ghost 4.47.4 → 5.0.1

package/core/frontend/web/middleware/static-theme.js

@@ -5,17 +5,24 @@ const themeEngine = require('../../services/theme-engine');
 const express = require('../../../shared/express');
 
 function isDeniedFile(file) {
-    const deniedFileTypes = ['.hbs', '.md', '.json'];
+    const deniedFileTypes = ['.hbs', '.md', '.json', '.lock', '.log'];
+    const deniedFiles = ['gulpfile.js', 'gruntfile.js'];
+
     const ext = path.extname(file);
+    const base = path.basename(file);
 
-    return deniedFileTypes.includes(ext);
+    return deniedFiles.includes(base) || deniedFileTypes.includes(ext);
 }
 
 function isAllowedFile(file) {
     const allowedFiles = ['manifest.json'];
+    const allowedPath = '/assets/';
+    const alwaysDeny = ['.hbs'];
+
+    const ext = path.extname(file);
     const base = path.basename(file);
 
-    return allowedFiles.includes(base);
+    return allowedFiles.includes(base) || (file.startsWith(allowedPath) && !alwaysDeny.includes(ext));
 }
 
 function forwardToExpressStatic(req, res, next) {
@@ -25,14 +32,15 @@ function forwardToExpressStatic(req, res, next) {
 
     const configMaxAge = config.get('caching:theme:maxAge');
 
-    express.static(themeEngine.getActive().path,
-        {maxAge: (configMaxAge || configMaxAge === 0) ? configMaxAge : constants.ONE_YEAR_MS}
+    express.static(themeEngine.getActive().path, {
+        maxAge: (configMaxAge || configMaxAge === 0) ? configMaxAge : constants.ONE_YEAR_MS
+    }
     )(req, res, next);
 }
 
 function staticTheme() {
     return function denyStatic(req, res, next) {
-        if (!isAllowedFile(req.path) && isDeniedFile(req.path)) {
+        if (!isAllowedFile(req.path.toLowerCase()) && isDeniedFile(req.path.toLowerCase())) {
             return next();
         }
 

package/core/frontend/web/routes.js

@@ -1,12 +1,12 @@
-const debug = require('@tryghost/debug')('routing');
-
+const debug = require('@tryghost/debug')('frontend:routes');
 const routing = require('../services/routing');
-const urlService = require('../../server/services/url');
-const routeSettings = require('../../server/services/route-settings');
 
-module.exports = function siteRoutes(options = {}) {
-    debug('site Routes', options);
-    options.routerSettings = routeSettings.loadRouteSettingsSync();
-    options.urlService = urlService;
-    return routing.routerManager.init(options);
+/**
+ *
+ * @param {import('../services/routing/router-manager').RouterConfig} routerConfig
+ * @returns {import('express').Router}
+ */
+module.exports = function siteRoutes(routerConfig) {
+    debug('site Routes', routerConfig);
+    return routing.routerManager.init(routerConfig);
 };

package/core/frontend/web/site.js

@@ -8,10 +8,8 @@ const {MemberPageViewEvent} = require('@tryghost/member-events');
 const config = require('../../shared/config');
 const constants = require('@tryghost/constants');
 const storage = require('../../server/adapters/storage');
-const urlService = require('../../server/services/url');
 const urlUtils = require('../../shared/url-utils');
 const sitemapHandler = require('../services/sitemap/handler');
-const appService = require('../services/apps');
 const themeEngine = require('../services/theme-engine');
 const themeMiddleware = themeEngine.middleware;
 const membersService = require('../../server/services/members');
@@ -32,8 +30,13 @@ function SiteRouter(req, res, next) {
     router(req, res, next);
 }
 
-module.exports = function setupSiteApp(options = {}) {
-    debug('Site setup start', options);
+/**
+ *
+ * @param {import('../services/routing/router-manager').RouterConfig} routerConfig
+ * @returns {import('express').Application}
+ */
+module.exports = function setupSiteApp(routerConfig) {
+    debug('Site setup start', routerConfig);
 
     const siteApp = express('site');
 
