ghost 4.48.0 → 5.0.2

package/core/server/api/v2/posts.js

@@ -1,192 +0,0 @@
-const models = require('../../models');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const getPostServiceInstance = require('../../services/posts/posts-service');
-const allowedIncludes = ['tags', 'authors', 'authors.roles'];
-const unsafeAttrs = ['status', 'authors', 'visibility'];
-
-const messages = {
-    postNotFound: 'Post not found.'
-};
-
-const postsService = getPostServiceInstance('v2');
-
-module.exports = {
-    docName: 'posts',
-    browse: {
-        options: [
-            'include',
-            'filter',
-            'fields',
-            'formats',
-            'limit',
-            'order',
-            'page',
-            'debug',
-            'absolute_urls'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: {
-            unsafeAttrs: unsafeAttrs
-        },
-        query(frame) {
-            return models.Post.findPage(frame.options);
-        }
-    },
-
-    read: {
-        options: [
-            'include',
-            'fields',
-            'formats',
-            'debug',
-            'absolute_urls',
-            // NOTE: only for internal context
-            'forUpdate',
-            'transacting'
-        ],
-        data: [
-            'id',
-            'slug',
-            'uuid'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                formats: {
-                    values: models.Post.allowedFormats
-                }
-            }
-        },
-        permissions: {
-            unsafeAttrs: unsafeAttrs
-        },
-        query(frame) {
-            return models.Post.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        throw new errors.NotFoundError({
-                            message: tpl(messages.postNotFound)
-                        });
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    add: {
-        statusCode: 201,
-        headers: {},
-        options: [
-            'include',
-            'source'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                source: {
-                    values: ['html']
-                }
-            }
-        },
-        permissions: {
-            unsafeAttrs: unsafeAttrs
-        },
-        query(frame) {
-            return models.Post.add(frame.data.posts[0], frame.options)
-                .then((model) => {
-                    if (model.get('status') !== 'published') {
-                        this.headers.cacheInvalidate = false;
-                    } else {
-                        this.headers.cacheInvalidate = true;
-                    }
-
-                    return model;
-                });
-        }
-    },
-
-    edit: {
-        headers: {},
-        options: [
-            'include',
-            'id',
-            'source',
-            // NOTE: only for internal context
-            'forUpdate',
-            'transacting'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                id: {
-                    required: true
-                },
-                source: {
-                    values: ['html']
-                }
-            }
-        },
-        permissions: {
-            unsafeAttrs: unsafeAttrs
-        },
-        async query(frame) {
-            const model = await models.Post.edit(frame.data.posts[0], frame.options);
-
-            this.headers.cacheInvalidate = postsService.handleCacheInvalidation(model);
-
-            return model;
-        }
-    },
-
-    destroy: {
-        statusCode: 204,
-        headers: {
-            cacheInvalidate: true
-        },
-        options: [
-            'include',
-            'id'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: allowedIncludes
-                },
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            unsafeAttrs: unsafeAttrs
-        },
-        query(frame) {
-            frame.options.require = true;
-
-            return models.Post.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Post.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.postNotFound)
-                    }));
-                });
-        }
-    }
-};

package/core/server/api/v2/preview.js

@@ -1,46 +0,0 @@
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-const ALLOWED_INCLUDES = ['authors', 'tags'];
-
-const messages = {
-    postNotFound: 'Post not found.'
-};
-
-module.exports = {
-    docName: 'preview',
-
-    read: {
-        permissions: true,
-        options: [
-            'include'
-        ],
-        data: [
-            'uuid'
-        ],
-        validation: {
-            options: {
-                include: {
-                    values: ALLOWED_INCLUDES
-                }
-            },
-            data: {
-                uuid: {
-                    required: true
-                }
-            }
-        },
-        query(frame) {
-            return models.Post.findOne(Object.assign({status: 'all'}, frame.data), frame.options)
-                .then((model) => {
-                    if (!model) {
-                        throw new errors.NotFoundError({
-                            message: tpl(messages.postNotFound)
-                        });
-                    }
-
-                    return model;
-                });
-        }
-    }
-};

