ghost 4.19.1 → 4.20.3

package/core/server/web/api/app.js

@@ -12,18 +12,17 @@ module.exports = function setupApiApp() {
         apiApp.use(require('./testmode')());
     }
 
-    // Mount different API versions
-    apiApp.use(urlUtils.getVersionPath({version: 'v2', type: 'content'}), require('./v2/content/app')());
-    apiApp.use(urlUtils.getVersionPath({version: 'v2', type: 'admin'}), require('./v2/admin/app')());
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'v2', type: 'content'}), require('./v2/content/app'));
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'v2', type: 'admin'}), require('./v2/admin/app'));
 
-    apiApp.use(urlUtils.getVersionPath({version: 'v3', type: 'content'}), require('./v3/content/app')());
-    apiApp.use(urlUtils.getVersionPath({version: 'v3', type: 'admin'}), require('./v3/admin/app')());
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'v3', type: 'content'}), require('./v3/content/app'));
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'v3', type: 'admin'}), require('./v3/admin/app'));
 
-    apiApp.use(urlUtils.getVersionPath({version: 'v4', type: 'content'}), require('./canary/content/app')());
-    apiApp.use(urlUtils.getVersionPath({version: 'v4', type: 'admin'}), require('./canary/admin/app')());
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'v4', type: 'content'}), require('./canary/content/app'));
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'v4', type: 'admin'}), require('./canary/admin/app'));
 
-    apiApp.use(urlUtils.getVersionPath({version: 'canary', type: 'content'}), require('./canary/content/app')());
-    apiApp.use(urlUtils.getVersionPath({version: 'canary', type: 'admin'}), require('./canary/admin/app')());
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'canary', type: 'content'}), require('./canary/content/app'));
+    apiApp.lazyUse(urlUtils.getVersionPath({version: 'canary', type: 'admin'}), require('./canary/admin/app'));
 
     // Error handling for requests to non-existent API versions
     apiApp.use(errorHandler.resourceNotFound);

package/core/server/web/oauth/app.js

@@ -1,7 +1,5 @@
 const debug = require('@tryghost/debug')('web:oauth:app');
 const {URL} = require('url');
-const passport = require('passport');
-const GoogleStrategy = require('passport-google-oauth20').Strategy;
 const express = require('../../../shared/express');
 const urlUtils = require('../../../shared/url-utils');
 const shared = require('../shared');
@@ -36,6 +34,10 @@ module.exports = function setupOAuthApp() {
      */
     function googleOAuthMiddleware(clientId, secret) {
         return (req, res, next) => {
+            // Lazy-required to save boot time
+            const passport = require('passport');
+            const GoogleStrategy = require('passport-google-oauth20').Strategy;
+
             const adminURL = urlUtils.urlFor('admin', true);
 
             //Create the callback url to be sent to Google

package/core/server/web/parent/backend.js

@@ -10,9 +10,9 @@ module.exports = () => {
     // BACKEND
     // Wrap the admin and API apps into a single express app for use with vhost
     const backendApp = express('backend');
-    backendApp.use('/ghost/api', require('../api')());
-    backendApp.use('/ghost/oauth', require('../oauth')());
-    backendApp.use('/ghost/.well-known', require('../well-known')());
+    backendApp.lazyUse('/ghost/api', require('../api'));
+    backendApp.lazyUse('/ghost/oauth', require('../oauth'));
+    backendApp.lazyUse('/ghost/.well-known', require('../well-known'));
     backendApp.use('/ghost', require('../../services/auth/session').createSessionFromToken, require('../admin')());
 
     return backendApp;

package/core/server/web/parent/frontend.js

@@ -18,8 +18,8 @@ module.exports = (options) => {
     // otherwise we serve assets/pages with http. This can cause mixed content warnings in the admin client.
     frontendApp.use(shared.middlewares.urlRedirects.frontendSSLRedirect);
 
-    frontendApp.use('/members', require('../members')());
-    frontendApp.use('/', require('../site')(options));
+    frontendApp.lazyUse('/members', require('../members'));
+    frontendApp.use('/', require('../../../frontend/web')(options));
 
     return frontendApp;
 };

package/core/server/web/shared/middlewares/custom-redirects.js

@@ -7,7 +7,6 @@ const urlUtils = require('../../../../shared/url-utils');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 const redirectsService = require('../../../services/redirects');
-const labsService = require('../../../../shared/labs');
 
 const messages = {
     customRedirectsRegistrationFailure: 'Could not register custom redirects.'
@@ -27,13 +26,6 @@ let customRedirectsRouter;
 _private.registerRoutes = (router, redirects) => {
     debug('redirects loading');
 
