ghost 5.27.0 → 5.28.0

package/core/built/admin/index.html

@@ -8,7 +8,7 @@
     <title>Ghost Admin</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.27%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.28%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%7D" />
 
     <meta name="HandheldFriendly" content="True" />
     <meta name="MobileOptimized" content="320" />
@@ -58,7 +58,7 @@
 
     <script src="assets/vendor-dbf84caa0968ef5da0486055da6636da.js"></script>
 <script src="assets/chunk.380.de3a9bf5161ab5300d23.js"></script>
-<script src="assets/chunk.143.90a7ca5db49aa2d315c8.js"></script>
-    <script src="assets/ghost-b2e01b65312f0de8a3fb6a3d87ed5d89.js"></script>
+<script src="assets/chunk.143.16c07be45a0c39262995.js"></script>
+    <script src="assets/ghost-d8834e309d8e4800057d6d17fed9415b.js"></script>
 </body>
 </html>

package/core/frontend/helpers/get.js

@@ -13,7 +13,7 @@ const jsonpath = require('jsonpath');
 
 const messages = {
     mustBeCalledAsBlock: 'The {\\{{helperName}}} helper must be called as a block. E.g. {{#{helperName}}}...{{/{helperName}}}',
-    invalidResource: 'Invalid resource given to get helper'
+    invalidResource: 'Invalid "{resource}" resource given to get helper'
 };
 
 const createFrame = hbs.handlebars.createFrame;
@@ -193,7 +193,7 @@ module.exports = async function get(resource, options) {
     }
 
     if (!RESOURCES[resource]) {
-        data.error = tpl(messages.invalidResource);
+        data.error = tpl(messages.invalidResource, {resource});
         logging.warn(data.error);
         return options.inverse(self, {data: data});
     }

package/core/frontend/web/middleware/error-handler.js

@@ -47,8 +47,6 @@ const themeErrorRenderer = (err, req, res, next) => {
     // Format Data
     const data = {
         message: err.message,
-        // @deprecated Remove in Ghost 5.0
-        code: err.statusCode,
         statusCode: err.statusCode,
         errorDetails: err.errorDetails || []
     };

package/core/server/api/endpoints/themes.js

@@ -4,6 +4,7 @@ const models = require('../../models');
 
 // Used to emit theme.uploaded which is used in core/server/analytics-events
 const events = require('../../lib/common/events');
+const {settingsCache} = require('../../services/settings-helpers');
 
 module.exports = {
     docName: 'themes',
@@ -15,6 +16,15 @@ module.exports = {
         }
     },
 
+    readActive: {
+        permissions: true,
+        async query() {
+            let themeName = settingsCache.get('active_theme');
+            const themeErrors = await themeService.api.getThemeErrors(themeName);
+            return themeService.api.getJSON(themeName, themeErrors);
+        }
+    },
+
     activate: {
         headers: {
             cacheInvalidate: true
@@ -42,15 +52,9 @@ module.exports = {
                 value: themeName
             }];
 
-            return themeService.api.activate(themeName)
-                .then((checkedTheme) => {
-                    // @NOTE: we use the model, not the API here, as we don't want to trigger permissions
-                    return models.Settings.edit(newSettings, frame.options)
-                        .then(() => checkedTheme);
-                })
-                .then((checkedTheme) => {
-                    return themeService.api.getJSON(themeName, checkedTheme);
-                });
+            const themeErrors = await themeService.api.activate(themeName);
+            await models.Settings.edit(newSettings, frame.options);
+            return themeService.api.getJSON(themeName, themeErrors);
         }
     },
 

package/core/server/data/migrations/versions/5.28/2023-01-05-15-13-add-active-theme-permissions.js

