ghost 4.32.2 → 4.33.2

package/core/frontend/helpers/date.js

@@ -25,12 +25,11 @@ module.exports = function (...attrs) {
     // ensure that date is undefined, not null, as that can cause errors
     date = date === null ? undefined : date;
 
-    const timezone = options.data.site.timezone;
-    const locale = options.data.site.locale;
-
     const {
         format = 'll',
-        timeago
+        timeago,
+        timezone = options.data.site.timezone,
+        locale = options.data.site.locale
     } = options.hash;
 
     const timeNow = moment().tz(timezone);

package/core/frontend/services/routing/config/canary.js

@@ -54,7 +54,7 @@ module.exports.TAXONOMIES = {
     },
     author: {
         filter: 'authors:\'%s\'',
-        editRedirect: '#/staff/:slug/',
+        editRedirect: '#/settings/staff/:slug/',
         resource: 'authors'
     }
 };

package/core/frontend/services/routing/config/v4.js

@@ -54,7 +54,7 @@ module.exports.TAXONOMIES = {
     },
     author: {
         filter: 'authors:\'%s\'',
-        editRedirect: '#/staff/:slug/',
+        editRedirect: '#/settings/staff/:slug/',
         resource: 'authors'
     }
 };

package/core/frontend/services/theme-engine/middleware/update-global-template-options.js

@@ -28,7 +28,9 @@ function calculateLegacyPriceData(products) {
         };
     }
 
-    const defaultProduct = products[0] || {};
+    const defaultProduct = products.find((product) => {
+        return product.type === 'paid';
+    }) || {};
 
     const monthlyPrice = makePriceObject(defaultProduct.monthly_price || defaultPrice);
 

package/core/frontend/web/site.js

@@ -125,7 +125,11 @@ module.exports = function setupSiteApp(options = {}) {
     siteApp.use(membersService.middleware.loadMemberSession);
 
     // /member/.well-known/* serves files (e.g. jwks.json) so it needs to be mounted before the prettyUrl mw to avoid trailing slashes
-    siteApp.use('/members/.well-known', (req, res, next) => membersService.api.middleware.wellKnown(req, res, next));
+    siteApp.use(
+        '/members/.well-known',
+        shared.middleware.cacheControl('public', {maxAge: 60 * 60 * 24}),
+        (req, res, next) => membersService.api.middleware.wellKnown(req, res, next)
+    );
 
     // setup middleware for internal apps
     // @TODO: refactor this to be a proper app middleware hook for internal apps

package/core/server/api/canary/settings.js

@@ -6,6 +6,7 @@ const tpl = require('@tryghost/tpl');
 const {BadRequestError} = require('@tryghost/errors');
 const settingsService = require('../../services/settings');
 const membersService = require('../../services/members');
+const stripeService = require('../../services/stripe');
 
 const settingsBREADService = settingsService.getSettingsBREADServiceInstance();
 
@@ -132,7 +133,7 @@ module.exports = {
                 });
             }
 
-            await membersService.api.disconnectStripe();
+            await stripeService.disconnect();
 
             return models.Settings.edit([{
                 key: 'stripe_connect_publishable_key',

package/core/server/api/canary/utils/serializers/output/products.js

@@ -73,6 +73,8 @@ function serializeProduct(product, options, apiType) {
         name: json.name,
         description: json.description,
         slug: json.slug,
+        active: json.active,
+        type: json.type,
         created_at: json.created_at,
         updated_at: json.updated_at,
         stripe_prices: json.stripePrices ? json.stripePrices.map(price => serializeStripePrice(price, hideStripeData)) : null,
@@ -160,6 +162,8 @@ function createSerializer(debugString, serialize) {
  * @prop {string} name
  * @prop {string} slug
  * @prop {string} description
+ * @prop {boolean} active
+ * @prop {string} type
  * @prop {Date} created_at
  * @prop {Date} updated_at
  * @prop {StripePrice[]} [stripe_prices]

package/core/server/data/db/info.js

@@ -0,0 +1,4 @@
+const connection = require('./connection');
+const DatabaseInfo = require('@tryghost/database-info');
+
+module.exports = new DatabaseInfo(connection);

package/core/server/data/migrations/versions/4.33/2022-01-14-11-50-add-type-column-to-products.js

