ghost 4.48.0 → 5.0.0

package/core/frontend/helpers/ghost_head.js

@@ -2,7 +2,7 @@
 // Usage: `{{ghost_head}}`
 //
 // Outputs scripts and other assets at the top of a Ghost theme
-const {metaData, settingsCache, config, blogIcon, urlUtils, labs} = require('../services/proxy');
+const {metaData, settingsCache, config, blogIcon, urlUtils, labs, getFrontendKey} = require('../services/proxy');
 const {escapeExpression, SafeString} = require('../services/handlebars');
 
 // BAD REQUIRE
@@ -43,7 +43,7 @@ function finaliseStructuredData(meta) {
     return head;
 }
 
-function getMembersHelper(data) {
+function getMembersHelper(data, frontendKey) {
     if (settingsCache.get('members_signup_access') === 'none') {
         return '';
     }
@@ -52,8 +52,7 @@ function getMembersHelper(data) {
     const stripeDirectPublishableKey = settingsCache.get('stripe_publishable_key');
     const stripeConnectAccountId = settingsCache.get('stripe_connect_account_id');
     const colorString = _.has(data, 'site._preview') && data.site.accent_color ? ` data-accent-color="${data.site.accent_color}"` : '';
-    const portalUrl = config.get('portal:url');
-    let membersHelper = `<script defer src="${portalUrl}" data-ghost="${urlUtils.getSiteUrl()}"${colorString} crossorigin="anonymous"></script>`;
+    let membersHelper = `<script defer src="${config.get('portal:url')}" data-ghost="${urlUtils.getSiteUrl()}"${colorString} data-key="${frontendKey}" data-api="${urlUtils.urlFor('api', {type: 'content'}, true)}" crossorigin="anonymous"></script>`;
     membersHelper += (`<style id="gh-members-styles">${templateStyles}</style>`);
     if ((!!stripeDirectSecretKey && !!stripeDirectPublishableKey) || !!stripeConnectAccountId) {
         membersHelper += '<script async src="https://js.stripe.com/v3/"></script>';
@@ -96,7 +95,7 @@ function getMembersHelper(data) {
  *  Also see how the root object gets created, https://github.com/wycats/handlebars.js/blob/v4.0.6/lib/handlebars/runtime.js#L259
  */
 // We use the name ghost_head to match the helper for consistency:
-module.exports = function ghost_head(options) { // eslint-disable-line camelcase
+module.exports = async function ghost_head(options) { // eslint-disable-line camelcase
     debug('begin');
 
     // if server error page do nothing
@@ -118,128 +117,128 @@ module.exports = function ghost_head(options) { // eslint-disable-line camelcase
 
     debug('preparation complete, begin fetch');
 
-    /**
-     * @TODO:
-     *   - getMetaData(dataRoot, dataRoot) -> yes that looks confusing!
-     *   - there is a very mixed usage of `data.context` vs. `root.context` vs `root._locals.context` vs. `this.context`
-     *   - NOTE: getMetaData won't live here anymore soon, see https://github.com/TryGhost/Ghost/issues/8995
-     *   - therefore we get rid of using `getMetaData(this, dataRoot)`
-     *   - dataRoot has access to *ALL* locals, see function description
-     *   - it should not break anything
-     */
-    return getMetaData(dataRoot, dataRoot)
-        .then(function handleMetaData(meta) {
-            debug('end fetch');
-
-            if (context) {
-                // head is our main array that holds our meta data
-                if (meta.metaDescription && meta.metaDescription.length > 0) {
-                    head.push('<meta name="description" content="' + escapeExpression(meta.metaDescription) + '" />');
-                }
+    try {
+        /**
+         * @TODO:
+         *   - getMetaData(dataRoot, dataRoot) -> yes that looks confusing!
+         *   - there is a very mixed usage of `data.context` vs. `root.context` vs `root._locals.context` vs. `this.context`
+         *   - NOTE: getMetaData won't live here anymore soon, see https://github.com/TryGhost/Ghost/issues/8995
+         *   - therefore we get rid of using `getMetaData(this, dataRoot)`
+         *   - dataRoot has access to *ALL* locals, see function description
+         *   - it should not break anything
+         */
+        const meta = await getMetaData(dataRoot, dataRoot);
+        const frontendKey = await getFrontendKey();
+
+        debug('end fetch');
+
+        if (context) {
+            // head is our main array that holds our meta data
+            if (meta.metaDescription && meta.metaDescription.length > 0) {
+                head.push('<meta name="description" content="' + escapeExpression(meta.metaDescription) + '" />');
+            }
 
