ghost 4.47.3 → 5.0.0

package/core/server/models/settings.js

@@ -53,8 +53,7 @@ function parseDefaultSettings() {
     const dynamicDefault = {
         db_hash: () => uuid.v4(),
         public_hash: () => crypto.randomBytes(15).toString('hex'),
-        // @TODO: session_secret would ideally be named "admin_session_secret"
-        session_secret: () => crypto.randomBytes(32).toString('hex'),
+        admin_session_secret: () => crypto.randomBytes(32).toString('hex'),
         theme_session_secret: () => crypto.randomBytes(32).toString('hex'),
         members_public_key: () => getMembersKey('public'),
         members_private_key: () => getMembersKey('private'),
@@ -217,6 +216,11 @@ Settings = ghostBookshelf.Model.extend({
                 return Promise.reject(new errors.ValidationError({message: tpl(messages.valueCannotBeBlank)}));
             }
 
+            // Ensure that object keys are stringified
+            if (_.isObject(item.value)) {
+                item.value = JSON.stringify(item.value);
+            }
+
             item = self.filterData(item);
 
             return Settings.forge({key: item.key}).fetch(options).then(function then(setting) {

package/core/server/models/webhook.js

@@ -1,5 +1,6 @@
 const Promise = require('bluebird');
 const ghostBookshelf = require('./base');
+const ghostVersion = require('@tryghost/version');
 let Webhook;
 let Webhooks;
 
@@ -8,7 +9,7 @@ Webhook = ghostBookshelf.Model.extend({
 
     defaults() {
         return {
-            api_version: 'v4',
+            api_version: `v${ghostVersion.safe}`,
             status: 'available'
         };
     },

package/core/server/run-update-check.js

@@ -38,7 +38,7 @@ if (parentPort) {
     const permissions = require('./services/permissions');
     await permissions.init();
 
-    const settings = require('./services/settings');
+    const settings = require('./services/settings/settings-service');
     await settings.init();
     // Finished INIT
 

package/core/server/services/api-version-compatibility/index.js

@@ -1,38 +1,41 @@
 const APIVersionCompatibilityService = require('@tryghost/api-version-compatibility-service');
-const VersionNotificationsDataService = require('@tryghost/version-notifications-data-service');
 const versionMismatchHandler = require('@tryghost/mw-api-version-mismatch');
-// const {GhostMailer} = require('../mail');
-const settingsService = require('../../services/settings');
-const models = require('../../models');
-const logging = require('@tryghost/logging');
 const ghostVersion = require('@tryghost/version');
+const {GhostMailer} = require('../mail');
+const settingsService = require('../settings/settings-service');
+const models = require('../../models');
+const urlUtils = require('../../../shared/url-utils');
+const settingsCache = require('../../../shared/settings-cache');
 
 let serviceInstance;
 
 const init = () => {
-    //const ghostMailer = new GhostMailer();
-    const versionNotificationsDataService = new VersionNotificationsDataService({
-        UserModel: models.User,
-        settingsService: settingsService.getSettingsBREADServiceInstance()
-    });
+    const ghostMailer = new GhostMailer();
 
     serviceInstance = new APIVersionCompatibilityService({
+        UserModel: models.User,
+        ApiKeyModel: models.ApiKey,
+        settingsService: settingsService.getSettingsBREADServiceInstance(),
         sendEmail: (options) => {
             // NOTE: not using bind here because mockMailer is having trouble mocking bound methods
-            //return ghostMailer.send(options);
-            // For now log a warning, rather than sending an email
-            logging.warn(options.html);
+            return ghostMailer.send(options);
         },
-        fetchEmailsToNotify: versionNotificationsDataService.getNotificationEmails.bind(versionNotificationsDataService),
-        fetchHandled: versionNotificationsDataService.fetchNotification.bind(versionNotificationsDataService),
-        saveHandled: versionNotificationsDataService.saveNotification.bind(versionNotificationsDataService)
+        getSiteUrl: () => urlUtils.urlFor('home', true),
+        getSiteTitle: () => settingsCache.get('title')
     });
 };
 
