ghost 5.10.0 → 5.12.0

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.10%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22moment%22%3A%7B%22includeTimezone%22%3A%22all%22%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.12%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22moment%22%3A%7B%22includeTimezone%22%3A%22all%22%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -37,7 +37,7 @@
     </style>
 
     <link integrity="" rel="stylesheet" href="assets/vendor-bc9d2c9e5c8a33f0c92e81189d48e04c.css">
-    <link integrity="" rel="stylesheet" href="assets/ghost-13baab17b3f54b21f341fb8f36f83110.css" title="light">
+    <link integrity="" rel="stylesheet" href="assets/ghost-f62b0e78ddcd947273873bdeba4abc3c.css" title="light">
 
     
 </head>
@@ -53,9 +53,9 @@
 
     <div id="ember-basic-dropdown-wormhole"></div>
 
-    <script src="assets/vendor-a1ae7a38d5c38fcba5609eed4e37f02a.js"></script>
-<script src="assets/chunk.351.ea4a4ff4b40d5f2ad141.js"></script>
-<script src="assets/chunk.143.6a3c46a89c731b86a730.js"></script>
-    <script src="assets/ghost-ced03a7ac75c3148e0ea7d1bf51e39fc.js"></script>
+    <script src="assets/vendor-52613f40d62355e9ac64cbfa211169bb.js"></script>
+<script src="assets/chunk.579.65e09dd89eec70d059a0.js"></script>
+<script src="assets/chunk.143.da85cf08f47cfe520bf6.js"></script>
+    <script src="assets/ghost-0526c96b20843697927c1d06a9010197.js"></script>
 </body>
 </html>

package/core/frontend/helpers/search.js

@@ -4,26 +4,11 @@ const {SafeString} = require('../services/handlebars');
 const {labs} = require('../services/proxy');
 
 function search() {
-    const svg = `<style>.gh-search-icon {
-                display: inline-flex;
-                justify-content: center;
-                align-items: center;
-                width: 32px;
-                height: 32px;
-                padding: 0;
-                border: 0;
-                color: inherit;
-                background-color: transparent;
-                cursor: pointer;
-                outline: none;
-            }</style>
-            <button class="gh-search-icon" aria-label="search" data-ghost-search>
-                <svg width="20" height="20" fill="none" viewBox="0 0 24 24">
-                    <path d="M14.949 14.949a1 1 0 0 1 1.414 0l6.344 6.344a1 1 0 0 1-1.414 1.414l-6.344-6.344a1 1 0 0 1 0-1.414Z"
-                    fill="currentColor"/>
-                    <path d="M10 3a7 7 0 1 0 0 14 7 7 0 0 0 0-14Zm-9 7a9 9 0 1 1 18 0 9 9 0 0 1-18 0Z" fill="currentColor"/>
-                </svg>
-            </button>`;
+    // We want this to output as one line, but splitting for readability
+    const svg = '<button class="gh-search-icon" aria-label="search" data-ghost-search '
+              + 'style="display: inline-flex; justify-content: center; align-items: center; width: 32px; height: 32px; padding: 0; border: 0; color: inherit; background-color: transparent; cursor: pointer; outline: none;">'
+              + '<svg width="20" height="20" fill="none" viewBox="0 0 24 24"><path d="M14.949 14.949a1 1 0 0 1 1.414 0l6.344 6.344a1 1 0 0 1-1.414 1.414l-6.344-6.344a1 1 0 0 1 0-1.414Z" fill="currentColor"/>'
+              + '<path d="M10 3a7 7 0 1 0 0 14 7 7 0 0 0 0-14Zm-9 7a9 9 0 1 1 18 0 9 9 0 0 1-18 0Z" fill="currentColor"/></svg></button>';
 
     return new SafeString(svg);
 }

package/core/frontend/meta/get-meta.js

@@ -1,4 +1,3 @@
-const Promise = require('bluebird');
 const settingsCache = require('../../shared/settings-cache');
 const urlUtils = require('../../shared/url-utils');
 const logging = require('@tryghost/logging');
@@ -81,7 +80,7 @@ function getMetaData(data, root) {
     }
 
     // @TODO: wrap this in a utility function
-    return Promise.props(getImageDimensions(metaData)).then(function () {
+    return getImageDimensions(metaData).then(function () {
         metaData.structuredData = getStructuredData(metaData);
         metaData.schema = getSchema(metaData, data);
 

package/core/frontend/meta/image-dimensions.js

@@ -1,15 +1,14 @@
-const Promise = require('bluebird');
 const _ = require('lodash');
 const imageSizeCache = require('../../server/lib/image').cachedImageSizeFromUrl;
 