@@ -0,0 +1,12 @@
+const utils = require('../../utils');
+
+module.exports = utils.createAddColumnMigration(
+    'products',
+    'type',
+    {
+        type: 'string',
+        maxlength: 50,
+        nullable: false,
+        defaultTo: 'paid'
+    }
+);

package/core/server/data/migrations/versions/4.33/2022-01-14-11-51-add-default-free-tier.js

@@ -0,0 +1,37 @@
+const {createTransactionalMigration} = require('../../utils');
+const ObjectID = require('bson-objectid');
+const {slugify} = require('@tryghost/string');
+const logging = require('@tryghost/logging');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        const [result] = await knex
+            .count('id', {as: 'total'})
+            .from('products')
+            .where('type', 'free');
+
+        if (result.total !== 0) {
+            logging.warn(`Not adding default free tier, a free tier already exists`);
+            return;
+        }
+
+        const name = 'Free';
+        const id = ObjectID().toHexString();
+
+        logging.info(`Adding tier "${name}"`);
+        await knex('products')
+            .insert({
+                id: id,
+                name: name,
+                type: 'free',
+                slug: slugify(id),
+                created_at: knex.raw(`CURRENT_TIMESTAMP`)
+            });
+    },
+    async function down(knex) {
+        logging.info('Removing free tier');
+        await knex('products')
+            .where('type', 'free')
+            .del();
+    }
+);

package/core/server/data/migrations/versions/4.33/2022-01-18-09-07-remove-duplicate-offer-redemptions.js

@@ -0,0 +1,46 @@
+const logging = require('@tryghost/logging');
+
+const {createTransactionalMigration} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        if (knex.client.config.client !== 'mysql') {
+            logging.warn('Skipping cleanup of duplicate offer redemptions - database is not MySQL');
+            return;
+        }
+        logging.info('Looking for duplicate offer redemptions.');
+
+        const duplicates = await knex('offer_redemptions')
+            .select('subscription_id')
+            .count('subscription_id as count')
+            .groupBy('subscription_id')
+            .having('count', '>', 1);
+
+        if (!duplicates.length) {
+            logging.info('No duplicate offer redemptions found.');
+            return;
+        }
+
+        logging.info(`Found ${duplicates.length} duplicate offer redemptions.`);
+
+        // eslint-disable-next-line no-restricted-syntax
+        for (const duplicate of duplicates) {
+            const offerRedemptions = await knex('offer_redemptions')
+                .select('id')
+                .where('subscription_id', duplicate.subscription_id);
+
+            const [offerRedemptionToKeep, ...offerRedemptionsToDelete] = offerRedemptions;
+
+            logging.info(`Keeping offer redemption ${offerRedemptionToKeep.id}`);
+
+            logging.info(`Deleting ${offerRedemptionsToDelete.length} duplicates`);
+            await knex('offer_redemptions')
+                .whereIn('id', offerRedemptionsToDelete.map(x => x.id))
+                .del();
+        }
+    },
+    async function down() {
+        logging.warn('Not recreating duplicate offer redemptions');
+        return;
+    }
+);

package/core/server/data/migrations/versions/4.33/2022-01-19-10-43-add-active-column-to-products-table.js