-                // no output in head if a publication icon is not set
-                if (settingsCache.get('icon')) {
-                    head.push('<link rel="icon" href="' + favicon + '" type="image/' + iconType + '" />');
-                }
+            // no output in head if a publication icon is not set
+            if (settingsCache.get('icon')) {
+                head.push('<link rel="icon" href="' + favicon + '" type="image/' + iconType + '" />');
+            }
 
-                head.push('<link rel="canonical" href="' +
-                    escapeExpression(meta.canonicalUrl) + '" />');
-                head.push('<meta name="referrer" content="' + referrerPolicy + '" />');
+            head.push('<link rel="canonical" href="' + escapeExpression(meta.canonicalUrl) + '" />');
+            head.push('<meta name="referrer" content="' + referrerPolicy + '" />');
 
-                // don't allow indexing of preview URLs!
-                if (_.includes(context, 'preview')) {
-                    head.push(writeMetaTag('robots', 'noindex,nofollow', 'name'));
-                }
+            // don't allow indexing of preview URLs!
+            if (_.includes(context, 'preview')) {
+                head.push(writeMetaTag('robots', 'noindex,nofollow', 'name'));
+            }
 
-                // show amp link in post when 1. we are not on the amp page and 2. amp is enabled
-                if (_.includes(context, 'post') && !_.includes(context, 'amp') && settingsCache.get('amp')) {
-                    head.push('<link rel="amphtml" href="' +
-                        escapeExpression(meta.ampUrl) + '" />');
-                }
+            // show amp link in post when 1. we are not on the amp page and 2. amp is enabled
+            if (_.includes(context, 'post') && !_.includes(context, 'amp') && settingsCache.get('amp')) {
+                head.push('<link rel="amphtml" href="' +
+                    escapeExpression(meta.ampUrl) + '" />');
+            }
 
-                if (meta.previousUrl) {
-                    head.push('<link rel="prev" href="' +
-                        escapeExpression(meta.previousUrl) + '" />');
-                }
+            if (meta.previousUrl) {
+                head.push('<link rel="prev" href="' +
+                    escapeExpression(meta.previousUrl) + '" />');
+            }
 
-                if (meta.nextUrl) {
-                    head.push('<link rel="next" href="' +
-                        escapeExpression(meta.nextUrl) + '" />');
-                }
+            if (meta.nextUrl) {
+                head.push('<link rel="next" href="' +
+                    escapeExpression(meta.nextUrl) + '" />');
+            }
 
-                if (!_.includes(context, 'paged') && useStructuredData) {
-                    head.push('');
-                    head.push.apply(head, finaliseStructuredData(meta));
-                    head.push('');
+            if (!_.includes(context, 'paged') && useStructuredData) {
+                head.push('');
+                head.push.apply(head, finaliseStructuredData(meta));
+                head.push('');
 
-                    if (meta.schema) {
-                        head.push('<script type="application/ld+json">\n' +
-                            JSON.stringify(meta.schema, null, '    ') +
-                            '\n    </script>\n');
-                    }
+                if (meta.schema) {
+                    head.push('<script type="application/ld+json">\n' +
+                        JSON.stringify(meta.schema, null, '    ') +
+                        '\n    </script>\n');
                 }
             }
+        }
 
