From 7bfada343146b84363bc17ce8bd3200ce9dd99ce Mon Sep 17 00:00:00 2001
From: Andrew Scott <ascott18@gmail.com>
Date: Thu, 5 Sep 2024 15:52:25 -0700
Subject: [PATCH] wip

---
 .../.vscode/settings.json                     |   3 +-
 .../content/.template.config/template.json    |  77 ++--
 .../Coalesce.Starter.Vue.Data/AppDbContext.cs |  25 +-
 .../Auth/AppClaimTypes.cs                     |   3 +
 .../Auth/ClaimsPrincipalExtensions.cs         |   9 +
 .../Auth/ClaimsPrincipalFactory.cs            |  16 +-
 .../Auth/SecurityService.cs                   |   5 +-
 .../Auth/UserInfo.cs                          |   1 +
 .../DatabaseSeeder.cs                         |  31 ++
 .../Coalesce.Starter.Vue.Data/Models/Role.cs  |  45 +-
 .../Models/RoleClaim.cs                       |  11 -
 .../Coalesce.Starter.Vue.Data/Models/User.cs  | 116 ++++-
 .../Models/Widget.cs                          |   3 +
 .../Api/Generated/RoleController.g.cs         |  17 +
 ...mController.g.cs => WidgetController.g.cs} |  41 +-
 .../AppInsightsTelemetryEnricher.cs           |   4 +-
 .../Controllers/HomeController.cs             |  42 +-
 .../Models/Generated/RoleClaimDto.g.cs        |  94 ----
 .../Models/Generated/RoleDto.g.cs             |  22 +-
 .../Models/Generated/UserDto.g.cs             |  27 +-
 .../Models/Generated/UserInfoDto.g.cs         |   4 +-
 .../Models/Generated/WidgetDto.g.cs           | 116 +++++
 .../Coalesce.Starter.Vue.Web/Program.cs       | 126 +++---
 .../{Program.Auth.cs => ProgramAuth.cs}       | 180 +++++---
 .../Coalesce.Starter.Vue.Web/appsettings.json |  23 +-
 .../Coalesce.Starter.Vue.Web/package.json     |   1 +
 .../src/api-clients.g.ts                      |  10 +-
 .../src/components/HelloWorld.vue             | 421 +++++++++---------
 .../src/components/display/UserAvatar.vue     |  11 +-
 .../src/composables/useTitle.ts               |   4 +
 .../Coalesce.Starter.Vue.Web/src/main.ts      |  18 +-
 .../src/metadata.g.ts                         | 242 ++++++----
 .../Coalesce.Starter.Vue.Web/src/models.g.ts  |  81 ++--
 .../Coalesce.Starter.Vue.Web/src/router.ts    |  39 +-
 .../src/user-service.ts                       |   6 +
 .../src/viewmodels.g.ts                       |  74 +--
 .../src/views/Admin.vue                       |  96 +++-
 .../src/views/WidgetEdit.vue                  |   2 +-
 .../src/views/errors/Forbidden.vue            |  91 ++--
 .../src/views/errors/NotFound.vue             |   9 +-
 .../content/Directory.Build.props             |   4 +-
 41 files changed, 1279 insertions(+), 871 deletions(-)
 create mode 100644 templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/DatabaseSeeder.cs
 delete mode 100644 templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/RoleClaim.cs
 rename templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/{RoleClaimController.g.cs => WidgetController.g.cs} (50%)
 delete mode 100644 templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleClaimDto.g.cs
 create mode 100644 templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/WidgetDto.g.cs
 rename templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/{Program.Auth.cs => ProgramAuth.cs} (55%)

diff --git a/templates/Coalesce.Vue.Template/.vscode/settings.json b/templates/Coalesce.Vue.Template/.vscode/settings.json
index 8c5a1a9f5..5440fd3b7 100644
--- a/templates/Coalesce.Vue.Template/.vscode/settings.json
+++ b/templates/Coalesce.Vue.Template/.vscode/settings.json
@@ -1,3 +1,4 @@
 {
-    "dotnet.defaultSolution": "content\\Coalesce.Starter.Vue.sln"
+    "dotnet.defaultSolution": "content\\Coalesce.Starter.Vue.sln",
+    "editor.formatOnSave": true,
 }
\ No newline at end of file
diff --git a/templates/Coalesce.Vue.Template/content/.template.config/template.json b/templates/Coalesce.Vue.Template/content/.template.config/template.json
index e4bf22c13..d7e424735 100644
--- a/templates/Coalesce.Vue.Template/content/.template.config/template.json
+++ b/templates/Coalesce.Vue.Template/content/.template.config/template.json
@@ -1,15 +1,15 @@
 {
   "$schema": "http://json.schemastore.org/template",
   "author": "IntelliTect",
-  "classifications": [ "Web", "MVC", "Vue" ],
+  "classifications": ["Web", "MVC", "Vue"],
   "identity": "IntelliTect.Coalesce.Vue.Template",
   "name": "IntelliTect Coalesce Web App Vue Template",
   "shortName": "coalescevue",
   "tags": {
-    "language": "C#",            
-    "type":"project"
+    "language": "C#",
+    "type": "project"
   },
-  "sourceName": "Coalesce.Starter.Vue",              
+  "sourceName": "Coalesce.Starter.Vue",
   "preferNameDirectory": true,
   "symbols": {
     "KestrelPortGenerated": {
@@ -28,7 +28,7 @@
       },
       "replaces": "5002"
     },
-    
+
     "Identity": {
       "type": "parameter",
       "datatype": "bool"
@@ -81,8 +81,9 @@
         {
           "condition": "!Identity",
           "exclude": [
-            "**/Program.Auth.cs",
+            "**/ProgramAuth.cs",
             "**/Forbidden.vue",
+            "**/UserAvatar.vue",
             "**/SignIn.cshtml",
             "**/SignIn.cshtml.cs",
             "**/AppClaimTypes.cs",
@@ -91,53 +92,36 @@
             "**/Permission.cs",
             "**/User.cs",
             "**/UserRole.cs",
-            "**/Role.cs",
-            "**/RoleClaim.cs"
+            "**/Role.cs"
           ]
         },
         {
           "condition": "!(UserPictures && Identity)",
-          "exclude": [
-            "Coalesce.Starter.Vue.Data/Models/UserPhoto.cs"
-          ]
+          "exclude": ["Coalesce.Starter.Vue.Data/Models/UserPhoto.cs"]
         },
         {
           "condition": "!AuditLogs",
-          "exclude": [
-            "**/AuditOperationContext.cs",
-            "**/AuditLog.cs"
-          ]
+          "exclude": ["**/AuditOperationContext.cs", "**/AuditLog.cs"]
         },
         {
           "condition": "!TrackingBase",
-          "exclude": [
-            "**/TrackingBase.cs"
-          ]
+          "exclude": ["**/TrackingBase.cs"]
         },
         {
           "condition": "!AppInsights",
-          "exclude": [
-            "**/AppInsightsTelemetryEnricher.cs"
-          ]
+          "exclude": ["**/AppInsightsTelemetryEnricher.cs"]
         },
         {
           "condition": "!GoogleAuth",
-          "exclude": [
-            "**/google-logo.svg"
-          ]
+          "exclude": ["**/google-logo.svg"]
         },
         {
           "condition": "!MicrosoftAuth",
-          "exclude": [
-            "**/microsoft-logo.svg"
-          ]
+          "exclude": ["**/microsoft-logo.svg"]
         },
         {
           "condition": "!ExampleModel",
-          "exclude": [
-            "**/WidgetEdit.vue",
-            "**/WidgetEdit.spec.ts"
-          ]
+          "exclude": ["**/WidgetEdit.vue", "**/WidgetEdit.spec.ts"]
         }
       ]
     }
@@ -148,14 +132,14 @@
         {
           "type": "conditional",
           "configuration": {
-            "if": [ "//#if" ],
-            "else": [ "//#else" ],
-            "elseif": [ "//#elseif" ],
-            "endif": [ "//#endif" ],
-            "actionableIf": [ "////#if" ],
-            "actionableElse": [ "////#else" ],
-            "actionableElseif": [ "////#elseif" ],
-            "actions": [ "cStyleUncomment", "cStyleReduceComment" ],
+            "if": ["//#if"],
+            "else": ["//#else"],
+            "elseif": ["//#elseif"],
+            "endif": ["//#endif"],
+            "actionableIf": ["////#if"],
+            "actionableElse": ["////#else"],
+            "actionableElseif": ["////#elseif"],
+            "actions": ["cStyleUncomment", "cStyleReduceComment"],
             "trim": true,
             "wholeLine": true,
             "evaluator": "C++"
@@ -164,10 +148,15 @@
         {
           "type": "conditional",
           "configuration": {
-            "endif": [ "#endif", "<!--#endif" ],
-            "actionableIf": [ "<!--#if" ],
-            "actionableElse": [ "#else", "<!--#else" ],
-            "actionableElseif": [ "#elseif", "<!--#elseif", "#elif", "<!--#elif" ],
+            "endif": ["#endif", "<!--#endif"],
+            "actionableIf": ["<!--#if"],
+            "actionableElse": ["#else", "<!--#else"],
+            "actionableElseif": [
+              "#elseif",
+              "<!--#elseif",
+              "#elif",
+              "<!--#elif"
+            ],
             "trim": true,
             "wholeLine": true,
             "evaluator": "C++"
@@ -192,4 +181,4 @@
       ]
     }
   }
-}
\ No newline at end of file
+}
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/AppDbContext.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/AppDbContext.cs
index 99b13eed4..524aba3a0 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/AppDbContext.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/AppDbContext.cs
@@ -1,11 +1,12 @@
-using Microsoft.EntityFrameworkCore;
+using Coalesce.Starter.Vue.Data.Coalesce;
 using Coalesce.Starter.Vue.Data.Models;
-using System.Security.Cryptography;
-using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
-using Microsoft.AspNetCore.Identity;
-using Microsoft.AspNetCore.DataProtection.EntityFrameworkCore;
+#if AuditLogs
 using IntelliTect.Coalesce.AuditLogging;
-using Coalesce.Starter.Vue.Data.Coalesce;
+#endif
+using Microsoft.AspNetCore.DataProtection.EntityFrameworkCore;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
+using System.Security.Cryptography;
 
 namespace Coalesce.Starter.Vue.Data;
 
@@ -19,7 +20,7 @@ public class AppDbContext
 		IdentityUserClaim<string>,
 		UserRole,
 		IdentityUserLogin<string>,
-		RoleClaim,
+		IdentityRoleClaim<string>,
 		IdentityUserToken<string>
 	>
 #else
@@ -104,16 +105,6 @@ protected override void OnModelCreating(ModelBuilder builder)
                 .IsRequired()
                 .OnDelete(DeleteBehavior.Cascade);
         });
-
-        builder.Entity<RoleClaim>(e =>
-        {
-            e.HasOne(ur => ur.Role)
-                .WithMany(x => x.RoleClaims)
-                .HasForeignKey(x => x.RoleId)
-                .HasPrincipalKey(x => x.Id)
-                .IsRequired()
-                .OnDelete(DeleteBehavior.Cascade);
-        });
 #endif
     }
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/AppClaimTypes.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/AppClaimTypes.cs
index cd85b4ed3..ddf38a881 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/AppClaimTypes.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/AppClaimTypes.cs
@@ -4,5 +4,8 @@ public static class AppClaimTypes
 {
     public const string Role = "role";
     public const string Permission = "perm";
+    public const string UserId = ClaimTypes.NameIdentifier;
+    public const string UserName = ClaimTypes.Name;
+    public const string Email = ClaimTypes.Email;
     public const string FullName = nameof(FullName);
 }
\ No newline at end of file
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalExtensions.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalExtensions.cs
index e9126b07a..20cd73d23 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalExtensions.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalExtensions.cs
@@ -2,6 +2,15 @@
 
 public static class ClaimsPrincipalExtensions
 {
+    public static string? GetUserId(this ClaimsPrincipal user)
+        => user.FindFirstValue(AppClaimTypes.UserId);
+
+    public static string? GetUserName(this ClaimsPrincipal user)
+        => user.FindFirstValue(AppClaimTypes.UserName);
+
+    public static string? GetEmail(this ClaimsPrincipal user)
+        => user.FindFirstValue(AppClaimTypes.Email);
+
     public static bool Can(this ClaimsPrincipal user, params Permission[] permissions)
         => permissions.Any(p => user.HasClaim(AppClaimTypes.Permission, p.ToString()));
 }
\ No newline at end of file
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalFactory.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalFactory.cs
index 5a32fa6c0..e20568723 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalFactory.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/ClaimsPrincipalFactory.cs
@@ -5,8 +5,9 @@
 namespace Coalesce.Starter.Vue.Data.Auth;
 
 public class ClaimsPrincipalFactory(
-    UserManager<User> userManager, 
-    RoleManager<Role> roleManager, 
+    AppDbContext db,
+    UserManager<User> userManager,
+    RoleManager<Role> roleManager,
     IOptions<IdentityOptions> options
 ) : UserClaimsPrincipalFactory<User, Role>(userManager, roleManager, options)
 {
@@ -17,11 +18,16 @@ public override async Task<ClaimsPrincipal> CreateAsync(User user)
         // Attach additional custom claims
         identity.AddClaim(new Claim(AppClaimTypes.FullName, user.FullName ?? ""));
 
-        // Take all the permission claims and move them to a dedicated identity
+        // Store all the permissions in a dedicated identity
         // whose RoleClaimType is Permission so that they can still be treated like roles
         // (and so they work with IsInRole and coalesce attribute-based security).
-        var permissions = identity.Claims.Where(c => c.Type == AppClaimTypes.Permission).ToList();
-        permissions.ForEach(identity.RemoveClaim);
+        var permissions = (await db.Entry(user)
+            .Collection(u => u.UserRoles!)
+            .Query()
+            .Select(r => r.Role!)
+            .ToListAsync())
+            .SelectMany(role => role.Permissions!)
+            .Select(p => new Claim(AppClaimTypes.Permission, p.ToString()));
 
         var permissionIdentity = new ClaimsIdentity(
             permissions, 
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/SecurityService.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/SecurityService.cs
index 8340215ad..34a1345df 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/SecurityService.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/SecurityService.cs
@@ -1,4 +1,4 @@
-using IntelliTect.Coalesce.Utilities;
+using Coalesce.Starter.Vue.Data.Utilities;
 
 namespace Coalesce.Starter.Vue.Data.Auth;
 
@@ -11,9 +11,10 @@ public UserInfo WhoAmI(ClaimsPrincipal user)
         return new UserInfo
         {
             Id = user.GetUserId(),
-            UserName = user.Identity?.Name,
+            UserName = user.GetUserName(),
 
 #if Identity
+            Email = user.GetEmail(),
             FullName = user.FindFirstValue(AppClaimTypes.FullName),
 
             Roles = user.Claims
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/UserInfo.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/UserInfo.cs
index 2be351d2d..769ef22f3 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/UserInfo.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Auth/UserInfo.cs
@@ -7,6 +7,7 @@ public class UserInfo
     public string? UserName { get; set; }
 