@@ -136,7 +139,7 @@ module.exports = function setupSiteApp(options = {}) {
 
     debug('General middleware done');
 
-    router = siteRoutes(options);
+    router = siteRoutes(routerConfig);
     Object.setPrototypeOf(SiteRouter, router);
 
     // Set up Frontend routes (including private blogging routes)
@@ -158,18 +161,12 @@ module.exports = function setupSiteApp(options = {}) {
     return siteApp;
 };
 
-module.exports.reload = ({apiVersion}) => {
-    // https://github.com/expressjs/express/issues/2596
-    router = siteRoutes({start: true, apiVersion});
+/**
+ * see https://github.com/expressjs/express/issues/2596
+ * @param {import('../services/routing/router-manager').RouterConfig} routerConfig
+ */
+module.exports.reload = (routerConfig) => {
+    debug('reloading');
+    router = siteRoutes(routerConfig);
     Object.setPrototypeOf(SiteRouter, router);
-
-    // re-initialize apps (register app routers, because we have re-initialized the site routers)
-    appService.init();
-
-    // connect routers and resources again
-    urlService.queue.start({
-        event: 'init',
-        tolerance: 100,
-        requiredSubscriberCount: 1
-    });
 };

package/core/server/adapters/scheduling/post-scheduling/index.js

@@ -9,7 +9,7 @@ const getSchedulerIntegration = require('./scheduler-intergation');
  * @return {Promise}
  */
 const loadScheduledResources = async function () {
-    const api = require('../../../api');
+    const api = require('../../../api').endpoints;
     const SCHEDULED_RESOURCES = ['post', 'page'];
 
     // Fetches all scheduled resources(posts/pages) with default API

package/core/server/api/README.md

@@ -1,8 +1,4 @@
-# API Versioning
-
-Ghost supports multiple API versions.
-Each version lives in a separate folder e.g. api/v2, api/v3, api/canary etc.
-Next to the API folders there is a shared folder, which contains shared code, which all API versions use.
+# API
 
 ## Stages
 
@@ -19,7 +15,7 @@ The framework we are building pipes a request through these stages in respect of
 
 ## Frame
 
-Is a class, which holds all the information for request processing. We pass this instance by reference. 
+Is a class, which holds all the information for request processing. We pass this instance by reference.
 Each function can modify the original instance. No need to return the class instance.
 
 ### Structure

package/core/server/api/canary/authentication.js

@@ -129,7 +129,7 @@ module.exports = {
 
     generateResetToken: {
         validation: {
-            docName: 'passwordreset'
+            docName: 'password_reset'
         },
         permissions: true,
         options: [
@@ -141,7 +141,7 @@ module.exports = {
                     return auth.setup.assertSetupCompleted(true)();
                 })
                 .then(() => {
-                    return auth.passwordreset.generateToken(frame.data.passwordreset[0].email, api.settings);
+                    return auth.passwordreset.generateToken(frame.data.password_reset[0].email, api.settings);
                 })
                 .then((token) => {
                     return auth.passwordreset.sendResetNotification(token, api.mail);
@@ -151,7 +151,7 @@ module.exports = {
 
     resetPassword: {
         validation: {
-            docName: 'passwordreset',
+            docName: 'password_reset',
             data: {
                 newPassword: {required: true},
                 ne2Password: {required: true}
@@ -221,6 +221,7 @@ module.exports = {
     },
 
     resetAllPasswords: {
+        statusCode: 204,
         permissions: true,
         async query(frame) {
             await userService.resetAllPasswords(frame.options);

package/core/server/api/canary/{email-preview.js → email-previews.js}

@@ -7,18 +7,16 @@ const messages = {
     postNotFound: 'Post not found.'
 };
 
-const emailPreview = new mega.EmailPreview({
-    apiVersion: 'canary'
-});
+const emailPreview = new mega.EmailPreview();
 
 module.exports = {
-    // @TODO make the route match the resource name in 5.0
     docName: 'email_previews',
 
     read: {
         options: [
             'fields',
-            'memberSegment'
+            'memberSegment',
+            'newsletter'
         ],
         validation: {
             options: {
@@ -42,11 +40,14 @@ module.exports = {
                 });
             }
 