-            head.push('<meta name="generator" content="Ghost ' +
-                escapeExpression(safeVersion) + '" />');
+        head.push('<meta name="generator" content="Ghost ' +
+            escapeExpression(safeVersion) + '" />');
 
-            // Ghost analytics tag
-            if (labs.isSet('membersActivity')) {
-                const postId = (dataRoot && dataRoot.post) ? dataRoot.post.id : '';
-                head.push(writeMetaTag('ghost-analytics-id', postId, 'name'));
-            }
+        // Ghost analytics tag
+        if (labs.isSet('membersActivity')) {
+            const postId = (dataRoot && dataRoot.post) ? dataRoot.post.id : '';
+            head.push(writeMetaTag('ghost-analytics-id', postId, 'name'));
+        }
 
-            head.push('<link rel="alternate" type="application/rss+xml" title="' +
-                escapeExpression(meta.site.title) + '" href="' +
-                escapeExpression(meta.rssUrl) + '" />');
+        head.push('<link rel="alternate" type="application/rss+xml" title="' +
+            escapeExpression(meta.site.title) + '" href="' +
+            escapeExpression(meta.rssUrl) + '" />');
 
-            // no code injection for amp context!!!
-            if (!_.includes(context, 'amp')) {
-                head.push(getMembersHelper(options.data));
+        // no code injection for amp context!!!
+        if (!_.includes(context, 'amp')) {
+            head.push(getMembersHelper(options.data, frontendKey));
 
-                // @TODO do this in a more "frameworky" way
-                if (cardAssetService.hasFile('js')) {
-                    head.push(`<script defer src="${getAssetUrl('public/cards.min.js')}"></script>`);
-                }
-                if (cardAssetService.hasFile('css')) {
-                    head.push(`<link rel="stylesheet" type="text/css" href="${getAssetUrl('public/cards.min.css')}">`);
-                }
+            // @TODO do this in a more "frameworky" way
+            if (cardAssetService.hasFile('js')) {
+                head.push(`<script defer src="${getAssetUrl('public/cards.min.js')}"></script>`);
+            }
+            if (cardAssetService.hasFile('css')) {
+                head.push(`<link rel="stylesheet" type="text/css" href="${getAssetUrl('public/cards.min.css')}">`);
+            }
 
-                if (!_.isEmpty(globalCodeinjection)) {
-                    head.push(globalCodeinjection);
-                }
+            if (!_.isEmpty(globalCodeinjection)) {
+                head.push(globalCodeinjection);
+            }
 
-                if (!_.isEmpty(postCodeInjection)) {
-                    head.push(postCodeInjection);
-                }
+            if (!_.isEmpty(postCodeInjection)) {
+                head.push(postCodeInjection);
+            }
 
-                if (!_.isEmpty(tagCodeInjection)) {
-                    head.push(tagCodeInjection);
-                }
+            if (!_.isEmpty(tagCodeInjection)) {
+                head.push(tagCodeInjection);
             }
+        }
 
-            // AMP template has style injected directly because there can only be one <style amp-custom> tag
-            if (options.data.site.accent_color && !_.includes(context, 'amp')) {
-                const accentColor = escapeExpression(options.data.site.accent_color);
-                const styleTag = `<style>:root {--ghost-accent-color: ${accentColor};}</style>`;
-                const existingScriptIndex = _.findLastIndex(head, str => str.match(/<\/(style|script)>/));
+        // AMP template has style injected directly because there can only be one <style amp-custom> tag
+        if (options.data.site.accent_color && !_.includes(context, 'amp')) {
+            const accentColor = escapeExpression(options.data.site.accent_color);
+            const styleTag = `<style>:root {--ghost-accent-color: ${accentColor};}</style>`;
+            const existingScriptIndex = _.findLastIndex(head, str => str.match(/<\/(style|script)>/));
 