 #if Identity
+    public string? Email { get; set; }
     public string? FullName { get; set; }
 
     public required ICollection<string> Roles { get; set; }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/DatabaseSeeder.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/DatabaseSeeder.cs
new file mode 100644
index 000000000..e6bb911e9
--- /dev/null
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/DatabaseSeeder.cs
@@ -0,0 +1,31 @@
+namespace Coalesce.Starter.Vue.Data;
+
+public class DatabaseSeeder(AppDbContext db)
+{
+    public void Seed()
+    {
+#if Identity
+        SeedRoles();
+#endif
+    }
+
+#if Identity
+    private void SeedRoles()
+    {
+        if (!db.Roles.Any())
+        {
+            db.Roles.Add(new()
+            {
+                Permissions = Enum.GetValues<Permission>().ToList(),
+                Name = "Admin",
+                NormalizedName = "ADMIN",
+            });
+
+            // NOTE: In a permissions-based authorization system,
+            // roles can freely be created by administrators in the admin pages.
+
+            db.SaveChanges();
+        }
+    }
+#endif
+}
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Role.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Role.cs
index 4ac4f95a4..c07e609fe 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Role.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Role.cs
@@ -1,44 +1,33 @@
 using Coalesce.Starter.Vue.Data.Coalesce;
 using Microsoft.AspNetCore.Identity;
+using System.ComponentModel;
 
 namespace Coalesce.Starter.Vue.Data.Models;
 
 [Create(nameof(Permission.UserAdmin))]
 [Edit(nameof(Permission.UserAdmin))]
 [Delete(nameof(Permission.UserAdmin))]
+[Description("Roles are groups of permissions, analagous to job titles or functions.")]
 public class Role : IdentityRole
 {
-    [Required, Search(SearchMethod = SearchMethods.Contains)]
-    public override string? Name { get; set; }
+	[Required, Search(SearchMethod = SearchMethods.Contains)]
+	public override string? Name { get; set; }
 
-    [InternalUse]
-    public override string? ConcurrencyStamp { get; set; } = Guid.NewGuid().ToString();
+	[InternalUse]
+	public override string? ConcurrencyStamp { get; set; } = Guid.NewGuid().ToString();
 
-    [InternalUse]
-    public override string? NormalizedName { get; set; }
+	[InternalUse]
+	public override string? NormalizedName { get; set; }
 
-    [Hidden(HiddenAttribute.Areas.List)]
-    [InverseProperty(nameof(RoleClaim.Role))]
-    public ICollection<RoleClaim>? RoleClaims { get; set; }
+	public List<Permission>? Permissions { get; set; }
 
-    // TODO: Permission editing
-    [NotMapped, Hidden]
-    public Permission[] Permissions => 
-        RoleClaims is null 
-            ? Array.Empty<Permission>() 
-        : RoleClaims
-            .Where(c => c.ClaimType == AppClaimTypes.Permission && Enum.TryParse<Permission>(c.ClaimValue, out _))
-            .Select(r => Enum.Parse<Permission>(r.ClaimValue))
-            .ToArray();
+	public class Behaviors(RoleManager<Role> roleManager, CrudContext<AppDbContext> context) : AppBehaviors<Role>(context)
+	{
+		public override ItemResult BeforeSave(SaveKind kind, Role? oldItem, Role item)
+		{
+			item.NormalizedName = roleManager.NormalizeKey(item.Name);
 
-
-    public class Behaviors(RoleManager<Role> roleManager, CrudContext<AppDbContext> context) : AppBehaviors<Role>(context)
-    {
-        public override ItemResult BeforeSave(SaveKind kind, Role? oldItem, Role item)
-        {
-            item.NormalizedName = roleManager.NormalizeKey(item.Name);
-
-            return base.BeforeSave(kind, oldItem, item);
-        }
-    }
+			return base.BeforeSave(kind, oldItem, item);
+		}
+	}
 }
\ No newline at end of file
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/RoleClaim.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/RoleClaim.cs
deleted file mode 100644
index 073cd71ba..000000000
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/RoleClaim.cs
+++ /dev/null
@@ -1,11 +0,0 @@
-using Coalesce.Starter.Vue.Data.Models;
-using Microsoft.AspNetCore.Identity;
-
-[Edit(DenyAll)]
-[Create(DenyAll)]
-[Delete(DenyAll)]
-public class RoleClaim : IdentityRoleClaim<string>
-{
-    [ForeignKey(nameof(RoleId))]
-    public Role? Role { get; set; }
-}
\ No newline at end of file
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/User.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/User.cs
index 79821299f..837131df0 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/User.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/User.cs
@@ -1,10 +1,15 @@
+using Coalesce.Starter.Vue.Data.Coalesce;
+using IntelliTect.Coalesce.Helpers;
+using IntelliTect.Coalesce.Utilities;
 using Microsoft.AspNetCore.Identity;
+using System.ComponentModel;
 
 namespace Coalesce.Starter.Vue.Data.Models;
 
 [Edit(nameof(Permission.UserAdmin))]
 [Create(DenyAll)]
 [Delete(DenyAll)]
+[Description("A user profile within the application.")]
 public class User : IdentityUser
 {
     [Search(SearchMethod = SearchMethods.Contains)]
@@ -38,8 +43,8 @@ public class User : IdentityUser
     [InternalUse]
     public override bool PhoneNumberConfirmed { get; set; }
 
-    [InternalUse]
-	public override string? Email { get; set; }
+    [Read(nameof(Permission.UserAdmin)), Edit(nameof(Permission.UserAdmin))]
+    public override string? Email { get; set; }
     [InternalUse]
     public override string? NormalizedEmail { get; set; }
     [InternalUse]
@@ -48,30 +53,117 @@ public class User : IdentityUser
 	[InternalUse]
 	public override bool TwoFactorEnabled { get; set; }
 
-	[Read("UserAdmin")]
-	public override int AccessFailedCount { get; set; }
+#if PasswordAuth
+    [Read(nameof(Permission.UserAdmin))]
+    [Description("The number of failed login attempts for the user. Reset after a successful password sign-in.")]
+#else
+    [InternalUse]
+#endif
+    public override int AccessFailedCount { get; set; }
 
-	[Read("UserAdmin")]
-	public override DateTimeOffset? LockoutEnd { get; set; }
+    [Description("If set, the user will be blocked from signing in until this date.")]
+    [Read(nameof(Permission.UserAdmin)), Edit(nameof(Permission.UserAdmin))]
+    public override DateTimeOffset? LockoutEnd { get; set; }
 
-	[Read("UserAdmin")]
-	public override bool LockoutEnabled { get; set; }
+#if PasswordAuth
+    [Description("If enabled, the user will be locked out after multiple failed sign-in attempts.")]
+#else
+    [Description("If enabled, the user can be locked out.")]
+#endif
+    [Read(nameof(Permission.UserAdmin)), Edit(nameof(Permission.UserAdmin))]
+    public override bool LockoutEnabled { get; set; }
 
-    [Read("UserAdmin")]
+    [Read(nameof(Permission.UserAdmin))]
     [InverseProperty(nameof(UserRole.User))]
     [ManyToMany("Roles")]
     public ICollection<UserRole>? UserRoles { get; set; }
 
+    [Read(nameof(Permission.UserAdmin))]
+    [NotMapped, DataType(DataType.MultilineText)]
+    [Hidden(HiddenAttribute.Areas.List)]
+    [Display(Description = "A summary of the effective permissions of the user, derived from their current roles.")]
+    public string? EffectivePermissions
+    {
+        get
+        {
+            var currentPermissions = UserRoles
+                ?.SelectMany(u => u.Role?.Permissions!.Select(p => (p, u.Role)) ?? [])
+                .ToLookup(p => p.p, p => p.Role);
+
+            if (currentPermissions is null) return null;
+
+            return string.Join("\n", Enum.GetValues<Permission>().Select(p => currentPermissions.Contains(p)
+                ? $"✅ {p.GetDisplayName()} (via {string.Join(", ", currentPermissions[p].Select(r => r.Name))})"
+                : $"❌ {p.GetDisplayName()}"
+            ));
+        }
+    }
+
 #if UserPictures
     [Coalesce, Execute(HttpMethod = HttpMethod.Get, VaryByProperty = nameof(PhotoMD5))]
     public ItemResult<IFile> GetPhoto(AppDbContext db)
     {
         return new IntelliTect.Coalesce.Models.File(db.UserPhotos
             .Where(p => p.UserId == this.Id)
-            .Select(p => p.Content));
+            .Select(p => p.Content))
+        {
+            ContentType = "image/*"
+        };
     }
 #endif
 
-    // TODO: Make first user an admin.
-    // TODO: Seed an admin role with the admin permissions
+    public class UserBehaviors(
+        CrudContext<AppDbContext> context, 
+        UserManager<User> userManager,
+        SignInManager<User> signInManager
+    ) : AppBehaviors<User>(context)
+    {
+        public override ItemResult BeforeSave(SaveKind kind, User? oldItem, User item)
+        {
+            if (oldItem != null)
+            {
+                if (item.Email != oldItem.Email)
+                {
+                    item.NormalizedEmail = userManager.NormalizeEmail(item.Email);
+                    item.SecurityStamp = Guid.NewGuid().ToString();
+                }
+
+                if (item.UserName != oldItem.UserName)
+                {
+                    item.NormalizedUserName = userManager.NormalizeEmail(item.UserName);
+                    item.SecurityStamp = Guid.NewGuid().ToString();
+                }
+
+                if (item.LockoutEnd != oldItem.LockoutEnd)
+                {
+                    // Auto-enable lockout when setting a lockout date.
+                    if (item.LockoutEnd != null) item.LockoutEnabled = true;
+
+                    // Invalidate existing sessions when manually locking a user's account.
+                    item.SecurityStamp = Guid.NewGuid().ToString();
+                }
+
+                if (!item.LockoutEnabled)
+                {
+                    // Make it clear to the administrator that lockout is only respected when LockoutEnabled.
+                    item.LockoutEnd = null;
+                }
+            }
+
+            return base.BeforeSave(kind, oldItem, item);
+        }
+
+        public override async Task<ItemResult<User>> AfterSaveAsync(SaveKind kind, User? oldItem, User item)
+        {
+            if (User.GetUserId() == item.Id)
+            {
+                // If the user was editing their own profile,
+                // refresh their current sign-in so they aren't kicked out if
+                // the change required a refresh to the user's security stamp.
+                await signInManager.RefreshSignInAsync(item);
+            }
+
+            return await base.AfterSaveAsync(kind, oldItem, item);
+        }
+    }
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Widget.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Widget.cs
index 77f6cb27a..ab5e0fe52 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Widget.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Data/Models/Widget.cs
@@ -1,5 +1,8 @@
+using System.ComponentModel;
+
 namespace Coalesce.Starter.Vue.Data.Models;
 
+[Description("A sample model provided by the Coalesce template. Remove this when you start building your real data model.")]
 public class Widget
 #if TrackingBase
     : TrackingBase
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleController.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleController.g.cs
index ee42f5bd4..447bc0bbc 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleController.g.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleController.g.cs
@@ -54,6 +54,15 @@ public virtual Task<ItemResult<int>> Count(
             IDataSource<Coalesce.Starter.Vue.Data.Models.Role> dataSource)
             => CountImplementation(parameters, dataSource);
 
+        [HttpPost("save")]
+        [Authorize(Roles = "UserAdmin")]
+        public virtual Task<ItemResult<RoleResponse>> Save(
+            [FromForm] RoleParameter dto,
+            [FromQuery] DataSourceParameters parameters,
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Role> dataSource,
+            IBehaviors<Coalesce.Starter.Vue.Data.Models.Role> behaviors)
+            => SaveImplementation(dto, parameters, dataSource, behaviors);
+
         [HttpPost("bulkSave")]
         [Authorize]
         public virtual Task<ItemResult<RoleResponse>> BulkSave(
@@ -63,5 +72,13 @@ public virtual Task<ItemResult<RoleResponse>> BulkSave(
             [FromServices] IDataSourceFactory dataSourceFactory,
             [FromServices] IBehaviorsFactory behaviorsFactory)
             => BulkSaveImplementation(dto, parameters, dataSource, dataSourceFactory, behaviorsFactory);
+
+        [HttpPost("delete/{id}")]
+        [Authorize(Roles = "UserAdmin")]
+        public virtual Task<ItemResult<RoleResponse>> Delete(
+            string id,
+            IBehaviors<Coalesce.Starter.Vue.Data.Models.Role> behaviors,
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Role> dataSource)
+            => DeleteImplementation(id, new DataSourceParameters(), dataSource, behaviors);
     }
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleClaimController.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/WidgetController.g.cs
similarity index 50%
rename from templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleClaimController.g.cs
rename to templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/WidgetController.g.cs
index 6448ca5e7..64645dfc1 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/RoleClaimController.g.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Api/Generated/WidgetController.g.cs
@@ -21,47 +21,64 @@
 
 namespace Coalesce.Starter.Vue.Web.Api
 {
-    [Route("api/RoleClaim")]
+    [Route("api/Widget")]
     [Authorize]
     [ServiceFilter(typeof(IApiActionFilter))]
-    public partial class RoleClaimController
-        : BaseApiController<RoleClaim, RoleClaimParameter, RoleClaimResponse, Coalesce.Starter.Vue.Data.AppDbContext>
+    public partial class WidgetController
+        : BaseApiController<Coalesce.Starter.Vue.Data.Models.Widget, WidgetParameter, WidgetResponse, Coalesce.Starter.Vue.Data.AppDbContext>
     {
-        public RoleClaimController(CrudContext<Coalesce.Starter.Vue.Data.AppDbContext> context) : base(context)
+        public WidgetController(CrudContext<Coalesce.Starter.Vue.Data.AppDbContext> context) : base(context)
         {
-            GeneratedForClassViewModel = context.ReflectionRepository.GetClassViewModel<RoleClaim>();
+            GeneratedForClassViewModel = context.ReflectionRepository.GetClassViewModel<Coalesce.Starter.Vue.Data.Models.Widget>();
         }
 
         [HttpGet("get/{id}")]
         [Authorize]
-        public virtual Task<ItemResult<RoleClaimResponse>> Get(
+        public virtual Task<ItemResult<WidgetResponse>> Get(
             int id,
             DataSourceParameters parameters,
-            IDataSource<RoleClaim> dataSource)
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Widget> dataSource)
             => GetImplementation(id, parameters, dataSource);
 
         [HttpGet("list")]
         [Authorize]
-        public virtual Task<ListResult<RoleClaimResponse>> List(
+        public virtual Task<ListResult<WidgetResponse>> List(
             ListParameters parameters,
-            IDataSource<RoleClaim> dataSource)
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Widget> dataSource)
             => ListImplementation(parameters, dataSource);
 
         [HttpGet("count")]
         [Authorize]
         public virtual Task<ItemResult<int>> Count(
             FilterParameters parameters,
-            IDataSource<RoleClaim> dataSource)
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Widget> dataSource)
             => CountImplementation(parameters, dataSource);
 