@@ -0,0 +1,7 @@
+const {createAddColumnMigration} = require('../../utils');
+
+module.exports = createAddColumnMigration('products', 'active', {
+    type: 'boolean',
+    nullable: false,
+    defaultTo: true
+});

package/core/server/data/schema/default-settings.json

@@ -397,7 +397,7 @@
     },
     "amp": {
         "amp": {
-            "defaultValue": "true",
+            "defaultValue": "false",
             "validations": {
                 "isIn": [["true", "false"]]
             },

package/core/server/data/schema/fixtures/fixtures.json

@@ -3,9 +3,17 @@
         {
             "name": "Product",
             "entries": [
+                {
+                    "name":             "Free",
+                    "slug":             "free",
+                    "type":             "free",
+                    "active":           true
+                },
                 {
                     "name":             "Default Product",
-                    "slug":             "default-product"
+                    "slug":             "default-product",
+                    "type":             "paid",
+                    "active":           true
                 }
             ]
         },

package/core/server/data/schema/schema.js

@@ -378,9 +378,11 @@ module.exports = {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
         name: {type: 'string', maxlength: 191, nullable: false},
         slug: {type: 'string', maxlength: 191, nullable: false, unique: true},
+        active: {type: 'boolean', nullable: false, defaultTo: true},
         monthly_price_id: {type: 'string', maxlength: 24, nullable: true},
         yearly_price_id: {type: 'string', maxlength: 24, nullable: true},
         description: {type: 'string', maxlength: 191, nullable: true},
+        type: {type: 'string', maxlength: 50, nullable: false, defaultTo: 'paid', validations: {isIn: [['paid', 'free']]}},
         created_at: {type: 'dateTime', nullable: false},
         updated_at: {type: 'dateTime', nullable: true}
     },

package/core/server/models/base/plugins/data-manipulation.js

@@ -75,8 +75,9 @@ module.exports = function (Bookshelf) {
         fixBools: function fixBools(attrs) {
             const self = this;
             _.each(attrs, function each(value, key) {
-                if (Object.prototype.hasOwnProperty.call(schema.tables[self.tableName], key)
-                && schema.tables[self.tableName][key].type === 'bool') {
+                const tableDef = schema.tables[self.tableName];
+                const columnDef = tableDef ? tableDef[key] : null;
+                if (columnDef && (columnDef.type === 'bool' || columnDef.type === 'boolean')) {
                     attrs[key] = value ? true : false;
                 }
             });

package/core/server/models/product.js

@@ -4,6 +4,10 @@ const _ = require('lodash');
 const Product = ghostBookshelf.Model.extend({
     tableName: 'products',
 
+    defaults: {
+        active: true
+    },
+
     relationships: ['benefits'],
 
     relationshipBelongsTo: {

package/core/server/models/tag.js

@@ -100,6 +100,14 @@ Tag = ghostBookshelf.Model.extend({
 
         ghostBookshelf.Model.prototype.onSaving.apply(this, arguments);
 
+        // Support tag creation with `posts: [{..., tags: [{slug: 'new'}]}]`
+        // In that situation we have a slug but no name so validation will fail
+        // unless we set one automatically. Re-using slug for name matches our
+        // opposite name->slug behaviour.
+        if (!newTag.get('name') && newTag.get('slug')) {
+            this.set('name', newTag.get('slug'));
+        }
+
         // name: #later slug: hash-later
         if (/^#/.test(newTag.get('name'))) {
             this.set('visibility', 'internal');

package/core/server/services/members/api.js

@@ -173,21 +173,7 @@ function createApiInstance(config) {
             stripe: config.getStripePaymentConfig()
         },
         models: {
-            /**
-             * Settings do not have their own models, so we wrap the webhook in a "fake" model
-             */
-            StripeWebhook: {
-                async upsert(data, options) {
-                    const settings = [{
-                        key: 'members_stripe_webhook_id',
-                        value: data.webhook_id
-                    }, {
-                        key: 'members_stripe_webhook_secret',
-                        value: data.secret
-                    }];
-                    await models.Settings.edit(settings, options);
-                }
-            },
+            EmailRecipient: models.EmailRecipient,
             StripeCustomer: models.MemberStripeCustomer,
             StripeCustomerSubscription: models.StripeCustomerSubscription,
             Member: models.Member,

package/core/server/services/members/config.js

@@ -137,8 +137,6 @@ class MembersConfigProvider {
     getStripeUrlConfig() {
         const siteUrl = this._urlUtils.getSiteUrl();
 
