@jgardner04/ghost-mcp-server 1.13.1 → 1.13.3

package/src/services/ghostServiceImproved.js

@@ -1,5 +1,4 @@
 import GhostAdminAPI from '@tryghost/admin-api';
-import sanitizeHtml from 'sanitize-html';
 import dotenv from 'dotenv';
 import { promises as fs } from 'fs';
 import {
@@ -12,6 +11,7 @@ import {
   retryWithBackoff,
 } from '../errors/index.js';
 import { createContextLogger } from '../utils/logger.js';
+import { sanitizeNqlValue } from '../utils/nqlSanitizer.js';
 
 dotenv.config();
 
@@ -118,6 +118,30 @@ const handleApiRequest = async (resource, action, data = {}, options = {}, confi
  * Input validation helpers
  */
 const validators = {
+  validateScheduledStatus(data, resourceLabel = 'Resource') {
+    const errors = [];
+
+    if (data.status === 'scheduled' && !data.published_at) {
+      errors.push({
+        field: 'published_at',
+        message: 'published_at is required when status is scheduled',
+      });
+    }
+
+    if (data.published_at) {
+      const publishDate = new Date(data.published_at);
+      if (isNaN(publishDate.getTime())) {
+        errors.push({ field: 'published_at', message: 'Invalid date format' });
+      } else if (data.status === 'scheduled' && publishDate <= new Date()) {
+        errors.push({ field: 'published_at', message: 'Scheduled date must be in the future' });
+      }
+    }
+
+    if (errors.length > 0) {
+      throw new ValidationError(`${resourceLabel} validation failed`, errors);
+    }
+  },
+
   validatePostData(postData) {
     const errors = [];
 
@@ -136,25 +160,11 @@ const validators = {
       });
     }
 
-    if (postData.status === 'scheduled' && !postData.published_at) {
-      errors.push({
-        field: 'published_at',
-        message: 'published_at is required when status is scheduled',
-      });
-    }
-
-    if (postData.published_at) {
-      const publishDate = new Date(postData.published_at);
-      if (isNaN(publishDate.getTime())) {
-        errors.push({ field: 'published_at', message: 'Invalid date format' });
-      } else if (postData.status === 'scheduled' && publishDate <= new Date()) {
-        errors.push({ field: 'published_at', message: 'Scheduled date must be in the future' });
-      }
-    }
-
     if (errors.length > 0) {
       throw new ValidationError('Post validation failed', errors);
     }
+
+    this.validateScheduledStatus(postData, 'Post');
   },
 
   validateTagData(tagData) {
@@ -228,25 +238,11 @@ const validators = {
       });
     }
 
-    if (pageData.status === 'scheduled' && !pageData.published_at) {
-      errors.push({
-        field: 'published_at',
-        message: 'published_at is required when status is scheduled',
-      });
-    }
-
-    if (pageData.published_at) {
-      const publishDate = new Date(pageData.published_at);
-      if (isNaN(publishDate.getTime())) {
-        errors.push({ field: 'published_at', message: 'Invalid date format' });
-      } else if (pageData.status === 'scheduled' && publishDate <= new Date()) {
-        errors.push({ field: 'published_at', message: 'Scheduled date must be in the future' });
-      }
-    }
-
     if (errors.length > 0) {
       throw new ValidationError('Page validation failed', errors);
     }
+
+    this.validateScheduledStatus(pageData, 'Page');
   },
 
   validateNewsletterData(newsletterData) {
@@ -262,6 +258,53 @@ const validators = {
   },
 };
 