+        [HttpPost("save")]
+        [Authorize]
+        public virtual Task<ItemResult<WidgetResponse>> Save(
+            [FromForm] WidgetParameter dto,
+            [FromQuery] DataSourceParameters parameters,
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Widget> dataSource,
+            IBehaviors<Coalesce.Starter.Vue.Data.Models.Widget> behaviors)
+            => SaveImplementation(dto, parameters, dataSource, behaviors);
+
         [HttpPost("bulkSave")]
         [Authorize]
-        public virtual Task<ItemResult<RoleClaimResponse>> BulkSave(
+        public virtual Task<ItemResult<WidgetResponse>> BulkSave(
             [FromBody] BulkSaveRequest dto,
             [FromQuery] DataSourceParameters parameters,
-            IDataSource<RoleClaim> dataSource,
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Widget> dataSource,
             [FromServices] IDataSourceFactory dataSourceFactory,
             [FromServices] IBehaviorsFactory behaviorsFactory)
             => BulkSaveImplementation(dto, parameters, dataSource, dataSourceFactory, behaviorsFactory);
+
+        [HttpPost("delete/{id}")]
+        [Authorize]
+        public virtual Task<ItemResult<WidgetResponse>> Delete(
+            int id,
+            IBehaviors<Coalesce.Starter.Vue.Data.Models.Widget> behaviors,
+            IDataSource<Coalesce.Starter.Vue.Data.Models.Widget> dataSource)
+            => DeleteImplementation(id, new DataSourceParameters(), dataSource, behaviors);
     }
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/AppInsightsTelemetryEnricher.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/AppInsightsTelemetryEnricher.cs
index 4fde76849..504949ce6 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/AppInsightsTelemetryEnricher.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/AppInsightsTelemetryEnricher.cs
@@ -1,4 +1,4 @@
-using IntelliTect.Coalesce.Utilities;
+using Coalesce.Starter.Vue.Data.Utilities;
 using Microsoft.ApplicationInsights.Channel;
 using Microsoft.ApplicationInsights.DataContracts;
 using Microsoft.ApplicationInsights.Extensibility;
@@ -12,7 +12,7 @@ public void Initialize(ITelemetry telemetry)
         var user = httpContextAccessor.HttpContext?.User;
         if (user is not null)
         {
-            telemetry.Context.User.AuthenticatedUserId = user.GetUserId();
+            telemetry.Context.User.AuthenticatedUserId = user.GetUserName();
         }
 
         if (telemetry is ExceptionTelemetry ex)
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Controllers/HomeController.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Controllers/HomeController.cs
index 8b70d2b94..261f3d010 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Controllers/HomeController.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Controllers/HomeController.cs
@@ -1,13 +1,13 @@
 using Coalesce.Starter.Vue.Data.Models;
+#if AppInsights
+using Microsoft.ApplicationInsights.AspNetCore;
+#endif
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
-using System.Diagnostics;
 
 namespace Coalesce.Starter.Vue.Web.Controllers;
 
-#pragma warning disable CS1998 // Method lacks 'await' operators
-
 public class HomeController(
 #if Identity
     SignInManager<User> signInManager
@@ -17,40 +17,42 @@ SignInManager<User> signInManager
     /// <summary>
     /// Spa route for vue-based parts of the app
     /// </summary>
-    // Prevent caching of this route.
-    // The served file will contain the links to compiled js/css that include hashes in the filenames.
+    /// <remarks>
+    /// Caching is prevented on this route because the served file contains
+    /// the links to compiled js/css that include hashes in the filenames.
+    /// </remarks>
     [ResponseCache(Location = ResponseCacheLocation.None, NoStore = true)]
     [Authorize]
     public async Task<IActionResult> Index(
+#if AppInsights
+        [FromServices] JavaScriptSnippet appInsightsSnippet,
+#endif
         [FromServices] IWebHostEnvironment hostingEnvironment
     )
     {
         var fileInfo = hostingEnvironment.WebRootFileProvider.GetFileInfo("index.html");
         if (!fileInfo.Exists) return NotFound($"{hostingEnvironment.WebRootPath}/index.html was not found");
 
-        return File(fileInfo.CreateReadStream(), "text/html");
-
-        // If desired, you can inject settings or other variables into index.html here.
-        // These will then be available as global variables in your Vue app:
-        /*
         using var reader = new StreamReader(fileInfo.CreateReadStream());
         string contents = await reader.ReadToEndAsync();
 
-        contents = contents.Replace("<head>", $"""
-            <head>
+        contents = contents.Replace("<head>", "<head>"
+#if AppInsights
+            + appInsightsSnippet.FullScript
+            // Remove the automatic trackPageView event that is fired on load.
+            // We fire our own page tracking events in router.ts to get better data.
+            + "<script>window.appInsights.queue.pop()</script>"
+
+#endif
+            // OPTIONAL: Inject settings or other variables into index.html here.
+            // These will then be available as global variables in your Vue app:
+            + $"""
             <script>
-                MY_GLOBAL_VARIABLE="{HttpUtility.JavaScriptStringEncode(myValue)}"
+                ASPNETCORE_ENVIRONMENT="{hostingEnvironment.EnvironmentName}"
             </script>
             """);
 
         return Content(contents, "text/html");
-        */
-    }
-
-    public IActionResult Error()
-    {
-        ViewData["RequestId"] = Activity.Current?.Id ?? HttpContext.TraceIdentifier;
-        return View();
     }
 
 #if Identity
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleClaimDto.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleClaimDto.g.cs
deleted file mode 100644
index 78bc153f1..000000000
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleClaimDto.g.cs
+++ /dev/null
@@ -1,94 +0,0 @@
-using IntelliTect.Coalesce;
-using IntelliTect.Coalesce.Mapping;
-using IntelliTect.Coalesce.Models;
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Security.Claims;
-
-namespace Coalesce.Starter.Vue.Web.Models
-{
-    public partial class RoleClaimParameter : GeneratedParameterDto<RoleClaim>
-    {
-        public RoleClaimParameter() { }
-
-        private int? _Id;
-        private string _RoleId;
-        private string _ClaimType;
-        private string _ClaimValue;
-
-        public int? Id
-        {
-            get => _Id;
-            set { _Id = value; Changed(nameof(Id)); }
-        }
-        public string RoleId
-        {
-            get => _RoleId;
-            set { _RoleId = value; Changed(nameof(RoleId)); }
-        }
-        public string ClaimType
-        {
-            get => _ClaimType;
-            set { _ClaimType = value; Changed(nameof(ClaimType)); }
-        }
-        public string ClaimValue
-        {
-            get => _ClaimValue;
-            set { _ClaimValue = value; Changed(nameof(ClaimValue)); }
-        }
-
-        /// <summary>
-        /// Map from the current DTO instance to the domain object.
-        /// </summary>
-        public override void MapTo(RoleClaim entity, IMappingContext context)
-        {
-            var includes = context.Includes;
-
-            if (OnUpdate(entity, context)) return;
-
-            if (ShouldMapTo(nameof(Id))) entity.Id = (Id ?? entity.Id);
-            if (ShouldMapTo(nameof(RoleId))) entity.RoleId = RoleId;
-            if (ShouldMapTo(nameof(ClaimType))) entity.ClaimType = ClaimType;
-            if (ShouldMapTo(nameof(ClaimValue))) entity.ClaimValue = ClaimValue;
-        }
-
-        /// <summary>
-        /// Map from the current DTO instance to a new instance of the domain object.
-        /// </summary>
-        public override RoleClaim MapToNew(IMappingContext context)
-        {
-            var entity = new RoleClaim();
-            MapTo(entity, context);
-            return entity;
-        }
-    }
-
-    public partial class RoleClaimResponse : GeneratedResponseDto<RoleClaim>
-    {
-        public RoleClaimResponse() { }
-
-        public int? Id { get; set; }
-        public string RoleId { get; set; }
-        public string ClaimType { get; set; }
-        public string ClaimValue { get; set; }
-        public Coalesce.Starter.Vue.Web.Models.RoleResponse Role { get; set; }
-
-        /// <summary>
-        /// Map from the domain object to the properties of the current DTO instance.
-        /// </summary>
-        public override void MapFrom(RoleClaim obj, IMappingContext context, IncludeTree tree = null)
-        {
-            if (obj == null) return;
-            var includes = context.Includes;
-
-            this.Id = obj.Id;
-            this.RoleId = obj.RoleId;
-            this.ClaimType = obj.ClaimType;
-            this.ClaimValue = obj.ClaimValue;
-            if (tree == null || tree[nameof(this.Role)] != null)
-                this.Role = obj.Role.MapToDto<Coalesce.Starter.Vue.Data.Models.Role, RoleResponse>(context, tree?[nameof(this.Role)]);
-
-        }
-    }
-}
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleDto.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleDto.g.cs
index ccc5db6c9..06266c92f 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleDto.g.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/RoleDto.g.cs
@@ -14,6 +14,7 @@ public RoleParameter() { }
 
         private string _Id;
         private string _Name;
+        private System.Collections.Generic.ICollection<Coalesce.Starter.Vue.Data.Permission> _Permissions;
 
         public string Id
         {
@@ -25,6 +26,11 @@ public string Name
             get => _Name;
             set { _Name = value; Changed(nameof(Name)); }
         }
+        public System.Collections.Generic.ICollection<Coalesce.Starter.Vue.Data.Permission> Permissions
+        {
+            get => _Permissions;
+            set { _Permissions = value; Changed(nameof(Permissions)); }
+        }
 
         /// <summary>
         /// Map from the current DTO instance to the domain object.
@@ -37,6 +43,7 @@ public override void MapTo(Coalesce.Starter.Vue.Data.Models.Role entity, IMappin
 
             if (ShouldMapTo(nameof(Id))) entity.Id = Id;
             if (ShouldMapTo(nameof(Name))) entity.Name = Name;
+            if (ShouldMapTo(nameof(Permissions))) entity.Permissions = Permissions?.ToList();
         }
 
         /// <summary>
@@ -56,8 +63,7 @@ public RoleResponse() { }
 
         public string Id { get; set; }
         public string Name { get; set; }
-        public Coalesce.Starter.Vue.Data.Permission[] Permissions { get; set; }
-        public System.Collections.Generic.ICollection<RoleClaimResponse> RoleClaims { get; set; }
+        public System.Collections.Generic.ICollection<Coalesce.Starter.Vue.Data.Permission> Permissions { get; set; }
 
         /// <summary>
         /// Map from the domain object to the properties of the current DTO instance.
@@ -70,18 +76,6 @@ public override void MapFrom(Coalesce.Starter.Vue.Data.Models.Role obj, IMapping
             this.Id = obj.Id;
             this.Name = obj.Name;
             this.Permissions = obj.Permissions;
-            var propValRoleClaims = obj.RoleClaims;
-            if (propValRoleClaims != null && (tree == null || tree[nameof(this.RoleClaims)] != null))
-            {
-                this.RoleClaims = propValRoleClaims
-                    .OrderBy(f => f.Id)
-                    .Select(f => f.MapToDto<RoleClaim, RoleClaimResponse>(context, tree?[nameof(this.RoleClaims)])).ToList();
-            }
-            else if (propValRoleClaims == null && tree?[nameof(this.RoleClaims)] != null)
-            {
-                this.RoleClaims = new RoleClaimResponse[0];
-            }
-
         }
     }
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserDto.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserDto.g.cs
index 0fa348e11..d993dac35 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserDto.g.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserDto.g.cs
@@ -15,6 +15,9 @@ public UserParameter() { }
         private string _Id;
         private string _FullName;
         private string _UserName;
+        private string _Email;
+        private System.DateTimeOffset? _LockoutEnd;
+        private bool? _LockoutEnabled;
 
         public string Id
         {
@@ -31,6 +34,21 @@ public string UserName
             get => _UserName;
             set { _UserName = value; Changed(nameof(UserName)); }
         }
+        public string Email
+        {
+            get => _Email;
+            set { _Email = value; Changed(nameof(Email)); }
+        }
+        public System.DateTimeOffset? LockoutEnd
+        {
+            get => _LockoutEnd;
+            set { _LockoutEnd = value; Changed(nameof(LockoutEnd)); }
+        }
+        public bool? LockoutEnabled
+        {
+            get => _LockoutEnabled;
+            set { _LockoutEnabled = value; Changed(nameof(LockoutEnabled)); }
+        }
 
         /// <summary>
         /// Map from the current DTO instance to the domain object.
@@ -44,6 +62,9 @@ public override void MapTo(Coalesce.Starter.Vue.Data.Models.User entity, IMappin
             if (ShouldMapTo(nameof(Id))) entity.Id = Id;
             if (ShouldMapTo(nameof(FullName))) entity.FullName = FullName;
             if (ShouldMapTo(nameof(UserName))) entity.UserName = UserName;
+            if (ShouldMapTo(nameof(Email)) && (context.IsInRoleCached("UserAdmin"))) entity.Email = Email;
+            if (ShouldMapTo(nameof(LockoutEnd)) && (context.IsInRoleCached("UserAdmin"))) entity.LockoutEnd = LockoutEnd;
+            if (ShouldMapTo(nameof(LockoutEnabled)) && (context.IsInRoleCached("UserAdmin"))) entity.LockoutEnabled = (LockoutEnabled ?? entity.LockoutEnabled);
         }
 
         /// <summary>
@@ -65,9 +86,10 @@ public UserResponse() { }
         public string FullName { get; set; }
         public byte[] PhotoMD5 { get; set; }
         public string UserName { get; set; }
-        public int? AccessFailedCount { get; set; }
+        public string Email { get; set; }
         public System.DateTimeOffset? LockoutEnd { get; set; }
         public bool? LockoutEnabled { get; set; }
+        public string EffectivePermissions { get; set; }
         public System.Collections.Generic.ICollection<Coalesce.Starter.Vue.Web.Models.UserRoleResponse> UserRoles { get; set; }
 