-        const webhookHandlerUrl = new URL('members/webhooks/stripe/', siteUrl);
-
         const checkoutSuccessUrl = new URL(siteUrl);
         checkoutSuccessUrl.searchParams.set('stripe', 'success');
         const checkoutCancelUrl = new URL(siteUrl);
@@ -153,8 +151,7 @@ class MembersConfigProvider {
             checkoutSuccess: checkoutSuccessUrl.href,
             checkoutCancel: checkoutCancelUrl.href,
             billingSuccess: billingSuccessUrl.href,
-            billingCancel: billingCancelUrl.href,
-            webhookHandler: webhookHandlerUrl.href
+            billingCancel: billingCancelUrl.href
         };
     }
 
@@ -175,11 +172,6 @@ class MembersConfigProvider {
             checkoutCancelUrl: urls.checkoutCancel,
             billingSuccessUrl: urls.billingSuccess,
             billingCancelUrl: urls.billingCancel,
-            webhookHandlerUrl: urls.webhookHandler,
-            webhook: {
-                id: this._settingsCache.get('members_stripe_webhook_id'),
-                secret: this._settingsCache.get('members_stripe_webhook_secret')
-            },
             product: {
                 name: this._settingsCache.get('stripe_product_name')
             },

package/core/server/services/members/middleware.js

@@ -109,10 +109,13 @@ const getPortalProductPrices = async function () {
             monthlyPrice: product.monthlyPrice,
             yearlyPrice: product.yearlyPrice,
             benefits: product.benefits,
+            type: product.type,
             prices: productPrices
         };
     });
-    const defaultProduct = products[0];
+    const defaultProduct = products.find((product) => {
+        return product.type === 'paid';
+    });
     const defaultPrices = defaultProduct ? defaultProduct.prices : [];
     let portalProducts = defaultProduct ? [defaultProduct] : [];
     if (labsService.isSet('multipleProducts')) {
@@ -234,6 +237,5 @@ module.exports = {
     getOfferData,
     updateMemberData,
     getMemberSiteData,
-    deleteSession,
-    stripeWebhooks: (req, res, next) => membersService.api.middleware.handleStripeWebhook(req, res, next)
+    deleteSession
 };

package/core/server/services/members/service.js

@@ -5,7 +5,6 @@ const db = require('../../data/db');
 const MembersConfigProvider = require('./config');
 const MembersCSVImporter = require('@tryghost/members-importer');
 const MembersStats = require('./stats/members-stats');
-const createMembersApiInstance = require('./api');
 const createMembersSettingsInstance = require('./settings');
 const logging = require('@tryghost/logging');
 const urlUtils = require('../../../shared/url-utils');
@@ -16,7 +15,6 @@ const models = require('../../models');
 const _ = require('lodash');
 const {GhostMailer} = require('../mail');
 const jobsService = require('../jobs');
-const stripeService = require('../stripe');
 
 const messages = {
     noLiveKeysInDevelopment: 'Cannot use live stripe keys in development. Please restart in production mode.',
@@ -26,9 +24,6 @@ const messages = {
     emailVerificationEmailMessage: `Email verification needed for site: {siteUrl}, just imported: {importedNumber} members.`
 };
 
-// Bind to settings.edited to update systems based on settings changes, similar to the bridge and models/base/listeners
-const events = require('../../lib/common/events');
-
 const ghostMailer = new GhostMailer();
 
 const membersConfig = new MembersConfigProvider({
@@ -40,16 +35,6 @@ const membersConfig = new MembersConfigProvider({
 let membersApi;
 let membersSettings;
 
