ghost 4.48.0 → 5.0.2

package/core/server/api/canary/utils/serializers/output/products.js

@@ -1,213 +0,0 @@
-//@ts-check
-const debug = require('@tryghost/debug')('api:canary:utils:serializers:output:products');
-const _ = require('lodash');
-const utils = require('../../../../shared/utils');
-
-const allowedIncludes = ['stripe_prices', 'monthly_price', 'yearly_price'];
-
-module.exports = {
-    browse: createSerializer('browse', paginatedProducts),
-    read: createSerializer('read', singleProduct),
-    edit: createSerializer('edit', singleProduct),
-    add: createSerializer('add', singleProduct)
-};
-
-/**
- * @template PageMeta
- *
- * @param {{data: import('bookshelf').Model[], meta: PageMeta}} page
- * @param {APIConfig} _apiConfig
- * @param {Frame} frame
- *
- * @returns {{products: SerializedProduct[], meta: PageMeta}}
- */
-function paginatedProducts(page, _apiConfig, frame) {
-    const requestedQueryIncludes = frame.original && frame.original.query && frame.original.query.include && frame.original.query.include.split(',') || [];
-    const requestedOptionsIncludes = utils.options.trimAndLowerCase(frame.original && frame.original.options && frame.original.options.include || []);
-    return {
-        products: page.data.map((model) => {
-            return cleanIncludes(
-                allowedIncludes,
-                requestedQueryIncludes.concat(requestedOptionsIncludes),
-                serializeProduct(model, frame.options, frame.apiType)
-            );
-        }),
-        meta: page.meta
-    };
-}
-
-/**
- * @param {import('bookshelf').Model} model
- * @param {APIConfig} _apiConfig
- * @param {Frame} frame
- *
- * @returns {{products: SerializedProduct[]}}
- */
-function singleProduct(model, _apiConfig, frame) {
-    const requestedQueryIncludes = frame.original && frame.original.query && frame.original.query.include && frame.original.query.include.split(',') || [];
-    const requestedOptionsIncludes = frame.original && frame.original.options && frame.original.options.include || [];
-    return {
-        products: [
-            cleanIncludes(
-                allowedIncludes,
-                requestedQueryIncludes.concat(requestedOptionsIncludes),
-                serializeProduct(model, frame.options, frame.apiType)
-            )
-        ]
-    };
-}
-
-/**
- * @param {import('bookshelf').Model} product
- * @param {object} options
- * @param {'content'|'admin'} apiType
- *
- * @returns {SerializedProduct}
- */
-function serializeProduct(product, options, apiType) {
-    const json = product.toJSON(options);
-
-    const hideStripeData = apiType === 'content';
-
-    const serialized = {
-        id: json.id,
-        name: json.name,
-        description: json.description,
-        slug: json.slug,
-        active: json.active,
-        visibility: json.visibility,
-        type: json.type,
-        welcome_page_url: json.welcome_page_url,
-        created_at: json.created_at,
-        updated_at: json.updated_at,
-        stripe_prices: json.stripePrices ? json.stripePrices.map(price => serializeStripePrice(price, hideStripeData)) : null,
-        monthly_price: serializeStripePrice(json.monthlyPrice, hideStripeData),