-                if (existingScriptIndex !== -1) {
-                    head[existingScriptIndex] = head[existingScriptIndex] + styleTag;
-                } else {
-                    head.push(styleTag);
-                }
+            if (existingScriptIndex !== -1) {
+                head[existingScriptIndex] = head[existingScriptIndex] + styleTag;
+            } else {
+                head.push(styleTag);
             }
+        }
 
-            debug('end');
-            return new SafeString(head.join('\n    ').trim());
-        })
-        .catch(function handleError(err) {
-            logging.error(err);
+        debug('end');
+        return new SafeString(head.join('\n    ').trim());
+    } catch (error) {
+        logging.error(error);
 
-            // Return what we have so far (currently nothing)
-            return new SafeString(head.join('\n    ').trim());
-        });
+        // Return what we have so far (currently nothing)
+        return new SafeString(head.join('\n    ').trim());
+    }
 };
 
 module.exports.async = true;

package/core/frontend/helpers/navigation.js

@@ -29,7 +29,6 @@ module.exports = function navigation(options) {
 
     const navigationData = options.data.site[key];
     const currentUrl = options.data.root.relativeUrl;
-    const self = this;
     let output;
 
     if (!_.isObject(navigationData) || _.isFunction(navigationData)) {
@@ -78,7 +77,6 @@ module.exports = function navigation(options) {
         out.label = e.label;
         out.slug = slugify(e.label);
         out.url = e.url;
-        out.secure = self.secure;
         return out;
     });
 

package/core/frontend/helpers/prev_post.js

@@ -9,7 +9,6 @@ const {checks} = require('../services/data');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
 const get = require('lodash/get');
-const Promise = require('bluebird');
 const moment = require('moment');
 
 const messages = {
@@ -55,30 +54,25 @@ const buildApiOptions = function buildApiOptions(options, post) {
  * @param {*} data
  * @returns {Promise<any>}
  */
-const fetch = function fetch(options, data) {
+const fetch = async function fetch(options, data) {
     const self = this;
     const apiOptions = buildApiOptions(options, this);
-    const apiVersion = data.root._locals.apiVersion;
-
-    // @TODO: https://github.com/TryGhost/Ghost/issues/10548
-    const controller = api[apiVersion].postsPublic || api[apiVersion].posts;
-
-    return controller
-        .browse(apiOptions)
-        .then(function handleSuccess(result) {
-            const related = result.posts[0];
-
-            if (related) {
-                return options.fn(related, {data: data});
-            } else {
-                return options.inverse(self, {data: data});
-            }
-        })
-        .catch(function handleError(err) {
-            logging.error(err);
-            data.error = err.message;
+
+    try {
+        const response = await api.postsPublic.browse(apiOptions);
+
+        const related = response.posts[0];
+
+        if (related) {
+            return options.fn(related, {data: data});
+        } else {
             return options.inverse(self, {data: data});
-        });
+        }
+    } catch (error) {
+        logging.error(error);
+        data.error = error.message;
+        return options.inverse(self, {data: data});
+    }
 };
 
 // If prevNext method is called without valid post data then we must return a promise, if there is valid post data
@@ -88,7 +82,7 @@ const fetch = function fetch(options, data) {
  * @param {*} options
  * @returns {Promise<any>}
  */
-module.exports = function prevNext(options) {
+module.exports = async function prevNext(options) {
     options = options || {};
 
     const data = createFrame(options.data);
@@ -98,16 +92,16 @@ module.exports = function prevNext(options) {
     if (!options.fn || !options.inverse) {
         data.error = tpl(messages.mustBeCalledAsBlock, {helperName: options.name});
         logging.warn(data.error);
-        return Promise.resolve();
+        return;
     }
 
     if (context.includes('preview')) {
-        return Promise.resolve(options.inverse(this, {data: data}));
+        return options.inverse(this, {data: data});
     }
 
     // Guard against trying to execute prev/next on pages, or other resources
     if (!checks.isPost(this) || this.page) {
-        return Promise.resolve(options.inverse(this, {data: data}));
+        return options.inverse(this, {data: data});
     }
 
