import { deleteRole, purgeRole, undeleteRole } from "@/api/roles";
+import Filtering, { contains, equals, toBool, type ValidFilter } from "@/utils/filtering";
+import _l from "@/utils/localization";
+import { withPrefix } from "@/utils/redirect";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import type { ActionArray, FieldArray, GridConfig } from "./types";
+
+const { emit } = useEventBus<string>("grid-router-push");
+
+/**
+ * Local types
+ */
+type RoleEntry = Record<string, unknown>;
+
+/**
+ * Request and return data from server
+ */
+async function getData(offset: number, limit: number, search: string, sort_by: string, sort_desc: boolean) {
+    const query = {
+        limit: String(limit),
+        offset: String(offset),
+        search: search,
+        sort_by: sort_by,
+        sort_desc: String(sort_desc),
+    };
+    const queryString = new URLSearchParams(query).toString();
+    const { data } = await axios.get(withPrefix(`/admin/roles_list?${queryString}`));
+    return [data.rows, data.rows_total];
+}
+
+/**
+ * Actions are grid-wide operations
+ */
+const actions: ActionArray = [
+    {
+        title: "Create New Role",
+        icon: faPlus,
+        handler: () => {
+            emit("/admin/form/create_role");
+        },
+    },
+];
+
+/**
+ * Declare columns to be displayed
+ */
+const fields: FieldArray = [
+    {
+        key: "name",
+        title: "Name",
+        type: "operations",
+        operations: [
+            {
+                title: "Edit Name/Description",
+                icon: faEdit,
+                condition: (data: RoleEntry) => !data.deleted,
+                handler: (data: RoleEntry) => {
+                    emit(`/admin/form/rename_role?id=${data.id}`);
+                },
+            },
+            {
+                title: "Edit Permissions",
+                icon: faKey,
+                condition: (data: RoleEntry) => !data.deleted,
+                handler: (data: RoleEntry) => {
+                    emit(`/admin/form/manage_users_and_groups_for_role?id=${data.id}`);
+                },
+            },
+            {
+                title: "Delete",
+                icon: faTrash,
+                condition: (data: RoleEntry) => !data.deleted,
+                handler: async (data: RoleEntry) => {
+                    if (confirm(_l("Are you sure that you want to delete this role?"))) {
+                        try {
+                            await deleteRole({ id: String(data.id) });
+                            return {
+                                status: "success",
+                                message: `'${data.name}' has been deleted.`,
+                            };
+                        } catch (e) {
+                            return {
+                                status: "danger",
+                                message: `Failed to delete '${data.name}': ${errorMessageAsString(e)}`,
+                            };
+                        }
+                    }
+                },
+            },
+            {
+                title: "Purge",
+                icon: faTrash,
+                condition: (data: RoleEntry) => !!data.deleted,
+                handler: async (data: RoleEntry) => {
+                    if (confirm(_l("Are you sure that you want to purge this role?"))) {
+                        try {
+                            await purgeRole({ id: String(data.id) });
+                            return {
+                                status: "success",
+                                message: `'${data.name}' has been purged.`,
+                            };
+                        } catch (e) {
+                            return {
+                                status: "danger",
+                                message: `Failed to purge '${data.name}': ${errorMessageAsString(e)}`,
+                            };
+                        }
+                    }
+                },
+            },
+            {
+                title: "Restore",
+                icon: faTrashRestore,
+                condition: (data: RoleEntry) => !!data.deleted,
+                handler: async (data: RoleEntry) => {
+                    try {
+                        await undeleteRole({ id: String(data.id) });
+                        return {
+                            status: "success",
+                            message: `'${data.name}' has been restored.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to restore '${data.name}': ${errorMessageAsString(e)}`,
+                        };
+                    }
+                },
+            },
+        ],
+    },
+    {
+        key: "description",
+        title: "Description",
+        type: "text",
+    },
+    {
+        key: "type",
+        title: "Type",
+        type: "text",
+    },
+    {
+        key: "groups",
+        title: "Groups",
+        type: "text",
+    },
+    {
+        key: "users",
+        title: "Users",
+        type: "text",
+    },
+    {
+        key: "update_time",
+        title: "Updated",
+        type: "date",
+    },
+];
+
+const validFilters: Record<string, ValidFilter<string | boolean | undefined>> = {
+    name: { placeholder: "name", type: String, handler: contains("name"), menuItem: true },
+    description: { placeholder: "description", type: String, handler: contains("description"), menuItem: true },
+    deleted: {
+        placeholder: "Filter on deleted entries",
+        type: Boolean,
+        boolType: "is",
+        handler: equals("deleted", "deleted", toBool),
+        menuItem: true,
+    },
+};
+
+/**
+ * Grid configuration
+ */
+const gridConfig: GridConfig = {
+    id: "roles-grid",
+    actions: actions,
+    fields: fields,
+    filtering: new Filtering(validFilters, undefined, false, false),
+    getData: getData,
+    plural: "Roles",
+    sortBy: "name",
+    sortDesc: true,
+    sortKeys: ["description", "name", "update_time"],
+    title: "Roles",
+};
+
+export default gridConfig;
diff --git a/client/src/components/Grid/configs/adminUsers.test.js b/client/src/components/Grid/configs/adminUsers.test.js
new file mode 100644
index 000000000000..f10d62a77e2f
--- /dev/null
+++ b/client/src/components/Grid/configs/adminUsers.test.js
@@ -0,0 +1,52 @@
+import adminUsers from "./adminUsers";
+
+describe("AdminUsers", () => {
+    it("configuration", async () => {
+        const fields = adminUsers.fields;
+        expect(fields.length).toBe(10);
+        const fieldEmail = fields[0];
+        expect(fieldEmail.key).toBe("email");
+        expect(fieldEmail.type).toBe("operations");
+        for (const purged of [true, false]) {
+            expect(fieldEmail.condition({ purged })).toBe(!purged);
+        }
+        const ops = fieldEmail.operations;
+        const titles = [
+            "Information",
+            "Roles",
+            "Reset",
+            "Recalculate",
+            "Activate",
+            "Send",
+            "Key",
+            "Impersonate",
+            "Delete",
+            "Purge",
+            "Restore",
+        ];
+        titles.forEach((title, index) => {
+            expect(ops[index].title).toContain(title);
+        });
+        for (const a of [true, false]) {
+            expect(ops[0].condition({ deleted: !a })).toBe(a);
+            expect(ops[1].condition({ deleted: !a })).toBe(a);
+            expect(ops[2].condition({ deleted: !a })).toBe(a);
+            expect(ops[3].condition({ deleted: !a })).toBe(a);
+            expect(ops[6].condition({ deleted: !a })).toBe(a);
+            for (const b of [true, false]) {
+                expect(ops[4].condition({ deleted: !a }, { value: { user_activation_on: b } })).toBe(a && b);
+                expect(ops[5].condition({ deleted: !a }, { value: { user_activation_on: b } })).toBe(a && b);
+                expect(ops[7].condition({ deleted: !a }, { value: { allow_user_impersonation: b } })).toBe(a && b);
+                expect(ops[8].condition({ deleted: !a }, { value: { allow_user_deletion: b } })).toBe(a && b);
+                for (const c of [true, false]) {
+                    expect(ops[9].condition({ deleted: a, purged: !b }, { value: { allow_user_deletion: c } })).toBe(
+                        a && b && c
+                    );
+                    expect(ops[10].condition({ deleted: a, purged: !b }, { value: { allow_user_deletion: c } })).toBe(
+                        a && b && c
+                    );
+                }
+            }
+        }
+    });
+});
diff --git a/client/src/components/Grid/configs/adminUsers.ts b/client/src/components/Grid/configs/adminUsers.ts
new file mode 100644
index 000000000000..d4e0158e2817
--- /dev/null
+++ b/client/src/components/Grid/configs/adminUsers.ts
@@ -0,0 +1,339 @@
+import {
+    faBolt,
+    faCalculator,
+    faEnvelope,
+    faKey,
+    faMask,
+    faPlus,
+    faTrash,
+    faTrashRestore,
+    faUnlock,
+    faUser,
+    faUsers,
+} from "@fortawesome/free-solid-svg-icons";
+import { useEventBus } from "@vueuse/core";
+import axios from "axios";
+
+import { createApiKey, deleteUser, recalculateDiskUsageByUserId, sendActivationEmail, undeleteUser } from "@/api/users";
+import type { GalaxyConfiguration } from "@/stores/configurationStore";
+import Filtering, { contains, equals, toBool, type ValidFilter } from "@/utils/filtering";
+import { withPrefix } from "@/utils/redirect";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import type { ActionArray, FieldArray, GridConfig } from "./types";
+
+const { emit } = useEventBus<string>("grid-router-push");
+
+/**
+ * Local types
+ */
+type UserEntry = Record<string, unknown>;
+
+/**
+ * Request and return data from server
+ */
+async function getData(offset: number, limit: number, search: string, sort_by: string, sort_desc: boolean) {
+    const query = {
+        limit: String(limit),
+        offset: String(offset),
+        search: search,
+        sort_by: sort_by,
+        sort_desc: String(sort_desc),
+    };
+    const queryString = new URLSearchParams(query).toString();
+    const { data } = await axios.get(withPrefix(`/admin/users_list?${queryString}`));
+    return [data.rows, data.rows_total];
+}
+
+/**
+ * Actions are grid-wide operations
+ */
+const actions: ActionArray = [
+    {
+        title: "Create New User",
+        icon: faPlus,
+        handler: () => {
+            emit("/admin/users/create");
+        },
+    },
+];
+
+/**
+ * Declare columns to be displayed
+ */
+const fields: FieldArray = [
+    {
+        key: "email",
+        title: "Email",
+        type: "operations",
+        condition: (data: UserEntry) => !data.purged,
+        operations: [
+            {
+                title: "Manage Information",
+                icon: faUser,
+                condition: (data: UserEntry) => !data.deleted,
+                handler: (data: UserEntry) => {
+                    emit(`/user/information?id=${data.id}`);
+                },
+            },
+            {
+                title: "Manage Roles and Groups",
+                icon: faUsers,
+                condition: (data: UserEntry) => !data.deleted,
+                handler: (data: UserEntry) => {
+                    emit(`/admin/form/manage_roles_and_groups_for_user?id=${data.id}`);
+                },
+            },
+            {
+                title: "Reset Password",
+                icon: faUnlock,
+                condition: (data: UserEntry) => !data.deleted,
+                handler: (data: UserEntry) => {
+                    emit(`/admin/form/reset_user_password?id=${data.id}`);
+                },
+            },
+            {
+                title: "Recalculate Disk Usage",
+                icon: faCalculator,
+                condition: (data: UserEntry) => !data.deleted,
+                handler: async (data: UserEntry) => {
+                    try {
+                        await recalculateDiskUsageByUserId({ user_id: String(data.id) });
+                        return {
+                            status: "success",
+                            message: `Disk usage of '${data.username}' has been recalculated.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to recalculate disk usage of '${data.username}': ${errorMessageAsString(
+                                e
+                            )}.`,
+                        };
+                    }
+                },
+            },
+            {
+                title: "Activate",
+                icon: faBolt,
+                condition: (data: UserEntry, config: GalaxyConfiguration) => {
+                    return config.value.user_activation_on && !data.deleted;
+                },
+                handler: async (data: UserEntry) => {
+                    try {
+                        await axios.put(withPrefix(`/api/users/${data.id}`), { active: true });
+                        return {
+                            status: "success",
+                            message: `'${data.username}' has been activated.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to activate '${data.username}': ${errorMessageAsString(e)}.`,
+                        };
+                    }
+                },
+            },
+            {
+                title: "Send Activation Email",
+                icon: faEnvelope,
+                condition: (data: UserEntry, config: GalaxyConfiguration) => {
+                    return config.value.user_activation_on && !data.deleted;
+                },
+                handler: async (data: UserEntry) => {
+                    try {
+                        await sendActivationEmail({ user_id: String(data.id) });
+                        return {
+                            status: "success",
+                            message: `Activation email has been sent to '${data.username}'.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to send activation email to '${data.username}': ${errorMessageAsString(
+                                e
+                            )}.`,
+                        };
+                    }
+                },
+            },
+            {
+                title: "Generate New API Key",
+                icon: faKey,
+                condition: (data: UserEntry) => !data.deleted,
+                handler: async (data: UserEntry) => {
+                    try {
+                        await createApiKey({ user_id: String(data.id) });
+                        return {
+                            status: "success",
+                            message: `New API Key for '${data.username}' has been generated.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to generate new API Key for '${data.username}': ${errorMessageAsString(
+                                e
+                            )}.`,
+                        };
+                    }
+                },
+            },
+            {
+                title: "Impersonate User",
+                icon: faMask,
+                condition: (data: UserEntry, config: GalaxyConfiguration) => {
+                    return config.value.allow_user_impersonation && !data.deleted;
+                },
+                handler: (data: UserEntry) => {
+                    window.location.href = withPrefix(`/admin/impersonate?id=${String(data.id)}`);
+                },
+            },
+            {
+                title: "Delete",
+                icon: faTrash,
+                condition: (data: UserEntry, config: GalaxyConfiguration) => {
+                    return config.value.allow_user_deletion && !data.deleted;
+                },
+                handler: async (data: UserEntry) => {
+                    try {
+                        await deleteUser({ user_id: String(data.id), purge: false });
+                        return {
+                            status: "success",
+                            message: `'${data.username}' has been deleted.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to delete '${data.username}': ${errorMessageAsString(e)}`,
+                        };
+                    }
+                },
+            },
+            {
+                title: "Purge",
+                icon: faTrash,
+                condition: (data: UserEntry, config: GalaxyConfiguration) => {
+                    return config.value.allow_user_deletion && data.deleted && !data.purged;
+                },
+                handler: async (data: UserEntry) => {
+                    try {
+                        await deleteUser({ user_id: String(data.id), purge: true });
+                        return {
+                            status: "success",
+                            message: `'${data.username}' has been purged.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to purge '${data.username}': ${errorMessageAsString(e)}`,
+                        };
+                    }
+                },
+            },
+            {
+                title: "Restore",
+                icon: faTrashRestore,
+                condition: (data: UserEntry, config: GalaxyConfiguration) => {
+                    return config.value.allow_user_deletion && data.deleted && !data.purged;
+                },
+                handler: async (data: UserEntry) => {
+                    try {
+                        await undeleteUser({ user_id: String(data.id) });
+                        return {
+                            status: "success",
+                            message: `'${data.username}' has been restored.`,
+                        };
+                    } catch (e) {
+                        return {
+                            status: "danger",
+                            message: `Failed to restore '${data.username}': ${errorMessageAsString(e)}`,
+                        };
+                    }
+                },
+            },
+        ],
+    },
+    {
+        key: "username",
+        title: "Username",
+        type: "text",
+        condition: (data: UserEntry) => !data.purged,
+    },
+    {
+        key: "last_login",
+        title: "Last Login",
+        type: "text",
+    },
+    {
+        key: "disk_usage",
+        title: "Disk Usage",
+        type: "text",
+    },
+    {
+        key: "status",
+        title: "Status",
+        type: "text",
+    },
+    {
+        key: "create_time",
+        title: "Created",
+        type: "date",
+    },
+    {
+        key: "active",
+        title: "Active",
+        type: "boolean",
+    },
+    {
+        key: "groups",
+        title: "Groups",
+        type: "text",
+    },
+    {
+        key: "roles",
+        title: "Roles",
+        type: "text",
+    },
+    {
+        key: "external",
+        title: "External",
+        type: "boolean",
+    },
+];
+
+const validFilters: Record<string, ValidFilter<string | boolean | undefined>> = {
+    email: { placeholder: "email", type: String, handler: contains("email"), menuItem: true },
+    username: { placeholder: "username", type: String, handler: contains("username"), menuItem: true },
+    deleted: {
+        placeholder: "Filter on deleted users",
+        type: Boolean,
+        boolType: "is",
+        handler: equals("deleted", "deleted", toBool),
+        menuItem: true,
+    },
+    purged: {
+        placeholder: "Filter on purged users",
+        type: Boolean,
+        boolType: "is",
+        handler: equals("purged", "purged", toBool),
+        menuItem: true,
+    },
+};
+
+/**
+ * Grid configuration
+ */
+const gridConfig: GridConfig = {
+    id: "users-grid",
+    actions: actions,
+    fields: fields,
+    filtering: new Filtering(validFilters, undefined, false, false),
+    getData: getData,
+    plural: "Users",
+    sortBy: "email",
+    sortDesc: true,
+    sortKeys: ["active", "create_time", "disk_usage", "email", "external", "last_login", "status", "username"],
+    title: "Users",
+};
+
+export default gridConfig;
diff --git a/client/src/components/Grid/configs/types.ts b/client/src/components/Grid/configs/types.ts
index 2fc41e04a35d..95385c56351d 100644
--- a/client/src/components/Grid/configs/types.ts
+++ b/client/src/components/Grid/configs/types.ts
@@ -1,5 +1,6 @@
 import { IconDefinition } from "@fortawesome/fontawesome-svg-core";
 
+import type { GalaxyConfiguration } from "@/stores/configurationStore";
 import Filtering from "@/utils/filtering";
 
 export interface Action {
@@ -10,7 +11,8 @@ export interface Action {
 
 export type ActionArray = Array<Action>;
 
-export interface Config {
+export interface GridConfig {
+    id: string;
     actions?: ActionArray;
     fields: FieldArray;
     filtering: Filtering<any>;
@@ -40,7 +42,7 @@ export type FieldHandler = (data: RowData) => void;
 export interface Operation {
     title: string;
     icon: IconDefinition;
-    condition?: (data: RowData) => boolean;
+    condition?: (data: RowData, config: GalaxyConfiguration) => boolean;
     handler: (data: RowData) => OperationHandlerReturn;
 }
 
@@ -53,4 +55,4 @@ type OperationHandlerReturn = Promise<OperationHandlerMessage> | void;
 
 export type RowData = Record<string, unknown>;
 
-type validTypes = "date" | "link" | "operations" | "sharing" | "tags" | "text";
+type validTypes = "boolean" | "date" | "link" | "operations" | "sharing" | "tags" | "text";
diff --git a/client/src/components/Grid/configs/visualizations.ts b/client/src/components/Grid/configs/visualizations.ts
index 1e84d36eaca0..61a1f947a4cf 100644
--- a/client/src/components/Grid/configs/visualizations.ts
+++ b/client/src/components/Grid/configs/visualizations.ts
@@ -8,7 +8,7 @@ import Filtering, { contains, equals, expandNameTag, toBool, type ValidFilter }
 import { withPrefix } from "@/utils/redirect";
 import { errorMessageAsString, rethrowSimple } from "@/utils/simple-error";
 
-import type { ActionArray, Config, FieldArray } from "./types";
+import type { ActionArray, FieldArray, GridConfig } from "./types";
 
 const { emit } = useEventBus<string>("grid-router-push");
 
@@ -237,7 +237,8 @@ const validFilters: Record<string, ValidFilter<string | boolean | undefined>> =
 /**
  * Grid configuration
  */
-const config: Config = {
+const gridConfig: GridConfig = {
+    id: "visualizations-grid",
     actions: actions,
     fields: fields,
     filtering: new Filtering(validFilters, undefined, false, false),
@@ -248,4 +249,5 @@ const config: Config = {
     sortKeys: ["create_time", "title", "update_time"],
     title: "Saved Visualizations",
 };
-export default config;
+
+export default gridConfig;
diff --git a/client/src/components/Grid/configs/visualizationsPublished.ts b/client/src/components/Grid/configs/visualizationsPublished.ts
index 0be07fb90dbe..5c37ee06cdf9 100644
--- a/client/src/components/Grid/configs/visualizationsPublished.ts
+++ b/client/src/components/Grid/configs/visualizationsPublished.ts
@@ -2,6 +2,8 @@ import { fetcher } from "@/api/schema";
 import Filtering, { contains, expandNameTag, type ValidFilter } from "@/utils/filtering";
 import { withPrefix } from "@/utils/redirect";
 
+import type { FieldArray, GridConfig } from "./types";
+
 /**
  * Api endpoint handlers
  */
@@ -34,12 +36,12 @@ async function getData(offset: number, limit: number, search: string, sort_by: s
 /**
  * Declare columns to be displayed
  */
-const fields = [
+const fields: FieldArray = [
     {
         title: "Title",
         key: "title",
         type: "link",
-        width: "30%",
+        width: 30,
         handler: (data: VisualizationEntry) => {
             window.location.href = withPrefix(`/plugins/visualizations/${data.type}/saved?id=${data.id}`);
         },
@@ -84,7 +86,8 @@ const validFilters: Record<string, ValidFilter<string | boolean | undefined>> =
 /**
  * Grid configuration
  */
-export default {
+const gridConfig: GridConfig = {
+    id: "visualizations-published-grid",
     fields: fields,
     filtering: new Filtering(validFilters, undefined, false, false),
     getData: getData,
@@ -94,3 +97,5 @@ export default {
     sortKeys: ["create_time", "title", "update_time"],
     title: "Published Visualizations",
 };
+
+export default gridConfig;
diff --git a/client/src/components/History/Content/Collection/CollectionDescription.vue b/client/src/components/History/Content/Collection/CollectionDescription.vue
index 8c27d3e0640a..b8b68d3d68c8 100644
--- a/client/src/components/History/Content/Collection/CollectionDescription.vue
+++ b/client/src/components/History/Content/Collection/CollectionDescription.vue
@@ -1,7 +1,7 @@
 <template>
     <div>
         <span class="description mt-1 mb-1">
-            a {{ collectionLabel }} with {{ elementCount }}<b>{{ homogeneousDatatype }}</b> {{ pluralizedItem }}
+            a {{ collectionLabel }} with {{ elementCount || 0 }}<b>{{ homogeneousDatatype }}</b> {{ pluralizedItem }}
         </span>
         <CollectionProgress v-if="jobStateSummary.size != 0" :summary="jobStateSummary" />
     </div>
diff --git a/client/src/components/History/Content/ContentItem.vue b/client/src/components/History/Content/ContentItem.vue
index 2fb25d0abd72..a4bf4c8c398b 100644
--- a/client/src/components/History/Content/ContentItem.vue
+++ b/client/src/components/History/Content/ContentItem.vue
@@ -3,7 +3,7 @@
         :id="contentId"
         :class="['content-item m-1 p-0 rounded btn-transparent-background', contentCls, isBeingUsed]"
         :data-hid="id"
-        :data-state="state"
+        :data-state="dataState"
         tabindex="0"
         role="button"
         @keydown="onKeyDown">
@@ -43,7 +43,11 @@
                         <FontAwesomeIcon class="text-info" icon="arrow-circle-down" />
                     </b-button>
                     <span v-if="hasStateIcon" class="state-icon">
-                        <icon fixed-width :icon="contentState.icon" :spin="contentState.spin" />
+                        <icon
+                            fixed-width
+                            :icon="contentState.icon"
+                            :spin="contentState.spin"
+                            :title="item.populated_state_message || contentState.text" />
                     </span>
                     <span class="id hid">{{ id }}:</span>
                     <span class="content-title name font-weight-bold">{{ name }}</span>
@@ -170,6 +174,12 @@ export default {
             if (this.isPlaceholder) {
                 return "placeholder";
             }
+            if (this.item.populated_state === "failed") {
+                return "failed_populated_state";
+            }
+            if (this.item.populated_state === "new") {
+                return "new_populated_state";
+            }
             if (this.item.job_state_summary) {
                 for (const state of HIERARCHICAL_COLLECTION_JOB_STATES) {
                     if (this.item.job_state_summary[state] > 0) {
@@ -181,6 +191,9 @@ export default {
             }
             return "ok";
         },
+        dataState() {
+            return this.state === "new_populated_state" ? "new" : this.state;
+        },
         tags() {
             return this.item.tags;
         },
@@ -243,7 +256,14 @@ export default {
                 const url = entryPointsForHda[0].target;
                 window.open(url, "_blank");
             } else {
-                this.$router.push(this.itemUrls.display, { title: this.name });
+                // vue-router 4 supports a native force push with clean URLs,
+                // but we're using a workaround with a __vkey__ bit as a workaround
+                // Only conditionally force to keep urls clean most of the time.
+                if (this.$router.currentRoute.path === this.itemUrls.display) {
+                    this.$router.push(this.itemUrls.display, { title: this.name, force: true });
+                } else {
+                    this.$router.push(this.itemUrls.display, { title: this.name });
+                }
             }
         },
         onDelete(recursive = false) {
diff --git a/client/src/components/History/Content/GenericElement.test.js b/client/src/components/History/Content/GenericElement.test.js
index ba298ee4e3b0..42aaba220aaa 100644
--- a/client/src/components/History/Content/GenericElement.test.js
+++ b/client/src/components/History/Content/GenericElement.test.js
@@ -19,7 +19,7 @@ describe("GenericElement", () => {
                 dsc: {
                     elements: [
                         {
-                            element_index: 1,
+                            element_index: 0,
                             element_identifier: "element-1",
                             element_type: "hda",
                             object: {
@@ -27,17 +27,17 @@ describe("GenericElement", () => {
                             },
                         },
                         {
-                            element_index: 2,
+                            element_index: 1,
                             element_identifier: "element-2",
                             element_type: "hdca",
                             object: {
                                 id: "item-2",
                                 collection_type: "list",
-                                element_count: 2,
+                                element_count: 1,
                                 elements_datatypes: ["txt"],
                                 elements: [
                                     {
-                                        element_index: 3,
+                                        element_index: 2,
                                         element_identifier: "element-3",
                                         element_type: "hda",
                                         object: {
@@ -45,7 +45,7 @@ describe("GenericElement", () => {
                                         },
                                     },
                                     {
-                                        element_index: 4,
+                                        element_index: 3,
                                         element_identifier: "element-4",
                                         element_type: "hda",
                                         object: {
diff --git a/client/src/components/History/Content/GenericElement.vue b/client/src/components/History/Content/GenericElement.vue
index 4bc176276084..8438d9db3122 100644
--- a/client/src/components/History/Content/GenericElement.vue
+++ b/client/src/components/History/Content/GenericElement.vue
@@ -25,7 +25,7 @@ function toggle(expansionMap: Record<string, boolean>, itemId: string) {
     <div>
         <div v-for="(item, index) in dsc.elements" :key="index">
             <ContentItem
-                :id="item.element_index"
+                :id="item.element_index + 1"
                 :item="item.object"
                 :name="item.element_identifier"
                 :is-dataset="item.element_type == 'hda'"
diff --git a/client/src/components/History/Content/model/StatesInfo.vue b/client/src/components/History/Content/model/StatesInfo.vue
index 43d3a718af35..2cd7ab525f1a 100644
--- a/client/src/components/History/Content/model/StatesInfo.vue
+++ b/client/src/components/History/Content/model/StatesInfo.vue
@@ -22,6 +22,10 @@ if (props.excludeStates) {
     }
 }
 
+function dataState(state: string) {
+    return state === "new_populated_state" ? "new" : state;
+}
+
 function onFilter(value: string) {
     emit("set-filter", `state`, value);
 }
@@ -30,13 +34,21 @@ function onFilter(value: string) {
 <template>
     <div>
         <p>Here are all available item states in Galaxy:</p>
-        <p><i>(Note that the colors for each state correspond to content item state colors in the history)</i></p>
+        <p>
+            <i>
+                (Note that the colors for each state correspond to content item state colors in the history, and if it
+                exists, hovering over the icon on a history item will display the state message.)
+            </i>
+        </p>
         <dl v-for="(state, key, index) in states" :key="index">
-            <div :class="['alert', 'content-item', 'alert-' + state.status]" :data-state="key">
+            <div :class="['alert', 'content-item', 'alert-' + state.status]" :data-state="dataState(key)">
                 <dt>
-                    <a class="text-decoration-none" href="javascript:void(0)" @click="onFilter(key)"
+                    <a v-if="!state.nonDb" class="text-decoration-none" href="javascript:void(0)" @click="onFilter(key)"
                         ><code>{{ key }}</code></a
                     >
+                    <span v-else
+                        ><code>{{ key }}</code></span
+                    >
                     <icon v-if="state.icon" :icon="state.icon" />
                 </dt>
                 <dd>{{ helpText[key] || state.text }}</dd>
diff --git a/client/src/components/History/Content/model/stateTypes.d.ts b/client/src/components/History/Content/model/stateTypes.d.ts
index 3ef3a45c4456..368690474bd9 100644
--- a/client/src/components/History/Content/model/stateTypes.d.ts
+++ b/client/src/components/History/Content/model/stateTypes.d.ts
@@ -5,6 +5,7 @@ export type State = {
     text?: string;
     icon?: string;
     spin?: boolean;
+    nonDb?: boolean;
 };
 
 export type States = {
diff --git a/client/src/components/History/Content/model/states.ts b/client/src/components/History/Content/model/states.ts
index 2994100c6c0b..26594d2fa8e3 100644
--- a/client/src/components/History/Content/model/states.ts
+++ b/client/src/components/History/Content/model/states.ts
@@ -2,13 +2,14 @@ import type { components } from "@/api/schema";
 
 type DatasetState = components["schemas"]["DatasetState"];
 // The 'failed' state is for the collection job state summary, not a dataset state.
-type State = DatasetState | "failed" | "placeholder";
+type State = DatasetState | "failed" | "placeholder" | "failed_populated_state" | "new_populated_state";
 
 interface StateRepresentation {
     status: "success" | "warning" | "info" | "danger" | "secondary";
     text?: string;
     icon?: string;
     spin?: boolean;
+    nonDb?: boolean;
 }
 
 type StateMap = {
@@ -103,6 +104,21 @@ export const STATES: StateMap = {
         text: "This dataset is being fetched.",
         icon: "spinner",
         spin: true,
+        nonDb: true,
+    },
+    /** the `populated_state: failed`. This state is only visual and transitional, it does not exist in the database. */
+    failed_populated_state: {
+        status: "danger",
+        text: "Failed to populate the collection.",
+        icon: "exclamation-triangle",
+        nonDb: true,
+    },
+    /** the `populated_state: new`. This state is only visual and transitional, it does not exist in the database. */
+    new_populated_state: {
+        status: "warning",
+        text: "This is a new collection and not all of its data are available yet.",
+        icon: "clock",
+        nonDb: true,
     },
 } as const satisfies StateMap;
 
diff --git a/client/src/components/History/CurrentCollection/CollectionPanel.vue b/client/src/components/History/CurrentCollection/CollectionPanel.vue
index 7269918545a7..2f58d1356e2a 100644
--- a/client/src/components/History/CurrentCollection/CollectionPanel.vue
+++ b/client/src/components/History/CurrentCollection/CollectionPanel.vue
@@ -46,6 +46,9 @@ const dsc = computed(() => {
 const collectionElements = computed(() => collectionElementsStore.getCollectionElements(dsc.value, offset.value));
 const loading = computed(() => collectionElementsStore.isLoadingCollectionElements(dsc.value));
 const jobState = computed(() => ("job_state_summary" in dsc.value ? dsc.value.job_state_summary : undefined));
+const populatedStateMsg = computed(() =>
+    "populated_state_message" in dsc.value ? dsc.value.populated_state_message : undefined
+);
 const rootCollection = computed(() => {
     if (isHDCA(props.selectedCollections[0])) {
         return props.selectedCollections[0];
@@ -115,7 +118,15 @@ watch(
             </section>
             <section class="position-relative flex-grow-1 scroller">
                 <div>
+                    <b-alert
+                        v-if="collectionElements.length === 0"
+                        class="m-2"
+                        :variant="populatedStateMsg ? 'danger' : 'info'"
+                        show>
+                        {{ populatedStateMsg || "This is an empty collection." }}
+                    </b-alert>
                     <ListingLayout
+                        v-else
                         data-key="element_index"
                         :items="collectionElements"
                         :loading="loading"
diff --git a/client/src/components/History/HistoryFilters.js b/client/src/components/History/HistoryFilters.js
index 2cca93b7337d..051ca0a5450d 100644
--- a/client/src/components/History/HistoryFilters.js
+++ b/client/src/components/History/HistoryFilters.js
@@ -2,7 +2,7 @@ import { STATES } from "components/History/Content/model/states";
 import StatesInfo from "components/History/Content/model/StatesInfo";
 import Filtering, { compare, contains, equals, expandNameTag, toBool, toDate } from "utils/filtering";
 