-module.exports.errorHandler = (req, res, next) => {
-    return versionMismatchHandler(serviceInstance)(req, res, next);
+module.exports.errorHandler = (err, req, res, next) => {
+    return versionMismatchHandler(serviceInstance)(err, req, res, next);
 };
 
+/**
+ * If Accept-Version is set on the request set Content-Version on the response
+ *
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
 module.exports.contentVersion = (req, res, next) => {
     if (req.header('accept-version')) {
         res.header('Content-Version', `v${ghostVersion.safe}`);
@@ -40,4 +43,7 @@ module.exports.contentVersion = (req, res, next) => {
     next();
 };
 
+module.exports.versionRewrites = require('./mw-version-rewrites');
+module.exports.legacyApiPathMatch = require('./legacy-api-path-match');
+
 module.exports.init = init;

package/core/server/services/api-version-compatibility/legacy-api-path-match.js

@@ -0,0 +1,23 @@
+const pathMatch = require('path-match')();
+
+module.exports = (url) => {
+    let basePath = 'ghost/api';
+    let apiRouteMatcher = '/:version(v2|v3|v4|canary)?/:api(admin|content)/*';
+    let urlToMatch = url;
+
+    if (url.includes(basePath)) {
+        urlToMatch = url.split(basePath)[1];
+    }
+
+    if (!urlToMatch.endsWith('/')) {
+        urlToMatch += '/';
+    }
+
+    let {version, api} = pathMatch(apiRouteMatcher)(urlToMatch);
+
+    if (version === [null]) {
+        version = null;
+    }
+
+    return {version, api};
+};

package/core/server/services/api-version-compatibility/mw-version-rewrites.js

@@ -0,0 +1,36 @@
+const legacyApiPathMatch = require('./legacy-api-path-match');
+const urlUtils = require('../../../shared/url-utils');
+
+/**
+ * If there is a version in the URL, and this is a valid API URL containing admin/content
+ * Rewrite the URL and add the accept-version & deprecation headers
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+module.exports = (req, res, next) => {
+    let {version} = legacyApiPathMatch(req.url);
+
+    // If we don't match a valid version, carry on
+    if (!version) {
+        return next();
+    }
+
+    const versionlessUrl = req.url.replace(`${version}/`, '');
+
+    // Always send the explicit, numeric version in headers
+    if (version === 'canary') {
+        version = 'v4';
+    }
+
+    // Rewrite the url
+    req.url = versionlessUrl;
+
+    // Add the accept-version header so our internal systems will act as if it was set on the request
+    req.headers['accept-version'] = req.headers['accept-version'] || `${version}.0`;
+
+    res.header('Deprecation', `version="${version}"`);
+    res.header('Link', `<${urlUtils.urlJoin(urlUtils.urlFor('admin', true), 'api', versionlessUrl)}>; rel="latest-version"`);
+
+    next();
+};

package/core/server/services/auth/api-key/admin.js

@@ -3,7 +3,7 @@ const url = require('url');
 const models = require('../../../models');
 const errors = require('@tryghost/errors');
 const limitService = require('../../../services/limits');
-const config = require('../../../../shared/config');
+const {legacyApiPathMatch} = require('../../../services/api-version-compatibility');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 
@@ -139,19 +139,20 @@ const authenticateWithToken = async (req, res, next, {token, JWT_OPTIONS}) => {
         // https://github.com/auth0/node-jsonwebtoken/issues/208#issuecomment-231861138
         const secret = Buffer.from(apiKey.get('secret'), 'hex');
 
-        const {pathname} = url.parse(req.originalUrl);
-        const [hasMatch, version, api] = pathname.match(/ghost\/api\/([^/]+)\/([^/]+)\/(.+)*/); // eslint-disable-line no-unused-vars
+        // Using req.originalUrl means we get the right url even if version-rewrites have happened
+        const {version, api} = legacyApiPathMatch(req.originalUrl);
 