     // With the guards out of the way, attempt to build the apiOptions, and then fetch the data

package/core/frontend/helpers/price.js

@@ -58,8 +58,8 @@ module.exports = function price(planOrAmount, options) {
     }
     options = options || {};
     options.hash = options.hash || {};
-    // NOTE: potentially breaking place once site.lang is removed in favor of site.locale
-    const {currency, numberFormat = 'short', currencyFormat = 'symbol', locale = _.get(options, 'data.site.lang', 'en')} = options.hash;
+
+    const {currency, numberFormat = 'short', currencyFormat = 'symbol', locale = _.get(options, 'data.site.locale', 'en')} = options.hash;
     if (plan) {
         return formatter({
             amount: plan.amount && (plan.amount / 100),

package/core/frontend/meta/author-url.js

@@ -7,11 +7,11 @@ function getAuthorUrl(data, absolute) {
     const contextObject = getContextObject(data, context);
 
     if (data.author) {
-        return urlService.getUrlByResourceId(data.author.id, {absolute: absolute, secure: data.author.secure, withSubdirectory: true});
+        return urlService.getUrlByResourceId(data.author.id, {absolute: absolute, withSubdirectory: true});
     }
 
     if (contextObject && contextObject.primary_author) {
-        return urlService.getUrlByResourceId(contextObject.primary_author.id, {absolute: absolute, secure: contextObject.secure, withSubdirectory: true});
+        return urlService.getUrlByResourceId(contextObject.primary_author.id, {absolute: absolute, withSubdirectory: true});
     }
 
     return null;

package/core/frontend/meta/description.js

@@ -47,7 +47,7 @@ function getDescription(data, root, options = {}) {
             description = data.post[`${options.property}_description`]
                 || data.post.custom_excerpt
                 || data.post.meta_description
-                || generateExcerpt(data.post.html || '', {words: 50})
+                || generateExcerpt(data.post.excerpt || '', {words: 50})
                 || settingsCache.get('description')
                 || '';
         } else {
@@ -59,7 +59,7 @@ function getDescription(data, root, options = {}) {
             description = data.post[`${options.property}_description`]
                 || data.post.custom_excerpt
                 || data.post.meta_description
-                || generateExcerpt(data.post.html || '', {words: 50})
+                || generateExcerpt(data.post.excerpt || '', {words: 50})
                 || settingsCache.get('description')
                 || '';
         } else {
@@ -70,7 +70,7 @@ function getDescription(data, root, options = {}) {
             description = data.page[`${options.property}_description`]
                 || data.page.custom_excerpt
                 || data.page.meta_description
-                || generateExcerpt(data.page.html || '', {words: 50})
+                || generateExcerpt(data.page.excerpt || '', {words: 50})
                 || settingsCache.get('description')
                 || '';
         } else {

package/core/frontend/meta/excerpt.js

@@ -10,10 +10,9 @@ function getExcerpt(data) {
     // 1. CASE: custom_excerpt is populated via the UI
     // 2. CASE: no custom_excerpt, but meta_description is poplated via the UI
     // 3. CASE: fall back to automated excerpt of 50 words if neither custom_excerpt nor meta_description is provided
-    // @TODO: https://github.com/TryGhost/Ghost/issues/10062
     const customExcerpt = data.post.excerpt || data.post.custom_excerpt;
     const metaDescription = data.post.meta_description;
-    const fallbackExcerpt = data.post.html ? generateExcerpt(data.post.html, {words: 50}) : '';
+    const fallbackExcerpt = data.post.excerpt ? generateExcerpt(data.post.excerpt, {words: 50}) : '';
 
     return customExcerpt ? customExcerpt : metaDescription ? metaDescription : fallbackExcerpt;
 }

package/core/frontend/meta/generate-excerpt.js

@@ -1,22 +1,13 @@
 const downsize = require('downsize');
 
