ghost 5.111.0 → 5.113.0

package/core/frontend/src/cards/css/cta.css

@@ -42,28 +42,35 @@
     background: rgba(135, 85, 236, 0.12);
 }
 
-.kg-cta-sponsor-label {
-    margin: 0 2.4rem;
-    padding: 1.2rem 0;
+.kg-cta-sponsor-label-wrapper {
+    margin: 0 1.5em;
+    padding: .7em 0;
     border-bottom: 1px solid rgba(124, 139, 154, 0.2);
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif;
-    font-size: 12px;
-    font-weight: 600;
-    text-transform: uppercase;
-    text-wrap: pretty;
 }
 
 @media (max-width: 600px) {
-    .kg-cta-sponsor-label {
-        margin: 0 2rem;
-        padding: 1rem 0;
+    .kg-cta-sponsor-label-wrapper {
+        margin: 0 1.25em;
+        padding: .5em 0;
     }
 }
 
-.kg-cta-bg-none .kg-cta-sponsor-label {
+.kg-cta-bg-none .kg-cta-sponsor-label-wrapper {
     margin: 0;
+    padding-top: 0;
+}
+
+.kg-cta-has-img .kg-cta-sponsor-label-wrapper:not(.kg-cta-bg-none .kg-cta-sponsor-label-wrapper):not(.kg-cta-minimal .kg-cta-sponsor-label-wrapper) {
+    border-bottom: 0;
 }
 
+.kg-cta-sponsor-label {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif;
+    font-size: 12px;
+    font-weight: 600;
+    text-transform: uppercase;
+    text-wrap: pretty;
+}
 
 .kg-cta-sponsor-label p span:not(a span) {
     color: color-mix(in srgb, currentColor 45%, transparent);
@@ -75,29 +82,33 @@
 
 .kg-cta-content {
     display: flex;
-    padding: 2.4rem;
-    gap: 2.4rem;
+    padding: 1.5em;
+    gap: 1.5em;
 }
 
 @media (max-width: 600px) {
     .kg-cta-content {
-        padding: 2rem;
-        gap: 2rem;
+        padding: 1.25em;
+        gap: 1.25em;
     }
 }
 
+.kg-cta-has-img .kg-cta-sponsor-label-wrapper + .kg-cta-content:not(.kg-cta-bg-none .kg-cta-content):not(.kg-cta-minimal .kg-cta-content) {
+    padding-top: 0;
+}
+
 .kg-cta-bg-none .kg-cta-content {
-    padding: 2.4rem 0;
+    padding: 1.5em 0;
     border-bottom: 1px solid rgba(124, 139, 154, 0.2);
 }
 
-.kg-cta-bg-none .kg-cta-content:not(.kg-cta-sponsor-label + .kg-cta-content) {
+.kg-cta-bg-none .kg-cta-content:not(.kg-cta-sponsor-label-wrapper + .kg-cta-content) {
     border-top: 1px solid rgba(124, 139, 154, 0.2);
 }
 
 @media (max-width: 600px) {
     .kg-cta-bg-none .kg-cta-content {
-        padding: 2rem 0;
+        padding: 1.25em 0;
     }
 }
 
@@ -119,12 +130,12 @@
 .kg-cta-content-inner {
     display: flex;
     flex-direction: column;
-    gap: 2.4rem;
+    gap: 1.5em;
 }
 
 @media (max-width: 600px) {
     .kg-cta-content-inner {
-        gap: 2rem;
+        gap: 1.25em;
     }
 }
 
@@ -133,6 +144,7 @@
 }
 
 .kg-cta-image-container img {
+    margin: 0;
     object-fit: cover;
     border-radius: 6px;
 }
@@ -150,16 +162,13 @@
     }
 }
 
-.kg-cta-immersive .kg-cta-text {
-    text-align: center;
-}
-
 .kg-cta-text p {
+    margin: 0;
     text-wrap: pretty;
 }
 
 .kg-cta-text p + p {
-    margin-top: 2rem;
+    margin-top: 1.25em;
 }
 
 .kg-cta-text a {
@@ -171,7 +180,10 @@ a.kg-cta-button {
     position: static;
     align-items: center;
     justify-content: center;
+    padding: 0 1em;
+    height: 2.5em;
     font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif;
+    font-size: 0.95em;
     font-weight: 500;
     line-height: 1.65;
     text-decoration: none;
@@ -179,16 +191,6 @@ a.kg-cta-button {
     transition: opacity 0.2s ease-in-out;
 }
 
