ghost 4.47.3 → 5.0.0

package/core/server/web/api/v3/admin/middleware.js

@@ -1,89 +0,0 @@
-const errors = require('@tryghost/errors');
-const tpl = require('@tryghost/tpl');
-const auth = require('../../../../services/auth');
-const shared = require('../../../shared');
-const apiMw = require('../../middleware');
-
-const messages = {
-    notImplemented: 'The server does not support the functionality required to fulfill the request.'
-};
-
-const notImplemented = function (req, res, next) {
-    // CASE: user is logged in, allow
-    if (!req.api_key) {
-        return next();
-    }
-
-    // @NOTE: integrations have limited access for now
-    const allowlisted = {
-        // @NOTE: stable
-        site: ['GET'],
-        posts: ['GET', 'PUT', 'DELETE', 'POST'],
-        pages: ['GET', 'PUT', 'DELETE', 'POST'],
-        images: ['POST'],
-        webhooks: ['POST', 'PUT', 'DELETE'],
-        // @NOTE: experimental
-        actions: ['GET'],
-        tags: ['GET', 'PUT', 'DELETE', 'POST'],
-        labels: ['GET', 'PUT', 'DELETE', 'POST'],
-        users: ['GET'],
-        themes: ['POST', 'PUT'],
-        members: ['GET', 'PUT', 'DELETE', 'POST'],
-        config: ['GET'],
-        schedules: ['PUT'],
-        db: ['POST']
-    };
-
-    const match = req.url.match(/^\/(\w+)\/?/);
-
-    if (match) {
-        const entity = match[1];
-
-        if (allowlisted[entity] && allowlisted[entity].includes(req.method)) {
-            return next();
-        }
-    }
-
-    next(new errors.InternalServerError({
-        errorType: 'NotImplementedError',
-        message: tpl(messages.notImplemented),
-        statusCode: '501'
-    }));
-};
-
-/**
- * Authentication for private endpoints
- */
-module.exports.authAdminApi = [
-    auth.authenticate.authenticateAdminApi,
-    auth.authorize.authorizeAdminApi,
-    apiMw.updateUserLastSeen,
-    apiMw.cors,
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls,
-    notImplemented
-];
-
-/**
- * Authentication for private endpoints with token in URL
- * Ex.: For scheduler publish endpoint
- */
-module.exports.authAdminApiWithUrl = [
-    auth.authenticate.authenticateAdminApiWithUrl,
-    auth.authorize.authorizeAdminApi,
-    apiMw.updateUserLastSeen,
-    apiMw.cors,
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls,
-    notImplemented
-];
-
-/**
- * Middleware for public admin endpoints
- */
-module.exports.publicAdminApi = [
-    apiMw.cors,
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls,
-    notImplemented
-];

