ghost 4.48.0 → 5.0.0

package/core/server/api/v2/utils/permissions.js

@@ -1,112 +0,0 @@
-const debug = require('@tryghost/debug')('api:v2:utils:permissions');
-const Promise = require('bluebird');
-const _ = require('lodash');
-const permissions = require('../../../services/permissions');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-
-const messages = {
-    noPermissionToCall: 'You do not have permission to {method} {docName}'
-};
-
-/**
- * @description Handle requests, which need authentication.
- *
- * @param {Object} apiConfig - Docname & method of API ctrl
- * @param {Object} frame
- * @return {Promise}
- */
-const nonePublicAuth = (apiConfig, frame) => {
-    debug('check admin permissions');
-
-    const singular = apiConfig.docName.replace(/s$/, '');
-
-    let permissionIdentifier = frame.options.id;
-
-    // CASE: Target ctrl can override the identifier. The identifier is the unique identifier of the target resource
-    //       e.g. edit a setting -> the key of the setting
-    //       e.g. edit a post -> post id from url param
-    //       e.g. change user password -> user id inside of the body structure
-    if (apiConfig.identifier) {
-        permissionIdentifier = apiConfig.identifier(frame);
-    }
-
-    let unsafeAttrObject = apiConfig.unsafeAttrs && _.has(frame, `data.[${apiConfig.docName}][0]`) ? _.pick(frame.data[apiConfig.docName][0], apiConfig.unsafeAttrs) : {};
-
-    if (apiConfig.unsafeAttrsObject) {
-        unsafeAttrObject = apiConfig.unsafeAttrsObject(frame);
-    }
-
-    const permsPromise = permissions.canThis(frame.options.context)[apiConfig.method][singular](permissionIdentifier, unsafeAttrObject);
-
-    return permsPromise.then((result) => {
-        /*
-         * Allow the permissions function to return a list of excluded attributes.
-         * If it does, omit those attrs from the data passed through
-         *
-         * NOTE: excludedAttrs differ from unsafeAttrs in that they're determined by the model's permissible function,
-         * and the attributes are simply excluded rather than throwing a NoPermission exception
-         *
-         * TODO: This is currently only needed because of the posts model and the contributor role. Once we extend the
-         * contributor role to be able to edit existing tags, this concept can be removed.
-         */
-        if (result && result.excludedAttrs && _.has(frame, `data.[${apiConfig.docName}][0]`)) {
-            frame.data[apiConfig.docName][0] = _.omit(frame.data[apiConfig.docName][0], result.excludedAttrs);
-        }
-    }).catch((err) => {
-        if (err instanceof errors.NoPermissionError) {
-            err.message = tpl(messages.noPermissionToCall, {
-                method: apiConfig.method,
-                docName: apiConfig.docName
-            });
-            return Promise.reject(err);
-        }
-
-        if (errors.utils.isGhostError(err)) {
-            return Promise.reject(err);
-        }
-
-        return Promise.reject(new errors.InternalServerError({
-            err: err
-        }));
-    });
-};
-
-// @TODO: https://github.com/TryGhost/Ghost/issues/10735
-module.exports = {
-    /**
-     * @description Handle permission stage for API version v2.
-     *
-     * @param {Object} apiConfig - Docname & method of target ctrl.
-     * @param {Object} frame
-     * @return {Promise}
-     */
-    handle(apiConfig, frame) {
-        debug('handle');
-
-        // @TODO: https://github.com/TryGhost/Ghost/issues/10099
-        frame.options.context = permissions.parseContext(frame.options.context);
-
-        // CASE: Content API access
-        if (frame.options.context.public) {
-            debug('check content permissions');
-
-            // @TODO: Remove when we drop v0.1
-            // @TODO: https://github.com/TryGhost/Ghost/issues/10733
-            return permissions.applyPublicRules(apiConfig.docName, apiConfig.method, {
-                status: frame.options.status,
-                id: frame.options.id,
-                uuid: frame.options.uuid,
-                slug: frame.options.slug,
-                data: {
-                    status: frame.data.status,
-                    id: frame.data.id,
-                    uuid: frame.data.uuid,
-                    slug: frame.data.slug
-                }
-            });
-        }
-
-        return nonePublicAuth(apiConfig, frame);
-    }
-};