-const excludeStates = ["empty", "failed", "upload"];
+const excludeStates = ["empty", "failed", "upload", "placeholder", "failed_populated_state", "new_populated_state"];
 const states = Object.keys(STATES).filter((state) => !excludeStates.includes(state));
 
 const validFilters = {
diff --git a/client/src/components/History/HistoryPublishedList.vue b/client/src/components/History/HistoryPublishedList.vue
index 5c819f125849..723cbc4e2e83 100644
--- a/client/src/components/History/HistoryPublishedList.vue
+++ b/client/src/components/History/HistoryPublishedList.vue
@@ -179,7 +179,7 @@ async function load() {
 
 onMounted(async () => {
     if (props.fUsername) {
-        filterText.value = filters.getFilterText({ "user_eq:": props.fUsername });
+        filterText.value = filters.getFilterText({ user_eq: props.fUsername });
     }
     await load();
     useInfiniteScroll(scrollableDiv.value, () => load());
diff --git a/client/src/components/JobDestinationParams/JobDestinationParams.test.js b/client/src/components/JobDestinationParams/JobDestinationParams.test.js
deleted file mode 100644
index 1e870d3e2881..000000000000
--- a/client/src/components/JobDestinationParams/JobDestinationParams.test.js
+++ /dev/null
@@ -1,80 +0,0 @@
-import { createLocalVue, shallowMount } from "@vue/test-utils";
-import { createPinia, PiniaVuePlugin } from "pinia";
-import { useUserStore } from "stores/userStore";
-import Vuex from "vuex";
-import createCache from "vuex-cache";
-
-import JobDestinationParams from "./JobDestinationParams";
-import jobDestinationResponse from "./testData/jobDestinationResponse";
-
-const JOB_ID = "foo_job_id";
-
-const localVue = createLocalVue();
-localVue.use(PiniaVuePlugin);
-localVue.use(Vuex);
-
-const testStore = new Vuex.Store({
-    plugins: [createCache()],
-    modules: {
-        jobDestinationParametersStore: {
-            actions: {
-                fetchJobDestinationParams: jest.fn(),
-            },
-            getters: {
-                jobDestinationParams: (state) => (job_id) => {
-                    return jobDestinationResponse;
-                },
-            },
-        },
-    },
-});
-
-describe("JobDestinationParams/JobDestinationParams.vue", () => {
-    const responseKeys = Object.keys(jobDestinationResponse);
-
-    let wrapper;
-    let userStore;
-
-    beforeEach(async () => {
-        const propsData = {
-            jobId: JOB_ID,
-        };
-        const pinia = createPinia();
-        wrapper = await shallowMount(JobDestinationParams, {
-            store: testStore,
-            propsData,
-            localVue,
-            attachTo: document.body,
-            pinia,
-        });
-        userStore = useUserStore();
-        userStore.currentUser = { is_admin: true };
-        expect(responseKeys.length > 0).toBeTruthy();
-    });
-
-    it("destination parameters should exist", async () => {
-        expect(Object.keys(wrapper.vm.jobDestinationParams).length).toBe(responseKeys.length);
-        expect(wrapper.vm.jobId).toBe(JOB_ID);
-        expect(wrapper.vm.jobDestinationParams["docker_net"]).toBe("bridge");
-        expect(wrapper.vm.jobDestinationParams["docker_set_user"]).toBeNull();
-    });
-
-    it("destination parameters should be rendered", async () => {
-        const paramsTable = wrapper.find("#destination_parameters");
-        expect(paramsTable.element).toBeVisible();
-        const params = paramsTable.findAll("tbody > tr");
-        expect(params.length).toBe(responseKeys.length);
-
-        for (let counter = 0; counter < responseKeys.length - 1; counter++) {
-            const parameter = params.at(counter).findAll("td");
-            const parameterTitle = parameter.at(0).text();
-            const parameterValue = parameter.at(1).text();
-
-            expect(responseKeys.includes(parameterTitle)).toBeTruthy();
-            // since we render null as an empty string, rendered empty string should always equal null in test data
-            expect(
-                jobDestinationResponse[parameterTitle] === (parameterValue === "" ? null : parameterValue)
-            ).toBeTruthy();
-        }
-    });
-});
diff --git a/client/src/components/JobDestinationParams/JobDestinationParams.test.ts b/client/src/components/JobDestinationParams/JobDestinationParams.test.ts
new file mode 100644
index 000000000000..5486f481f91d
--- /dev/null
+++ b/client/src/components/JobDestinationParams/JobDestinationParams.test.ts
@@ -0,0 +1,72 @@
+import { shallowMount } from "@vue/test-utils";
+import flushPromises from "flush-promises";
+import { createPinia } from "pinia";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { mockFetcher } from "@/api/schema/__mocks__";
+import { useUserStore } from "@/stores/userStore";
+
+import jobDestinationResponseData from "./testData/jobDestinationResponse.json";
+
+import JobDestinationParams from "./JobDestinationParams.vue";
+
+const JOB_ID = "foo_job_id";
+
+jest.mock("@/api/schema");
+
+const localVue = getLocalVue();
+
+const jobDestinationResponse = jobDestinationResponseData as Record<string, string | null>;
+
+async function mountJobDestinationParams() {
+    mockFetcher.path("/api/jobs/{job_id}/destination_params").method("get").mock({ data: jobDestinationResponse });
+
+    const pinia = createPinia();
+    const wrapper = shallowMount(JobDestinationParams as object, {
+        propsData: {
+            jobId: JOB_ID,
+        },
+        localVue,
+        pinia,
+    });
+
+    const userStore = useUserStore();
+    userStore.currentUser = {
+        email: "admin@email",
+        id: "1",
+        tags_used: [],
+        isAnonymous: false,
+        total_disk_usage: 1048576,
+        is_admin: true,
+    };
+
+    await flushPromises();
+
+    return wrapper;
+}
+
+describe("JobDestinationParams/JobDestinationParams.vue", () => {
+    const responseKeys = Object.keys(jobDestinationResponse);
+    expect(responseKeys.length > 0).toBeTruthy();
+
+    it("should render destination parameters", async () => {
+        const wrapper = await mountJobDestinationParams();
+
+        const paramsTable = wrapper.find("#destination_parameters");
+        expect(paramsTable.exists()).toBe(true);
+        const params = paramsTable.findAll("tbody > tr");
+        expect(params.length).toBe(responseKeys.length);
+
+        for (let counter = 0; counter < responseKeys.length - 1; counter++) {
+            const parameter = params.at(counter).findAll("td");
+            const parameterTitle = parameter.at(0).text();
+            const parameterValue = parameter.at(1).text();
+
+            expect(responseKeys.includes(parameterTitle)).toBeTruthy();
+            // since we render null as an empty string, rendered empty string should always equal null in test data
+            expect(
+                jobDestinationResponse[parameterTitle] === (parameterValue === "" ? null : parameterValue)
+            ).toBeTruthy();
+        }
+    });
+});
diff --git a/client/src/components/JobDestinationParams/JobDestinationParams.vue b/client/src/components/JobDestinationParams/JobDestinationParams.vue
index 074c9160b5ed..1f2653bc7aa8 100644
--- a/client/src/components/JobDestinationParams/JobDestinationParams.vue
+++ b/client/src/components/JobDestinationParams/JobDestinationParams.vue
@@ -1,3 +1,24 @@
+<script setup lang="ts">
+import { storeToRefs } from "pinia";
+import { computed } from "vue";
+
+import { useJobDestinationParametersStore } from "@/stores/jobDestinationParametersStore";
+import { useUserStore } from "@/stores/userStore";
+
+const { currentUser } = storeToRefs(useUserStore());
+const jobDestinationParametersStore = useJobDestinationParametersStore();
+
+interface Props {
+    jobId: string;
+}
+
+const props = defineProps<Props>();
+
+const jobDestinationParams = computed(() => {
+    return jobDestinationParametersStore.getJobDestinationParams(props.jobId);
+});
+</script>
+
 <template>
     <div v-if="currentUser?.is_admin">
         <h2 class="h-md">Destination Parameters</h2>
@@ -11,31 +32,3 @@
         </table>
     </div>
 </template>
-
-<script>
-import { mapState } from "pinia";
-import { mapCacheActions } from "vuex-cache";
-
-import { useUserStore } from "@/stores/userStore";
-
-export default {
-    props: {
-        jobId: {
-            type: String,
-            required: true,
-        },
-    },
-    computed: {
-        ...mapState(useUserStore, ["currentUser"]),
-        jobDestinationParams: function () {
-            return this.$store.getters.jobDestinationParams(this.jobId);
-        },
-    },
-    created: function () {
-        this.fetchJobDestinationParams(this.jobId);
-    },
-    methods: {
-        ...mapCacheActions(["fetchJobDestinationParams"]),
-    },
-};
-</script>
diff --git a/client/src/components/Panels/Menus/PanelViewMenu.vue b/client/src/components/Panels/Menus/PanelViewMenu.vue
index 50af093e2735..b6afe4a69006 100644
--- a/client/src/components/Panels/Menus/PanelViewMenu.vue
+++ b/client/src/components/Panels/Menus/PanelViewMenu.vue
@@ -4,7 +4,8 @@
         right
         block
         no-caret
-        title="Show panel options"
+        :disabled="storeLoading"
+        :title="!storeLoading ? 'Show panel options' : 'Loading panel view'"
         variant="link"
         toggle-class="text-decoration-none"
         role="menu"
@@ -58,6 +59,10 @@ export default {
         currentPanelView: {
             type: String,
         },
+        storeLoading: {
+            type: Boolean,
+            default: false,
+        },
     },
     computed: {
         defaultPanelView() {
@@ -99,3 +104,11 @@ export default {
     },
 };
 </script>
+
+<style lang="scss">
+.tool-panel-dropdown .dropdown-menu {
+    overflow: auto;
+    max-height: 50vh;
+    min-width: 100%;
+}
+</style>
diff --git a/client/src/components/Panels/ToolPanel.vue b/client/src/components/Panels/ToolPanel.vue
index 4de35d575b25..7d8080dbc5d2 100644
--- a/client/src/components/Panels/ToolPanel.vue
+++ b/client/src/components/Panels/ToolPanel.vue
@@ -34,8 +34,9 @@ const emit = defineEmits<{
 
 const arePanelsFetched = ref(false);
 const toolStore = useToolStore();
-const { currentPanelView, defaultPanelView, isPanelPopulated, panelViews } = storeToRefs(toolStore);
+const { currentPanelView, defaultPanelView, isPanelPopulated, loading, panelViews } = storeToRefs(toolStore);
 
+const loadingView = ref<string | undefined>(undefined);
 const query = ref("");
 const showAdvanced = ref(false);
 
@@ -70,6 +71,8 @@ watch(
 const toolPanelHeader = computed(() => {
     if (showAdvanced.value) {
         return localize("Advanced Tool Search");
+    } else if (loading.value && loadingView.value) {
+        return localize(loadingView.value);
     } else if (
         currentPanelView.value !== "default" &&
         panelViews.value &&
@@ -106,7 +109,9 @@ async function initializeTools() {
 }
 
 async function updatePanelView(panelView: string) {
+    loadingView.value = panelViews.value[panelView]?.name;
     await toolStore.setCurrentPanelView(panelView);
+    loadingView.value = undefined;
 }
 
 function onInsertTool(toolId: string, toolName: string) {
@@ -134,12 +139,13 @@ function onInsertWorkflowSteps(workflowId: string, workflowStepCount: number | u
                     v-if="panelViews && Object.keys(panelViews).length > 1"
                     :panel-views="panelViews"
                     :current-panel-view="currentPanelView"
+                    :store-loading="loading"
                     @updatePanelView="updatePanelView">
                     <template v-slot:panel-view-selector>
                         <div class="d-flex justify-content-between panel-view-selector">
                             <div>
                                 <span
-                                    v-if="viewIcon"
+                                    v-if="viewIcon && !loading"
                                     :class="['fas', `fa-${viewIcon}`, 'mr-1']"
                                     data-description="panel view header icon" />
                                 <Heading
@@ -147,8 +153,11 @@ function onInsertWorkflowSteps(workflowId: string, workflowStepCount: number | u
                                     :class="!showAdvanced && toolPanelHeader !== 'Tools' && 'font-italic'"
                                     h2
                                     inline
-                                    size="sm"
-                                    >{{ toolPanelHeader }}
+                                    size="sm">
+                                    <span v-if="loading && loadingView">
+                                        <LoadingSpan :message="toolPanelHeader" />
+                                    </span>
+                                    <span v-else>{{ toolPanelHeader }}</span>
                                 </Heading>
                             </div>
                             <div v-if="!showAdvanced" class="panel-header-buttons">
diff --git a/client/src/components/admin/Notifications/NotificationsManagement.test.ts b/client/src/components/admin/Notifications/NotificationsManagement.test.ts
new file mode 100644
index 000000000000..41474db51618
--- /dev/null
+++ b/client/src/components/admin/Notifications/NotificationsManagement.test.ts
@@ -0,0 +1,55 @@
+import { createTestingPinia } from "@pinia/testing";
+import { getLocalVue } from "@tests/jest/helpers";
+import { shallowMount } from "@vue/test-utils";
+import flushPromises from "flush-promises";
+import { setActivePinia } from "pinia";
+
+import { mockFetcher } from "@/api/schema/__mocks__";
+
+import NotificationsManagement from "./NotificationsManagement.vue";
+
+jest.mock("@/api/schema");
+
+const localVue = getLocalVue(true);
+
+const selectors = {
+    sendNotificationButton: "#send-notification-button",
+    createBroadcastButton: "#create-broadcast-button",
+} as const;
+
+async function mountNotificationsManagement(config: any = {}) {
+    const pinia = createTestingPinia();
+    setActivePinia(pinia);
+
+    mockFetcher.path("/api/configuration").method("get").mock({ data: config });
+
+    const wrapper = shallowMount(NotificationsManagement as object, {
+        localVue,
+        pinia,
+        stubs: {
+            FontAwesomeIcon: true,
+        },
+    });
+
+    await flushPromises();
+
+    return wrapper;
+}
+
+describe("NotificationsManagement.vue", () => {
+    it("should render the create notification buttons if the notification system is enabled", async () => {
+        const config = { enable_notification_system: true };
+        const wrapper = await mountNotificationsManagement(config);
+
+        expect(wrapper.find(selectors.sendNotificationButton).exists()).toBe(true);
+        expect(wrapper.find(selectors.createBroadcastButton).exists()).toBe(true);
+    });
+
+    it("should not render the create notification buttons if the notification system is disabled", async () => {
+        const config = { enable_notification_system: false };
+        const wrapper = await mountNotificationsManagement(config);
+
+        expect(wrapper.find(selectors.sendNotificationButton).exists()).toBe(false);
+        expect(wrapper.find(selectors.createBroadcastButton).exists()).toBe(false);
+    });
+});
diff --git a/client/src/components/admin/Notifications/NotificationsManagement.vue b/client/src/components/admin/Notifications/NotificationsManagement.vue
index 1ffb7d7a557d..ef06eba45f4d 100644
--- a/client/src/components/admin/Notifications/NotificationsManagement.vue
+++ b/client/src/components/admin/Notifications/NotificationsManagement.vue
@@ -1,12 +1,15 @@
 <script setup lang="ts">
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
-import { BButton } from "bootstrap-vue";
+import { BAlert, BButton } from "bootstrap-vue";
 import { useRouter } from "vue-router/composables";
 
+import { useConfig } from "@/composables/config";
+
 import BroadcastsList from "@/components/admin/Notifications/BroadcastsList.vue";
 import Heading from "@/components/Common/Heading.vue";
 
 const router = useRouter();
+const { config, isConfigLoaded } = useConfig();
 
 function goToCreateNewNotification() {
     router.push("/admin/notifications/create_new_notification");
@@ -28,18 +31,32 @@ function goToCreateNewBroadcast() {
             <i>broadcast notifications</i> to all users (even anonymous users).
         </p>
 
-        <div>
-            <BButton class="mb-2" variant="outline-primary" @click="goToCreateNewNotification">
-                <FontAwesomeIcon icon="plus" />
-                Send new notification
-            </BButton>
-
-            <BButton class="mb-2" variant="outline-primary" @click="goToCreateNewBroadcast">
-                <FontAwesomeIcon icon="plus" />
-                Create new broadcast
-            </BButton>
+        <div v-if="isConfigLoaded && config.enable_notification_system">
+            <div>
+                <BButton
+                    id="send-notification-button"
+                    class="mb-2"
+                    variant="outline-primary"
+                    @click="goToCreateNewNotification">
+                    <FontAwesomeIcon icon="plus" />
+                    Send new notification
+                </BButton>
+
+                <BButton
+                    id="create-broadcast-button"
+                    class="mb-2"
+                    variant="outline-primary"
+                    @click="goToCreateNewBroadcast">
+                    <FontAwesomeIcon icon="plus" />
+                    Create new broadcast
+                </BButton>
+            </div>
+
+            <BroadcastsList class="mt-2" />
         </div>
-
-        <BroadcastsList class="mt-2" />
+        <BAlert v-else variant="warning" show>
+            The notification system is disabled. To enable it, set the
+            <code>enable_notification_system</code> option to <code>true</code> in the Galaxy configuration file.
+        </BAlert>
     </div>
 </template>
diff --git a/client/src/components/plugins/icons.js b/client/src/components/plugins/icons.js
index ea99ce1fe0fd..f0d6d8688efe 100644
--- a/client/src/components/plugins/icons.js
+++ b/client/src/components/plugins/icons.js
@@ -4,6 +4,7 @@ import {
     faBell,
     faBolt,
     faBurn,
+    faCalculator,
     faChartArea,
     faChartBar,
     faCheckSquare,
@@ -57,6 +58,7 @@ library.add(
     faBell,
     faBolt,
     faBurn,
+    faCalculator,
     faChartArea,
     faChartBar,
     faCheckSquare,
diff --git a/client/src/entry/analysis/modules/Admin.vue b/client/src/entry/analysis/modules/Admin.vue
index 33d9abf634d4..25b052ab08af 100644
--- a/client/src/entry/analysis/modules/Admin.vue
+++ b/client/src/entry/analysis/modules/Admin.vue
@@ -23,7 +23,7 @@ const panelProperties = computed(() => {
             <AdminPanel v-bind="panelProperties" />
         </FlexPanel>
         <div id="center" class="overflow-auto p-3 w-100">
-            <router-view :key="$route.fullPath" />
+            <router-view :key="$route.fullPath" class="h-100" />
         </div>
     </div>
 </template>
diff --git a/client/src/entry/analysis/router.js b/client/src/entry/analysis/router.js
index 69ce1f28be04..b0618f00a18d 100644
--- a/client/src/entry/analysis/router.js
+++ b/client/src/entry/analysis/router.js
@@ -7,8 +7,8 @@ import DatasetAttributes from "components/DatasetInformation/DatasetAttributes";
 import DatasetDetails from "components/DatasetInformation/DatasetDetails";
 import DatasetError from "components/DatasetInformation/DatasetError";
 import FormGeneric from "components/Form/FormGeneric";
-import visualizationsGrid from "components/Grid/configs/visualizations";
-import visualizationsPublishedGrid from "components/Grid/configs/visualizationsPublished";
+import visualizationsGridConfig from "components/Grid/configs/visualizations";
+import visualizationsPublishedGridConfig from "components/Grid/configs/visualizationsPublished";
 import GridHistory from "components/Grid/GridHistory";
 import GridList from "components/Grid/GridList";
 import HistoryExportTasks from "components/History/Export/HistoryExport";
@@ -466,14 +466,14 @@ export function getRouter(Galaxy) {
                         path: "visualizations/list",
                         component: GridList,
                         props: {
-                            config: visualizationsGrid,
+                            gridConfig: visualizationsGridConfig,
                         },
                     },
                     {
                         path: "visualizations/list_published",
                         component: GridList,
                         props: {
-                            config: visualizationsPublishedGrid,
+                            gridConfig: visualizationsPublishedGridConfig,
                         },
                     },
                     {
diff --git a/client/src/entry/analysis/routes/admin-routes.js b/client/src/entry/analysis/routes/admin-routes.js
index bf8a7de1a042..ad2e3437f9ca 100644
--- a/client/src/entry/analysis/routes/admin-routes.js
+++ b/client/src/entry/analysis/routes/admin-routes.js
@@ -18,7 +18,11 @@ import NotificationsManagement from "components/admin/Notifications/Notification
 import ResetMetadata from "components/admin/ResetMetadata";
 import SanitizeAllow from "components/admin/SanitizeAllow";
 import FormGeneric from "components/Form/FormGeneric";
+import adminGroupsGridConfig from "components/Grid/configs/adminGroups";
+import adminRolesGridConfig from "components/Grid/configs/adminRoles";
+import adminUsersGridConfig from "components/Grid/configs/adminUsers";
 import Grid from "components/Grid/Grid";
+import GridList from "components/Grid/GridList";
 import RegisterForm from "components/Login/RegisterForm";
 import Toolshed from "components/Toolshed/Index";
 import Admin from "entry/analysis/modules/Admin";
@@ -132,10 +136,11 @@ export default [
             },
             {
                 path: "groups",
-                component: Grid,
-                props: {
-                    urlBase: "admin/groups_list",
-                },
+                component: GridList,
+                props: (route) => ({
+                    gridConfig: adminGroupsGridConfig,
+                    gridMessage: route.query.message,
+                }),
             },
             {
                 path: "quotas",
@@ -146,17 +151,19 @@ export default [
             },
             {
                 path: "roles",
-                component: Grid,
-                props: {
-                    urlBase: "admin/roles_list",
-                },
+                component: GridList,
+                props: (route) => ({
+                    gridConfig: adminRolesGridConfig,
+                    gridMessage: route.query.message,
+                }),
             },
             {
                 path: "users",
-                component: Grid,
-                props: {
-                    urlBase: "admin/users_list",
-                },
+                component: GridList,
+                props: (route) => ({
+                    gridConfig: adminUsersGridConfig,
+                    gridMessage: route.query.message,
+                }),
             },
             {
                 path: "tool_versions",
@@ -191,7 +198,7 @@ export default [
                 component: FormGeneric,
                 props: (route) => ({
                     url: `/admin/manage_users_and_groups_for_role?id=${route.query.id}`,
-                    redirect: "/admin/users",
+                    redirect: "/admin/roles",
                 }),
             },
             {
@@ -199,7 +206,7 @@ export default [
                 component: FormGeneric,
                 props: (route) => ({
                     url: `/admin/manage_users_and_roles_for_group?id=${route.query.id}`,
-                    redirect: "/admin/users",
+                    redirect: "/admin/groups",
                 }),
             },
             {
diff --git a/client/src/store/datasetExtFilesStore.js b/client/src/store/datasetExtFilesStore.js
deleted file mode 100644
index 8ae400479093..000000000000
--- a/client/src/store/datasetExtFilesStore.js
+++ /dev/null
@@ -1,35 +0,0 @@
-import axios from "axios";
-import { getAppRoot } from "onload/loadConfig";
-import Vue from "vue";
-
-export const state = {
-    datasetExtFilesById: {},
-};
-
-const getters = {
-    getDatasetExtFiles: (state) => (history_dataset_id) => {
-        return state.datasetExtFilesById[history_dataset_id] || null;
-    },
-};
-
-const actions = {
-    fetchDatasetExtFiles: async ({ commit }, history_dataset_id) => {
-        const { data } = await axios.get(
-            `${getAppRoot()}api/histories/${history_dataset_id}/contents/${history_dataset_id}/extra_files`
-        );
-        commit("saveDatasetExtFiles", { history_dataset_id, datasetExtFiles: data });
-    },
-};
-
-const mutations = {
-    saveDatasetExtFiles: (state, { history_dataset_id, datasetExtFiles }) => {
-        Vue.set(state.datasetExtFilesById, history_dataset_id, datasetExtFiles);
-    },
-};
-
-export const datasetExtFilesStore = {
-    state,
-    getters,
-    actions,
-    mutations,
-};
diff --git a/client/src/store/index.js b/client/src/store/index.js
index 8ce43f061f30..fd6f6d7bde87 100644
--- a/client/src/store/index.js
+++ b/client/src/store/index.js
@@ -9,11 +9,9 @@ import Vuex from "vuex";
 import createCache from "vuex-cache";
 import VuexPersistence from "vuex-persist";
 
-import { datasetExtFilesStore } from "./datasetExtFilesStore";
 import { datasetPathDestinationStore } from "./datasetPathDestinationStore";
 import { gridSearchStore } from "./gridSearchStore";
 import { invocationStore } from "./invocationStore";
-import { jobDestinationParametersStore } from "./jobDestinationParametersStore";
 import { syncVuextoGalaxy } from "./syncVuextoGalaxy";
 import { tagStore } from "./tagStore";
 
@@ -42,8 +40,6 @@ export function createStore() {
     const storeConfig = {
         plugins: [createCache(), panelsPersistence.plugin],
         modules: {
-            destinationParameters: jobDestinationParametersStore,
-            datasetExtFiles: datasetExtFilesStore,
             datasetPathDestination: datasetPathDestinationStore,
             invocations: invocationStore,
             gridSearch: gridSearchStore,
diff --git a/client/src/store/jobDestinationParametersStore.js b/client/src/store/jobDestinationParametersStore.js
deleted file mode 100644
index a1cbb66caac1..000000000000
--- a/client/src/store/jobDestinationParametersStore.js
+++ /dev/null
@@ -1,33 +0,0 @@
-import axios from "axios";
-import { getAppRoot } from "onload/loadConfig";
-import Vue from "vue";
-
-export const state = {
-    jobDestinationParametersByJobId: {},
-};
-
-const getters = {
-    jobDestinationParams: (state) => (jobId) => {
-        return state.jobDestinationParametersByJobId[jobId] || [];
-    },
-};
-
-const actions = {
-    fetchJobDestinationParams: async ({ commit }, jobId) => {
-        const { data } = await axios.get(`${getAppRoot()}api/jobs/${jobId}/destination_params`);
-        commit("saveJobDestinationParamsForJobId", { jobId, jobDestinationParams: data });
-    },
-};
-
-const mutations = {
-    saveJobDestinationParamsForJobId: (state, { jobId, jobDestinationParams }) => {
-        Vue.set(state.jobDestinationParametersByJobId, jobId, jobDestinationParams);
-    },
-};
-
-export const jobDestinationParametersStore = {
-    state,
-    getters,
-    actions,
-    mutations,
-};
diff --git a/client/src/stores/configurationStore.ts b/client/src/stores/configurationStore.ts
index 45508619252f..1cd70b0d2c55 100644
--- a/client/src/stores/configurationStore.ts
+++ b/client/src/stores/configurationStore.ts
@@ -4,7 +4,7 @@ import { computed, ref } from "vue";
 import { fetcher } from "@/api/schema";
 
 // Temporary set to any until schema model is defined
-type GalaxyConfiguration = any;
+export type GalaxyConfiguration = any;
 
 const fetchConfiguration = fetcher.path("/api/configuration").method("get").create();
 
diff --git a/client/src/stores/datasetExtraFilesStore.ts b/client/src/stores/datasetExtraFilesStore.ts
new file mode 100644
index 000000000000..14080fd978f5
--- /dev/null
+++ b/client/src/stores/datasetExtraFilesStore.ts
@@ -0,0 +1,46 @@
+import { defineStore } from "pinia";
+import { computed, del, ref, set } from "vue";
+
+import { DatasetExtraFiles, fetchDatasetExtraFiles } from "@/api/datasets";
+
+export const useDatasetExtraFilesStore = defineStore("datasetExtraFilesStore", () => {
+    const storedDatasetExtraFiles = ref<{ [key: string]: DatasetExtraFiles }>({});
+    const loading = ref<{ [key: string]: boolean }>({});
+
+    const getDatasetExtraFiles = computed(() => {
+        return (datasetId: string) => {
+            const datasetExtFiles = storedDatasetExtraFiles.value[datasetId];
+            if (!datasetExtFiles && !loading.value[datasetId]) {
+                fetchDatasetExtFilesByDatasetId({ id: datasetId });
+            }
+            return datasetExtFiles ?? null;
+        };
+    });
+
+    const isLoadingDatasetExtraFiles = computed(() => {
+        return (datasetId: string) => {
+            return loading.value[datasetId] ?? false;
+        };
+    });
+
+    async function fetchDatasetExtFilesByDatasetId(params: { id: string }) {
+        const datasetId = params.id;
+        set(loading.value, datasetId, true);
+        try {
+            const { data: datasetExtFiles } = await fetchDatasetExtraFiles({
+                dataset_id: datasetId,
+            });
+            set(storedDatasetExtraFiles.value, datasetId, datasetExtFiles);
+            return datasetExtFiles;
+        } finally {
+            del(loading.value, datasetId);
+        }
+    }
+
+    return {
+        storedDatasetExtraFiles,
+        getDatasetExtraFiles,
+        isLoadingDatasetExtraFiles,
+        fetchDatasetExtFilesByDatasetId,
+    };
+});
diff --git a/client/src/stores/jobDestinationParametersStore.ts b/client/src/stores/jobDestinationParametersStore.ts
new file mode 100644
index 000000000000..6856b1fe7a39
--- /dev/null
+++ b/client/src/stores/jobDestinationParametersStore.ts
@@ -0,0 +1,43 @@
+import { defineStore } from "pinia";
+import { computed, del, ref, set } from "vue";
+
+import { fetchJobDestinationParams, type JobDestinationParams } from "@/api/jobs";
+
+export const useJobDestinationParametersStore = defineStore("jobDestinationParametersStore", () => {
+    const storedJobDestinationParameters = ref<{ [key: string]: JobDestinationParams }>({});
+    const loadingParameters = ref<{ [key: string]: boolean }>({});
+
+    const getJobDestinationParams = computed(() => {
+        return (jobId: string) => {
+            const destinationParams = storedJobDestinationParameters.value[jobId];
+            if (!destinationParams && !loadingParameters.value[jobId]) {
+                fetchJobDestinationParamsByJobId({ id: jobId });
+            }
+            return destinationParams ?? null;
+        };
+    });
+
+    const isLoadingJobDestinationParams = computed(() => {
+        return (jobId: string) => {
+            return loadingParameters.value[jobId] ?? false;
+        };
+    });
+
+    async function fetchJobDestinationParamsByJobId(params: { id: string }) {
+        const jobId = params.id;
+        set(loadingParameters.value, jobId, true);
+        try {
+            const { data: destinationParams } = await fetchJobDestinationParams({ job_id: jobId });
+            set(storedJobDestinationParameters.value, jobId, destinationParams);
+            return destinationParams;
+        } finally {
+            del(loadingParameters.value, jobId);
+        }
+    }
+
+    return {
+        storedJobDestinationParameters,
+        getJobDestinationParams,
+        isLoadingJobDestinationParams,
+    };
+});
diff --git a/client/src/stores/userStore.ts b/client/src/stores/userStore.ts
index e0329a4db7e3..489ff893ccad 100644
--- a/client/src/stores/userStore.ts
+++ b/client/src/stores/userStore.ts
@@ -23,6 +23,7 @@ export interface User extends QuotaUsageResponse {
 
 export interface AnonymousUser {
     isAnonymous: true;
+    is_admin?: false;
 }
 
 export type GenericUser = User | AnonymousUser;
diff --git a/client/src/utils/navigation/navigation.yml b/client/src/utils/navigation/navigation.yml
index 1ba8b674d44a..1eb623ea1869 100644
--- a/client/src/utils/navigation/navigation.yml
+++ b/client/src/utils/navigation/navigation.yml
@@ -955,8 +955,8 @@ admin:
     dm_table_button: '#${data_table}-table'
     dm_table_card: '#data-table-card'
     users_grid: '#users-grid'
-    users_grid_create_button: '.manage-table-actions .action-button'
-    groups_grid_create_button: '.manage-table-actions .action-button'
+    users_grid_create_button: '[data-description="grid action create new user"]'
+    groups_grid_create_button: '[data-description="grid action create new group"]'
     registration_form: 'form#registration'
     groups_grid: '#groups-grid'
     roles_grid: '#roles-grid'
diff --git a/client/yarn.lock b/client/yarn.lock
index d7a91ccd5d02..941594306aa6 100644
--- a/client/yarn.lock
+++ b/client/yarn.lock
@@ -8,9 +8,9 @@
   integrity sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==
 
 "@adobe/css-tools@^4.3.1":
-  version "4.3.1"
-  resolved "https://registry.yarnpkg.com/@adobe/css-tools/-/css-tools-4.3.1.tgz#abfccb8ca78075a2b6187345c26243c1a0842f28"
-  integrity sha512-/62yikz7NLScCGAAST5SHdnjaDJQBDq0M2muyRTpf2VQhw6StBg2ALiu73zSJQ4fMVLA+0uBhBHAle7Wg+2kSg==
+  version "4.3.2"
+  resolved "https://registry.yarnpkg.com/@adobe/css-tools/-/css-tools-4.3.2.tgz#a6abc715fb6884851fca9dad37fc34739a04fd11"
+  integrity sha512-DA5a1C0gD/pLOvhv33YMrbf2FK3oUzwNl9oOJqE4XVjuEtt6XIakRcsd7eLiOSPkp1kTRQGICTA8cKra/vFbjw==
 
 "@ampproject/remapping@^2.1.0":
   version "2.2.0"
diff --git a/lib/galaxy/app.py b/lib/galaxy/app.py
index 2048dc1ea18c..2753b87a076e 100644
--- a/lib/galaxy/app.py
+++ b/lib/galaxy/app.py
@@ -107,6 +107,12 @@
     Vault,
     VaultFactory,
 )
+from galaxy.short_term_storage import (
+    ShortTermStorageAllocator,
+    ShortTermStorageConfiguration,
+    ShortTermStorageManager,
+    ShortTermStorageMonitor,
+)
 from galaxy.tool_shed.cache import ToolShedRepositoryCache
 from galaxy.tool_shed.galaxy_install.client import InstallationTarget
 from galaxy.tool_shed.galaxy_install.installed_repository_manager import InstalledRepositoryManager
@@ -144,12 +150,6 @@
 )
 from galaxy.web.framework.base import server_starttime
 from galaxy.web.proxy import ProxyManager
-from galaxy.web.short_term_storage import (
-    ShortTermStorageAllocator,
-    ShortTermStorageConfiguration,
-    ShortTermStorageManager,
-    ShortTermStorageMonitor,
-)
 from galaxy.web_stack import (
     application_stack_instance,
     ApplicationStack,
diff --git a/lib/galaxy/app_unittest_utils/galaxy_mock.py b/lib/galaxy/app_unittest_utils/galaxy_mock.py
index 65d559a851a2..d6a773e214e0 100644
--- a/lib/galaxy/app_unittest_utils/galaxy_mock.py
+++ b/lib/galaxy/app_unittest_utils/galaxy_mock.py
@@ -41,6 +41,12 @@
     GalaxyDataTestConfig,
 )
 from galaxy.security import idencoding
+from galaxy.short_term_storage import (
+    ShortTermStorageAllocator,
+    ShortTermStorageConfiguration,
+    ShortTermStorageManager,
+    ShortTermStorageMonitor,
+)
 from galaxy.structured_app import (
     BasicSharedApp,
     MinimalManagerApp,
@@ -52,12 +58,6 @@
 from galaxy.tools.data import ToolDataTableManager
 from galaxy.util import StructuredExecutionTimer
 from galaxy.util.bunch import Bunch
-from galaxy.web.short_term_storage import (
-    ShortTermStorageAllocator,
-    ShortTermStorageConfiguration,
-    ShortTermStorageManager,
-    ShortTermStorageMonitor,
-)
 from galaxy.web_stack import ApplicationStack
 
 
@@ -280,6 +280,10 @@ def __init__(self, security: idencoding.IdEncodingHelper, **kwargs):
         self.security = security
 
