ghost 4.48.0 → 5.0.0

package/core/server/api/v3/utils/validators/input/passwordreset.js

@@ -1,36 +0,0 @@
-const Promise = require('bluebird');
-const validator = require('@tryghost/validator');
-const debug = require('@tryghost/debug')('api:v3:utils:validators:input:passwordreset');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-
-const messages = {
-    newPasswordsDoNotMatch: 'Your new passwords do not match',
-    invalidEmailReceived: 'The server did not receive a valid email'
-};
-
-module.exports = {
-    resetPassword(apiConfig, frame) {
-        debug('resetPassword');
-
-        const data = frame.data.passwordreset[0];
-
-        if (data.newPassword !== data.ne2Password) {
-            return Promise.reject(new errors.ValidationError({
-                message: tpl(messages.newPasswordsDoNotMatch)
-            }));
-        }
-    },
-
-    generateResetToken(apiConfig, frame) {
-        debug('generateResetToken');
-
-        const email = frame.data.passwordreset[0].email;
-
-        if (typeof email !== 'string' || !validator.isEmail(email)) {
-            throw new errors.BadRequestError({
-                message: tpl(messages.invalidEmailReceived)
-            });
-        }
-    }
-};

package/core/server/api/v3/utils/validators/input/posts.js

@@ -1,46 +0,0 @@
-const jsonSchema = require('../utils/json-schema');
-const models = require('../../../../../models');
-const {ValidationError} = require('@tryghost/errors');
-const tpl = require('@tryghost/tpl');
-
-const messages = {
-    invalidVisibilityFilter: 'Invalid filter in visibility property'
-};
-
-const validateVisibility = async function (frame) {
-    if (!frame.data.posts || !frame.data.posts[0]) {
-        return Promise.resolve();
-    }
-
-    // validate visibility - not done at schema level because this can be an NQL query so needs model access
-    const visibility = frame.data.posts[0].visibility;
-    if (visibility) {
-        if (!['public', 'members', 'paid'].includes(visibility)) {
-            // check filter is valid
-            try {
-                await models.Member.findPage({filter: visibility, limit: 1});
-                return Promise.resolve();
-            } catch (err) {
-                return Promise.reject(new ValidationError({
-                    message: tpl(messages.invalidVisibilityFilter),
-                    property: 'visibility'
-                }));
-            }
-        }
-
-        return Promise.resolve();
-    }
-};
-
-module.exports = {
-    add(apiConfig, frame) {
-        return jsonSchema.validate(...arguments).then(() => {
-            return validateVisibility(frame);
-        });
-    },
-    edit(apiConfig, frame) {
-        return jsonSchema.validate(...arguments).then(() => {
-            return validateVisibility(frame);
-        });
-    }
-};

