ghost 4.47.4 → 5.0.1

package/core/server/services/url/configs/v4.js

@@ -1,143 +0,0 @@
-/*
- * These are the default resources and filters.
- * They contain minimum filters for public accessibility of resources.
- */
-
-// @TODO: keep this similar to ./canary.js until the v5 release
-
-module.exports = [
-    {
-        type: 'posts',
-        modelOptions: {
-            modelName: 'Post',
-            filter: 'status:published+type:post',
-            exclude: [
-                'title',
-                'mobiledoc',
-                'html',
-                'plaintext',
-                // @TODO: https://github.com/TryGhost/Ghost/issues/10335
-                // 'page',
-                'status',
-                'amp',
-                'codeinjection_head',
-                'codeinjection_foot',
-                'meta_title',
-                'meta_description',
-                'custom_excerpt',
-                'og_image',
-                'og_title',
-                'og_description',
-                'twitter_image',
-                'twitter_title',
-                'twitter_description',
-                'custom_template',
-                'locale'
-            ],
-            withRelated: ['tags', 'authors'],
-            withRelatedPrimary: {
-                primary_tag: 'tags',
-                primary_author: 'authors'
-            },
-            withRelatedFields: {
-                tags: ['tags.id', 'tags.slug'],
-                authors: ['users.id', 'users.slug']
-            }
-        },
-        events: {
-            add: 'post.published',
-            update: 'post.published.edited',
-            remove: 'post.unpublished'
-        }
-    },
-    {
-        type: 'pages',
-        modelOptions: {
-            modelName: 'Post',
-            exclude: [
-                'title',
-                'mobiledoc',
-                'html',
-                'plaintext',
-                // @TODO: https://github.com/TryGhost/Ghost/issues/10335
-                // 'page',
-                // 'status',
-                'amp',
-                'codeinjection_head',
-                'codeinjection_foot',
-                'meta_title',
-                'meta_description',
-                'custom_excerpt',
-                'og_image',
-                'og_title',
-                'og_description',
-                'twitter_image',
-                'twitter_title',
-                'twitter_description',
-                'custom_template',
-                'locale',
-                'tags',
-                'authors',
-                'primary_tag',
-                'primary_author'
-            ],
-            filter: 'status:published+type:page'
-        },
-        events: {
-            add: 'page.published',
-            update: 'page.published.edited',
-            remove: 'page.unpublished'
-        }
-    },
-    {
-        type: 'tags',
-        keep: ['id', 'slug'],
-        modelOptions: {
-            modelName: 'Tag',
-            exclude: [
-                'description',
-                'meta_title',
-                'meta_description',
-                'parent_id'
-            ],
-            filter: 'visibility:public',
-            shouldHavePosts: {
-                joinTo: 'tag_id',
-                joinTable: 'posts_tags'
-            }
-        },
-        events: {
-            add: 'tag.added',
-            update: ['tag.edited', 'tag.attached', 'tag.detached'],
-            remove: 'tag.deleted'
-        }
-    },
-    {
-        type: 'authors',
-        modelOptions: {
-            modelName: 'User',
-            exclude: [
-                'bio',
-                'website',
-                'location',
-                'facebook',
-                'twitter',
-                'locale',
-                'accessibility',
-                'meta_title',
-                'meta_description',
-                'tour'
-            ],
-            filter: 'visibility:public',
-            shouldHavePosts: {
-                joinTo: 'author_id',
-                joinTable: 'posts_authors'
-            }
-        },
-        events: {
-            add: 'user.activated',
-            update: ['user.activated.edited', 'user.attached', 'user.detached'],
-            remove: 'user.deleted'
-        }
-    }
-];

package/core/server/web/api/v2/admin/app.js

@@ -1,43 +0,0 @@
-const debug = require('@tryghost/debug')('web:v2:admin:app');
-const boolParser = require('express-query-boolean');
-const express = require('../../../../../shared/express');
-const sentry = require('../../../../../shared/sentry');
-const bodyParser = require('body-parser');
-const shared = require('../../../shared');
-const apiMw = require('../../middleware');
-const routes = require('./routes');
-const errorHandler = require('@tryghost/mw-error-handler');
-const APIVersionCompatibilityService = require('../../../../services/api-version-compatibility');
-
-module.exports = function setupApiApp() {
-    debug('Admin API v2 setup start');
-    const apiApp = express('v2 admin');
-
-    // API middleware
-
-    // Body parsing
-    apiApp.use(bodyParser.json({limit: '1mb'}));
-    apiApp.use(bodyParser.urlencoded({extended: true, limit: '1mb'}));
-
-    // Query parsing
-    apiApp.use(boolParser());
-
-    // Check version matches for API requests, depends on res.locals.safeVersion being set
-    // Therefore must come after themeHandler.ghostLocals, for now
-    apiApp.use(apiMw.versionMatch);
-
-    // Admin API shouldn't be cached
-    apiApp.use(shared.middleware.cacheControl('private'));
-
-    // Routing
-    apiApp.use(routes());
-
-    // API error handling
-    apiApp.use(errorHandler.resourceNotFound);
-    apiApp.use(APIVersionCompatibilityService.errorHandler);
-    apiApp.use(errorHandler.handleJSONResponseV2(sentry));
-
-    debug('Admin API v2 setup end');
-
-    return apiApp;
-};

