ghost 4.47.4 → 5.0.1

package/core/server/lib/image/gravatar.js

@@ -1,5 +1,6 @@
 const Promise = require('bluebird');
 const crypto = require('crypto');
+const tpl = require('@tryghost/tpl');
 
 class Gravatar {
     constructor({config, request}) {
@@ -7,21 +8,36 @@ class Gravatar {
         this.request = request;
     }
 
+    url(email, options) {
+        if (options.default) {
+            // tpl errors on token `{default}` so we use `{_default}` instead
+            // but still allow the option to be passed as `default`
+            options._default = options.default;
+        }
+        const defaultOptions = {
+            size: 250,
+            _default: 'blank',
+            rating: 'g'
+        };
+        const emailHash = crypto.createHash('md5').update(email.toLowerCase().trim()).digest('hex');
+        const gravatarUrl = this.config.get('gravatar').url;
+        return tpl(gravatarUrl, Object.assign(defaultOptions, options, {hash: emailHash}));
+    }
+
     lookup(userData, timeout) {
-        let gravatarUrl = '//www.gravatar.com/avatar/' +
-            crypto.createHash('md5').update(userData.email.toLowerCase().trim()).digest('hex') +
-            '?s=250';
-    
         if (this.config.isPrivacyDisabled('useGravatar')) {
             return Promise.resolve();
         }
-    
-        return Promise.resolve(this.request('https:' + gravatarUrl + '&d=404&r=x', {timeout: timeout || 2 * 1000}))
+
+        // test existence using a default 404, but return a different default
+        // so we still have a fallback if the image gets removed from Gravatar
+        const testUrl = this.url(userData.email, {default: 404, rating: 'x'});
+        const imageUrl = this.url(userData.email, {default: 'mp', rating: 'x'});
+
+        return Promise.resolve(this.request(testUrl, {timeout: timeout || 2 * 1000}))
             .then(function () {
-                gravatarUrl += '&d=mm&r=x';
-    
                 return {
-                    image: gravatarUrl
+                    image: imageUrl
                 };
             })
             .catch({statusCode: 404}, function () {

package/core/server/models/api-key.js

@@ -1,36 +1,13 @@
 const omit = require('lodash/omit');
-const crypto = require('crypto');
+const security = require('@tryghost/security');
 const ghostBookshelf = require('./base');
 const {Role} = require('./role');
 
-/*
- * Uses birthday problem estimation to calculate chance of collision
- * d = 16^26        // 26 char hex string
- * n = 10,000,000   // 10 million
- *
- *       (-n x (n-1)) / 2d
- * 1 - e^
- *
- *
- *           17
- * ~= 4 x 10^
- *
- * ref: https://medium.freecodecamp.org/how-long-should-i-make-my-api-key-833ebf2dc26f
- * ref: https://en.wikipedia.org/wiki/Birthday_problem#Approximations
- *
- * 26 char hex string = 13 bytes
- * 64 char hex string JWT secret = 32 bytes
- */
-const createSecret = (type) => {
-    const bytes = type === 'content' ? 13 : 32;
-    return crypto.randomBytes(bytes).toString('hex');
-};
-
 const ApiKey = ghostBookshelf.Model.extend({
     tableName: 'api_keys',
 
     defaults() {
-        const secret = createSecret(this.get('type'));
+        const secret = security.secret.create(this.get('type'));
 
         return {
             secret
@@ -97,7 +74,7 @@ const ApiKey = ghostBookshelf.Model.extend({
     }
 }, {
     refreshSecret(data, options) {
-        const secret = createSecret(data.type);
+        const secret = security.secret.create(data.type);
         return this.edit(Object.assign({}, data, {secret}), options);
     }
 });

package/core/server/models/base/plugins/bulk-operations.js

@@ -52,9 +52,9 @@ async function editMultiple(knex, table, chunk, options) {
     await knex(table).whereIn('id', chunk).update(options.data);
 }
 
-async function delSingle(knex, table, id) {
+async function delSingle(knex, table, id, options) {
     try {
-        await knex(table).where('id', id).del();
+        await knex(table).where(options.column ?? 'id', id).del();
     } catch (err) {
         const importError = new errors.DataImportError({
             message: `Failed to remove entry from ${table}`,
@@ -66,8 +66,8 @@ async function delSingle(knex, table, id) {
     }
 }
 
