ghost 4.47.3 → 5.0.0

package/core/server/api/v3/tags.js

@@ -1,159 +0,0 @@
-const Promise = require('bluebird');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-
-const ALLOWED_INCLUDES = ['count.posts'];
-
-const messages = {
-    tagNotFound: 'Tag not found.'
-};
-
-module.exports = {
-    docName: 'tags',
-
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'limit',
-            'order',
-            'page',
-            'debug'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Tag.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'debug'
-        ],
-        data: [
-            'id',
-            'slug',
-            'visibility'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Tag.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.tagNotFound)
-                        }));
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    add: {
-        statusCode: 201,
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'include'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Tag.add(frame.data.tags[0], frame.options);
-        }
-    },
-
-    edit: {
-        headers: {},
-        options: [
-            'id',
-            'include'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Tag.edit(frame.data.tags[0], frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.tagNotFound)
-                        }));
-                    }
-
-                    if (model.wasChanged()) {
-                        this.headers.cacheInvalidate = true;
-                    } else {
-                        this.headers.cacheInvalidate = false;
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    destroy: {
-        statusCode: 204,
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Tag.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Tag.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.tagNotFound)
-                    }));
-                });
-        }
-    }
-};

package/core/server/api/v3/themes.js

@@ -1,131 +0,0 @@
-const themeService = require('../../services/themes');
-const limitService = require('../../services/limits');
-const models = require('../../models');
-
-// Used to emit theme.uploaded which is used in core/server/analytics-events
-const events = require('../../lib/common/events');
-
-module.exports = {
-    docName: 'themes',
-
-    browse: {
-        permissions: true,
-        query() {
-            return themeService.api.getJSON();
-        }
-    },
-
-    activate: {
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'name'
-        ],
-        validation: {
-            options: {
-                name: {
-                    required: true
-                }
-            }
-        },
-        permissions: true,
-        async query(frame) {
-            let themeName = frame.options.name;
-
-            if (limitService.isLimited('customThemes')) {
-                await limitService.errorIfWouldGoOverLimit('customThemes', {value: themeName});
-            }
-
-            const newSettings = [{
-                key: 'active_theme',
-                value: themeName
-            }];
-
-            return themeService.api.activate(themeName)
-                .then((checkedTheme) => {
-                    // @NOTE: we use the model, not the API here, as we don't want to trigger permissions
-                    return models.Settings.edit(newSettings, frame.options)
-                        .then(() => checkedTheme);
-                })
-                .then((checkedTheme) => {
-                    return themeService.api.getJSON(themeName, checkedTheme);
-                });
-        }
-    },
-
-    upload: {
-        headers: {},
-        permissions: {
-            method: 'add'
-        },
-        async query(frame) {
-            if (limitService.isLimited('customThemes')) {
-                // Sending a bad string to make sure it fails (empty string isn't valid)
-                await limitService.errorIfWouldGoOverLimit('customThemes', {value: '.'});
-            }
-
-            // @NOTE: consistent filename uploads
-            frame.options.originalname = frame.file.originalname.toLowerCase();
-
-            let zip = {
-                path: frame.file.path,
-                name: frame.file.originalname
-            };
-
-            return themeService.api.setFromZip(zip)
-                .then(({theme, themeOverridden}) => {
-                    if (themeOverridden) {
-                        // CASE: clear cache
-                        this.headers.cacheInvalidate = true;
-                    }
-                    events.emit('theme.uploaded');
-                    return theme;
-                });
-        }
-    },
-
-    download: {
-        options: [
-            'name'
-        ],
-        validation: {
-            options: {
-                name: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            method: 'read'
-        },
-        query(frame) {
-            let themeName = frame.options.name;
-
-            return themeService.api.getZip(themeName);
-        }
-    },
-
-    destroy: {
-        statusCode: 204,
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'name'
-        ],
-        validation: {
-            options: {
-                name: {
-                    required: true
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            let themeName = frame.options.name;
-
-            return themeService.api.destroy(themeName);
-        }
-    }
-};