         // ensure the token was meant for this api
         let options;
-        if (!config.get('api:versions:all').includes(version)) {
-            // CASE: non-versioned api request
+
+        if (version) {
+            // CASE: legacy versioned api request
             options = Object.assign({
-                audience: new RegExp(`\/?${version}\/?$`) // eslint-disable-line no-useless-escape
+                audience: new RegExp(`/?${version}/${api}/?$`)
             }, JWT_OPTIONS);
         } else {
             options = Object.assign({
-                audience: new RegExp(`\/?${version}\/${api}\/?$`) // eslint-disable-line no-useless-escape
+                audience: new RegExp(`/?${api}/?$`)
             }, JWT_OPTIONS);
         }
 

package/core/server/services/auth/passwordreset.js

@@ -61,10 +61,10 @@ function generateToken(email, settingsAPI, transaction) {
 }
 
 function extractTokenParts(options) {
-    options.data.passwordreset[0].token = security.url.decodeBase64(options.data.passwordreset[0].token);
+    options.data.password_reset[0].token = security.url.decodeBase64(options.data.password_reset[0].token);
 
     const tokenParts = security.tokens.resetToken.extract({
-        token: options.data.passwordreset[0].token
+        token: options.data.password_reset[0].token
     });
 
     if (!tokenParts) {
@@ -93,7 +93,7 @@ function protectBruteForce({options, tokenParts}) {
 function doReset(options, tokenParts, settingsAPI) {
     let dbHash;
 
-    const data = options.data.passwordreset[0];
+    const data = options.data.password_reset[0];
     const resetToken = data.token;
     const oldPassword = data.oldPassword;
     const newPassword = data.newPassword;

package/core/server/services/auth/session/express-session.js

@@ -15,7 +15,7 @@ function getExpressSessionMiddleware() {
     if (!unoExpressSessionMiddleware) {
         unoExpressSessionMiddleware = session({
             store: sessionStore,
-            secret: settingsCache.get('session_secret'),
+            secret: settingsCache.get('admin_session_secret'),
             resave: false,
             saveUninitialized: false,
             name: 'ghost-admin-api-session',

package/core/server/services/auth/session/index.js

@@ -32,7 +32,7 @@ const sessionService = createSessionService({
     getOriginOfRequest,
     getSession: expressSession.getSession,
     findUserById({id}) {
-        return models.User.findOne({id});
+        return models.User.findOne({id, status: 'active'});
     }
 });
 

package/core/server/services/auth/setup.js

@@ -108,8 +108,8 @@ async function doSettings(data, settingsAPI) {
 }
 
 // Update names for default product and newsletter to site title
-async function doProductAndNewsletter(data, api) {
-    const {products: productsAPI, newsletters: newslettersAPI} = api;
+async function doTiersAndNewsletter(data, api) {
+    const {tiers: tiersAPI, newsletters: newslettersAPI} = api;
     const context = {context: {user: data.user.id}};
     const user = data.user;
     const blogTitle = data.userData.blogTitle;
@@ -118,16 +118,16 @@ async function doProductAndNewsletter(data, api) {
         return user;
     }
     try {
-        const productPage = await productsAPI.browse({limit: 'all'});
+        const tierPage = await tiersAPI.browse({limit: 'all'});
         const newsletterPage = await newslettersAPI.browse({limit: 'all'});
 
-        const defaultProduct = productPage.products.find(p => p.slug === 'default-product');
+        const defaultTier = tierPage.tiers.find(p => p.slug === 'default-product');
         const defaultNewsletter = newsletterPage.newsletters.find(p => p.slug === 'default-newsletter');
 
-        if (defaultProduct) {
-            await productsAPI.edit({products: [{
+        if (defaultTier) {
+            await tiersAPI.edit({tiers: [{
                 name: blogTitle.trim()
-            }]}, {context: context.context, id: defaultProduct.id});
+            }]}, {context: context.context, id: defaultTier.id});
         }
 
         if (defaultNewsletter) {
@@ -231,7 +231,7 @@ module.exports = {
     assertSetupCompleted: assertSetupCompleted,
     setupUser: setupUser,
     doSettings: doSettings,
-    doProductAndNewsletter: doProductAndNewsletter,
+    doProductAndNewsletter: doTiersAndNewsletter,
     installTheme: installTheme,
     doFixtures: doFixtures,
     sendWelcomeEmail: sendWelcomeEmail

package/core/server/services/bulk-email/bulk-email-processor.js

@@ -167,6 +167,9 @@ module.exports = {
         await emailBatchModel.save({status: 'submitting'}, knexOptions);
 
         try {
+            // Load newsletter data on email
+            await emailBatchModel.relations.email.related('newsletter').fetch(Object.assign({}, {require: false}, knexOptions));
+
             // send the email
             const sendResponse = await this.send(emailBatchModel.relations.email.toJSON(), recipientRows, memberSegment);
 