         /// <summary>
@@ -84,9 +106,10 @@ public override void MapFrom(Coalesce.Starter.Vue.Data.Models.User obj, IMapping
             this.UserName = obj.UserName;
             if ((context.IsInRoleCached("UserAdmin")))
             {
-                this.AccessFailedCount = obj.AccessFailedCount;
+                this.Email = obj.Email;
                 this.LockoutEnd = obj.LockoutEnd;
                 this.LockoutEnabled = obj.LockoutEnabled;
+                this.EffectivePermissions = obj.EffectivePermissions;
                 var propValUserRoles = obj.UserRoles;
                 if (propValUserRoles != null && (tree == null || tree[nameof(this.UserRoles)] != null))
                 {
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserInfoDto.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserInfoDto.g.cs
index 115e33a7c..e58815ac3 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserInfoDto.g.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/UserInfoDto.g.cs
@@ -69,13 +69,13 @@ public override Coalesce.Starter.Vue.Data.Auth.UserInfo MapToNew(IMappingContext
 
             var entity = new Coalesce.Starter.Vue.Data.Auth.UserInfo()
             {
-                Id = Id,
-                UserName = UserName,
                 Roles = Roles,
                 Permissions = Permissions,
             };
 
             if (OnUpdate(entity, context)) return entity;
+            if (ShouldMapTo(nameof(Id))) entity.Id = Id;
+            if (ShouldMapTo(nameof(UserName))) entity.UserName = UserName;
             if (ShouldMapTo(nameof(FullName))) entity.FullName = FullName;
 
             return entity;
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/WidgetDto.g.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/WidgetDto.g.cs
new file mode 100644
index 000000000..e81f10f14
--- /dev/null
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Models/Generated/WidgetDto.g.cs
@@ -0,0 +1,116 @@
+using IntelliTect.Coalesce;
+using IntelliTect.Coalesce.Mapping;
+using IntelliTect.Coalesce.Models;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+
+namespace Coalesce.Starter.Vue.Web.Models
+{
+    public partial class WidgetParameter : GeneratedParameterDto<Coalesce.Starter.Vue.Data.Models.Widget>
+    {
+        public WidgetParameter() { }
+
+        private int? _WidgetId;
+        private string _Name;
+        private Coalesce.Starter.Vue.Data.Models.WidgetCategory? _Category;
+        private System.DateTimeOffset? _InventedOn;
+
+        public int? WidgetId
+        {
+            get => _WidgetId;
+            set { _WidgetId = value; Changed(nameof(WidgetId)); }
+        }
+        public string Name
+        {
+            get => _Name;
+            set { _Name = value; Changed(nameof(Name)); }
+        }
+        public Coalesce.Starter.Vue.Data.Models.WidgetCategory? Category
+        {
+            get => _Category;
+            set { _Category = value; Changed(nameof(Category)); }
+        }
+        public System.DateTimeOffset? InventedOn
+        {
+            get => _InventedOn;
+            set { _InventedOn = value; Changed(nameof(InventedOn)); }
+        }
+
+        /// <summary>
+        /// Map from the current DTO instance to the domain object.
+        /// </summary>
+        public override void MapTo(Coalesce.Starter.Vue.Data.Models.Widget entity, IMappingContext context)
+        {
+            var includes = context.Includes;
+
+            if (OnUpdate(entity, context)) return;
+
+            if (ShouldMapTo(nameof(WidgetId))) entity.WidgetId = (WidgetId ?? entity.WidgetId);
+            if (ShouldMapTo(nameof(Name))) entity.Name = Name;
+            if (ShouldMapTo(nameof(Category))) entity.Category = (Category ?? entity.Category);
+            if (ShouldMapTo(nameof(InventedOn))) entity.InventedOn = InventedOn;
+        }
+
+        /// <summary>
+        /// Map from the current DTO instance to a new instance of the domain object.
+        /// </summary>
+        public override Coalesce.Starter.Vue.Data.Models.Widget MapToNew(IMappingContext context)
+        {
+            var includes = context.Includes;
+
+            var entity = new Coalesce.Starter.Vue.Data.Models.Widget()
+            {
+                Name = Name,
+                Category = (Category ?? default),
+            };
+
+            if (OnUpdate(entity, context)) return entity;
+            if (ShouldMapTo(nameof(WidgetId))) entity.WidgetId = (WidgetId ?? entity.WidgetId);
+            if (ShouldMapTo(nameof(InventedOn))) entity.InventedOn = InventedOn;
+
+            return entity;
+        }
+    }
+
+    public partial class WidgetResponse : GeneratedResponseDto<Coalesce.Starter.Vue.Data.Models.Widget>
+    {
+        public WidgetResponse() { }
+
+        public int? WidgetId { get; set; }
+        public string Name { get; set; }
+        public Coalesce.Starter.Vue.Data.Models.WidgetCategory? Category { get; set; }
+        public System.DateTimeOffset? InventedOn { get; set; }
+        public string ModifiedById { get; set; }
+        public System.DateTimeOffset? ModifiedOn { get; set; }
+        public string CreatedById { get; set; }
+        public System.DateTimeOffset? CreatedOn { get; set; }
+        public Coalesce.Starter.Vue.Web.Models.UserResponse ModifiedBy { get; set; }
+        public Coalesce.Starter.Vue.Web.Models.UserResponse CreatedBy { get; set; }
+
+        /// <summary>
+        /// Map from the domain object to the properties of the current DTO instance.
+        /// </summary>
+        public override void MapFrom(Coalesce.Starter.Vue.Data.Models.Widget obj, IMappingContext context, IncludeTree tree = null)
+        {
+            if (obj == null) return;
+            var includes = context.Includes;
+
+            this.WidgetId = obj.WidgetId;
+            this.Name = obj.Name;
+            this.Category = obj.Category;
+            this.InventedOn = obj.InventedOn;
+            this.ModifiedById = obj.ModifiedById;
+            this.ModifiedOn = obj.ModifiedOn;
+            this.CreatedById = obj.CreatedById;
+            this.CreatedOn = obj.CreatedOn;
+            if (tree == null || tree[nameof(this.ModifiedBy)] != null)
+                this.ModifiedBy = obj.ModifiedBy.MapToDto<Coalesce.Starter.Vue.Data.Models.User, UserResponse>(context, tree?[nameof(this.ModifiedBy)]);
+
+            if (tree == null || tree[nameof(this.CreatedBy)] != null)
+                this.CreatedBy = obj.CreatedBy.MapToDto<Coalesce.Starter.Vue.Data.Models.User, UserResponse>(context, tree?[nameof(this.CreatedBy)]);
+
+        }
+    }
+}
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.cs
index 69caee6d9..f3fe7a8fa 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.cs
@@ -14,26 +14,27 @@
 #if OpenAPI
 using Microsoft.OpenApi.Models;
 #endif
+using System.Security.Claims;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using System.Text.RegularExpressions;
 
 var builder = WebApplication.CreateBuilder(new WebApplicationOptions
 {
-    Args = args,
-    // Explicit declaration prevents ASP.NET Core from erroring if wwwroot doesn't exist at startup:
-    WebRootPath = "wwwroot"
+	Args = args,
+	// Explicit declaration prevents ASP.NET Core from erroring if wwwroot doesn't exist at startup:
+	WebRootPath = "wwwroot"
 });
 
 builder.Logging
-    .AddConsole()
-    // Filter out Request Starting/Request Finished noise:
-    .AddFilter<ConsoleLoggerProvider>("Microsoft.AspNetCore.Hosting.Diagnostics", LogLevel.Warning);
+	.AddConsole()
+	// Filter out Request Starting/Request Finished noise:
+	.AddFilter<ConsoleLoggerProvider>("Microsoft.AspNetCore.Hosting.Diagnostics", LogLevel.Warning);
 
 builder.Configuration
-    .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
-    .AddJsonFile("appsettings.localhost.json", optional: true, reloadOnChange: true)
-    .AddEnvironmentVariables();
+	.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
+	.AddJsonFile("appsettings.localhost.json", optional: true, reloadOnChange: true)
+	.AddEnvironmentVariables();
 
 #region Configure Services
 
@@ -43,7 +44,7 @@
 services.AddApplicationInsightsTelemetry();
 services.AddSingleton<ITelemetryInitializer, AppInsightsTelemetryEnricher>();
 services.ConfigureTelemetryModule<DependencyTrackingTelemetryModule>((module, o) => {
-    module.EnableSqlCommandTextInstrumentation = true;
+	module.EnableSqlCommandTextInstrumentation = true;
 });
 // App insights filters all logs to Warning by default.
 builder.Logging.AddFilter<ApplicationInsightsLoggerProvider>("Coalesce.Starter.Vue", LogLevel.Information);
@@ -51,27 +52,27 @@
 
 
 services.AddDbContext<AppDbContext>(options => options
-    .UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection"), opt => opt
-        .EnableRetryOnFailure()
-        .UseQuerySplittingBehavior(QuerySplittingBehavior.SplitQuery)
-    )
-    // Ignored because it interferes with the construction of Coalesce IncludeTrees via .Include()
-    .ConfigureWarnings(warnings => warnings.Ignore(CoreEventId.NavigationBaseIncludeIgnored))
+	.UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection"), opt => opt
+		.EnableRetryOnFailure()
+		.UseQuerySplittingBehavior(QuerySplittingBehavior.SplitQuery)
+	)
+	// Ignored because it interferes with the construction of Coalesce IncludeTrees via .Include()
+	.ConfigureWarnings(warnings => warnings.Ignore(CoreEventId.NavigationBaseIncludeIgnored))
 );
 
 services.AddCoalesce<AppDbContext>();
 
 services.AddDataProtection()
-    .PersistKeysToDbContext<AppDbContext>();
+	.PersistKeysToDbContext<AppDbContext>();
 
 services
-    .AddMvc()
-    .AddJsonOptions(options =>
-    {
-        options.JsonSerializerOptions.PropertyNamingPolicy = JsonNamingPolicy.CamelCase;
-        options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
-        options.JsonSerializerOptions.DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull;
-    });
+	.AddMvc()
+	.AddJsonOptions(options =>
+	{
+		options.JsonSerializerOptions.PropertyNamingPolicy = JsonNamingPolicy.CamelCase;
+		options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+		options.JsonSerializerOptions.DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull;
+	});
 
 #if Identity
 builder.ConfigureAuthentication();
@@ -80,8 +81,8 @@
 #if OpenAPI
 services.AddSwaggerGen(c =>
 {
-    c.AddCoalesce();
-    c.SwaggerDoc("v1", new OpenApiInfo { Title = "Current API", Version = "v1" });
+	c.AddCoalesce();
+	c.SwaggerDoc("current", new OpenApiInfo { Title = "Current API", Version = "current" });
 });
 #endif
 
@@ -97,14 +98,32 @@
 
 if (app.Environment.IsDevelopment())
 {
-    app.UseDeveloperExceptionPage();
-
-    app.UseViteDevelopmentServer(c =>
-    {
-        c.DevServerPort = 5002;
-    });
-
-    app.MapCoalesceSecurityOverview("coalesce-security");
+	app.UseDeveloperExceptionPage();
+
+	app.UseViteDevelopmentServer(c =>
+	{
+		c.DevServerPort = 5002;
+	});
+
+	app.MapCoalesceSecurityOverview("coalesce-security");
+	
+	#if !Identity
+	// TODO: Dummy authentication for initial development.
+	// Replace this with a proper authentication scheme like
+	// Windows Authentication, or an OIDC provider, or something else.
+	// If you wanted to use ASP.NET Core Identity, you're recommended
+	// to keep the "--Identity" parameter to the Coalesce template enabled.
+	app.Use(async (context, next) =>
+	{
+		Claim[] claims = [new Claim(ClaimTypes.Name, "developmentuser")];
+
+		var identity = new ClaimsIdentity(claims, "dummy-auth");
+		context.User = new ClaimsPrincipal(identity);
+
+		await next.Invoke();
+	});
+	// End Dummy Authentication.
+	#endif
 }
 
 app.UseAuthentication();
@@ -113,30 +132,30 @@
 var containsFileHashRegex = new Regex(@"[.-][0-9a-zA-Z-_]{8}\.[^\.]*$", RegexOptions.Compiled);
 app.UseStaticFiles(new StaticFileOptions
 {
-    OnPrepareResponse = ctx =>
-    {
-        // vite puts 8-char hashes before the file extension.
-        // Use this to determine if we can send a long-term cache duration.
-        if (containsFileHashRegex.IsMatch(ctx.File.Name))
-        {
-            ctx.Context.Response.GetTypedHeaders().CacheControl = new() { Public = true, MaxAge = TimeSpan.FromDays(30) };
-        }
-    }
+	OnPrepareResponse = ctx =>
+	{
+		// vite puts 8-char hashes before the file extension.
+		// Use this to determine if we can send a long-term cache duration.
+		if (containsFileHashRegex.IsMatch(ctx.File.Name))
+		{
+			ctx.Context.Response.GetTypedHeaders().CacheControl = new() { Public = true, MaxAge = TimeSpan.FromDays(30) };
+		}
+	}
 });
 
 // For all requests that aren't to static files, disallow caching by default.
 // Individual endpoints may override this.
 app.Use(async (context, next) =>
 {
-    context.Response.GetTypedHeaders().CacheControl = new() { NoCache = true, NoStore = true };
-    await next();
+	context.Response.GetTypedHeaders().CacheControl = new() { NoCache = true, NoStore = true };
+	await next();
 });
 
 #if OpenAPI
 app.MapSwagger();
 app.UseSwaggerUI(c =>
 {
-    c.SwaggerEndpoint("/swagger/v1/swagger.json", "Current API");
+	c.SwaggerEndpoint("/swagger/current/swagger.json", "Current API");
 });
 #endif
 
@@ -155,17 +174,18 @@
 // Initialize/migrate database.
 using (var scope = app.Services.CreateScope())
 {
-    var serviceScope = scope.ServiceProvider;
+	var serviceScope = scope.ServiceProvider;
 
-    // Run database migrations.
-    using var db = serviceScope.GetRequiredService<AppDbContext>();
-    db.Database.SetCommandTimeout(TimeSpan.FromMinutes(10));
+	// Run database migrations.
+	using var db = serviceScope.GetRequiredService<AppDbContext>();
+	db.Database.SetCommandTimeout(TimeSpan.FromMinutes(10));
 #if KeepTemplateOnly
-    db.Database.EnsureDeleted();
-    db.Database.EnsureCreated();
+	db.Database.EnsureDeleted();
+	db.Database.EnsureCreated();
 #else
-    db.Database.Migrate();
+	db.Database.Migrate();
 #endif
+    new DatabaseSeeder(db).Seed();
 }
 
 app.Run();
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.Auth.cs b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/ProgramAuth.cs
similarity index 55%
rename from templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.Auth.cs
rename to templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/ProgramAuth.cs
index 4d2ef7cc3..8c117f630 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/Program.Auth.cs
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/ProgramAuth.cs
@@ -2,13 +2,13 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
-using System.Net.Http.Headers;
+using System.Data;
 using System.Security.Claims;
 using System.Security.Cryptography;
 
 namespace Coalesce.Starter.Vue.Data.Auth;
 
-public static class AuthenticationConfiguration
+public static class ProgramAuth
 {
     public static void ConfigureAuthentication(this WebApplicationBuilder builder)
     {
@@ -27,6 +27,7 @@ public static void ConfigureAuthentication(this WebApplicationBuilder builder)
             {
                 options.ClientId = config["Authentication:Google:ClientId"]!;
                 options.ClientSecret = config["Authentication:Google:ClientSecret"]!;
+                options.ClaimActions.MapJsonKey("hd", "hd"); // Hosted domain (i.e. GSuite domain).
 #if UserPictures
                 options.ClaimActions.MapJsonKey("pictureUrl", "picture");
 #endif
@@ -35,28 +36,12 @@ public static void ConfigureAuthentication(this WebApplicationBuilder builder)
                 {
                     // OPTIONAL: Populate fields on `user` specific to Google, if any.
 
+                    // NOTE: If needed, the GSuite domain (if any) of the user can be acquired as follows:
+                    //var domain = ctx.Principal!.FindFirstValue("hd")
 #if UserPictures
-                    UserPhoto? photo = db.UserPhotos.Where(p => p.UserId == user.Id).FirstOrDefault();
-                    if (photo is null || photo.ModifiedOn < DateTimeOffset.Now.AddDays(-7))
-                    {
-                        var photoUrl = ctx.Principal!.FindFirstValue("pictureUrl");
-                        var request = new HttpRequestMessage(HttpMethod.Get, photoUrl);
-                        var response = await ctx.Options.Backchannel.SendAsync(request);
-                        if (response.IsSuccessStatusCode)
-                        {
-                            byte[] content = await response.Content.ReadAsByteArrayAsync();
-                            if (photo is null)
-                            {
-                                db.Add(photo = new UserPhoto { UserId = user.Id, Content = content });
-                            }
-                            else
-                            {
-                                photo.Content = content;
-                                photo.SetTracking(user.Id);
-                            }
-                            user.PhotoMD5 = MD5.HashData(content);
-                        }
-                    }
+                    // Populate or update user photo from Google
+                    await UpdateUserPhoto(user, db, ctx.Options.Backchannel, 
+                        () => new HttpRequestMessage(HttpMethod.Get, ctx.Principal!.FindFirstValue("pictureUrl")));
 #endif
                 });
              })
@@ -74,30 +59,18 @@ public static void ConfigureAuthentication(this WebApplicationBuilder builder)
                 {
                     // OPTIONAL: Populate additional fields on `user` specific to Microsoft, if any.
 