 
+def mock_url_builder(*a, **k):
+    return f"(fake url): {a}, {k}"
+
+
 class MockTrans:
     def __init__(self, app=None, user=None, history=None, **kwargs):
         self.app = cast(UniverseApplication, app or MockApp(**kwargs))
@@ -291,7 +295,7 @@ def __init__(self, app=None, user=None, history=None, **kwargs):
         self.anonymous = False
         self.debug = True
         self.user_is_admin = True
-        self.url_builder = None
+        self.url_builder = mock_url_builder
 
         self.galaxy_session = None
         self.__user = user
diff --git a/lib/galaxy/celery/tasks.py b/lib/galaxy/celery/tasks.py
index 828e692ba0a2..4c74ffd2807a 100644
--- a/lib/galaxy/celery/tasks.py
+++ b/lib/galaxy/celery/tasks.py
@@ -58,12 +58,12 @@
     WriteHistoryTo,
     WriteInvocationTo,
 )
+from galaxy.short_term_storage import ShortTermStorageMonitor
 from galaxy.structured_app import MinimalManagerApp
 from galaxy.tools import create_tool_from_representation
 from galaxy.tools.data_fetch import do_fetch
 from galaxy.util import galaxy_directory
 from galaxy.util.custom_logging import get_logger
-from galaxy.web.short_term_storage import ShortTermStorageMonitor
 
 log = get_logger(__name__)
 
diff --git a/lib/galaxy/config/__init__.py b/lib/galaxy/config/__init__.py
index 836b69a5f7f0..fd0b5aa9c538 100644
--- a/lib/galaxy/config/__init__.py
+++ b/lib/galaxy/config/__init__.py
@@ -860,7 +860,14 @@ def _process_config(self, kwargs: Dict[str, Any]) -> None:
         self.install_database_engine_options = get_database_engine_options(kwargs, model_prefix="install_")
         self.shared_home_dir = kwargs.get("shared_home_dir")
         self.cookie_path = kwargs.get("cookie_path")
-        self.tool_path = self._in_root_dir(self.tool_path)
+        if not running_from_source and kwargs.get("tool_path") is None:
+            try:
+                self.tool_path = str(files("galaxy.tools") / "bundled")
+            except ModuleNotFoundError:
+                # Might not be a full galaxy installation
+                self.tool_path = self._in_root_dir(self.tool_path)
+        else:
+            self.tool_path = self._in_root_dir(self.tool_path)
         self.tool_data_path = self._in_root_dir(self.tool_data_path)
         if not running_from_source and kwargs.get("tool_data_path") is None:
             self.tool_data_path = self._in_data_dir(self.schema.defaults["tool_data_path"])
diff --git a/lib/galaxy/dependencies/dev-requirements.txt b/lib/galaxy/dependencies/dev-requirements.txt
index 8c4bb177cba5..0be0caf9a3fd 100644
--- a/lib/galaxy/dependencies/dev-requirements.txt
+++ b/lib/galaxy/dependencies/dev-requirements.txt
@@ -26,7 +26,7 @@ codespell==2.2.6 ; python_version >= "3.8" and python_version < "3.12"
 colorama==0.4.6 ; python_version >= "3.8" and python_version < "3.12" and (sys_platform == "win32" or platform_system == "Windows" or os_name == "nt")
 contourpy==1.1.1 ; python_version >= "3.8" and python_version < "3.12"
 coverage[toml]==7.3.2 ; python_version >= "3.8" and python_version < "3.12"
-cryptography==41.0.5 ; python_version >= "3.8" and python_version < "3.12"
+cryptography==41.0.7 ; python_version >= "3.8" and python_version < "3.12"
 cwltest==2.4.20231031143732 ; python_version >= "3.8" and python_version < "3.12"
 cycler==0.12.1 ; python_version >= "3.8" and python_version < "3.12"
 darker==1.7.2 ; python_version >= "3.8" and python_version < "3.12"
@@ -46,8 +46,8 @@ httpcore==1.0.2 ; python_version >= "3.8" and python_version < "3.12"
 httpx==0.25.2 ; python_version >= "3.8" and python_version < "3.12"
 idna==3.6 ; python_version >= "3.8" and python_version < "3.12"
 imagesize==1.4.1 ; python_version >= "3.8" and python_version < "3.12"
-importlib-metadata==6.8.0 ; python_version >= "3.8" and python_version < "3.12"
-importlib-resources==6.1.1 ; python_version >= "3.8" and python_version < "3.12"
+importlib-metadata==6.9.0 ; python_version >= "3.8" and python_version < "3.12"
+importlib-resources==6.1.1 ; python_version >= "3.8" and python_version < "3.10"
 iniconfig==2.0.0 ; python_version >= "3.8" and python_version < "3.12"
 isodate==0.6.1 ; python_version >= "3.8" and python_version < "3.12"
 isort==5.12.0 ; python_version >= "3.8" and python_version < "3.12"
@@ -127,7 +127,7 @@ rfc3986==2.0.0 ; python_version >= "3.8" and python_version < "3.12"
 rich==13.7.0 ; python_version >= "3.8" and python_version < "3.12"
 ruamel-yaml-clib==0.2.8 ; platform_python_implementation == "CPython" and python_version < "3.12" and python_version >= "3.8"
 ruamel-yaml==0.18.5 ; python_version >= "3.8" and python_version < "3.12"
-schema-salad==8.4.20231117150958 ; python_version >= "3.8" and python_version < "3.12"
+schema-salad==8.5.20231201181309 ; python_version >= "3.8" and python_version < "3.12"
 scipy==1.10.1 ; python_version >= "3.8" and python_version < "3.9"
 scipy==1.11.4 ; python_version >= "3.9" and python_version < "3.12"
 secretstorage==3.3.3 ; python_version >= "3.8" and python_version < "3.12" and sys_platform == "linux"
diff --git a/lib/galaxy/dependencies/pinned-lint-requirements.txt b/lib/galaxy/dependencies/pinned-lint-requirements.txt
index 6663da463581..95966290773c 100644
--- a/lib/galaxy/dependencies/pinned-lint-requirements.txt
+++ b/lib/galaxy/dependencies/pinned-lint-requirements.txt
@@ -1,6 +1,6 @@
 attrs==23.1.0
 flake8==6.1.0
-flake8-bugbear==23.9.16
+flake8-bugbear==23.11.28
 mccabe==0.7.0
 pycodestyle==2.11.1
 pyflakes==3.1.0
diff --git a/lib/galaxy/dependencies/pinned-requirements.txt b/lib/galaxy/dependencies/pinned-requirements.txt
index 35c59dfd9e7f..87940aa7e3ed 100644
--- a/lib/galaxy/dependencies/pinned-requirements.txt
+++ b/lib/galaxy/dependencies/pinned-requirements.txt
@@ -6,7 +6,7 @@ aiofiles==23.2.1 ; python_version >= "3.8" and python_version < "3.12"
 aiohttp==3.9.1 ; python_version >= "3.8" and python_version < "3.12"
 aioitertools==0.11.0 ; python_version >= "3.8" and python_version < "3.12"
 aiosignal==1.3.1 ; python_version >= "3.8" and python_version < "3.12"
-alembic==1.12.1 ; python_version >= "3.8" and python_version < "3.12"
+alembic==1.13.0 ; python_version >= "3.8" and python_version < "3.12"
 amqp==5.2.0 ; python_version >= "3.8" and python_version < "3.12"
 aniso8601==9.0.1 ; python_version >= "3.8" and python_version < "3.12"
 anyio==4.1.0 ; python_version >= "3.8" and python_version < "3.12"
@@ -22,7 +22,7 @@ backports-zoneinfo==0.2.1 ; python_version >= "3.8" and python_version < "3.9"
 backports-zoneinfo[tzdata]==0.2.1 ; python_version >= "3.8" and python_version < "3.9"
 bagit-profile==1.3.1 ; python_version >= "3.8" and python_version < "3.12"
 bagit==1.8.1 ; python_version >= "3.8" and python_version < "3.12"
-bcrypt==4.0.1 ; python_version >= "3.8" and python_version < "3.12"
+bcrypt==4.1.1 ; python_version >= "3.8" and python_version < "3.12"
 bdbag==1.7.1 ; python_version >= "3.8" and python_version < "3.12"
 beaker==1.12.1 ; python_version >= "3.8" and python_version < "3.12"
 billiard==4.2.0 ; python_version >= "3.8" and python_version < "3.12"
@@ -48,9 +48,9 @@ cloudbridge==3.2.0 ; python_version >= "3.8" and python_version < "3.12"
 colorama==0.4.6 ; python_version >= "3.8" and python_version < "3.12" and platform_system == "Windows"
 coloredlogs==15.0.1 ; python_version >= "3.8" and python_version < "3.12"
 conda-package-streaming==0.9.0 ; python_version >= "3.8" and python_version < "3.12"
-cryptography==41.0.5 ; python_version >= "3.8" and python_version < "3.12"
+cryptography==41.0.7 ; python_version >= "3.8" and python_version < "3.12"
 cwl-upgrader==1.2.10 ; python_version >= "3.8" and python_version < "3.12"
-cwl-utils==0.31 ; python_version >= "3.8" and python_version < "3.12"
+cwl-utils==0.32 ; python_version >= "3.8" and python_version < "3.12"
 cwltool==3.1.20231114134824 ; python_version >= "3.8" and python_version < "3.12"
 decorator==5.1.1 ; python_version >= "3.8" and python_version < "3.12"
 defusedxml==0.7.1 ; python_version >= "3.8" and python_version < "3.12"
@@ -86,14 +86,14 @@ h5grove==1.3.0 ; python_version >= "3.8" and python_version < "3.12"
 h5py==3.10.0 ; python_version >= "3.8" and python_version < "3.12"
 humanfriendly==10.0 ; python_version >= "3.8" and python_version < "3.12"
 idna==3.6 ; python_version >= "3.8" and python_version < "3.12"
-importlib-metadata==6.8.0 ; python_version >= "3.8" and python_version < "3.12"
+importlib-metadata==6.9.0 ; python_version >= "3.8" and python_version < "3.12"
 importlib-resources==6.1.1 ; python_version >= "3.8" and python_version < "3.12"
 isa-rwval==0.10.10 ; python_version >= "3.8" and python_version < "3.12"
 isodate==0.6.1 ; python_version >= "3.8" and python_version < "3.12"
 jinja2==3.1.2 ; python_version >= "3.8" and python_version < "3.12"
 jmespath==1.0.1 ; python_version >= "3.8" and python_version < "3.12"
 jsonref==1.1.0 ; python_version >= "3.8" and python_version < "3.12"
-jsonschema-specifications==2023.11.1 ; python_version >= "3.8" and python_version < "3.12"
+jsonschema-specifications==2023.11.2 ; python_version >= "3.8" and python_version < "3.12"
 jsonschema==4.20.0 ; python_version >= "3.8" and python_version < "3.12"
 kombu==5.3.4 ; python_version >= "3.8" and python_version < "3.12"
 lagom==2.6.0 ; python_version >= "3.8" and python_version < "3.12"
@@ -156,7 +156,7 @@ pytz==2023.3.post1 ; python_version >= "3.8" and python_version < "3.12"
 pyyaml==6.0.1 ; python_version >= "3.8" and python_version < "3.12"
 pyzmq==25.1.1 ; python_version >= "3.8" and python_version < "3.12"
 rdflib==6.3.2 ; python_version >= "3.8" and python_version < "3.12"
-referencing==0.31.0 ; python_version >= "3.8" and python_version < "3.12"
+referencing==0.31.1 ; python_version >= "3.8" and python_version < "3.12"
 refgenconf==0.12.2 ; python_version >= "3.8" and python_version < "3.12"
 regex==2023.10.3 ; python_version >= "3.8" and python_version < "3.12"
 repoze-lru==0.7 ; python_version >= "3.8" and python_version < "3.12"
@@ -167,12 +167,12 @@ requests==2.31.0 ; python_version >= "3.8" and python_version < "3.12"
 rich==13.7.0 ; python_version >= "3.8" and python_version < "3.12"
 rocrate==0.9.0 ; python_version >= "3.8" and python_version < "3.12"
 routes==2.5.1 ; python_version >= "3.8" and python_version < "3.12"
-rpds-py==0.13.1 ; python_version >= "3.8" and python_version < "3.12"
+rpds-py==0.13.2 ; python_version >= "3.8" and python_version < "3.12"
 rsa==4.9 ; python_version >= "3.8" and python_version < "3.12"
 ruamel-yaml-clib==0.2.8 ; platform_python_implementation == "CPython" and python_version < "3.12" and python_version >= "3.8"
 ruamel-yaml==0.18.5 ; python_version >= "3.8" and python_version < "3.12"
 s3fs==2023.10.0 ; python_version >= "3.8" and python_version < "3.12"
-schema-salad==8.4.20231117150958 ; python_version >= "3.8" and python_version < "3.12"
+schema-salad==8.5.20231201181309 ; python_version >= "3.8" and python_version < "3.12"
 setuptools-scm==5.0.2 ; python_version >= "3.8" and python_version < "3.12"
 setuptools==69.0.2 ; python_version >= "3.8" and python_version < "3.12"
 shellescape==3.8.1 ; python_version >= "3.8" and python_version < "3.12"
@@ -192,7 +192,7 @@ tenacity==8.2.3 ; python_version >= "3.8" and python_version < "3.12"
 tifffile==2023.7.10 ; python_version >= "3.8" and python_version < "3.12"
 tinydb==4.8.0 ; python_version >= "3.8" and python_version < "3.12"
 tomli==2.0.1 ; python_version >= "3.8" and python_version < "3.11"
-tornado==6.3.3 ; python_version >= "3.8" and python_version < "3.12"
+tornado==6.4 ; python_version >= "3.8" and python_version < "3.12"
 tqdm==4.66.1 ; python_version >= "3.8" and python_version < "3.12"
 tuspy==1.0.1 ; python_version >= "3.8" and python_version < "3.12"
 tuswsgi==0.5.5 ; python_version >= "3.8" and python_version < "3.12"
diff --git a/lib/galaxy/dependencies/pinned-typecheck-requirements.txt b/lib/galaxy/dependencies/pinned-typecheck-requirements.txt
index f25703f5524c..83876770d945 100644
--- a/lib/galaxy/dependencies/pinned-typecheck-requirements.txt
+++ b/lib/galaxy/dependencies/pinned-typecheck-requirements.txt
@@ -1,5 +1,5 @@
 cffi==1.16.0 ; python_version >= "3.8" and python_version < "3.12"
-cryptography==41.0.5 ; python_version >= "3.8" and python_version < "3.12"
+cryptography==41.0.7 ; python_version >= "3.8" and python_version < "3.12"
 mypy-extensions==1.0.0 ; python_version >= "3.8" and python_version < "3.12"
 mypy==1.7.1 ; python_version >= "3.8" and python_version < "3.12"
 pycparser==2.21 ; python_version >= "3.8" and python_version < "3.12"
diff --git a/lib/galaxy/exceptions/utils.py b/lib/galaxy/exceptions/utils.py
new file mode 100644
index 000000000000..81a9f8d4023b
--- /dev/null
+++ b/lib/galaxy/exceptions/utils.py
@@ -0,0 +1,33 @@
+from galaxy.exceptions import error_codes
+
+
+def api_error_to_dict(**kwds):
+    UNKNOWN_ERROR_CODE = error_codes.error_codes_by_name["UNKNOWN"]
+    exception = kwds.get("exception", None)
+    if exception:
+        # If we are passed a MessageException use err_msg.
+        default_error_code = getattr(exception, "err_code", UNKNOWN_ERROR_CODE)
+        default_error_message = getattr(exception, "err_msg", default_error_code.default_error_message)
+        extra_error_info = getattr(exception, "extra_error_info", {})
+        if not isinstance(extra_error_info, dict):
+            extra_error_info = {}
+    else:
+        default_error_message = "Error processing API request."
+        default_error_code = UNKNOWN_ERROR_CODE
+        extra_error_info = {}
+    traceback_string = kwds.get("traceback", "No traceback available.")
+    err_msg = kwds.get("err_msg", default_error_message)
+    error_code_object = kwds.get("err_code", default_error_code)
+    try:
+        error_code = error_code_object.code
+    except AttributeError:
+        # Some sort of bad error code sent in, logic failure on part of
+        # Galaxy developer.
+        error_code = UNKNOWN_ERROR_CODE.code
+    # Would prefer the terminology of error_code and error_message, but
+    # err_msg used a good number of places already. Might as well not change
+    # it?
+    error_response = dict(err_msg=err_msg, err_code=error_code, **extra_error_info)
+    if kwds.get("debug"):  # TODO: Should admins get to see traceback as well?
+        error_response["traceback"] = traceback_string
+    return error_response
diff --git a/lib/galaxy/files/sources/s3fs.py b/lib/galaxy/files/sources/s3fs.py
index 6234391409c8..e2a654b16309 100644
--- a/lib/galaxy/files/sources/s3fs.py
+++ b/lib/galaxy/files/sources/s3fs.py
@@ -71,7 +71,8 @@ def _realize_to(self, source_path, native_path, user_context=None, opts: Optiona
         self._open_fs(user_context=user_context, opts=opts).download(bucket_path, native_path)
 
     def _write_from(self, target_path, native_path, user_context=None, opts: Optional[FilesSourceOptions] = None):
-        raise NotImplementedError()
+        bucket_path = self._bucket_path(target_path)
+        self._open_fs(user_context=user_context, opts=opts).upload(native_path, bucket_path)
 
     def _bucket_path(self, path: str):
         if path.startswith("s3://"):
diff --git a/lib/galaxy/managers/base.py b/lib/galaxy/managers/base.py
index 216aac5582c3..66507e6f1550 100644
--- a/lib/galaxy/managers/base.py
+++ b/lib/galaxy/managers/base.py
@@ -68,7 +68,6 @@
     BasicSharedApp,
     MinimalManagerApp,
 )
-from galaxy.web import url_for as gx_url_for
 
 log = logging.getLogger(__name__)
 
@@ -599,6 +598,13 @@ def __call__(self, item: Any, key: str, **context) -> Any:
         ...
 
 
+# TODO: eventually all urls should be generated by the url builder and this can be safely removed.
+# Using it for now to identify in which contexts the url builder is not available
+def url_for_not_available(*args, **kwargs):
+    args_str = [str(arg) for arg in args]
+    raise NotImplementedError(f"url_for is not available in this context - args: {args_str} ")
+
+
 class ModelSerializer(HasAModelManager[T]):
     """
     Turns models into JSONable dicts.
@@ -646,7 +652,7 @@ def __init__(self, app: MinimalManagerApp, **kwargs):
     @staticmethod
     def url_for(*args, context=None, **kwargs):
         trans = context and context.get("trans")
-        url_for = trans and trans.url_builder or gx_url_for
+        url_for = trans and trans.url_builder or url_for_not_available
         return url_for(*args, **kwargs)
 
     def add_serializers(self):
diff --git a/lib/galaxy/managers/collections.py b/lib/galaxy/managers/collections.py
index d46b74ba7f96..f4af990ffe9c 100644
--- a/lib/galaxy/managers/collections.py
+++ b/lib/galaxy/managers/collections.py
@@ -43,11 +43,11 @@
 from galaxy.schema.schema import DatasetCollectionInstanceType
 from galaxy.schema.tasks import PrepareDatasetCollectionDownload
 from galaxy.security.idencoding import IdEncodingHelper
-from galaxy.util import validation
-from galaxy.web.short_term_storage import (
+from galaxy.short_term_storage import (
     ShortTermStorageMonitor,
     storage_context,
 )
+from galaxy.util import validation
 
 log = logging.getLogger(__name__)
 
diff --git a/lib/galaxy/managers/configuration.py b/lib/galaxy/managers/configuration.py
index 78b38046d870..a0f68155e3ef 100644
--- a/lib/galaxy/managers/configuration.py
+++ b/lib/galaxy/managers/configuration.py
@@ -17,7 +17,6 @@
 from galaxy.managers.markdown_util import weasyprint_available
 from galaxy.schema import SerializationParams
 from galaxy.structured_app import StructuredApp
-from galaxy.web.framework.base import server_starttime
 
 log = logging.getLogger(__name__)
 
@@ -183,7 +182,7 @@ def _config_is_truthy(item, key, **context):
             "message_box_content": _use_config,
             "message_box_visible": _use_config,
             "message_box_class": _use_config,
-            "server_startttime": lambda item, key, **context: server_starttime,
+            "server_starttime": lambda item, key, **context: self.app.server_starttime,
             "mailing_join_addr": _defaults_to("galaxy-announce-join@bx.psu.edu"),  # should this be the schema default?
             "server_mail_configured": lambda item, key, **context: bool(item.smtp_server),
             "registration_warning_message": _use_config,
@@ -206,6 +205,7 @@ def _config_is_truthy(item, key, **context):
             ),
             "object_store_allows_id_selection": lambda item, key, **context: object_store.object_store_allows_id_selection(),
             "object_store_ids_allowing_selection": lambda item, key, **context: object_store.object_store_ids_allowing_selection(),
+            "user_activation_on": _use_config,
             "user_library_import_dir_available": lambda item, key, **context: bool(item.get("user_library_import_dir")),
             "welcome_directory": _use_config,
             "themes": _use_config,
diff --git a/lib/galaxy/managers/groups.py b/lib/galaxy/managers/groups.py
index e8919d4db72a..6cbea985d74a 100644
--- a/lib/galaxy/managers/groups.py
+++ b/lib/galaxy/managers/groups.py
@@ -9,6 +9,7 @@
     Conflict,
     ObjectAttributeMissingException,
     ObjectNotFound,
+    RequestParameterInvalidException,
 )
 from galaxy.managers.context import ProvidesAppContext
 from galaxy.managers.roles import get_roles_by_ids
@@ -101,6 +102,39 @@ def update(self, trans: ProvidesAppContext, group_id: int, payload: GroupCreateP
         item["url"] = self._url_for(trans, "show_group", group_id=encoded_id)
         return item
 
+    def delete(self, trans: ProvidesAppContext, group_id: int):
+        group = self._get_group(trans.sa_session, group_id)
+        group.deleted = True
+        trans.sa_session.add(group)
+        with transaction(trans.sa_session):
+            trans.sa_session.commit()
+
+    def purge(self, trans: ProvidesAppContext, group_id: int):
+        group = self._get_group(trans.sa_session, group_id)
+        if not group.deleted:
+            raise RequestParameterInvalidException(
+                f"Group '{group.name}' has not been deleted, so it cannot be purged."
+            )
+        # Delete UserGroupAssociations
+        for uga in group.users:
+            trans.sa_session.delete(uga)
+        # Delete GroupRoleAssociations
+        for gra in group.roles:
+            trans.sa_session.delete(gra)
+        with transaction(trans.sa_session):
+            trans.sa_session.commit()
+
+    def undelete(self, trans: ProvidesAppContext, group_id: int):
+        group = self._get_group(trans.sa_session, group_id)
+        if not group.deleted:
+            raise RequestParameterInvalidException(
+                f"Group '{group.name}' has not been deleted, so it cannot be undeleted."
+            )
+        group.deleted = False
+        trans.sa_session.add(group)
+        with transaction(trans.sa_session):
+            trans.sa_session.commit()
+
     def _url_for(self, trans, name, **kwargs):
         return trans.url_builder(name, **kwargs)
 
diff --git a/lib/galaxy/managers/hdcas.py b/lib/galaxy/managers/hdcas.py
index cd288a1c45a7..9e38c053c77c 100644
--- a/lib/galaxy/managers/hdcas.py
+++ b/lib/galaxy/managers/hdcas.py
@@ -310,6 +310,7 @@ def add_serializers(self):
                 history_id=self.app.security.encode_id(item.history_id),
                 id=self.app.security.encode_id(item.id),
                 type=self.hdca_manager.model_class.content_type,
+                context=context,
             ),
             "contents_url": self.generate_contents_url,
             "job_state_summary": self.serialize_job_state_summary,
diff --git a/lib/galaxy/managers/histories.py b/lib/galaxy/managers/histories.py
index 5c0b62e1a08a..99a7c70d80ff 100644
--- a/lib/galaxy/managers/histories.py
+++ b/lib/galaxy/managers/histories.py
@@ -18,6 +18,7 @@
 from sqlalchemy import (
     asc,
     desc,
+    exists,
     false,
     func,
     select,
@@ -340,13 +341,12 @@ def get_sharing_extra_information(
         return extra
 
     def is_history_shared_with(self, history: model.History, user: model.User) -> bool:
-        stmt = (
-            select(HistoryUserShareAssociation.id)
+        stmt = select(
+            exists()
             .where(HistoryUserShareAssociation.user_id == user.id)
             .where(HistoryUserShareAssociation.history_id == history.id)
-            .limit(1)
         )
-        return bool(self.session().execute(stmt).first())
+        return self.session().scalar(stmt)
 
     def make_members_public(self, trans, item):
         """Make the non-purged datasets in history public.
diff --git a/lib/galaxy/managers/markdown_util.py b/lib/galaxy/managers/markdown_util.py
index 982aecc6b4a6..3523031283cf 100644
--- a/lib/galaxy/managers/markdown_util.py
+++ b/lib/galaxy/managers/markdown_util.py
@@ -50,13 +50,13 @@
 from galaxy.model.orm.now import now
 from galaxy.schema import PdfDocumentType
 from galaxy.schema.tasks import GeneratePdfDownload
-from galaxy.util.markdown import literal_via_fence
-from galaxy.util.resources import resource_string
-from galaxy.util.sanitize_html import sanitize_html
-from galaxy.web.short_term_storage import (
+from galaxy.short_term_storage import (
     ShortTermStorageMonitor,
     storage_context,
 )
+from galaxy.util.markdown import literal_via_fence
+from galaxy.util.resources import resource_string
+from galaxy.util.sanitize_html import sanitize_html
 from .markdown_parse import (
     GALAXY_MARKDOWN_FUNCTION_CALL_LINE,
     validate_galaxy_markdown,
diff --git a/lib/galaxy/managers/model_stores.py b/lib/galaxy/managers/model_stores.py
index a31e5059668f..b96b052cfe0c 100644
--- a/lib/galaxy/managers/model_stores.py
+++ b/lib/galaxy/managers/model_stores.py
@@ -39,12 +39,12 @@
     WriteHistoryTo,
     WriteInvocationTo,
 )
-from galaxy.structured_app import MinimalManagerApp
-from galaxy.version import VERSION
-from galaxy.web.short_term_storage import (
+from galaxy.short_term_storage import (
     ShortTermStorageMonitor,
     storage_context,
 )
+from galaxy.structured_app import MinimalManagerApp
+from galaxy.version import VERSION
 
 
 class ModelStoreUserContext(ProvidesUserContext):
diff --git a/lib/galaxy/managers/roles.py b/lib/galaxy/managers/roles.py
index fbe96ba2b2ad..ecb221cc8044 100644
--- a/lib/galaxy/managers/roles.py
+++ b/lib/galaxy/managers/roles.py
@@ -101,6 +101,59 @@ def create_role(self, trans: ProvidesUserContext, role_definition_model: RoleDef
             trans.sa_session.commit()
         return role
 
+    def delete(self, trans: ProvidesUserContext, role: model.Role) -> model.Role:
+        role.deleted = True
+        trans.sa_session.add(role)
+        with transaction(trans.sa_session):
+            trans.sa_session.commit()
+        return role
+
+    def purge(self, trans: ProvidesUserContext, role: model.Role) -> model.Role:
+        # This method should only be called for a Role that has previously been deleted.
+        # Purging a deleted Role deletes all of the following from the database:
+        # - UserRoleAssociations where role_id == Role.id
+        # - DefaultUserPermissions where role_id == Role.id
+        # - DefaultHistoryPermissions where role_id == Role.id
+        # - GroupRoleAssociations where role_id == Role.id
+        # - DatasetPermissionss where role_id == Role.id
+        if not role.deleted:
+            raise galaxy.exceptions.RequestParameterInvalidException(
+                f"Role '{role.name}' has not been deleted, so it cannot be purged."
+            )
+        # Delete UserRoleAssociations
+        for ura in role.users:
+            user = trans.sa_session.query(trans.app.model.User).get(ura.user_id)
+            # Delete DefaultUserPermissions for associated users
+            for dup in user.default_permissions:
+                if role == dup.role:
+                    trans.sa_session.delete(dup)
+            # Delete DefaultHistoryPermissions for associated users
+            for history in user.histories:
+                for dhp in history.default_permissions:
+                    if role == dhp.role:
+                        trans.sa_session.delete(dhp)
+            trans.sa_session.delete(ura)
+        # Delete GroupRoleAssociations
+        for gra in role.groups:
+            trans.sa_session.delete(gra)
+        # Delete DatasetPermissionss
+        for dp in role.dataset_actions:
+            trans.sa_session.delete(dp)
+        with transaction(trans.sa_session):
+            trans.sa_session.commit()
+        return role
+
+    def undelete(self, trans: ProvidesUserContext, role: model.Role) -> model.Role:
+        if not role.deleted:
+            raise galaxy.exceptions.RequestParameterInvalidException(
+                f"Role '{role.name}' has not been deleted, so it cannot be undeleted."
+            )
+        role.deleted = False
+        trans.sa_session.add(role)
+        with transaction(trans.sa_session):
+            trans.sa_session.commit()
+        return role
+
 
 def get_roles_by_ids(session: Session, role_ids):
     stmt = select(Role).where(Role.id.in_(role_ids))
diff --git a/lib/galaxy/managers/users.py b/lib/galaxy/managers/users.py
index ee9b05c3ac78..eb067d0af8ca 100644
--- a/lib/galaxy/managers/users.py
+++ b/lib/galaxy/managers/users.py
@@ -56,7 +56,6 @@
     MinimalManagerApp,
 )
 from galaxy.util.hash_util import new_secure_hash_v2
-from galaxy.web import url_for
 
 log = logging.getLogger(__name__)
 
@@ -494,13 +493,25 @@ def __set_password(self, trans, user, password, confirm):
         else:
             return "Failed to determine user, access denied."
 
+    def impersonate(self, trans, user):
+        if not trans.app.config.allow_user_impersonation:
+            raise exceptions.Message("User impersonation is not enabled in this instance of Galaxy.")
+        if user:
+            trans.handle_user_logout()
+            trans.handle_user_login(user)
+        else:
+            raise exceptions.Message("Please provide a valid user.")
+
     def send_activation_email(self, trans, email, username):
         """
         Send the verification email containing the activation link to the user's email.
         """
         activation_token = self.__get_activation_token(trans, email)
-        activation_link = url_for(
-            controller="user", action="activate", activation_token=activation_token, email=escape(email), qualified=True
+        activation_link = trans.url_builder(
+            "/user/activate",
+            activation_token=activation_token,
+            email=escape(email),
+            qualified=True,
         )
         template_context = {
             "name": escape(username),
@@ -553,7 +564,7 @@ def send_reset_email(self, trans, payload, **kwd):
         else:
             reset_user, prt = self.get_reset_token(trans, email)
             if prt:
-                reset_url = url_for(controller="login", action="start", token=prt.token)
+                reset_url = trans.url_builder("/login/start", token=prt.token)
                 body = PASSWORD_RESET_TEMPLATE % (
                     trans.app.config.hostname,
                     prt.expiration_time.strftime(trans.app.config.pretty_datetime_format),
@@ -757,11 +768,12 @@ class UserDeserializer(base.ModelDeserializer):
 
     def add_deserializers(self):
         super().add_deserializers()
-        history_deserializers: Dict[str, base.Deserializer] = {
+        user_deserializers: Dict[str, base.Deserializer] = {
+            "active": self.default_deserializer,
             "username": self.deserialize_username,
             "preferred_object_store_id": self.deserialize_preferred_object_store_id,
         }
-        self.deserializers.update(history_deserializers)
+        self.deserializers.update(user_deserializers)
 
     def deserialize_preferred_object_store_id(self, item: Any, key: Any, val: Any, **context):
         preferred_object_store_id = val
diff --git a/lib/galaxy/managers/workflows.py b/lib/galaxy/managers/workflows.py
index b6625ac1b356..4d542abd23b5 100644
--- a/lib/galaxy/managers/workflows.py
+++ b/lib/galaxy/managers/workflows.py
@@ -65,7 +65,10 @@
     WorkflowInvocation,
     WorkflowInvocationStep,
 )
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.model.index_filter_util import (
     append_user_filter,
     raw_text_column_filter,
@@ -97,7 +100,6 @@
     parse_filters_structured,
     RawTextTerm,
 )
-from galaxy.web import url_for
 from galaxy.work.context import WorkRequestContext
 from galaxy.workflow.modules import (
     module_factory,
@@ -819,6 +821,11 @@ def _workflow_from_raw_description(
 
         workflow.has_cycles = True
         workflow.steps = steps
+        # Safeguard: workflow was implicitly merged into this Session prior to SQLAlchemy 2.0.
+        # when AT LEAST ONE step in steps belonged to a session.
+        for step in steps:
+            if ensure_object_added_to_session(workflow, object_in_session=step):
+                break
 
         comments: List[model.WorkflowComment] = []
         comments_by_external_id: Dict[str, model.WorkflowComment] = {}
@@ -873,9 +880,9 @@ def to_format_2(wf_dict, **kwds):
         if style == "editor":
             wf_dict = self._workflow_to_dict_editor(trans, stored, workflow)
         elif style == "legacy":
-            wf_dict = self._workflow_to_dict_instance(stored, workflow=workflow, legacy=True)
+            wf_dict = self._workflow_to_dict_instance(trans, stored, workflow=workflow, legacy=True)
         elif style == "instance":
-            wf_dict = self._workflow_to_dict_instance(stored, workflow=workflow, legacy=False)
+            wf_dict = self._workflow_to_dict_instance(trans, stored, workflow=workflow, legacy=False)
         elif style == "run":
             wf_dict = self._workflow_to_dict_run(trans, stored, workflow=workflow, history=history or trans.history)
         elif style == "preview":
@@ -1205,7 +1212,7 @@ def _workflow_to_dict_editor(self, trans, stored, workflow, tooltip=True, is_sub
                 "workflow_outputs": [],
             }
             if tooltip:
-                step_dict["tooltip"] = module.get_tooltip(static_path=url_for("/static"))
+                step_dict["tooltip"] = module.get_tooltip(static_path="/static")
             # Connections
             input_connections = step.input_connections
             input_connections_type = {}
@@ -1584,12 +1591,12 @@ def callback(input, prefixed_name, **kwargs):
             steps[step.order_index] = step_dict
         return data
 
-    def _workflow_to_dict_instance(self, stored, workflow, legacy=True):
+    def _workflow_to_dict_instance(self, trans, stored, workflow, legacy=True):
         encode = self.app.security.encode_id
         sa_session = self.app.model.context
         item = stored.to_dict(view="element", value_mapper={"id": encode})
         item["name"] = workflow.name
-        item["url"] = url_for("workflow", id=item["id"])
+        item["url"] = trans.url_builder("workflow", id=item["id"])
         item["owner"] = stored.user.username
         item["email_hash"] = md5_hash_str(stored.user.email)
         item["slug"] = stored.slug
diff --git a/lib/galaxy/model/__init__.py b/lib/galaxy/model/__init__.py
index 0e178f8d98d8..2bf193dd334a 100644
--- a/lib/galaxy/model/__init__.py
+++ b/lib/galaxy/model/__init__.py
@@ -119,7 +119,10 @@
 import galaxy.model.tags
 import galaxy.security.passwords
 import galaxy.util
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.model.custom_types import (
     DoubleEncodedJsonType,
     JSONType,
@@ -689,13 +692,15 @@ class User(Base, Dictifiable, RepresentById):
     active = Column(Boolean, index=True, default=True, nullable=False)
     activation_token = Column(TrimmedString(64), nullable=True, index=True)
 