package/core/server/web/api/v2/admin/middleware.js

@@ -1,85 +0,0 @@
-const errors = require('@tryghost/errors');
-const tpl = require('@tryghost/tpl');
-const auth = require('../../../../services/auth');
-const shared = require('../../../shared');
-const apiMw = require('../../middleware');
-
-const messages = {
-    notImplemented: 'The server does not support the functionality required to fulfill the request.'
-};
-
-const notImplemented = function (req, res, next) {
-    // CASE: user is logged in, allow
-    if (!req.api_key) {
-        return next();
-    }
-
-    // @NOTE: integrations have limited access for now
-    //        all APIs are considered to be in "maintenance" stability index
-    const allowlisted = {
-        site: ['GET'],
-        posts: ['GET', 'PUT', 'DELETE', 'POST'],
-        pages: ['GET', 'PUT', 'DELETE', 'POST'],
-        images: ['POST'],
-        webhooks: ['POST', 'PUT', 'DELETE'],
-        tags: ['GET', 'PUT', 'DELETE', 'POST'],
-        users: ['GET'],
-        themes: ['POST', 'PUT'],
-        config: ['GET'],
-        schedules: ['PUT'],
-        db: ['POST']
-    };
-
-    const match = req.url.match(/^\/(\w+)\/?/);
-
-    if (match) {
-        const entity = match[1];
-
-        if (allowlisted[entity] && allowlisted[entity].includes(req.method)) {
-            return next();
-        }
-    }
-
-    next(new errors.InternalServerError({
-        errorType: 'NotImplementedError',
-        message: tpl(messages.notImplemented),
-        statusCode: '501'
-    }));
-};
-
-/**
- * Authentication for private endpoints
- */
-module.exports.authAdminApi = [
-    auth.authenticate.authenticateAdminApi,
-    auth.authorize.authorizeAdminApi,
-    apiMw.updateUserLastSeen,
-    apiMw.cors,
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls,
-    notImplemented
-];
-
-/**
- * Authentication for private endpoints with token in URL
- * Ex.: For scheduler publish endpoint
- */
-module.exports.authAdminApiWithUrl = [
-    auth.authenticate.authenticateAdminApiWithUrl,
-    auth.authorize.authorizeAdminApi,
-    apiMw.updateUserLastSeen,
-    apiMw.cors,
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls,
-    notImplemented
-];
-
-/**
- * Middleware for public admin endpoints
- */
-module.exports.publicAdminApi = [
-    apiMw.cors,
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls,
-    notImplemented
-];