+/**
+ * Shared CRUD helper: read a single resource by ID with 404→NotFoundError handling
+ */
+async function readResource(resource, id, label, options = {}) {
+  if (!id) throw new ValidationError(`${label} ID is required`);
+  try {
+    return await handleApiRequest(resource, 'read', { id }, options);
+  } catch (error) {
+    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
+      throw new NotFoundError(label, id);
+    }
+    throw error;
+  }
+}
+
+/**
+ * Shared CRUD helper: update a resource with optimistic concurrency control (OCC)
+ * Reads the current version, merges updated_at, then edits.
+ */
+async function updateWithOCC(resource, id, updateData, options = {}, label = resource) {
+  const existing = await readResource(resource, id, label);
+  const editData = { ...updateData, updated_at: existing.updated_at };
+  try {
+    return await handleApiRequest(resource, 'edit', { id, ...editData }, options);
+  } catch (error) {
+    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
+      throw new NotFoundError(label, id);
+    }
+    throw error;
+  }
+}
+
+/**
+ * Shared CRUD helper: delete a resource by ID with 404→NotFoundError handling
+ */
+async function deleteResource(resource, id, label) {
+  if (!id) throw new ValidationError(`${label} ID is required for deletion`);
+  try {
+    return await handleApiRequest(resource, 'delete', { id });
+  } catch (error) {
+    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
+      throw new NotFoundError(label, id);
+    }
+    throw error;
+  }
+}
+
 /**
  * Service functions with enhanced error handling
  */
@@ -285,48 +328,7 @@ export async function createPost(postData, options = { source: 'html' }) {
     ...postData,
   };
 
-  // Sanitize HTML content if provided
-  if (dataWithDefaults.html) {
-    // Use proper HTML sanitization library to prevent XSS
-    dataWithDefaults.html = sanitizeHtml(dataWithDefaults.html, {
-      allowedTags: [
-        'h1',
-        'h2',
-        'h3',
-        'h4',
-        'h5',
-        'h6',
-        'blockquote',
-        'p',
-        'a',
-        'ul',
-        'ol',
-        'nl',
-        'li',
-        'b',
-        'i',
-        'strong',
-        'em',
-        'strike',
-        'code',
-        'hr',
-        'br',
-        'div',
-        'span',
-        'img',
-        'pre',
-      ],
-      allowedAttributes: {
-        a: ['href', 'title'],
-        img: ['src', 'alt', 'title', 'width', 'height'],
-        '*': ['class', 'id'],
-      },
-      allowedSchemes: ['http', 'https', 'mailto'],
-      allowedSchemesByTag: {
-        img: ['http', 'https', 'data'],
-      },
-    });
-  }
+  // SECURITY: HTML must be sanitized before reaching this function. See htmlContentSchema in schemas/common.js
 
   try {
     return await handleApiRequest('posts', 'add', dataWithDefaults, options);
@@ -346,54 +348,20 @@ export async function updatePost(postId, updateData, options = {}) {
     throw new ValidationError('Post ID is required for update');
   }
 
-  // Get the current post first to ensure it exists
-  try {
-    const existingPost = await handleApiRequest('posts', 'read', { id: postId });
-
-    // Merge with existing data
-    const mergedData = {
-      ...existingPost,
-      ...updateData,
-      updated_at: existingPost.updated_at, // Required for Ghost API
-    };
-
-    return await handleApiRequest('posts', 'edit', mergedData, { id: postId, ...options });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Post', postId);
-    }
-    throw error;
+  // Validate scheduled status if status is being updated
+  if (updateData.status) {
+    validators.validateScheduledStatus(updateData, 'Post');
   }
+
+  return updateWithOCC('posts', postId, updateData, options, 'Post');
 }
 
 export async function deletePost(postId) {
-  if (!postId) {
-    throw new ValidationError('Post ID is required for deletion');
-  }
-
-  try {
-    return await handleApiRequest('posts', 'delete', { id: postId });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Post', postId);
-    }
-    throw error;
-  }
+  return deleteResource('posts', postId, 'Post');
 }
 
 export async function getPost(postId, options = {}) {
-  if (!postId) {
-    throw new ValidationError('Post ID is required');
-  }
-
-  try {
-    return await handleApiRequest('posts', 'read', { id: postId }, options);
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Post', postId);
-    }
-    throw error;
-  }
+  return readResource('posts', postId, 'Post', options);
 }
 
 export async function getPosts(options = {}) {
@@ -418,7 +386,7 @@ export async function searchPosts(query, options = {}) {
   }
 
   // Sanitize query - escape special NQL characters to prevent injection
-  const sanitizedQuery = query.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+  const sanitizedQuery = sanitizeNqlValue(query);
 