 /**
  * Get Image dimensions
  * @param {object} metaData
- * @returns {object} metaData
+ * @returns {Promise<object>} metaData
  * @description for image properties in meta data (coverImage, authorImage and site.logo), `getCachedImageSizeFromUrl` is
  * called to receive image width and height
  */
-function getImageDimensions(metaData) {
+async function getImageDimensions(metaData) {
     const fetch = {
         coverImage: imageSizeCache.getCachedImageSizeFromUrl(metaData.coverImage.url),
         authorImage: imageSizeCache.getCachedImageSizeFromUrl(metaData.authorImage.url),
@@ -17,45 +16,54 @@ function getImageDimensions(metaData) {
         logo: imageSizeCache.getCachedImageSizeFromUrl(metaData.site.logo.url)
     };
 
-    return Promise
-        .props(fetch)
-        .then(function (imageObj) {
-            _.forEach(imageObj, function (key, value) {
-                if (_.has(key, 'width') && _.has(key, 'height')) {
-                    // We have some restrictions for publisher.logo:
-                    // The image needs to be <=600px wide and <=60px high (ideally exactly 600px x 60px).
-                    // Unless we have proper image-handling (see https://github.com/TryGhost/Ghost/issues/4453),
-                    // we will fake it in some cases or not produce an imageObject at all.
-                    if (value === 'logo') {
-                        if (key.height <= 60 && key.width <= 600) {
-                            _.assign(metaData.site[value], {
-                                dimensions: {
-                                    width: key.width,
-                                    height: key.height
-                                }
-                            });
-                        } else if (key.width === key.height) {
-                            // CASE: the logo is too large, but it is a square. We fake it...
-                            _.assign(metaData.site[value], {
-                                dimensions: {
-                                    width: 60,
-                                    height: 60
-                                }
-                            });
+    const [coverImage, authorImage, ogImage, logo] = await Promise.all([
+        fetch.coverImage,
+        fetch.authorImage,
+        fetch.ogImage,
+        fetch.logo
+    ]);
+    const imageObj = {
+        coverImage,
+        authorImage,
+        ogImage,
+        logo
+    };
+
+    _.forEach(imageObj, function (key, value) {
+        if (_.has(key, 'width') && _.has(key, 'height')) {
+            // We have some restrictions for publisher.logo:
+            // The image needs to be <=600px wide and <=60px high (ideally exactly 600px x 60px).
+            // Unless we have proper image-handling (see https://github.com/TryGhost/Ghost/issues/4453),
+            // we will fake it in some cases or not produce an imageObject at all.
+            if (value === 'logo') {
+                if (key.height <= 60 && key.width <= 600) {
+                    _.assign(metaData.site[value], {
+                        dimensions: {
+                            width: key.width,
+                            height: key.height
                         }
-                    } else {
-                        _.assign(metaData[value], {
-                            dimensions: {
-                                width: key.width,
-                                height: key.height
-                            }
-                        });
-                    }
+                    });
+                } else if (key.width === key.height) {
+                    // CASE: the logo is too large, but it is a square. We fake it...
+                    _.assign(metaData.site[value], {
+                        dimensions: {
+                            width: 60,
+                            height: 60
+                        }
+                    });
                 }
-            });
+            } else {
+                _.assign(metaData[value], {
+                    dimensions: {
+                        width: key.width,
+                        height: key.height
+                    }
+                });
+            }
+        }
+    });
 
-            return metaData;
-        });
+    return metaData;
 }
 
 module.exports = getImageDimensions;

package/core/server/api/endpoints/comments-members.js

@@ -189,8 +189,6 @@ module.exports = {
         validation: {},
         permissions: true,
         query(frame) {
-            frame.options.require = true;
-
             // TODO: move to likes service
             if (frame.options?.context?.member?.id) {
                 return models.CommentLike.destroy({
@@ -198,12 +196,17 @@ module.exports = {
                     destroyBy: {
                         member_id: frame.options.context.member.id,
                         comment_id: frame.options.id
-                    }
+                    },
+                    require: true
                 }).then(() => null)
-                    .catch(models.CommentLike.NotFoundError, () => {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.likeNotFound)
-                        }));
+                    .catch((err) => {
+                        if (err instanceof models.CommentLike.NotFoundError) {
+                            return Promise.reject(new errors.NotFoundError({
+                                message: tpl(messages.likeNotFound)
+                            }));
+                        }
+
+                        throw err;
                     });
             } else {
                 return Promise.reject(new errors.NotFoundError({