-        yearly_price: serializeStripePrice(json.yearlyPrice, hideStripeData),
-        benefits: json.benefits || null
-    };
-
-    return serialized;
-}
-
-/**
- * @param {object} data
- * @param {boolean} hideStripeData
- *
- * @returns {StripePrice}
- */
-function serializeStripePrice(data, hideStripeData) {
-    if (_.isEmpty(data)) {
-        return null;
-    }
-    const price = {
-        id: data.id,
-        stripe_product_id: data.stripe_product_id,
-        stripe_price_id: data.stripe_price_id,
-        active: data.active,
-        nickname: data.nickname,
-        description: data.description,
-        currency: data.currency,
-        amount: data.amount,
-        type: data.type,
-        interval: data.interval,
-        created_at: data.created_at,
-        updated_at: data.updated_at
-    };
-
-    if (hideStripeData) {
-        delete price.stripe_price_id;
-        delete price.stripe_product_id;
-    }
-
-    return price;
-}
-
-/**
- * @template Data
- *
- * @param {string[]} allowed
- * @param {string[]} requested
- * @param {Data & Object<string, any>} data
- *
- * @returns {Data}
- */
-function cleanIncludes(allowed, requested, data) {
-    const cleaned = {
-        ...data
-    };
-    for (const include of allowed) {
-        if (!requested.includes(include)) {
-            delete cleaned[include];
-        }
-    }
-    return cleaned;
-}
-
-/**
- * @template Data
- * @template Response
- * @param {string} debugString
- * @param {(data: Data, apiConfig: APIConfig, frame: Frame) => Response} serialize - A function to serialize the data into an object suitable for API response
- *
- * @returns {(data: Data, apiConfig: APIConfig, frame: Frame) => void}
- */
-function createSerializer(debugString, serialize) {
-    return function serializer(data, apiConfig, frame) {
-        debug(debugString);
-        const response = serialize(data, apiConfig, frame);
-        frame.response = response;
-    };
-}
-
-/**
- * @typedef {Object} SerializedProduct
- * @prop {string} id
- * @prop {string} name
- * @prop {string} slug
- * @prop {string} description
- * @prop {boolean} active
- * @prop {string} type
- * @prop {string} welcome_page_url
- * @prop {Date} created_at
- * @prop {Date} updated_at
- * @prop {StripePrice[]} [stripe_prices]
- * @prop {StripePrice} [monthly_price]
- * @prop {StripePrice} [yearly_price]
- * @prop {Benefit[]} [benefits]
- */
-
-/**
- * @typedef {object} Benefit
- * @prop {string} id
- * @prop {string} name
- * @prop {string} slug
- * @prop {Date} created_at
- * @prop {Date} updated_at
- */
-
-/**
- * @typedef {object} StripePrice
- * @prop {string} id
- * @prop {string|null} stripe_product_id
- * @prop {string|null} stripe_price_id
- * @prop {boolean} active
- * @prop {string} nickname
- * @prop {string} description
- * @prop {string} currency
- * @prop {number} amount
- * @prop {'recurring'|'one-time'} type
- * @prop {'day'|'week'|'month'|'year'} interval
- * @prop {Date} created_at
- * @prop {Date} updated_at
- */
-
-/**
- * @typedef {Object} APIConfig
- * @prop {string} docName
- * @prop {string} method
- */
-
-/**
- * @typedef {Object<string, any>} Frame
- * @prop {Object} options
- */