package/core/server/web/api/v3/admin/routes.js

@@ -1,267 +0,0 @@
-const express = require('../../../../../shared/express');
-const api = require('../../../../api').v3;
-const apiMw = require('../../middleware');
-const mw = require('./middleware');
-
-const shared = require('../../../shared');
-
-module.exports = function apiRoutes() {
-    const router = express.Router('v3 admin');
-
-    // alias delete with del
-    router.del = router.delete;
-
-    router.use(apiMw.cors);
-
-    const http = api.http;
-
-    // ## Public
-    router.get('/site', mw.publicAdminApi, http(api.site.read));
-
-    // ## Configuration
-    router.get('/config', mw.authAdminApi, http(api.config.read));
-
-    // ## Posts
-    router.get('/posts', mw.authAdminApi, http(api.posts.browse));
-    router.post('/posts', mw.authAdminApi, http(api.posts.add));
-    router.get('/posts/:id', mw.authAdminApi, http(api.posts.read));
-    router.get('/posts/slug/:slug', mw.authAdminApi, http(api.posts.read));
-    router.put('/posts/:id', mw.authAdminApi, http(api.posts.edit));
-    router.del('/posts/:id', mw.authAdminApi, http(api.posts.destroy));
-
-    // ## Pages
-    router.get('/pages', mw.authAdminApi, http(api.pages.browse));
-    router.post('/pages', mw.authAdminApi, http(api.pages.add));
-    router.get('/pages/:id', mw.authAdminApi, http(api.pages.read));
-    router.get('/pages/slug/:slug', mw.authAdminApi, http(api.pages.read));
-    router.put('/pages/:id', mw.authAdminApi, http(api.pages.edit));
-    router.del('/pages/:id', mw.authAdminApi, http(api.pages.destroy));
-
-    // # Integrations
-
-    router.get('/integrations', mw.authAdminApi, http(api.integrations.browse));
-    router.get('/integrations/:id', mw.authAdminApi, http(api.integrations.read));
-    router.post('/integrations', mw.authAdminApi, http(api.integrations.add));
-    router.post('/integrations/:id/api_key/:keyid/refresh', mw.authAdminApi, http(api.integrations.edit));
-    router.put('/integrations/:id', mw.authAdminApi, http(api.integrations.edit));
-    router.del('/integrations/:id', mw.authAdminApi, http(api.integrations.destroy));
-
-    // ## Schedules
-    router.put('/schedules/:resource/:id', mw.authAdminApiWithUrl, http(api.schedules.publish));
-
-    // ## Settings
-    router.get('/settings/routes/yaml', mw.authAdminApi, http(api.settings.download));
-    router.post('/settings/routes/yaml',
-        mw.authAdminApi,
-        apiMw.upload.single('routes'),
-        apiMw.upload.validation({type: 'routes'}),
-        http(api.settings.upload)
-    );
-
-    router.get('/settings', mw.authAdminApi, http(api.settings.browse));
-    router.get('/settings/:key', mw.authAdminApi, http(api.settings.read));
-    router.put('/settings', mw.authAdminApi, http(api.settings.edit));
-    router.get('/settings/members/email', http(api.settings.validateMembersEmailUpdate));
-    router.post('/settings/members/email', mw.authAdminApi, http(api.settings.updateMembersEmail));
-    router.del('/settings/stripe/connect', mw.authAdminApi, http(api.settings.disconnectStripeConnectIntegration));
-
-    // ## Users
-    router.get('/users', mw.authAdminApi, http(api.users.browse));
-    router.get('/users/:id', mw.authAdminApi, http(api.users.read));
-    router.get('/users/slug/:slug', mw.authAdminApi, http(api.users.read));
-    // NOTE: We don't expose any email addresses via the public api.
-    router.get('/users/email/:email', mw.authAdminApi, http(api.users.read));
-    router.get('/users/:id/token', mw.authAdminApi, http(api.users.readToken));
-
-    router.put('/users/password', mw.authAdminApi, http(api.users.changePassword));
-    router.put('/users/owner', mw.authAdminApi, http(api.users.transferOwnership));
-    router.put('/users/:id', mw.authAdminApi, http(api.users.edit));
-    router.put('/users/:id/token', mw.authAdminApi, http(api.users.regenerateToken));
-    router.del('/users/:id', mw.authAdminApi, http(api.users.destroy));
-
-    // ## Tags
-    router.get('/tags', mw.authAdminApi, http(api.tags.browse));
-    router.get('/tags/:id', mw.authAdminApi, http(api.tags.read));
-    router.get('/tags/slug/:slug', mw.authAdminApi, http(api.tags.read));
-    router.post('/tags', mw.authAdminApi, http(api.tags.add));
-    router.put('/tags/:id', mw.authAdminApi, http(api.tags.edit));
-    router.del('/tags/:id', mw.authAdminApi, http(api.tags.destroy));
-
-    // ## Members
-    router.get('/members', mw.authAdminApi, http(api.members.browse));
-    router.post('/members', mw.authAdminApi, http(api.members.add));
-
-    router.get('/members/stats', mw.authAdminApi, http(api.members.stats));
-
-    router.get('/members/upload', mw.authAdminApi, http(api.members.exportCSV));
-    router.post('/members/upload',
-        mw.authAdminApi,
-        apiMw.upload.single('membersfile'),
-        apiMw.upload.validation({type: 'members'}),
-        http(api.members.importCSV)
-    );
-
-    router.get('/members/hasActiveStripeSubscriptions', mw.authAdminApi, http(api.members.hasActiveStripeSubscriptions));
-
-    router.get('/members/stripe_connect', mw.authAdminApi, http(api.membersStripeConnect.auth));
-
-    router.get('/members/:id', mw.authAdminApi, http(api.members.read));
-    router.put('/members/:id', mw.authAdminApi, http(api.members.edit));
-    router.del('/members/:id', mw.authAdminApi, http(api.members.destroy));
-
-    router.put('/members/:id/subscriptions/:subscription_id', mw.authAdminApi, http(api.members.editSubscription));
-
-    router.get('/members/:id/signin_urls', mw.authAdminApi, http(api.memberSigninUrls.read));
-
-    // ## Labels
-    router.get('/labels', mw.authAdminApi, http(api.labels.browse));
-    router.get('/labels/:id', mw.authAdminApi, http(api.labels.read));
-    router.get('/labels/slug/:slug', mw.authAdminApi, http(api.labels.read));
-    router.post('/labels', mw.authAdminApi, http(api.labels.add));