package/core/server/api/v3/users.js

@@ -1,242 +0,0 @@
-const Promise = require('bluebird');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-const permissionsService = require('../../services/permissions');
-const dbBackup = require('../../data/db/backup');
-const auth = require('../../services/auth');
-const apiMail = require('./index').mail;
-const apiSettings = require('./index').settings;
-const UsersService = require('../../services/users');
-const userService = new UsersService({dbBackup, models, auth, apiMail, apiSettings});
-const ALLOWED_INCLUDES = ['count.posts', 'permissions', 'roles', 'roles.permissions'];
-const UNSAFE_ATTRS = ['status', 'roles'];
-
-const messages = {
-    noPermissionToAction: 'You do not have permission to perform this action',
-    userNotFound: 'User not found.'
-};
-
-function permissionOnlySelf(frame) {
-    const targetId = getTargetId(frame);
-    const userId = frame.user.id;
-    if (targetId !== userId) {
-        return Promise.reject(new errors.NoPermissionError({message: tpl(messages.noPermissionToAction)}));
-    }
-    return Promise.resolve();
-}
-
-function getTargetId(frame) {
-    return frame.options.id === 'me' ? frame.user.id : frame.options.id;
-}
-
-async function fetchOrCreatePersonalToken(userId) {
-    const token = await models.ApiKey.findOne({user_id: userId}, {});
-
-    if (!token) {
-        const newToken = await models.ApiKey.add({user_id: userId, type: 'admin'});
-        return newToken;
-    }
-
-    return token;
-}
-
-module.exports = {
-    docName: 'users',
-
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'limit',
-            'order',
-            'page',
-            'debug'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.User.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'debug'
-        ],
-        data: [
-            'id',
-            'slug',
-            'email',
-            'role'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.User.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.userNotFound)
-                        }));
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    edit: {
-        headers: {},
-        options: [
-            'id',
-            'include'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                },
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            unsafeAttrs: UNSAFE_ATTRS
-        },
-        query(frame) {
-            return models.User.edit(frame.data.users[0], frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.userNotFound)
-                        }));
-                    }
-
-                    if (model.wasChanged()) {
-                        this.headers.cacheInvalidate = true;
-                    } else {
-                        this.headers.cacheInvalidate = false;
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    destroy: {
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: true,
-        async query(frame) {
-            return userService.destroyUser(frame.options).catch((err) => {
-                return Promise.reject(new errors.NoPermissionError({
-                    err: err
-                }));
-            });
-        }
-    },
-
-    changePassword: {
-        validation: {
-            docName: 'password',
-            data: {
-                newPassword: {required: true},
-                ne2Password: {required: true},
-                user_id: {required: true}
-            }
-        },
-        permissions: {
-            docName: 'user',
-            method: 'edit',
-            identifier(frame) {
-                return frame.data.password[0].user_id;
-            }
-        },
-        query(frame) {
-            frame.options.skipSessionID = frame.original.session.id;
-            return models.User.changePassword(frame.data.password[0], frame.options);
-        }
-    },
-
-    transferOwnership: {
-        permissions(frame) {
-            return models.Role.findOne({name: 'Owner'})
-                .then((ownerRole) => {
-                    return permissionsService.canThis(frame.options.context).assign.role(ownerRole);
-                });
-        },
-        query(frame) {
-            return models.User.transferOwnership(frame.data.owner[0], frame.options);
-        }
-    },
-
-    readToken: {
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: permissionOnlySelf,
-        query(frame) {
-            const targetId = getTargetId(frame);
-            return fetchOrCreatePersonalToken(targetId);
-        }
-    },
-
-    regenerateToken: {
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: permissionOnlySelf,
-        query(frame) {
-            const targetId = getTargetId(frame);
-            return fetchOrCreatePersonalToken(targetId).then((model) => {
-                return models.ApiKey.refreshSecret(model.toJSON(), Object.assign({}, {id: model.id}));
-            });
-        }
-    }
-};

package/core/server/api/v3/utils/index.js

@@ -1,34 +0,0 @@
-module.exports = {
-    get permissions() {
-        return require('./permissions');
-    },
-
-    get serializers() {
-        return require('./serializers');
-    },
-
-    get validators() {
-        return require('./validators');
-    },
-
-    /**
-     * @description Does the request access the Content API?
-     *
-     * Each controller is either for the Content or for the Admin API.
-     * When Ghost registers each controller, it currently passes a String "content" if the controller
-     * is a Content API implementation -  see index.js file.
-     *
-     * @TODO: Move this helper function into a utils.js file.
-     * @param {Object} frame
-     * @return {boolean}
-     */
-    isContentAPI: (frame) => {
-        return frame.apiType === 'content';
-    },
-
-    // @TODO: Remove, not used.
-    isAdminAPIKey: (frame) => {
-        return frame.options.context && Object.keys(frame.options.context).length !== 0 && frame.options.context.api_key &&
-            frame.options.context.api_key.type === 'admin';
-    }
-};