package/core/server/api/endpoints/invites.js

@@ -76,15 +76,7 @@ module.exports = {
         },
         permissions: true,
         query(frame) {
-            frame.options.require = true;
-
-            return models.Invite.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Invite.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.inviteNotFound)
-                    }));
-                });
+            return models.Invite.destroy({...frame.options, require: true});
         }
     },
 

package/core/server/api/endpoints/labels.js

@@ -150,13 +150,7 @@ module.exports = {
         },
         permissions: true,
         query(frame) {
-            return models.Label.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Label.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.labelNotFound)
-                    }));
-                });
+            return models.Label.destroy({...frame.options, require: true});
         }
     }
 };

package/core/server/api/endpoints/members.js

@@ -1,6 +1,5 @@
 // NOTE: We must not cache references to membersService.api
 // as it is a getter and may change during runtime.
-const Promise = require('bluebird');
 const moment = require('moment-timezone');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
@@ -253,20 +252,11 @@ module.exports = {
         },
         permissions: true,
         async query(frame) {
-            frame.options.require = true;
-            frame.options.cancelStripeSubscriptions = frame.options.cancel;
-
-            await Promise.resolve(membersService.api.members.destroy({
+            return membersService.api.members.destroy({
                 id: frame.options.id
-            }, frame.options)).catch(models.Member.NotFoundError, () => {
-                throw new errors.NotFoundError({
-                    message: tpl(messages.resourceNotFound, {
-                        resource: 'Member'
-                    })
-                });
+            }, {
+                ...frame.options, require: true, cancelStripeSubscriptions: frame.options.cancel
             });
-
-            return null;
         }
     },
 

package/core/server/api/endpoints/offers.js

@@ -49,7 +49,7 @@ module.exports = {
             const offer = await offersService.api.updateOffer({
                 ...frame.data.offers[0],
                 id: frame.options.id
-            });
+            }, frame.options);
 
             if (!offer) {
                 throw new errors.NotFoundError({
@@ -69,7 +69,7 @@ module.exports = {
             cacheInvalidate: true
         },
         async query(frame) {
-            const offer = await offersService.api.createOffer(frame.data.offers[0]);
+            const offer = await offersService.api.createOffer(frame.data.offers[0], frame.options);
             return {
                 data: [offer]
             };

package/core/server/api/endpoints/pages.js

@@ -2,7 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service');
-const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles', 'tiers'];
+const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.conversions'];
 const UNSAFE_ATTRS = ['status', 'authors', 'visibility'];
 
 const messages = {
@@ -186,15 +186,7 @@ module.exports = {
             unsafeAttrs: UNSAFE_ATTRS
         },
         query(frame) {
-            frame.options.require = true;
-
-            return models.Post.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Post.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.pageNotFound)
-                    }));
-                });
+            return models.Post.destroy({...frame.options, require: true});
         }
     }
 };

package/core/server/api/endpoints/posts.js

@@ -192,15 +192,7 @@ module.exports = {
             unsafeAttrs: unsafeAttrs
         },
         query(frame) {
-            frame.options.require = true;
-
-            return models.Post.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Post.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.postNotFound)
-                    }));
-                });
+            return models.Post.destroy({...frame.options, require: true});
         }
     }
 };

package/core/server/api/endpoints/snippets.js

@@ -101,15 +101,7 @@ module.exports = {
         },
         permissions: true,
         query(frame) {
-            frame.options.require = true;
-
-            return models.Snippet.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Snippet.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.snippetNotFound)
-                    }));
-                });
+            return models.Snippet.destroy({...frame.options, require: true});
         }
     }
 };

package/core/server/api/endpoints/tags.js

@@ -147,13 +147,7 @@ module.exports = {
         },
         permissions: true,
         query(frame) {
-            return models.Tag.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Tag.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.tagNotFound)
-                    }));
-                });
+            return models.Tag.destroy({...frame.options, require: true});
         }
     }
 };

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -23,7 +23,7 @@ function defaultRelations(frame) {
         return false;
     }
 