-    router.put('/labels/:id', mw.authAdminApi, http(api.labels.edit));
-    router.del('/labels/:id', mw.authAdminApi, http(api.labels.destroy));
-
-    // ## Roles
-    router.get('/roles/', mw.authAdminApi, http(api.roles.browse));
-
-    // ## Slugs
-    router.get('/slugs/:type/:name', mw.authAdminApi, http(api.slugs.generate));
-
-    // ## Themes
-    router.get('/themes/', mw.authAdminApi, http(api.themes.browse));
-
-    router.get('/themes/:name/download',
-        mw.authAdminApi,
-        http(api.themes.download)
-    );
-
-    router.post('/themes/upload',
-        mw.authAdminApi,
-        apiMw.upload.single('file'),
-        apiMw.upload.validation({type: 'themes'}),
-        http(api.themes.upload)
-    );
-
-    router.put('/themes/:name/activate',
-        mw.authAdminApi,
-        http(api.themes.activate)
-    );
-
-    router.del('/themes/:name',
-        mw.authAdminApi,
-        http(api.themes.destroy)
-    );
-
-    // ## Notifications
-    router.get('/notifications', mw.authAdminApi, http(api.notifications.browse));
-    router.post('/notifications', mw.authAdminApi, http(api.notifications.add));
-    router.del('/notifications/:notification_id', mw.authAdminApi, http(api.notifications.destroy));
-
-    // ## DB
-    router.get('/db', mw.authAdminApi, http(api.db.exportContent));
-    router.post('/db',
-        mw.authAdminApi,
-        apiMw.upload.single('importfile'),
-        apiMw.upload.validation({type: 'db'}),
-        http(api.db.importContent)
-    );
-    router.del('/db', mw.authAdminApi, http(api.db.deleteAllContent));
-    router.post('/db/backup',
-        mw.authAdminApi,
-        http(api.db.backupContent)
-    );
-
-    // ## Mail
-    router.post('/mail', mw.authAdminApi, http(api.mail.send));
-    router.post('/mail/test', mw.authAdminApi, http(api.mail.sendTest));
-
-    // ## Slack
-    router.post('/slack/test', mw.authAdminApi, http(api.slack.sendTest));
-
-    // ## Sessions
-    router.get('/session', mw.authAdminApi, http(api.session.read));
-    // We don't need auth when creating a new session (logging in)
-    router.post('/session',
-        shared.middleware.brute.globalBlock,
-        shared.middleware.brute.userLogin,
-        http(api.session.add)
-    );
-    router.del('/session', mw.authAdminApi, http(api.session.delete));
-
-    // ## Identity
-    router.get('/identities', mw.authAdminApi, http(api.identities.read));
-
-    // ## Authentication
-    router.post('/authentication/passwordreset',
-        shared.middleware.brute.globalReset,
-        shared.middleware.brute.userReset,
-        http(api.authentication.generateResetToken)
-    );
-    router.put('/authentication/passwordreset', shared.middleware.brute.globalBlock, http(api.authentication.resetPassword));
-    router.post('/authentication/invitation', http(api.authentication.acceptInvitation));
-    router.get('/authentication/invitation', http(api.authentication.isInvitation));
-    router.post('/authentication/setup', http(api.authentication.setup));
-    router.put('/authentication/setup', mw.authAdminApi, http(api.authentication.updateSetup));
-    router.get('/authentication/setup', http(api.authentication.isSetup));
-
-    // ## Images
-    router.post('/images/upload',
-        mw.authAdminApi,
-        apiMw.upload.single('file'),
-        apiMw.upload.validation({type: 'images'}),
-        apiMw.normalizeImage,
-        http(api.images.upload)
-    );
-
-    // ## Invites
-    router.get('/invites', mw.authAdminApi, http(api.invites.browse));
-    router.get('/invites/:id', mw.authAdminApi, http(api.invites.read));
-    router.post('/invites', mw.authAdminApi, http(api.invites.add));
-    router.del('/invites/:id', mw.authAdminApi, http(api.invites.destroy));
-
-    // ## Redirects
-    // TODO: yaml support has been added to https://github.com/TryGhost/Ghost/issues/11085
-    // The `/json` endpoints below are left for backward compatibility. They'll be removed in v4.
-    router.get('/redirects/json', mw.authAdminApi, http(api.redirects.download));
-    router.post('/redirects/json',
-        mw.authAdminApi,
-        apiMw.upload.single('redirects'),
-        apiMw.upload.validation({type: 'redirects'}),
-        http(api.redirects.upload)
-    );
-    router.get('/redirects/download', mw.authAdminApi, http(api.redirects.download));
-    router.post('/redirects/upload',
-        mw.authAdminApi,
-        apiMw.upload.single('redirects'),
-        apiMw.upload.validation({type: 'redirects'}),
-        http(api.redirects.upload)
-    );
-
-    // ## Webhooks (RESTHooks)
-    router.post('/webhooks', mw.authAdminApi, http(api.webhooks.add));
-    router.put('/webhooks/:id', mw.authAdminApi, http(api.webhooks.edit));
-    router.del('/webhooks/:id', mw.authAdminApi, http(api.webhooks.destroy));
-
-    // ## Oembed (fetch response from oembed provider)
-    router.get('/oembed', mw.authAdminApi, http(api.oembed.read));
-
-    // ## Actions
-    router.get('/actions', mw.authAdminApi, http(api.actions.browse));
-
-    // ## Email Preview
-    router.get('/email_preview/posts/:id', mw.authAdminApi, http(api.email_preview.read));
-    router.post('/email_preview/posts/:id', mw.authAdminApi, http(api.email_preview.sendTestEmail));
-
-    // ## Emails
-    router.get('/emails/:id', mw.authAdminApi, http(api.emails.read));
-    router.put('/emails/:id/retry', mw.authAdminApi, http(api.emails.retry));
-
-    // ## Snippets
-    router.get('/snippets', mw.authAdminApi, http(api.snippets.browse));
-    router.get('/snippets/:id', mw.authAdminApi, http(api.snippets.read));
-    router.post('/snippets', mw.authAdminApi, http(api.snippets.add));
-    router.put('/snippets/:id', mw.authAdminApi, http(api.snippets.edit));
-    router.del('/snippets/:id', mw.authAdminApi, http(api.snippets.destroy));
-
-    return router;
-};