-function generateExcerpt(html, truncateOptions) {
+function generateExcerpt(excerpt, truncateOptions) {
     truncateOptions = truncateOptions || {};
-    // Strip inline and bottom footnotes
-    let excerpt = html.replace(/<a href="#fn.*?rel="footnote">.*?<\/a>/gi, '');
-    excerpt = excerpt.replace(/<div class="footnotes"><ol>.*?<\/ol><\/div>/, '');
-
-    // Make sure to have space between paragraphs and new lines
-    excerpt = excerpt.replace(/(<\/p>|<br>)/gi, ' ');
-
-    // Strip other html
-    excerpt = excerpt.replace(/<\/?[^>]+>/gi, '');
-    excerpt = excerpt.replace(/(\r\n|\n|\r)+/gm, ' ');
 
     if (!truncateOptions.words && !truncateOptions.characters) {
         truncateOptions.words = 50;
     }
 
+    // Just uses downsize to truncate, not format
     return downsize(excerpt, truncateOptions);
 }
 

package/core/frontend/meta/paginated-url.js

@@ -35,7 +35,7 @@ function getPaginatedUrl(page, data, absolute) {
     // baseUrl can be undefined, if there was nothing preceding the pagePath (e.g. first page of the index channel)
     newRelativeUrl = baseUrl ? urlUtils.urlJoin(baseUrl, newRelativeUrl) : newRelativeUrl;
 
-    return urlUtils.urlFor({relativeUrl: newRelativeUrl, secure: data.secure}, absolute);
+    return urlUtils.urlFor({relativeUrl: newRelativeUrl}, absolute);
 }
 
 module.exports = getPaginatedUrl;

package/core/frontend/meta/rss-url.js

@@ -2,7 +2,6 @@ const routingService = require('../services/routing');
 
 function getRssUrl(data, absolute) {
     return routingService.registry.getRssUrl({
-        secure: data.secure,
         absolute: absolute
     });
 }

package/core/frontend/meta/url.js

@@ -27,18 +27,18 @@ function getUrl(data, absolute) {
          * A long term solution should be part of the final version of Dynamic Routing.
          */
         if (data.status !== 'published' && urlService.getUrlByResourceId(data.id) === '/404/') {
-            return urlUtils.urlFor({relativeUrl: urlUtils.urlJoin('/p', data.uuid, '/'), secure: data.secure}, null, absolute);
+            return urlUtils.urlFor({relativeUrl: urlUtils.urlJoin('/p', data.uuid, '/')}, null, absolute);
         }
 
-        return urlService.getUrlByResourceId(data.id, {secure: data.secure, absolute: absolute, withSubdirectory: true});
+        return urlService.getUrlByResourceId(data.id, {absolute: absolute, withSubdirectory: true});
     }
 
     if (checks.isTag(data) || checks.isUser(data)) {
-        return urlService.getUrlByResourceId(data.id, {secure: data.secure, absolute: absolute, withSubdirectory: true});
+        return urlService.getUrlByResourceId(data.id, {absolute: absolute, withSubdirectory: true});
     }
 
     if (checks.isNav(data)) {
-        return urlUtils.urlFor('nav', {nav: data, secure: data.secure}, absolute);
+        return urlUtils.urlFor('nav', {nav: data}, absolute);
     }
 
     // sanitize any trailing `/amp` in the url

package/core/frontend/services/data/entry-lookup.js

@@ -14,7 +14,7 @@ const routeMatch = require('path-match')();
 function entryLookup(postUrl, routerOptions, locals) {
     debug(postUrl);
 