-    addresses = relationship("UserAddress", back_populates="user", order_by=lambda: desc(UserAddress.update_time))
+    addresses = relationship(
+        "UserAddress", back_populates="user", order_by=lambda: desc(UserAddress.update_time), cascade_backrefs=False
+    )
     cloudauthz = relationship("CloudAuthz", back_populates="user")
     custos_auth = relationship("CustosAuthnzToken", back_populates="user")
     default_permissions = relationship("DefaultUserPermissions", back_populates="user")
     groups = relationship("UserGroupAssociation", back_populates="user")
     histories = relationship(
-        "History", back_populates="user", order_by=lambda: desc(History.update_time)  # type: ignore[has-type]
+        "History", back_populates="user", order_by=lambda: desc(History.update_time), cascade_backrefs=False  # type: ignore[has-type]
     )
     active_histories = relationship(
         "History",
@@ -704,7 +709,7 @@ class User(Base, Dictifiable, RepresentById):
         order_by=lambda: desc(History.update_time),  # type: ignore[has-type]
     )
     galaxy_sessions = relationship(
-        "GalaxySession", back_populates="user", order_by=lambda: desc(GalaxySession.update_time)  # type: ignore[has-type]
+        "GalaxySession", back_populates="user", order_by=lambda: desc(GalaxySession.update_time), cascade_backrefs=False  # type: ignore[has-type]
     )
     quotas = relationship("UserQuotaAssociation", back_populates="user")
     quota_source_usages = relationship("UserQuotaSourceUsage", back_populates="user")
@@ -739,9 +744,12 @@ class User(Base, Dictifiable, RepresentById):
     data_manager_histories = relationship("DataManagerHistoryAssociation", back_populates="user")
     roles = relationship("UserRoleAssociation", back_populates="user")
     stored_workflows = relationship(
-        "StoredWorkflow", back_populates="user", primaryjoin=(lambda: User.id == StoredWorkflow.user_id)  # type: ignore[has-type]
+        "StoredWorkflow",
+        back_populates="user",
+        primaryjoin=(lambda: User.id == StoredWorkflow.user_id),  # type: ignore[has-type]
+        cascade_backrefs=False,
     )
-    all_notifications = relationship("UserNotificationAssociation", back_populates="user")
+    all_notifications = relationship("UserNotificationAssociation", back_populates="user", cascade_backrefs=False)
     non_private_roles = relationship(
         "UserRoleAssociation",
         viewonly=True,
@@ -1328,7 +1336,7 @@ class Job(Base, JobLike, UsesCreateAndUpdateTime, Dictifiable, Serializable):
     )
     output_dataset_collection_instances = relationship("JobToOutputDatasetCollectionAssociation", back_populates="job")
     output_dataset_collections = relationship("JobToImplicitOutputDatasetCollectionAssociation", back_populates="job")
-    post_job_actions = relationship("PostJobActionAssociation", back_populates="job")
+    post_job_actions = relationship("PostJobActionAssociation", back_populates="job", cascade_backrefs=False)
     input_library_datasets = relationship("JobToInputLibraryDatasetAssociation", back_populates="job")
     output_library_datasets = relationship("JobToOutputLibraryDatasetAssociation", back_populates="job")
     external_output_metadata = relationship("JobExternalOutputMetadata", back_populates="job")
@@ -1339,10 +1347,12 @@ class Job(Base, JobLike, UsesCreateAndUpdateTime, Dictifiable, Serializable):
     numeric_metrics = relationship("JobMetricNumeric")
     interactivetool_entry_points = relationship("InteractiveToolEntryPoint", back_populates="job", uselist=True)
     implicit_collection_jobs_association = relationship(
-        "ImplicitCollectionJobsJobAssociation", back_populates="job", uselist=False
+        "ImplicitCollectionJobsJobAssociation", back_populates="job", uselist=False, cascade_backrefs=False
     )
     container = relationship("JobContainerAssociation", back_populates="job", uselist=False)
-    data_manager_association = relationship("DataManagerJobAssociation", back_populates="job", uselist=False)
+    data_manager_association = relationship(
+        "DataManagerJobAssociation", back_populates="job", uselist=False, cascade_backrefs=False
+    )
     history_dataset_collection_associations = relationship("HistoryDatasetCollectionAssociation", back_populates="job")
     workflow_invocation_step = relationship("WorkflowInvocationStep", back_populates="job", uselist=False)
 
@@ -2408,7 +2418,9 @@ class ImplicitCollectionJobs(Base, Serializable):
 
     id = Column(Integer, primary_key=True)
     populated_state = Column(TrimmedString(64), default="new", nullable=False)
-    jobs = relationship("ImplicitCollectionJobsJobAssociation", back_populates="implicit_collection_jobs")
+    jobs = relationship(
+        "ImplicitCollectionJobsJobAssociation", back_populates="implicit_collection_jobs", cascade_backrefs=False
+    )
 
     class populated_states(str, Enum):
         NEW = "new"  # New implicit jobs object, unpopulated job associations
@@ -2462,6 +2474,7 @@ def __init__(self, action_type, workflow_step=None, output_name=None, action_arg
         self.output_name = output_name
         self.action_arguments = action_arguments
         self.workflow_step = workflow_step
+        ensure_object_added_to_session(self, object_in_session=workflow_step)
 
 
 class PostJobActionAssociation(Base, RepresentById):
@@ -2476,6 +2489,7 @@ class PostJobActionAssociation(Base, RepresentById):
     def __init__(self, pja, job=None, job_id=None):
         if job is not None:
             self.job = job
+            ensure_object_added_to_session(self, object_in_session=job)
         elif job_id is not None:
             self.job_id = job_id
         else:
@@ -2771,7 +2785,7 @@ class Group(Base, Dictifiable, RepresentById):
     name = Column(String(255), index=True, unique=True)
     deleted = Column(Boolean, index=True, default=False)
     quotas = relationship("GroupQuotaAssociation", back_populates="group")
-    roles = relationship("GroupRoleAssociation", back_populates="group")
+    roles = relationship("GroupRoleAssociation", back_populates="group", cascade_backrefs=False)
     users = relationship("UserGroupAssociation", back_populates="group")
 
     dict_collection_visible_keys = ["id", "name"]
@@ -2846,6 +2860,7 @@ class UserNotificationAssociation(Base, RepresentById):
 
     def __init__(self, user, notification):
         self.user = user
+        ensure_object_added_to_session(self, object_in_session=user)
         self.notification = notification
 
 
@@ -2979,9 +2994,9 @@ class History(Base, HasTags, Dictifiable, UsesAnnotations, HasName, Serializable
     default_permissions = relationship("DefaultHistoryPermissions", back_populates="history")
     users_shared_with = relationship("HistoryUserShareAssociation", back_populates="history")
     galaxy_sessions = relationship("GalaxySessionToHistoryAssociation", back_populates="history")
-    workflow_invocations = relationship("WorkflowInvocation", back_populates="history")
+    workflow_invocations = relationship("WorkflowInvocation", back_populates="history", cascade_backrefs=False)
     user = relationship("User", back_populates="histories")
-    jobs = relationship("Job", back_populates="history")
+    jobs = relationship("Job", back_populates="history", cascade_backrefs=False)
 
     update_time = column_property(
         select(func.max(HistoryAudit.update_time)).where(HistoryAudit.history_id == id).scalar_subquery(),
@@ -3499,6 +3514,7 @@ class GroupRoleAssociation(Base, RepresentById):
 
     def __init__(self, group, role):
         self.group = group
+        ensure_object_added_to_session(self, object_in_session=group)
         self.role = role
 
 
@@ -3599,7 +3615,7 @@ class Quota(Base, Dictifiable, RepresentById):
     operation = Column(String(8))
     deleted = Column(Boolean, index=True, default=False)
     quota_source_label = Column(String(32), default=None)
-    default = relationship("DefaultQuotaAssociation", back_populates="quota")
+    default = relationship("DefaultQuotaAssociation", back_populates="quota", cascade_backrefs=False)
     groups = relationship("GroupQuotaAssociation", back_populates="quota")
     users = relationship("UserQuotaAssociation", back_populates="quota")
 
@@ -3669,6 +3685,7 @@ def __init__(self, type, quota):
         assert type in self.types.__members__.values(), "Invalid type"
         self.type = type
         self.quota = quota
+        ensure_object_added_to_session(self, object_in_session=quota)
 
 
 class DatasetPermissions(Base, RepresentById):
@@ -3709,6 +3726,7 @@ def __init__(self, action, library_item, role):
         self.action = action
         if isinstance(library_item, Library):
             self.library = library_item
+            ensure_object_added_to_session(self, object_in_session=library_item)
         else:
             raise Exception(f"Invalid Library specified: {library_item.__class__.__name__}")
         self.role = role
@@ -3730,6 +3748,7 @@ def __init__(self, action, library_item, role):
         self.action = action
         if isinstance(library_item, LibraryFolder):
             self.folder = library_item
+            ensure_object_added_to_session(self, object_in_session=library_item)
         else:
             raise Exception(f"Invalid LibraryFolder specified: {library_item.__class__.__name__}")
         self.role = role
@@ -3751,6 +3770,7 @@ def __init__(self, action, library_item, role):
         self.action = action
         if isinstance(library_item, LibraryDataset):
             self.library_dataset = library_item
+            ensure_object_added_to_session(self, object_in_session=library_item)
         else:
             raise Exception(f"Invalid LibraryDataset specified: {library_item.__class__.__name__}")
         self.role = role
@@ -3873,13 +3893,14 @@ class Dataset(Base, StorableObject, Serializable):
         ),
         viewonly=True,
     )
-    hashes = relationship("DatasetHash", back_populates="dataset")
+    hashes = relationship("DatasetHash", back_populates="dataset", cascade_backrefs=False)
     sources = relationship("DatasetSource", back_populates="dataset")
-    history_associations = relationship("HistoryDatasetAssociation", back_populates="dataset")
+    history_associations = relationship("HistoryDatasetAssociation", back_populates="dataset", cascade_backrefs=False)
     library_associations = relationship(
         "LibraryDatasetDatasetAssociation",
         primaryjoin=(lambda: LibraryDatasetDatasetAssociation.table.c.dataset_id == Dataset.id),
         back_populates="dataset",
+        cascade_backrefs=False,
     )
 
     # failed_metadata is only valid as DatasetInstance state currently
@@ -4371,6 +4392,7 @@ def __init__(
         elif dataset:
             add_object_to_object_session(self, dataset)
         self.dataset = dataset
+        ensure_object_added_to_session(self, object_in_session=dataset)
         self.parent_id = parent_id
 
     @property
@@ -5368,7 +5390,7 @@ class Library(Base, Dictifiable, HasName, Serializable):
     description = Column(TEXT)
     synopsis = Column(TEXT)
     root_folder = relationship("LibraryFolder", back_populates="library_root")
-    actions = relationship("LibraryPermissions", back_populates="library")
+    actions = relationship("LibraryPermissions", back_populates="library", cascade_backrefs=False)
 
     permitted_actions = get_permitted_actions(filter="LIBRARY")
     dict_collection_visible_keys = ["id", "name"]
@@ -5487,7 +5509,7 @@ class LibraryFolder(Base, Dictifiable, HasName, Serializable):
     )
 
     library_root = relationship("Library", back_populates="root_folder")
-    actions = relationship("LibraryFolderPermissions", back_populates="folder")
+    actions = relationship("LibraryFolderPermissions", back_populates="folder", cascade_backrefs=False)
 
     dict_element_visible_keys = [
         "id",
@@ -5612,7 +5634,7 @@ class LibraryDataset(Base, Serializable):
         viewonly=True,
         uselist=True,
     )
-    actions = relationship("LibraryDatasetPermissions", back_populates="library_dataset")
+    actions = relationship("LibraryDatasetPermissions", back_populates="library_dataset", cascade_backrefs=False)
 
     # This class acts as a proxy to the currently selected LDDA
     upload_options = [
@@ -6125,7 +6147,7 @@ def __init__(self, id=None, collection_type=None, populated=True, element_count=
             self.populated_state = DatasetCollection.populated_states.NEW
         self.element_count = element_count
 
-    def _get_nested_collection_attributes(
+    def _build_nested_collection_attributes_stmt(
         self,
         collection_attributes: Optional[Iterable[str]] = None,
         element_attributes: Optional[Iterable[str]] = None,
@@ -6152,10 +6174,8 @@ def _get_nested_collection_attributes(
         dataset_permission_attributes = dataset_permission_attributes or ()
         return_entities = return_entities or ()
         dataset_collection = self
-        db_session = object_session(self)
         dc = alias(DatasetCollection)
         dce = alias(DatasetCollectionElement)
-
         depth_collection_type = dataset_collection.collection_type
         order_by_columns = [dce.c.element_index]
         nesting_level = 0
@@ -6165,7 +6185,7 @@ def attribute_columns(column_collection, attributes, nesting_level=None):
             return [getattr(column_collection, a).label(f"{a}{label_fragment}") for a in attributes]
 
         q = (
-            db_session.query(
+            select(
                 *attribute_columns(dce.c, element_attributes, nesting_level),
                 *attribute_columns(dc.c, collection_attributes, nesting_level),
             )
@@ -6173,6 +6193,7 @@ def attribute_columns(column_collection, attributes, nesting_level=None):
             .join(dce, dce.c.dataset_collection_id == dc.c.id)
             .filter(dc.c.id == dataset_collection.id)
         )
+
         while ":" in depth_collection_type:
             nesting_level += 1
             inner_dc = alias(DatasetCollection)
@@ -6207,18 +6228,28 @@ def attribute_columns(column_collection, attributes, nesting_level=None):
             .add_columns(*attribute_columns(DatasetPermissions, dataset_permission_attributes))
         )
         for entity in return_entities:
-            q = q.add_entity(entity)
+            q = q.add_columns(entity)
             if entity == DatasetCollectionElement:
                 q = q.filter(entity.id == dce.c.id)
-        return q.distinct().order_by(*order_by_columns)
+
+        q = q.order_by(*order_by_columns)
+        return q
 
     @property
     def dataset_states_and_extensions_summary(self):
         if not hasattr(self, "_dataset_states_and_extensions_summary"):
-            q = self._get_nested_collection_attributes(hda_attributes=("extension",), dataset_attributes=("state",))
+            stmt = self._build_nested_collection_attributes_stmt(
+                hda_attributes=("extension",), dataset_attributes=("state",)
+            )
+            # With DISTINCT, all columns that appear in the ORDER BY clause must appear in the SELECT clause.
+            stmt = stmt.add_columns(*stmt._order_by_clauses)
+            stmt = stmt.distinct()
+
+            tuples = object_session(self).execute(stmt)
+
             extensions = set()
             states = set()
-            for extension, state in q:
+            for extension, state, *_ in tuples:  # we discard the added columns from the order-by clause
                 states.add(state)
                 extensions.add(extension)
 
@@ -6232,8 +6263,9 @@ def has_deferred_data(self):
             has_deferred_data = False
             if object_session(self):
                 # TODO: Optimize by just querying without returning the states...
-                q = self._get_nested_collection_attributes(dataset_attributes=("state",))
-                for (state,) in q:
+                stmt = self._build_nested_collection_attributes_stmt(dataset_attributes=("state",))
+                tuples = object_session(self).execute(stmt)
+                for (state,) in tuples:
                     if state == Dataset.states.DEFERRED:
                         has_deferred_data = True
                         break
@@ -6254,13 +6286,16 @@ def populated_optimized(self):
             if ":" not in self.collection_type:
                 _populated_optimized = self.populated_state == DatasetCollection.populated_states.OK
             else:
-                q = self._get_nested_collection_attributes(
+                stmt = self._build_nested_collection_attributes_stmt(
                     collection_attributes=("populated_state",),
                     inner_filter=InnerCollectionFilter(
                         "populated_state", operator.__ne__, DatasetCollection.populated_states.OK
                     ),
                 )
-                _populated_optimized = q.session.query(~exists(q.subquery())).scalar()
+                stmt = stmt.subquery()
+                stmt = select(~exists(stmt))
+                session = object_session(self)
+                _populated_optimized = session.scalar(stmt)
 
             self._populated_optimized = _populated_optimized
 
@@ -6276,37 +6311,25 @@ def populated(self):
     @property
     def dataset_action_tuples(self):
         if not hasattr(self, "_dataset_action_tuples"):
-            q = self._get_nested_collection_attributes(dataset_permission_attributes=("action", "role_id"))
-            _dataset_action_tuples = []
-            for _dataset_action_tuple in q:
-                if _dataset_action_tuple[0] is None:
-                    continue
-                _dataset_action_tuples.append(_dataset_action_tuple)
-
-            self._dataset_action_tuples = _dataset_action_tuples
-
+            stmt = self._build_nested_collection_attributes_stmt(dataset_permission_attributes=("action", "role_id"))
+            tuples = object_session(self).execute(stmt)
+            self._dataset_action_tuples = [(action, role_id) for action, role_id in tuples if action is not None]
         return self._dataset_action_tuples
 
-    @property
-    def element_identifiers_extensions_and_paths(self):
-        q = self._get_nested_collection_attributes(
-            element_attributes=("element_identifier",), hda_attributes=("extension",), return_entities=(Dataset,)
-        )
-        return [(row[:-2], row.extension, row.Dataset.get_file_name()) for row in q]
-
     @property
     def element_identifiers_extensions_paths_and_metadata_files(
         self,
     ) -> List[List[Any]]:
         results = []
         if object_session(self):
-            q = self._get_nested_collection_attributes(
+            stmt = self._build_nested_collection_attributes_stmt(
                 element_attributes=("element_identifier",),
                 hda_attributes=("extension",),
                 return_entities=(HistoryDatasetAssociation, Dataset),
             )
+            tuples = object_session(self).execute(stmt)
             # element_identifiers, extension, path
-            for row in q:
+            for row in tuples:
                 result = [row[:-3], row.extension, row.Dataset.get_file_name()]
                 hda = row.HistoryDatasetAssociation
                 result.append(hda.get_metadata_file_paths_and_extensions())
@@ -6351,7 +6374,9 @@ def finalize(self, collection_type_description):
     def dataset_instances(self):
         db_session = object_session(self)
         if db_session and self.id:
-            return self._get_nested_collection_attributes(return_entities=(HistoryDatasetAssociation,)).all()
+            stmt = self._build_nested_collection_attributes_stmt(return_entities=(HistoryDatasetAssociation,))
+            tuples = db_session.execute(stmt).all()
+            return [tuple[0] for tuple in tuples]
         else:
             # Sessionless context
             instances = []
@@ -6367,7 +6392,9 @@ def dataset_instances(self):
     def dataset_elements(self):
         db_session = object_session(self)
         if db_session and self.id:
-            return self._get_nested_collection_attributes(return_entities=(DatasetCollectionElement,)).all()
+            stmt = self._build_nested_collection_attributes_stmt(return_entities=(DatasetCollectionElement,))
+            tuples = db_session.execute(stmt).all()
+            return [tuple[0] for tuple in tuples]
         elements = []
         for element in self.elements:
             if element.is_collection:
@@ -6452,9 +6479,11 @@ def copy(
         return new_collection
 
     def replace_failed_elements(self, replacements):
-        hda_id_to_element = dict(
-            self._get_nested_collection_attributes(return_entities=[DatasetCollectionElement], hda_attributes=["id"])
+        stmt = self._build_nested_collection_attributes_stmt(
+            return_entities=[DatasetCollectionElement], hda_attributes=["id"]
         )
+        tuples = object_session(self).execute(stmt).all()
+        hda_id_to_element = dict(tuples)
         for failed, replacement in replacements.items():
             element = hda_id_to_element.get(failed.id)
             if element:
@@ -6719,10 +6748,12 @@ def job_state_summary_dict(self):
     @property
     def dataset_dbkeys_and_extensions_summary(self):
         if not hasattr(self, "_dataset_dbkeys_and_extensions_summary"):
-            rows = self.collection._get_nested_collection_attributes(hda_attributes=("_metadata", "extension"))
+            stmt = self.collection._build_nested_collection_attributes_stmt(hda_attributes=("_metadata", "extension"))
+            tuples = object_session(self).execute(stmt)
+
             extensions = set()
             dbkeys = set()
-            for row in rows:
+            for row in tuples:
                 if row is not None:
                     dbkey_field = row._metadata.get("dbkey")
                     if isinstance(dbkey_field, list):
@@ -7192,7 +7223,9 @@ class GalaxySession(Base, RepresentById):
     disk_usage = Column(Numeric(15, 0), index=True)
     last_action = Column(DateTime)
     current_history = relationship("History")
-    histories = relationship("GalaxySessionToHistoryAssociation", back_populates="galaxy_session")
+    histories = relationship(
+        "GalaxySessionToHistoryAssociation", back_populates="galaxy_session", cascade_backrefs=False
+    )
     user = relationship("User", back_populates="galaxy_sessions")
 
     def __init__(self, is_valid=False, **kwd):
@@ -7229,6 +7262,7 @@ class GalaxySessionToHistoryAssociation(Base, RepresentById):
 
     def __init__(self, galaxy_session, history):
         self.galaxy_session = galaxy_session
+        ensure_object_added_to_session(self, object_in_session=galaxy_session)
         add_object_to_object_session(self, history)
         self.history = history
 
@@ -7275,6 +7309,7 @@ class StoredWorkflow(Base, HasTags, Dictifiable, RepresentById):
         cascade="all, delete-orphan",
         primaryjoin=(lambda: StoredWorkflow.id == Workflow.stored_workflow_id),  # type: ignore[has-type]
         order_by=lambda: -Workflow.id,  # type: ignore[has-type]
+        cascade_backrefs=False,
     )
     latest_workflow = relationship(
         "Workflow",
@@ -7443,6 +7478,7 @@ class Workflow(Base, Dictifiable, RepresentById):
         "WorkflowStep",
         primaryjoin=(lambda: Workflow.id == WorkflowStep.subworkflow_id),  # type: ignore[has-type]
         back_populates="subworkflow",
+        cascade_backrefs=False,
     )
     stored_workflow = relationship(
         "StoredWorkflow",
@@ -7631,14 +7667,17 @@ class WorkflowStep(Base, RepresentById):
         order_by=lambda: WorkflowStepAnnotationAssociation.id,
         back_populates="workflow_step",
     )
-    post_job_actions = relationship("PostJobAction", back_populates="workflow_step")
+    post_job_actions = relationship("PostJobAction", back_populates="workflow_step", cascade_backrefs=False)
     inputs = relationship("WorkflowStepInput", back_populates="workflow_step")
-    workflow_outputs = relationship("WorkflowOutput", back_populates="workflow_step")
+    workflow_outputs = relationship("WorkflowOutput", back_populates="workflow_step", cascade_backrefs=False)
     output_connections = relationship(
         "WorkflowStepConnection", primaryjoin=(lambda: WorkflowStepConnection.output_step_id == WorkflowStep.id)
     )
     workflow = relationship(
-        "Workflow", primaryjoin=(lambda: Workflow.id == WorkflowStep.workflow_id), back_populates="steps"
+        "Workflow",
+        primaryjoin=(lambda: Workflow.id == WorkflowStep.workflow_id),
+        back_populates="steps",
+        cascade_backrefs=False,
     )
 
     # Injected attributes
@@ -7735,6 +7774,7 @@ def add_connection(self, input_name, output_name, output_step, input_subworkflow
 
         conn = WorkflowStepConnection()
         conn.input_step_input = step_input
+        ensure_object_added_to_session(conn, object_in_session=step_input)
         conn.output_name = output_name
         add_object_to_object_session(conn, output_step)
         conn.output_step = output_step
@@ -7924,6 +7964,7 @@ class WorkflowStepInput(Base, RepresentById):
         "WorkflowStepConnection",
         back_populates="input_step_input",
         primaryjoin=(lambda: WorkflowStepConnection.input_step_input_id == WorkflowStepInput.id),
+        cascade_backrefs=False,
     )
 
     def __init__(self, workflow_step):
@@ -8015,6 +8056,7 @@ class WorkflowOutput(Base, Serializable):
 
     def __init__(self, workflow_step, output_name=None, label=None, uuid=None):
         self.workflow_step = workflow_step
+        ensure_object_added_to_session(self, object_in_session=workflow_step)
         self.output_name = output_name
         self.label = label
         self.uuid = get_uuid(uuid)
@@ -8154,12 +8196,20 @@ class WorkflowInvocation(Base, UsesCreateAndUpdateTime, Dictifiable, Serializabl
     history_id = Column(Integer, ForeignKey("history.id"), index=True)
 
     history = relationship("History", back_populates="workflow_invocations")
-    input_parameters = relationship("WorkflowRequestInputParameter", back_populates="workflow_invocation")
-    step_states = relationship("WorkflowRequestStepState", back_populates="workflow_invocation")
-    input_step_parameters = relationship("WorkflowRequestInputStepParameter", back_populates="workflow_invocation")
-    input_datasets = relationship("WorkflowRequestToInputDatasetAssociation", back_populates="workflow_invocation")
+    input_parameters = relationship(
+        "WorkflowRequestInputParameter", back_populates="workflow_invocation", cascade_backrefs=False
+    )
+    step_states = relationship("WorkflowRequestStepState", back_populates="workflow_invocation", cascade_backrefs=False)
+    input_step_parameters = relationship(
+        "WorkflowRequestInputStepParameter", back_populates="workflow_invocation", cascade_backrefs=False
+    )
+    input_datasets = relationship(
+        "WorkflowRequestToInputDatasetAssociation", back_populates="workflow_invocation", cascade_backrefs=False
+    )
     input_dataset_collections = relationship(
-        "WorkflowRequestToInputDatasetCollectionAssociation", back_populates="workflow_invocation"
+        "WorkflowRequestToInputDatasetCollectionAssociation",
+        back_populates="workflow_invocation",
+        cascade_backrefs=False,
     )
     subworkflow_invocations = relationship(
         "WorkflowInvocationToSubworkflowInvocationAssociation",
@@ -8173,13 +8223,20 @@ class WorkflowInvocation(Base, UsesCreateAndUpdateTime, Dictifiable, Serializabl
         "WorkflowInvocationStep",
         back_populates="workflow_invocation",
         order_by=lambda: WorkflowInvocationStep.order_index,
+        cascade_backrefs=False,
     )
     workflow: Workflow = relationship("Workflow")
     output_dataset_collections = relationship(
-        "WorkflowInvocationOutputDatasetCollectionAssociation", back_populates="workflow_invocation"
+        "WorkflowInvocationOutputDatasetCollectionAssociation",
+        back_populates="workflow_invocation",
+        cascade_backrefs=False,
+    )
+    output_datasets = relationship(
+        "WorkflowInvocationOutputDatasetAssociation", back_populates="workflow_invocation", cascade_backrefs=False
+    )
+    output_values = relationship(
+        "WorkflowInvocationOutputValue", back_populates="workflow_invocation", cascade_backrefs=False
     )
-    output_datasets = relationship("WorkflowInvocationOutputDatasetAssociation", back_populates="workflow_invocation")
-    output_values = relationship("WorkflowInvocationOutputValue", back_populates="workflow_invocation")
     messages = relationship("WorkflowInvocationMessage", back_populates="workflow_invocation")
 
     dict_collection_visible_keys = [
@@ -8388,6 +8445,7 @@ def add_output(self, workflow_output, step, output_object):
             # dispatch on actual object and not step type.
             output_assoc = WorkflowInvocationOutputValue()
             output_assoc.workflow_invocation = self
+            ensure_object_added_to_session(output_assoc, object_in_session=self)
             output_assoc.workflow_output = workflow_output
             output_assoc.workflow_step = step
             output_assoc.value = output_object
@@ -8395,6 +8453,7 @@ def add_output(self, workflow_output, step, output_object):
         elif output_object.history_content_type == "dataset":
             output_assoc = WorkflowInvocationOutputDatasetAssociation()
             output_assoc.workflow_invocation = self
+            ensure_object_added_to_session(output_assoc, object_in_session=self)
             output_assoc.workflow_output = workflow_output
             output_assoc.workflow_step = step
             output_assoc.dataset = output_object
@@ -8402,6 +8461,7 @@ def add_output(self, workflow_output, step, output_object):
         elif output_object.history_content_type == "dataset_collection":
             output_assoc = WorkflowInvocationOutputDatasetCollectionAssociation()
             output_assoc.workflow_invocation = self
+            ensure_object_added_to_session(output_assoc, object_in_session=self)
             output_assoc.workflow_output = workflow_output
             output_assoc.workflow_step = step
             output_assoc.dataset_collection = output_object
@@ -8793,10 +8853,14 @@ class WorkflowInvocationStep(Base, Dictifiable, Serializable):
     job = relationship("Job", back_populates="workflow_invocation_step", uselist=False)
     implicit_collection_jobs = relationship("ImplicitCollectionJobs", uselist=False)
     output_dataset_collections = relationship(
-        "WorkflowInvocationStepOutputDatasetCollectionAssociation", back_populates="workflow_invocation_step"
+        "WorkflowInvocationStepOutputDatasetCollectionAssociation",
+        back_populates="workflow_invocation_step",
+        cascade_backrefs=False,
     )
     output_datasets = relationship(
-        "WorkflowInvocationStepOutputDatasetAssociation", back_populates="workflow_invocation_step"
+        "WorkflowInvocationStepOutputDatasetAssociation",
+        back_populates="workflow_invocation_step",
+        cascade_backrefs=False,
     )
     workflow_invocation = relationship("WorkflowInvocation", back_populates="steps")
     output_value = relationship(
@@ -8851,12 +8915,14 @@ def add_output(self, output_name, output_object):
         if output_object.history_content_type == "dataset":
             output_assoc = WorkflowInvocationStepOutputDatasetAssociation()
             output_assoc.workflow_invocation_step = self
+            ensure_object_added_to_session(output_assoc, object_in_session=self)
             output_assoc.dataset = output_object
             output_assoc.output_name = output_name
             self.output_datasets.append(output_assoc)
         elif output_object.history_content_type == "dataset_collection":
             output_assoc = WorkflowInvocationStepOutputDatasetCollectionAssociation()
             output_assoc.workflow_invocation_step = self
+            ensure_object_added_to_session(output_assoc, object_in_session=self)
             output_assoc.dataset_collection = output_object
             output_assoc.output_name = output_name
             self.output_dataset_collections.append(output_assoc)
@@ -9928,6 +9994,7 @@ class Visualization(Base, HasTags, Dictifiable, RepresentById):
         back_populates="visualization",
         cascade="all, delete-orphan",
         primaryjoin=(lambda: Visualization.id == VisualizationRevision.visualization_id),
+        cascade_backrefs=False,
     )
     latest_revision = relationship(
         "VisualizationRevision",
diff --git a/lib/galaxy/model/base.py b/lib/galaxy/model/base.py
index 2aade3f4ff36..2e4d248afeb4 100644
--- a/lib/galaxy/model/base.py
+++ b/lib/galaxy/model/base.py
@@ -20,6 +20,7 @@
 
 from sqlalchemy import event
 from sqlalchemy.orm import (
+    object_session,
     scoped_session,
     Session,
     sessionmaker,
@@ -167,3 +168,22 @@ def before_flush(session, flush_context, instances):
             obj.__create_version__(session)
         for obj in versioned_objects(session.deleted):
             obj.__create_version__(session, deleted=True)
+
+
+def ensure_object_added_to_session(object_to_add, *, object_in_session=None, session=None) -> bool:
+    """
+    This function is intended as a safeguard to mimic pre-SQLAlchemy 2.0 behavior.
+    `object_to_add` was implicitly merged into a Session prior to SQLAlchemy 2.0, which was indicated
+    by `RemovedIn20Warning` warnings logged while running Galaxy's tests. (See https://github.com/galaxyproject/galaxy/issues/12541)
+    As part of the upgrade to 2.0, the `cascade_backrefs=False` argument was added to the relevant relationships that turned off this behavior.
+    This function is called from the code that triggered these warnings, thus emulating the cascading behavior.
+    The intention is to remove all such calls, as well as this function definition, after the move to SQLAlchemy 2.0.
+    # Ref: https://docs.sqlalchemy.org/en/14/changelog/migration_14.html#cascade-backrefs-behavior-deprecated-for-removal-in-2-0
+    """
+    if session:
+        session.add(object_to_add)
+        return True
+    if object_in_session and object_session(object_in_session):
+        object_session(object_in_session).add(object_to_add)
+        return True
+    return False
diff --git a/lib/galaxy/model/database_utils.py b/lib/galaxy/model/database_utils.py
index ee7d12819edb..0865450d71da 100644
--- a/lib/galaxy/model/database_utils.py
+++ b/lib/galaxy/model/database_utils.py
@@ -12,6 +12,7 @@
 )
 from sqlalchemy.engine import Engine
 from sqlalchemy.engine.url import make_url
+from sqlalchemy.orm import object_session
 from sqlalchemy.sql.compiler import IdentifierPreparer
 from sqlalchemy.sql.expression import (
     ClauseElement,
@@ -175,3 +176,22 @@ def _statement_executed_without_error(statement: ClauseElement, engine: Engine)
 
 def is_postgres(url: DbUrl) -> bool:
     return url.startswith("postgres")
+
+
+def ensure_object_added_to_session(object_to_add, *, object_in_session=None, session=None) -> bool:
+    """
+    This function is intended as a safeguard to mimic pre-SQLAlchemy 2.0 behavior.
+    `object_to_add` was implicitly merged into a Session prior to SQLAlchemy 2.0, which was indicated
+    by `RemovedIn20Warning` warnings logged while running Galaxy's tests. (See https://github.com/galaxyproject/galaxy/issues/12541)
+    As part of the upgrade to 2.0, the `cascade_backrefs=False` argument was added to the relevant relationships that turned off this behavior.
+    This function is called from the code that triggered these warnings, thus emulating the cascading behavior.
+    The intention is to remove all such calls, as well as this function definition, after the move to SQLAlchemy 2.0.
+    # Ref: https://docs.sqlalchemy.org/en/14/changelog/migration_14.html#cascade-backrefs-behavior-deprecated-for-removal-in-2-0
+    """
+    if session:
+        session.add(object_to_add)
+        return True
+    if object_in_session and object_session(object_in_session):
+        object_session(object_in_session).add(object_to_add)
+        return True
+    return False
diff --git a/lib/galaxy/model/store/__init__.py b/lib/galaxy/model/store/__init__.py
index e18fa9ba71a5..eb30696b1e34 100644
--- a/lib/galaxy/model/store/__init__.py
+++ b/lib/galaxy/model/store/__init__.py
@@ -56,7 +56,10 @@
     ProvidesUserFileSourcesUserContext,
 )
 from galaxy.files.uris import stream_url_to_file
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.model.mapping import GalaxyModelMapping
 from galaxy.model.metadata import MetadataCollection
 from galaxy.model.orm.util import (
@@ -1024,6 +1027,7 @@ def _import_workflow_invocations(
             imported_invocation = model.WorkflowInvocation()
             imported_invocation.user = self.user
             imported_invocation.history = history
+            ensure_object_added_to_session(imported_invocation, object_in_session=history)
             workflow_key = invocation_attrs["workflow"]
             if workflow_key not in object_import_tracker.workflows_by_key:
                 raise Exception(f"Failed to find key {workflow_key} in {object_import_tracker.workflows_by_key.keys()}")
@@ -1045,6 +1049,7 @@ def attach_workflow_step(imported_object, attrs):
             for step_attrs in invocation_attrs["steps"]:
                 imported_invocation_step = model.WorkflowInvocationStep()
                 imported_invocation_step.workflow_invocation = imported_invocation
+                ensure_object_added_to_session(imported_invocation, session=self.sa_session)
                 attach_workflow_step(imported_invocation_step, step_attrs)
                 restore_times(imported_invocation_step, step_attrs)
                 imported_invocation_step.action = step_attrs["action"]
diff --git a/lib/galaxy/schema/fetch_data.py b/lib/galaxy/schema/fetch_data.py
index 0655b9904823..83cc385d4b2d 100644
--- a/lib/galaxy/schema/fetch_data.py
+++ b/lib/galaxy/schema/fetch_data.py
@@ -119,6 +119,7 @@ class BaseDataElement(FetchBaseModel):
     items_from: Optional[ElementsFromType] = Field(alias="elements_from")
     collection_type: Optional[str]
     MD5: Optional[str]
+    description: Optional[str]
 
     class Config:
         # reject unknown extra attributes
diff --git a/lib/galaxy/schema/item_tags.py b/lib/galaxy/schema/item_tags.py
index 6458241717c9..1237e42f01dc 100644
--- a/lib/galaxy/schema/item_tags.py
+++ b/lib/galaxy/schema/item_tags.py
@@ -42,7 +42,7 @@ class ItemTagsListResponse(Model):
 class ItemTagsCreatePayload(Model):
     """Payload schema for creating an item tag."""
 