package/core/server/web/api/v3/content/app.js

@@ -1,38 +0,0 @@
-const debug = require('@tryghost/debug')('web:api:v3:content:app');
-const boolParser = require('express-query-boolean');
-const bodyParser = require('body-parser');
-const express = require('../../../../../shared/express');
-const sentry = require('../../../../../shared/sentry');
-const shared = require('../../../shared');
-const routes = require('./routes');
-const errorHandler = require('@tryghost/mw-error-handler');
-const versionMissmatchHandler = require('@tryghost/mw-api-version-mismatch');
-const {APIVersionCompatibilityServiceInstance} = require('../../../../services/api-version-compatibility');
-
-module.exports = function setupApiApp() {
-    debug('Content API v3 setup start');
-    const apiApp = express('v3 content');
-
-    // API middleware
-
-    // @NOTE: req.body is undefined if we don't use this parser, this can trouble if components rely on req.body being present
-    apiApp.use(bodyParser.json({limit: '1mb'}));
-
-    // Query parsing
-    apiApp.use(boolParser());
-
-    // API shouldn't be cached
-    apiApp.use(shared.middleware.cacheControl('private'));
-
-    // Routing
-    apiApp.use(routes());
-
-    // API error handling
-    apiApp.use(errorHandler.resourceNotFound);
-    apiApp.use(versionMissmatchHandler(APIVersionCompatibilityServiceInstance));
-    apiApp.use(errorHandler.handleJSONResponse(sentry));
-
-    debug('Content API v3 setup end');
-
-    return apiApp;
-};