-    if (labsService.isSet('offers')) {
-        redirects.unshift({
-            from: '/zimo50',
-            to: '/#/portal/offers/abcdefuckoff'
-        });
-    }
-
     redirects.forEach((redirect) => {
         /**
          * Detect case insensitive modifier when regex is enclosed by

package/core/server/web/shared/middlewares/maintenance.js

@@ -1,7 +1,7 @@
 const errors = require('@tryghost/errors');
 const config = require('../../../../shared/config');
 const tpl = require('@tryghost/tpl');
-const urlService = require('../../../../frontend/services/url');
+const urlService = require('../../../services/url');
 
 const messages = {
     maintenance: 'Site is currently undergoing maintenance, please wait a moment then retry.',

package/core/server/web/well-known.js

@@ -1,19 +1,19 @@
 const express = require('../../shared/express');
 const settings = require('../../shared/settings-cache');
-const jose = require('node-jose');
-
-const dangerousPrivateKey = settings.get('ghost_private_key');
-const keyStore = jose.JWK.createKeyStore();
-const keyStoreReady = keyStore.add(dangerousPrivateKey, 'pem');
-
-const getSafePublicJWKS = async () => {
-    await keyStoreReady;
-    return keyStore.toJSON();
-};
 
 module.exports = function setupWellKnownApp() {
     const wellKnownApp = express('well-known');
 
+    const jose = require('node-jose');
+    const dangerousPrivateKey = settings.get('ghost_private_key');
+    const keyStore = jose.JWK.createKeyStore();
+    const keyStoreReady = keyStore.add(dangerousPrivateKey, 'pem');
+
+    const getSafePublicJWKS = async () => {
+        await keyStoreReady;
+        return keyStore.toJSON();
+    };
+
     wellKnownApp.get('/jwks.json', async (req, res) => {
         const jwks = await getSafePublicJWKS();
         res.json(jwks);

package/core/shared/config/overrides.json

@@ -10,7 +10,7 @@
         "internalAppPath": "core/frontend/apps/",
         "internalAdaptersPath": "core/server/adapters/",
         "migrationPath": "core/server/data/migrations",
-        "publicFilePath": "core/server/public"
+        "publicFilePath": "core/frontend/public"
     },
     "apps": {
         "internal": [

package/core/shared/express.js

@@ -1,7 +1,10 @@
 const debug = require('@tryghost/debug')('shared:express');
 const express = require('express');
+const {createLazyRouter} = require('express-lazy-router');
 const sentry = require('./sentry');
 
+const lazyLoad = createLazyRouter();
+
 module.exports = (name) => {
     debug('new app start', name);
     const app = express();
@@ -14,6 +17,13 @@ module.exports = (name) => {
     // Sentry must be our first error handler. Mounting it here means all custom error handlers will come after
     app.use(sentry.errorHandler);
 
+    app.lazyUse = function lazyUse(mountPath, requireFn) {
+        app.use(mountPath, lazyLoad(() => {
+            debug(`lazy-loading on ${mountPath}`);
+            return Promise.resolve(requireFn());
+        }));
+    };
+
     debug('new app end', name);
     return app;
 };

package/core/shared/html-to-plaintext.js

@@ -1,6 +1,6 @@
-const htmlToText = require('html-to-text');
-
 module.exports = function htmlToPlaintext(html) {
+    const htmlToText = require('html-to-text');
+
     return htmlToText.fromString(html, {
         wordwrap: 80,
         ignoreImage: true,

package/core/shared/labs.js

@@ -1,6 +1,5 @@
 const _ = require('lodash');
 const Promise = require('bluebird');
-const SafeString = require('express-hbs').SafeString;
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
@@ -14,6 +13,12 @@ const messages = {
     errorHelp: 'See {url}'
 };
 
+// flags in this list always return `true`, allows quick global enable prior to full flag removal
+const GA_FEATURES = [
+    'customThemeSettings',
+    'offers'
+];
+
 // NOTE: this allowlist is meant to be used to filter out any unexpected
 //       input for the "labs" setting value
 const BETA_FEATURES = [
@@ -23,11 +28,10 @@ const BETA_FEATURES = [
 
 const ALPHA_FEATURES = [
     'oauthLogin',
-    'customThemeSettings',
-    'membersActivity',
-    'offers'
+    'membersActivity'
 ];
 
+module.exports.GA_KEYS = [...GA_FEATURES];
 module.exports.WRITABLE_KEYS_ALLOWLIST = [...BETA_FEATURES, ...ALPHA_FEATURES];
 
 module.exports.getAll = () => {
@@ -39,6 +43,10 @@ module.exports.getAll = () => {
         }
     });
 