-            return emailPreview.generateEmailContent(model, frame.options.memberSegment);
+            return emailPreview.generateEmailContent(model, {
+                newsletter: frame.options.newsletter,
+                memberSegment: frame.options.memberSegment
+            });
         }
     },
     sendTestEmail: {
-        statusCode: 200,
+        statusCode: 204,
         headers: {},
         options: [
             'id'
@@ -70,7 +71,7 @@ module.exports = {
             }
 
             const {emails = [], memberSegment} = frame.data;
-            return await mega.mega.sendTestEmail(model, emails, 'canary', memberSegment);
+            return await mega.mega.sendTestEmail(model, emails, memberSegment);
         }
     }
 };

package/core/server/api/canary/index.js

@@ -8,10 +8,6 @@ const localUtils = require('./utils');
 /* eslint-disable max-lines */
 
 module.exports = {
-    get http() {
-        return shared.http;
-    },
-
     get authentication() {
         return shared.pipeline(require('./authentication'), localUtils);
     },
@@ -89,10 +85,6 @@ module.exports = {
         return shared.pipeline(require('./offers'), localUtils);
     },
 
-    get products() {
-        return shared.pipeline(require('./products'), localUtils);
-    },
-
     get tiers() {
         return shared.pipeline(require('./tiers'), localUtils);
     },
@@ -125,8 +117,8 @@ module.exports = {
         return shared.pipeline(require('./users'), localUtils);
     },
 
-    get preview() {
-        return shared.pipeline(require('./preview'), localUtils);
+    get previews() {
+        return shared.pipeline(require('./previews'), localUtils);
     },
 
     get emailPost() {
@@ -153,8 +145,8 @@ module.exports = {
         return shared.pipeline(require('./actions'), localUtils);
     },
 
-    get email_preview() {
-        return shared.pipeline(require('./email-preview'), localUtils);
+    get email_previews() {
+        return shared.pipeline(require('./email-previews'), localUtils);
     },
 
     get emails() {
@@ -190,8 +182,8 @@ module.exports = {
      *
      * @NOTE:
      *
-     * Please create separate controllers for Content & Admin API. The goal is to expose `api.canary.content` and
-     * `api.canary.admin` soon. Need to figure out how serializers & validation works then.
+     * Please create separate controllers for Content & Admin API. The goal is to expose `api.content` and
+     * `api.admin` soon. Need to figure out how serializers & validation works then.
      */
     get pagesPublic() {
         return shared.pipeline(require('./pages-public'), localUtils, 'content');
@@ -213,11 +205,15 @@ module.exports = {
         return shared.pipeline(require('./authors-public'), localUtils, 'content');
     },
 
-    get productsPublic() {
-        return shared.pipeline(require('./products-public'), localUtils, 'content');
-    },
-
     get tiersPublic() {
         return shared.pipeline(require('./tiers-public'), localUtils, 'content');
+    },
+
+    get newslettersPublic() {
+        return shared.pipeline(require('./newsletters-public'), localUtils, 'content');
+    },
+
+    get offersPublic() {
+        return shared.pipeline(require('./offers-public'), localUtils, 'content');
     }
 };

package/core/server/api/canary/members.js

@@ -5,7 +5,6 @@ const moment = require('moment-timezone');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
 const membersService = require('../../services/members');
-const labsService = require('../../../shared/labs');
 
 const settingsCache = require('../../../shared/settings-cache');
 const tpl = require('@tryghost/tpl');
@@ -29,23 +28,11 @@ const messages = {
     resourceNotFound: '{resource} not found.'
 };
 