-    value: str = Field(
-        Required,
+    value: Optional[str] = Field(
+        None,
         title="value of the item tag",
     )
diff --git a/lib/galaxy/schema/jobs.py b/lib/galaxy/schema/jobs.py
index aaa10f68f42d..4ab9241c9e4c 100644
--- a/lib/galaxy/schema/jobs.py
+++ b/lib/galaxy/schema/jobs.py
@@ -157,7 +157,7 @@ class EncodedDatasetJobInfo(EncodedDataItemSourceId):
 
 
 class EncodedJobDetails(JobSummary):
-    command_version: str = Field(
+    command_version: Optional[str] = Field(
         ...,
         title="Command Version",
         description="Tool version indicated during job execution.",
diff --git a/lib/galaxy/web/short_term_storage/__init__.py b/lib/galaxy/short_term_storage/__init__.py
similarity index 95%
rename from lib/galaxy/web/short_term_storage/__init__.py
rename to lib/galaxy/short_term_storage/__init__.py
index 5291c04cd311..73a452242705 100644
--- a/lib/galaxy/web/short_term_storage/__init__.py
+++ b/lib/galaxy/short_term_storage/__init__.py
@@ -1,3 +1,12 @@
+""" Short Term Storage service for Galaxy.
+
+This service is used to store files for a short period of time (e.g. a few minutes, hours or days)
+and then serve them to the client. This is useful for large files that take a long time to
+generate and are not worth storing permanently.
+"""
+
+# TODO: Move it to its own package https://github.com/galaxyproject/galaxy/pull/17058#discussion_r1400909897
+
 import abc
 import contextlib
 import json
@@ -24,13 +33,13 @@
     ObjectNotFound,
 )
 from galaxy.exceptions.error_codes import error_codes_by_int_code
+from galaxy.exceptions.utils import api_error_to_dict
 from galaxy.schema.schema import OptionalNumberT
 from galaxy.util import (
     directory_hash_id,
     is_uuid,
     safe_makedirs,
 )
-from galaxy.web.framework.decorators import api_error_message
 
 now = datetime.utcnow
 DEFAULT_STORAGE_DURATION = 24 * 60 * 60  # store for a day by default
@@ -220,7 +229,7 @@ def cancel(self, target: ShortTermStorageTarget, exception: Optional[MessageExce
         if exception:
             exception_json = {
                 "status_code": exception.status_code,
-                "exception": api_error_message(None, exception=exception),
+                "exception": api_error_to_dict(exception=exception),
             }
         else:
             exception_json = {"status_code": 204, "exception": None}  # NO CONTENT
diff --git a/lib/galaxy/structured_app.py b/lib/galaxy/structured_app.py
index ba62268c35c6..2c20b9cf3d53 100644
--- a/lib/galaxy/structured_app.py
+++ b/lib/galaxy/structured_app.py
@@ -95,6 +95,7 @@ class MinimalApp(BasicSharedApp):
     install_model: ModelMapping
     security_agent: GalaxyRBACAgent
     host_security_agent: HostAgent
+    server_starttime: int
 
 
 class MinimalManagerApp(MinimalApp):
diff --git a/lib/galaxy/tool_util/parser/yaml.py b/lib/galaxy/tool_util/parser/yaml.py
index 7ebc574c9ad0..c39599849744 100644
--- a/lib/galaxy/tool_util/parser/yaml.py
+++ b/lib/galaxy/tool_util/parser/yaml.py
@@ -267,7 +267,7 @@ def _parse_test(i, test_dict) -> ToolSourceTest:
     return test_dict
 
 
-def __to_test_assert_list(assertions) -> AssertionList:
+def to_test_assert_list(assertions) -> AssertionList:
     def expand_dict_form(item):
         key, value = item
         new_value = value.copy()
@@ -281,6 +281,12 @@ def expand_dict_form(item):
     for assertion in assertions:
         # TODO: not handling nested assertions correctly,
         # not sure these are used though.
+        if "that" not in assertion:
+            new_assertion = {}
+            for assertion_key, assertion_value in assertion.items():
+                new_assertion["that"] = assertion_key
+                new_assertion.update(assertion_value)
+            assertion = new_assertion
         children = []
         if "children" in assertion:
             children = assertion["children"]
@@ -295,6 +301,9 @@ def expand_dict_form(item):
     return assert_list or None  # XML variant is None if no assertions made
 
 
+__to_test_assert_list = to_test_assert_list
+
+
 class YamlPageSource(PageSource):
     def __init__(self, inputs_list):
         self.inputs_list = inputs_list
diff --git a/lib/galaxy/tool_util/xsd/galaxy.xsd b/lib/galaxy/tool_util/xsd/galaxy.xsd
index 4994e5e7b7ee..02d67e1c35b3 100644
--- a/lib/galaxy/tool_util/xsd/galaxy.xsd
+++ b/lib/galaxy/tool_util/xsd/galaxy.xsd
@@ -7322,24 +7322,39 @@ and ``contains``. In addition there is ``sim_size`` which is discouraged in favo
     <xs:annotation>
       <xs:documentation xml:lang="en">Documentation for PermissiveBoolean</xs:documentation>
     </xs:annotation>
-    <xs:restriction base="xs:string">
-      <xs:enumeration value="0"/>
-      <xs:enumeration value="1"/>
-      <xs:enumeration value="true"/>
-      <xs:enumeration value="false"/>
-      <xs:enumeration value="True"/>
-      <xs:enumeration value="False"/>
-      <xs:enumeration value="yes"/>
-      <xs:enumeration value="no"/>
-    </xs:restriction>
+    <xs:union>
+      <xs:simpleType>
+        <xs:restriction base="xs:boolean"/>
+      </xs:simpleType>
+      <xs:simpleType>
+        <xs:restriction base="xs:string">
+          <xs:enumeration value="0"/>
+          <xs:enumeration value="1"/>
+          <xs:enumeration value="true"/>
+          <xs:enumeration value="false"/>
+          <xs:enumeration value="True"/>
+          <xs:enumeration value="False"/>
+          <xs:enumeration value="yes"/>
+          <xs:enumeration value="no"/>
+        </xs:restriction>
+      </xs:simpleType>
+    </xs:union>
   </xs:simpleType>
   <xs:simpleType name="Bytes">
     <xs:annotation>
       <xs:documentation xml:lang="en">Number of bytes allowing for suffix (k|K|M|G|P|E)i? </xs:documentation>
     </xs:annotation>
-    <xs:restriction base="xs:string">
-      <xs:pattern value="(0|[1-9][0-9]*)([kKMGTPE]i?)?"></xs:pattern>
-    </xs:restriction>
+    <xs:union>
+       <xs:simpleType>
+         <xs:restriction base="xs:integer">
+         </xs:restriction>
+       </xs:simpleType>
+       <xs:simpleType>
+         <xs:restriction base="xs:string">
+          <xs:pattern value="(0|[1-9][0-9]*)([kKMGTPE]i?)?"></xs:pattern>
+         </xs:restriction>
+       </xs:simpleType>
+    </xs:union>
   </xs:simpleType>
   <xs:complexType name="EdamTopics">
     <xs:annotation>
diff --git a/lib/galaxy/tools/error_reports/plugins/slack.py b/lib/galaxy/tools/error_reports/plugins/slack.py
index ee819b6f2669..10e3c69128b4 100644
--- a/lib/galaxy/tools/error_reports/plugins/slack.py
+++ b/lib/galaxy/tools/error_reports/plugins/slack.py
@@ -8,7 +8,6 @@
 
 import requests
 
-from galaxy import web
 from galaxy.util import string_as_bool
 from .base_git import BaseGitPlugin
 
@@ -38,7 +37,7 @@ def _fill_issue_cache(self, *args, **kwargs):
 
     def submit_report(self, dataset, job, tool, **kwargs):
         history_id_encoded = self.app.security.encode_id(dataset.history_id)
-        history_view_link = web.url_for("/histories/view", id=history_id_encoded, qualified=True)
+        history_view_link = self.app.url_for("/histories/view", id=history_id_encoded, qualified=True)
         error_report_id = str(uuid.uuid4())[0:13]
         title = self._generate_error_title(job)
 
diff --git a/lib/galaxy/tools/errors.py b/lib/galaxy/tools/errors.py
index a2ee14a69ddf..a9a74e0a3de1 100644
--- a/lib/galaxy/tools/errors.py
+++ b/lib/galaxy/tools/errors.py
@@ -8,7 +8,6 @@
 from galaxy import (
     model,
     util,
-    web,
 )
 from galaxy.security.validate_user_input import validate_email_str
 from galaxy.util import unicodify
@@ -159,11 +158,11 @@ def _can_access_dataset(self, user):
     def create_report(self, user, email="", message="", redact_user_details_in_bugreport=False, **kwd):
         hda = self.hda
         job = self.job
-        host = web.url_for("/", qualified=True)
+        host = self.app.url_for("/", qualified=True)
         history_id_encoded = self.app.security.encode_id(hda.history_id)
-        history_view_link = web.url_for("/histories/view", id=history_id_encoded, qualified=True)
+        history_view_link = self.app.url_for("/histories/view", id=history_id_encoded, qualified=True)
         hda_id_encoded = self.app.security.encode_id(hda.id)
-        hda_show_params_link = web.url_for(
+        hda_show_params_link = self.app.url_for(
             controller="dataset", action="details", dataset_id=hda_id_encoded, qualified=True
         )
         # Build the email message
diff --git a/lib/galaxy/tools/search/__init__.py b/lib/galaxy/tools/search/__init__.py
index 650bcea425e3..075cbc9c51ea 100644
--- a/lib/galaxy/tools/search/__init__.py
+++ b/lib/galaxy/tools/search/__init__.py
@@ -57,8 +57,10 @@
 from whoosh.writing import AsyncWriter
 
 from galaxy.config import GalaxyAppConfiguration
-from galaxy.util import ExecutionTimer
-from galaxy.web.framework.helpers import to_unicode
+from galaxy.util import (
+    ExecutionTimer,
+    unicodify,
+)
 
 log = logging.getLogger(__name__)
 
@@ -279,7 +281,7 @@ def _create_doc(
         def clean(string):
             """Remove hyphens as they are Whoosh wildcards."""
             if "-" in string:
-                return (" ").join(token.text for token in self.rex(to_unicode(tool.name)))
+                return (" ").join(token.text for token in self.rex(unicodify(tool.name)))
             else:
                 return string
 
@@ -287,16 +289,16 @@ def clean(string):
             #  Do not add data managers to the public index
             return {}
         add_doc_kwds = {
-            "id": to_unicode(tool.id),
-            "id_exact": to_unicode(tool.id),
+            "id": unicodify(tool.id),
+            "id_exact": unicodify(tool.id),
             "name": clean(tool.name),
-            "description": to_unicode(tool.description),
-            "section": to_unicode(tool.get_panel_section()[1] if len(tool.get_panel_section()) == 2 else ""),
+            "description": unicodify(tool.description),
+            "section": unicodify(tool.get_panel_section()[1] if len(tool.get_panel_section()) == 2 else ""),
             "edam_operations": clean(tool.edam_operations),
             "edam_topics": clean(tool.edam_topics),
-            "repository": to_unicode(tool.repository_name),
-            "owner": to_unicode(tool.repository_owner),
-            "help": to_unicode(""),
+            "repository": unicodify(tool.repository_name),
+            "owner": unicodify(tool.repository_owner),
+            "help": unicodify(""),
         }
         if tool.guid:
             # Create a stub consisting of owner, repo, and tool from guid
@@ -304,14 +306,14 @@ def clean(string):
             id_stub = tool.guid[(slash_indexes[1] + 1) : slash_indexes[4]]
             add_doc_kwds["stub"] = clean(id_stub)
         else:
-            add_doc_kwds["stub"] = to_unicode(id)
+            add_doc_kwds["stub"] = unicodify(id)
         if tool.labels:
-            add_doc_kwds["labels"] = to_unicode(" ".join(tool.labels))
+            add_doc_kwds["labels"] = unicodify(" ".join(tool.labels))
         if index_help:
             raw_help = tool.raw_help
             if raw_help:
                 try:
-                    add_doc_kwds["help"] = to_unicode(raw_help)
+                    add_doc_kwds["help"] = unicodify(raw_help)
                 except Exception:
                     # Don't fail to build index when help fails to parse
                     pass
diff --git a/lib/galaxy/tools/wrappers.py b/lib/galaxy/tools/wrappers.py
index 25e8ce9a9d4e..c3c7ec40bce0 100644
--- a/lib/galaxy/tools/wrappers.py
+++ b/lib/galaxy/tools/wrappers.py
@@ -470,11 +470,12 @@ def __str__(self) -> str:
         else:
             return str(self.unsanitized.get_file_name())
 
+    @property
+    def file_name(self) -> str:
+        return str(self)
+
     def __getattr__(self, key: Any) -> Any:
-        if self.false_path is not None and key == "get_file_name":
-            # Path to dataset was rewritten for this job.
-            return lambda *args, **kwargs: self.false_path
-        elif key in ("extra_files_path", "files_path"):
+        if key in ("extra_files_path", "files_path"):
             if not self.compute_environment:
                 # Only happens in WrappedParameters context, refactor!
                 return self.unsanitized.extra_files_path
diff --git a/lib/galaxy/web/framework/decorators.py b/lib/galaxy/web/framework/decorators.py
index 1b00a59bf32d..b43a2588f471 100644
--- a/lib/galaxy/web/framework/decorators.py
+++ b/lib/galaxy/web/framework/decorators.py
@@ -14,6 +14,7 @@
     RequestParameterInvalidException,
     RequestParameterMissingException,
 )
+from galaxy.exceptions.utils import api_error_to_dict
 from galaxy.util import (
     parse_non_hex_float,
     unicodify,
@@ -394,38 +395,8 @@ def validation_error_to_message_exception(e: ValidationError) -> MessageExceptio
         return RequestParameterInvalidException(str(e), validation_errors=loads(e.json()))
 
 
-def api_error_message(trans, **kwds):
-    if exception := kwds.get("exception", None):
-        # If we are passed a MessageException use err_msg.
-        default_error_code = getattr(exception, "err_code", error_codes.UNKNOWN)
-        default_error_message = getattr(exception, "err_msg", default_error_code.default_error_message)
-        extra_error_info = getattr(exception, "extra_error_info", {})
-        if not isinstance(extra_error_info, dict):
-            extra_error_info = {}
-    else:
-        default_error_message = "Error processing API request."
-        default_error_code = error_codes.UNKNOWN
-        extra_error_info = {}
-    traceback_string = kwds.get("traceback", "No traceback available.")
-    err_msg = kwds.get("err_msg", default_error_message)
-    error_code_object = kwds.get("err_code", default_error_code)
-    try:
-        error_code = error_code_object.code
-    except AttributeError:
-        # Some sort of bad error code sent in, logic failure on part of
-        # Galaxy developer.
-        error_code = error_codes.UNKNOWN.code
-    # Would prefer the terminology of error_code and error_message, but
-    # err_msg used a good number of places already. Might as well not change
-    # it?
-    error_response = dict(err_msg=err_msg, err_code=error_code, **extra_error_info)
-    if trans and trans.debug:  # TODO: Should admins get to see traceback as well?
-        error_response["traceback"] = traceback_string
-    return error_response
-
-
 def __api_error_dict(trans, **kwds):
-    error_dict = api_error_message(trans, **kwds)
+    error_dict = api_error_to_dict(debug=trans.debug, **kwds)
     exception = kwds.get("exception", None)
     # If we are given an status code directly - use it - otherwise check
     # the exception for a status_code attribute.
diff --git a/lib/galaxy/web/framework/helpers/__init__.py b/lib/galaxy/web/framework/helpers/__init__.py
index d678f708b93c..20e3c802614b 100644
--- a/lib/galaxy/web/framework/helpers/__init__.py
+++ b/lib/galaxy/web/framework/helpers/__init__.py
@@ -14,7 +14,6 @@
 from babel.dates import format_timedelta
 from routes import url_for
 
-from galaxy.util import unicodify
 from galaxy.util.json import safe_dumps as dumps  # noqa: F401
 from .tags import (
     javascript_link,
@@ -98,15 +97,6 @@ def dist_js(*args):
     return js_helper("static/dist/", *args)
 
 
-# Unicode help
-def to_unicode(a_string):
-    """
-    Convert a string to unicode in utf-8 format; if string is already unicode,
-    does nothing because string's encoding cannot be determined by introspection.
-    """
-    return unicodify(a_string, "utf-8")
-
-
 def is_true(val):
     """
     Returns true if input is a boolean and true or is a string and looks like a true value.
diff --git a/lib/galaxy/web/framework/helpers/grids.py b/lib/galaxy/web/framework/helpers/grids.py
index c4fd321c1d65..1306b7306f6f 100644
--- a/lib/galaxy/web/framework/helpers/grids.py
+++ b/lib/galaxy/web/framework/helpers/grids.py
@@ -28,6 +28,7 @@
 from galaxy.util import (
     restore_text,
     sanitize_text,
+    string_as_bool,
     unicodify,
 )
 from galaxy.web.framework import (
@@ -56,6 +57,7 @@ def __init__(
         label_id_prefix=None,
         target=None,
         delayed=False,
+        escape=True,
     ):
         """Create a grid column."""
         self.label = label
@@ -70,6 +72,7 @@ def __init__(
         self.visible = visible
         self.filterable = filterable
         self.delayed = delayed
+        self.escape = escape
         # Column must have a key to be sortable.
         self.sortable = self.key is not None and sortable
         self.label_id_prefix = label_id_prefix or ""
@@ -83,7 +86,10 @@ def get_value(self, trans, grid, item):
             value = None
         if self.format:
             value = self.format(value)
-        return escape(unicodify(value))
+        if self.escape:
+            return escape(unicodify(value))
+        else:
+            return value
 
     def get_link(self, trans, grid, item):
         if self.link and self.link(item):
@@ -1046,3 +1052,65 @@ def apply_query_filter(self, trans, query, **kwargs):
         # (gvk) Is this method necessary?  Why not simply build the entire query,
         # including applying filters in the build_initial_query() method?
         return query
+
+
+class GridData:
+    """
+    Specifies the content a grid (data table).
+    """
+
+    model_class: Optional[type] = None
+    columns: List[GridColumn] = []
+    default_limit: int = 1000
+
+    def __init__(self):
+        # If a column does not have a model class, set the column's model class
+        # to be the grid's model class.
+        for column in self.columns:
+            if not column.model_class:
+                column.model_class = self.model_class
+
+    def __call__(self, trans, **kwargs):
+        limit = kwargs.get("limit", self.default_limit)
+        offset = kwargs.get("offset", 0)
+
+        # Build initial query
+        query = self.build_initial_query(trans, **kwargs)
+        query = self.apply_query_filter(query, **kwargs)
+
+        # Process sort arguments.
+        sort_by = kwargs.get("sort_by", self.default_sort_key)
+        sort_desc = string_as_bool(kwargs.get("sort_desc", True))
+        for column in self.columns:
+            if column.key == sort_by:
+                query = column.sort(trans, query, not sort_desc, column_name=sort_by)
+                break
+
+        # Process limit and offset.
+        rows_total = query.count()
+        query = query.limit(limit).offset(offset)
+
+        # Populate and return response
+        grid_config = {
+            "rows": [],
+            "rows_total": rows_total,
+        }
+        for row in query:
+            row_dict = {
+                "id": trans.security.encode_id(row.id),
+            }
+            for column in self.columns:
+                value = column.get_value(trans, self, row)
+                row_dict[column.key] = value
+            grid_config["rows"].append(row_dict)
+        return grid_config
+
+    # ---- Override these ----------------------------------------------------
+    def handle_operation(self, trans, operation, ids, **kwargs):
+        pass
+
+    def get_current_item(self, trans, **kwargs):
+        return None
+
+    def build_initial_query(self, trans, **kwargs):
+        return trans.sa_session.query(self.model_class)
diff --git a/lib/galaxy/webapps/base/api.py b/lib/galaxy/webapps/base/api.py
index a1804255f228..c41637f48b8f 100644
--- a/lib/galaxy/webapps/base/api.py
+++ b/lib/galaxy/webapps/base/api.py
@@ -19,11 +19,9 @@
 from starlette_context.plugins import RequestIdPlugin
 
 from galaxy.exceptions import MessageException
+from galaxy.exceptions.utils import api_error_to_dict
 from galaxy.web.framework.base import walk_controller_modules
-from galaxy.web.framework.decorators import (
-    api_error_message,
-    validation_error_to_message_exception,
-)
+from galaxy.web.framework.decorators import validation_error_to_message_exception
 
 if typing.TYPE_CHECKING:
     from starlette.background import BackgroundTask
@@ -159,7 +157,7 @@ def add_sentry_middleware(app: FastAPI) -> None:
 
 
 def get_error_response_for_request(request: Request, exc: MessageException) -> JSONResponse:
-    error_dict = api_error_message(None, exception=exc)
+    error_dict = api_error_to_dict(exception=exc)
     status_code = exc.status_code
     if "ga4gh" in (path := request.url.path):
         # When serving GA4GH APIs use limited exceptions to conform their expected
diff --git a/lib/galaxy/webapps/base/webapp.py b/lib/galaxy/webapps/base/webapp.py
index 97bd22c768d1..92633b3188ed 100644
--- a/lib/galaxy/webapps/base/webapp.py
+++ b/lib/galaxy/webapps/base/webapp.py
@@ -37,7 +37,10 @@
 from galaxy.managers import context
 from galaxy.managers.session import GalaxySessionManager
 from galaxy.managers.users import UserManager
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.structured_app import (
     BasicSharedApp,
     MinimalApp,
@@ -1119,6 +1122,7 @@ def create_new_session(trans, prev_galaxy_session=None, user_for_new_session=Non
     if user_for_new_session:
         # The new session should be associated with the user
         galaxy_session.user = user_for_new_session
+        ensure_object_added_to_session(galaxy_session, object_in_session=user_for_new_session)
     return galaxy_session
 
 
diff --git a/lib/galaxy/webapps/galaxy/api/datasets.py b/lib/galaxy/webapps/galaxy/api/datasets.py
index 46da439b7b41..14d4bc1fe019 100644
--- a/lib/galaxy/webapps/galaxy/api/datasets.py
+++ b/lib/galaxy/webapps/galaxy/api/datasets.py
@@ -57,6 +57,7 @@
     ComputeDatasetHashPayload,
     ConvertedDatasetsMap,
     DatasetContentType,
+    DatasetExtraFiles,
     DatasetInheritanceChain,
     DatasetsService,
     DatasetStorageDetails,
@@ -72,7 +73,7 @@
 
 DatasetIDPathParam: DecodedDatabaseIdField = Path(..., description="The encoded database identifier of the dataset.")
 
-HistoryIDPathParam: DecodedDatabaseIdField = Path(..., description="The encoded database identifier of the History.")
+HistoryIDPathParam = Path(description="The encoded database identifier of the History.")
 
 DatasetSourceQueryParam: DatasetSourceType = Query(
     default=DatasetSourceType.hda,
@@ -241,17 +242,28 @@ def update_permissions(
 
     @router.get(
         "/api/histories/{history_id}/contents/{history_content_id}/extra_files",
-        summary="Generate list of extra files.",
+        summary="Get the list of extra files/directories associated with a dataset.",
         tags=["histories"],
     )
-    def extra_files(
+    def extra_files_history(
         self,
         trans=DependsOnTrans,
         history_id: DecodedDatabaseIdField = HistoryIDPathParam,
         history_content_id: DecodedDatabaseIdField = DatasetIDPathParam,
-    ):
+    ) -> DatasetExtraFiles:
         return self.service.extra_files(trans, history_content_id)
 
+    @router.get(
+        "/api/datasets/{dataset_id}/extra_files",
+        summary="Get the list of extra files/directories associated with a dataset.",
+    )
+    def extra_files(
+        self,
+        trans=DependsOnTrans,
+        dataset_id: DecodedDatabaseIdField = DatasetIDPathParam,
+    ) -> DatasetExtraFiles:
+        return self.service.extra_files(trans, dataset_id)
+
     @router.get(
         "/api/histories/{history_id}/contents/{history_content_id}/display",
         name="history_contents_display",
@@ -269,9 +281,7 @@ def display_history_content(
         self,
         request: Request,
         trans=DependsOnTrans,
-        history_id: Optional[DecodedDatabaseIdField] = Path(
-            description="The encoded database identifier of the History.",
-        ),
+        history_id: Optional[DecodedDatabaseIdField] = HistoryIDPathParam,
         history_content_id: DecodedDatabaseIdField = DatasetIDPathParam,
         preview: bool = PreviewQueryParam,
         filename: Optional[str] = FilenameQueryParam,
@@ -356,9 +366,7 @@ def _display(
     def get_metadata_file_history_content(
         self,
         trans=DependsOnTrans,
-        history_id: DecodedDatabaseIdField = Path(
-            description="The encoded database identifier of the History.",
-        ),
+        history_id: DecodedDatabaseIdField = HistoryIDPathParam,
         history_content_id: DecodedDatabaseIdField = DatasetIDPathParam,
         metadata_file: str = Query(
             ...,
diff --git a/lib/galaxy/webapps/galaxy/api/groups.py b/lib/galaxy/webapps/galaxy/api/groups.py
index 2b4c7e1ca1d5..c571983df48a 100644
--- a/lib/galaxy/webapps/galaxy/api/groups.py
+++ b/lib/galaxy/webapps/galaxy/api/groups.py
@@ -82,3 +82,15 @@ def update(
         payload: GroupCreatePayload = Body(...),
     ) -> GroupResponse:
         return self.manager.update(trans, group_id, payload)
+
+    @router.delete("/api/groups/{group_id}", require_admin=True)
+    def delete(self, group_id: DecodedDatabaseIdField, trans: ProvidesAppContext = DependsOnTrans):
+        self.manager.delete(trans, group_id)
+
+    @router.post("/api/groups/{group_id}/purge", require_admin=True)
+    def purge(self, group_id: DecodedDatabaseIdField, trans: ProvidesAppContext = DependsOnTrans):
+        self.manager.purge(trans, group_id)
+
+    @router.post("/api/groups/{group_id}/undelete", require_admin=True)
+    def undelete(self, group_id: DecodedDatabaseIdField, trans: ProvidesAppContext = DependsOnTrans):
+        self.manager.undelete(trans, group_id)
diff --git a/lib/galaxy/webapps/galaxy/api/item_tags.py b/lib/galaxy/webapps/galaxy/api/item_tags.py
index 7b7f7fb65389..a32805ac4d49 100644
--- a/lib/galaxy/webapps/galaxy/api/item_tags.py
+++ b/lib/galaxy/webapps/galaxy/api/item_tags.py
@@ -72,8 +72,10 @@ def create(
                 trans: ProvidesAppContext = DependsOnTrans,
                 item_id: DecodedDatabaseIdField = Path(..., title="Item ID", alias=tagged_item_id),
                 tag_name: str = Path(..., title="Tag Name"),
-                payload: ItemTagsCreatePayload = Body(...),
+                payload: ItemTagsCreatePayload = Body(None),
             ) -> ItemTagsResponse:
+                if payload is None:
+                    payload = ItemTagsCreatePayload()
                 return self.manager.create(trans, tagged_item_class, item_id, tag_name, payload)
 
             @router.put(
diff --git a/lib/galaxy/webapps/galaxy/api/roles.py b/lib/galaxy/webapps/galaxy/api/roles.py
index 92d6369285d0..53ef695a0aca 100644
--- a/lib/galaxy/webapps/galaxy/api/roles.py
+++ b/lib/galaxy/webapps/galaxy/api/roles.py
@@ -55,3 +55,21 @@ def create(
     ) -> RoleModelResponse:
         role = self.role_manager.create_role(trans, role_definition_model)
         return role_to_model(role)
+
+    @router.delete("/api/roles/{id}", require_admin=True)
+    def delete(self, id: DecodedDatabaseIdField, trans: ProvidesUserContext = DependsOnTrans) -> RoleModelResponse:
+        role = self.role_manager.get(trans, id)
+        role = self.role_manager.delete(trans, role)
+        return role_to_model(role)
+
+    @router.post("/api/roles/{id}/purge", require_admin=True)
+    def purge(self, id: DecodedDatabaseIdField, trans: ProvidesUserContext = DependsOnTrans) -> RoleModelResponse:
+        role = self.role_manager.get(trans, id)
+        role = self.role_manager.purge(trans, role)
+        return role_to_model(role)
+
+    @router.post("/api/roles/{id}/undelete", require_admin=True)
+    def undelete(self, id: DecodedDatabaseIdField, trans: ProvidesUserContext = DependsOnTrans) -> RoleModelResponse:
+        role = self.role_manager.get(trans, id)
+        role = self.role_manager.undelete(trans, role)
+        return role_to_model(role)
diff --git a/lib/galaxy/webapps/galaxy/api/short_term_storage.py b/lib/galaxy/webapps/galaxy/api/short_term_storage.py
index c72068097649..cd5a95a1965f 100644
--- a/lib/galaxy/webapps/galaxy/api/short_term_storage.py
+++ b/lib/galaxy/webapps/galaxy/api/short_term_storage.py
@@ -1,9 +1,9 @@
 """
-API operations around galaxy.web.short_term_storage infrastructure.
+API operations around galaxy.short_term_storage infrastructure.
 """
 from uuid import UUID
 
-from galaxy.web.short_term_storage import (
+from galaxy.short_term_storage import (
     ShortTermStorageMonitor,
     ShortTermStorageServeCancelledInformation,
     ShortTermStorageServeCompletedInformation,
diff --git a/lib/galaxy/webapps/galaxy/api/users.py b/lib/galaxy/webapps/galaxy/api/users.py
index 1ab007693020..ae2b0d78a3f6 100644
--- a/lib/galaxy/webapps/galaxy/api/users.py
+++ b/lib/galaxy/webapps/galaxy/api/users.py
@@ -172,7 +172,25 @@ def recalculate_disk_usage(
 
         Please use `/api/users/current/recalculate_disk_usage` instead.
         """
-        result = self.service.recalculate_disk_usage(trans)
+        user_id = getattr(trans.user, "id", None)
+        if not user_id:
+            raise exceptions.AuthenticationRequired("Only registered users can recalculate disk usage.")
+        else:
+            result = self.service.recalculate_disk_usage(trans, user_id)
+            return Response(status_code=status.HTTP_204_NO_CONTENT) if result is None else result
+
+    @router.put(
+        "/api/users/{user_id}/recalculate_disk_usage",
+        summary=RecalculateDiskUsageSummary,
+        responses=RecalculateDiskUsageResponseDescriptions,
+        require_admin=True,
+    )
+    def recalculate_disk_usage_by_user_id(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_id: DecodedDatabaseIdField = UserIdPathParamQueryParam,
+    ):
+        result = self.service.recalculate_disk_usage(trans, user_id)
         return Response(status_code=status.HTTP_204_NO_CONTENT) if result is None else result
 
     @router.get(
@@ -674,6 +692,23 @@ def delete(
                 raise exceptions.InsufficientPermissionsException("You may only delete your own account.")
         return self.service.user_to_detailed_model(user_to_update)
 
+    @router.post(
+        "/api/users/{user_id}/send_activation_email",
+        name="send_activation_email",
+        summary="Sends activation email to user.",
+        require_admin=True,
+    )
+    def send_activation_email(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_id: DecodedDatabaseIdField = UserIdPathParamQueryParam,
+    ):
+        user = trans.sa_session.query(trans.model.User).get(user_id)
+        if not user:
+            raise exceptions.ObjectNotFound("User not found for given id.")
+        if not self.service.user_manager.send_activation_email(trans, user.email, user.username):
+            raise exceptions.MessageException("Unable to send activation email.")
+
 
 class UserAPIController(BaseGalaxyAPIController, UsesTagsMixin, BaseUIController, UsesFormDefinitionsMixin):
     service: UsersService = depends(UsersService)
diff --git a/lib/galaxy/webapps/galaxy/controllers/admin.py b/lib/galaxy/webapps/galaxy/controllers/admin.py
index 5495f24943fb..ac2109d310bc 100644
--- a/lib/galaxy/webapps/galaxy/controllers/admin.py
+++ b/lib/galaxy/webapps/galaxy/controllers/admin.py
@@ -4,6 +4,7 @@
 from sqlalchemy import (
     false,
     func,
+    true,
 )
 from typing_extensions import TypedDict
 