-    frame.options.withRelated = ['tags', 'authors', 'authors.roles', 'tiers'];
+    frame.options.withRelated = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.conversions'];
 }
 
 function setDefaultOrder(frame) {

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -128,7 +128,8 @@ function serializeMember(member, options) {
         email_open_rate: json.email_open_rate,
         email_recipients: json.email_recipients,
         status: json.status,
-        last_seen_at: json.last_seen_at
+        last_seen_at: json.last_seen_at,
+        attribution: json.attribution
     };
 
     if (json.products) {

package/core/server/api/endpoints/utils/serializers/output/site.js

@@ -12,6 +12,7 @@ module.exports = {
                 'logo',
                 'icon',
                 'accent_color',
+                'locale',
                 'url',
                 'version',
                 'sentry_dsn',

package/core/server/api/endpoints/utils/serializers/output/utils/clean.js

@@ -32,6 +32,9 @@ const author = (attrs, frame) => {
         delete attrs.status;
         delete attrs.email;
         delete attrs.comment_notifications;
+        delete attrs.free_member_signup_notification;
+        delete attrs.paid_subscription_started_notification;
+        delete attrs.paid_subscription_canceled_notification;
 
         // @NOTE: used for night shift
         delete attrs.accessibility;
@@ -130,9 +133,6 @@ const post = (attrs, frame) => {
 
 const action = (attrs) => {
     if (attrs.actor) {
-        delete attrs.actor_id;
-        delete attrs.resource_id;
-
         if (attrs.actor_type === 'user') {
             attrs.actor = _.pick(attrs.actor, ['id', 'name', 'slug', 'profile_image']);
             attrs.actor.image = attrs.actor.profile_image;
@@ -142,12 +142,11 @@ const action = (attrs) => {
             attrs.actor.image = attrs.actor.icon_image;
             delete attrs.actor.icon_image;
         }
-    } else if (attrs.resource) {
-        delete attrs.actor_id;
-        delete attrs.resource_id;
+    }
 
+    if (attrs.resource) {
         // @NOTE: we only support posts right now
-        attrs.resource = _.pick(attrs.resource, ['id', 'title', 'slug', 'feature_image']);
+        attrs.resource = _.pick(attrs.resource, ['id', 'title', 'slug', 'feature_image', 'name']);
         attrs.resource.image = attrs.resource.feature_image;
         delete attrs.resource.feature_image;
     }

package/core/server/api/endpoints/webhooks.js

@@ -78,14 +78,7 @@ module.exports = {
             }
         },
         query({data, options}) {
-            return models.Webhook.edit(data.webhooks[0], Object.assign(options, {require: true}))
-                .catch(models.Webhook.NotFoundError, () => {
-                    throw new errors.NotFoundError({
-                        message: tpl(messages.resourceNotFound, {
-                            resource: 'Webhook'
-                        })
-                    });
-                });
+            return models.Webhook.edit(data.webhooks[0], {...options, require: true});
         }
     },
 
@@ -130,17 +123,7 @@ module.exports = {
             }
         },
         query(frame) {
-            frame.options.require = true;
-
-            return models.Webhook.destroy(frame.options)
-                .then(() => null)
-                .catch(models.Webhook.NotFoundError, () => {
-                    return Promise.reject(new errors.NotFoundError({
-                        message: tpl(messages.resourceNotFound, {
-                            resource: 'Webhook'
-                        })
-                    }));
-                });
+            return models.Webhook.destroy({...frame.options, require: true});
         }
     }
 };

package/core/server/data/migrations/versions/5.11/2022-08-22-11-03-add-member-alert-settings-columns-to-users.js

@@ -0,0 +1,21 @@
+const {createAddColumnMigration, combineNonTransactionalMigrations} = require('../../utils');
+
+module.exports = combineNonTransactionalMigrations(
+    createAddColumnMigration('users', 'free_member_signup_notification', {
+        type: 'boolean',
+        nullable: false,
+        defaultTo: true
+    }),
+
+    createAddColumnMigration('users', 'paid_subscription_canceled_notification', {
+        type: 'boolean',
+        nullable: false,
+        defaultTo: false
+    }),
+
+    createAddColumnMigration('users', 'paid_subscription_started_notification', {
+        type: 'boolean',
+        nullable: false,
+        defaultTo: true
+    })
+);

package/core/server/data/migrations/versions/5.11/2022-08-23-13-41-backfill-members-created-events.js

@@ -0,0 +1,32 @@
+const ObjectID = require('bson-objectid').default;
+const logging = require('@tryghost/logging');
+
+const {createTransactionalMigration} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        const members = await knex('members')
+            .select('id', 'created_at');
+
+        if (members.length === 0) {
+            logging.warn(`Skipping migration because no members found`);
+            return;
+        }
+
+        const toInsert = members.map((member) => {
+            return {
+                id: ObjectID().toHexString(),
+                member_id: member.id,
+                created_at: member.created_at,
+                source: 'member'
+            };
+        });
+
+        logging.info(`Inserting ${toInsert.length} members created events`);
+        await knex.batchInsert('members_created_events', toInsert);
+    },
+    async function down(knex) {
+        logging.info(`Clearing all members created events`);
+        await knex('members_created_events').del();
+    }
+);

package/core/server/data/migrations/versions/5.11/2022-08-23-13-59-fix-page-resource-type.js