-function reconfigureMembersAPI() {
-    const reconfiguredMembersAPI = createMembersApiInstance(membersConfig);
-    reconfiguredMembersAPI.bus.on('ready', function () {
-        membersApi = reconfiguredMembersAPI;
-    });
-    reconfiguredMembersAPI.bus.on('error', function (err) {
-        logging.error(err);
-    });
-}
-
 /**
  * @description Calculates threshold based on following formula
  * Threshold = max{[current number of members], [volume threshold]}
@@ -57,7 +42,7 @@ function reconfigureMembersAPI() {
  * @returns {Promise<number>}
  */
 const fetchImportThreshold = async () => {
-    const membersTotal = await membersService.stats.getTotalMembers();
+    const membersTotal = await module.exports.stats.getTotalMembers();
     const configThreshold = _.get(config.get('hostSettings'), 'emailVerification.importThreshold');
     const volumeThreshold = (configThreshold === undefined) ? Infinity : configThreshold;
     const threshold = Math.max(membersTotal, volumeThreshold);
@@ -68,7 +53,7 @@ const fetchImportThreshold = async () => {
 const membersImporter = new MembersCSVImporter({
     storagePath: config.getContentPath('data'),
     getTimezone: () => settingsCache.get('timezone'),
-    getMembersApi: () => membersService.api,
+    getMembersApi: () => module.exports.api,
     sendEmail: ghostMailer.send.bind(ghostMailer),
     isSet: labsService.isSet.bind(labsService),
     addJob: jobsService.addJob.bind(jobsService),
@@ -125,18 +110,14 @@ const processImport = async (options) => {
     return result;
 };
 
-events.on('services.stripe.reconfigured', reconfigureMembersAPI);
-
-const membersService = {
+module.exports = {
     async init() {
+        const stripeService = require('../stripe');
+        const createMembersApiInstance = require('./api');
         const env = config.get('env');
 
+        // @TODO Move to stripe service
         if (env !== 'production') {
-            if (!process.env.WEBHOOK_SECRET && stripeService.api.configured) {
-                process.env.WEBHOOK_SECRET = 'DEFAULT_WEBHOOK_SECRET';
-                logging.warn(tpl(messages.remoteWebhooksInDevelopment));
-            }
-
             if (stripeService.api.configured && stripeService.api.mode === 'live') {
                 throw new errors.IncorrectUsageError({
                     message: tpl(messages.noLiveKeysInDevelopment)
@@ -166,6 +147,12 @@ const membersService = {
                 logging.error(err);
             }
         })();
+
+        try {
+            await stripeService.migrations.execute();
+        } catch (err) {
+            logging.error(err);
+        }
     },
     contentGating: require('./content-gating'),
 
@@ -187,7 +174,7 @@ const membersService = {
         cookieKeys: [settingsCache.get('theme_session_secret')],
         cookieName: 'ghost-members-ssr',
         cookieCacheName: 'ghost-members-ssr-cache',
-        getMembersApi: () => membersService.api
+        getMembersApi: () => module.exports.api
     }),
 
     stripeConnect: require('./stripe-connect'),
@@ -199,7 +186,6 @@ const membersService = {
         settingsCache: settingsCache,
         isSQLite: config.get('database:client') === 'sqlite3'
     })
-};
 
-module.exports = membersService;
+};
 module.exports.middleware = require('./middleware');

package/core/server/services/offers/service.js

@@ -1,8 +1,6 @@
 const DynamicRedirectManager = require('@tryghost/express-dynamic-redirects');
 const OffersModule = require('@tryghost/members-offers');
 
-const stripeService = require('../stripe');
-
 const config = require('../../../shared/config');
 const urlUtils = require('../../../shared/url-utils');
 const models = require('../../models');
@@ -19,8 +17,7 @@ module.exports = {
         const offersModule = OffersModule.create({
             OfferModel: models.Offer,
             OfferRedemptionModel: models.OfferRedemption,
-            redirectManager: redirectManager,
-            stripeAPIService: stripeService.api
+            redirectManager: redirectManager
         });
 
         this.api = offersModule.api;

package/core/server/services/public-config/config.js

@@ -1,20 +1,21 @@
 const {isPlainObject} = require('lodash');
 const config = require('../../../shared/config');
 const labs = require('../../../shared/labs');
+const databaseInfo = require('../../data/db/info');
 const ghostVersion = require('@tryghost/version');
 