+                    // NOTE: If needed, the Entra/AAD TenantID of the user can be acquired as follows:
+                    //var tenantId = new JwtSecurityTokenHandler()
+                    //    .ReadJwtToken(ctx.Properties!.GetTokenValue(OpenIdConnectParameterNames.AccessToken))
+                    //    .Claims.First(c => c.Type == "tid").Value;
+
 #if UserPictures
-                    UserPhoto? photo = db.UserPhotos.Where(p => p.UserId == user.Id).FirstOrDefault();
-                    if (photo is null || photo.ModifiedOn < DateTimeOffset.Now.AddDays(-7))
-                    {
+                    // Populate or update user photo from Microsoft Graph
+                    await UpdateUserPhoto(user, db, ctx.Options.Backchannel, () => {
                         var request = new HttpRequestMessage(HttpMethod.Get, "https://graph.microsoft.com/v1.0/me/photos/96x96/$value");
-                        var token = ctx.Properties!.GetTokenValue(OpenIdConnectParameterNames.AccessToken);
-                        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
-
-                        var response = await ctx.Options.Backchannel.SendAsync(request);
-                        if (response.IsSuccessStatusCode)
-                        {
-                            byte[] content = await response.Content.ReadAsByteArrayAsync();
-                            if (photo is null)
-                            {
-                                db.Add(photo = new UserPhoto { UserId = user.Id, Content = content });
-                            }
-                            else
-                            {
-                                photo.Content = content;
-                                photo.SetTracking(user.Id);
-                            }
-                            user.PhotoMD5 = MD5.HashData(content);
-                        }
-                    }
+                        request.Headers.Authorization = new("Bearer", ctx.Properties!.GetTokenValue(OpenIdConnectParameterNames.AccessToken));
+                        return request;
+                    });
 #endif
                 });
             })
@@ -108,7 +81,7 @@ public static void ConfigureAuthentication(this WebApplicationBuilder builder)
         {
             // Configure how often to refresh user claims and validate
             // that the user is still allowed to sign in.
-            o.ValidationInterval = TimeSpan.FromMinutes(10);
+            o.ValidationInterval = TimeSpan.FromMinutes(5);
         });
 
         builder.Services.ConfigureApplicationCookie(c =>
@@ -117,6 +90,44 @@ public static void ConfigureAuthentication(this WebApplicationBuilder builder)
         });
     }
 
+#if UserPictures
+    private static async Task UpdateUserPhoto(User user, AppDbContext db, HttpClient client, Func<HttpRequestMessage> buildRequest)
+    {
+        UserPhoto? photo = user.Photo = db.UserPhotos.Where(p => p.UserId == user.Id).FirstOrDefault();
+        if (photo is not null && photo.ModifiedOn >= DateTimeOffset.Now.AddDays(-7))
+        {
+            // User photo already populated and reasonably recent.
+            return;
+        }
+
+        var request = buildRequest();
+
+        if (request.RequestUri is null) return;
+
+        try
+        {
+            var response = await client.SendAsync(request);
+            if (!response.IsSuccessStatusCode) return;
+
+            byte[] content = await response.Content.ReadAsByteArrayAsync();
+
+            if (content is not { Length: > 0 }) return;
+
+            if (photo is null)
+            {
+                user.Photo = photo = new UserPhoto { UserId = user.Id, Content = content };
+            }
+            else
+            {
+                photo.Content = content;
+                photo.SetTracking(user.Id);
+            }
+            user.PhotoMD5 = MD5.HashData(content);
+        }
+        catch { /* Failure is non-critical */ }
+    }
+#endif
+
 #if GoogleAuth || MicrosoftAuth
     private static Func<TicketReceivedContext, Task> OnTicketReceived(
         Func<User, AppDbContext, TicketReceivedContext, Task>? updateUser = null
@@ -125,14 +136,51 @@ private static Func<TicketReceivedContext, Task> OnTicketReceived(
         var db = ctx.HttpContext.RequestServices.GetRequiredService<AppDbContext>();
         var signInManager = ctx.HttpContext.RequestServices.GetRequiredService<SignInManager<User>>();
 
+        var (user, remoteLoginInfo) = await GetOrCreateUser(ctx, db, signInManager);
+        if (user is null)
+        {
+            await Results.Text("Forbidden", statusCode: StatusCodes.Status403Forbidden).ExecuteAsync(ctx.HttpContext);
+            ctx.HandleResponse();
+            return;
+        }
+
+        if (updateUser is not null) await updateUser(user, db, ctx);
+
+        await signInManager.UserManager.UpdateAsync(user);
+
+        var result = await signInManager.ExternalLoginSignInAsync(
+            remoteLoginInfo.LoginProvider, 
+            remoteLoginInfo.ProviderKey, 
+            isPersistent: true, 
+            bypassTwoFactor: true);
+
+        if (!result.Succeeded)
+        {
+            await Results.Text("Forbidden", statusCode: StatusCodes.Status403Forbidden).ExecuteAsync(ctx.HttpContext);
+            ctx.HandleResponse();
+            return;
+        }
+
+        ctx.HttpContext.Response.Redirect(ctx.ReturnUri ?? "/");
+        ctx.HandleResponse();
+    };
+
+    private static async Task<(User? user, UserLoginInfo remoteLoginInfo)> GetOrCreateUser(
+        TicketReceivedContext ctx, 
+        AppDbContext db, 
+        SignInManager<User> signInManager
+    )
+    {
         var remoteProvider = ctx.Scheme.Name;
         var remoteUser = ctx.Principal!;
         var remoteUserId = remoteUser.FindFirstValue(ClaimTypes.NameIdentifier)!;
         var remoteUserEmail = remoteUser.FindFirstValue(ClaimTypes.Email);
 
+        var remoteLoginInfo = new UserLoginInfo(remoteProvider, remoteUserId, ctx.Scheme.DisplayName);
+
         // Find by the external user ID
         bool foundByLogin = false;
-        var user = await signInManager.UserManager.FindByLoginAsync(remoteProvider, remoteUserId);
+        User? user = await signInManager.UserManager.FindByLoginAsync(remoteProvider, remoteUserId);
 
         // If not found, look for an existing user by email address
         if (user is not null)
@@ -148,44 +196,38 @@ private static Func<TicketReceivedContext, Task> OnTicketReceived(
         {
             if (!await CanUserSignUpAsync(ctx, db, remoteUser))
             {
-                await Results.Text("Forbidden", statusCode: StatusCodes.Status403Forbidden).ExecuteAsync(ctx.HttpContext);
-                ctx.HandleResponse();
-                return;
+                return (null, remoteLoginInfo);
             }
 
             user = new User { UserName = remoteUserEmail };
-            await signInManager.UserManager.CreateAsync(user);
-        }
 
-        user.FullName = remoteUser.FindFirstValue(ClaimTypes.Name) ?? user.FullName;
-        user.Email = remoteUserEmail ?? user.Email;
-        // OPTIONAL: Update any other properties on the user as desired.
-
-        if (updateUser is not null) await updateUser(user, db, ctx);
+            // If this user is the first user, give them all roles so the system has an admin.
+            if (!db.Users.Any())
+            {
+                user.UserRoles = db.Roles.Select(r => new UserRole { Role = r, User = user }).ToList();
+            }
 
-        await signInManager.UserManager.UpdateAsync(user);
+            await signInManager.UserManager.CreateAsync(user);
+        }
 
         if (!foundByLogin)
         {
-            await signInManager.UserManager.AddLoginAsync(user, new UserLoginInfo(remoteProvider, remoteUserId, ctx.Scheme.DisplayName));
+            await signInManager.UserManager.AddLoginAsync(user, remoteLoginInfo);
         }
 
-        var result = await signInManager.ExternalLoginSignInAsync(remoteProvider, remoteUserId, isPersistent: true, bypassTwoFactor: true);
-        if (!result.Succeeded)
-        {
-            await Results.Text("Forbidden", statusCode: StatusCodes.Status403Forbidden).ExecuteAsync(ctx.HttpContext);
-            ctx.HandleResponse();
-            return;
-        }
+        user.FullName = remoteUser.FindFirstValue(ClaimTypes.Name) ?? user.FullName;
+        user.Email = remoteUserEmail ?? user.Email;
+        user.EmailConfirmed = true;
+        // OPTIONAL: Update any other properties on the user as desired.
 
-        ctx.HttpContext.Response.Redirect(ctx.ReturnUri ?? "/");
-        ctx.HandleResponse();
-    };
+        return (user, remoteLoginInfo);
+    }
 
     private static Task<bool> CanUserSignUpAsync(TicketReceivedContext ctx, AppDbContext db, ClaimsPrincipal remoteUser)
     {
         // OPTIONAL: Examine the properties of `remoteUser` and determine if they're permitted to sign up.
         return Task.FromResult(true);
     }
+
 #endif
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/appsettings.json b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/appsettings.json
index 453c9b251..4773d5611 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/appsettings.json
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/appsettings.json
@@ -1,5 +1,24 @@
 {
   "ConnectionStrings": {
     "DefaultConnection": "Server=(localdb)\\MSSQLLocalDB;Database=Coalesce.Starter.Vue;Trusted_Connection=True;TrustServerCertificate=True;"
-  }
-}
\ No newline at end of file
+  },
+  //#if AppInsights
+  "ApplicationInsights": {
+    "ConnectionString": ""
+  },
+  //#endif AppInsights
+  "Authentication": {
+    //#if MicrosoftAuth
+    "Microsoft": {
+      "ClientId": "",
+      "ClientSecret": ""
+    },
+    //#endif
+    //#if GoogleAuth
+    "Google": {
+      "ClientId": "",
+      "ClientSecret": ""
+    },
+    //#endif
+  },
+}
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/package.json b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/package.json
index e66e05b44..6ceaddf91 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/package.json
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/package.json
@@ -14,6 +14,7 @@
   },
   "dependencies": {
     "@fortawesome/fontawesome-free": "^6.6.0",
+    "@microsoft/applicationinsights-web": "^3.3.2",
     "@vueuse/core": "^11.0.3",
     "coalesce-vue": "5.0.0-ci.20240830.2",
     "coalesce-vue-vuetify3": "5.0.0-ci.20240830.2",
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/api-clients.g.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/api-clients.g.ts
index fe0d768c0..49b4268b6 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/api-clients.g.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/api-clients.g.ts
@@ -17,11 +17,6 @@ export class RoleApiClient extends ModelApiClient<$models.Role> {
 }
 
 
-export class RoleClaimApiClient extends ModelApiClient<$models.RoleClaim> {
-  constructor() { super($metadata.RoleClaim) }
-}
-
-
 export class UserApiClient extends ModelApiClient<$models.User> {
   constructor() { super($metadata.User) }
   public getPhoto(id: string | null, etag?: string | null, $config?: AxiosRequestConfig): AxiosPromise<ItemResult<File>> {
@@ -41,6 +36,11 @@ export class UserRoleApiClient extends ModelApiClient<$models.UserRole> {
 }
 