   // Build filter with fuzzy title match using Ghost NQL
   const filterParts = [`title:~'${sanitizedQuery}'`];
@@ -457,47 +425,7 @@ export async function createPage(pageData, options = { source: 'html' }) {
     ...pageData,
   };
 
-  // Sanitize HTML content if provided (use same sanitization as posts)
-  if (dataWithDefaults.html) {
-    dataWithDefaults.html = sanitizeHtml(dataWithDefaults.html, {
-      allowedTags: [
-        'h1',
-        'h2',
-        'h3',
-        'h4',
-        'h5',
-        'h6',
-        'blockquote',
-        'p',
-        'a',
-        'ul',
-        'ol',
-        'nl',
-        'li',
-        'b',
-        'i',
-        'strong',
-        'em',
-        'strike',
-        'code',
-        'hr',
-        'br',
-        'div',
-        'span',
-        'img',
-        'pre',
-      ],
-      allowedAttributes: {
-        a: ['href', 'title'],
-        img: ['src', 'alt', 'title', 'width', 'height'],
-        '*': ['class', 'id'],
-      },
-      allowedSchemes: ['http', 'https', 'mailto'],
-      allowedSchemesByTag: {
-        img: ['http', 'https', 'data'],
-      },
-    });
-  }
+  // SECURITY: HTML must be sanitized before reaching this function. See htmlContentSchema in schemas/common.js
 
   try {
     return await handleApiRequest('pages', 'add', dataWithDefaults, options);
@@ -516,96 +444,22 @@ export async function updatePage(pageId, updateData, options = {}) {
     throw new ValidationError('Page ID is required for update');
   }
 
-  // Sanitize HTML if being updated
-  if (updateData.html) {
-    updateData.html = sanitizeHtml(updateData.html, {
-      allowedTags: [
-        'h1',
-        'h2',
-        'h3',
-        'h4',
-        'h5',
-        'h6',
-        'blockquote',
-        'p',
-        'a',
-        'ul',
-        'ol',
-        'nl',
-        'li',
-        'b',
-        'i',
-        'strong',
-        'em',
-        'strike',
-        'code',
-        'hr',
-        'br',
-        'div',
-        'span',
-        'img',
-        'pre',
-      ],
-      allowedAttributes: {
-        a: ['href', 'title'],
-        img: ['src', 'alt', 'title', 'width', 'height'],
-        '*': ['class', 'id'],
-      },
-      allowedSchemes: ['http', 'https', 'mailto'],
-      allowedSchemesByTag: {
-        img: ['http', 'https', 'data'],
-      },
-    });
-  }
-
-  try {
-    // Get existing page to retrieve updated_at for conflict resolution
-    const existingPage = await handleApiRequest('pages', 'read', { id: pageId });
-
-    // Merge existing data with updates, preserving updated_at
-    const mergedData = {
-      ...existingPage,
-      ...updateData,
-      updated_at: existingPage.updated_at,
-    };
+  // SECURITY: HTML must be sanitized before reaching this function. See htmlContentSchema in schemas/common.js
 
-    return await handleApiRequest('pages', 'edit', mergedData, { id: pageId, ...options });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Page', pageId);
-    }
-    throw error;
+  // Validate scheduled status if status is being updated
+  if (updateData.status) {
+    validators.validateScheduledStatus(updateData, 'Page');
   }
+
+  return updateWithOCC('pages', pageId, updateData, options, 'Page');
 }
 
 export async function deletePage(pageId) {
-  if (!pageId) {
-    throw new ValidationError('Page ID is required for delete');
-  }
-
-  try {
-    return await handleApiRequest('pages', 'delete', { id: pageId });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Page', pageId);
-    }
-    throw error;
-  }
+  return deleteResource('pages', pageId, 'Page');
 }
 
 export async function getPage(pageId, options = {}) {
-  if (!pageId) {
-    throw new ValidationError('Page ID is required');
-  }
-
-  try {
-    return await handleApiRequest('pages', 'read', { id: pageId }, options);
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Page', pageId);
-    }
-    throw error;
-  }
+  return readResource('pages', pageId, 'Page', options);
 }
 
 export async function getPages(options = {}) {
@@ -630,7 +484,7 @@ export async function searchPages(query, options = {}) {
   }
 