+    GA_FEATURES.forEach((gaKey) => {
+        labs[gaKey] = true;
+    });
+
     labs.members = settingsCache.get('members_signup_access') !== 'none';
 
     return labs;
@@ -78,7 +86,7 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
     }
 
     // Else, the helper is not active and we need to handle this as an error
-    errDetails.message = tpl(options.errorMessage || messages.errorMessage, {helperName: options.helperName}),
+    errDetails.message = tpl(options.errorMessage || messages.errorMessage, {helperName: options.helperName});
     errDetails.context = tpl(options.errorContext || messages.errorContext, {
         helperName: options.helperName,
         flagName: options.flagName
@@ -87,6 +95,7 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
 
     logging.error(new errors.DisabledFeatureError(errDetails));
 
+    const {SafeString} = require('express-hbs');
     errString = new SafeString(`<script>console.error("${_.values(errDetails).join(' ')}");</script>`);
 
     if (options.async) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "4.19.1",
+  "version": "4.20.3",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -29,7 +29,7 @@
     "test": "mocha --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js --timeout=60000",
     "test:all": "yarn test:unit && yarn test:integration && yarn test:e2e && yarn lint",
     "test:debug": "DEBUG=ghost:test* yarn test",
-    "test:unit": "c8 --all -n 'core/{*.js,frontend,server,shared}' --reporter text-summary mocha --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js './test/unit' --timeout=2000",
+    "test:unit": "c8 --all -n 'core/{*.js,frontend,server,shared}' --reporter text-summary --reporter cobertura mocha --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js './test/unit' --timeout=2000",
     "test:integration": "mocha --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js  './test/integration' --timeout=5000",
     "test:e2e": "mocha --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js './test/e2e-api' './test/e2e-frontend' './test/e2e-server' --timeout=10000",
     "test:regression": "mocha --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js  './test/regression' --timeout=60000",
@@ -55,55 +55,55 @@
   "dependencies": {
     "@nexes/nql": "0.6.0",
     "@sentry/node": "6.13.3",
-    "@tryghost/adapter-manager": "0.2.17",
+    "@tryghost/adapter-manager": "0.2.18",
     "@tryghost/admin-api-schema": "2.6.0",
-    "@tryghost/bookshelf-plugins": "0.3.3",
-    "@tryghost/bootstrap-socket": "0.2.12",
+    "@tryghost/bookshelf-plugins": "0.3.4",
+    "@tryghost/bootstrap-socket": "0.2.13",
     "@tryghost/color-utils": "0.1.2",
-    "@tryghost/config-url-helpers": "0.1.2",
-    "@tryghost/constants": "0.1.11",
-    "@tryghost/custom-theme-settings-service": "0.1.2",
-    "@tryghost/debug": "0.1.8",
-    "@tryghost/email-analytics-provider-mailgun": "1.0.3",
-    "@tryghost/email-analytics-service": "1.0.2",
-    "@tryghost/errors": "0.2.16",
-    "@tryghost/express-dynamic-redirects": "0.2.0",
+    "@tryghost/config-url-helpers": "0.1.3",
+    "@tryghost/constants": "0.1.12",
+    "@tryghost/custom-theme-settings-service": "0.3.0",
+    "@tryghost/debug": "0.1.9",
+    "@tryghost/email-analytics-provider-mailgun": "1.0.4",
+    "@tryghost/email-analytics-service": "1.0.3",
+    "@tryghost/errors": "0.2.17",
+    "@tryghost/express-dynamic-redirects": "0.2.1",
     "@tryghost/helpers": "1.1.52",
-    "@tryghost/image-transform": "1.0.16",
-    "@tryghost/job-manager": "0.8.10",
+    "@tryghost/image-transform": "1.0.17",
+    "@tryghost/job-manager": "0.8.11",
     "@tryghost/kg-card-factory": "3.0.4",
     "@tryghost/kg-default-atoms": "3.0.0",
     "@tryghost/kg-default-cards": "5.0.7",