package/core/server/api/v3/utils/permissions.js

@@ -1,116 +0,0 @@
-const debug = require('@tryghost/debug')('api:v3:utils:permissions');
-const Promise = require('bluebird');
-const _ = require('lodash');
-const permissions = require('../../../services/permissions');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-
-const messages = {
-    noPermissionToCall: 'You do not have permission to {method} {docName}'
-};
-
-/**
- * @description Handle requests, which need authentication.
- *
- * @param {Object} apiConfig - Docname & method of API ctrl
- * @param {Object} frame
- * @return {Promise}
- */
-const nonePublicAuth = (apiConfig, frame) => {
-    debug('check admin permissions');
-
-    let singular;
-    if (apiConfig.docName.match(/ies$/)) {
-        singular = apiConfig.docName.replace(/ies$/, 'y');
-    } else {
-        singular = apiConfig.docName.replace(/s$/, '');
-    }
-    let permissionIdentifier = frame.options.id;
-
-    // CASE: Target ctrl can override the identifier. The identifier is the unique identifier of the target resource
-    //       e.g. edit a setting -> the key of the setting
-    //       e.g. edit a post -> post id from url param
-    //       e.g. change user password -> user id inside of the body structure
-    if (apiConfig.identifier) {
-        permissionIdentifier = apiConfig.identifier(frame);
-    }
-
-    let unsafeAttrObject = apiConfig.unsafeAttrs && _.has(frame, `data.[${apiConfig.docName}][0]`) ? _.pick(frame.data[apiConfig.docName][0], apiConfig.unsafeAttrs) : {};
-
-    if (apiConfig.unsafeAttrsObject) {
-        unsafeAttrObject = apiConfig.unsafeAttrsObject(frame);
-    }
-
-    const permsPromise = permissions.canThis(frame.options.context)[apiConfig.method][singular](permissionIdentifier, unsafeAttrObject);
-
-    return permsPromise.then((result) => {
-        /*
-         * Allow the permissions function to return a list of excluded attributes.
-         * If it does, omit those attrs from the data passed through
-         *
-         * NOTE: excludedAttrs differ from unsafeAttrs in that they're determined by the model's permissible function,
-         * and the attributes are simply excluded rather than throwing a NoPermission exception
-         *
-         * TODO: This is currently only needed because of the posts model and the contributor role. Once we extend the
-         * contributor role to be able to edit existing tags, this concept can be removed.
-         */
-        if (result && result.excludedAttrs && _.has(frame, `data.[${apiConfig.docName}][0]`)) {
-            frame.data[apiConfig.docName][0] = _.omit(frame.data[apiConfig.docName][0], result.excludedAttrs);
-        }
-    }).catch((err) => {
-        if (err instanceof errors.NoPermissionError) {
-            err.message = tpl(messages.noPermissionToCall, {
-                method: apiConfig.method,
-                docName: apiConfig.docName
-            });
-            return Promise.reject(err);
-        }
-
-        if (errors.utils.isGhostError(err)) {
-            return Promise.reject(err);
-        }
-
-        return Promise.reject(new errors.InternalServerError({
-            err: err
-        }));
-    });
-};
-
-// @TODO: https://github.com/TryGhost/Ghost/issues/10735
-module.exports = {
-    /**
-     * @description Handle permission stage for v3 API.
-     *
-     * @param {Object} apiConfig - Docname & method of target ctrl.
-     * @param {Object} frame
-     * @return {Promise}
-     */
-    handle(apiConfig, frame) {
-        debug('handle');
-
-        // @TODO: https://github.com/TryGhost/Ghost/issues/10099
-        frame.options.context = permissions.parseContext(frame.options.context);
-
-        // CASE: Content API access
-        if (frame.options.context.public) {
-            debug('check content permissions');
-
-            // @TODO: Remove when we drop v0.1
-            // @TODO: https://github.com/TryGhost/Ghost/issues/10733
-            return permissions.applyPublicRules(apiConfig.docName, apiConfig.method, {
-                status: frame.options.status,
-                id: frame.options.id,
-                uuid: frame.options.uuid,
-                slug: frame.options.slug,
-                data: {
-                    status: frame.data.status,
-                    id: frame.data.id,
-                    uuid: frame.data.uuid,
-                    slug: frame.data.slug
-                }
-            });
-        }
-
-        return nonePublicAuth(apiConfig, frame);
-    }
-};

package/core/server/api/v3/utils/serializers/index.js

@@ -1,9 +0,0 @@
-module.exports = {
-    get input() {
-        return require('./input');
-    },
-
-    get output() {
-        return require('./output');
-    }
-};