package/core/server/api/v2/redirects.js

@@ -1,28 +0,0 @@
-const redirects = require('../../services/redirects');
-
-module.exports = {
-    docName: 'redirects',
-
-    download: {
-        headers: {
-            disposition: {
-                type: 'file',
-                value: 'redirects.json'
-            }
-        },
-        permissions: true,
-        query() {
-            return redirects.api.get();
-        }
-    },
-
-    upload: {
-        permissions: true,
-        headers: {
-            cacheInvalidate: true
-        },
-        query(frame) {
-            return redirects.api.setFromFilePath(frame.file.path);
-        }
-    }
-};

package/core/server/api/v2/roles.js

@@ -1,19 +0,0 @@
-const models = require('../../models');
-
-module.exports = {
-    docName: 'roles',
-    browse: {
-        options: [
-            'permissions'
-        ],
-        validation: {
-            options: {
-                permissions: ['assign']
-            }
-        },
-        permissions: true,
-        query(frame) {
-            return models.Role.findAll(frame.options);
-        }
-    }
-};

package/core/server/api/v2/schedules.js

@@ -1,77 +0,0 @@
-const models = require('../../models');
-
-const postSchedulingService = require('../../services/posts/post-scheduling-service')('canary');
-
-module.exports = {
-    docName: 'schedules',
-    publish: {
-        headers: {},
-        options: [
-            'id',
-            'resource'
-        ],
-        data: [
-            'force'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                },
-                resource: {
-                    required: true,
-                    values: ['posts', 'pages']
-                }
-            }
-        },
-        permissions: {
-            docName: 'posts'
-        },
-        async query(frame) {
-            const resourceType = frame.options.resource;
-            const options = {
-                status: 'scheduled',
-                id: frame.options.id,
-                context: {
-                    internal: true
-                }
-            };
-
-            const {scheduledResource, preScheduledResource} = await postSchedulingService.publish(resourceType, frame.options.id, frame.data.force, options);
-            const cacheInvalidate = postSchedulingService.handleCacheInvalidation(scheduledResource, preScheduledResource);
-            this.headers.cacheInvalidate = cacheInvalidate;
-
-            const response = {};
-            response[resourceType] = [scheduledResource];
-            return response;
-        }
-    },
-
-    getScheduled: {
-        // NOTE: this method is for internal use only by DefaultScheduler
-        //       it is not exposed anywhere!
-        permissions: false,
-        validation: {
-            options: {
-                resource: {
-                    required: true,
-                    values: ['posts', 'pages']
-                }
-            }
-        },
-        query(frame) {
-            const resourceModel = 'Post';
-            const resourceType = (frame.options.resource === 'post') ? 'post' : 'page';
-            const cleanOptions = {};
-            cleanOptions.filter = `status:scheduled+type:${resourceType}`;
-            cleanOptions.columns = ['id', 'published_at', 'created_at', 'type'];
-
-            return models[resourceModel].findAll(cleanOptions)
-                .then((result) => {
-                    let response = {};
-                    response[resourceType] = result;
-                    return response;
-                });
-        }
-    }
-};