@@ -19,12 +20,16 @@
 from galaxy.managers.quotas import QuotaManager
 from galaxy.model import tool_shed_install as install_model
 from galaxy.model.base import transaction
+from galaxy.model.index_filter_util import (
+    raw_text_column_filter,
+    text_column_filter,
+)
 from galaxy.security.validate_user_input import validate_password
 from galaxy.structured_app import StructuredApp
-from galaxy.util import (
-    nice_size,
-    pretty_print_time_interval,
-    sanitize_text,
+from galaxy.util.search import (
+    FilteredTerm,
+    parse_filters_structured,
+    RawTextTerm,
 )
 from galaxy.web import url_for
 from galaxy.web.framework.helpers import (
@@ -37,24 +42,14 @@
 log = logging.getLogger(__name__)
 
 
-class UserListGrid(grids.Grid):
-    class EmailColumn(grids.TextColumn):
-        def get_value(self, trans, grid, user):
-            return escape(user.email)
-
-    class UserNameColumn(grids.TextColumn):
-        def get_value(self, trans, grid, user):
-            if user.username:
-                return escape(user.username)
-            return "not set"
-
+class UserListGrid(grids.GridData):
     class StatusColumn(grids.GridColumn):
         def get_value(self, trans, grid, user):
             if user.purged:
-                return "purged"
+                return "Purged"
             elif user.deleted:
-                return "deleted"
-            return ""
+                return "Deleted"
+            return "Available"
 
     class GroupsColumn(grids.GridColumn):
         def get_value(self, trans, grid, user):
@@ -68,12 +63,6 @@ def get_value(self, trans, grid, user):
                 return len(user.roles)
             return 0
 
-    class ExternalColumn(grids.GridColumn):
-        def get_value(self, trans, grid, user):
-            if user.external:
-                return "yes"
-            return "no"
-
     class LastLoginColumn(grids.GridColumn):
         def get_value(self, trans, grid, user):
             if user.galaxy_sessions:
@@ -97,17 +86,6 @@ def sort(self, trans, query, ascending, column_name=None):
                 query = query.order_by((last_login_subquery.c.last_login).asc().nullsfirst())
             return query
 
-    class TimeCreatedColumn(grids.GridColumn):
-        def get_value(self, trans, grid, user):
-            return user.create_time.strftime("%x")
-
-    class ActivatedColumn(grids.GridColumn):
-        def get_value(self, trans, grid, user):
-            if user.active:
-                return "Y"
-            else:
-                return "N"
-
     class DiskUsageColumn(grids.GridColumn):
         def get_value(self, trans, grid, user):
             return user.get_disk_usage(nice_size=True)
@@ -130,97 +108,57 @@ def sort(self, trans, query, ascending, column_name=None):
     model_class = model.User
     default_sort_key = "email"
     columns = [
-        EmailColumn(
-            "Email",
-            key="email",
-            link=(lambda item: dict(controller="user", action="information", id=item.id, webapp="galaxy")),
-            attach_popup=True,
-            filterable="advanced",
-            target="top",
-        ),
-        UserNameColumn("User Name", key="username", attach_popup=False, filterable="advanced"),
-        LastLoginColumn("Last Login", format=time_ago, key="last_login", sortable=True),
-        DiskUsageColumn("Disk Usage", key="disk_usage", attach_popup=False),
-        StatusColumn("Status", attach_popup=False, key="deleted"),
-        TimeCreatedColumn("Created", attach_popup=False, key="create_time"),
-        ActivatedColumn("Activated", attach_popup=False, key="active"),
-        GroupsColumn("Groups", attach_popup=False),
-        RolesColumn("Roles", attach_popup=False),
-        ExternalColumn("External", attach_popup=False, key="external"),
-        # Columns that are valid for filtering but are not visible.
-        grids.DeletedColumn("Deleted", key="deleted", visible=False, filterable="advanced"),
-        grids.PurgedColumn("Purged", key="purged", visible=False, filterable="advanced"),
-    ]
-    columns.append(
-        grids.MulticolFilterColumn(
-            "Search",
-            cols_to_filter=[columns[0], columns[1]],
-            key="free-text-search",
-            visible=False,
-            filterable="standard",
-        )
-    )
-    global_actions = [grids.GridAction("Create new user", url_args=dict(action="users/create"))]
-    operations = [
-        grids.GridOperation(
-            "Manage Information",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=False,
-            url_args=dict(controller="user", action="information", webapp="galaxy"),
-        ),
-        grids.GridOperation(
-            "Manage Roles and Groups",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=False,
-            url_args=dict(action="form/manage_roles_and_groups_for_user"),
-        ),
-        grids.GridOperation(
-            "Reset Password",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=True,
-            url_args=dict(action="form/reset_user_password"),
-            target="top",
-        ),
-        grids.GridOperation("Recalculate Disk Usage", condition=(lambda item: not item.deleted), allow_multiple=False),
-        grids.GridOperation("Generate New API Key", allow_multiple=False, async_compatible=True),
+        grids.GridColumn("Email", key="email"),
+        grids.GridColumn("User Name", key="username"),
+        LastLoginColumn("Last Login", key="last_login", format=time_ago),
+        DiskUsageColumn("Disk Usage", key="disk_usage"),
+        StatusColumn("Status", key="status"),
+        grids.GridColumn("Created", key="create_time"),
+        grids.GridColumn("Activated", key="active", escape=False),
+        GroupsColumn("Groups", key="groups"),
+        RolesColumn("Roles", key="roles"),
+        grids.GridColumn("External", key="external", escape=False),
+        grids.GridColumn("Deleted", key="deleted", escape=False),
+        grids.GridColumn("Purged", key="purged", escape=False),
     ]
 
-    standard_filters = [
-        grids.GridColumnFilter("Active", args=dict(deleted=False)),
-        grids.GridColumnFilter("Deleted", args=dict(deleted=True, purged=False)),
-        grids.GridColumnFilter("Purged", args=dict(purged=True)),
-        grids.GridColumnFilter("All", args=dict(deleted="All")),
-    ]
-    num_rows_per_page = 50
-    use_paging = True
-    default_filter = dict(purged="False")
-    use_default_filter = True
-
-    def get_current_item(self, trans, **kwargs):
-        return trans.user
-
-
-class RoleListGrid(grids.Grid):
-    class NameColumn(grids.TextColumn):
-        def get_value(self, trans, grid, role):
-            return escape(role.name)
-
-    class DescriptionColumn(grids.TextColumn):
-        def get_value(self, trans, grid, role):
-            if role.description:
-                return escape(role.description)
-            return ""
-
-    class TypeColumn(grids.TextColumn):
-        def get_value(self, trans, grid, role):
-            return role.type
+    def apply_query_filter(self, query, **kwargs):
+        INDEX_SEARCH_FILTERS = {
+            "email": "email",
+            "username": "username",
+            "is": "is",
+        }
+        search_query = kwargs.get("search")
+        parsed_search = parse_filters_structured(search_query, INDEX_SEARCH_FILTERS)
+        deleted = False
+        for term in parsed_search.terms:
+            if isinstance(term, FilteredTerm):
+                key = term.filter
+                q = term.text
+                if key == "email":
+                    query = query.filter(text_column_filter(self.model_class.email, term))
+                elif key == "username":
+                    query = query.filter(text_column_filter(self.model_class.username, term))
+                elif key == "is":
+                    if q == "deleted":
+                        deleted = True
+                    elif q == "purged":
+                        query = query.filter(self.model_class.purged == true())
+            elif isinstance(term, RawTextTerm):
+                query = query.filter(
+                    raw_text_column_filter(
+                        [
+                            self.model_class.email,
+                            self.model_class.username,
+                        ],
+                        term,
+                    )
+                )
+        query = query.filter(self.model_class.deleted == (true() if deleted else false()))
+        return query
 
-    class StatusColumn(grids.GridColumn):
-        def get_value(self, trans, grid, role):
-            if role.deleted:
-                return "deleted"
-            return ""
 
+class RoleListGrid(grids.GridData):
     class GroupsColumn(grids.GridColumn):
         def get_value(self, trans, grid, role):
             if role.groups:
@@ -239,76 +177,53 @@ def get_value(self, trans, grid, role):
     model_class = model.Role
     default_sort_key = "name"
     columns = [
-        NameColumn(
-            "Name",
-            key="name",
-            link=(lambda item: dict(action="form/manage_users_and_groups_for_role", id=item.id, webapp="galaxy")),
-            model_class=model.Role,
-            attach_popup=True,
-            filterable="advanced",
-            target="top",
-        ),
-        DescriptionColumn(
-            "Description", key="description", model_class=model.Role, attach_popup=False, filterable="advanced"
-        ),
-        TypeColumn("Type", key="type", model_class=model.Role, attach_popup=False, filterable="advanced"),
-        GroupsColumn("Groups", attach_popup=False),
-        UsersColumn("Users", attach_popup=False),
-        StatusColumn("Status", attach_popup=False),
-        # Columns that are valid for filtering but are not visible.
-        grids.DeletedColumn("Deleted", key="deleted", visible=False, filterable="advanced"),
+        grids.GridColumn("Name", key="name"),
+        grids.GridColumn("Description", key="description"),
+        grids.GridColumn("Type", key="type"),
+        GroupsColumn("Groups", key="groups"),
+        UsersColumn("Users", key="users"),
+        grids.GridColumn("Deleted", key="deleted", escape=False),
+        grids.GridColumn("Purged", key="purged", escape=False),
         grids.GridColumn("Last Updated", key="update_time"),
     ]
-    columns.append(
-        grids.MulticolFilterColumn(
-            "Search",
-            cols_to_filter=[columns[0], columns[1], columns[2]],
-            key="free-text-search",
-            visible=False,
-            filterable="standard",
-        )
-    )
-    global_actions = [grids.GridAction("Add new role", url_args=dict(action="form/create_role"))]
-    operations = [
-        grids.GridOperation(
-            "Edit Name/Description",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=False,
-            url_args=dict(action="form/rename_role"),
-        ),
-        grids.GridOperation(
-            "Edit Permissions",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=False,
-            url_args=dict(action="form/manage_users_and_groups_for_role", webapp="galaxy"),
-        ),
-        grids.GridOperation("Delete", condition=(lambda item: not item.deleted), allow_multiple=True),
-        grids.GridOperation("Undelete", condition=(lambda item: item.deleted), allow_multiple=True),
-        grids.GridOperation("Purge", condition=(lambda item: item.deleted), allow_multiple=True),
-    ]
-    standard_filters = [
-        grids.GridColumnFilter("Active", args=dict(deleted=False)),
-        grids.GridColumnFilter("Deleted", args=dict(deleted=True)),
-        grids.GridColumnFilter("All", args=dict(deleted="All")),
-    ]
-    num_rows_per_page = 50
-    use_paging = True
-
-    def apply_query_filter(self, trans, query, **kwargs):
-        return query.filter(model.Role.type != model.Role.types.PRIVATE)
 
+    def apply_query_filter(self, query, **kwargs):
+        INDEX_SEARCH_FILTERS = {
+            "description": "description",
+            "name": "name",
+            "is": "is",
+        }
+        deleted = False
+        query = query.filter(self.model_class.type != self.model_class.types.PRIVATE)
+        search_query = kwargs.get("search")
+        if search_query:
+            parsed_search = parse_filters_structured(search_query, INDEX_SEARCH_FILTERS)
+            for term in parsed_search.terms:
+                if isinstance(term, FilteredTerm):
+                    key = term.filter
+                    q = term.text
+                    if key == "name":
+                        query = query.filter(text_column_filter(self.model_class.name, term))
+                    if key == "description":
+                        query = query.filter(text_column_filter(self.model_class.description, term))
+                    elif key == "is":
+                        if q == "deleted":
+                            deleted = True
+                elif isinstance(term, RawTextTerm):
+                    query = query.filter(
+                        raw_text_column_filter(
+                            [
+                                self.model_class.description,
+                                self.model_class.name,
+                            ],
+                            term,
+                        )
+                    )
+        query = query.filter(self.model_class.deleted == (true() if deleted else false()))
+        return query
 
-class GroupListGrid(grids.Grid):
-    class NameColumn(grids.TextColumn):
-        def get_value(self, trans, grid, group):
-            return escape(group.name)
-
-    class StatusColumn(grids.GridColumn):
-        def get_value(self, trans, grid, group):
-            if group.deleted:
-                return "deleted"
-            return ""
 
+class GroupListGrid(grids.GridData):
     class RolesColumn(grids.GridColumn):
         def get_value(self, trans, grid, group):
             if group.roles:
@@ -327,51 +242,42 @@ def get_value(self, trans, grid, group):
     model_class = model.Group
     default_sort_key = "name"
     columns = [
-        NameColumn(
-            "Name",
-            key="name",
-            link=(lambda item: dict(action="form/manage_users_and_roles_for_group", id=item.id, webapp="galaxy")),
-            model_class=model.Group,
-            attach_popup=True,
-            filterable="advanced",
-        ),
-        UsersColumn("Users", attach_popup=False),
-        RolesColumn("Roles", attach_popup=False),
-        StatusColumn("Status", attach_popup=False),
-        # Columns that are valid for filtering but are not visible.
-        grids.DeletedColumn("Deleted", key="deleted", visible=False, filterable="advanced"),
-        grids.GridColumn("Last Updated", key="update_time", format=pretty_print_time_interval),
-    ]
-    columns.append(
-        grids.MulticolFilterColumn(
-            "Search", cols_to_filter=[columns[0]], key="free-text-search", visible=False, filterable="standard"
-        )
-    )
-    global_actions = [grids.GridAction("Add new group", url_args=dict(action="form/create_group"))]
-    operations = [
-        grids.GridOperation(
-            "Edit Name",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=False,
-            url_args=dict(action="form/rename_group"),
-        ),
-        grids.GridOperation(
-            "Edit Permissions",
-            condition=(lambda item: not item.deleted),
-            allow_multiple=False,
-            url_args=dict(action="form/manage_users_and_roles_for_group", webapp="galaxy"),
-        ),
-        grids.GridOperation("Delete", condition=(lambda item: not item.deleted), allow_multiple=True),
-        grids.GridOperation("Undelete", condition=(lambda item: item.deleted), allow_multiple=True),
-        grids.GridOperation("Purge", condition=(lambda item: item.deleted), allow_multiple=True),
-    ]
-    standard_filters = [
-        grids.GridColumnFilter("Active", args=dict(deleted=False)),
-        grids.GridColumnFilter("Deleted", args=dict(deleted=True)),
-        grids.GridColumnFilter("All", args=dict(deleted="All")),
+        grids.GridColumn("Name", key="name"),
+        UsersColumn("Users", key="users"),
+        RolesColumn("Roles", key="roles"),
+        grids.DeletedColumn("Deleted", key="deleted", escape=False),
+        grids.GridColumn("Last Updated", key="update_time"),
     ]
-    num_rows_per_page = 50
-    use_paging = True
+
+    def apply_query_filter(self, query, **kwargs):
+        INDEX_SEARCH_FILTERS = {
+            "name": "name",
+            "is": "is",
+        }
+        deleted = False
+        search_query = kwargs.get("search")
+        if search_query:
+            parsed_search = parse_filters_structured(search_query, INDEX_SEARCH_FILTERS)
+            for term in parsed_search.terms:
+                if isinstance(term, FilteredTerm):
+                    key = term.filter
+                    q = term.text
+                    if key == "name":
+                        query = query.filter(text_column_filter(self.model_class.name, term))
+                    elif key == "is":
+                        if q == "deleted":
+                            deleted = True
+                elif isinstance(term, RawTextTerm):
+                    query = query.filter(
+                        raw_text_column_filter(
+                            [
+                                self.model_class.name,
+                            ],
+                            term,
+                        )
+                    )
+        query = query.filter(self.model_class.deleted == (true() if deleted else false()))
+        return query
 
 
 class QuotaListGrid(grids.Grid):
@@ -629,45 +535,6 @@ def data_types_list(self, trans, **kwd) -> DatatypesEntryT:
     @web.json
     @web.require_admin
     def users_list(self, trans, **kwd):
-        message = kwd.get("message", "")
-        status = kwd.get("status", "")
-        if "operation" in kwd:
-            id = kwd.get("id")
-            if not id:
-                message, status = (f"Invalid user id ({str(id)}) received.", "error")
-            ids = util.listify(id)
-            operation = kwd["operation"].lower()
-            if operation == "delete":
-                message, status = self._delete_user(trans, ids)
-            elif operation == "undelete":
-                message, status = self._undelete_user(trans, ids)
-            elif operation == "purge":
-                message, status = self._purge_user(trans, ids)
-            elif operation == "recalculate disk usage":
-                message, status = self._recalculate_user(trans, id)
-            elif operation == "generate new api key":
-                message, status = self._new_user_apikey(trans, id)
-            elif operation == "activate user":
-                message, status = self._activate_user(trans, id)
-            elif operation == "resend activation email":
-                message, status = self._resend_activation_email(trans, id)
-        if message and status:
-            kwd["message"] = util.sanitize_text(message)
-            kwd["status"] = status
-        if trans.app.config.allow_user_deletion:
-            if self.delete_operation not in self.user_list_grid.operations:
-                self.user_list_grid.operations.append(self.delete_operation)
-            if self.undelete_operation not in self.user_list_grid.operations:
-                self.user_list_grid.operations.append(self.undelete_operation)
-            if self.purge_operation not in self.user_list_grid.operations:
-                self.user_list_grid.operations.append(self.purge_operation)
-        if trans.app.config.allow_user_impersonation:
-            if self.impersonate_operation not in self.user_list_grid.operations:
-                self.user_list_grid.operations.append(self.impersonate_operation)
-        if trans.app.config.user_activation_on:
-            if self.activate_operation not in self.user_list_grid.operations:
-                self.user_list_grid.operations.append(self.activate_operation)
-                self.user_list_grid.operations.append(self.resend_activation_email)
         return self.user_list_grid(trans, **kwd)
 
     @web.legacy_expose_api
@@ -934,23 +801,6 @@ def tool_versions_list(self, trans, **kwd):
     @web.json
     @web.require_admin
     def roles_list(self, trans, **kwargs):
-        message = kwargs.get("message")
-        status = kwargs.get("status")
-        if "operation" in kwargs:
-            id = kwargs.get("id", None)
-            if not id:
-                message, status = (f"Invalid role id ({str(id)}) received.", "error")
-            ids = util.listify(id)
-            operation = kwargs["operation"].lower().replace("+", " ")
-            if operation == "delete":
-                message, status = self._delete_role(trans, ids)
-            elif operation == "undelete":
-                message, status = self._undelete_role(trans, ids)
-            elif operation == "purge":
-                message, status = self._purge_role(trans, ids)
-        if message and status:
-            kwargs["message"] = util.sanitize_text(message)
-            kwargs["status"] = status
         return self.role_list_grid(trans, **kwargs)
 
     @web.legacy_expose_api
@@ -1148,89 +998,9 @@ def manage_users_and_groups_for_role(self, trans, payload=None, **kwd):
                 "message": f"Role '{role.name}' has been updated with {len(in_users)} associated users and {len(in_groups)} associated groups."
             }
 
-    def _delete_role(self, trans, ids):
-        message = "Deleted %d roles: " % len(ids)
-        for role_id in ids:
-            role = get_role(trans, role_id)
-            role.deleted = True
-            trans.sa_session.add(role)
-            with transaction(trans.sa_session):
-                trans.sa_session.commit()
-            message += f" {role.name} "
-        return (message, "done")
-
-    def _undelete_role(self, trans, ids):
-        count = 0
-        undeleted_roles = ""
-        for role_id in ids:
-            role = get_role(trans, role_id)
-            if not role.deleted:
-                return (f"Role '{role.name}' has not been deleted, so it cannot be undeleted.", "error")
-            role.deleted = False
-            trans.sa_session.add(role)
-            with transaction(trans.sa_session):
-                trans.sa_session.commit()
-            count += 1
-            undeleted_roles += f" {role.name}"
-        return ("Undeleted %d roles: %s" % (count, undeleted_roles), "done")
-
-    def _purge_role(self, trans, ids):
-        # This method should only be called for a Role that has previously been deleted.
-        # Purging a deleted Role deletes all of the following from the database:
-        # - UserRoleAssociations where role_id == Role.id
-        # - DefaultUserPermissions where role_id == Role.id
-        # - DefaultHistoryPermissions where role_id == Role.id
-        # - GroupRoleAssociations where role_id == Role.id
-        # - DatasetPermissionss where role_id == Role.id
-        message = "Purged %d roles: " % len(ids)
-        for role_id in ids:
-            role = get_role(trans, role_id)
-            if not role.deleted:
-                return (f"Role '{role.name}' has not been deleted, so it cannot be purged.", "error")
-            # Delete UserRoleAssociations
-            for ura in role.users:
-                user = trans.sa_session.query(trans.app.model.User).get(ura.user_id)
-                # Delete DefaultUserPermissions for associated users
-                for dup in user.default_permissions:
-                    if role == dup.role:
-                        trans.sa_session.delete(dup)
-                # Delete DefaultHistoryPermissions for associated users
-                for history in user.histories:
-                    for dhp in history.default_permissions:
-                        if role == dhp.role:
-                            trans.sa_session.delete(dhp)
-                trans.sa_session.delete(ura)
-            # Delete GroupRoleAssociations
-            for gra in role.groups:
-                trans.sa_session.delete(gra)
-            # Delete DatasetPermissionss
-            for dp in role.dataset_actions:
-                trans.sa_session.delete(dp)
-            with transaction(trans.sa_session):
-                trans.sa_session.commit()
-            message += f" {role.name} "
-        return (message, "done")
-
     @web.legacy_expose_api
     @web.require_admin
     def groups_list(self, trans, **kwargs):
-        message = kwargs.get("message")
-        status = kwargs.get("status")
-        if "operation" in kwargs:
-            id = kwargs.get("id")
-            if not id:
-                return self.message_exception(trans, f"Invalid group id ({str(id)}) received.")
-            ids = util.listify(id)
-            operation = kwargs["operation"].lower().replace("+", " ")
-            if operation == "delete":
-                message, status = self._delete_group(trans, ids)
-            elif operation == "undelete":
-                message, status = self._undelete_group(trans, ids)
-            elif operation == "purge":
-                message, status = self._purge_group(trans, ids)
-        if message and status:
-            kwargs["message"] = util.sanitize_text(message)
-            kwargs["status"] = status
         return self.group_list_grid(trans, **kwargs)
 
     @web.legacy_expose_api
@@ -1413,49 +1183,6 @@ def create_group(self, trans, payload=None, **kwd):
                     )
                 return {"message": message}
 
-    def _delete_group(self, trans, ids):
-        message = "Deleted %d groups: " % len(ids)
-        for group_id in ids:
-            group = get_group(trans, group_id)
-            group.deleted = True
-            trans.sa_session.add(group)
-            with transaction(trans.sa_session):
-                trans.sa_session.commit()
-            message += f" {group.name} "
-        return (message, "done")
-
-    def _undelete_group(self, trans, ids):
-        count = 0
-        undeleted_groups = ""
-        for group_id in ids:
-            group = get_group(trans, group_id)
-            if not group.deleted:
-                return (f"Group '{group.name}' has not been deleted, so it cannot be undeleted.", "error")
-            group.deleted = False
-            trans.sa_session.add(group)
-            with transaction(trans.sa_session):
-                trans.sa_session.commit()
-            count += 1
-            undeleted_groups += f" {group.name}"
-        return ("Undeleted %d groups: %s" % (count, undeleted_groups), "done")
-
-    def _purge_group(self, trans, ids):
-        message = "Purged %d groups: " % len(ids)
-        for group_id in ids:
-            group = get_group(trans, group_id)
-            if not group.deleted:
-                return (f"Group '{group.name}' has not been deleted, so it cannot be purged.", "error")
-            # Delete UserGroupAssociations
-            for uga in group.users:
-                trans.sa_session.delete(uga)
-            # Delete GroupRoleAssociations
-            for gra in group.roles:
-                trans.sa_session.delete(gra)
-            with transaction(trans.sa_session):
-                trans.sa_session.commit()
-            message += f" {group.name} "
-        return (message, "done")
-
     @web.expose
     @web.require_admin
     def create_new_user(self, trans, **kwd):
@@ -1490,89 +1217,6 @@ def reset_user_password(self, trans, payload=None, **kwd):
         else:
             return self.message_exception(trans, "Please specify user ids.")
 
-    def _delete_user(self, trans, ids):
-        message = "Deleted %d users: " % len(ids)
-        for user_id in ids:
-            user = get_user(trans, user_id)
-            # Actually do the delete
-            self.user_manager.delete(user)
-            # Accumulate messages for the return message
-            message += f" {user.email} "
-        return (message, "done")
-
-    def _undelete_user(self, trans, ids):
-        count = 0
-        undeleted_users = ""
-        for user_id in ids:
-            user = get_user(trans, user_id)
-            # Actually do the undelete
-            self.user_manager.undelete(user)
-            # Count and accumulate messages to return to the admin panel
-            count += 1
-            undeleted_users += f" {user.email}"
-        message = "Undeleted %d users: %s" % (count, undeleted_users)
-        return (message, "done")
-
-    def _purge_user(self, trans, ids):
-        # This method should only be called for a User that has previously been deleted.
-        # We keep the User in the database ( marked as purged ), and stuff associated
-        # with the user's private role in case we want the ability to unpurge the user
-        # some time in the future.
-        # Purging a deleted User deletes all of the following:
-        # - History where user_id = User.id
-        #    - HistoryDatasetAssociation where history_id = History.id
-        # - UserGroupAssociation where user_id == User.id
-        # - UserRoleAssociation where user_id == User.id EXCEPT FOR THE PRIVATE ROLE
-        # - UserAddress where user_id == User.id
-        # Purging Histories and Datasets must be handled via the cleanup_datasets.py script
-        message = "Purged %d users: " % len(ids)
-        for user_id in ids:
-            user = get_user(trans, user_id)
-            self.user_manager.purge(user)
-            message += f"\t{user.email}\n "
-        return (message, "done")
-
-    def _recalculate_user(self, trans, user_id):
-        user = trans.sa_session.query(trans.model.User).get(trans.security.decode_id(user_id))
-        if not user:
-            return (f"User not found for id ({sanitize_text(str(user_id))})", "error")
-        current = user.get_disk_usage()
-        user.calculate_and_set_disk_usage()
-        new = user.get_disk_usage()
-        if new in (current, None):
-            message = f"Usage is unchanged at {nice_size(current)}."
-        else:
-            message = f"Usage has changed by {nice_size(new - current)} to {nice_size(new)}."
-        return (message, "done")
-
-    def _new_user_apikey(self, trans, user_id):
-        user = trans.sa_session.query(trans.model.User).get(trans.security.decode_id(user_id))
-        if not user:
-            return (f"User not found for id ({sanitize_text(str(user_id))})", "error")
-        new_key = trans.app.model.APIKeys(
-            user_id=trans.security.decode_id(user_id), key=trans.app.security.get_new_guid()
-        )
-        trans.sa_session.add(new_key)
-        with transaction(trans.sa_session):
-            trans.sa_session.commit()
-        return (f"New key '{new_key.key}' generated for requested user '{user.email}'.", "done")
-
-    def _activate_user(self, trans, user_id):
-        user = trans.sa_session.query(trans.model.User).get(trans.security.decode_id(user_id))
-        if not user:
-            return (f"User not found for id ({sanitize_text(str(user_id))})", "error")
-        self.user_manager.activate(user)
-        return (f"Activated user: {user.email}.", "done")
-
-    def _resend_activation_email(self, trans, user_id):
-        user = trans.sa_session.query(trans.model.User).get(trans.security.decode_id(user_id))
-        if not user:
-            return (f"User not found for id ({sanitize_text(str(user_id))})", "error")
-        if self.user_manager.send_activation_email(trans, user.email, user.username):
-            return (f"Activation email has been sent to user: {user.email}.", "done")
-        else:
-            return (f"Unable to send activation email to user: {user.email}.", "error")
-
     @web.legacy_expose_api
     @web.require_admin
     def manage_roles_and_groups_for_user(self, trans, payload=None, **kwd):
diff --git a/lib/galaxy/webapps/galaxy/controllers/authnz.py b/lib/galaxy/webapps/galaxy/controllers/authnz.py
index 2f6cde7d1ebe..3bf290ba9902 100644
--- a/lib/galaxy/webapps/galaxy/controllers/authnz.py
+++ b/lib/galaxy/webapps/galaxy/controllers/authnz.py
@@ -188,6 +188,7 @@ def logout(self, trans, provider, **kwargs):
         success, message, redirect_uri = trans.app.authnz_manager.logout(
             provider, trans, post_user_logout_href=post_user_logout_href
         )
+        trans.handle_user_logout()
         if success:
             return {"redirect_uri": redirect_uri}
         else:
diff --git a/lib/galaxy/webapps/galaxy/services/base.py b/lib/galaxy/webapps/galaxy/services/base.py
index 7cae6d5c060e..dcf91e80f2f2 100644
--- a/lib/galaxy/webapps/galaxy/services/base.py
+++ b/lib/galaxy/webapps/galaxy/services/base.py
@@ -31,11 +31,11 @@
 from galaxy.schema.fields import EncodedDatabaseIdField
 from galaxy.schema.schema import AsyncTaskResultSummary
 from galaxy.security.idencoding import IdEncodingHelper
-from galaxy.util import ready_name_for_url
-from galaxy.web.short_term_storage import (
+from galaxy.short_term_storage import (
     ShortTermStorageAllocator,
     ShortTermStorageTarget,
 )
+from galaxy.util import ready_name_for_url
 
 
 def ensure_celery_tasks_enabled(config):
diff --git a/lib/galaxy/webapps/galaxy/services/datasets.py b/lib/galaxy/webapps/galaxy/services/datasets.py
index 4a40e2e2576a..2e20d689dea4 100644
--- a/lib/galaxy/webapps/galaxy/services/datasets.py
+++ b/lib/galaxy/webapps/galaxy/services/datasets.py
@@ -177,6 +177,12 @@ class ExtraFileEntry(Model):
     )
 
 
+class DatasetExtraFiles(Model):
+    """A list of extra files associated with a dataset."""
+
+    __root__: List[ExtraFileEntry]
+
+
 class DatasetTextContentDetails(Model):
     item_data: Optional[str] = Field(
         description="First chunk of text content (maximum 1MB) of the dataset.",
diff --git a/lib/galaxy/webapps/galaxy/services/histories.py b/lib/galaxy/webapps/galaxy/services/histories.py
index 30e10f28f2d7..77dbb6eb692a 100644
--- a/lib/galaxy/webapps/galaxy/services/histories.py
+++ b/lib/galaxy/webapps/galaxy/services/histories.py
@@ -76,8 +76,8 @@
 )
 from galaxy.schema.types import LatestLiteral
 from galaxy.security.idencoding import IdEncodingHelper
+from galaxy.short_term_storage import ShortTermStorageAllocator
 from galaxy.util import restore_text
-from galaxy.web.short_term_storage import ShortTermStorageAllocator
 from galaxy.webapps.galaxy.services.base import (
     async_task_summary,
     ConsumesModelStores,
diff --git a/lib/galaxy/webapps/galaxy/services/history_contents.py b/lib/galaxy/webapps/galaxy/services/history_contents.py
index a6d2a3becf2e..2c84759b7fbb 100644
--- a/lib/galaxy/webapps/galaxy/services/history_contents.py
+++ b/lib/galaxy/webapps/galaxy/services/history_contents.py
@@ -117,8 +117,8 @@
     WriteHistoryContentTo,
 )
 from galaxy.security.idencoding import IdEncodingHelper
+from galaxy.short_term_storage import ShortTermStorageAllocator
 from galaxy.util.zipstream import ZipstreamWrapper
-from galaxy.web.short_term_storage import ShortTermStorageAllocator
 from galaxy.webapps.galaxy.services.base import (
     async_task_summary,
     ConsumesModelStores,
diff --git a/lib/galaxy/webapps/galaxy/services/invocations.py b/lib/galaxy/webapps/galaxy/services/invocations.py
index 81427cfa4c39..1416bb938fd2 100644
--- a/lib/galaxy/webapps/galaxy/services/invocations.py
+++ b/lib/galaxy/webapps/galaxy/services/invocations.py
@@ -44,7 +44,7 @@
     WriteInvocationTo,
 )
 from galaxy.security.idencoding import IdEncodingHelper
-from galaxy.web.short_term_storage import ShortTermStorageAllocator
+from galaxy.short_term_storage import ShortTermStorageAllocator
 from galaxy.webapps.galaxy.services.base import (
     async_task_summary,
     ensure_celery_tasks_enabled,
diff --git a/lib/galaxy/webapps/galaxy/services/pages.py b/lib/galaxy/webapps/galaxy/services/pages.py
index 444149b17d19..8689d8248686 100644
--- a/lib/galaxy/webapps/galaxy/services/pages.py
+++ b/lib/galaxy/webapps/galaxy/services/pages.py
@@ -27,7 +27,7 @@
 )
 from galaxy.schema.tasks import GeneratePdfDownload
 from galaxy.security.idencoding import IdEncodingHelper
-from galaxy.web.short_term_storage import ShortTermStorageAllocator
+from galaxy.short_term_storage import ShortTermStorageAllocator
 from galaxy.webapps.galaxy.services.base import (
     async_task_summary,
     ensure_celery_tasks_enabled,
diff --git a/lib/galaxy/webapps/galaxy/services/users.py b/lib/galaxy/webapps/galaxy/services/users.py
index de291d9c5b19..b4cb33b1021c 100644
--- a/lib/galaxy/webapps/galaxy/services/users.py
+++ b/lib/galaxy/webapps/galaxy/services/users.py
@@ -70,20 +70,21 @@ def __init__(
     def recalculate_disk_usage(
         self,
         trans: ProvidesUserContext,
+        user_id: int,
     ):
         if trans.anonymous:
             raise glx_exceptions.AuthenticationRequired("Only registered users can recalculate disk usage.")
         if trans.app.config.enable_celery_tasks:
             from galaxy.celery.tasks import recalculate_user_disk_usage
 