 
+export class WidgetApiClient extends ModelApiClient<$models.Widget> {
+  constructor() { super($metadata.Widget) }
+}
+
+
 export class SecurityServiceApiClient extends ServiceApiClient<typeof $metadata.SecurityService> {
   constructor() { super($metadata.SecurityService) }
   public whoAmI($config?: AxiosRequestConfig): AxiosPromise<ItemResult<$models.UserInfo>> {
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/HelloWorld.vue b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/HelloWorld.vue
index b956b2e9c..083d5b8f7 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/HelloWorld.vue
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/HelloWorld.vue
@@ -1,5 +1,5 @@
 <template>
-  <v-container>
+  <v-container max-width="1500px">
     <v-row>
       <v-col cols="12" md="8">
         <v-card>
@@ -7,189 +7,157 @@
             {{ msg }}
           </v-card-title>
           <v-card-text>
-            <v-row
-              style="max-width: 500px"
-              class="mx-auto"
-              justify="space-around"
-              align="end"
+            Here are some next steps to get started:
+
+            <h2 class="mt-5">1. Create a Data Model</h2>
+            <p>
+              Visit
+              <a href="https://learn.microsoft.com/en-us/ef/core/modeling/"
+                >Entity Framework's documentation</a
+              >
+              to learn about creating the data model for your application.
+            </p>
+
+            <h2 class="mt-5">2. Create a Migration</h2>
+            To turn your data model into a database schema,
+            <a
+              href="https://learn.microsoft.com/en-us/ef/core/managing-schemas/migrations/?tabs=dotnet-core-cli"
+              >create a migration with Entity Framework</a
+            >.
+
+            <!--#if !Identity -->
+            <h2 class="mt-5">3. Add Authentication</h2>
+            <strong> Implement a proper authentication mechanism</strong> in
+            Program.cs and remove the existing dummy authentication. If you want
+            to use
+            <a
+              href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity"
             >
-              <v-col>
-                <a href="https://vuejs.org/">
-                  <img
-                    src="https://raw.githubusercontent.com/vitejs/vite/9885f6f113667c1e161dee5f30af1e91aeefa62f/docs/images/vue.svg"
-                    width="100"
-                  />
-                </a>
+              ASP.NET Core Identity </a
+            >, you should start over and include the Identity option when
+            instantiating the Coalesce project template. Otherwise,
+            <a
+              href="https://learn.microsoft.com/en-us/aspnet/core/security/how-to-choose-identity-solution"
+            >
+              read more about authentication in ASP.NET Core </a
+            >.
+            <br />
+            <br />
+            This template authenticates all users as a dummy user to facilitate
+            rapid initial development. Since all Coalesce endpoints require
+            authentication by default, you would otherwise have to setup a real
+            authentication scheme before you could begin development.
+            <!--#endif -->
+          </v-card-text>
+        </v-card>
+        <br />
+        <v-card>
+          <v-card-title>
+            Development Environment Recommended Tooling:
+          </v-card-title>
+          <v-card-text>
+            <v-row align="center">
+              <v-col style="flex-grow: 0">
+                <img
+                  src="https://visualstudio.microsoft.com/wp-content/uploads/2021/10/Product-Icon.svg"
+                  width="64"
+                />
               </v-col>
               <v-col>
-                <a href="https://vuetifyjs.com/en/">
-                  <img
-                    src="https://cdn.vuetifyjs.com/docs/images/logos/vuetify-logo-v3-slim-light.svg"
-                    width="100"
-                  />
-                </a>
+                <p>
+                  Visual Studio is recommended for back-end C# work, but other
+                  IDEs like Rider or VS Code can also be used.
+                </p>
+                Recommended extensions:
+                <ul class="mt-1">
+                  <li>
+                    <a
+                      href="https://marketplace.visualstudio.com/items?itemName=MadsKristensen.NpmTaskRunner64"
+                    >
+                      NPM Task Runner
+                    </a>
+                    (for easily running
+                    <code>dotnet coalesce</code>)
+                  </li>
+                </ul>
+              </v-col>
+            </v-row>
+            <v-row align="center">
+              <v-col style="flex-grow: 0">
+                <img
+                  src="https://code.visualstudio.com/assets/images/code-stable.png"
+                  width="64"
+                />
               </v-col>
               <v-col>
-                <a href="https://vitejs.dev/">
-                  <img
-                    src="https://raw.githubusercontent.com/vitejs/vite/9885f6f113667c1e161dee5f30af1e91aeefa62f/docs/images/vite.svg"
-                    width="100"
-                  />
-                </a>
+                VS Code is recommended for front-end Vue/Typescript work, with
+                these extensions:
+                <ul class="mt-1">
+                  <li>
+                    <a
+                      href="https://marketplace.visualstudio.com/items?itemName=Vue.volar"
+                    >
+                      Vue - Official
+                    </a>
+                  </li>
+                  <li>
+                    <a
+                      href="https://marketplace.visualstudio.com/items?itemName=antfu.goto-alias"
+                    >
+                      Goto definition alias
+                    </a>
+                  </li>
+                  <li>
+                    <a
+                      href="https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint"
+                    >
+                      ESLint
+                    </a>
+                  </li>
+                  <li>
+                    <a
+                      href="https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode"
+                    >
+                      Prettier
+                    </a>
+                  </li>
+                </ul>
               </v-col>
             </v-row>
-            <h2 class="headline font-weight-light my-3">
-              Here are some next steps to get started:
-            </h2>
-            <ol>
-              <li>
-                <strong>Create your data model</strong> by adding classes to the
-                Models folder in your data project, and adding DbSet properties
-                on AppDbContext.
-              </li>
-              <li>
-                <strong>Create an EF migration</strong> by running
-                <code>dotnet ef migrations add MigrationName</code>
-                in your .Data project. The pages below will not work until you
-                do so.
-              </li>
-              <li>
-                <i class="fas fa-star" />
-                <strong> Implement a proper authentication mechanism</strong> in
-                Program.cs and remove the existing dummy authentication. Options
-                include
-                <a
-                  href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity"
-                >
-                  Identity
-                </a>
-                and
-                <a
-                  href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth?view=aspnetcore-6.0#kestrel"
-                >
-                  Windows Authentication
-                </a>
-
-                <br />
-                <br />
-                This template authenticates all users as a dummy user to
-                facilitate rapid initial development. Since all Coalesce
-                endpoints require authentication by default, you would otherwise
-                have to setup a real authentication scheme before you could
-                begin development.
-              </li>
-              <li>
-                <b>Check out the other pages</b> in the sidebar for
-                <router-link to="/widget">examples</router-link> and
-                <router-link to="/admin">admin page links</router-link>!
-              </li>
-            </ol>
-            <v-divider class="my-4"></v-divider>
-            <h2 class="headline font-weight-light my-3">
-              Development Environment Recommended Tooling:
-            </h2>
-            <div style="max-width: 580px">
-              <v-row align="center">
-                <v-col style="flex-grow: 0">
+            <v-row>
+              <v-col style="flex-grow: 0">
+                <div class="browser-logos">
                   <img
-                    src="https://visualstudio.microsoft.com/wp-content/uploads/2021/10/Product-Icon.svg"
+                    class="f1"
+                    src="https://raw.githubusercontent.com/vuejs/devtools/1b1d1d0ce62e78b5cd8e628c89b31b6ed6df7a73/packages/docs/src/public/logo-chrome.svg"
                     width="64"
                   />
-                </v-col>
-                <v-col>
-                  Visual Studio is recommended for back-end C# work, but other
-                  IDEs like Rider or VS Code can also be used. Recommended
-                  extensions:
-                  <ul class="mt-1">
-                    <li>
-                      <a
-                        href="https://marketplace.visualstudio.com/items?itemName=MadsKristensen.NpmTaskRunner64"
-                      >
-                        NPM Task Runner
-                      </a>
-                      (for easily running
-                      <code>dotnet coalesce</code>)
-                    </li>
-                  </ul>
-                </v-col>
-              </v-row>
-              <v-row align="center">
-                <v-col style="flex-grow: 0">
                   <img
-                    src="https://code.visualstudio.com/assets/images/code-stable.png"
+                    class="f2"
+                    src="https://raw.githubusercontent.com/vuejs/devtools/1b1d1d0ce62e78b5cd8e628c89b31b6ed6df7a73/packages/docs/src/public/logo-edge.png"
                     width="64"
                   />
-                </v-col>
-                <v-col>
-                  VS Code is recommended for front-end Vue/Typescript work, with
-                  these extensions:
-                  <ul class="mt-1">
-                    <li>
-                      <a
-                        href="https://marketplace.visualstudio.com/items?itemName=Vue.volar"
-                      >
-                        Vue - Official
-                      </a>
-                    </li>
-                    <li>
-                      <a
-                        href="https://marketplace.visualstudio.com/items?itemName=antfu.goto-alias"
-                      >
-                        Goto definition alias
-                      </a>
-                    </li>
-                    <li>
-                      <a
-                        href="https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint"
-                      >
-                        ESLint
-                      </a>
-                    </li>
-                    <li>
-                      <a
-                        href="https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode"
-                      >
-                        Prettier
-                      </a>
-                    </li>
-                  </ul>
-                </v-col>
-              </v-row>
-              <v-row>
-                <v-col style="flex-grow: 0">
-                  <div class="browser-logos">
-                    <img
-                      class="f1"
-                      src="https://raw.githubusercontent.com/vuejs/devtools/1b1d1d0ce62e78b5cd8e628c89b31b6ed6df7a73/packages/docs/src/public/logo-chrome.svg"
-                      width="64"
-                    />
-                    <img
-                      class="f2"
-                      src="https://raw.githubusercontent.com/vuejs/devtools/1b1d1d0ce62e78b5cd8e628c89b31b6ed6df7a73/packages/docs/src/public/logo-edge.png"
-                      width="64"
-                    />
-                    <img
-                      class="f3"
-                      src="https://raw.githubusercontent.com/vuejs/devtools/1b1d1d0ce62e78b5cd8e628c89b31b6ed6df7a73/packages/docs/src/public/logo-firefox.svg"
-                      width="64"
-                    />
-                  </div>
-                </v-col>
-                <v-col>
-                  Recommended browser extensions:
-                  <ul class="mt-1">
-                    <li>
-                      <a
-                        href="https://devtools.vuejs.org/guide/installation.html"
-                        target="_blank"
-                      >
-                        Vue Devtools
-                      </a>
-                    </li>
-                  </ul>
-                </v-col>
-              </v-row>
-            </div>
+                  <img
+                    class="f3"
+                    src="https://raw.githubusercontent.com/vuejs/devtools/1b1d1d0ce62e78b5cd8e628c89b31b6ed6df7a73/packages/docs/src/public/logo-firefox.svg"
+                    width="64"
+                  />
+                </div>
+              </v-col>
+              <v-col>
+                Recommended browser extensions:
+                <ul class="mt-1">
+                  <li>
+                    <a
+                      href="https://devtools.vuejs.org/guide/installation.html"
+                      target="_blank"
+                    >
+                      Vue Devtools
+                    </a>
+                  </li>
+                </ul>
+              </v-col>
+            </v-row>
           </v-card-text>
         </v-card>
       </v-col>
@@ -198,36 +166,31 @@
         <v-card>
           <v-card-title> Quick Links </v-card-title>
           <v-card-text>
-            <h2 class="headline font-weight-light mb-3">Documentation</h2>
-            <ul>
-              <li>
-                <a href="https://vuejs.org/guide/introduction">
-                  Vue Documentation
-                </a>
-              </li>
-              <li>
-                <a href="https://vitejs.dev/"> Vite Documentation </a>
-              </li>
-              <li>
-                <a href="https://vuetifyjs.com/en/getting-started/quick-start/">
-                  Vuetify Documentation
-                </a>
-              </li>
-              <li>
-                <a
-                  href="https://intellitect.github.io/Coalesce/stacks/vue/overview"
-                >
-                  Coalesce Documentation
-                </a>
-              </li>
-              <li>
-                <a
-                  href="https://intellitect.github.io/Coalesce/stacks/vue/coalesce-vue-vuetify/overview"
-                >
-                  Coalesce Vuetify Documentation
-                </a>
-              </li>
-            </ul>
+            <v-list density="compact" class="doc-links">
+              <v-list-item
+                title="Coalesce Documentation"
+                href="https://intellitect.github.io/Coalesce"
+                prepend-avatar="https://intellitect.github.io/Coalesce/coalesce-icon-color.svg"
+              >
+              </v-list-item>
+              <v-list-item
+                title="Vue Documentation"
+                href="https://vuejs.org/guide/introduction"
+                prepend-avatar="https://raw.githubusercontent.com/vitejs/vite/9885f6f113667c1e161dee5f30af1e91aeefa62f/docs/images/vue.svg"
+              >
+              </v-list-item>
+              <v-list-item
+                title="Vuetify Documentation"
+                href="https://vuetifyjs.com/en/"
+                prepend-avatar="https://cdn.vuetifyjs.com/docs/images/logos/vuetify-logo-v3-slim-light.svg"
+              ></v-list-item>
+              <v-list-item
+                title="Vite Documentation"
+                href="https://vitejs.dev/"
+                prepend-avatar="https://raw.githubusercontent.com/vitejs/vite/9885f6f113667c1e161dee5f30af1e91aeefa62f/docs/images/vite.svg"
+              >
+              </v-list-item>
+            </v-list>
             <v-divider class="my-3" />
             <h2 class="headline font-weight-light mb-3">Resources</h2>
             <ul>
@@ -251,12 +214,13 @@ defineProps<{ msg: string | null }>();
 </script>
 
 <!-- Add "scoped" attribute to limit CSS to this component only -->
-<style scoped lang="scss">
+<style lang="scss">
 .browser-logos {
   position: relative;
   width: 64px;
   height: 64px;
   margin: auto;
+
   img {
     position: absolute;
     top: 0;
@@ -265,30 +229,45 @@ defineProps<{ msg: string | null }>();
     animation-duration: 6s;
     animation-timing-function: ease-in-out;
   }
-}
 
-@keyframes fade {
-  0% {
-    opacity: 0;
-  }
-  20% {
-    opacity: 1;
-  }
-  33% {
-    opacity: 1;
+  @keyframes fade {
+    0% {
+      opacity: 0;
+    }
+
+    20% {
+      opacity: 1;
+    }
+
+    33% {
+      opacity: 1;
+    }
+
+    53% {
+      opacity: 0;
+    }
+
+    100% {
+      opacity: 0;
+    }
   }
-  53% {
-    opacity: 0;
+
+  .f2 {
+    animation-delay: -4s;
   }
-  100% {
-    opacity: 0;
+
+  .f3 {
+    animation-delay: -2s;
   }
 }
 
-.f2 {
-  animation-delay: -4s;
-}
-.f3 {
-  animation-delay: -2s;
+.doc-links {
+  .v-avatar {
+    border-radius: 0;
+  }
+
+  img {
+    object-fit: contain;
+  }
 }
 </style>
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/display/UserAvatar.vue b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/display/UserAvatar.vue
index 4d4b72461..d5587ed07 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/display/UserAvatar.vue
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/components/display/UserAvatar.vue
@@ -22,17 +22,14 @@
 </template>
 
 <script setup lang="ts">
-import {
-  //#if Identity
-  User,
-  //#endif
-  UserInfo,
-} from "@/models.g";
+import { User, UserInfo } from "@/models.g";
 //#if UserPictures
 import { UserViewModel } from "@/viewmodels.g";
 //#endif
 
-const props = defineProps<{ user: User | UserInfo }>();
+const props = defineProps<{
+  user: User | UserInfo;
+}>();
 
 const initials = computed(() => {
   const fullName = props.user.fullName;
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/composables/useTitle.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/composables/useTitle.ts
index b39c1330b..f4edeb87f 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/composables/useTitle.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/composables/useTitle.ts
@@ -37,5 +37,9 @@ export function useTitle(
       },
       { immediate: true, deep: true },
     );
+
+    onBeforeUnmount(() => {
+      document.title = titlePostfix;
+    });
   });
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/main.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/main.ts
index 092462090..e5afad0fa 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/main.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/main.ts
@@ -37,16 +37,22 @@ const vuetify = createVuetify({
     VAutocomplete: inputDefaults,
     VField: inputDefaults,
     VInput: inputDefaults,
-    VSwitch: { color: "primary" }, // https://github.com/vuetifyjs/vuetify/issues/16486
+    VSwitch: { color: "primary" },
   },
   theme: {
     themes: {
       light: {
-        colors: {},
+        colors: {
+          // TODO: Customize theme colors
+        },
       },
+      //#if DarkMode
       dark: {
-        colors: {},
+        colors: {
+          // TODO: Customize theme colors
+        },
       },
+      //#endif
     },
   },
 });
@@ -59,7 +65,7 @@ CoalesceAxiosClient.interceptors.response.use(undefined, (error) => {
     console.warn("Received 401 from API endpoint. Refreshing for sign-in.");
     window.location.reload();
     return new Promise<void>(() => {
-      /* Never resolving promise so failure doesn't momentarily propagate to UI */
+      /* Never resolving promise so failure doesn't momentarily propagate to UI before reload completes */
     });
   }
 });
@@ -74,9 +80,9 @@ Object.defineProperties(
   app.config.globalProperties,
   Object.getOwnPropertyDescriptors(userServiceProps),
 );
+
 app.use(router);
 app.use(vuetify);
 app.use(coalesceVuetify);
-app.mount("#app");
 