-async function delMultiple(knex, table, chunk) {
-    await knex(table).whereIn('id', chunk).del();
+async function delMultiple(knex, table, chunk, options) {
+    await knex(table).whereIn(options.column ?? 'id', chunk).del();
 }
 
 const insert = createBulkOperation(insertSingle, insertMultiple);
@@ -91,10 +91,18 @@ module.exports = function (Bookshelf) {
             return edit(Bookshelf.knex, tableName, data, options);
         },
 
-        bulkDestroy: function bulkDestroy(data, tableName) {
+        /**
+         * 
+         * @param {string[]} data List of ids to delete
+         * @param {*} tableName 
+         * @param {Object} [options] 
+         * @param {string} [options.column] Delete the rows where this column equals the ids in `data` (defaults to 'id')
+         * @returns 
+         */
+        bulkDestroy: function bulkDestroy(data, tableName, options = {}) {
             tableName = tableName || this.prototype.tableName;
 
-            return del(Bookshelf.knex, tableName, data);
+            return del(Bookshelf.knex, tableName, data, options);
         }
     });
 };

package/core/server/models/integration.js

@@ -1,3 +1,4 @@
+const _ = require('lodash');
 const limitService = require('../services/limits');
 const ghostBookshelf = require('./base');
 const {NoPermissionError} = require('@tryghost/errors');
@@ -64,6 +65,14 @@ const Integration = ghostBookshelf.Model.extend({
         return options;
     },
 
+    defaultRelations: function defaultRelations(methodName, options) {
+        if (['edit', 'add', 'destroy'].indexOf(methodName) !== -1) {
+            options.withRelated = _.union(['api_keys'], options.withRelated || []);
+        }
+
+        return options;
+    },
+
     async permissible(integrationModel, action, context, attrs, loadedPerms, hasUserPermission, hasApiKeyPermission) {
         const isAdd = (action === 'add');
 
@@ -76,6 +85,14 @@ const Integration = ghostBookshelf.Model.extend({
         if (!hasUserPermission || !hasApiKeyPermission) {
             throw new NoPermissionError();
         }
+    },
+
+    async getInternalFrontendKey(options) {
+        options = options || {};
+
+        options.withRelated = ['api_keys'];
+
+        return this.findOne({slug: 'ghost-internal-frontend'}, options);
     }
 });
 

package/core/server/models/member.js

@@ -2,7 +2,7 @@ const ghostBookshelf = require('./base');
 const uuid = require('uuid');
 const _ = require('lodash');
 const config = require('../../shared/config');
-const crypto = require('crypto');
+const {gravatar} = require('../lib/image');
 
 const Member = ghostBookshelf.Model.extend({
     tableName: 'members',
@@ -10,7 +10,6 @@ const Member = ghostBookshelf.Model.extend({
     defaults() {
         return {
             status: 'free',
-            subscribed: true,
             uuid: uuid.v4(),
             email_count: 0,
             email_opened_count: 0
@@ -30,6 +29,12 @@ const Member = ghostBookshelf.Model.extend({
         }, {
             key: 'products',
             replacement: 'products.slug'
+        }, {
+            key: 'tier',
+            replacement: 'products.slug'
+        }, {
+            key: 'tiers',
+            replacement: 'products.slug'
         }, {
             key: 'newsletters',
             replacement: 'newsletters.slug'
@@ -311,8 +316,7 @@ const Member = ghostBookshelf.Model.extend({
         // Will not use gravatar if privacy.useGravatar is false in config
         attrs.avatar_image = null;
         if (attrs.email && !config.isPrivacyDisabled('useGravatar')) {
-            const emailHash = crypto.createHash('md5').update(attrs.email.toLowerCase().trim()).digest('hex');
-            attrs.avatar_image = `https://gravatar.com/avatar/${emailHash}?s=250&d=blank`;
+            attrs.avatar_image = gravatar.url(attrs.email, {size: 250, default: 'blank'});
         }
 
         return attrs;

package/core/server/models/newsletter.js

@@ -38,6 +38,11 @@ const Newsletter = ghostBookshelf.Model.extend({
         return this.hasMany('Post');
     },
 
+    // Force active newsletters for content API
+    enforcedFilters: function enforcedFilters(options) {
+        return (options.context && options.context.public) ? 'status:active' : null;
+    },
+
     async onSaving(model, _attr, options) {
         ghostBookshelf.Model.prototype.onSaving.apply(this, arguments);
 