@@ -217,11 +220,12 @@ module.exports = {
 
         // collate static and dynamic data for each recipient ready for provider
         const recipientData = {};
+        const newsletterUuid = emailData.newsletter ? emailData.newsletter.uuid : null;
         recipients.forEach((recipient) => {
             // static data for every recipient
             const data = {
                 unique_id: recipient.member_uuid,
-                unsubscribe_url: postEmailSerializer.createUnsubscribeUrl(recipient.member_uuid)
+                unsubscribe_url: postEmailSerializer.createUnsubscribeUrl(recipient.member_uuid, newsletterUuid)
             };
 
             // computed properties on recipients - TODO: better way of handling these

package/core/server/services/frontend-data-service/frontend-data-service.js

@@ -0,0 +1,27 @@
+const errors = require('@tryghost/errors');
+const logging = require('@tryghost/logging');
+
+class FrontendDataService {
+    constructor({IntegrationModel}) {
+        this.IntegrationModel = IntegrationModel;
+        this.frontendKey = null;
+    }
+
+    async getFrontendKey() {
+        if (this.frontendKey) {
+            return this.frontendKey;
+        }
+
+        try {
+            const key = await this.IntegrationModel.getInternalFrontendKey();
+            this.frontendKey = key.toJSON().api_keys[0].secret;
+        } catch (error) {
+            this.frontendKey = null;
+            logging.error(new errors.InternalServerError({message: 'Unable to find the internal frontend key', err: error}));
+        }
+
+        return this.frontendKey;
+    }
+}
+
+module.exports = FrontendDataService;

package/core/server/services/frontend-data-service/index.js

@@ -0,0 +1,6 @@
+const models = require('../../models');
+const FrontendDataService = require('./frontend-data-service');
+
+module.exports.init = () => {
+    return new FrontendDataService({IntegrationModel: models.Integration});
+};

package/core/server/services/mail/index.js

@@ -1,2 +1,15 @@
+const path = require('path');
+const urlUtils = require('../../../shared/url-utils');
+const settingsCache = require('../../../shared/settings-cache');
+const EmailContentGenerator = require('@tryghost/email-content-generator');
+
+const emailContentGenerator = new EmailContentGenerator({
+    getSiteUrl: () => urlUtils.urlFor('home', true),
+    getSiteTitle: () => settingsCache.get('title'),
+    templatesDir: path.resolve(__dirname, '..', 'mail', 'templates')
+});
+
 exports.GhostMailer = require('./GhostMailer');
-exports.utils = require('./utils');
+exports.utils = {
+    generateContent: emailContentGenerator.getContent.bind(emailContentGenerator)
+};

package/core/server/services/mega/email-preview.js

@@ -2,26 +2,25 @@ const postEmailSerializer = require('./post-email-serializer');
 const models = require('../../models');
 
 class EmailPreview {
-    /**
-     * @constructor
-     * @param {Object} options
-     * @param {String} options.apiVersion
-     */
-    constructor({apiVersion}) {
-        this.apiVersion = apiVersion;
-    }
-
     /**
      * @param {Object} post - Post model object instance
-     * @param {String} memberSegment - member segment filter
+     * @param {Object} options
+     * @param {String} options.newsletter - newsletter slug
+     * @param {String} options.memberSegment - member segment filter
      * @returns {Promise<Object>}
      */
-    async generateEmailContent(post, memberSegment) {
-        const newsletter = await models.Newsletter.getDefaultNewsletter();
+    async generateEmailContent(post, {newsletter, memberSegment} = {}) {
+        let newsletterModel = post.relations.newsletter ?? await post.related('newsletter').fetch();
+        if (!newsletterModel) {
+            if (newsletter) {
+                newsletterModel = await models.Newsletter.findOne({slug: newsletter});
+            } else {
+                newsletterModel = await models.Newsletter.getDefaultNewsletter();
+            }
+        }
 