-// TODO: Appinsights frontend
+app.mount("#app");
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/metadata.g.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/metadata.g.ts
index 109f10027..a83199f71 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/metadata.g.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/metadata.g.ts
@@ -53,6 +53,28 @@ export const Permission = domain.enums.Permission = {
   },
   ]),
 }
+export const WidgetCategory = domain.enums.WidgetCategory = {
+  name: "WidgetCategory" as const,
+  displayName: "Widget Category",
+  type: "enum",
+  ...getEnumMeta<"Whizbangs"|"Sprecklesprockets"|"Discombobulators">([
+  {
+    value: 0,
+    strValue: "Whizbangs",
+    displayName: "Whizbangs",
+  },
+  {
+    value: 1,
+    strValue: "Sprecklesprockets",
+    displayName: "Sprecklesprockets",
+  },
+  {
+    value: 2,
+    strValue: "Discombobulators",
+    displayName: "Discombobulators",
+  },
+  ]),
+}
 export const AuditLog = domain.types.AuditLog = {
   name: "AuditLog" as const,
   displayName: "Audit Log",
@@ -234,11 +256,12 @@ export const AuditLogProperty = domain.types.AuditLogProperty = {
 export const Role = domain.types.Role = {
   name: "Role" as const,
   displayName: "Role",
+  description: "Roles are groups of permissions, analagous to job titles or functions.",
   get displayProp() { return this.props.name }, 
   type: "model",
   controllerRoute: "Role",
   get keyProp() { return this.props.id }, 
-  behaviorFlags: 0 as BehaviorFlags,
+  behaviorFlags: 7 as BehaviorFlags,
   props: {
     name: {
       name: "name",
@@ -249,23 +272,6 @@ export const Role = domain.types.Role = {
         required: val => (val != null && val !== '') || "Name is required.",
       }
     },
-    roleClaims: {
-      name: "roleClaims",
-      displayName: "Role Claims",
-      type: "collection",
-      itemType: {
-        name: "$collectionItem",
-        displayName: "",
-        role: "value",
-        type: "model",
-        get typeDef() { return (domain.types.RoleClaim as ModelType & { name: "RoleClaim" }) },
-      },
-      role: "collectionNavigation",
-      get foreignKey() { return (domain.types.RoleClaim as ModelType & { name: "RoleClaim" }).props.roleId as ForeignKeyProperty },
-      get inverseNavigation() { return (domain.types.RoleClaim as ModelType & { name: "RoleClaim" }).props.role as ModelReferenceNavigationProperty },
-      hidden: 1 as HiddenAreas,
-      dontSerialize: true,
-    },
     permissions: {
       name: "permissions",
       displayName: "Permissions",
@@ -278,8 +284,6 @@ export const Role = domain.types.Role = {
         get typeDef() { return Permission },
       },
       role: "value",
-      hidden: 3 as HiddenAreas,
-      dontSerialize: true,
     },
     id: {
       name: "id",
@@ -294,67 +298,10 @@ export const Role = domain.types.Role = {
   dataSources: {
   },
 }
-export const RoleClaim = domain.types.RoleClaim = {
-  name: "RoleClaim" as const,
-  displayName: "Role Claim",
-  get displayProp() { return this.props.id }, 
-  type: "model",
-  controllerRoute: "RoleClaim",
-  get keyProp() { return this.props.id }, 
-  behaviorFlags: 0 as BehaviorFlags,
-  props: {
-    role: {
-      name: "role",
-      displayName: "Role",
-      type: "model",
-      get typeDef() { return (domain.types.Role as ModelType & { name: "Role" }) },
-      role: "referenceNavigation",
-      get foreignKey() { return (domain.types.RoleClaim as ModelType & { name: "RoleClaim" }).props.roleId as ForeignKeyProperty },
-      get principalKey() { return (domain.types.Role as ModelType & { name: "Role" }).props.id as PrimaryKeyProperty },
-      get inverseNavigation() { return (domain.types.Role as ModelType & { name: "Role" }).props.roleClaims as ModelCollectionNavigationProperty },
-      dontSerialize: true,
-    },
-    id: {
-      name: "id",
-      displayName: "Id",
-      type: "number",
-      role: "primaryKey",
-      hidden: 3 as HiddenAreas,
-    },
-    roleId: {
-      name: "roleId",
-      displayName: "Role Id",
-      type: "string",
-      role: "foreignKey",
-      get principalKey() { return (domain.types.Role as ModelType & { name: "Role" }).props.id as PrimaryKeyProperty },
-      get principalType() { return (domain.types.Role as ModelType & { name: "Role" }) },
-      get navigationProp() { return (domain.types.RoleClaim as ModelType & { name: "RoleClaim" }).props.role as ModelReferenceNavigationProperty },
-      hidden: 3 as HiddenAreas,
-      rules: {
-        required: val => (val != null && val !== '') || "Role is required.",
-      }
-    },
-    claimType: {
-      name: "claimType",
-      displayName: "Claim Type",
-      type: "string",
-      role: "value",
-    },
-    claimValue: {
-      name: "claimValue",
-      displayName: "Claim Value",
-      type: "string",
-      role: "value",
-    },
-  },
-  methods: {
-  },
-  dataSources: {
-  },
-}
 export const User = domain.types.User = {
   name: "User" as const,
   displayName: "User",
+  description: "A user profile within the application.",
   get displayProp() { return this.props.id }, 
   type: "model",
   controllerRoute: "User",
@@ -382,27 +329,26 @@ export const User = domain.types.User = {
       type: "string",
       role: "value",
     },
-    accessFailedCount: {
-      name: "accessFailedCount",
-      displayName: "Access Failed Count",
-      type: "number",
+    email: {
+      name: "email",
+      displayName: "Email",
+      type: "string",
       role: "value",
-      dontSerialize: true,
     },
     lockoutEnd: {
       name: "lockoutEnd",
       displayName: "Lockout End",
+      description: "If set, the user will be blocked from signing in until this date.",
       type: "date",
       dateKind: "datetime",
       role: "value",
-      dontSerialize: true,
     },
     lockoutEnabled: {
       name: "lockoutEnabled",
       displayName: "Lockout Enabled",
+      description: "If enabled, the user can be locked out.",
       type: "boolean",
       role: "value",
-      dontSerialize: true,
     },
     userRoles: {
       name: "userRoles",
@@ -429,6 +375,16 @@ export const User = domain.types.User = {
       },
       dontSerialize: true,
     },
+    effectivePermissions: {
+      name: "effectivePermissions",
+      displayName: "Effective Permissions",
+      description: "A summary of the effective permissions of the user, derived from their current roles.",
+      type: "string",
+      subtype: "multiline",
+      role: "value",
+      hidden: 1 as HiddenAreas,
+      dontSerialize: true,
+    },
     id: {
       name: "id",
       displayName: "Id",
@@ -550,6 +506,113 @@ export const UserRole = domain.types.UserRole = {
     },
   },
 }
+export const Widget = domain.types.Widget = {
+  name: "Widget" as const,
+  displayName: "Widget",
+  description: "A sample model provided by the Coalesce template. Remove this when you start building your real data model.",
+  get displayProp() { return this.props.name }, 
+  type: "model",
+  controllerRoute: "Widget",
+  get keyProp() { return this.props.widgetId }, 
+  behaviorFlags: 7 as BehaviorFlags,
+  props: {
+    widgetId: {
+      name: "widgetId",
+      displayName: "Widget Id",
+      type: "number",
+      role: "primaryKey",
+      hidden: 3 as HiddenAreas,
+    },
+    name: {
+      name: "name",
+      displayName: "Name",
+      type: "string",
+      role: "value",
+      rules: {
+        required: val => (val != null && val !== '') || "Name is required.",
+      }
+    },
+    category: {
+      name: "category",
+      displayName: "Category",
+      type: "enum",
+      get typeDef() { return WidgetCategory },
+      role: "value",
+      rules: {
+        required: val => val != null || "Category is required.",
+      }
+    },
+    inventedOn: {
+      name: "inventedOn",
+      displayName: "Invented On",
+      type: "date",
+      dateKind: "datetime",
+      role: "value",
+    },
+    modifiedById: {
+      name: "modifiedById",
+      displayName: "Modified By Id",
+      type: "string",
+      role: "foreignKey",
+      get principalKey() { return (domain.types.User as ModelType & { name: "User" }).props.id as PrimaryKeyProperty },
+      get principalType() { return (domain.types.User as ModelType & { name: "User" }) },
+      get navigationProp() { return (domain.types.Widget as ModelType & { name: "Widget" }).props.modifiedBy as ModelReferenceNavigationProperty },
+      hidden: 3 as HiddenAreas,
+      dontSerialize: true,
+    },
+    createdById: {
+      name: "createdById",
+      displayName: "Created By Id",
+      type: "string",
+      role: "foreignKey",
+      get principalKey() { return (domain.types.User as ModelType & { name: "User" }).props.id as PrimaryKeyProperty },
+      get principalType() { return (domain.types.User as ModelType & { name: "User" }) },
+      get navigationProp() { return (domain.types.Widget as ModelType & { name: "Widget" }).props.createdBy as ModelReferenceNavigationProperty },
+      hidden: 3 as HiddenAreas,
+      dontSerialize: true,
+    },
+    createdBy: {
+      name: "createdBy",
+      displayName: "Created By",
+      type: "model",
+      get typeDef() { return (domain.types.User as ModelType & { name: "User" }) },
+      role: "referenceNavigation",
+      get foreignKey() { return (domain.types.Widget as ModelType & { name: "Widget" }).props.createdById as ForeignKeyProperty },
+      get principalKey() { return (domain.types.User as ModelType & { name: "User" }).props.id as PrimaryKeyProperty },
+      dontSerialize: true,
+    },
+    createdOn: {
+      name: "createdOn",
+      displayName: "Created On",
+      type: "date",
+      dateKind: "datetime",
+      role: "value",
+      dontSerialize: true,
+    },
+    modifiedBy: {
+      name: "modifiedBy",
+      displayName: "Modified By",
+      type: "model",
+      get typeDef() { return (domain.types.User as ModelType & { name: "User" }) },
+      role: "referenceNavigation",
+      get foreignKey() { return (domain.types.Widget as ModelType & { name: "Widget" }).props.modifiedById as ForeignKeyProperty },
+      get principalKey() { return (domain.types.User as ModelType & { name: "User" }).props.id as PrimaryKeyProperty },
+      dontSerialize: true,
+    },
+    modifiedOn: {
+      name: "modifiedOn",
+      displayName: "Modified On",
+      type: "date",
+      dateKind: "datetime",
+      role: "value",
+      dontSerialize: true,
+    },
+  },
+  methods: {
+  },
+  dataSources: {
+  },
+}
 export const UserInfo = domain.types.UserInfo = {
   name: "UserInfo" as const,
   displayName: "User Info",
@@ -560,18 +623,12 @@ export const UserInfo = domain.types.UserInfo = {
       displayName: "Id",
       type: "string",
       role: "value",
-      rules: {
-        required: val => (val != null && val !== '') || "Id is required.",
-      }
     },
     userName: {
       name: "userName",
       displayName: "User Name",
       type: "string",
       role: "value",
-      rules: {
-        required: val => (val != null && val !== '') || "User Name is required.",
-      }
     },
     fullName: {
       name: "fullName",
@@ -633,15 +690,16 @@ interface AppDomain extends Domain {
   enums: {
     AuditEntryState: typeof AuditEntryState
     Permission: typeof Permission
+    WidgetCategory: typeof WidgetCategory
   }
   types: {
     AuditLog: typeof AuditLog
     AuditLogProperty: typeof AuditLogProperty
     Role: typeof Role
-    RoleClaim: typeof RoleClaim
     User: typeof User
     UserInfo: typeof UserInfo
     UserRole: typeof UserRole
+    Widget: typeof Widget
   }
   services: {
     SecurityService: typeof SecurityService
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/models.g.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/models.g.ts
index a50e09a43..a1a2eeb7e 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/models.g.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/models.g.ts
@@ -19,6 +19,13 @@ export enum Permission {
 }
 
 
+export enum WidgetCategory {
+  Whizbangs = 0,
+  Sprecklesprockets = 1,
+  Discombobulators = 2,
+}
+
+
 export interface AuditLog extends Model<typeof metadata.AuditLog> {
   userId: string | null
   user: User | null
@@ -86,7 +93,6 @@ export class AuditLogProperty {
 
 export interface Role extends Model<typeof metadata.Role> {
   name: string | null
-  roleClaims: RoleClaim[] | null
   permissions: Permission[] | null
   id: string | null
 }
@@ -111,42 +117,21 @@ export class Role {
 }
 
 
-export interface RoleClaim extends Model<typeof metadata.RoleClaim> {
-  role: Role | null
-  id: number | null
-  roleId: string | null
-  claimType: string | null
-  claimValue: string | null
-}
-export class RoleClaim {
-  
-  /** Mutates the input object and its descendents into a valid RoleClaim implementation. */
-  static convert(data?: Partial<RoleClaim>): RoleClaim {
-    return convertToModel(data || {}, metadata.RoleClaim) 
-  }
-  
-  /** Maps the input object and its descendents to a new, valid RoleClaim implementation. */
-  static map(data?: Partial<RoleClaim>): RoleClaim {
-    return mapToModel(data || {}, metadata.RoleClaim) 
-  }
-  
-  static [Symbol.hasInstance](x: any) { return x?.$metadata === metadata.RoleClaim; }
-  
-  /** Instantiate a new RoleClaim, optionally basing it on the given data. */
-  constructor(data?: Partial<RoleClaim> | {[k: string]: any}) {
-    Object.assign(this, RoleClaim.map(data || {}));
-  }
-}
-
-
 export interface User extends Model<typeof metadata.User> {
   fullName: string | null
   photoMD5: string | null
   userName: string | null
-  accessFailedCount: number | null
+  email: string | null
+  
+  /** If set, the user will be blocked from signing in until this date. */
   lockoutEnd: Date | null
+  
+  /** If enabled, the user can be locked out. */
   lockoutEnabled: boolean | null
   userRoles: UserRole[] | null
+  
+  /** A summary of the effective permissions of the user, derived from their current roles. */
+  effectivePermissions: string | null
   id: string | null
 }
 export class User {
@@ -206,6 +191,39 @@ export namespace UserRole {
 }
 
 
+export interface Widget extends Model<typeof metadata.Widget> {
+  widgetId: number | null
+  name: string | null
+  category: WidgetCategory | null
+  inventedOn: Date | null
+  modifiedBy: User | null
+  modifiedById: string | null
+  modifiedOn: Date | null
+  createdBy: User | null
+  createdById: string | null
+  createdOn: Date | null
+}
+export class Widget {
+  
+  /** Mutates the input object and its descendents into a valid Widget implementation. */
+  static convert(data?: Partial<Widget>): Widget {
+    return convertToModel(data || {}, metadata.Widget) 
+  }
+  
+  /** Maps the input object and its descendents to a new, valid Widget implementation. */
+  static map(data?: Partial<Widget>): Widget {
+    return mapToModel(data || {}, metadata.Widget) 
+  }
+  
+  static [Symbol.hasInstance](x: any) { return x?.$metadata === metadata.Widget; }
+  
+  /** Instantiate a new Widget, optionally basing it on the given data. */
+  constructor(data?: Partial<Widget> | {[k: string]: any}) {
+    Object.assign(this, Widget.map(data || {}));
+  }
+}
+
+
 export interface UserInfo extends Model<typeof metadata.UserInfo> {
   id: string | null
   userName: string | null
@@ -238,14 +256,15 @@ declare module "coalesce-vue/lib/model" {
   interface EnumTypeLookup {
     AuditEntryState: AuditEntryState
     Permission: Permission
+    WidgetCategory: WidgetCategory
   }
   interface ModelTypeLookup {
     AuditLog: AuditLog
     AuditLogProperty: AuditLogProperty
     Role: Role
-    RoleClaim: RoleClaim
     User: User
     UserInfo: UserInfo
     UserRole: UserRole
+    Widget: Widget
   }
 }
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/router.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/router.ts
index 94c17df98..4d04197da 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/router.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/router.ts
@@ -10,7 +10,7 @@ import {
 import { Permission } from "./models.g";
 //#endif
 
-export default createRouter({
+const router = createRouter({
   history: createWebHistory(),
   routes: [
     {
@@ -87,3 +87,40 @@ function titledAdminPage<
     },
   });
 }
+
+//#if AppInsights
+// Azure Monitor Application Insights configuration
+let flushPageView: Function | undefined;
+router.beforeEach((to, from) => {
+  if (to.path != from.path) {
+    // If there's a previous page view still unsent,
+    // flush it now before the new page takes over and changes
+    // the window.location and document.title.
+    // This only happens when a user is clicking through pages very fast.
+    flushPageView?.();
+  }
+});
+router.afterEach((to, from) => {
+  if (to.path != from.path) {
+    const time = new Date();
+    let hasSent = false;
+
+    flushPageView = () => {
+      if (hasSent) return;
+      hasSent = true;
+      //@ts-expect-error appInsights from backend JavaScriptSnippet; no types available.
+      window.appInsights?.trackPageView({
+        startTime: time,
+        properties: { duration: 0 },
+      });
+    };
+
+    // Wait a moment before sending the page view
+    // so that the page has a chance to update `document.title`,
+    // which makes the timeline easier to read in app insights.
+    setTimeout(flushPageView, 2000);
+  }
+});
+//#endif
+
+export default router;
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/user-service.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/user-service.ts
index aaae6b250..764f376fc 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/user-service.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/user-service.ts
@@ -8,6 +8,12 @@ import {
 
 const securityService = new SecurityServiceViewModel();
 securityService.whoAmI.setConcurrency("debounce");
+//#if AppInsights
+securityService.whoAmI.onFulfilled(() => {
+  //@ts-expect-error AppInsights imported from backend JavaScriptSnippet; no types available.
+  window.appInsights?.setAuthenticatedUserContext(userInfo.value.userName);
+});
+//#endif
 