@@ -99,6 +104,28 @@ const Newsletter = ghostBookshelf.Model.extend({
         return attrs;
     }
 }, {
+    /**
+     * Returns an array of keys permitted in a method's `options` hash, depending on the current method.
+     * @param {String} methodName The name of the method to check valid options for.
+     * @return {Array} Keys allowed in the `options` hash of the model's method.
+     */
+    permittedOptions: function permittedOptions(methodName) {
+        let options = ghostBookshelf.Model.permittedOptions.call(this, methodName);
+
+        // allowlists for the `options` hash argument on methods, by method name.
+        // these are the only options that can be passed to Bookshelf / Knex.
+        const validOptions = {
+            findOne: ['filter'],
+            findAll: ['filter']
+        };
+
+        if (validOptions[methodName]) {
+            options = options.concat(validOptions[methodName]);
+        }
+
+        return options;
+    },
+
     orderDefaultRaw: function () {
         return 'sort_order ASC, created_at ASC, id ASC';
     },

package/core/server/models/post.js

@@ -16,12 +16,16 @@ const mobiledocLib = require('../lib/mobiledoc');
 const relations = require('./relations');
 const urlUtils = require('../../shared/url-utils');
 const {Tag} = require('./tag');
+const {Newsletter} = require('./newsletter');
+const {BadRequestError} = require('@tryghost/errors');
 
 const messages = {
     isAlreadyPublished: 'Your post is already published, please reload your page.',
     valueCannotBeBlank: 'Value in {key} cannot be blank.',
     expectedPublishedAtInFuture: 'Date must be at least {cannotScheduleAPostBeforeInMinutes} minutes in the future.',
-    untitled: '(Untitled)'
+    untitled: '(Untitled)',
+    notEnoughPermission: 'You do not have permission to perform this action',
+    invalidNewsletter: 'The newsletter parameter doesn\'t match any active newsletter.'
 };
 
 const MOBILEDOC_REVISIONS_COUNT = 10;
@@ -78,7 +82,7 @@ Post = ghostBookshelf.Model.extend({
             type: 'post',
             tiers,
             visibility: visibility,
-            email_recipient_filter: 'none'
+            email_recipient_filter: 'all'
         };
     },
 
@@ -135,14 +139,6 @@ Post = ghostBookshelf.Model.extend({
             }
         });
 
-        // update legacy email_recipient_filter values to proper NQL
-        if (attrs.email_recipient_filter === 'free') {
-            attrs.email_recipient_filter = 'status:free';
-        }
-        if (attrs.email_recipient_filter === 'paid') {
-            attrs.email_recipient_filter = 'status:-free';
-        }
-
         return attrs;
     },
 
@@ -186,14 +182,6 @@ Post = ghostBookshelf.Model.extend({
             }
         });
 
-        // update legacy email_recipient_filter values to proper NQL
-        if (attrs.email_recipient_filter === 'free') {
-            attrs.email_recipient_filter = 'status:free';
-        }
-        if (attrs.email_recipient_filter === 'paid') {
-            attrs.email_recipient_filter = 'status:-free';
-        }
-
         // transform visibility NQL queries to special-case values where necessary
         // ensures checks against special-case values such as `{{#has visibility="paid"}}` continue working
         if (attrs.visibility && !['public', 'members', 'paid', 'tiers'].includes(attrs.visibility)) {
@@ -638,7 +626,7 @@ Post = ghostBookshelf.Model.extend({
             if (this.get('html') === null) {
                 plaintext = null;
             } else {
-                plaintext = htmlToPlaintext(this.get('html'));
+                plaintext = htmlToPlaintext.excerpt(this.get('html'));
             }
 
             // CASE: html is e.g. <p></p>
@@ -674,20 +662,30 @@ Post = ghostBookshelf.Model.extend({
             }
         }
 