-.kg-cta-minimal a.kg-cta-button {
-    padding: 0 2rem;
-    height: 2.4em;
-    font-size: 0.95em;
-}
-
-.kg-cta-immersive a.kg-cta-button {
-    padding: .8rem 2rem;
-}
-
 a.kg-cta-button:hover {
     opacity: 0.85;
 }

package/core/server/adapters/cache/AdapterCacheMemoryTTL.js

@@ -0,0 +1,54 @@
+const TTLCache = require('@isaacs/ttlcache');
+const Base = require('@tryghost/adapter-base-cache');
+
+/**
+ * Cache adapter compatible wrapper around TTLCache
+ * Distinct features of this cache adapter:
+ * - it is in-memory only
+ * - it supports time-to-live (TTL)
+ * - it supports a max number of items
+ */
+class AdapterCacheMemoryTTL extends Base {
+    #cache;
+
+    /**
+     *
+     * @param {Object} [deps]
+     * @param {Number} [deps.max] - The max number of items to keep in the cache.
+     * @param {Number} [deps.ttl] - The max time in ms to store items
+     */
+    constructor({max = Infinity, ttl = Infinity} = {}) {
+        super();
+
+        this.#cache = new TTLCache({max, ttl});
+    }
+
+    get(key) {
+        return this.#cache.get(key);
+    }
+
+    /**
+     *
+     * @param {String} key
+     * @param {*} value
+     * @param {Object} [options]
+     * @param {Number} [options.ttl]
+    */
+    set(key, value, {ttl} = {}) {
+        this.#cache.set(key, value, {ttl});
+    }
+
+    reset() {
+        this.#cache.clear();
+    }
+
+    /**
+     * Helper method to assist "getAll" type of operations
+     * @returns {Array<String>} all keys present in the cache
+     */
+    keys() {
+        return [...this.#cache.keys()];
+    }
+}
+
+module.exports = AdapterCacheMemoryTTL;

package/core/server/adapters/cache/memory-ttl.js

@@ -1,3 +1,3 @@
-const TTLMemoryCache = require('@tryghost/adapter-cache-memory-ttl');
+const TTLMemoryCache = require('./AdapterCacheMemoryTTL');
 
 module.exports = TTLMemoryCache;

package/core/server/api/endpoints/utils/serializers/input/settings.js

@@ -76,7 +76,8 @@ const EDITABLE_SETTINGS = [
     'body_font',
     'heading_font',
     'blocked_email_domains',
-    'captcha_enabled'
+    'captcha_enabled',
+    'require_email_mfa'
 ];
 
 module.exports = {

package/core/server/api/endpoints/utils/serializers/input/utils/settings-key-group-mapper.js

@@ -47,7 +47,8 @@ const keyGroupMapping = {
     stripe_connect_integration: 'members',
     portal_name: 'portal',
     portal_button: 'portal',
-    portal_plans: 'portal'
+    portal_plans: 'portal',
+    require_email_mfa: 'security'
 };
 
 const mapKeyToGroup = (key) => {

package/core/server/api/endpoints/utils/serializers/input/utils/settings-key-type-mapper.js

@@ -54,7 +54,8 @@ const keyTypeMapping = {
     stripe_connect_livemode: 'boolean',
     labs: 'object',
     unsplash: 'object',
-    bulk_email_settings: 'object'
+    bulk_email_settings: 'object',
+    require_email_mfa: 'boolean'
 };
 
 const mapKeyToType = (key) => {

package/core/server/data/migrations/versions/5.112/2025-03-10-10-01-01-add-require-mfa-setting.js

@@ -0,0 +1,8 @@
+const {addSetting} = require('../../utils');
+
+module.exports = addSetting({
+    key: 'require_email_mfa',
+    value: 'false',
+    type: 'boolean',
+    group: 'security'
+});

package/core/server/data/migrations/versions/5.113/2025-03-07-12-24-00-add-super-editor.js

@@ -0,0 +1,31 @@
+const logging = require('@tryghost/logging');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        logging.info('Creating "Super Editor" role');
+        const existingRole = await knex('roles').where({
+            name: 'Super Editor'
+        }).first();
+
+        if (existingRole) {
+            logging.warn('"Super Editor" role already exists, skipping');
+            return;
+        }
+
+        await knex('roles').insert({
+            id: (new ObjectID()).toHexString(),
+            name: 'Super Editor',
+            description: 'Editor plus member management',
+            created_by: meta.MIGRATION_USER,
+            created_at: knex.raw('current_timestamp')
+        });
+    },
+    async function down(knex) {
+        logging.info('Deleting role "Super Editor"');
+        await knex('roles').where({
+            name: 'Super Editor'
+        }).del();
+    }
+);

package/core/server/data/migrations/versions/5.113/2025-03-07-12-25-00-add-member-perms-to-super-editor.js