package/core/server/api/v2/session.js

@@ -1,70 +0,0 @@
-const Promise = require('bluebird');
-const tpl = require('@tryghost/tpl');
-const errors = require('@tryghost/errors');
-const models = require('../../models');
-const auth = require('../../services/auth');
-const api = require('./index');
-
-const messages = {
-    authAccessDenied: 'Access denied.'
-};
-
-const session = {
-    read(frame) {
-        /*
-         * TODO
-         * Don't query db for user, when new api http wrapper is in we can
-         * have direct access to req.user, we can also get access to some session
-         * inofrmation too and send it back
-         */
-        return models.User.findOne({id: frame.options.context.user});
-    },
-    add(frame) {
-        const object = frame.data;
-
-        if (!object || !object.username || !object.password) {
-            return Promise.reject(new errors.UnauthorizedError({
-                message: tpl(messages.authAccessDenied)
-            }));
-        }
-
-        return models.User.check({
-            email: object.username,
-            password: object.password
-        }).then((user) => {
-            return Promise.resolve((req, res, next) => {
-                req.brute.reset(function (err) {
-                    if (err) {
-                        return next(err);
-                    }
-                    req.user = user;
-                    auth.session.createSession(req, res, next);
-                });
-            });
-        }).catch(async (err) => {
-            if (!errors.utils.isGhostError(err)) {
-                throw new errors.UnauthorizedError({
-                    message: tpl(messages.authAccessDenied),
-                    err
-                });
-            }
-
-            if (err.errorType === 'PasswordResetRequiredError') {
-                await api.authentication.generateResetToken({
-                    passwordreset: [{
-                        email: object.username
-                    }]
-                }, frame.options.context);
-            }
-
-            throw err;
-        });
-    },
-    delete() {
-        return Promise.resolve((req, res, next) => {
-            auth.session.destroySession(req, res, next);
-        });
-    }
-};
-
-module.exports = session;

package/core/server/api/v2/settings-public.js

@@ -1,17 +0,0 @@
-const settingsCache = require('../../../shared/settings-cache');
-const urlUtils = require('../../../shared/url-utils');
-
-module.exports = {
-    docName: 'settings',
-
-    browse: {
-        permissions: true,
-        query() {
-            // @TODO: decouple settings cache from API knowledge
-            // The controller fetches models (or cached models) and the API frame for the target API version formats the response.
-            return Object.assign({}, settingsCache.getPublic(), {
-                url: urlUtils.urlFor('home', true)
-            });
-        }
-    }
-};