-        // newsletter_id is read-only and should only be set using a query param when publishing/scheduling
-        if (options.newsletter_id
+        // newsletter_id is read-only and should only be set using the newsletter param when publishing/scheduling
+        if (options.newsletter
             && !this.get('newsletter_id')
             && this.hasChanged('status')
             && (newStatus === 'published' || newStatus === 'scheduled')) {
-            this.set('newsletter_id', options.newsletter_id);
-        }
+            // Map the passed slug to the id + validate the passed newsletter
+            ops.push(async () => {
+                const newsletter = await Newsletter.findOne({slug: options.newsletter}, {transacting: options.transacting, filter: 'status:active'});
+                if (!newsletter) {
+                    throw new BadRequestError({
+                        message: messages.invalidNewsletter
+                    });
+                }
+                this.set('newsletter_id', newsletter.id);
+            });
 
-        // email_recipient_filter is read-only and should only be set using a query param when publishing/scheduling
-        if (options.email_recipient_filter
-            && (options.email_recipient_filter !== 'none')
-            && this.hasChanged('status')
-            && (newStatus === 'published' || newStatus === 'scheduled')) {
-            this.set('email_recipient_filter', options.email_recipient_filter);
+            // If the `email_segment` isn't passed at the same time, reset it to be 100% sure that they can only be used together
+            this.set('email_recipient_filter', 'all');
+
+            // email_segment is read-only and should only be set using a query param when publishing/scheduling
+            // we can't set it if we don't pass newsletter
+            if (options.email_segment) {
+                this.set('email_recipient_filter', options.email_segment);
+            }
         }
 
         // ensure draft posts have the email_recipient_filter reset unless an email has already been sent
@@ -695,7 +693,7 @@ Post = ghostBookshelf.Model.extend({
             ops.push(function ensureSendEmailWhenPublishedIsUnchanged() {
                 return self.related('email').fetch({transacting: options.transacting}).then((email) => {
                     if (!email) {
-                        self.set('email_recipient_filter', 'none');
+                        self.set('email_recipient_filter', 'all');
                         self.set('newsletter_id', null);
                     }
                 });
@@ -862,7 +860,7 @@ Post = ghostBookshelf.Model.extend({
      *            This is protected by the fn `permittedOptions`.
      */
     defaultColumnsToFetch: function defaultColumnsToFetch() {
-        return ['id', 'published_at', 'slug', 'author_id'];
+        return ['id', 'published_at', 'slug'];
     },
     /**
      * If the `formats` option is not used, we return `html` be default.
@@ -1029,7 +1027,7 @@ Post = ghostBookshelf.Model.extend({
             findPage: ['status'],
             findAll: ['columns', 'filter'],
             destroy: ['destroyAll', 'destroyBy'],
-            edit: ['filter', 'email_recipient_filter', 'force_rerender', 'newsletter_id']
+            edit: ['filter', 'email_segment', 'force_rerender', 'newsletter']
         };
 
         // The post model additionally supports having a formats option

package/core/server/models/relations/authors.js

@@ -17,13 +17,7 @@ const messages = {
  * We fetch the `authors` relations when you either request `withRelated=['authors']` or `withRelated=['author`].
  * The old `author` relation was removed, but we still have to support this case.
  *
- * # CASE 2
- * We fetch when editing a post.
- * Imagine you change `author_id` and you have 3 existing `posts_authors`.
- * We now need to set `author_id` as primary author `post.authors[0]`.
- * Furthermore, we now longer have a `author` relationship.
- *
- * # CASE 3:
+ * # CASE 2:
  * If you request `include=author`, we have to fill this object with `post.authors[0]`.
  * Otherwise we can't return `post.author = User`.
  *
@@ -85,19 +79,10 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             return proto.onFetchingCollection.call(this, collection, attrs, options);
         },
 
-        // NOTE: sending `post.author = {}` was always ignored [unsupported]
         onCreating: function onCreating(model, attrs, options) {
-            if (!model.get('author_id')) {
-                if (model.get('authors')) {
-                    model.set('author_id', model.get('authors')[0].id);
-                } else {
-                    model.set('author_id', this.contextUser(options));
-                }
-            }
-
             if (!model.get('authors')) {
                 model.set('authors', [{
-                    id: model.get('author_id')
+                    id: this.contextUser(options)
                 }]);
             }
 