@@ -0,0 +1,291 @@
+const {addPermissionToRole, combineTransactionalMigrations} = require('../../utils');
+module.exports = combineTransactionalMigrations(
+    addPermissionToRole({
+        permission: 'Browse Members',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read Members',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit Members',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add Members',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete Members',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read offers',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse offers',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read member signin urls',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse notifications',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add notifications',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete notifications',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Generate slugs',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse posts',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read posts',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit posts',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add posts',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete posts',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Publish posts',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse settings',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read settings',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse tags',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read tags',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit tags',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add tags',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete tags',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse themes',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'View active theme details',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse users',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read users',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit users',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add users',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete users',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Assign a role',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse roles',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse invites',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read invites',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add invites',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete invites',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit invites',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Email preview',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Send test email',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read emails',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse emails',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Retry emails',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse snippets',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read snippets',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit snippets',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add snippets',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete snippets',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse labels',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read labels',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit labels',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add labels',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete labels',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse Products',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read Products',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse newsletters',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read newsletters',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse collections',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read collections',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit collections',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add collections',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete collections',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Moderate comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Like comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Unlike comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Add comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Edit comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Delete comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Read comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Browse comments',
+        role: 'Super Editor'
+    }),
+    addPermissionToRole({
+        permission: 'Report comments',
+        role: 'Super Editor'
+    })
+);

package/core/server/data/schema/default-settings/default-settings.json

@@ -603,5 +603,11 @@
             },
             "type": "boolean"
         }
+    },
+    "security": {
+        "require_email_mfa": {
+            "defaultValue": false,
+            "type": "boolean"
+        }
     }
 }

package/core/server/data/schema/fixtures/fixtures.json

@@ -106,6 +106,10 @@
                 {
                     "name": "Scheduler Integration",
                     "description": "Internal Scheduler Client"
+                },
+                {
+                    "name": "Super Editor",
+                    "description": "Super Editors"
                 }
             ]
         },
@@ -917,6 +921,29 @@
                     "recommendation": "all",
                     "member_signin_url": "read"
                 },
+                "Super Editor": {
+                    "notification": "all",
+                    "post": "all",
+                    "setting": ["browse", "read"],
+                    "slug": "all",
+                    "tag": "all",
+                    "user": "all",
+                    "role": "all",
+                    "invite": "all",
+                    "theme": ["browse", "readActive"],
+                    "email_preview": "all",
+                    "email": "all",
+                    "snippet": "all",
+                    "label": ["browse", "read", "edit", "add", "destroy"],
+                    "product": ["browse", "read"],
+                    "newsletter": ["browse", "read"],
+                    "collection": "all",
+                    "recommendation": ["browse", "read"],
+                    "member": ["browse", "read", "add", "edit", "destroy"],
+                    "member_signin_url": "read",
+                    "offer": ["browse", "read"],
+                    "comment": "all"
+                },
                 "Editor": {
                     "notification": "all",
                     "post": "all",

package/core/server/models/invite.js

@@ -1,4 +1,3 @@
-const _ = require('lodash');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const constants = require('@tryghost/constants');
@@ -6,7 +5,7 @@ const security = require('@tryghost/security');
 const settingsCache = require('../../shared/settings-cache');
 const limitService = require('../services/limits');
 const ghostBookshelf = require('./base');
-
+const {setIsRoles} = require('./role-utils');
 const messages = {
     notEnoughPermission: 'You do not have permission to perform this action',
     roleNotFound: 'Role not found',
@@ -86,14 +85,14 @@ Invite = ghostBookshelf.Model.extend({
 
                 let allowed = [];
                 if (loadedPermissions.user) {
-                    if (_.some(loadedPermissions.user.roles, {name: 'Owner'}) ||
-                        _.some(loadedPermissions.user.roles, {name: 'Administrator'})) {
-                        allowed = ['Administrator', 'Editor', 'Author', 'Contributor'];
-                    } else if (_.some(loadedPermissions.user.roles, {name: 'Editor'})) {
+                    const {isOwner, isAdmin, isEitherEditor} = setIsRoles(loadedPermissions);
+                    if (isOwner || isAdmin) {
+                        allowed = ['Administrator', 'Editor', 'Author', 'Contributor', 'Super Editor'];
+                    } else if (isEitherEditor) {
                         allowed = ['Author', 'Contributor'];
                     }
                 } else if (loadedPermissions.apiKey) {
-                    allowed = ['Editor', 'Author', 'Contributor'];
+                    allowed = ['Editor', 'Author', 'Contributor', 'Super Editor'];
                 }
 
                 if (allowed.indexOf(roleToInvite.get('name')) === -1) {