package/core/server/api/v3/utils/validators/input/settings.js

@@ -1,89 +0,0 @@
-const Promise = require('bluebird');
-const _ = require('lodash');
-const tpl = require('@tryghost/tpl');
-const {NotFoundError, ValidationError, BadRequestError} = require('@tryghost/errors');
-const validator = require('@tryghost/validator');
-
-const messages = {
-    invalidEmailReceived: 'Please send a valid email',
-    invalidEmailTypeReceived: 'Invalid email type received',
-    problemFindingSetting: 'Problem finding setting: {key}'
-};
-
-module.exports = {
-    read(apiConfig, frame) {
-        // @NOTE: was removed https://github.com/TryGhost/Ghost/issues/10373
-        if (frame.options.key === 'ghost_head' || frame.options.key === 'ghost_foot') {
-            return Promise.reject(new NotFoundError({
-                message: tpl(messages.problemFindingSetting, {
-                    key: frame.options.key
-                })
-            }));
-        }
-    },
-
-    edit(apiConfig, frame) {
-        const errors = [];
-
-        _.each(frame.data.settings, (setting) => {
-            if (setting.key === 'ghost_head' || setting.key === 'ghost_foot') {
-                // @NOTE: was removed https://github.com/TryGhost/Ghost/issues/10373
-                errors.push(new NotFoundError({
-                    message: tpl(messages.problemFindingSetting, {
-                        key: setting.key
-                    })
-                }));
-            }
-
-            // TODO: the below array is INCOMPLETE
-            //       it should include all setting values that have array as a type
-            const arrayTypeSettings = [
-                'notifications',
-                'navigation',
-                'secondary_navigation'
-            ];
-
-            if (arrayTypeSettings.includes(setting.key)) {
-                const typeError = new ValidationError({
-                    message: `Value in ${setting.key} should be an array.`,
-                    property: 'value'
-                });
-
-                // NOTE: The additional check on raw value is here because internal calls to
-                //       settings API use raw unstringified objects (e.g. when adding notifications)
-                //       The conditional can be removed once internals are changed to do the calls properly
-                //       and the JSON.parse should be left as the only valid way to check the value.
-                if (!_.isArray(setting.value)) {
-                    try {
-                        const value = JSON.parse(setting.value);
-                        if (!_.isArray(value)) {
-                            errors.push(typeError);
-                        }
-                    } catch (err) {
-                        errors.push(typeError);
-                    }
-                }
-            }
-        });
-
-        if (errors.length) {
-            return Promise.reject(errors[0]);
-        }
-    },
-
-    updateMembersEmail(apiConfig, frame) {
-        const {email, type} = frame.data;
-
-        if (typeof email !== 'string' || !validator.isEmail(email)) {
-            throw new BadRequestError({
-                message: messages.invalidEmailReceived
-            });
-        }
-
-        if (!type || !['fromAddressUpdate', 'supportAddressUpdate'].includes(type)) {
-            throw new BadRequestError({
-                message: messages.invalidEmailTypeReceived
-            });
-        }
-    }
-};

package/core/server/api/v3/utils/validators/input/setup.js

@@ -1,17 +0,0 @@
-const debug = require('@tryghost/debug')('api:v3:utils:validators:input:updateSetup');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-
-const messages = {
-    notTheBlogOwner: 'You are not the site owner.'
-};
-
-module.exports = {
-    updateSetup(apiConfig, frame) {
-        debug('resetPassword');
-
-        if (!frame.options.context || !frame.options.context.user) {
-            throw new errors.NoPermissionError({message: tpl(messages.notTheBlogOwner)});
-        }
-    }
-};

package/core/server/api/v3/utils/validators/input/snippets.js

@@ -1,6 +0,0 @@
-const jsonSchema = require('../utils/json-schema');
-
-module.exports = {
-    add: jsonSchema.validate,
-    edit: jsonSchema.validate
-};

package/core/server/api/v3/utils/validators/input/tags.js

@@ -1,6 +0,0 @@
-const jsonSchema = require('../utils/json-schema');
-
-module.exports = {
-    add: jsonSchema.validate,
-    edit: jsonSchema.validate
-};

package/core/server/api/v3/utils/validators/input/users.js

@@ -1,22 +0,0 @@
-const Promise = require('bluebird');
-const debug = require('@tryghost/debug')('api:v3:utils:validators:input:users');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-
-const messages = {
-    newPasswordsDoNotMatch: 'Your new passwords do not match'
-};
-
-module.exports = {
-    changePassword(apiConfig, frame) {
-        debug('changePassword');
-
-        const data = frame.data.password[0];
-
-        if (data.newPassword !== data.ne2Password) {
-            return Promise.reject(new errors.ValidationError({
-                message: tpl(messages.newPasswordsDoNotMatch)
-            }));
-        }
-    }
-};

package/core/server/api/v3/utils/validators/input/webhooks.js

@@ -1,27 +0,0 @@
-const _ = require('lodash');
-const errors = require('@tryghost/errors');
-const tpl = require('@tryghost/tpl');
-const jsonSchema = require('../utils/json-schema');
-
-const messages = {
-    schemaValidationFailed: 'Validation failed for \'{key}\'.',
-    noIntegrationIdProvidedContext: 'You may only create webhooks with \'integration_id\' when using session authentication.'
-};
-
-module.exports = {
-    add(apiConfig, frame) {
-        if (!_.get(frame, 'options.context.integration.id') && !_.get(frame.data, 'webhooks[0].integration_id')) {
-            return Promise.reject(new errors.ValidationError({
-                message: tpl(messages.schemaValidationFailed, {
-                    key: 'integration_id'
-                }),
-                context: tpl(messages.noIntegrationIdProvidedContext),
-                property: 'integration_id'
-            }));
-        }
-
-        return jsonSchema.validate(apiConfig, frame);
-    },
-
-    edit: jsonSchema.validate
-};