package/core/server/web/api/v2/admin/routes.js

@@ -1,200 +0,0 @@
-const express = require('../../../../../shared/express');
-const api = require('../../../../api').v2;
-const mw = require('./middleware');
-const apiMw = require('../../middleware');
-
-const shared = require('../../../shared');
-
-module.exports = function apiRoutes() {
-    const router = express.Router('v2 admin');
-
-    // alias delete with del
-    router.del = router.delete;
-
-    router.use(apiMw.cors);
-
-    const http = api.http;
-
-    // ## Public
-    router.get('/site', mw.publicAdminApi, http(api.site.read));
-
-    // ## Configuration
-    router.get('/config', mw.authAdminApi, http(api.config.read));
-
-    // ## Posts
-    router.get('/posts', mw.authAdminApi, http(api.posts.browse));
-    router.post('/posts', mw.authAdminApi, http(api.posts.add));
-    router.get('/posts/:id', mw.authAdminApi, http(api.posts.read));
-    router.get('/posts/slug/:slug', mw.authAdminApi, http(api.posts.read));
-    router.put('/posts/:id', mw.authAdminApi, http(api.posts.edit));
-    router.del('/posts/:id', mw.authAdminApi, http(api.posts.destroy));
-
-    // ## Pages
-    router.get('/pages', mw.authAdminApi, http(api.pages.browse));
-    router.post('/pages', mw.authAdminApi, http(api.pages.add));
-    router.get('/pages/:id', mw.authAdminApi, http(api.pages.read));
-    router.get('/pages/slug/:slug', mw.authAdminApi, http(api.pages.read));
-    router.put('/pages/:id', mw.authAdminApi, http(api.pages.edit));
-    router.del('/pages/:id', mw.authAdminApi, http(api.pages.destroy));
-
-    // # Integrations
-
-    router.get('/integrations', mw.authAdminApi, http(api.integrations.browse));
-    router.get('/integrations/:id', mw.authAdminApi, http(api.integrations.read));
-    router.post('/integrations', mw.authAdminApi, http(api.integrations.add));
-    router.put('/integrations/:id', mw.authAdminApi, http(api.integrations.edit));
-    router.del('/integrations/:id', mw.authAdminApi, http(api.integrations.destroy));
-
-    // ## Schedules
-    router.put('/schedules/:resource/:id', mw.authAdminApiWithUrl, http(api.schedules.publish));
-
-    // ## Settings
-    router.get('/settings/routes/yaml', mw.authAdminApi, http(api.settings.download));
-    router.post('/settings/routes/yaml',
-        mw.authAdminApi,
-        apiMw.upload.single('routes'),
-        apiMw.upload.validation({type: 'routes'}),
-        http(api.settings.upload)
-    );
-
-    router.get('/settings', mw.authAdminApi, http(api.settings.browse));
-    router.get('/settings/:key', mw.authAdminApi, http(api.settings.read));
-    router.put('/settings', mw.authAdminApi, http(api.settings.edit));
-
-    // ## Users
-    router.get('/users', mw.authAdminApi, http(api.users.browse));
-    router.get('/users/:id', mw.authAdminApi, http(api.users.read));
-    router.get('/users/slug/:slug', mw.authAdminApi, http(api.users.read));
-    // NOTE: We don't expose any email addresses via the public api.
-    router.get('/users/email/:email', mw.authAdminApi, http(api.users.read));
-
-    router.put('/users/password', mw.authAdminApi, http(api.users.changePassword));
-    router.put('/users/owner', mw.authAdminApi, http(api.users.transferOwnership));
-    router.put('/users/:id', mw.authAdminApi, http(api.users.edit));
-    router.del('/users/:id', mw.authAdminApi, http(api.users.destroy));
-
-    // ## Tags
-    router.get('/tags', mw.authAdminApi, http(api.tags.browse));
-    router.get('/tags/:id', mw.authAdminApi, http(api.tags.read));
-    router.get('/tags/slug/:slug', mw.authAdminApi, http(api.tags.read));
-    router.post('/tags', mw.authAdminApi, http(api.tags.add));
-    router.put('/tags/:id', mw.authAdminApi, http(api.tags.edit));
-    router.del('/tags/:id', mw.authAdminApi, http(api.tags.destroy));
-
-    // ## Roles
-    router.get('/roles/', mw.authAdminApi, http(api.roles.browse));
-
-    // ## Slugs
-    router.get('/slugs/:type/:name', mw.authAdminApi, http(api.slugs.generate));
-
-    // ## Themes
-    router.get('/themes/', mw.authAdminApi, http(api.themes.browse));
-
-    router.get('/themes/:name/download',
-        mw.authAdminApi,
-        http(api.themes.download)
-    );
-
-    router.post('/themes/upload',
-        mw.authAdminApi,
-        apiMw.upload.single('file'),
-        apiMw.upload.validation({type: 'themes'}),
-        http(api.themes.upload)
-    );
-
-    router.put('/themes/:name/activate',
-        mw.authAdminApi,
-        http(api.themes.activate)
-    );
-
-    router.del('/themes/:name',
-        mw.authAdminApi,
-        http(api.themes.destroy)
-    );
-
-    // ## Notifications
-    router.get('/notifications', mw.authAdminApi, http(api.notifications.browse));
-    router.post('/notifications', mw.authAdminApi, http(api.notifications.add));
-    router.del('/notifications/:notification_id', mw.authAdminApi, http(api.notifications.destroy));
-
-    // ## DB
-    router.get('/db', mw.authAdminApi, http(api.db.exportContent));
-    router.post('/db',
-        mw.authAdminApi,
-        apiMw.upload.single('importfile'),
-        apiMw.upload.validation({type: 'db'}),
-        http(api.db.importContent)
-    );
-    router.del('/db', mw.authAdminApi, http(api.db.deleteAllContent));
-    router.post('/db/backup',
-        mw.authAdminApi,
-        http(api.db.backupContent)
-    );
-
-    // ## Mail
-    router.post('/mail', mw.authAdminApi, http(api.mail.send));
-    router.post('/mail/test', mw.authAdminApi, http(api.mail.sendTest));
-
-    // ## Slack
-    router.post('/slack/test', mw.authAdminApi, http(api.slack.sendTest));
-
-    // ## Sessions
-    router.get('/session', mw.authAdminApi, http(api.session.read));
-    // We don't need auth when creating a new session (logging in)
-    router.post('/session',
-        shared.middleware.brute.globalBlock,
-        shared.middleware.brute.userLogin,
-        http(api.session.add)
-    );
-    router.del('/session', mw.authAdminApi, http(api.session.delete));
-
-    // ## Authentication
-    router.post('/authentication/passwordreset',
-        shared.middleware.brute.globalReset,
-        shared.middleware.brute.userReset,
-        http(api.authentication.generateResetToken)
-    );
-    router.put('/authentication/passwordreset', shared.middleware.brute.globalBlock, http(api.authentication.resetPassword));
-    router.post('/authentication/invitation', http(api.authentication.acceptInvitation));
-    router.get('/authentication/invitation', http(api.authentication.isInvitation));
-    router.post('/authentication/setup', http(api.authentication.setup));
-    router.put('/authentication/setup', mw.authAdminApi, http(api.authentication.updateSetup));
-    router.get('/authentication/setup', http(api.authentication.isSetup));
-
-    // ## Images
-    router.post('/images/upload',
-        mw.authAdminApi,
-        apiMw.upload.single('file'),
-        apiMw.upload.validation({type: 'images'}),
-        apiMw.normalizeImage,
-        http(api.images.upload)
-    );
-
-    // ## Invites
-    router.get('/invites', mw.authAdminApi, http(api.invites.browse));
-    router.get('/invites/:id', mw.authAdminApi, http(api.invites.read));
-    router.post('/invites', mw.authAdminApi, http(api.invites.add));
-    router.del('/invites/:id', mw.authAdminApi, http(api.invites.destroy));
-
-    // ## Redirects (JSON based)
-    router.get('/redirects/json', mw.authAdminApi, http(api.redirects.download));
-    router.post('/redirects/json',
-        mw.authAdminApi,
-        apiMw.upload.single('redirects'),
-        apiMw.upload.validation({type: 'redirects'}),
-        http(api.redirects.upload)
-    );
-
-    // ## Webhooks (RESTHooks)
-    router.post('/webhooks', mw.authAdminApi, http(api.webhooks.add));
-    router.put('/webhooks/:id', mw.authAdminApi, http(api.webhooks.edit));
-    router.del('/webhooks/:id', mw.authAdminApi, http(api.webhooks.destroy));
-
-    // ## Oembed (fetch response from oembed provider)
-    router.get('/oembed', mw.authAdminApi, http(api.oembed.read));
-
-    // ## Actions
-    router.get('/actions/:type/:id', mw.authAdminApi, http(api.actions.browse));
-
-    return router;
-};