package/core/server/api/v2/utils/serializers/index.js

@@ -1,9 +0,0 @@
-module.exports = {
-    get input() {
-        return require('./input');
-    },
-
-    get output() {
-        return require('./output');
-    }
-};

package/core/server/api/v2/utils/serializers/input/db.js

@@ -1,20 +0,0 @@
-const _ = require('lodash');
-const debug = require('@tryghost/debug')('api:v2:utils:serializers:input:db');
-const optionsUtil = require('../../../../shared/utils/options');
-
-const INTERNAL_OPTIONS = ['transacting', 'forUpdate'];
-
-module.exports = {
-    all(apiConfig, frame) {
-        debug('serialize all');
-
-        if (frame.options.include) {
-            frame.options.include = optionsUtil.trimAndLowerCase(frame.options.include);
-        }
-
-        if (!frame.options.context.internal) {
-            debug('omit internal options');
-            frame.options = _.omit(frame.options, INTERNAL_OPTIONS);
-        }
-    }
-};

package/core/server/api/v2/utils/serializers/input/index.js

@@ -1,33 +0,0 @@
-module.exports = {
-    get db() {
-        return require('./db');
-    },
-
-    get integrations() {
-        return require('./integrations');
-    },
-
-    get pages() {
-        return require('./pages');
-    },
-
-    get posts() {
-        return require('./posts');
-    },
-
-    get settings() {
-        return require('./settings');
-    },
-
-    get users() {
-        return require('./users');
-    },
-
-    get tags() {
-        return require('./tags');
-    },
-
-    get webhooks() {
-        return require('./webhooks');
-    }
-};

package/core/server/api/v2/utils/serializers/input/integrations.js

@@ -1,33 +0,0 @@
-const _ = require('lodash');
-const debug = require('@tryghost/debug')('api:v2:utils:serializers:input:integrations');
-
-function setDefaultFilter(frame) {
-    if (frame.options.filter) {
-        frame.options.filter = `(${frame.options.filter})+type:[custom,builtin]`;
-    } else {
-        frame.options.filter = 'type:[custom,builtin]';
-    }
-}
-
-module.exports = {
-    browse(apiConfig, frame) {
-        debug('browse');
-
-        setDefaultFilter(frame);
-    },
-    read(apiConfig, frame) {
-        debug('read');
-
-        setDefaultFilter(frame);
-    },
-    add(apiConfig, frame) {
-        debug('add');
-
-        frame.data = _.pick(frame.data.integrations[0], apiConfig.data);
-    },
-    edit(apiConfig, frame) {
-        debug('edit');
-
-        frame.data = _.pick(frame.data.integrations[0], apiConfig.data);
-    }
-};