 /** Properties about the currently authenticated user */
 export const userInfo = computed(() => {
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/viewmodels.g.ts b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/viewmodels.g.ts
index 2ad176060..cb380dcc1 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/viewmodels.g.ts
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/viewmodels.g.ts
@@ -67,18 +67,11 @@ export class AuditLogPropertyListViewModel extends ListViewModel<$models.AuditLo
 
 export interface RoleViewModel extends $models.Role {
   name: string | null;
-  get roleClaims(): ViewModelCollection<RoleClaimViewModel, $models.RoleClaim>;
-  set roleClaims(value: (RoleClaimViewModel | $models.RoleClaim)[] | null);
   permissions: $models.Permission[] | null;
   id: string | null;
 }
 export class RoleViewModel extends ViewModel<$models.Role, $apiClients.RoleApiClient, string> implements $models.Role  {
   
-  
-  public addToRoleClaims(initialData?: DeepPartial<$models.RoleClaim> | null) {
-    return this.$addChild('roleClaims', initialData) as RoleClaimViewModel
-  }
-  
   constructor(initialData?: DeepPartial<$models.Role> | null) {
     super($metadata.Role, new $apiClients.RoleApiClient(), initialData)
   }
@@ -93,39 +86,22 @@ export class RoleListViewModel extends ListViewModel<$models.Role, $apiClients.R
 }
 
 
-export interface RoleClaimViewModel extends $models.RoleClaim {
-  get role(): RoleViewModel | null;
-  set role(value: RoleViewModel | $models.Role | null);
-  id: number | null;
-  roleId: string | null;
-  claimType: string | null;
-  claimValue: string | null;
-}
-export class RoleClaimViewModel extends ViewModel<$models.RoleClaim, $apiClients.RoleClaimApiClient, number> implements $models.RoleClaim  {
-  
-  constructor(initialData?: DeepPartial<$models.RoleClaim> | null) {
-    super($metadata.RoleClaim, new $apiClients.RoleClaimApiClient(), initialData)
-  }
-}
-defineProps(RoleClaimViewModel, $metadata.RoleClaim)
-
-export class RoleClaimListViewModel extends ListViewModel<$models.RoleClaim, $apiClients.RoleClaimApiClient, RoleClaimViewModel> {
-  
-  constructor() {
-    super($metadata.RoleClaim, new $apiClients.RoleClaimApiClient())
-  }
-}
-
-
 export interface UserViewModel extends $models.User {
   fullName: string | null;
   photoMD5: string | null;
   userName: string | null;
-  accessFailedCount: number | null;
+  email: string | null;
+  
+  /** If set, the user will be blocked from signing in until this date. */
   lockoutEnd: Date | null;
+  
+  /** If enabled, the user can be locked out. */
   lockoutEnabled: boolean | null;
   get userRoles(): ViewModelCollection<UserRoleViewModel, $models.UserRole>;
   set userRoles(value: (UserRoleViewModel | $models.UserRole)[] | null);
+  
+  /** A summary of the effective permissions of the user, derived from their current roles. */
+  effectivePermissions: string | null;
   id: string | null;
 }
 export class UserViewModel extends ViewModel<$models.User, $apiClients.UserApiClient, string> implements $models.User  {
@@ -191,6 +167,36 @@ export class UserRoleListViewModel extends ListViewModel<$models.UserRole, $apiC
 }
 
 
+export interface WidgetViewModel extends $models.Widget {
+  widgetId: number | null;
+  name: string | null;
+  category: $models.WidgetCategory | null;
+  inventedOn: Date | null;
+  get modifiedBy(): UserViewModel | null;
+  set modifiedBy(value: UserViewModel | $models.User | null);
+  modifiedById: string | null;
+  modifiedOn: Date | null;
+  get createdBy(): UserViewModel | null;
+  set createdBy(value: UserViewModel | $models.User | null);
+  createdById: string | null;
+  createdOn: Date | null;
+}
+export class WidgetViewModel extends ViewModel<$models.Widget, $apiClients.WidgetApiClient, number> implements $models.Widget  {
+  
+  constructor(initialData?: DeepPartial<$models.Widget> | null) {
+    super($metadata.Widget, new $apiClients.WidgetApiClient(), initialData)
+  }
+}
+defineProps(WidgetViewModel, $metadata.Widget)
+
+export class WidgetListViewModel extends ListViewModel<$models.Widget, $apiClients.WidgetApiClient, WidgetViewModel> {
+  
+  constructor() {
+    super($metadata.Widget, new $apiClients.WidgetApiClient())
+  }
+}
+
+
 export class SecurityServiceViewModel extends ServiceViewModel<typeof $metadata.SecurityService, $apiClients.SecurityServiceApiClient> {
   
   public get whoAmI() {
@@ -214,17 +220,17 @@ const viewModelTypeLookup = ViewModel.typeLookup = {
   AuditLog: AuditLogViewModel,
   AuditLogProperty: AuditLogPropertyViewModel,
   Role: RoleViewModel,
-  RoleClaim: RoleClaimViewModel,
   User: UserViewModel,
   UserRole: UserRoleViewModel,
+  Widget: WidgetViewModel,
 }
 const listViewModelTypeLookup = ListViewModel.typeLookup = {
   AuditLog: AuditLogListViewModel,
   AuditLogProperty: AuditLogPropertyListViewModel,
   Role: RoleListViewModel,
-  RoleClaim: RoleClaimListViewModel,
   User: UserListViewModel,
   UserRole: UserRoleListViewModel,
+  Widget: WidgetListViewModel,
 }
 const serviceViewModelTypeLookup = ServiceViewModel.typeLookup = {
   SecurityService: SecurityServiceViewModel,
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/Admin.vue b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/Admin.vue
index d7fd90339..c90f3e598 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/Admin.vue
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/Admin.vue
@@ -1,28 +1,67 @@
 <template>
-  <v-container style="max-width: 600px">
+  <v-container style="max-width: 800px">
     <v-card>
-      <v-card-title> Coalesce Admin Pages </v-card-title>
-      <v-card-text class="black--text">
-        <ul>
-          <li v-for="typeMeta in adminTypes" :key="typeMeta.name">
-            <router-link
-              :to="{
-                name: 'coalesce-admin-list',
-                params: { type: typeMeta.name },
-              }"
-            >
-              {{ typeMeta.displayName }}
-            </router-link>
-          </li>
-        </ul>
+      <v-card-title> Coalesce Admin Tables </v-card-title>
+
+      <v-card-text>
+        <v-list density="compact">
+          <v-list-item
+            v-for="type in adminTypes"
+            :key="type.name"
+            :title="type.displayName"
+            :subtitle="type.description"
+            :to="{
+              name: 'coalesce-admin-list',
+              params: { type: type.name },
+            }"
+          >
+            <template #prepend>
+              <v-avatar color="surface-variant" class="font-weight-bold ml-n1">
+                {{
+                  type.displayName
+                    .split(" ")
+                    .map((w) => w[0])
+                    .join("")
+                    .slice(0, 4)
+                }}
+              </v-avatar>
+            </template>
+          </v-list-item>
+        </v-list>
       </v-card-text>
+    </v-card>
+    <br />
+    <v-card>
       <v-card-title> Other Pages </v-card-title>
+
       <v-card-text>
-        <ul>
-          <li>
-            <a href="/coalesce-security"> Coalesce Security Overview </a>
-          </li>
-        </ul>
+        <v-list compact>
+          <v-list-item
+            title="Coalesce Security Overview"
+            subtitle="An overview of how each property, method, and endpoint is served by Coalesce."
+            href="/coalesce-security"
+            prepend-icon="fa fa-lock-open"
+          >
+          </v-list-item>
+          <!--#if AuditLogs  -->
+          <v-list-item
+            title="Audit Logs"
+            subtitle="Logs of each data change made in the application."
+            to="/admin/audit"
+            prepend-icon="fa fa-clipboard-list"
+          >
+          </v-list-item>
+          <!--#endif  -->
+          <!--#if OpenAPI  -->
+          <v-list-item
+            title="Swagger UI"
+            subtitle="View OpenAPI/Swagger documentation for the application."
+            href="/swagger"
+            prepend-icon="fa fa-code"
+          >
+          </v-list-item>
+          <!--#endif  -->
+        </v-list>
       </v-card-text>
     </v-card>
   </v-container>
@@ -30,9 +69,20 @@
 
 <script setup lang="ts">
 import $metadata from "@/metadata.g";
+import { Domain, ModelType } from "coalesce-vue";
+
+const excludedTypes: Array<keyof typeof $metadata.types> = [
+  //#if AuditLogs
+  "AuditLog",
+  // "AuditLogProperty",
+  //#endif
+  //#if Identity
+  "UserRole",
+  //#endif
+];
 
-const adminTypes = Object.values($metadata.types).filter(
-  // @ts-ignore may be errors if the project has only model or only object types
-  (t) => t.type == "model",
+const adminTypes = Object.values(($metadata as Domain).types).filter(
+  //@ts-ignore may be errors if the project has only model or only object types
+  (t): t is ModelType => t.type == "model" && !excludedTypes.includes(t.name),
 );
 </script>
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/WidgetEdit.vue b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/WidgetEdit.vue
index 76d7dbecf..4d230e6dd 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/WidgetEdit.vue
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/WidgetEdit.vue
@@ -51,7 +51,7 @@ import { useBindKeyToRouteOnCreate } from "coalesce-vue";
 
 const props = defineProps<{ id?: number }>();
 
-useTitle(() => item.name);
+useTitle(() => (props.id ? item.name || "Loading" : "Create Widget"));
 const form = useForm();
 
 // The properties on the generated ViewModels are already reactive.
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/Forbidden.vue b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/Forbidden.vue
index 44a8a2d0d..b3cf7d4a3 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/Forbidden.vue
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/Forbidden.vue
@@ -1,55 +1,46 @@
 <template>
-  <v-container fluid>
-    <v-row style="margin-top: 10vh">
-      <v-col>
-        <h1 class="text-center text-h1 font-weight-thin">Forbidden</h1>
-        <h2 class="text-center text-h4 font-weight-thin mt-5">
-          User '{{ $userInfo.userName }}' is not permitted to access the
-          requested page.
-        </h2>
+  <v-empty-state headline="Forbidden" class="justify-start mt-16">
+    <template #title>
+      {{ $userInfo.userName }} is not permitted to access this page.
+    </template>
 
-        <v-row
-          justify="space-between"
-          style="max-width: 600px"
-          class="mx-auto mt-10"
-        >
-          <v-btn
-            size="x-large"
-            @click="$router.back()"
-            variant="outlined"
-            color="primary"
-          >
-            <v-icon start>fa fa-arrow-left</v-icon> Back
-          </v-btn>
-          <v-btn size="x-large" to="/" variant="outlined" color="primary">
-            <v-icon start>fa fa-home</v-icon> Home
-          </v-btn>
-          <v-btn
-            size="x-large"
-            :href="logOutUrl"
-            variant="outlined"
-            color="primary"
-          >
-            <v-icon start>fa fa-sign-out</v-icon> Switch Account
-          </v-btn>
-        </v-row>
+    <template #actions>
+      <v-btn
+        size="x-large"
+        @click="$router.back()"
+        variant="outlined"
+        color="primary"
+      >
+        <v-icon start>fa fa-arrow-left</v-icon> Back
+      </v-btn>
+      <v-btn size="x-large" to="/" variant="outlined" color="primary">
+        <v-icon start>fa fa-home</v-icon> Home
+      </v-btn>
+      <v-btn
+        size="x-large"
+        :href="logOutUrl"
+        variant="outlined"
+        color="primary"
+      >
+        <v-icon start>fa fa-sign-out</v-icon> Sign Out
+      </v-btn>
+    </template>
 
-        <!-- This is deliberately off the bottom of the screen for mild obscurity -->
-        <h3
-          class="text-center text-body-2 my-3 font-weight-light"
-          style="position: absolute; top: 100vh; left: 0; right: 0"
-        >
-          User needs at least one of these required permissions:
-          <br />
-          {{
-            permissions
-              ?.map((p) => PermissionMeta.valueLookup[p].displayName)
-              .join(", ")
-          }}
-        </h3>
-      </v-col>
-    </v-row>
-  </v-container>
+    <template #text>
+      <!-- This is deliberately off the bottom of the screen for mild obscurity -->
+      <h3
+        v-if="permissions?.length"
+        class="text-center text-body-2 my-3 font-weight-light"
+      >
+        Required permissions:
+        {{
+          permissions
+            ?.map((p) => PermissionMeta.valueLookup[p].displayName)
+            .join(", ")
+        }}
+      </h3>
+    </template>
+  </v-empty-state>
 </template>
 
 <script lang="ts" setup>
@@ -60,7 +51,7 @@ const props = defineProps<{ permissions?: Permission[] }>();
 
 const logOutUrl = computed(
   () =>
-    "/Account/LogOff?ReturnUrl=" +
+    "/Home/SignOut?ReturnUrl=" +
     encodeURIComponent(
       window.location.href.replace(window.location.origin, ""),
     ),
diff --git a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/NotFound.vue b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/NotFound.vue
index 39d9c63c8..8d1f96444 100644
--- a/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/NotFound.vue
+++ b/templates/Coalesce.Vue.Template/content/Coalesce.Starter.Vue.Web/src/views/errors/NotFound.vue
@@ -1,9 +1,4 @@
 <template>
-  <v-container fluid>
-    <v-row style="margin-top: 10vh">
-      <v-col>
-        <h1 class="text-center text-h1 font-weight-thin">Not Found</h1>
-      </v-col>
-    </v-row>
-  </v-container>
+  <v-empty-state headline="Not Found" class="justify-start mt-16">
+  </v-empty-state>
 </template>
diff --git a/templates/Coalesce.Vue.Template/content/Directory.Build.props b/templates/Coalesce.Vue.Template/content/Directory.Build.props
index aec664bb8..05dad50c7 100644
--- a/templates/Coalesce.Vue.Template/content/Directory.Build.props
+++ b/templates/Coalesce.Vue.Template/content/Directory.Build.props
@@ -11,9 +11,7 @@
     <CoalesceVersion>5.0.0-ci.20240828.1</CoalesceVersion>
 
     <!--#if (KeepTemplateOnly) -->
-    <DefineConstants>
-      KeepTemplateOnly;AppInsights;OpenAPI;Identity;MicrosoftAuth;GoogleAuth;AuditLogs;UserPictures;TrackingBase;ExampleModel;
-    </DefineConstants>
+    <DefineConstants>KeepTemplateOnly;AppInsights;OpenAPI;Identity;MicrosoftAuth;GoogleAuth;AuditLogs;UserPictures;TrackingBase;ExampleModel</DefineConstants>
     <!--#endif -->
   </PropertyGroup>
 </Project>