package/core/server/api/v3/utils/validators/output/index.js

@@ -1 +0,0 @@
-module.exports = {};

package/core/server/api/v3/utils/validators/utils/json-schema.js

@@ -1,17 +0,0 @@
-const jsonSchema = require('@tryghost/admin-api-schema');
-
-/**
- *
- * @param {Object} apiConfig "frame" api configuration object
- * @param {string} apiConfig.docName the name of the resource
- * @param {string} apiConfig.method API's method name
- * @param {Object} frame "frame" object with data attached to it
- * @param {Object} frame.data request data to validate
- */
-const validate = async (apiConfig, frame) => await jsonSchema.validate({
-    data: frame.data,
-    schema: `${apiConfig.docName}-${apiConfig.method}`,
-    version: 'v3'
-});
-
-module.exports.validate = validate;

package/core/server/api/v3/webhooks.js

@@ -1,130 +0,0 @@
-const models = require('../../models');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const getWebhooksServiceInstance = require('../../services/webhooks/webhooks-service');
-
-const messages = {
-    resourceNotFound: '{resource} not found.',
-    noPermissionToEdit: {
-        message: 'You do not have permission to {method} this webhook.',
-        context: 'You may only {method} webhooks that belong to the authenticated integration. Check the supplied Admin API Key.'
-    }
-};
-
-const webhooksService = getWebhooksServiceInstance({
-    WebhookModel: models.Webhook
-});
-
-module.exports = {
-    docName: 'webhooks',
-
-    add: {
-        statusCode: 201,
-        headers: {
-            // NOTE: remove if there is ever a 'read' method
-            location: false
-        },
-        options: [],
-        data: [],
-        permissions: true,
-        async query(frame) {
-            return await webhooksService.add(frame.data, frame.options);
-        }
-    },
-
-    edit: {
-        permissions: {
-            before: (frame) => {
-                if (frame.options.context && frame.options.context.integration && frame.options.context.integration.id) {
-                    return models.Webhook.findOne({id: frame.options.id})
-                        .then((webhook) => {
-                            if (!webhook) {
-                                throw new errors.NotFoundError({
-                                    message: tpl(messages.resourceNotFound, {resource: 'Webhook'})
-                                });
-                            }
-
-                            if (webhook.get('integration_id') !== frame.options.context.integration.id) {
-                                throw new errors.NoPermissionError({
-                                    message: tpl(messages.noPermissionToEdit.message, {method: 'edit'}),
-                                    context: tpl(messages.noPermissionToEdit.context, {method: 'edit'})
-                                });
-                            }
-                        });
-                }
-            }
-        },
-        data: [
-            'name',
-            'event',
-            'target_url',
-            'secret',
-            'api_version'
-        ],
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        query({data, options}) {
-            return models.Webhook.edit(data.webhooks[0], Object.assign(options, {require: true}))
-                .catch(models.Webhook.NotFoundError, () => {
-                    throw new errors.NotFoundError({
-                        message: tpl(messages.resourceNotFound, {resource: 'Webhook'})
-                    });
-                });
-        }
-    },
-
-    destroy: {
-        statusCode: 204,
-        headers: {},
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            before: (frame) => {
-                if (frame.options.context && frame.options.context.integration && frame.options.context.integration.id) {
-                    return models.Webhook.findOne({id: frame.options.id})
-                        .then((webhook) => {
-                            if (!webhook) {
-                                throw new errors.NotFoundError({
-                                    message: tpl(messages.resourceNotFound, {resource: 'Webhook'})
-                                });
-                            }
-
-                            if (webhook.get('integration_id') !== frame.options.context.integration.id) {
-                                throw new errors.NoPermissionError({
-                                    message: tpl(messages.noPermissionToEdit.message, {method: 'destroy'}),
-                                    context: tpl(messages.noPermissionToEdit.context, {method: 'destroy'})
-                                });
-                            }
-                        });
-                }
-            }
-        },
-        query(frame) {
-            frame.options.require = true;
-
-            return models.Webhook.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Webhook.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.resourceNotFound, {resource: 'Webhook'})
-                    }));
-                });
-        }
-    }
-};