-const allowedIncludes = ['email_recipients', 'products'];
+const allowedIncludes = ['email_recipients', 'products', 'tiers'];
 
 module.exports = {
     docName: 'members',
 
-    hasActiveStripeSubscriptions: {
-        permissions: {
-            method: 'browse'
-        },
-        async query() {
-            const hasActiveStripeSubscriptions = await membersService.api.hasActiveStripeSubscriptions();
-            return {
-                hasActiveStripeSubscriptions
-            };
-        }
-    },
-
     browse: {
         options: [
             'limit',
@@ -362,16 +349,9 @@ module.exports = {
         },
         validation: {},
         async query(frame) {
-            frame.options.withRelated = ['labels', 'stripeSubscriptions', 'stripeSubscriptions.customer'];
-            if (labsService.isSet('multipleProducts')) {
-                frame.options.withRelated.push('products');
-            }
-            if (labsService.isSet('multipleNewsletters')) {
-                frame.options.withRelated.push('newsletters');
-            }
-            const page = await membersService.api.members.list(frame.options);
-
-            return page;
+            return {
+                data: await membersService.export(frame.options)
+            };
         }
     },
 

package/core/server/api/{v3/actions.js → canary/newsletters-public.js}

@@ -1,19 +1,19 @@
 const models = require('../../models');
 
 module.exports = {
-    docName: 'actions',
+    docName: 'newsletters',
 
     browse: {
         options: [
-            'page',
-            'limit',
+            'filter',
             'fields',
-            'include',
-            'filter'
+            'limit',
+            'order',
+            'page'
         ],
         permissions: true,
         query(frame) {
-            return models.Action.findPage(frame.options);
+            return models.Newsletter.findPage(frame.options);
         }
     }
 };

package/core/server/api/canary/newsletters.js

@@ -1,11 +1,6 @@
 const models = require('../../models');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
 const allowedIncludes = ['count.posts', 'count.members'];
 
-const messages = {
-    newsletterNotFound: 'Newsletter not found.'
-};
 const newslettersService = require('../../services/newsletters');
 
 module.exports = {
@@ -56,14 +51,7 @@ module.exports = {
         },
         permissions: true,
         async query(frame) {
-            const newsletter = models.Newsletter.findOne(frame.data, frame.options);
-
-            if (!newsletter) {
-                throw new errors.NotFoundError({
-                    message: tpl(messages.newsletterNotFound)
-                });
-            }
-            return newsletter;
+            return newslettersService.read(frame.data, frame.options);
         }
     },
 

package/core/server/api/canary/notifications.js

@@ -1,5 +1,6 @@
 const {notifications} = require('../../services/notifications');
-const api = require('./index');
+const settingsService = require('../../services/settings/settings-service');
+const settingsBREADService = settingsService.getSettingsBREADServiceInstance();
 const internalContext = {context: {internal: true}};
 
 module.exports = {
@@ -25,19 +26,17 @@ module.exports = {
             }
         },
         permissions: true,
-        query(frame) {
+        async query(frame) {
             const {allNotifications, notificationsToAdd} = notifications.add({
                 notifications: frame.data.notifications
             });
 
             if (notificationsToAdd.length){
-                return api.settings.edit({
-                    settings: [{
-                        key: 'notifications',
-                        // @NOTE: We always need to store all notifications!
-                        value: allNotifications.concat(notificationsToAdd)
-                    }]
-                }, internalContext).then(() => {
+                return await settingsBREADService.edit([{
+                    key: 'notifications',
+                    // @NOTE: We always need to store all notifications!
+                    value: allNotifications.concat(notificationsToAdd)
+                }], internalContext).then(() => {
                     return notificationsToAdd;
                 });
             }
@@ -63,12 +62,10 @@ module.exports = {
                 }
             });
 
-            return api.settings.edit({
-                settings: [{
-                    key: 'notifications',
-                    value: allNotifications
-                }]
-            }, internalContext).return();
+            await settingsBREADService.edit([{
+                key: 'notifications',
+                value: allNotifications
+            }], internalContext);
         }
     },
 
@@ -82,15 +79,13 @@ module.exports = {
         permissions: {
             method: 'destroy'
         },
-        query() {
+        async query() {
             const allNotifications = notifications.destroyAll();
 