package/core/server/web/api/v3/content/middleware.js

@@ -1,23 +0,0 @@
-const cors = require('cors');
-const auth = require('../../../../services/auth');
-const shared = require('../../../shared');
-
-/**
- * Auth Middleware Packages
- *
- * IMPORTANT
- * - cors middleware MUST happen before pretty urls, because otherwise cors header can get lost on redirect
- * - url redirects MUST happen after cors, otherwise cors header can get lost on redirect
- */
-
-/**
- * Authentication for public endpoints
- */
-module.exports.authenticatePublic = [
-    shared.middleware.brute.contentApiKey,
-    auth.authenticate.authenticateContentApi,
-    auth.authorize.authorizeContentApi,
-    cors(),
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls
-];

package/core/server/web/api/v3/content/routes.js

@@ -1,37 +0,0 @@
-const express = require('../../../../../shared/express');
-const cors = require('cors');
-const api = require('../../../../api').v3;
-const mw = require('./middleware');
-
-module.exports = function apiRoutes() {
-    const router = express.Router('v3 content');
-
-    router.use(cors());
-
-    const http = api.http;
-
-    // ## Posts
-    router.get('/posts', mw.authenticatePublic, http(api.postsPublic.browse));
-    router.get('/posts/:id', mw.authenticatePublic, http(api.postsPublic.read));
-    router.get('/posts/slug/:slug', mw.authenticatePublic, http(api.postsPublic.read));
-
-    // ## Pages
-    router.get('/pages', mw.authenticatePublic, http(api.pagesPublic.browse));
-    router.get('/pages/:id', mw.authenticatePublic, http(api.pagesPublic.read));
-    router.get('/pages/slug/:slug', mw.authenticatePublic, http(api.pagesPublic.read));
-
-    // ## Users
-    router.get('/authors', mw.authenticatePublic, http(api.authorsPublic.browse));
-    router.get('/authors/:id', mw.authenticatePublic, http(api.authorsPublic.read));
-    router.get('/authors/slug/:slug', mw.authenticatePublic, http(api.authorsPublic.read));
-
-    // ## Tags
-    router.get('/tags', mw.authenticatePublic, http(api.tagsPublic.browse));
-    router.get('/tags/:id', mw.authenticatePublic, http(api.tagsPublic.read));
-    router.get('/tags/slug/:slug', mw.authenticatePublic, http(api.tagsPublic.read));
-
-    // ## Settings
-    router.get('/settings', mw.authenticatePublic, http(api.publicSettings.browse));
-
-    return router;
-};