-        let emailContent = await postEmailSerializer.serialize(post, newsletter, {
-            isBrowserPreview: true,
-            apiVersion: this.apiVersion
+        let emailContent = await postEmailSerializer.serialize(post, newsletterModel, {
+            isBrowserPreview: true
         });
 
         if (memberSegment) {

package/core/server/services/mega/mega.js

@@ -17,7 +17,6 @@ const models = require('../../models');
 const postEmailSerializer = require('./post-email-serializer');
 const labs = require('../../../shared/labs');
 const {getSegmentsFromHtml} = require('./segment-parser');
-const labsService = require('../../../shared/labs');
 
 // Used to listen to email.added and email.edited model events originally, I think to offload this - ideally would just use jobs now if possible
 const events = require('../../lib/common/events');
@@ -28,6 +27,7 @@ const messages = {
     noneFilterError: 'Cannot send email to "none" {property}',
     emailSendingDisabled: `Email sending is temporarily disabled because your account is currently in review. You should have an email about this from us already, but you can also reach us any time at support@ghost.org`,
     sendEmailRequestFailed: 'The email service was unable to send an email batch.',
+    archivedNewsletterError: 'Cannot send email to archived newsletters',
     newsletterVisibilityError: 'Unexpected visibility value "{value}". Use one of the valid: "members", "paid".'
 };
 
@@ -51,11 +51,11 @@ const getReplyToAddress = (fromAddress, replyAddressOption) => {
  *
  * @param {Object} postModel - post model instance
  * @param {Object} options
- * @param {ValidAPIVersion} options.apiVersion - api version to be used when serializing email data
  */
 const getEmailData = async (postModel, options) => {
-    let newsletter = postModel.relations.newsletter ? postModel.relations.newsletter : (await postModel.related('newsletter').fetch());
+    let newsletter = postModel.relations.newsletter ?? await postModel.related('newsletter').fetch();
     if (!newsletter) {
+        // The postModel doesn't have a newsletter in test emails
         newsletter = await models.Newsletter.getDefaultNewsletter();
     }
     const {subject, html, plaintext} = await postEmailSerializer.serialize(postModel, newsletter, options);
@@ -83,11 +83,10 @@ const getEmailData = async (postModel, options) => {
  *
  * @param {Object} postModel - post model instance
  * @param {[string]} toEmails - member email addresses to send email to
- * @param {ValidAPIVersion} apiVersion - api version to be used when serializing email data
  * @param {ValidMemberSegment} [memberSegment]
  */
-const sendTestEmail = async (postModel, toEmails, apiVersion, memberSegment) => {
-    let emailData = await getEmailData(postModel, {apiVersion});
+const sendTestEmail = async (postModel, toEmails, memberSegment) => {
+    let emailData = await getEmailData(postModel);
     emailData.subject = `[Test] ${emailData.subject}`;
 
     if (memberSegment) {
@@ -134,28 +133,14 @@ const sendTestEmail = async (postModel, toEmails, apiVersion, memberSegment) =>
  *
  * Accepts a filter string, errors on unexpected legacy filter syntax and enforces subscribed:true
  *
+ * @param {Object} newsletter
  * @param {string} emailRecipientFilter NQL filter for members
- * @param {object} options
+ * @param {string} errorProperty
  */
-const transformEmailRecipientFilter = (emailRecipientFilter, {errorProperty = 'email_recipient_filter'} = {}, newsletter = null) => {
-    let filter = [];
-
-    if (!newsletter) {
-        filter.push(`subscribed:true`);
-    } else {
-        filter.push(`newsletters.id:${newsletter.id}`);
-    }
+const transformEmailRecipientFilter = (newsletter, emailRecipientFilter, errorProperty) => {
+    const filter = [`newsletters.id:${newsletter.id}`];
 
     switch (emailRecipientFilter) {
-    // `paid` and `free` were swapped out for NQL filters in 4.5.0, we shouldn't see them here now
-    case 'paid':
-    case 'free':
-        throw new errors.InternalServerError({
-            message: tpl(messages.unexpectedFilterError, {
-                property: errorProperty,
-                value: emailRecipientFilter
-            })
-        });
     case 'all':
         break;
     case 'none':
@@ -169,22 +154,20 @@ const transformEmailRecipientFilter = (emailRecipientFilter, {errorProperty = 'e
         break;
     }
 