@@ -0,0 +1,22 @@
+const logging = require('@tryghost/logging');
+const {createTransactionalMigration} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        logging.info(`Changing Action event 'page' resource_type to 'post'`);
+
+        const affectedRows = await knex('actions')
+            .update({
+                resource_type: 'post',
+                context: JSON.stringify({
+                    type: 'page'
+                })
+            })
+            .where('resource_type', 'page');
+
+        logging.info(`Updated ${affectedRows} Action events from 'page' to 'post'`);
+    },
+    async function down() {
+        // no-op: we don't want to put `pages` back as a resource type
+    }
+);

package/core/server/data/schema/fixtures/fixtures.json

@@ -626,6 +626,9 @@
                     "name": "Ghost",
                     "email": "ghost@example.com",
                     "status": "inactive",
+                    "free_member_signup_notification": true,
+                    "paid_subscription_started_notification": true,
+                    "paid_subscription_canceled_notification": false,
                     "roles": []
                 }
             ]

package/core/server/data/schema/schema.js

@@ -149,6 +149,9 @@ module.exports = {
         tour: {type: 'text', maxlength: 65535, nullable: true},
         last_seen: {type: 'dateTime', nullable: true},
         comment_notifications: {type: 'boolean', nullable: false, defaultTo: true},
+        free_member_signup_notification: {type: 'boolean', nullable: false, defaultTo: true},
+        paid_subscription_started_notification: {type: 'boolean', nullable: false, defaultTo: true},
+        paid_subscription_canceled_notification: {type: 'boolean', nullable: false, defaultTo: false},
         created_at: {type: 'dateTime', nullable: false},
         created_by: {type: 'string', maxlength: 24, nullable: false},
         updated_at: {type: 'dateTime', nullable: true},
@@ -480,9 +483,17 @@ module.exports = {
         created_at: {type: 'dateTime', nullable: false},
         member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
         attribution_id: {type: 'string', maxlength: 24, nullable: true},
-        attribution_type: {type: 'string', maxlength: 50, nullable: true},
+        attribution_type: {
+            type: 'string', maxlength: 50, nullable: true, validations: {
+                isIn: [['url', 'post', 'page', 'author', 'tag']]
+            }
+        },
         attribution_url: {type: 'string', maxlength: 2000, nullable: true},
-        source: {type: 'string', maxlength: 50, nullable: false}
+        source: {
+            type: 'string', maxlength: 50, nullable: false, validations: {
+                isIn: [['member', 'import', 'system', 'api', 'admin']]
+            }
+        }
     },
     members_cancel_events: {
         id: {type: 'string', maxlength: 24, nullable: false, primary: true},
@@ -610,7 +621,11 @@ module.exports = {
         member_id: {type: 'string', maxlength: 24, nullable: false, references: 'members.id', cascadeDelete: true},
         subscription_id: {type: 'string', maxlength: 24, nullable: false, references: 'members_stripe_customers_subscriptions.id', cascadeDelete: true},
         attribution_id: {type: 'string', maxlength: 24, nullable: true},
-        attribution_type: {type: 'string', maxlength: 50, nullable: true},
+        attribution_type: {
+            type: 'string', maxlength: 50, nullable: true, validations: {
+                isIn: [['url', 'post', 'page', 'author', 'tag']]
+            }
+        },
         attribution_url: {type: 'string', maxlength: 2000, nullable: true}
     },
     offer_redemptions: {
@@ -625,7 +640,11 @@ module.exports = {
         member_id: {type: 'string', maxlength: 24, nullable: false, unique: false, references: 'members.id', cascadeDelete: true},
         subscribed: {type: 'bool', nullable: false, defaultTo: true},
         created_at: {type: 'dateTime', nullable: false},
-        source: {type: 'string', maxlength: 50, nullable: true},
+        source: {
+            type: 'string', maxlength: 50, nullable: true, validations: {
+                isIn: [['member', 'import', 'system', 'api', 'admin']]
+            }
+        },
         newsletter_id: {type: 'string', maxlength: 24, nullable: true, references: 'newsletters.id', cascadeDelete: false}
     },
     stripe_products: {