-    const api = require('../proxy').api[locals.apiVersion];
+    const api = require('../proxy').api;
     const targetPath = url.parse(postUrl).path;
     const permalinks = routerOptions.permalinks;
     let isEditURL = false;

package/core/frontend/services/data/fetch-data.js

@@ -45,7 +45,7 @@ defaultPostQuery.options = defaultQueryOptions.options;
  * @returns {Promise}
  */
 function processQuery(query, slugParam, locals) {
-    const api = require('../proxy').api[locals.apiVersion];
+    const api = require('../proxy').api;
 
     query = _.cloneDeep(query);
 

package/core/frontend/services/helpers/handlebars.js

@@ -1,4 +1,3 @@
-const Promise = require('bluebird');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 
@@ -6,31 +5,31 @@ const {hbs} = require('../handlebars');
 
 // Register an async handlebars helper for a given handlebars instance
 function asyncHelperWrapper(hbsInstance, name, fn) {
-    hbsInstance.registerAsyncHelper(name, function returnAsync(context, options, cb) {
+    hbsInstance.registerAsyncHelper(name, async function returnAsync(context, options, cb) {
         // Handle the case where we only get context and cb
         if (!cb) {
             cb = options;
             options = undefined;
         }
 
-        // Wrap the function passed in with a Promise.resolve so it can return either a promise or a value
-        Promise.resolve(fn.call(this, context, options)).then(function asyncHelperSuccess(result) {
-            cb(result);
-        }).catch(function asyncHelperError(err) {
-            const wrappedErr = errors.utils.isGhostError(err) ? err : new errors.IncorrectUsageError({
-                err: err,
+        try {
+            const response = await fn.call(this, context, options);
+            cb(response);
+        } catch (error) {
+            const wrappedErr = errors.utils.isGhostError(error) ? error : new errors.IncorrectUsageError({
+                err: error,
                 context: 'registerAsyncThemeHelper: ' + name,
                 errorDetails: {
-                    originalError: err
+                    originalError: error
                 }
             });
 
-            const result = process.env.NODE_ENV === 'development' ? wrappedErr : '';
+            const response = process.env.NODE_ENV === 'development' ? wrappedErr : '';
 
             logging.error(wrappedErr);
 
-            cb(new hbsInstance.SafeString(result));
-        });
+            cb(new hbsInstance.SafeString(response));
+        }
     });
 }
 

package/core/frontend/services/proxy.js

@@ -5,7 +5,13 @@ const config = require('../../shared/config');
 // Require from the handlebars framework
 const {SafeString} = require('./handlebars');
 
+let _dataService = {};
+
 module.exports = {
+    getFrontendKey: () => {
+        return _dataService.getFrontendKey();
+    },
+
     /**
      * Section two: data manipulation
      * Stuff that modifies API data (SDK layer)
@@ -39,7 +45,7 @@ module.exports = {
     settingsCache: settingsCache,
 
     // TODO: Expose less of the API to make this safe
-    api: require('../../server/api'),
+    api: require('../../server/api').endpoints,
 
     // Labs utils for enabling/disabling helpers
     labs: require('../../shared/labs'),
@@ -47,3 +53,7 @@ module.exports = {
     urlService: require('../../server/services/url'),
     urlUtils: require('../../shared/url-utils')
 };
+
+module.exports.init = ({dataService}) => {
+    _dataService = dataService;
+};

package/core/frontend/services/rendering/format-response.js

@@ -46,12 +46,19 @@ function formatPageResponse(result) {
  *
  * @return {Object} containing page variables
  */
-function formatResponse(post) {
+function formatResponse(post, context) {
     prepareContextResource(post);
 
-    return {
+    let entry = {
         post: post
     };
+
+    // NOTE: preview context is a special case where the internal preview api returns the post model's type field
+    if (context?.includes('page') || (context?.includes('preview') && post.type === 'page')) {
+        entry.page = post;
+    }
+
+    return entry;
 }
 
 module.exports = {

package/core/frontend/services/rendering/index.js

@@ -19,10 +19,6 @@ module.exports = {
         return require('./templates');
     },
 
-    get secure() {
-        return require('./secure');
-    },
-
     get handleError() {
         return require('./error');
     },