-    if (newsletter) {
-        const visibility = newsletter.get('visibility');
-        switch (visibility) {
-        case 'members':
-            // No need to add a member status filter as the email is available to all members
-            break;
-        case 'paid':
-            filter.push(`status:-free`);
-            break;
-        default:
-            throw new errors.InternalServerError({
-                message: tpl(messages.newsletterVisibilityError, {
-                    value: visibility
-                })
-            });
-        }
+    const visibility = newsletter.get('visibility');
+    switch (visibility) {
+    case 'members':
+        // No need to add a member status filter as the email is available to all members
+        break;
+    case 'paid':
+        filter.push(`status:-free`);
+        break;
+    default:
+        throw new errors.InternalServerError({
+            message: tpl(messages.newsletterVisibilityError, {
+                value: visibility
+            })
+        });
     }
 
     return filter.join('+');
@@ -198,8 +181,6 @@ const transformEmailRecipientFilter = (emailRecipientFilter, {errorProperty = 'e
  *
  * @param {object} postModel Post Model Object
  * @param {object} options
- * @param {ValidAPIVersion} options.apiVersion - api version to be used when serializing email data
- * @param {string} options.newsletter_id - the newsletter_id to send the email to
  */
 
 const addEmail = async (postModel, options) => {
@@ -216,10 +197,19 @@ const addEmail = async (postModel, options) => {
     const knexOptions = _.pick(options, ['transacting', 'forUpdate']);
     const filterOptions = {...knexOptions, limit: 1};
 
-    const newsletter = postModel.relations.newsletter ? postModel.relations.newsletter : (await postModel.related('newsletter').fetch({require: true, ..._.pick(options, ['transacting'])}));
+    // TODO: this is a hack for https://github.com/TryGhost/Team/issues/1626
+    const newsletter = postModel.relations.newsletter ?? await postModel.related('newsletter').fetch({require: true, ..._.pick(options, ['transacting'])});
+
+    if (newsletter.get('status') !== 'active') {
+        // A post might have been scheduled to an archived newsletter.
+        // Don't send it (people can't unsubscribe any longer).
+        throw new errors.EmailError({
+            message: tpl(messages.archivedNewsletterError)
+        });
+    }
 
     const emailRecipientFilter = postModel.get('email_recipient_filter');
-    filterOptions.filter = transformEmailRecipientFilter(emailRecipientFilter, {errorProperty: 'email_recipient_filter'}, newsletter);
+    filterOptions.filter = transformEmailRecipientFilter(newsletter, emailRecipientFilter, 'email_segment');
 
     const startRetrieve = Date.now();
     debug('addEmail: retrieving members count');
@@ -426,11 +416,8 @@ async function getEmailMemberRows({emailModel, memberSegment, options}) {
     const knexOptions = _.pick(options, ['transacting', 'forUpdate']);
     const filterOptions = Object.assign({}, knexOptions);
 
-    let newsletter = null;
-    if (labsService.isSet('multipleNewsletters')) {
-        newsletter = await emailModel.relations.newsletter ? emailModel.relations.newsletter : (emailModel.related('newsletter').fetch(Object.assign({}, {require: false}, _.pick(options, ['transacting']))));
-    }
-    const recipientFilter = transformEmailRecipientFilter(emailModel.get('recipient_filter'), {errorProperty: 'recipient_filter'}, newsletter);
+    const newsletter = emailModel.relations.newsletter ?? await emailModel.related('newsletter').fetch(Object.assign({}, {require: true}, _.pick(options, ['transacting'])));
+    const recipientFilter = transformEmailRecipientFilter(newsletter, emailModel.get('recipient_filter'), 'recipient_filter');
     filterOptions.filter = recipientFilter;
 
     if (memberSegment) {
@@ -613,6 +600,5 @@ module.exports = {
 };
 
 /**
- * @typedef {'v2' | 'v3' | 'v4' | 'canary' } ValidAPIVersion
  * @typedef {'status:free' | 'status:-free'} ValidMemberSegment
  */