package/core/server/api/v2/actions.js

@@ -1,38 +0,0 @@
-const models = require('../../models');
-
-module.exports = {
-    docName: 'actions',
-
-    browse: {
-        options: [
-            'page',
-            'limit',
-            'fields'
-        ],
-        data: [
-            'id',
-            'type'
-        ],
-        validation: {
-            id: {
-                required: true
-            },
-            type: {
-                required: true,
-                values: ['resource', 'actor']
-            }
-        },
-        permissions: true,
-        query(frame) {
-            if (frame.data.type === 'resource') {
-                frame.options.withRelated = ['actor'];
-                frame.options.filter = `resource_id:${frame.data.id}`;
-            } else {
-                frame.options.withRelated = ['resource'];
-                frame.options.filter = `actor_id:${frame.data.id}`;
-            }
-
-            return models.Action.findPage(frame.options);
-        }
-    }
-};

package/core/server/api/v2/authentication.js

@@ -1,191 +0,0 @@
-const api = require('./index');
-const config = require('../../../shared/config');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const web = require('../../web');
-const models = require('../../models');
-const auth = require('../../services/auth');
-const invitations = require('../../services/invitations');
-
-const messages = {
-    notTheBlogOwner: 'You are not the site owner.'
-};
-
-module.exports = {
-    docName: 'authentication',
-
-    setup: {
-        statusCode: 201,
-        permissions: false,
-        validation: {
-            docName: 'setup'
-        },
-        query(frame) {
-            return Promise.resolve()
-                .then(() => {
-                    return auth.setup.assertSetupCompleted(false)();
-                })
-                .then(() => {
-                    const setupDetails = {
-                        name: frame.data.setup[0].name,
-                        email: frame.data.setup[0].email,
-                        password: frame.data.setup[0].password,
-                        blogTitle: frame.data.setup[0].blogTitle,
-                        status: 'active'
-                    };
-
-                    return auth.setup.setupUser(setupDetails);
-                })
-                .then((data) => {
-                    return auth.setup.doSettings(data, api.settings);
-                })
-                .then((user) => {
-                    return auth.setup.sendWelcomeEmail(user.get('email'), api.mail)
-                        .then(() => user);
-                });
-        }
-    },
-
-    updateSetup: {
-        permissions: (frame) => {
-            return models.User.findOne({role: 'Owner', status: 'all'})
-                .then((owner) => {
-                    if (owner.id !== frame.options.context.user) {
-                        throw new errors.NoPermissionError({
-                            message: tpl(messages.notTheBlogOwner)
-                        });
-                    }
-                });
-        },
-        validation: {
-            docName: 'setup'
-        },
-        query(frame) {
-            return Promise.resolve()
-                .then(() => {
-                    return auth.setup.assertSetupCompleted(true)();
-                })
-                .then(() => {
-                    const setupDetails = {
-                        name: frame.data.setup[0].name,
-                        email: frame.data.setup[0].email,
-                        password: frame.data.setup[0].password,
-                        blogTitle: frame.data.setup[0].blogTitle,
-                        status: 'active'
-                    };
-
-                    return auth.setup.setupUser(setupDetails);
-                })
-                .then((data) => {
-                    return auth.setup.doSettings(data, api.settings);
-                });
-        }
-    },
-
-    isSetup: {
-        permissions: false,
-        async query() {
-            const isSetup = await auth.setup.checkIsSetup();
-
-            return {
-                status: isSetup,
-                title: config.title,
-                name: config.user_name,
-                email: config.user_email
-            };
-        }
-    },
-
-    generateResetToken: {
-        validation: {
-            docName: 'passwordreset'
-        },
-        permissions: true,
-        options: [
-            'email'
-        ],
-        query(frame) {
-            return Promise.resolve()
-                .then(() => {
-                    return auth.setup.assertSetupCompleted(true)();
-                })
-                .then(() => {
-                    return auth.passwordreset.generateToken(frame.data.passwordreset[0].email, api.settings);
-                })
-                .then((token) => {
-                    return auth.passwordreset.sendResetNotification(token, api.mail);
-                });
-        }
-    },
-
-    resetPassword: {
-        validation: {
-            docName: 'passwordreset',
-            data: {
-                newPassword: {required: true},
-                ne2Password: {required: true}
-            }
-        },
-        permissions: false,
-        options: [
-            'ip'
-        ],
-        query(frame) {
-            return Promise.resolve()
-                .then(() => {
-                    return auth.setup.assertSetupCompleted(true)();
-                })
-                .then(() => {
-                    return auth.passwordreset.extractTokenParts(frame);
-                })
-                .then((params) => {
-                    return auth.passwordreset.protectBruteForce(params);
-                })
-                .then(({options, tokenParts}) => {
-                    options = Object.assign(options, {context: {internal: true}});
-                    return auth.passwordreset.doReset(options, tokenParts, api.settings)
-                        .then((params) => {
-                            web.shared.middleware.api.spamPrevention.userLogin().reset(frame.options.ip, `${tokenParts.email}login`);
-                            return params;
-                        });
-                });
-        }
-    },
-
-    acceptInvitation: {
-        validation: {
-            docName: 'invitations'
-        },
-        permissions: false,
-        query(frame) {
-            return Promise.resolve()
-                .then(() => {
-                    return auth.setup.assertSetupCompleted(true)();
-                })
-                .then(() => {
-                    return invitations.accept(frame.data);
-                });
-        }
-    },
-
-    isInvitation: {
-        data: [
-            'email'
-        ],
-        validation: {
-            docName: 'invitations'
-        },
-        permissions: false,
-        query(frame) {
-            return Promise.resolve()
-                .then(() => {
-                    return auth.setup.assertSetupCompleted(true)();
-                })
-                .then(() => {
-                    const email = frame.data.email;
-
-                    return models.Invite.findOne({email: email, status: 'sent'}, frame.options);
-                });
-        }
-    }
-};