package/core/server/api/v2/utils/serializers/input/pages.js

@@ -1,203 +0,0 @@
-const _ = require('lodash');
-const mapNQLKeyValues = require('@tryghost/nql').utils.mapKeyValues;
-const debug = require('@tryghost/debug')('api:v2:utils:serializers:input:pages');
-const mobiledoc = require('../../../../../lib/mobiledoc');
-const url = require('./utils/url');
-const localUtils = require('../../index');
-const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
-
-const replacePageWithType = mapNQLKeyValues({
-    key: {
-        from: 'page',
-        to: 'type'
-    },
-    values: [{
-        from: false,
-        to: 'post'
-    }, {
-        from: true,
-        to: 'page'
-    }]
-});
-
-function removeMobiledocFormat(frame) {
-    if (frame.options.formats && frame.options.formats.includes('mobiledoc')) {
-        frame.options.formats = frame.options.formats.filter((format) => {
-            return (format !== 'mobiledoc');
-        });
-    }
-}
-
-function defaultRelations(frame) {
-    if (frame.options.withRelated) {
-        return;
-    }
-
-    if (frame.options.columns && !frame.options.withRelated) {
-        return false;
-    }
-
-    frame.options.withRelated = ['tags', 'authors', 'authors.roles'];
-}
-
-function setDefaultOrder(frame) {
-    let includesOrderedRelations = false;
-
-    if (frame.options.withRelated) {
-        const orderedRelations = ['author', 'authors', 'tag', 'tags'];
-        includesOrderedRelations = _.intersection(orderedRelations, frame.options.withRelated).length > 0;
-    }
-
-    if (!frame.options.order && !includesOrderedRelations) {
-        frame.options.order = 'title asc';
-    }
-}
-
-function forceVisibilityColumn(frame) {
-    if (frame.options.columns && !frame.options.columns.includes('visibility')) {
-        frame.options.columns.push('visibility');
-    }
-}
-
-function defaultFormat(frame) {
-    if (frame.options.formats) {
-        return;
-    }
-
-    frame.options.formats = 'mobiledoc';
-}
-
-function handlePostsMeta(frame) {
-    let metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
-    let meta = _.pick(frame.data.pages[0], metaAttrs);
-    frame.data.pages[0].posts_meta = meta;
-}
-
-/**
- * CASE:
- *
- * - the content api endpoints for pages forces the model layer to return static pages only
- * - we have to enforce the filter
- *
- * @TODO: https://github.com/TryGhost/Ghost/issues/10268
- */
-const forcePageFilter = (frame) => {
-    if (frame.options.filter) {
-        frame.options.filter = `(${frame.options.filter})+type:page`;
-    } else {
-        frame.options.filter = 'type:page';
-    }
-};
-
-const forceStatusFilter = (frame) => {
-    if (!frame.options.filter) {
-        frame.options.filter = 'status:[draft,published,scheduled]';
-    } else if (!frame.options.filter.match(/status:/)) {
-        frame.options.filter = `(${frame.options.filter})+status:[draft,published,scheduled]`;
-    }
-};
-
-module.exports = {
-    browse(apiConfig, frame) {
-        debug('browse');
-
-        forcePageFilter(frame);
-
-        if (localUtils.isContentAPI(frame)) {
-            removeMobiledocFormat(frame);
-            setDefaultOrder(frame);
-            forceVisibilityColumn(frame);
-        }
-
-        if (!localUtils.isContentAPI(frame)) {
-            forceStatusFilter(frame);
-            defaultFormat(frame);
-            defaultRelations(frame);
-        }
-
-        frame.options.mongoTransformer = replacePageWithType;
-    },
-
-    read(apiConfig, frame) {
-        debug('read');
-
-        forcePageFilter(frame);
-
-        if (localUtils.isContentAPI(frame)) {
-            removeMobiledocFormat(frame);
-            setDefaultOrder(frame);
-            forceVisibilityColumn(frame);
-        }
-
-        if (!localUtils.isContentAPI(frame)) {
-            forceStatusFilter(frame);
-            defaultFormat(frame);
-            defaultRelations(frame);
-        }
-    },
-
-    add(apiConfig, frame, options = {add: true}) {
-        debug('add');
-
-        if (_.get(frame,'options.source')) {
-            const html = frame.data.pages[0].html;
-
-            if (frame.options.source === 'html' && !_.isEmpty(html)) {
-                frame.data.pages[0].mobiledoc = JSON.stringify(mobiledoc.htmlToMobiledocConverter(html));
-            }
-        }
-
-        frame.data.pages[0] = url.forPost(Object.assign({}, frame.data.pages[0]), frame.options);
-
-        // @NOTE: force storing page
-        if (options.add) {
-            frame.data.pages[0].type = 'page';
-        }
-
-        // CASE: Transform short to long format
-        if (frame.data.pages[0].authors) {
-            frame.data.pages[0].authors.forEach((author, index) => {
-                if (_.isString(author)) {
-                    frame.data.pages[0].authors[index] = {
-                        email: author
-                    };
-                }
-            });
-        }
-
-        if (frame.data.pages[0].tags) {
-            frame.data.pages[0].tags.forEach((tag, index) => {
-                if (_.isString(tag)) {
-                    frame.data.pages[0].tags[index] = {
-                        name: tag
-                    };
-                }
-            });
-        }
-
-        handlePostsMeta(frame);
-        defaultFormat(frame);
-        defaultRelations(frame);
-    },
-
-    edit(apiConfig, frame) {
-        debug('edit');
-
-        this.add(...arguments, {add: false});
-
-        handlePostsMeta(frame);
-        forceStatusFilter(frame);
-        forcePageFilter(frame);
-    },
-
-    destroy(apiConfig, frame) {
-        debug('destroy');
-        frame.options.destroyBy = {
-            id: frame.options.id,
-            type: 'page'
-        };
-
-        defaultFormat(frame);
-        defaultRelations(frame);
-    }
-};