 module.exports = function getConfigProperties() {
     const configProperties = {
         version: ghostVersion.full,
         environment: config.get('env'),
-        database: config.get('database').client,
+        database: databaseInfo.getEngine(),
         mail: isPlainObject(config.get('mail')) ? config.get('mail').transport : '',
         useGravatar: !config.isPrivacyDisabled('useGravatar'),
         labs: labs.getAll(),
         clientExtensions: config.get('clientExtensions') || {},
         enableDeveloperExperiments: config.get('enableDeveloperExperiments') || false,
         stripeDirect: config.get('stripeDirect'),
-        mailgunIsConfigured: config.get('bulkEmail') && config.get('bulkEmail').mailgun,
+        mailgunIsConfigured: !!(config.get('bulkEmail') && config.get('bulkEmail').mailgun),
         emailAnalytics: config.get('emailAnalytics'),
         hostSettings: config.get('hostSettings'),
         tenor: config.get('tenor')

package/core/server/services/stripe/config.js

@@ -1,7 +1,13 @@
-const ghostVersion = require('@tryghost/version');
+const logging = require('@tryghost/logging');
+const tpl = require('@tryghost/tpl');
 
+const messages = {
+    remoteWebhooksInDevelopment: 'Cannot use remote webhooks in development. See https://ghost.org/docs/webhooks/#stripe-webhooks for developing with Stripe.'
+};
+
+// @TODO Refactor to a class w/ constructor
 module.exports = {
-    getConfig(settings, config) {
+    getConfig(settings, config, urlUtils) {
         /**
          * @param {'direct' | 'connect'} type - The "type" of keys to fetch from settings
          * @returns {{publicKey: string, secretKey: string} | null}
@@ -42,16 +48,25 @@ module.exports = {
         if (!keys) {
             return null;
         }
+
+        const env = config.get('env');
+        let webhookSecret = process.env.WEBHOOK_SECRET;
+
+        if (env !== 'production') {
+            if (!webhookSecret) {
+                webhookSecret = 'DEFAULT_WEBHOOK_SECRET';
+                logging.warn(tpl(messages.remoteWebhooksInDevelopment));
+            }
+        }
+
+        const webhookHandlerUrl = new URL('members/webhooks/stripe/', urlUtils.getSiteUrl());
+
         return {
             secretKey: keys.secretKey,
             publicKey: keys.publicKey,
-            appInfo: {
-                name: 'Ghost',
-                partner_id: 'pp_partner_DKmRVtTs4j9pwZ',
-                version: ghostVersion.original,
-                url: 'https://ghost.org/'
-            },
-            enablePromoCodes: config.get('enableStripePromoCodes')
+            enablePromoCodes: config.get('enableStripePromoCodes'),
+            webhookSecret: webhookSecret,
+            webhookHandlerUrl: webhookHandlerUrl.href
         };
     }
 };

package/core/server/services/stripe/index.js

@@ -1,45 +1 @@
-const _ = require('lodash');
-const StripeAPIService = require('@tryghost/members-stripe-service');
-
-const config = require('../../../shared/config');
-const settings = require('../../../shared/settings-cache');
-const events = require('../../lib/common/events');
-
-const {getConfig} = require('./config');
-
-const api = new StripeAPIService({
-    config: {}
-});
-
-const stripeKeySettings = [
-    'stripe_publishable_key',
-    'stripe_secret_key',
-    'stripe_connect_publishable_key',
-    'stripe_connect_secret_key'
-];
-
-function configureApi() {
-    const cfg = getConfig(settings, config);
-    if (cfg) {
-        api.configure(cfg);
-    }
-}
-
-const debouncedConfigureApi = _.debounce(() => {
-    configureApi();
-    events.emit('services.stripe.reconfigured');
-}, 600);
-
-module.exports = {
-    async init() {
-        configureApi();
-        events.on('settings.edited', function (model) {
-            if (!stripeKeySettings.includes(model.get('key'))) {
-                return;
-            }
-            debouncedConfigureApi();
-        });
-    },
-
-    api
-};
+module.exports = require('./service');