@@ -141,44 +126,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             }
 
             ops.push(() => {
-                // CASE: `post.author_id` has changed
-                if (model.hasChanged('author_id')) {
-                    // CASE: you don't send `post.authors`
-                    // SOLUTION: we have to update the primary author
-                    if (!model.get('authors')) {
-                        let existingAuthors = model.related('authors').toJSON();
-
-                        // CASE: override primary author
-                        existingAuthors[0] = {
-                            id: model.get('author_id')
-                        };
-
-                        model.set('authors', existingAuthors);
-                    } else {
-                        // CASE: you send `post.authors` next to `post.author_id`
-                        if (model.get('authors')[0].id !== model.get('author_id')) {
-                            model.set('author_id', model.get('authors')[0].id);
-                        }
-                    }
-                }
-
-                // CASE: if you change `post.author_id`, we have to update the primary author
-                // CASE: if the `author_id` has change and you pass `posts.authors`, we already check above that
-                //       the primary author id must be equal
-                if (model.hasChanged('author_id') && !model.get('authors')) {
-                    let existingAuthors = model.related('authors').toJSON();
-
-                    // CASE: override primary author
-                    existingAuthors[0] = {
-                        id: model.get('author_id')
-                    };
-
-                    model.set('authors', existingAuthors);
-                } else if (model.get('authors') && model.get('authors').length) {
-                    // ensure we update the primary author id
-                    model.set('author_id', model.get('authors')[0].id);
-                }
-
                 return proto.onSaving.call(this, model, attrs, options);
             });
 
@@ -207,14 +154,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                 }
 
                 attrs.author = attrs.authors[0];
-                delete attrs.author_id;
-            } else {
-                // CASE: we return `post.author=id` with or without requested columns.
-                // @NOTE: this serialization should be moved into api layer, it's not being moved as it's deprecated
-                if (!options.columns || (options.columns && options.columns.indexOf('author') !== -1)) {
-                    attrs.author = attrs.author_id;
-                    delete attrs.author_id;
-                }
             }
 
             // CASE: `posts.authors` was not requested, but fetched in specific cases (see top)
@@ -294,12 +233,14 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
         }
     }, {
         /**
-         * ### destroyByAuthor
-         * @param  {[type]} options has context and id. Context is the user doing the destroy, id is the user to destroy
+         * ### reassignByAuthor
+         * @param  {Object} unfilteredOptions has context and id. Context is the user doing the destroy, id is the user to destroy
+         * @param {string} unfilteredOptions.id
+         * @param {Object} unfilteredOptions.context
+         * @param {Object} unfilteredOptions.transacting
          */
-        destroyByAuthor: function destroyByAuthor(unfilteredOptions) {
-            let options = this.filterOptions(unfilteredOptions, 'destroyByAuthor', {extraAllowedProperties: ['id']});
-            let postCollection = Posts.forge();
+        reassignByAuthor: async function reassignByAuthor(unfilteredOptions) {
+            let options = this.filterOptions(unfilteredOptions, 'reassignByAuthor', {extraAllowedProperties: ['id']});
             let authorId = options.id;
 
             if (!authorId) {
@@ -308,34 +249,76 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                 }));
             }
 