package/core/server/web/api/v2/content/app.js

@@ -1,38 +0,0 @@
-const debug = require('@tryghost/debug')('web:api:v2:content:app');
-const boolParser = require('express-query-boolean');
-const bodyParser = require('body-parser');
-const express = require('../../../../../shared/express');
-const sentry = require('../../../../../shared/sentry');
-const shared = require('../../../shared');
-const routes = require('./routes');
-const errorHandler = require('@tryghost/mw-error-handler');
-const versionMissmatchHandler = require('@tryghost/mw-api-version-mismatch');
-const {APIVersionCompatibilityServiceInstance} = require('../../../../services/api-version-compatibility');
-
-module.exports = function setupApiApp() {
-    debug('Content API v2 setup start');
-    const apiApp = express('v2 content');
-
-    // API middleware
-
-    // @NOTE: req.body is undefined if we don't use this parser, this can trouble if components rely on req.body being present
-    apiApp.use(bodyParser.json({limit: '1mb'}));
-
-    // Query parsing
-    apiApp.use(boolParser());
-
-    // API shouldn't be cached
-    apiApp.use(shared.middleware.cacheControl('private'));
-
-    // Routing
-    apiApp.use(routes());
-
-    // API error handling
-    apiApp.use(errorHandler.resourceNotFound);
-    apiApp.use(versionMissmatchHandler(APIVersionCompatibilityServiceInstance));
-    apiApp.use(errorHandler.handleJSONResponse(sentry));
-
-    debug('Content API v2 setup end');
-
-    return apiApp;
-};