-            result = recalculate_user_disk_usage.delay(task_user_id=getattr(trans.user, "id", None))
+            result = recalculate_user_disk_usage.delay(task_user_id=user_id)
             return async_task_summary(result)
         else:
             send_local_control_task(
                 trans.app,
                 "recalculate_user_disk_usage",
                 kwargs={
-                    "user_id": trans.user.id,
+                    "user_id": user_id,
                 },
             )
             return None
diff --git a/lib/galaxy/workflow/extract.py b/lib/galaxy/workflow/extract.py
index 199c096e1133..bfa74d404d17 100644
--- a/lib/galaxy/workflow/extract.py
+++ b/lib/galaxy/workflow/extract.py
@@ -8,7 +8,10 @@
     exceptions,
     model,
 )
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.tool_util.parser import ToolOutputCollectionPart
 from galaxy.tools.parameters.basic import (
     DataCollectionToolParameter,
@@ -71,6 +74,7 @@ def extract_workflow(
     workflow.stored_workflow = stored
     stored.latest_workflow = workflow
     trans.sa_session.add(stored)
+    ensure_object_added_to_session(workflow, session=trans.sa_session)
     with transaction(trans.sa_session):
         trans.sa_session.commit()
     return stored
diff --git a/lib/galaxy/workflow/modules.py b/lib/galaxy/workflow/modules.py
index 6105111dce89..2ff8fe290e0b 100644
--- a/lib/galaxy/workflow/modules.py
+++ b/lib/galaxy/workflow/modules.py
@@ -23,7 +23,6 @@
 from galaxy import (
     exceptions,
     model,
-    web,
 )
 from galaxy.exceptions import (
     ToolInputsNotReadyException,
@@ -36,6 +35,7 @@
     WorkflowStep,
     WorkflowStepConnection,
 )
+from galaxy.model.base import ensure_object_added_to_session
 from galaxy.model.dataset_collections import matching
 from galaxy.schema.invocation import (
     CancelReason,
@@ -645,6 +645,7 @@ def from_workflow_step(Class, trans, step, **kwds):
     def save_to_step(self, step, **kwd):
         step.type = self.type
         step.subworkflow = self.subworkflow
+        ensure_object_added_to_session(step, object_in_session=self.subworkflow)
 
     def get_name(self):
         if hasattr(self.subworkflow, "name"):
@@ -1838,9 +1839,11 @@ def get_content_id(self):
     def get_version(self):
         return self.tool.version if self.tool else self.tool_version
 
-    def get_tooltip(self, static_path=""):
+    def get_tooltip(self, static_path=None):
         if self.tool and self.tool.help:
-            return self.tool.help.render(host_url=web.url_for("/"), static_path=static_path)
+            host_url = self.trans.url_builder("/")
+            static_path = self.trans.url_builder(static_path) if static_path else ""
+            return self.tool.help.render(host_url=host_url, static_path=static_path)
 
     # ---- Configuration time -----------------------------------------------
 
diff --git a/lib/galaxy/workflow/run.py b/lib/galaxy/workflow/run.py
index 776b4e525803..c7eab00a7a1d 100644
--- a/lib/galaxy/workflow/run.py
+++ b/lib/galaxy/workflow/run.py
@@ -18,7 +18,10 @@
     WorkflowInvocation,
     WorkflowInvocationStep,
 )
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.schema.invocation import (
     CancelReason,
     FailureReason,
@@ -225,6 +228,7 @@ def invoke(self) -> Dict[int, Any]:
                     workflow_invocation_step = WorkflowInvocationStep()
                     assert workflow_invocation_step
                     workflow_invocation_step.workflow_invocation = workflow_invocation
+                    ensure_object_added_to_session(workflow_invocation_step, object_in_session=workflow_invocation)
                     workflow_invocation_step.workflow_step = step
                     workflow_invocation_step.state = "new"
 
diff --git a/lib/galaxy/workflow/run_request.py b/lib/galaxy/workflow/run_request.py
index 8797b1fb8fe1..029b1e7630c6 100644
--- a/lib/galaxy/workflow/run_request.py
+++ b/lib/galaxy/workflow/run_request.py
@@ -21,7 +21,10 @@
     WorkflowRequestInputParameter,
     WorkflowRequestStepState,
 )
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy.tools.parameters.meta import expand_workflow_inputs
 from galaxy.workflow.resources import get_resource_mapper_function
 
@@ -486,6 +489,7 @@ def workflow_run_config_to_request(
     workflow_invocation = WorkflowInvocation()
     workflow_invocation.uuid = uuid.uuid1()
     workflow_invocation.history = run_config.target_history
+    ensure_object_added_to_session(workflow_invocation, object_in_session=run_config.target_history)
 
     def add_parameter(name: str, value: str, type: WorkflowRequestInputParameter.types) -> None:
         parameter = WorkflowRequestInputParameter(
diff --git a/lib/galaxy_test/api/test_item_tags.py b/lib/galaxy_test/api/test_item_tags.py
index 319e91a2ce22..3bf856126c8d 100644
--- a/lib/galaxy_test/api/test_item_tags.py
+++ b/lib/galaxy_test/api/test_item_tags.py
@@ -1,3 +1,8 @@
+from typing import (
+    Any,
+    Dict,
+)
+
 from galaxy_test.base.populators import (
     DatasetCollectionPopulator,
     DatasetPopulator,
@@ -6,7 +11,7 @@
 from galaxy_test.driver import integration_util
 
 
-class TestHistoriesApi(integration_util.IntegrationTestCase):
+class TestItemTagsApi(integration_util.IntegrationTestCase):
     dataset_populator: DatasetPopulator
 
     @classmethod
@@ -20,75 +25,77 @@ def setUp(self):
         self.dataset_collection_populator = DatasetCollectionPopulator(self.galaxy_interactor)
 
     def test_get_tags_workflows(self):
-        response = self._test_get_tags(self._create_prefixes()["workflows"])
+        response = self._test_get_tags(self._create_prefix("workflows"))
         self._assert_status_code_is(response, 200)
 
     def test_create_tag_workflows(self):
-        response = self._test_create_tag(self._create_prefixes()["workflows"])
+        response = self._test_create_tag(self._create_prefix("workflows"))
         self._assert_status_code_is(response, 200)
 
     def test_update_tag_workflows(self):
-        response = self._test_update_tag(self._create_prefixes()["workflows"])
+        response = self._test_update_tag(self._create_prefix("workflows"))
         self._assert_status_code_is(response, 200)
 
     def test_get_tag_workflows(self):
-        response = self._test_get_tag(self._create_prefixes()["workflows"])
+        response = self._test_get_tag(self._create_prefix("workflows"))
         self._assert_status_code_is(response, 200)
 
     def test_delete_tag_workflows(self):
-        response = self._test_delete_tag(self._create_prefixes()["workflows"])
+        response = self._test_delete_tag(self._create_prefix("workflows"))
         self._assert_status_code_is(response, 200)
 
     def test_get_tags_histories(self):
-        response = self._test_get_tags(self._create_prefixes()["histories"])
+        response = self._test_get_tags(self._create_prefix("histories"))
         self._assert_status_code_is(response, 200)
 
     def test_create_tag_histories(self):
-        response = self._test_create_tag(self._create_prefixes()["histories"])
+        response = self._test_create_tag(self._create_prefix("histories"))
         self._assert_status_code_is(response, 200)
 
     def test_update_tag_histories(self):
-        response = self._test_update_tag(self._create_prefixes()["histories"])
+        response = self._test_update_tag(self._create_prefix("histories"))
         self._assert_status_code_is(response, 200)
 
     def test_get_tag_histories(self):
-        response = self._test_get_tag(self._create_prefixes()["histories"])
+        response = self._test_get_tag(self._create_prefix("histories"))
         self._assert_status_code_is(response, 200)
 
     def test_delete_tag_histories(self):
-        response = self._test_delete_tag(self._create_prefixes()["histories"])
+        response = self._test_delete_tag(self._create_prefix("histories"))
         self._assert_status_code_is(response, 200)
 
     def test_get_tags_histories_content(self):
-        response = self._test_get_tags(self._create_prefixes()["histories_content"])
+        response = self._test_get_tags(self._create_prefix("histories_content"))
         self._assert_status_code_is(response, 200)
 
     def test_create_tag_histories_content(self):
-        response = self._test_create_tag(self._create_prefixes()["histories_content"])
+        response = self._test_create_tag(self._create_prefix("histories_content"))
         self._assert_status_code_is(response, 200)
 
     def test_update_tag_histories_content(self):
-        response = self._test_update_tag(self._create_prefixes()["histories_content"])
+        response = self._test_update_tag(self._create_prefix("histories_content"))
         self._assert_status_code_is(response, 200)
 
     def test_get_tag_histories_content(self):
-        response = self._test_get_tag(self._create_prefixes()["histories_content"])
+        response = self._test_get_tag(self._create_prefix("histories_content"))
         self._assert_status_code_is(response, 200)
 
     def test_delete_tag_histories_content(self):
-        response = self._test_delete_tag(self._create_prefixes()["histories_content"])
+        response = self._test_delete_tag(self._create_prefix("histories_content"))
         self._assert_status_code_is(response, 200)
 
-    def _create_prefixes(self):
-        workflow_id = self._create_workflow()
+    def _create_prefix(self, type_: str) -> str:
+        if type_ == "workflows":
+            workflow_id = self._create_workflow()
+            return f"workflows/{workflow_id}"
         history_id = self._create_history()
-        history_content_id = self._create_history_contents(history_id)
-        prefixs = {
-            "workflows": f"workflows/{workflow_id}",
-            "histories": f"histories/{history_id}",
-            "histories_content": f"histories/{history_id}/contents/{history_content_id}",
-        }
-        return prefixs
+        if type_ == "histories":
+            return f"histories/{history_id}"
+        elif type_ == "histories_content":
+            history_content_id = self._create_history_contents(history_id)
+            return f"histories/{history_id}/contents/{history_content_id}"
+        else:
+            raise ValueError(f"Unrecognized type_ {type_}")
 
     def _test_get_tags(self, prefix):
         url = f"{prefix}/tags"
@@ -123,7 +130,7 @@ def _test_delete_tag(self, prefix):
 
     def _create_valid_tag(self, prefix: str):
         url = f"{prefix}/tags/awesometagname"
-        tag_data = dict(value="awesometagvalue")
+        tag_data: Dict[str, Any] = {}  # Can also be dict(value="awesometagvalue")
         response = self._post(url, data=tag_data, json=True)
         return response
 
diff --git a/lib/galaxy_test/api/test_tools_upload.py b/lib/galaxy_test/api/test_tools_upload.py
index 51df9ab4adcd..ef35eecf6de7 100644
--- a/lib/galaxy_test/api/test_tools_upload.py
+++ b/lib/galaxy_test/api/test_tools_upload.py
@@ -990,6 +990,7 @@ def upload_file(url, path, api_key, history_id):
             # Upload a file to a tus server.
             uploader = my_client.uploader(path, metadata=metadata)
             uploader.upload()
+            assert uploader.url
             return uploader.url.rsplit("/", 1)[1]
 
         with self.dataset_populator.test_history() as history_id:
diff --git a/packages/app/HISTORY.rst b/packages/app/HISTORY.rst
index b0d01e41d70c..0cd9988f5378 100644
--- a/packages/app/HISTORY.rst
+++ b/packages/app/HISTORY.rst
@@ -4,11 +4,41 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Fix unbound ``runner`` variable when there is an error in the job config by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16906 <https://github.com/galaxyproject/galaxy/pull/16906>`_
+* Fix discarded dataset ordering in Storage Dashboard by `@davelopez <https://github.com/davelopez>`_ in `#16929 <https://github.com/galaxyproject/galaxy/pull/16929>`_
+* Include owner's annotation when exporting workflow by `@dannon <https://github.com/dannon>`_ in `#16930 <https://github.com/galaxyproject/galaxy/pull/16930>`_
+* Skip state filtering in ``__MERGE_COLLECTION__`` tool  by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16937 <https://github.com/galaxyproject/galaxy/pull/16937>`_
+* Prevent Singular external auth users from disconnecting identity by `@ahmedhamidawan <https://github.com/ahmedhamidawan>`_ in `#16961 <https://github.com/galaxyproject/galaxy/pull/16961>`_
+* Prevent workflow submission with missing input values by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17048 <https://github.com/galaxyproject/galaxy/pull/17048>`_
+* Fix extra files collection if using ``store_by="id"`` and `outputs_to_working_directory` by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17067 <https://github.com/galaxyproject/galaxy/pull/17067>`_
+* Remove rollback from ``__check_jobs_at_startup`` by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17085 <https://github.com/galaxyproject/galaxy/pull/17085>`_
+
+============
+Enhancements
+============
+
+* Improve invocation error reporting by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16917 <https://github.com/galaxyproject/galaxy/pull/16917>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +48,7 @@ History
 Bug fixes
 =========
 
+* 
 * read job_conf directly from `config_dir` instead of computing it again from `config_file` by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15596 <https://github.com/galaxyproject/galaxy/pull/15596>`_
 * Fix some drs handling issues by `@nuwang <https://github.com/nuwang>`_ in `#15777 <https://github.com/galaxyproject/galaxy/pull/15777>`_
 * Fix filesource file url support by `@nuwang <https://github.com/nuwang>`_ in `#15794 <https://github.com/galaxyproject/galaxy/pull/15794>`_
@@ -73,6 +104,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Empower Users to Select Storage Destination by `@jmchilton <https://github.com/jmchilton>`_ in `#14073 <https://github.com/galaxyproject/galaxy/pull/14073>`_
 * External Login Flow: Redirect users if account already exists by `@ahmedhamidawan <https://github.com/ahmedhamidawan>`_ in `#15019 <https://github.com/galaxyproject/galaxy/pull/15019>`_
 * Add slack error reporting plugin by `@hexylena <https://github.com/hexylena>`_ in `#15025 <https://github.com/galaxyproject/galaxy/pull/15025>`_
@@ -158,6 +190,8 @@ Other changes
 Bug fixes
 =========
 
+* 
+* 
 * Fix upload paramfile handling (for real user setups) by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#16504 <https://github.com/galaxyproject/galaxy/pull/16504>`_
 * Fix extra files path handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16541 <https://github.com/galaxyproject/galaxy/pull/16541>`_
 * Make sure job_wrapper uses a consistent metadata strategy by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16569 <https://github.com/galaxyproject/galaxy/pull/16569>`_
@@ -171,6 +205,8 @@ Bug fixes
 Enhancements
 ============
 
+* 
+* 
 * Update pulsar client library to 0.15.5 by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16701 <https://github.com/galaxyproject/galaxy/pull/16701>`_
 
 -------------------
@@ -182,6 +218,8 @@ Enhancements
 Bug fixes
 =========
 
+* 
+* 
 * 
 * Skip installing npm/yarn if available, fix conditional dependency parsing, create virtualenv via conda when conda active by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#16403 <https://github.com/galaxyproject/galaxy/pull/16403>`_
 * Fix test discovery in vscode by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16413 <https://github.com/galaxyproject/galaxy/pull/16413>`_
@@ -196,6 +234,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * Fix default when statement evaluation by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16332 <https://github.com/galaxyproject/galaxy/pull/16332>`_
@@ -210,6 +250,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * 
@@ -219,6 +261,8 @@ Bug fixes
 Enhancements
 ============
 
+* 
+* 
 * 
 * When importing tool data bundles, use the first loc file for the matching table by `@natefoo <https://github.com/natefoo>`_ in `#16247 <https://github.com/galaxyproject/galaxy/pull/16247>`_
 
@@ -226,6 +270,8 @@ Enhancements
 Other changes
 =============
 
+* 
+* 
 * Forward port of slugify username received from oidc by `@nuwang <https://github.com/nuwang>`_ in `#16271 <https://github.com/galaxyproject/galaxy/pull/16271>`_
 
 -------------------
@@ -241,6 +287,8 @@ Bug fixes
 * 
 * 
 * 
+* 
+* 
 * Fix ``Text File Busy`` errors at the source by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16212 <https://github.com/galaxyproject/galaxy/pull/16212>`_
 
 ============
@@ -251,6 +299,8 @@ Enhancements
 * 
 * 
 * 
+* 
+* 
 * Point release deps fixes and docs by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16214 <https://github.com/galaxyproject/galaxy/pull/16214>`_
 * Use galaxy-release-util to upload python packages by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16240 <https://github.com/galaxyproject/galaxy/pull/16240>`_
 
@@ -268,6 +318,8 @@ Bug fixes
 * 
 * 
 * 
+* 
+* 
 * Display DCE in job parameter component, allow rerunning with DCE input by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15744 <https://github.com/galaxyproject/galaxy/pull/15744>`_
 * Fix mixed outputs_to_working_directory pulsar destinations by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15927 <https://github.com/galaxyproject/galaxy/pull/15927>`_
 * Update Gravity to 1.0.3 by `@natefoo <https://github.com/natefoo>`_ in `#15939 <https://github.com/galaxyproject/galaxy/pull/15939>`_
@@ -295,6 +347,8 @@ Other changes
 * 
 * 
 * 
+* 
+* 
 * Startup fix when tool removed between reboot by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16175 <https://github.com/galaxyproject/galaxy/pull/16175>`_
 
 -------------------
diff --git a/packages/app/galaxy/short_term_storage b/packages/app/galaxy/short_term_storage
new file mode 120000
index 000000000000..0cf1fea8150e
--- /dev/null
+++ b/packages/app/galaxy/short_term_storage
@@ -0,0 +1 @@
+../../../lib/galaxy/short_term_storage/
\ No newline at end of file
diff --git a/packages/auth/HISTORY.rst b/packages/auth/HISTORY.rst
index 3bff8a7b7b14..a1ee05a3c0bf 100644
--- a/packages/auth/HISTORY.rst
+++ b/packages/auth/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
diff --git a/packages/config/HISTORY.rst b/packages/config/HISTORY.rst
index 9ccf708e7354..e3ced64e6a2d 100644
--- a/packages/config/HISTORY.rst
+++ b/packages/config/HISTORY.rst
@@ -4,11 +4,35 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Prevent Singular external auth users from disconnecting identity by `@ahmedhamidawan <https://github.com/ahmedhamidawan>`_ in `#16961 <https://github.com/galaxyproject/galaxy/pull/16961>`_
+* Set correct tool_path for packaged galaxy by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17102 <https://github.com/galaxyproject/galaxy/pull/17102>`_
+
+============
+Enhancements
+============
+
+* Add support for larch datatypes by `@patrick-austin <https://github.com/patrick-austin>`_ in `#17080 <https://github.com/galaxyproject/galaxy/pull/17080>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +42,7 @@ History
 Bug fixes
 =========
 
+* 
 * Fix some drs handling issues by `@nuwang <https://github.com/nuwang>`_ in `#15777 <https://github.com/galaxyproject/galaxy/pull/15777>`_
 * Improve container resolver documentation by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16280 <https://github.com/galaxyproject/galaxy/pull/16280>`_
 * Limit tool document cache to tool configs with explicit cache path by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16537 <https://github.com/galaxyproject/galaxy/pull/16537>`_
@@ -28,6 +53,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * External Login Flow: Redirect users if account already exists by `@ahmedhamidawan <https://github.com/ahmedhamidawan>`_ in `#15019 <https://github.com/galaxyproject/galaxy/pull/15019>`_
 * Add slack error reporting plugin by `@hexylena <https://github.com/hexylena>`_ in `#15025 <https://github.com/galaxyproject/galaxy/pull/15025>`_
 * Documents use of k8s_extra_job_envs in job_conf sample advanced by `@pcm32 <https://github.com/pcm32>`_ in `#15110 <https://github.com/galaxyproject/galaxy/pull/15110>`_
@@ -71,6 +97,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * Minor bug fix for default mail templates by `@neoformit <https://github.com/neoformit>`_ in `#16362 <https://github.com/galaxyproject/galaxy/pull/16362>`_
 
 -------------------
@@ -100,6 +128,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * Change default watchdog inotify_buffer log level to info by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15967 <https://github.com/galaxyproject/galaxy/pull/15967>`_
@@ -108,6 +138,8 @@ Bug fixes
 Enhancements
 ============
 
+* 
+* 
 * Add ``ca_certs`` option for sentry client by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15943 <https://github.com/galaxyproject/galaxy/pull/15943>`_
 
 -------------------
diff --git a/packages/data/HISTORY.rst b/packages/data/HISTORY.rst
index e35636ecebaa..c5c22246148c 100644
--- a/packages/data/HISTORY.rst
+++ b/packages/data/HISTORY.rst
@@ -4,11 +4,45 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Add missing optional description field, fixes ephemeris data library example by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17116 <https://github.com/galaxyproject/galaxy/pull/17116>`_
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Skip change_datatype things if we're not actually changing the extension by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16931 <https://github.com/galaxyproject/galaxy/pull/16931>`_
+* Fix copying metadata to copied job outputs by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17007 <https://github.com/galaxyproject/galaxy/pull/17007>`_
+* Update tar_to_directory dependency by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17009 <https://github.com/galaxyproject/galaxy/pull/17009>`_
+* Assert that ``DatasetCollectioElement`` has an associated object by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17071 <https://github.com/galaxyproject/galaxy/pull/17071>`_
+* Fix input dates in notifications: consider timezone offset by `@davelopez <https://github.com/davelopez>`_ in `#17088 <https://github.com/galaxyproject/galaxy/pull/17088>`_
+* Allow relative URLs in broadcasts action links by `@davelopez <https://github.com/davelopez>`_ in `#17093 <https://github.com/galaxyproject/galaxy/pull/17093>`_
+
+============
+Enhancements
+============
+
+* Improve invocation error reporting by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16917 <https://github.com/galaxyproject/galaxy/pull/16917>`_
+* Add support for larch datatypes by `@patrick-austin <https://github.com/patrick-austin>`_ in `#17080 <https://github.com/galaxyproject/galaxy/pull/17080>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +52,7 @@ History
 Bug fixes
 =========
 
+* 
 * Fix bad auto-merge of dev. by `@jmchilton <https://github.com/jmchilton>`_ in `#15386 <https://github.com/galaxyproject/galaxy/pull/15386>`_
 * Merge conflicting db migration branches into one by `@jdavcs <https://github.com/jdavcs>`_ in `#15771 <https://github.com/galaxyproject/galaxy/pull/15771>`_
 * Enable ``strict_equality`` mypy option by `@nsoranzo <https://github.com/nsoranzo>`_ in `#15808 <https://github.com/galaxyproject/galaxy/pull/15808>`_
@@ -48,6 +83,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Empower Users to Select Storage Destination by `@jmchilton <https://github.com/jmchilton>`_ in `#14073 <https://github.com/galaxyproject/galaxy/pull/14073>`_
 * Add Storage Dashboard visualizations for histories by `@davelopez <https://github.com/davelopez>`_ in `#14820 <https://github.com/galaxyproject/galaxy/pull/14820>`_
 * Towards decoupling datatypes and model by `@jdavcs <https://github.com/jdavcs>`_ in `#15186 <https://github.com/galaxyproject/galaxy/pull/15186>`_
@@ -106,6 +142,8 @@ Other changes
 Bug fixes
 =========
 
+* 
+* 
 * Fix extra files path handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16541 <https://github.com/galaxyproject/galaxy/pull/16541>`_
 * Don't fail invocation message without dependent_workflow_step_id by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16628 <https://github.com/galaxyproject/galaxy/pull/16628>`_
 
@@ -118,6 +156,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * Copy when_expression when copying workflow step by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16377 <https://github.com/galaxyproject/galaxy/pull/16377>`_
 
@@ -148,6 +188,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * Display DCE in job parameter component, allow rerunning with DCE input by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15744 <https://github.com/galaxyproject/galaxy/pull/15744>`_
diff --git a/packages/files/HISTORY.rst b/packages/files/HISTORY.rst
index 0e421ead2f62..bb5df832b72d 100644
--- a/packages/files/HISTORY.rst
+++ b/packages/files/HISTORY.rst
@@ -4,11 +4,28 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Implement missing upload for S3 file sources by `@davelopez <https://github.com/davelopez>`_ in `#17100 <https://github.com/galaxyproject/galaxy/pull/17100>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +35,7 @@ History
 Bug fixes
 =========
 
+* 
 * Fix some drs handling issues by `@nuwang <https://github.com/nuwang>`_ in `#15777 <https://github.com/galaxyproject/galaxy/pull/15777>`_
 * Fix filesource file url support by `@nuwang <https://github.com/nuwang>`_ in `#15794 <https://github.com/galaxyproject/galaxy/pull/15794>`_
 * Fix unittest mocks to support us checking geturl()  by `@dannon <https://github.com/dannon>`_ in `#16726 <https://github.com/galaxyproject/galaxy/pull/16726>`_
@@ -62,6 +80,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * Fix dropbox import to support newer versions by `@nuwang <https://github.com/nuwang>`_ in `#16239 <https://github.com/galaxyproject/galaxy/pull/16239>`_
 
 -------------------
diff --git a/packages/job_execution/HISTORY.rst b/packages/job_execution/HISTORY.rst
index 293a0b094613..82f7934ea472 100644
--- a/packages/job_execution/HISTORY.rst
+++ b/packages/job_execution/HISTORY.rst
@@ -4,11 +4,30 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Fix library import from path linking files by `@davelopez <https://github.com/davelopez>`_ in `#16919 <https://github.com/galaxyproject/galaxy/pull/16919>`_
+* Don't store job in JobIO instance attributes by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16965 <https://github.com/galaxyproject/galaxy/pull/16965>`_
+* Fix extra files collection if using ``store_by="id"`` and `outputs_to_working_directory` by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17067 <https://github.com/galaxyproject/galaxy/pull/17067>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +37,7 @@ History
 Bug fixes
 =========
 
+* 
 * Fix tags ownership by `@davelopez <https://github.com/davelopez>`_ in `#16339 <https://github.com/galaxyproject/galaxy/pull/16339>`_
 * Push to object store even if ``set_meta`` fails by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16667 <https://github.com/galaxyproject/galaxy/pull/16667>`_
 * Fix metadata setting in extended metadata + outputs_to_working_directory mode by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16678 <https://github.com/galaxyproject/galaxy/pull/16678>`_
@@ -46,6 +66,8 @@ Enhancements
 Bug fixes
 =========
 
+* 
+* 
 * Fix extra files path handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16541 <https://github.com/galaxyproject/galaxy/pull/16541>`_
 * Make sure job_wrapper uses a consistent metadata strategy by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16569 <https://github.com/galaxyproject/galaxy/pull/16569>`_
 * Fixes for extra files handling and cached object stores  by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16595 <https://github.com/galaxyproject/galaxy/pull/16595>`_
diff --git a/packages/job_metrics/HISTORY.rst b/packages/job_metrics/HISTORY.rst
index aa0f5dc62d37..8e5403a780d8 100644
--- a/packages/job_metrics/HISTORY.rst
+++ b/packages/job_metrics/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
diff --git a/packages/navigation/HISTORY.rst b/packages/navigation/HISTORY.rst
index e327ef00676a..c8f96b79b2a0 100644
--- a/packages/navigation/HISTORY.rst
+++ b/packages/navigation/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
diff --git a/packages/objectstore/HISTORY.rst b/packages/objectstore/HISTORY.rst
index 1cc0ad482c91..2c99e54cde30 100644
--- a/packages/objectstore/HISTORY.rst
+++ b/packages/objectstore/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -49,6 +61,8 @@ Other changes
 Bug fixes
 =========
 
+* 
+* 
 * Fix extra files path handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16541 <https://github.com/galaxyproject/galaxy/pull/16541>`_
 * Fixes for extra files handling and cached object stores  by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16595 <https://github.com/galaxyproject/galaxy/pull/16595>`_
 
diff --git a/packages/selenium/HISTORY.rst b/packages/selenium/HISTORY.rst
index 7034e144749d..2f75e58a8c23 100644
--- a/packages/selenium/HISTORY.rst
+++ b/packages/selenium/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -74,6 +86,8 @@ No recorded changes since last release
 Enhancements
 ============
 
+* 
+* 
 * Port selenium setup to non-deprecated selenium options by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16215 <https://github.com/galaxyproject/galaxy/pull/16215>`_
 
 -------------------
@@ -90,6 +104,8 @@ Enhancements
 * 
 * 
 * 
+* 
+* 
 * Add support for launching workflows via Tutorial Mode by `@hexylena <https://github.com/hexylena>`_ in `#15684 <https://github.com/galaxyproject/galaxy/pull/15684>`_
 
 -------------------
diff --git a/packages/test_api/HISTORY.rst b/packages/test_api/HISTORY.rst
index d92eeba74c5a..c8b5c1169577 100644
--- a/packages/test_api/HISTORY.rst
+++ b/packages/test_api/HISTORY.rst
@@ -4,11 +4,35 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Skip state filtering in ``__MERGE_COLLECTION__`` tool  by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16937 <https://github.com/galaxyproject/galaxy/pull/16937>`_
+* Fix duplicated tools in tool panel view section copying by `@jmchilton <https://github.com/jmchilton>`_ in `#17036 <https://github.com/galaxyproject/galaxy/pull/17036>`_
+
+============
+Enhancements
+============
+
+* Improve invocation error reporting by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16917 <https://github.com/galaxyproject/galaxy/pull/16917>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +42,7 @@ History
 Bug fixes
 =========
 
+* 
 * Ensure session is request-scoped for legacy endpoints by `@jdavcs <https://github.com/jdavcs>`_ in `#16207 <https://github.com/galaxyproject/galaxy/pull/16207>`_
 * allow anon access for api/datasets/get_content_as_text by `@martenson <https://github.com/martenson>`_ in `#16226 <https://github.com/galaxyproject/galaxy/pull/16226>`_
 * qualify querying for an api-key by `@martenson <https://github.com/martenson>`_ in `#16320 <https://github.com/galaxyproject/galaxy/pull/16320>`_
@@ -39,6 +64,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Empower Users to Select Storage Destination by `@jmchilton <https://github.com/jmchilton>`_ in `#14073 <https://github.com/galaxyproject/galaxy/pull/14073>`_
 * Outline Deployment Tests by `@jmchilton <https://github.com/jmchilton>`_ in `#15420 <https://github.com/galaxyproject/galaxy/pull/15420>`_
 * Unify url handling with filesources by `@nuwang <https://github.com/nuwang>`_ in `#15497 <https://github.com/galaxyproject/galaxy/pull/15497>`_
@@ -91,6 +117,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * Display DCE in job parameter component, allow rerunning with DCE input by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15744 <https://github.com/galaxyproject/galaxy/pull/15744>`_
 * Fix folder listing via file browser by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15950 <https://github.com/galaxyproject/galaxy/pull/15950>`_
 * Fix case sensitive filtering by name in histories by `@davelopez <https://github.com/davelopez>`_ in `#16036 <https://github.com/galaxyproject/galaxy/pull/16036>`_
@@ -101,6 +129,8 @@ Bug fixes
 Enhancements
 ============
 
+* 
+* 
 * Add support for launching workflows via Tutorial Mode by `@hexylena <https://github.com/hexylena>`_ in `#15684 <https://github.com/galaxyproject/galaxy/pull/15684>`_
 * Allow setting auto_decompress property in staging interface by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16014 <https://github.com/galaxyproject/galaxy/pull/16014>`_
 
diff --git a/packages/test_base/HISTORY.rst b/packages/test_base/HISTORY.rst
index d0ccb6166ef4..7039fdba71c9 100644
--- a/packages/test_base/HISTORY.rst
+++ b/packages/test_base/HISTORY.rst
@@ -4,11 +4,28 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Fix duplicated tools in tool panel view section copying by `@jmchilton <https://github.com/jmchilton>`_ in `#17036 <https://github.com/galaxyproject/galaxy/pull/17036>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +35,7 @@ History
 Bug fixes
 =========
 
+* 
 * Ensure session is request-scoped for legacy endpoints by `@jdavcs <https://github.com/jdavcs>`_ in `#16207 <https://github.com/galaxyproject/galaxy/pull/16207>`_
 
 ============
@@ -78,6 +96,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * Ensure history export contains all expected datasets by `@davelopez <https://github.com/davelopez>`_ in `#16013 <https://github.com/galaxyproject/galaxy/pull/16013>`_
 * Fix extended metadata file size handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16109 <https://github.com/galaxyproject/galaxy/pull/16109>`_
 
diff --git a/packages/test_driver/HISTORY.rst b/packages/test_driver/HISTORY.rst
index e6b6a3563240..277e723ed412 100644
--- a/packages/test_driver/HISTORY.rst
+++ b/packages/test_driver/HISTORY.rst
@@ -4,11 +4,28 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Assert that ``DatasetCollectioElement`` has an associated object by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17071 <https://github.com/galaxyproject/galaxy/pull/17071>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +35,7 @@ History
 Bug fixes
 =========
 
+* 
 * Backport tool mem fixes by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16601 <https://github.com/galaxyproject/galaxy/pull/16601>`_
 * Fix allowlist deserialization in file sources by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16729 <https://github.com/galaxyproject/galaxy/pull/16729>`_
 
diff --git a/packages/tool_util/HISTORY.rst b/packages/tool_util/HISTORY.rst
index b56109e98356..0a53cd057152 100644
--- a/packages/tool_util/HISTORY.rst
+++ b/packages/tool_util/HISTORY.rst
@@ -4,11 +4,36 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Change log level for duplicate data table entries to warning by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16988 <https://github.com/galaxyproject/galaxy/pull/16988>`_
+* Upgrade minimum conda to be compatible with latest conda-build by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#17013 <https://github.com/galaxyproject/galaxy/pull/17013>`_
+* Fix duplicated tools in tool panel view section copying by `@jmchilton <https://github.com/jmchilton>`_ in `#17036 <https://github.com/galaxyproject/galaxy/pull/17036>`_
+
+============
+Enhancements
+============
+
+* Adds `biii` as supported xref reference type by `@kostrykin <https://github.com/kostrykin>`_ in `#16952 <https://github.com/galaxyproject/galaxy/pull/16952>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +43,7 @@ History
 Bug fixes
 =========
 
+* 
 * Fixes for two framework test tools by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15483 <https://github.com/galaxyproject/galaxy/pull/15483>`_
 * add missing f for f-string by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15584 <https://github.com/galaxyproject/galaxy/pull/15584>`_
 * Fix call to `docker_cached_container_description` by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15598 <https://github.com/galaxyproject/galaxy/pull/15598>`_
@@ -39,6 +65,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Decompress history data for testing assertions by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15085 <https://github.com/galaxyproject/galaxy/pull/15085>`_
 * OIDC tokens by `@SergeyYakubov <https://github.com/SergeyYakubov>`_ in `#15300 <https://github.com/galaxyproject/galaxy/pull/15300>`_
 * Fix for new style conda packages by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15446 <https://github.com/galaxyproject/galaxy/pull/15446>`_
@@ -75,6 +102,8 @@ Other changes
 Bug fixes
 =========
 