-            // CASE: if you are the primary author of a post, the whole post and it's relations get's deleted.
-            //       `posts_authors` are automatically removed (bookshelf-relations)
-            // CASE: if you are the secondary author of a post, you are just deleted as author.
-            //       must happen manually
-            const destroyPost = (() => {
-                return postCollection
-                    .query('where', 'author_id', '=', authorId)
-                    .fetch(options)
-                    .call('invokeThen', 'destroy', options)
-                    .then(function (response) {
-                        return (options.transacting || ghostBookshelf.knex)('posts_authors')
-                            .where('author_id', authorId)
-                            .del()
-                            .then(() => response);
-                    })
-                    .catch((err) => {
-                        throw new errors.InternalServerError({err: err});
-                    });
+            const reassignPost = (async () => {
+                let trx = options.transacting;
+                let knex = ghostBookshelf.knex;
+
+                try {
+                    // There's only one possible owner per Ghost instance
+                    const ownerUser = await knex('roles')
+                        .transacting(trx)
+                        .join('roles_users', 'roles.id', '=', 'roles_users.role_id')
+                        .where('roles.name', 'Owner')
+                        .select('roles_users.user_id');
+                    const ownerId = ownerUser[0].user_id;
+
+                    const authorsPosts = await knex('posts_authors')
+                        .transacting(trx)
+                        .where('author_id', authorId)
+                        .select('post_id', 'sort_order');
+
+                    const ownersPosts = await knex('posts_authors')
+                        .transacting(trx)
+                        .where('author_id', ownerId)
+                        .select('post_id');
+
+                    const authorsPrimaryPosts = authorsPosts.filter(ap => ap.sort_order === 0);
+                    const primaryPostsWithOwnerCoauthor = _.intersectionBy(authorsPrimaryPosts, ownersPosts, 'post_id');
+                    const primaryPostsWithOwnerCoauthorIds = primaryPostsWithOwnerCoauthor.map(post => post.post_id);
+
+                    // remove author and bump owner's sort_order to 0 to make them a primary author
+                    // remove author from posts
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .whereIn('post_id', primaryPostsWithOwnerCoauthorIds)
+                        .where('author_id', authorId)
+                        .del();
+
+                    // make the owner a primary author
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .whereIn('post_id', primaryPostsWithOwnerCoauthorIds)
+                        .where('author_id', ownerId)
+                        .update('sort_order', 0);
+
+                    const primaryPostsWithoutOwnerCoauthor = _.differenceBy(authorsPrimaryPosts, primaryPostsWithOwnerCoauthor, 'post_id');
+                    const postsWithoutOwnerCoauthorIds = primaryPostsWithoutOwnerCoauthor.map(post => post.post_id);
+
+                    // swap out current author with the owner
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .whereIn('post_id', postsWithoutOwnerCoauthorIds)
+                        .where('author_id', authorId)
+                        .update('author_id', ownerId);
+
+                    // remove author as secondary author from any other posts
+                    await knex('posts_authors')
+                        .transacting(trx)
+                        .where('author_id', authorId)
+                        .del();
+                } catch (err) {
+                    throw new errors.InternalServerError({err: err});
+                }
             });
 
             if (!options.transacting) {
                 return ghostBookshelf.transaction((transacting) => {
                     options.transacting = transacting;
-                    return destroyPost();
+                    return reassignPost();
                 });
             }
 
-            return destroyPost();
+            return reassignPost();
         },
 
         permissible: function permissible(postModelOrId, action, context, unsafeAttrs, loadedPermissions, hasUserPermission, hasApiKeyPermission) {
@@ -375,10 +358,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             isAdd = (action === 'add');
             isDestroy = (action === 'destroy');
 
-            function isChanging(attr) {
-                return unsafeAttrs[attr] && unsafeAttrs[attr] !== postModel.get(attr);
-            }
-
             function isChangingAuthors() {
                 if (!unsafeAttrs.authors) {
                     return false;
@@ -394,14 +373,10 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             function isOwner() {
                 let isCorrectOwner = true;
 
-                if (!unsafeAttrs.author_id && !unsafeAttrs.authors) {
+                if (!unsafeAttrs.authors) {
                     return false;
                 }
 
-                if (unsafeAttrs.author_id) {
-                    isCorrectOwner = unsafeAttrs.author_id && unsafeAttrs.author_id === context.user;
-                }
-
                 if (unsafeAttrs.authors) {
                     isCorrectOwner = isCorrectOwner && unsafeAttrs.authors.length && unsafeAttrs.authors[0].id === context.user;
                 }
@@ -418,13 +393,13 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
             }
 
             if (isContributor && isEdit) {
-                hasUserPermission = !isChanging('author_id') && !isChangingAuthors() && isCoAuthor();
+                hasUserPermission = !isChangingAuthors() && isCoAuthor();
             } else if (isContributor && isAdd) {
                 hasUserPermission = isOwner();
             } else if (isContributor && isDestroy) {
                 hasUserPermission = isPrimaryAuthor();
             } else if (isAuthor && isEdit) {
-                hasUserPermission = isCoAuthor() && !isChanging('author_id') && !isChangingAuthors();
+                hasUserPermission = isCoAuthor() && !isChangingAuthors();
             } else if (isAuthor && isAdd) {
                 hasUserPermission = isOwner();
             } else if (postModel) {
@@ -444,7 +419,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
                     // @TODO: we need a concept for making a diff between incoming authors and existing authors
                     // @TODO: for now we simply re-use the new concept of `excludedAttrs`
                     // We only check the primary author of `authors`, any other change will be ignored.
-                    // By this we can deprecate `author_id` more easily.
                     if (isContributor || isAuthor) {
                         return {
                             excludedAttrs: ['authors'].concat(excludedAttrs)