package/core/server/api/v2/utils/serializers/input/posts.js

@@ -1,218 +0,0 @@
-const _ = require('lodash');
-const mapNQLKeyValues = require('@tryghost/nql').utils.mapKeyValues;
-const debug = require('@tryghost/debug')('api:v2:utils:serializers:input:posts');
-const url = require('./utils/url');
-const localUtils = require('../../index');
-const mobiledoc = require('../../../../../lib/mobiledoc');
-const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
-
-const replacePageWithType = mapNQLKeyValues({
-    key: {
-        from: 'page',
-        to: 'type'
-    },
-    values: [{
-        from: false,
-        to: 'post'
-    }, {
-        from: true,
-        to: 'page'
-    }]
-});
-
-function removeMobiledocFormat(frame) {
-    if (frame.options.formats && frame.options.formats.includes('mobiledoc')) {
-        frame.options.formats = frame.options.formats.filter((format) => {
-            return (format !== 'mobiledoc');
-        });
-    }
-}
-
-function defaultRelations(frame) {
-    if (frame.options.withRelated) {
-        return;
-    }
-
-    if (frame.options.columns && !frame.options.withRelated) {
-        return false;
-    }
-
-    frame.options.withRelated = ['tags', 'authors', 'authors.roles'];
-}
-
-function setDefaultOrder(frame) {
-    let includesOrderedRelations = false;
-
-    if (frame.options.withRelated) {
-        const orderedRelations = ['author', 'authors', 'tag', 'tags'];
-        includesOrderedRelations = _.intersection(orderedRelations, frame.options.withRelated).length > 0;
-    }
-
-    if (!frame.options.order && !includesOrderedRelations) {
-        frame.options.order = 'published_at desc';
-    }
-}
-
-function forceVisibilityColumn(frame) {
-    if (frame.options.columns && !frame.options.columns.includes('visibility')) {
-        frame.options.columns.push('visibility');
-    }
-}
-
-function defaultFormat(frame) {
-    if (frame.options.formats) {
-        return;
-    }
-
-    frame.options.formats = 'mobiledoc';
-}
-
-function handlePostsMeta(frame) {
-    let metaAttrs = _.keys(_.omit(postsMetaSchema, ['id', 'post_id']));
-    let meta = _.pick(frame.data.posts[0], metaAttrs);
-    frame.data.posts[0].posts_meta = meta;
-}
-
-/**
- * CASE:
- *
- * - posts endpoint only returns posts, not pages
- * - we have to enforce the filter
- *
- * @TODO: https://github.com/TryGhost/Ghost/issues/10268
- */
-const forcePageFilter = (frame) => {
-    if (frame.options.filter) {
-        frame.options.filter = `(${frame.options.filter})+type:post`;
-    } else {
-        frame.options.filter = 'type:post';
-    }
-};
-
-const forceStatusFilter = (frame) => {
-    if (!frame.options.filter) {
-        frame.options.filter = 'status:[draft,published,scheduled]';
-    } else if (!frame.options.filter.match(/status:/)) {
-        frame.options.filter = `(${frame.options.filter})+status:[draft,published,scheduled]`;
-    }
-};
-
-module.exports = {
-    browse(apiConfig, frame) {
-        debug('browse');
-
-        forcePageFilter(frame);
-
-        /**
-         * ## current cases:
-         * - context object is empty (functional call, content api access)
-         * - api_key.type == 'content' ? content api access