   // Sanitize query - escape special NQL characters to prevent injection
-  const sanitizedQuery = query.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+  const sanitizedQuery = sanitizeNqlValue(query);
 
   // Build filter with fuzzy title match using Ghost NQL
   const filterParts = [`title:~'${sanitizedQuery}'`];
@@ -721,18 +575,7 @@ export async function getTags(options = {}) {
 }
 
 export async function getTag(tagId, options = {}) {
-  if (!tagId) {
-    throw new ValidationError('Tag ID is required');
-  }
-
-  try {
-    return await handleApiRequest('tags', 'read', { id: tagId }, options);
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Tag', tagId);
-    }
-    throw error;
-  }
+  return readResource('tags', tagId, 'Tag', options);
 }
 
 export async function updateTag(tagId, updateData) {
@@ -740,16 +583,11 @@ export async function updateTag(tagId, updateData) {
     throw new ValidationError('Tag ID is required for update');
   }
 
-  validators.validateTagUpdateData(updateData); // Validate update data
+  validators.validateTagUpdateData(updateData);
 
   try {
-    const existingTag = await getTag(tagId);
-    const mergedData = {
-      ...existingTag,
-      ...updateData,
-    };
-
-    return await handleApiRequest('tags', 'edit', mergedData, { id: tagId });
+    await readResource('tags', tagId, 'Tag');
+    return await handleApiRequest('tags', 'edit', { id: tagId, ...updateData });
   } catch (error) {
     if (error instanceof NotFoundError) {
       throw error;
@@ -764,18 +602,7 @@ export async function updateTag(tagId, updateData) {
 }
 
 export async function deleteTag(tagId) {
-  if (!tagId) {
-    throw new ValidationError('Tag ID is required for deletion');
-  }
-
-  try {
-    return await handleApiRequest('tags', 'delete', { id: tagId });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Tag', tagId);
-    }
-    throw error;
-  }
+  return deleteResource('tags', tagId, 'Tag');
 }
 
 /**
@@ -833,24 +660,7 @@ export async function updateMember(memberId, updateData, options = {}) {
     throw new ValidationError('Member ID is required for update');
   }
 
-  try {
-    // Get existing member to retrieve updated_at for conflict resolution
-    const existingMember = await handleApiRequest('members', 'read', { id: memberId });
-
-    // Merge existing data with updates, preserving updated_at
-    const mergedData = {
-      ...existingMember,
-      ...updateData,
-      updated_at: existingMember.updated_at,
-    };
-
-    return await handleApiRequest('members', 'edit', mergedData, { id: memberId, ...options });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Member', memberId);
-    }
-    throw error;
-  }
+  return updateWithOCC('members', memberId, updateData, options, 'Member');
 }
 
 /**
@@ -862,18 +672,7 @@ export async function updateMember(memberId, updateData, options = {}) {
  * @throws {GhostAPIError} If the API request fails
  */
 export async function deleteMember(memberId) {
-  if (!memberId) {
-    throw new ValidationError('Member ID is required for deletion');
-  }
-
-  try {
-    return await handleApiRequest('members', 'delete', { id: memberId });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Member', memberId);
-    }
-    throw error;
-  }
+  return deleteResource('members', memberId, 'Member');
 }
 