     "@tryghost/kg-markdown-html-renderer": "5.0.5",
     "@tryghost/kg-mobiledoc-html-renderer": "5.1.1",
-    "@tryghost/limit-service": "0.6.4",
+    "@tryghost/limit-service": "0.6.5",
     "@tryghost/logging": "0.2.2",
-    "@tryghost/magic-link": "1.0.13",
-    "@tryghost/members-api": "2.2.3",
-    "@tryghost/members-csv": "1.1.7",
-    "@tryghost/members-importer": "0.3.3",
-    "@tryghost/members-offers": "0.6.1",
-    "@tryghost/members-ssr": "1.0.14",
-    "@tryghost/metrics": "0.2.4",
-    "@tryghost/mw-session-from-token": "0.1.25",
-    "@tryghost/nodemailer": "0.3.5",
-    "@tryghost/package-json": "1.0.5",
-    "@tryghost/promise": "0.1.12",
-    "@tryghost/request": "0.1.7",
-    "@tryghost/root-utils": "0.3.6",
-    "@tryghost/security": "0.2.12",
-    "@tryghost/session-service": "0.1.27",
+    "@tryghost/magic-link": "1.0.14",
+    "@tryghost/members-api": "2.4.1",
+    "@tryghost/members-csv": "1.1.8",
+    "@tryghost/members-importer": "0.3.4",
+    "@tryghost/members-offers": "0.10.1",
+    "@tryghost/members-ssr": "1.0.15",
+    "@tryghost/metrics": "0.2.6",
+    "@tryghost/mw-session-from-token": "0.1.26",
+    "@tryghost/nodemailer": "0.3.6",
+    "@tryghost/package-json": "1.0.6",
+    "@tryghost/promise": "0.1.13",
+    "@tryghost/request": "0.1.8",
+    "@tryghost/root-utils": "0.3.7",
+    "@tryghost/security": "0.2.13",
+    "@tryghost/session-service": "0.1.28",
     "@tryghost/social-urls": "0.1.26",
     "@tryghost/string": "0.1.20",
-    "@tryghost/tpl": "0.1.7",
+    "@tryghost/tpl": "0.1.8",
     "@tryghost/update-check-service": "0.2.4",
     "@tryghost/url-utils": "2.0.2",
-    "@tryghost/validator": "0.1.7",
-    "@tryghost/version": "0.1.6",
-    "@tryghost/vhost-middleware": "1.0.18",
-    "@tryghost/zip": "1.1.17",
+    "@tryghost/validator": "0.1.8",
+    "@tryghost/version": "0.1.7",
+    "@tryghost/vhost-middleware": "1.0.19",
+    "@tryghost/zip": "1.1.18",
     "amperize": "0.6.1",
-    "analytics-node": "5.1.0",
+    "analytics-node": "5.1.2",
     "bluebird": "3.7.2",
     "body-parser": "1.19.0",
     "bookshelf": "1.2.0",
@@ -121,13 +121,14 @@
     "express-brute": "1.0.1",
     "express-hbs": "2.4.0",
     "express-jwt": "6.1.0",
+    "express-lazy-router": "1.0.4",
     "express-query-boolean": "2.0.0",
     "express-session": "1.17.2",
     "fs-extra": "10.0.0",
     "ghost-storage-base": "0.0.6",
     "glob": "7.2.0",
     "got": "9.6.0",
-    "gscan": "4.8.1",
+    "gscan": "4.9.1",
     "html-to-text": "5.1.1",
     "image-size": "1.0.0",
     "intl": "1.2.5",
@@ -140,6 +141,7 @@
     "knex": "0.21.21",
     "knex-migrator": "4.0.5",
     "lodash": "4.17.21",
+    "luxon": "2.0.2",
     "mailgun-js": "0.22.0",
     "metascraper": "5.24.9",
     "metascraper-author": "5.24.9",
@@ -156,7 +158,7 @@
     "mysql": "2.18.1",
     "nconf": "0.11.3",
     "node-jose": "2.0.0",
-    "oembed-parser": "1.4.8",
+    "oembed-parser": "1.4.9",
     "passport": "0.5.0",
     "passport-google-oauth": "2.0.0",
     "path-match": "1.2.4",
@@ -179,7 +181,7 @@
     "coffeescript": "2.6.1",
     "cssnano": "5.0.8",
     "eslint": "7.32.0",
-    "eslint-plugin-ghost": "2.6.0",
+    "eslint-plugin-ghost": "2.7.0",
     "grunt": "1.4.1",
     "grunt-bg-shell": "2.3.3",
     "grunt-contrib-clean": "2.0.0",
@@ -191,13 +193,13 @@
     "grunt-shell": "3.0.1",
     "grunt-subgrunt": "1.3.0",
     "grunt-update-submodules": "0.4.1",
-    "jwks-rsa": "2.0.4",
+    "jwks-rsa": "2.0.5",
     "mocha": "9.1.3",
     "mocha-slow-test-reporter": "0.1.2",
     "mock-knex": "0.4.10",
-    "nock": "13.1.3",
+    "nock": "13.1.4",
     "papaparse": "5.3.1",
-    "postcss": "8.3.9",
+    "postcss": "8.3.11",
     "rewire": "5.0.0",
     "should": "13.2.3",
     "sinon": "11.1.2",