+* 
+* 
 * Fixes for extra files handling and cached object stores  by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16595 <https://github.com/galaxyproject/galaxy/pull/16595>`_
 * Fix create/install commands for conda 23.9.0 by `@nsoranzo <https://github.com/nsoranzo>`_ in `#16831 <https://github.com/galaxyproject/galaxy/pull/16831>`_
 
@@ -87,6 +116,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * Allow duplicate labels in linter if outputs contain filters  by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15933 <https://github.com/galaxyproject/galaxy/pull/15933>`_
 * Fix parsing tool metadata from bio.tools by `@kysrpex <https://github.com/kysrpex>`_ in `#16449 <https://github.com/galaxyproject/galaxy/pull/16449>`_
@@ -108,6 +139,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * xsd: add missing `sep` attribute for `has_n_columns` by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#16262 <https://github.com/galaxyproject/galaxy/pull/16262>`_
@@ -117,6 +150,8 @@ Bug fixes
 Enhancements
 ============
 
+* 
+* 
 * When importing tool data bundles, use the first loc file for the matching table by `@natefoo <https://github.com/natefoo>`_ in `#16247 <https://github.com/galaxyproject/galaxy/pull/16247>`_
 
 -------------------
@@ -132,6 +167,8 @@ Bug fixes
 * 
 * 
 * 
+* 
+* 
 * Don't fail CWL tool parsing when Cheetah not installed by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16219 <https://github.com/galaxyproject/galaxy/pull/16219>`_
 * Allow skipping ``expect_num_outputs`` when ``expect_failure`` is set in tool test by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#16237 <https://github.com/galaxyproject/galaxy/pull/16237>`_
 
@@ -149,6 +186,8 @@ Bug fixes
 * 
 * 
 * 
+* 
+* 
 * Fix assertion linting to not fail on byte suffixes by `@bernt-matthias <https://github.com/bernt-matthias>`_ in `#15873 <https://github.com/galaxyproject/galaxy/pull/15873>`_
 * Fix ``get_test_from_anaconda()`` and ``base_image_for_targets()`` functions by `@nsoranzo <https://github.com/nsoranzo>`_ in `#16125 <https://github.com/galaxyproject/galaxy/pull/16125>`_
 * Fix test search for mulled container hashes by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16170 <https://github.com/galaxyproject/galaxy/pull/16170>`_
@@ -161,6 +200,8 @@ Enhancements
 * 
 * 
 * 
+* 
+* 
 * Allow setting auto_decompress property in staging interface by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16014 <https://github.com/galaxyproject/galaxy/pull/16014>`_
 
 -------------------
diff --git a/packages/tours/HISTORY.rst b/packages/tours/HISTORY.rst
index b140d54e55d0..2305458ba3fc 100644
--- a/packages/tours/HISTORY.rst
+++ b/packages/tours/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
diff --git a/packages/util/HISTORY.rst b/packages/util/HISTORY.rst
index 1d1b02b7716c..39c593d8f8be 100644
--- a/packages/util/HISTORY.rst
+++ b/packages/util/HISTORY.rst
@@ -4,11 +4,28 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+============
+Enhancements
+============
+
+* Improve invocation error reporting by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16917 <https://github.com/galaxyproject/galaxy/pull/16917>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -32,6 +49,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Various Tool Shed Cleanup by `@jmchilton <https://github.com/jmchilton>`_ in `#15247 <https://github.com/galaxyproject/galaxy/pull/15247>`_
 * Protection against problematic boolean parameters. by `@jmchilton <https://github.com/jmchilton>`_ in `#15493 <https://github.com/galaxyproject/galaxy/pull/15493>`_
 * Unify url handling with filesources by `@nuwang <https://github.com/nuwang>`_ in `#15497 <https://github.com/galaxyproject/galaxy/pull/15497>`_
@@ -83,6 +101,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * Replace httpbin service with pytest-httpserver by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16042 <https://github.com/galaxyproject/galaxy/pull/16042>`_
 
 -------------------
diff --git a/packages/web_apps/HISTORY.rst b/packages/web_apps/HISTORY.rst
index f8bba3ddd201..2c817f6ca381 100644
--- a/packages/web_apps/HISTORY.rst
+++ b/packages/web_apps/HISTORY.rst
@@ -4,11 +4,40 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Add missing optional description field, fixes ephemeris data library example by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17116 <https://github.com/galaxyproject/galaxy/pull/17116>`_
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Provide error message instead of internal server error by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16905 <https://github.com/galaxyproject/galaxy/pull/16905>`_
+* Fix input dates in notifications: consider timezone offset by `@davelopez <https://github.com/davelopez>`_ in `#17088 <https://github.com/galaxyproject/galaxy/pull/17088>`_
+
+============
+Enhancements
+============
+
+* Add HEAD route to job_files endpoint by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17072 <https://github.com/galaxyproject/galaxy/pull/17072>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +47,7 @@ History
 Bug fixes
 =========
 
+* 
 * Create ToolSuccess route and refactor component by `@ahmedhamidawan <https://github.com/ahmedhamidawan>`_ in `#15484 <https://github.com/galaxyproject/galaxy/pull/15484>`_
 * fix premature return in user API by `@martenson <https://github.com/martenson>`_ in `#15781 <https://github.com/galaxyproject/galaxy/pull/15781>`_
 * Ensure session is request-scoped for legacy endpoints by `@jdavcs <https://github.com/jdavcs>`_ in `#16207 <https://github.com/galaxyproject/galaxy/pull/16207>`_
@@ -38,6 +68,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Empower Users to Select Storage Destination by `@jmchilton <https://github.com/jmchilton>`_ in `#14073 <https://github.com/galaxyproject/galaxy/pull/14073>`_
 * Add Storage Dashboard visualizations for histories by `@davelopez <https://github.com/davelopez>`_ in `#14820 <https://github.com/galaxyproject/galaxy/pull/14820>`_
 * External Login Flow: Redirect users if account already exists by `@ahmedhamidawan <https://github.com/ahmedhamidawan>`_ in `#15019 <https://github.com/galaxyproject/galaxy/pull/15019>`_
@@ -95,6 +126,8 @@ Other changes
 Bug fixes
 =========
 
+* 
+* 
 * Fix incorrect ASGI request host by `@davelopez <https://github.com/davelopez>`_ in `#16574 <https://github.com/galaxyproject/galaxy/pull/16574>`_
 * Allow the legacy DELETE dataset endpoint to accept any string for the history_id by `@assuntad23 <https://github.com/assuntad23>`_ in `#16593 <https://github.com/galaxyproject/galaxy/pull/16593>`_
 
@@ -107,6 +140,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * Fix active step display in workflow editor side panel by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16364 <https://github.com/galaxyproject/galaxy/pull/16364>`_
 
@@ -119,6 +154,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * Fix folder access for anonymous user by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16330 <https://github.com/galaxyproject/galaxy/pull/16330>`_
@@ -132,6 +169,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * 
@@ -141,6 +180,8 @@ Bug fixes
 Enhancements
 ============
 
+* 
+* 
 * When importing tool data bundles, use the first loc file for the matching table by `@natefoo <https://github.com/natefoo>`_ in `#16247 <https://github.com/galaxyproject/galaxy/pull/16247>`_
 
 -------------------
@@ -162,6 +203,8 @@ Bug fixes
 * 
 * 
 * 
+* 
+* 
 * Display DCE in job parameter component, allow rerunning with DCE input by `@mvdbeek <https://github.com/mvdbeek>`_ in `#15744 <https://github.com/galaxyproject/galaxy/pull/15744>`_
 * Various fixes to path prefix handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16033 <https://github.com/galaxyproject/galaxy/pull/16033>`_
 * Fix dataype_change not updating HDCA update_time by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16099 <https://github.com/galaxyproject/galaxy/pull/16099>`_
diff --git a/packages/web_apps/setup.cfg b/packages/web_apps/setup.cfg
index 472f09cc1c85..4b5f5045e858 100644
--- a/packages/web_apps/setup.cfg
+++ b/packages/web_apps/setup.cfg
@@ -35,7 +35,7 @@ install_requires =
     galaxy-data
     galaxy-job-execution
     galaxy-tool-util
-    galaxy-util
+    galaxy-util[jstree,template]
     galaxy-web-framework
     galaxy-web-stack
     a2wsgi
diff --git a/packages/web_framework/HISTORY.rst b/packages/web_framework/HISTORY.rst
index 03fd917fc884..fc647991c446 100644
--- a/packages/web_framework/HISTORY.rst
+++ b/packages/web_framework/HISTORY.rst
@@ -4,11 +4,34 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+
+=========
+Bug fixes
+=========
+
+* Workaround issue in Routes by `@nsoranzo <https://github.com/nsoranzo>`_ in `#16981 <https://github.com/galaxyproject/galaxy/pull/16981>`_
+
+============
+Enhancements
+============
+
+* Add HEAD route to job_files endpoint by `@mvdbeek <https://github.com/mvdbeek>`_ in `#17072 <https://github.com/galaxyproject/galaxy/pull/17072>`_
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -18,6 +41,7 @@ History
 Bug fixes
 =========
 
+* 
 * Fix some drs handling issues by `@nuwang <https://github.com/nuwang>`_ in `#15777 <https://github.com/galaxyproject/galaxy/pull/15777>`_
 * Ensure session is request-scoped for legacy endpoints by `@jdavcs <https://github.com/jdavcs>`_ in `#16207 <https://github.com/galaxyproject/galaxy/pull/16207>`_
 
@@ -25,6 +49,7 @@ Bug fixes
 Enhancements
 ============
 
+* 
 * Update Python dependencies by `@galaxybot <https://github.com/galaxybot>`_ in `#15435 <https://github.com/galaxyproject/galaxy/pull/15435>`_
 * Don't error on missing parameters or unused parameters in UI controllers by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16246 <https://github.com/galaxyproject/galaxy/pull/16246>`_
 
@@ -37,6 +62,8 @@ Enhancements
 Bug fixes
 =========
 
+* 
+* 
 * Don't read request body into memory by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16585 <https://github.com/galaxyproject/galaxy/pull/16585>`_
 
 -------------------
@@ -48,6 +75,8 @@ Bug fixes
 Bug fixes
 =========
 
+* 
+* 
 * 
 * Media player fix issue 16415 by `@bdwheele <https://github.com/bdwheele>`_ in `#16443 <https://github.com/galaxyproject/galaxy/pull/16443>`_
 * Fix static file serving for ``robots.txt`` and ``favicon.ico`` when using per_host settings by `@mira-miracoli <https://github.com/mira-miracoli>`_ in `#16459 <https://github.com/galaxyproject/galaxy/pull/16459>`_
@@ -79,6 +108,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * 
 * 
 * Various fixes to path prefix handling by `@mvdbeek <https://github.com/mvdbeek>`_ in `#16033 <https://github.com/galaxyproject/galaxy/pull/16033>`_
diff --git a/packages/web_stack/HISTORY.rst b/packages/web_stack/HISTORY.rst
index 9c3e3b4f072b..cbbbebae9793 100644
--- a/packages/web_stack/HISTORY.rst
+++ b/packages/web_stack/HISTORY.rst
@@ -4,11 +4,23 @@ History
 .. to_doc
 
 ---------
-23.2.dev0
+23.3.dev0
 ---------
 
 
 
+-------------------
+23.1.3 (2023-12-01)
+-------------------
+
+No recorded changes since last release
+
+-------------------
+23.1.2 (2023-11-29)
+-------------------
+
+No recorded changes since last release
+
 -------------------
 23.1.1 (2023-10-23)
 -------------------
@@ -49,6 +61,8 @@ No recorded changes since last release
 Bug fixes
 =========
 
+* 
+* 
 * Don't attempt to call a bool when using mem-self handler assignment. by `@natefoo <https://github.com/natefoo>`_ in `#16359 <https://github.com/galaxyproject/galaxy/pull/16359>`_
 
 -------------------
diff --git a/scripts/check_model.py b/scripts/check_model.py
index d1661df4975e..1675dc76ba8f 100644
--- a/scripts/check_model.py
+++ b/scripts/check_model.py
@@ -47,8 +47,9 @@ def load_indexes(metadata):
 
     # create EMPTY metadata, then load from database
     db_url = get_config(sys.argv)["db_url"]
-    metadata = MetaData(bind=create_engine(db_url))
-    metadata.reflect()
+    metadata = MetaData()
+    engine = create_engine(db_url)
+    metadata.reflect(bind=engine)
     indexes_in_db = load_indexes(metadata)
 
     all_indexes = set(mapping_indexes.keys()) | set(tsi_mapping_indexes.keys())
diff --git a/templates/webapps/galaxy/dataset/copy_view.mako b/templates/webapps/galaxy/dataset/copy_view.mako
index a13c79ccea83..5f041733dec0 100644
--- a/templates/webapps/galaxy/dataset/copy_view.mako
+++ b/templates/webapps/galaxy/dataset/copy_view.mako
@@ -94,7 +94,7 @@
                     %>
                     <div class="form-row">
                         <input type="checkbox" name="source_content_ids" id="${input_id}" value="${input_id}"${checked}/>
-                        <label for="${input_id}" style="display: inline;font-weight:normal;"> ${data.hid}: ${h.to_unicode(data.name) | h}</label>
+                        <label for="${input_id}" style="display: inline;font-weight:normal;"> ${data.hid}: ${util.unicodify(data.name) | h}</label>
                     </div>
                 %endfor
                 %if not has_source_contents:
diff --git a/test/functional/tools/md5sum.xml b/test/functional/tools/md5sum.xml
index 252e051ca48e..577f873e6081 100644
--- a/test/functional/tools/md5sum.xml
+++ b/test/functional/tools/md5sum.xml
@@ -1,6 +1,6 @@
 <tool id="md5sum" name="md5sum" version="1.0.0">
     <command>
-        cp $input $output
+        cp '$input.file_name' '$output'
     </command>
     <inputs>
         <param name="input" type="data" format="txt" />
diff --git a/test/integration/test_celery_tasks.py b/test/integration/test_celery_tasks.py
index 30658dc5b3b9..70e2c583b6e6 100644
--- a/test/integration/test_celery_tasks.py
+++ b/test/integration/test_celery_tasks.py
@@ -12,7 +12,7 @@
 from galaxy.schema import PdfDocumentType
 from galaxy.schema.schema import CreatePagePayload
 from galaxy.schema.tasks import GeneratePdfDownload
-from galaxy.web.short_term_storage import ShortTermStorageAllocator
+from galaxy.short_term_storage import ShortTermStorageAllocator
 from galaxy_test.base.populators import (
     DatasetPopulator,
     wait_on,
diff --git a/test/integration/test_job_files.py b/test/integration/test_job_files.py
index f45cd6a722e1..4ed02b350dd3 100644
--- a/test/integration/test_job_files.py
+++ b/test/integration/test_job_files.py
@@ -22,7 +22,10 @@
 from sqlalchemy import select
 
 from galaxy import model
-from galaxy.model.base import transaction
+from galaxy.model.base import (
+    ensure_object_added_to_session,
+    transaction,
+)
 from galaxy_test.base import api_asserts
 from galaxy_test.base.populators import DatasetPopulator
 from galaxy_test.driver import integration_util
@@ -138,6 +141,7 @@ def create_static_job_with_state(self, state):
             sa_session.commit()
         job = model.Job()
         job.history = history
+        ensure_object_added_to_session(job, object_in_session=history)
         job.user = user
         job.handler = "unknown-handler"
         job.state = state
diff --git a/test/unit/app/managers/test_DatasetManager.py b/test/unit/app/managers/test_DatasetManager.py
index 882e4a97f71c..8847b019f2a4 100644
--- a/test/unit/app/managers/test_DatasetManager.py
+++ b/test/unit/app/managers/test_DatasetManager.py
@@ -9,6 +9,7 @@
     exceptions,
     model,
 )
+from galaxy.app_unittest_utils.galaxy_mock import mock_url_builder
 from galaxy.managers.base import SkipAttribute
 from galaxy.managers.datasets import (
     DatasetManager,
@@ -188,12 +189,7 @@ def test_create_private_dataset(self):
         assert not self.dataset_manager.permissions.access.is_permitted(dataset, None)
 
 
-# web.url_for doesn't work well in the framework
-def testable_url_for(*a, **k):
-    return f"(fake url): {a}, {k}"
-
-
-@mock.patch("galaxy.managers.datasets.DatasetSerializer.url_for", testable_url_for)
+@mock.patch("galaxy.managers.datasets.DatasetSerializer.url_for", mock_url_builder)
 class TestDatasetSerializer(BaseTestCase):
     def set_up_managers(self):
         super().set_up_managers()
diff --git a/test/unit/app/managers/test_HDAManager.py b/test/unit/app/managers/test_HDAManager.py
index 5692d83eec9e..6c7300a44271 100644
--- a/test/unit/app/managers/test_HDAManager.py
+++ b/test/unit/app/managers/test_HDAManager.py
@@ -7,6 +7,7 @@
     exceptions,
     model,
 )
+from galaxy.app_unittest_utils.galaxy_mock import mock_url_builder
 from galaxy.managers import hdas
 from galaxy.managers.datasets import DatasetManager
 from galaxy.managers.histories import HistoryManager
@@ -345,13 +346,7 @@ def test_data_conversion_status(self):
     # def test_text_data( self ):
 
 
-# =============================================================================
-# web.url_for doesn't work well in the framework
-def testable_url_for(*a, **k):
-    return f"(fake url): {a}, {k}"
-
-
-@mock.patch("galaxy.managers.hdas.HDASerializer.url_for", testable_url_for)
+@mock.patch("galaxy.managers.hdas.HDASerializer.url_for", mock_url_builder)
 class TestHDASerializer(HDATestCase):
     def set_up_managers(self):
         super().set_up_managers()
diff --git a/test/unit/app/managers/test_HDCAManager.py b/test/unit/app/managers/test_HDCAManager.py
index 23ea050b2def..313520886e45 100644
--- a/test/unit/app/managers/test_HDCAManager.py
+++ b/test/unit/app/managers/test_HDCAManager.py
@@ -1,5 +1,6 @@
 from unittest import mock
 
+from galaxy.app_unittest_utils.galaxy_mock import mock_url_builder
 from galaxy.managers import (
     collections,
     hdas,
@@ -52,13 +53,7 @@ def _create_list_hdca(self, hdas, history=None, name="test collection", **kwargs
         return hdca
 
 
-# =============================================================================
-# web.url_for doesn't work well in the framework
-def testable_url_for(*a, **k):
-    return f"(fake url): {a}, {k}"
-
-
-@mock.patch("galaxy.managers.hdcas.HDCASerializer.url_for", testable_url_for)
+@mock.patch("galaxy.managers.base.ModelSerializer.url_for", mock_url_builder)
 class TestHDCASerializer(HDCATestCase):
     def set_up_managers(self):
         super().set_up_managers()
diff --git a/test/unit/app/managers/test_HistoryManager.py b/test/unit/app/managers/test_HistoryManager.py
index 6809f564af82..e9e011c3bf97 100644
--- a/test/unit/app/managers/test_HistoryManager.py
+++ b/test/unit/app/managers/test_HistoryManager.py
@@ -13,6 +13,7 @@
     exceptions,
     model,
 )
+from galaxy.app_unittest_utils.galaxy_mock import mock_url_builder
 from galaxy.managers import (
     base,
     hdas,
@@ -391,14 +392,8 @@ def test_rating(self):
         assert manager.ratings_count(item) == 2
 
 
-# =============================================================================
-# web.url_for doesn't work well in the framework
-def testable_url_for(*a, **k):
-    return f"(fake url): {a}, {k}"
-
-
-@mock.patch("galaxy.managers.histories.HistorySerializer.url_for", testable_url_for)
-@mock.patch("galaxy.managers.hdas.HDASerializer.url_for", testable_url_for)
+@mock.patch("galaxy.managers.histories.HistorySerializer.url_for", mock_url_builder)
+@mock.patch("galaxy.managers.hdas.HDASerializer.url_for", mock_url_builder)
 class TestHistorySerializer(BaseTestCase):
     def set_up_managers(self):
         super().set_up_managers()
diff --git a/test/unit/app/managers/test_UserManager.py b/test/unit/app/managers/test_UserManager.py
index b6c24c7ed276..ea606f7743c7 100644
--- a/test/unit/app/managers/test_UserManager.py
+++ b/test/unit/app/managers/test_UserManager.py
@@ -191,10 +191,6 @@ def test_empty_password(self):
         assert not check_password("", user.password)
         assert not check_password(None, user.password)
 
-    def testable_url_for(*a, **k):
-        return f"(url_for): {k}"
-
-    @patch("routes.url_for", testable_url_for)
     def test_activation_email(self):
         self.log("should produce the activation email")
         self.user_manager.create(email="user@nopassword.com", username="nopassword")
@@ -206,7 +202,7 @@ def validate_send_email(frm, to, subject, body, config, html=None):
             assert "custom_activation_email_message" in body
             assert "Hello nopassword" in body
             assert (
-                "{'controller': 'user', 'action': 'activate', 'activation_token': 'activation_token', 'email': Markup('user@nopassword.com'), 'qualified': True}"
+                "{'activation_token': 'activation_token', 'email': Markup('user@nopassword.com'), 'qualified': True}"
                 in body
             )
 
@@ -217,7 +213,6 @@ def validate_send_email(frm, to, subject, body, config, html=None):
                 mock_hash_util.assert_called_once()
         assert result is True
 
-    @patch("routes.url_for", testable_url_for)
     def test_reset_email(self):
         self.log("should produce the password reset email")
         self.user_manager.create(email="user@nopassword.com", username="nopassword")
@@ -227,7 +222,7 @@ def validate_send_email(frm, to, subject, body, config, html=None):
             assert to == "user@nopassword.com"
             assert subject == "Galaxy Password Reset"
             assert "reset your Galaxy password" in body
-            assert "{'controller': 'login', 'action': 'start', 'token': 'reset_token'}" in body
+            assert "{'token': 'reset_token'}" in body
 
         with patch("galaxy.util.send_mail", side_effect=validate_send_email) as mock_send_mail:
             with patch("galaxy.model.unique_id", return_value="reset_token") as mock_unique_id:
diff --git a/test/unit/web_framework/test_short_term_storage.py b/test/unit/app/test_short_term_storage.py
similarity index 99%
rename from test/unit/web_framework/test_short_term_storage.py
rename to test/unit/app/test_short_term_storage.py
index d30234f36ef8..89a32f417592 100644
--- a/test/unit/web_framework/test_short_term_storage.py
+++ b/test/unit/app/test_short_term_storage.py
@@ -7,7 +7,7 @@
     MessageException,
     ObjectNotFound,
 )
-from galaxy.web.short_term_storage import (
+from galaxy.short_term_storage import (
     ShortTermStorageConfiguration,
     ShortTermStorageManager,
     ShortTermStorageServeCancelledInformation,
diff --git a/test/unit/app/tools/test_wrappers.py b/test/unit/app/tools/test_wrappers.py
index 69cca55f204f..a7be2e271d1b 100644
--- a/test/unit/app/tools/test_wrappers.py
+++ b/test/unit/app/tools/test_wrappers.py
@@ -207,7 +207,7 @@ def test_dataset_wrapper():
     dataset = cast(DatasetInstance, MockDataset())
     wrapper = DatasetFilenameWrapper(dataset)
     assert str(wrapper) == MOCK_DATASET_PATH
-    assert wrapper.get_file_name() == MOCK_DATASET_PATH
+    assert wrapper.file_name == MOCK_DATASET_PATH
 
     assert wrapper.ext == MOCK_DATASET_EXT
 
@@ -219,7 +219,7 @@ def test_dataset_wrapper_false_path():
         dataset, compute_environment=cast(ComputeEnvironment, MockComputeEnvironment(false_path=new_path))
     )
     assert str(wrapper) == new_path
-    assert wrapper.get_file_name() == new_path
+    assert wrapper.file_name == new_path
 
 
 class MockComputeEnvironment:
diff --git a/test/unit/data/test_galaxy_mapping.py b/test/unit/data/test_galaxy_mapping.py
index c22d51f45eae..20822dc70222 100644
--- a/test/unit/data/test_galaxy_mapping.py
+++ b/test/unit/data/test_galaxy_mapping.py
@@ -356,6 +356,22 @@ def test_collections_in_library_folders(self):
         # assert len(loaded_dataset_collection.datasets) == 2
         # assert loaded_dataset_collection.collection_type == "pair"
 
+    def test_dataset_action_tuples(self):
+        u = model.User(email="foo", password="foo")
+        h1 = model.History(user=u)
+        hda1 = model.HistoryDatasetAssociation(history=h1, create_dataset=True, sa_session=self.model.session)
+        hda2 = model.HistoryDatasetAssociation(history=h1, create_dataset=True, sa_session=self.model.session)
+        r1 = model.Role()
+        dp1 = model.DatasetPermissions(action="action1", dataset=hda1.dataset, role=r1)
+        dp2 = model.DatasetPermissions(action=None, dataset=hda1.dataset, role=r1)
+        dp3 = model.DatasetPermissions(action="action3", dataset=hda1.dataset, role=r1)
+        c1 = model.DatasetCollection(collection_type="type1")
+        dce1 = model.DatasetCollectionElement(collection=c1, element=hda1)
+        dce2 = model.DatasetCollectionElement(collection=c1, element=hda2)
+        self.model.session.add_all([u, h1, hda1, hda2, r1, dp1, dp2, dp3, c1, dce1, dce2])
+        self.model.session.flush()
+        assert c1.dataset_action_tuples == [("action1", r1.id), ("action3", r1.id)]
+
     def test_nested_collection_attributes(self):
         u = model.User(email="mary2@example.com", password="password")
         h1 = model.History(name="History 1", user=u)
@@ -392,18 +408,31 @@ def test_nested_collection_attributes(self):
         )
         self.model.session.add_all([d1, d2, c1, dce1, dce2, c2, dce3, c3, c4, dce4])
         self.model.session.flush()
-        q = c2._get_nested_collection_attributes(
+
+        stmt = c2._build_nested_collection_attributes_stmt(
             element_attributes=("element_identifier",), hda_attributes=("extension",), dataset_attributes=("state",)
         )
-        assert [(r._fields) for r in q] == [
+        result = self.model.session.execute(stmt).all()
+        assert [(r._fields) for r in result] == [
             ("element_identifier_0", "element_identifier_1", "extension", "state"),
             ("element_identifier_0", "element_identifier_1", "extension", "state"),
         ]
-        assert q.all() == [("inner_list", "forward", "bam", "new"), ("inner_list", "reverse", "txt", "new")]
-        q = c2._get_nested_collection_attributes(return_entities=(model.HistoryDatasetAssociation,))
-        assert q.all() == [d1, d2]
-        q = c2._get_nested_collection_attributes(return_entities=(model.HistoryDatasetAssociation, model.Dataset))
-        assert q.all() == [(d1, d1.dataset), (d2, d2.dataset)]
+
+        stmt = c2._build_nested_collection_attributes_stmt(
+            element_attributes=("element_identifier",), hda_attributes=("extension",), dataset_attributes=("state",)
+        )
+        result = self.model.session.execute(stmt).all()
+        assert result == [("inner_list", "forward", "bam", "new"), ("inner_list", "reverse", "txt", "new")]
+
+        stmt = c2._build_nested_collection_attributes_stmt(return_entities=(model.HistoryDatasetAssociation,))
+        result = self.model.session.execute(stmt).all()
+        assert result == [(d1,), (d2,)]
+
+        stmt = c2._build_nested_collection_attributes_stmt(
+            return_entities=(model.HistoryDatasetAssociation, model.Dataset)
+        )
+        result = self.model.session.execute(stmt).all()
+        assert result == [(d1, d1.dataset), (d2, d2.dataset)]
         # Assert properties that use _get_nested_collection_attributes return correct content
         assert c2.dataset_instances == [d1, d2]
         assert c2.dataset_elements == [dce1, dce2]
@@ -422,13 +451,14 @@ def test_nested_collection_attributes(self):
         assert c3.dataset_instances == []
         assert c3.dataset_elements == []
         assert c3.dataset_states_and_extensions_summary == (set(), set())
-        q = c4._get_nested_collection_attributes(element_attributes=("element_identifier",))
-        assert q.all() == [("outer_list", "inner_list", "forward"), ("outer_list", "inner_list", "reverse")]
-        assert c4.dataset_elements == [dce1, dce2]
-        assert c4.element_identifiers_extensions_and_paths == [
-            (("outer_list", "inner_list", "forward"), "bam", "mock_dataset_14.dat"),
-            (("outer_list", "inner_list", "reverse"), "txt", "mock_dataset_14.dat"),
+
+        stmt = c4._build_nested_collection_attributes_stmt(element_attributes=("element_identifier",))
+        result = self.model.session.execute(stmt).all()
+        assert result == [
+            ("outer_list", "inner_list", "forward"),
+            ("outer_list", "inner_list", "reverse"),
         ]
+        assert c4.dataset_elements == [dce1, dce2]
 
     def test_dataset_dbkeys_and_extensions_summary(self):
         u = model.User(email="mary2@example.com", password="password")
diff --git a/test/unit/tool_util/test_test_parsing.py b/test/unit/tool_util/test_test_parsing.py
new file mode 100644
index 000000000000..c489d9658cae
--- /dev/null
+++ b/test/unit/tool_util/test_test_parsing.py
@@ -0,0 +1,40 @@
+import yaml
+
+from galaxy.tool_util.parser.yaml import to_test_assert_list
+
+# Legacy style
+ASSERT_THAT_LIST = yaml.safe_load(
+    """
+- that: "has_text"
+  text: "Number of input reads |\t1051466"
+- that: "has_text"
+  text: "Uniquely mapped reads number |\t871202"
+"""
+)
+# New list of assertion style
+ASSERT_LIST = yaml.safe_load(
+    """
+- has_text:
+    text: "Number of input reads |\t1051466"
+- has_text:
+    text: "Uniquely mapped reads number |\t871202"
+"""
+)
+# Singleton assertion
+SIMPLE_ASSERT = {"has_text": {"text": "Number of input reads |\t1051466"}}
+
+
+def test_assert_that_list_to_test_assert_list():
+    to_test_assert_list(ASSERT_THAT_LIST)
+
+
+def test_assert_list_to_test_assert_list():
+    to_test_assert_list(ASSERT_LIST)
+
+
+def test_simple_assert_to_test_assert_list():
+    to_test_assert_list(SIMPLE_ASSERT)
+
+
+def test_assert_legacy_same_as_new_list_style():
+    assert to_test_assert_list(ASSERT_THAT_LIST) == to_test_assert_list(ASSERT_THAT_LIST)
diff --git a/test/unit/webapps/api/test_fetch_schema.py b/test/unit/webapps/api/test_fetch_schema.py
index 0a78c56bec8b..45c600a8d0d9 100644
--- a/test/unit/webapps/api/test_fetch_schema.py
+++ b/test/unit/webapps/api/test_fetch_schema.py
@@ -1,6 +1,8 @@
 from copy import deepcopy
 from json import dumps
 
+import yaml
+
 from galaxy.schema.fetch_data import (
     FetchDataPayload,
     FileDataElement,
@@ -121,6 +123,33 @@
     "auto_decompress": True,
 }
 
+library_payload = yaml.safe_load(
+    """
+destination:
+  type: library
+  name: "Cool Training Library"
+  description: "A longer description."
+  synopsis: "Optional - does anyone ever set this?"
+items:
+  - name: "Test Folder 1"
+    description: "Description of what is in Test Folder 1"  # Only populated with new API.
+    items:
+      - url: https://raw.githubusercontent.com/eteriSokhoyan/test-data/master/cliques-high-representatives.fa
+        src: url
+        ext: fasta
+        info: "A cool longer description."  # Only populated with new API.
+        dbkey: "hg19"  # Only populated with new API.
+  - name: "Test data segmentation-fold"
+    items:
+      - url: https://raw.githubusercontent.com/yhoogstrate/segmentation-fold/55d0bb28b01e613844ca35cf21fa41379fd72770/scripts/energy-estimation-utility/tests/test-data/workflow-test_cd-box_kturns.xml
+        name: workflow-test_cd-box_kturns.xml  # Only populated with new API.
+        info: Downloaded from https://raw.githubusercontent.com/yhoogstrate/segmentation-fold/55d0bb28b01e613844ca35cf21fa41379fd72770/scripts/energy-estimation-utility/tests/test-data/workflow-test_cd-box_kturns.xml
+        src: url
+        ext: xml
+
+"""
+)
+
 
 def test_fetch_data_schema():
     payload = FetchDataPayload(**example_payload)
@@ -156,5 +185,9 @@ def test_recursive_archive_form_like_data():
     FetchDataPayload(**payload)
 
 
-def test_nested_elemet_regression():
+def test_nested_element_regression():
     FetchDataPayload(**nested_element_regression_payload)
+
+
+def test_library_payload():
+    FetchDataPayload(targets=[library_payload], history_id=HISTORY_ID)
diff --git a/test/unit/webapps/test_service_base.py b/test/unit/webapps/test_service_base.py
index 37b8fff6467a..993b841c133e 100644
--- a/test/unit/webapps/test_service_base.py
+++ b/test/unit/webapps/test_service_base.py
@@ -3,7 +3,7 @@
 import pytest
 
 from galaxy.schema.schema import ModelStoreFormat
-from galaxy.web.short_term_storage import ShortTermStorageAllocator
+from galaxy.short_term_storage import ShortTermStorageAllocator
 from galaxy.webapps.galaxy.services.base import model_store_storage_target
 
 
diff --git a/tools/data_source/upload.xml b/tools/data_source/upload.xml
index de3c80404e0c..548b63163334 100644
--- a/tools/data_source/upload.xml
+++ b/tools/data_source/upload.xml
@@ -14,7 +14,7 @@
     #while $varExists('output%i' % $outnum):
         #set $output = $getVar('output%i' % $outnum)
         #set $outnum += 1
-        #set $file_name = $output.get_file_name()
+        #set $file_name = str($output)
         ## FIXME: This is not future-proof for other uses of external_filename (other than for use by the library upload's "link data" feature)
         #if $output.dataset.dataset.external_filename:
             #set $file_name = "None"