package/core/server/web/api/v2/content/middleware.js

@@ -1,23 +0,0 @@
-const cors = require('cors');
-const auth = require('../../../../services/auth');
-const shared = require('../../../shared');
-
-/**
- * Auth Middleware Packages
- *
- * IMPORTANT
- * - cors middleware MUST happen before pretty urls, because otherwise cors header can get lost on redirect
- * - url redirects MUST happen after cors, otherwise cors header can get lost on redirect
- */
-
-/**
- * Authentication for public endpoints
- */
-module.exports.authenticatePublic = [
-    shared.middleware.brute.contentApiKey,
-    auth.authenticate.authenticateContentApi,
-    auth.authorize.authorizeContentApi,
-    cors(),
-    shared.middleware.urlRedirects.adminSSLAndHostRedirect,
-    shared.middleware.prettyUrls
-];

package/core/server/web/api/v2/content/routes.js

@@ -1,37 +0,0 @@
-const express = require('../../../../../shared/express');
-const cors = require('cors');
-const api = require('../../../../api').v2;
-const mw = require('./middleware');
-
-module.exports = function apiRoutes() {
-    const router = express.Router('v2 content');
-
-    router.use(cors());
-
-    const http = api.http;
-
-    // ## Posts
-    router.get('/posts', mw.authenticatePublic, http(api.postsPublic.browse));
-    router.get('/posts/:id', mw.authenticatePublic, http(api.postsPublic.read));
-    router.get('/posts/slug/:slug', mw.authenticatePublic, http(api.postsPublic.read));
-
-    // ## Pages
-    router.get('/pages', mw.authenticatePublic, http(api.pagesPublic.browse));
-    router.get('/pages/:id', mw.authenticatePublic, http(api.pagesPublic.read));
-    router.get('/pages/slug/:slug', mw.authenticatePublic, http(api.pagesPublic.read));
-
-    // ## Users
-    router.get('/authors', mw.authenticatePublic, http(api.authorsPublic.browse));
-    router.get('/authors/:id', mw.authenticatePublic, http(api.authorsPublic.read));
-    router.get('/authors/slug/:slug', mw.authenticatePublic, http(api.authorsPublic.read));
-
-    // ## Tags
-    router.get('/tags', mw.authenticatePublic, http(api.tagsPublic.browse));
-    router.get('/tags/:id', mw.authenticatePublic, http(api.tagsPublic.read));
-    router.get('/tags/slug/:slug', mw.authenticatePublic, http(api.tagsPublic.read));
-
-    // ## Settings
-    router.get('/settings', mw.authenticatePublic, http(api.publicSettings.browse));
-
-    return router;
-};

package/core/server/web/api/v3/admin/app.js

@@ -1,43 +0,0 @@
-const debug = require('@tryghost/debug')('web:v3:admin:app');
-const boolParser = require('express-query-boolean');
-const express = require('../../../../../shared/express');
-const sentry = require('../../../../../shared/sentry');
-const bodyParser = require('body-parser');
-const shared = require('../../../shared');
-const apiMw = require('../../middleware');
-const routes = require('./routes');
-const errorHandler = require('@tryghost/mw-error-handler');
-const APIVersionCompatibilityService = require('../../../../services/api-version-compatibility');
-
-module.exports = function setupApiApp() {
-    debug('Admin API v3 setup start');
-    const apiApp = express('v3 admin');
-
-    // API middleware
-
-    // Body parsing
-    apiApp.use(bodyParser.json({limit: '1mb'}));
-    apiApp.use(bodyParser.urlencoded({extended: true, limit: '1mb'}));
-
-    // Query parsing
-    apiApp.use(boolParser());
-
-    // Check version matches for API requests, depends on res.locals.safeVersion being set
-    // Therefore must come after themeHandler.ghostLocals, for now
-    apiApp.use(apiMw.versionMatch);
-
-    // Admin API shouldn't be cached
-    apiApp.use(shared.middleware.cacheControl('private'));
-
-    // Routing
-    apiApp.use(routes());
-
-    // API error handling
-    apiApp.use(errorHandler.resourceNotFound);
-    apiApp.use(APIVersionCompatibilityService.errorHandler);
-    apiApp.use(errorHandler.handleJSONResponseV2(sentry));
-
-    debug('Admin API v3 setup end');
-
-    return apiApp;
-};