 /**
@@ -916,7 +715,6 @@ export async function getMembers(options = {}) {
  */
 export async function getMember(params) {
   // Input validation is performed at the MCP tool layer using Zod schemas
-  const { sanitizeNqlValue } = await import('./memberService.js');
   const { id, email } = params;
 
   try {
@@ -958,7 +756,6 @@ export async function getMember(params) {
  */
 export async function searchMembers(query, options = {}) {
   // Input validation is performed at the MCP tool layer using Zod schemas
-  const { sanitizeNqlValue } = await import('./memberService.js');
   const sanitizedQuery = sanitizeNqlValue(query.trim());
 
   const limit = options.limit || 15;
@@ -996,18 +793,7 @@ export async function getNewsletters(options = {}) {
 }
 
 export async function getNewsletter(newsletterId) {
-  if (!newsletterId) {
-    throw new ValidationError('Newsletter ID is required');
-  }
-
-  try {
-    return await handleApiRequest('newsletters', 'read', { id: newsletterId });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Newsletter', newsletterId);
-    }
-    throw error;
-  }
+  return readResource('newsletters', newsletterId, 'Newsletter');
 }
 
 export async function createNewsletter(newsletterData) {
@@ -1032,23 +818,8 @@ export async function updateNewsletter(newsletterId, updateData) {
   }
 
   try {
-    // Get existing newsletter to retrieve updated_at for conflict resolution
-    const existingNewsletter = await handleApiRequest('newsletters', 'read', {
-      id: newsletterId,
-    });
-
-    // Merge existing data with updates, preserving updated_at
-    const mergedData = {
-      ...existingNewsletter,
-      ...updateData,
-      updated_at: existingNewsletter.updated_at,
-    };
-
-    return await handleApiRequest('newsletters', 'edit', mergedData, { id: newsletterId });
+    return await updateWithOCC('newsletters', newsletterId, updateData, {}, 'Newsletter');
   } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Newsletter', newsletterId);
-    }
     if (error instanceof GhostAPIError && error.ghostStatusCode === 422) {
       throw new ValidationError('Newsletter update failed', [
         { field: 'newsletter', message: error.originalError },
@@ -1059,18 +830,7 @@ export async function updateNewsletter(newsletterId, updateData) {
 }
 
 export async function deleteNewsletter(newsletterId) {
-  if (!newsletterId) {
-    throw new ValidationError('Newsletter ID is required for deletion');
-  }
-
-  try {
-    return await handleApiRequest('newsletters', 'delete', newsletterId);
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Newsletter', newsletterId);
-    }
-    throw error;
-  }
+  return deleteResource('newsletters', newsletterId, 'Newsletter');
 }
 
 /**
@@ -1110,24 +870,7 @@ export async function updateTier(id, updateData, options = {}) {
   const { validateTierUpdateData } = await import('./tierService.js');
   validateTierUpdateData(updateData);
 
-  try {
-    // Get existing tier for merge
-    const existingTier = await handleApiRequest('tiers', 'read', { id }, { id });
-
-    // Merge updates with existing data
-    const mergedData = {
-      ...existingTier,
-      ...updateData,
-      updated_at: existingTier.updated_at,
-    };
-
-    return await handleApiRequest('tiers', 'edit', mergedData, { id, ...options });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Tier', id);
-    }
-    throw error;
-  }
+  return updateWithOCC('tiers', id, updateData, options, 'Tier');
 }
 
 /**
@@ -1140,14 +883,7 @@ export async function deleteTier(id) {
     throw new ValidationError('Tier ID is required for deletion');
   }
 
-  try {
-    return await handleApiRequest('tiers', 'delete', { id });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Tier', id);
-    }
-    throw error;
-  }
+  return deleteResource('tiers', id, 'Tier');
 }
 
 /**
@@ -1188,14 +924,7 @@ export async function getTier(id) {
     throw new ValidationError('Tier ID is required and must be a non-empty string');
   }
 
-  try {
-    return await handleApiRequest('tiers', 'read', { id }, { id });
-  } catch (error) {
-    if (error instanceof GhostAPIError && error.ghostStatusCode === 404) {
-      throw new NotFoundError('Tier', id);
-    }
-    throw error;
-  }
+  return readResource('tiers', id, 'Tier');
 }
 
 /**

package/src/services/imageProcessingService.js

@@ -89,7 +89,7 @@ const processImage = async (inputPath, outputDir) => {
     });
     // If processing fails, maybe fall back to using the original?
     // Or throw the error to fail the upload.
-    throw new Error('Image processing failed: ' + error.message);
+    throw new Error('Image processing failed: ' + error.message, { cause: error });
   }
 };