package/core/server/api/v2/authors-public.js

@@ -1,69 +0,0 @@
-const Promise = require('bluebird');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-const ALLOWED_INCLUDES = ['count.posts'];
-
-const messages = {
-    authorsNotFound: 'Author not found.'
-};
-
-module.exports = {
-    docName: 'authors',
-
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'limit',
-            'order',
-            'page'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Author.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'filter',
-            'fields'
-        ],
-        data: [
-            'id',
-            'slug',
-            'email',
-            'role'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Author.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.authorsNotFound)
-                        }));
-                    }
-
-                    return model;
-                });
-        }
-    }
-};

package/core/server/api/v2/config.js

@@ -1,12 +0,0 @@
-const publicConfig = require('../../services/public-config');
-
-module.exports = {
-    docName: 'config',
-
-    read: {
-        permissions: false,
-        query() {
-            return publicConfig.config;
-        }
-    }
-};

package/core/server/api/v2/db.js

@@ -1,120 +0,0 @@
-const Promise = require('bluebird');
-const dbBackup = require('../../data/db/backup');
-const exporter = require('../../data/exporter');
-const importer = require('../../data/importer');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-
-module.exports = {
-    docName: 'db',
-
-    backupContent: {
-        permissions: true,
-        options: [
-            'include',
-            'filename'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: exporter.BACKUP_TABLES
-                }
-            }
-        },
-        query(frame) {
-            // NOTE: we need to have `include` property available as backupDatabase uses it internally
-            Object.assign(frame.options, {include: frame.options.withRelated});
-
-            return dbBackup.backup(frame.options);
-        }
-    },
-
-    exportContent: {
-        options: [
-            'include'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: exporter.BACKUP_TABLES
-                }
-            }
-        },
-        headers: {
-            disposition: {
-                type: 'file',
-                value: () => (exporter.fileName())
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return Promise.resolve()
-                .then(() => exporter.doExport({include: frame.options.withRelated}))
-                .catch((err) => {
-                    return Promise.reject(new errors.InternalServerError({err: err}));
-                });
-        }
-    },
-
-    importContent: {
-        options: [
-            'include'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: exporter.BACKUP_TABLES
-                }
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return importer.importFromFile(frame.file, {include: frame.options.withRelated});
-        }
-    },
-
-    deleteAllContent: {
-        statusCode: 204,
-        permissions: true,
-        query() {
-            /**
-             * @NOTE:
-             * We fetch all posts with `columns:id` to increase the speed of this endpoint.
-             * And if you trigger `post.destroy(..)`, this will trigger bookshelf and model events.
-             * But we only have to `id` available in the model. This won't work, because:
-             *   - model layer can't trigger event e.g. `post.page` to trigger `post|page.unpublished`.
-             *   - `onDestroyed` or `onDestroying` can contain custom logic
-             */
-            function deleteContent() {
-                return models.Base.transaction((transacting) => {
-                    const queryOpts = {
-                        columns: 'id',
-                        context: {internal: true},
-                        destroyAll: true,
-                        transacting: transacting
-                    };
-
-                    return models.Post.findAll(queryOpts)
-                        .then((response) => {
-                            return Promise.map(response.models, (post) => {
-                                return models.Post.destroy(Object.assign({id: post.id}, queryOpts));
-                            }, {concurrency: 100});
-                        })
-                        .then(() => models.Tag.findAll(queryOpts))
-                        .then((response) => {
-                            return Promise.map(response.models, (tag) => {
-                                return models.Tag.destroy(Object.assign({id: tag.id}, queryOpts));
-                            }, {concurrency: 100});
-                        })
-                        .catch((err) => {
-                            throw new errors.InternalServerError({
-                                err: err
-                            });
-                        });
-                });
-            }
-
-            return dbBackup.backup().then(deleteContent);
-        }
-    }
-};

package/core/server/api/v2/images.js

@@ -1,20 +0,0 @@
-const Promise = require('bluebird');
-const storage = require('../../adapters/storage');
-
-module.exports = {
-    docName: 'images',
-    upload: {
-        statusCode: 201,
-        permissions: false,
-        query(frame) {
-            const store = storage.getStorage('images');
-
-            if (frame.files) {
-                return Promise
-                    .map(frame.files, file => store.save(file))
-                    .then(paths => paths[0]);
-            }
-            return store.save(frame.file);
-        }
-    }
-};