package/core/server/web/oauth/app.js

@@ -1,153 +0,0 @@
-const debug = require('@tryghost/debug')('web:oauth:app');
-const {URL} = require('url');
-const express = require('../../../shared/express');
-const urlUtils = require('../../../shared/url-utils');
-const settingsCache = require('../../../shared/settings-cache');
-const models = require('../../models');
-const auth = require('../../services/auth');
-const labs = require('../../../shared/labs');
-
-function randomPassword() {
-    return require('crypto').randomBytes(128).toString('hex');
-}
-
-module.exports = function setupOAuthApp() {
-    debug('OAuth App setup start');
-    const oauthApp = express('oauth');
-
-    function labsMiddleware(req, res, next) {
-        if (labs.isSet('oauthLogin')) {
-            return next();
-        }
-        res.sendStatus(404);
-    }
-    oauthApp.use(labsMiddleware);
-
-    /**
-     * Configure the passport.authenticate middleware
-     * We need to configure it on each request because clientId and secret
-     * will change (when the Owner is changing these settings)
-     */
-    function googleOAuthMiddleware(clientId, secret) {
-        return (req, res, next) => {
-            // Lazy-required to save boot time
-            const passport = require('passport');
-            const GoogleStrategy = require('passport-google-oauth20').Strategy;
-
-            const adminURL = urlUtils.urlFor('admin', true);
-
-            //Create the callback url to be sent to Google
-            const callbackUrl = new URL('oauth/google/callback', adminURL);
-
-            passport.authenticate(new GoogleStrategy({
-                clientID: clientId,
-                clientSecret: secret,
-                callbackURL: callbackUrl.href
-            }, async function (accessToken, refreshToken, profile) {
-                // This is the verify function that checks that a Google-authenticated user
-                // is matching one of our users (or invite).
-
-                if (req.user) {
-                    // CASE: the user already has an active Ghost session
-                    const emails = profile.emails.filter(email => email.verified === true).map(email => email.value);
-
-                    if (!emails.includes(req.user.get('email'))) {
-                        return res.redirect(new URL('#/staff?message=oauth-linking-failed', adminURL));
-                    }
-
-                    // TODO: configure the oauth data for this user (row in the oauth table)
-
-                    //Associate logged-in user with oauth account
-                    req.user.set('password', randomPassword());
-                    await req.user.save();
-                } else {
-                    // CASE: the user is logging-in or accepting an invite
-
-                    //Find user in DB and log-in
-                    //TODO: instead find the oauth row with the email use the provider id
-                    const emails = profile.emails.filter(email => email.verified === true);
-                    if (emails.length < 1) {
-                        return res.redirect(new URL('#/signin?message=login-failed', adminURL));
-                    }
-                    const email = emails[0].value;
-
-                    let user = await models.User.findOne({
-                        email: email
-                    });
-
-                    if (!user) {
-                        // CASE: the user is accepting an invite
-                        // TODO: move this code in the invitations service
-                        const options = {context: {internal: true}};
-                        let invite = await models.Invite.findOne({email, status: 'sent'}, options);
-
-                        if (!invite || invite.get('expires') < Date.now()) {
-                            return res.redirect(new URL('#/signin?message=login-failed', adminURL));
-                        }
-
-                        //Accept invite
-                        user = await models.User.add({
-                            email: email,
-                            name: profile.displayName,
-                            password: randomPassword(),
-                            roles: [invite.toJSON().role_id]
-                        }, options);
-
-                        await invite.destroy(options);
-
-                        // TODO: create an oauth model link to user
-                    }
-
-                    req.user = user;
-                }
-
-                await auth.session.sessionService.createSessionForUser(req, res, req.user);
-
-                return res.redirect(adminURL);
-            }), {
-                scope: ['profile', 'email'],
-                session: false,
-                prompt: 'consent',
-                accessType: 'offline'
-            })(req, res, next);
-        };
-    }
-
-    oauthApp.get('/:provider', auth.authenticate.authenticateAdminApi, (req, res, next) => {
-        if (req.params.provider !== 'google') {
-            return res.sendStatus(404);
-        }
-
-        const clientId = settingsCache.get('oauth_client_id');
-        const secret = settingsCache.get('oauth_client_secret');
-
-        if (clientId && secret) {
-            return googleOAuthMiddleware(clientId, secret)(req, res, next);
-        }
-
-        res.sendStatus(404);
-    });
-
-    oauthApp.get('/:provider/callback', (req, res, next) => {
-        // Set the referrer as the ghost instance domain so that the session is linked to the ghost instance domain
-        req.headers.referrer = urlUtils.getAdminUrl();
-        next();
-    }, auth.authenticate.authenticateAdminApi, (req, res, next) => {
-        if (req.params.provider !== 'google') {
-            return res.sendStatus(404);
-        }
-
-        const clientId = settingsCache.get('oauth_client_id');
-        const secret = settingsCache.get('oauth_client_secret');
-
-        if (clientId && secret) {
-            return googleOAuthMiddleware(clientId, secret)(req, res, next);
-        }
-
-        res.sendStatus(404);
-    });
-
-    debug('OAuth App setup end');
-
-    return oauthApp;
-};

package/core/server/web/oauth/index.js

@@ -1 +0,0 @@
-module.exports = require('./app');