-         * - user exists? admin api access
-         */
-        if (localUtils.isContentAPI(frame)) {
-            // CASE: the content api endpoint for posts should not return mobiledoc
-            removeMobiledocFormat(frame);
-
-            setDefaultOrder(frame);
-            forceVisibilityColumn(frame);
-        }
-
-        if (!localUtils.isContentAPI(frame)) {
-            forceStatusFilter(frame);
-            defaultFormat(frame);
-            defaultRelations(frame);
-        }
-
-        frame.options.mongoTransformer = replacePageWithType;
-    },
-
-    read(apiConfig, frame) {
-        debug('read');
-
-        forcePageFilter(frame);
-
-        /**
-         * ## current cases:
-         * - context object is empty (functional call, content api access)
-         * - api_key.type == 'content' ? content api access
-         * - user exists? admin api access
-         */
-        if (localUtils.isContentAPI(frame)) {
-            // CASE: the content api endpoint for posts should not return mobiledoc
-            removeMobiledocFormat(frame);
-
-            setDefaultOrder(frame);
-            forceVisibilityColumn(frame);
-        }
-
-        if (!localUtils.isContentAPI(frame)) {
-            forceStatusFilter(frame);
-            defaultFormat(frame);
-            defaultRelations(frame);
-        }
-    },
-
-    add(apiConfig, frame, options = {add: true}) {
-        debug('add');
-
-        if (_.get(frame,'options.source')) {
-            const html = frame.data.posts[0].html;
-
-            if (frame.options.source === 'html' && !_.isEmpty(html)) {
-                frame.data.posts[0].mobiledoc = JSON.stringify(mobiledoc.htmlToMobiledocConverter(html));
-            }
-        }
-
-        frame.data.posts[0] = url.forPost(Object.assign({}, frame.data.posts[0]), frame.options);
-
-        // @NOTE: force adding post
-        if (options.add) {
-            frame.data.posts[0].type = 'post';
-        }
-
-        // CASE: Transform short to long format
-        if (frame.data.posts[0].authors) {
-            frame.data.posts[0].authors.forEach((author, index) => {
-                if (_.isString(author)) {
-                    frame.data.posts[0].authors[index] = {
-                        email: author
-                    };
-                }
-            });
-        }
-
-        if (frame.data.posts[0].tags) {
-            frame.data.posts[0].tags.forEach((tag, index) => {
-                if (_.isString(tag)) {
-                    frame.data.posts[0].tags[index] = {
-                        name: tag
-                    };
-                }
-            });
-        }
-
-        handlePostsMeta(frame);
-        defaultFormat(frame);
-        defaultRelations(frame);
-    },
-
-    edit(apiConfig, frame) {
-        debug('edit');
-        this.add(apiConfig, frame, {add: false});
-
-        handlePostsMeta(frame);
-        forceStatusFilter(frame);
-        forcePageFilter(frame);
-    },
-
-    destroy(apiConfig, frame) {
-        debug('destroy');
-        frame.options.destroyBy = {
-            id: frame.options.id,
-            type: 'post'
-        };
-
-        defaultFormat(frame);
-        defaultRelations(frame);
-    }
-};