package/core/server/api/v2/settings.js

@@ -1,195 +0,0 @@
-const Promise = require('bluebird');
-const _ = require('lodash');
-const models = require('../../models');
-const routeSettings = require('../../services/route-settings');
-const tpl = require('@tryghost/tpl');
-const {NoPermissionError, NotFoundError} = require('@tryghost/errors');
-const settingsService = require('../../services/settings');
-const settingsCache = require('../../../shared/settings-cache');
-
-const messages = {
-    problemFindingSetting: 'Problem finding setting: {key}',
-    accessCoreSettingFromExtReq: 'Attempted to access core setting from external request'
-};
-
-module.exports = {
-    docName: 'settings',
-
-    browse: {
-        options: ['type'],
-        permissions: true,
-        query(frame) {
-            let settings = settingsCache.getAll();
-
-            // CASE: no context passed (functional call)
-            if (!frame.options.context) {
-                return Promise.resolve(settings.filter((setting) => {
-                    return setting.group === 'site';
-                }));
-            }
-
-            if (!frame.options.context.internal) {
-                // CASE: omit core settings unless internal request
-                settings = _.filter(settings, (setting) => {
-                    const isCore = setting.group === 'core';
-                    return !isCore;
-                });
-                // CASE: omit secret settings unless internal request
-                settings = settings.map(settingsService.hideValueIfSecret);
-            }
-
-            return settings;
-        }
-    },
-
-    read: {
-        options: ['key'],
-        validation: {
-            options: {
-                key: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            identifier(frame) {
-                return frame.options.key;
-            }
-        },
-        query(frame) {
-            let setting;
-            if (frame.options.key === 'slack') {
-                const slackURL = settingsCache.get('slack_url', {resolve: false});
-                const slackUsername = settingsCache.get('slack_username', {resolve: false});
-
-                setting = slackURL || slackUsername;
-                setting.key = 'slack';
-                setting.value = [{
-                    url: slackURL && slackURL.value,
-                    username: slackUsername && slackUsername.value
-                }];
-            } else if (frame.options.key === 'slack_url' || frame.options.key === 'slack_username') {
-                // leave the value empty returning 404 for unknown in current API keys
-            } else {
-                setting = settingsCache.get(frame.options.key, {resolve: false});
-            }
-
-            if (!setting) {
-                return Promise.reject(new NotFoundError({
-                    message: tpl(messages.problemFindingSetting, {key: frame.options.key})
-                }));
-            }
-
-            // @TODO: handle in settings model permissible fn
-            if (setting.group === 'core' && !(frame.options.context && frame.options.context.internal)) {
-                return Promise.reject(new NoPermissionError({
-                    message: tpl(messages.accessCoreSettingFromExtReq)
-                }));
-            }
-
-            setting = settingsService.hideValueIfSecret(setting);
-
-            return {
-                [frame.options.key]: setting
-            };
-        }
-    },
-
-    edit: {
-        headers: {
-            cacheInvalidate: true
-        },
-        permissions: {
-            unsafeAttrsObject(frame) {
-                return _.find(frame.data.settings, {key: 'labs'});
-            },
-            before(frame) {
-                const errors = [];
-
-                // Using eslint disable line here as we are about to drop v2 - no point in fixing
-                frame.data.settings.map((setting) => { /* eslint-disable-line array-callback-return */
-                    if (setting.group === 'core' && !(frame.options.context && frame.options.context.internal)) {
-                        errors.push(new NoPermissionError({
-                            message: tpl(messages.accessCoreSettingFromExtReq)
-                        }));
-                    }
-                });
-
-                if (errors.length) {
-                    return Promise.reject(errors[0]);
-                }
-            }
-        },
-        query(frame) {
-            let type = frame.data.settings.find((setting) => {
-                return setting.key === 'type';
-            });
-
-            if (_.isObject(type)) {
-                type = type.value;
-            }
-
-            frame.data.settings = _.reject(frame.data.settings, (setting) => {
-                return setting.key === 'type'
-                    // Remove obfuscated settings
-                    || (setting.value === settingsService.obfuscatedSetting
-                        && settingsService.isSecretSetting(setting));
-            });
-
-            const errors = [];
-
-            _.each(frame.data.settings, (setting) => {
-                const settingFromCache = settingsCache.get(setting.key, {resolve: false});
-
-                if (!settingFromCache) {
-                    errors.push(new NotFoundError({
-                        message: tpl(messages.problemFindingSetting, {key: setting.key})
-                    }));
-                } else if (settingFromCache.core === 'core' && !(frame.options.context && frame.options.context.internal)) {
-                    // @TODO: handle in settings model permissible fn
-                    errors.push(new NoPermissionError({
-                        message: tpl(messages.accessCoreSettingFromExtReq)
-                    }));
-                }
-            });
-
-            if (errors.length) {
-                return Promise.reject(errors[0]);
-            }
-
-            return models.Settings.edit(frame.data.settings, frame.options);
-        }
-    },
-
-    upload: {
-        headers: {
-            cacheInvalidate: true
-        },
-        permissions: {
-            method: 'edit'
-        },
-        async query(frame) {
-            await routeSettings.api.setFromFilePath(frame.file.path);
-            const getRoutesHash = () => routeSettings.api.getCurrentHash();
-            await settingsService.syncRoutesHash(getRoutesHash);
-        }
-    },
-
-    download: {
-        headers: {
-            disposition: {
-                type: 'yaml',
-                value: 'routes.yaml'
-            }
-        },
-        response: {
-            format: 'plain'
-        },
-        permissions: {
-            method: 'browse'
-        },
-        query() {
-            return routeSettings.api.get();
-        }
-    }
-};

package/core/server/api/v2/site.js

@@ -1,14 +0,0 @@
-const publicConfig = require('../../services/public-config');
-
-const site = {
-    docName: 'site',
-
-    read: {
-        permissions: false,
-        query() {
-            return publicConfig.site;
-        }
-    }
-};
-
-module.exports = site;

package/core/server/api/v2/slack.js

@@ -1,12 +0,0 @@
-// Used to call the slack ping service, iirc this was done to avoid circular deps a long time ago
-const events = require('../../lib/common/events');
-
-module.exports = {
-    docName: 'slack',
-    sendTest: {
-        permissions: false,
-        query() {
-            events.emit('slack.test');
-        }
-    }
-};