-            return api.settings.edit({
-                settings: [{
-                    key: 'notifications',
-                    value: allNotifications
-                }]
-            }, internalContext).return();
+            await settingsBREADService.edit([{
+                key: 'notifications',
+                value: allNotifications
+            }], internalContext);
         }
     }
 };

package/core/server/api/canary/offers-public.js

@@ -0,0 +1,28 @@
+const tpl = require('@tryghost/tpl');
+const errors = require('@tryghost/errors');
+const offersService = require('../../services/offers');
+
+const messages = {
+    offerNotFound: 'Offer not found.'
+};
+
+module.exports = {
+    docName: 'offers',
+
+    read: {
+        data: ['id'],
+        permissions: true,
+        async query(frame) {
+            const offer = await offersService.api.getOffer(frame.data);
+            if (!offer) {
+                throw new errors.NotFoundError({
+                    message: tpl(messages.offerNotFound)
+                });
+            }
+
+            frame.response = {
+                offers: [offer]
+            };
+        }
+    }
+};

package/core/server/api/canary/pages.js

@@ -9,7 +9,7 @@ const messages = {
     pageNotFound: 'Page not found.'
 };
 
-const postsService = getPostServiceInstance('canary');
+const postsService = getPostServiceInstance();
 
 module.exports = {
     docName: 'pages',

package/core/server/api/canary/posts.js

@@ -2,14 +2,14 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service');
-const allowedIncludes = ['tags', 'authors', 'authors.roles', 'email', 'tiers'];
+const allowedIncludes = ['tags', 'authors', 'authors.roles', 'email', 'tiers', 'newsletter'];
 const unsafeAttrs = ['status', 'authors', 'visibility'];
 
 const messages = {
     postNotFound: 'Post not found.'
 };
 
-const postsService = getPostServiceInstance('canary');
+const postsService = getPostServiceInstance();
 
 module.exports = {
     docName: 'posts',
@@ -128,9 +128,8 @@ module.exports = {
             'id',
             'formats',
             'source',
-            'email_recipient_filter',
-            'newsletter_id',
-            'send_email_when_published',
+            'email_segment',
+            'newsletter',
             'force_rerender',
             // NOTE: only for internal context
             'forUpdate',
@@ -146,9 +145,6 @@ module.exports = {
                 },
                 source: {
                     values: ['html']
-                },
-                send_email_when_published: {
-                    values: [true, false]
                 }
             }
         },

package/core/server/api/canary/{preview.js → previews.js}

@@ -8,7 +8,7 @@ const messages = {
 };
 
 module.exports = {
-    docName: 'preview',
+    docName: 'previews',
 
     read: {
         permissions: true,

package/core/server/api/canary/schedules.js

@@ -1,6 +1,6 @@
 const models = require('../../models');
 
-const postSchedulingService = require('../../services/posts/post-scheduling-service')('canary');
+const postSchedulingService = require('../../services/posts/post-scheduling-service')();
 
 module.exports = {
     docName: 'schedules',

package/core/server/api/canary/session.js

@@ -51,7 +51,7 @@ const session = {
 
             if (err.errorType === 'PasswordResetRequiredError') {
                 await api.authentication.generateResetToken({
-                    passwordreset: [{
+                    password_reset: [{
                         email: object.username
                     }]
                 }, frame.options.context);

package/core/server/api/canary/settings-public.js

@@ -1,5 +1,6 @@
 const settingsCache = require('../../../shared/settings-cache');
 const urlUtils = require('../../../shared/url-utils');
+const ghostVersion = require('@tryghost/version');
 
 module.exports = {
     docName: 'settings',
@@ -10,7 +11,8 @@ module.exports = {
             // @TODO: decouple settings cache from API knowledge
             // The controller fetches models (or cached models) and the API frame for the target API version formats the response.
             return Object.assign({}, settingsCache.getPublic(), {
-                url: urlUtils.urlFor('home', true)
+                url: urlUtils.urlFor('home', true),
+                version: ghostVersion.safe
             });
         }
     }