@@ -0,0 +1,12 @@
+const {addPermissionWithRoles} = require('../../utils');
+
+module.exports = addPermissionWithRoles({
+    name: 'View active theme details',
+    action: 'readActive',
+    object: 'theme'
+}, [
+    'Author',
+    'Editor',
+    'Administrator',
+    'Admin Integration'
+]);

package/core/server/data/schema/fixtures/fixtures.json

@@ -214,6 +214,11 @@
                     "action_type": "activate",
                     "object_type": "theme"
                 },
+                {
+                    "name": "View active theme details",
+                    "action_type": "readActive",
+                    "object_type": "theme"
+                },
                 {
                     "name": "Upload themes",
                     "action_type": "add",
@@ -804,7 +809,7 @@
                     "user": "all",
                     "role": "all",
                     "invite": "all",
-                    "theme": ["browse"],
+                    "theme": ["browse", "readActive"],
                     "email_preview": "all",
                     "email": "all",
                     "snippet": "all",
@@ -819,7 +824,7 @@
                     "tag": ["browse", "read", "add"],
                     "user": ["browse", "read"],
                     "role": ["browse"],
-                    "theme": ["browse"],
+                    "theme": ["browse", "readActive"],
                     "email_preview": "read",
                     "email": "read",
                     "snippet": ["browse", "read"],

package/core/server/services/themes/activate.js

@@ -21,7 +21,7 @@ module.exports.loadAndActivate = async (themeName) => {
         const loadedTheme = await themeLoader.loadOneTheme(themeName);
         // Validate
         // @NOTE: this is now the only usage of check, rather than checkSafe...
-        const checkedTheme = await validate.check(loadedTheme);
+        const checkedTheme = await validate.check(themeName, loadedTheme);
 
         if (!validate.canActivate(checkedTheme)) {
             logging.error(validate.getThemeValidationError('activeThemeHasFatalErrors', themeName, checkedTheme));
@@ -57,6 +57,6 @@ module.exports.activate = async (themeName) => {
     const checkedTheme = await validate.checkSafe(themeName, loadedTheme);
     // Activate
     await activator.activateFromAPI(themeName, loadedTheme, checkedTheme);
-    // Return the checked theme
-    return checkedTheme;
+    // Return the theme errors
+    return validate.getErrorsFromCheckedTheme(checkedTheme);
 };

package/core/server/services/themes/index.js

@@ -3,7 +3,7 @@ const themeLoader = require('./loader');
 const storage = require('./storage');
 const getJSON = require('./to-json');
 const installer = require('./installer');
-
+const validate = require('./validate');
 const settingsCache = require('../../../shared/settings-cache');
 
 module.exports = {
@@ -11,8 +11,9 @@ module.exports = {
      * Load the currently active theme
      */
     init: async () => {
-        const themeName = settingsCache.get('active_theme');
+        validate.init();
 
+        const themeName = settingsCache.get('active_theme');
         return activate.loadAndActivate(themeName);
     },
     /**
@@ -25,6 +26,7 @@ module.exports = {
     api: {
         getJSON,
         activate: activate.activate,
+        getThemeErrors: validate.getThemeErrors,
         getZip: storage.getZip,
         setFromZip: storage.setFromZip,
         installFromGithub: installer.installFromGithub,

package/core/server/services/themes/storage.js

@@ -86,10 +86,12 @@ module.exports = {
                 await activator.activateFromAPIOverride(themeName, loadedTheme, checkedTheme);
             }
 
+            const themeErrors = validate.getErrorsFromCheckedTheme(checkedTheme);
+
             // @TODO: unify the name across gscan and Ghost!
             return {
                 themeOverridden: overrideTheme,
-                theme: toJSON(themeName, checkedTheme)
+                theme: toJSON(themeName, themeErrors)
             };
         } catch (error) {
             // restore backup if we renamed an existing theme but saving failed

package/core/server/services/themes/to-json.js

@@ -13,10 +13,10 @@ const settingsCache = require('../../../shared/settings-cache');
  * @TODO: settingsCache.get('active_theme') vs. active.get().name
  *
  * @param {string} [name] - the theme to output
- * @param {object} [checkedTheme] - a theme result from gscan
+ * @param {{errors: Array, warnings: Array}} [themeErrors] - Error and warning results from checked theme (if available)
  * @return {}
  */
-module.exports = function toJSON(name, checkedTheme) {
+module.exports = function toJSON(name, themeErrors) {
     let themeResult;
     let toFilter;
 
@@ -30,12 +30,12 @@ module.exports = function toJSON(name, checkedTheme) {
 
         themeResult = packageJSON.filter(toFilter, settingsCache.get('active_theme'));
 
-        if (checkedTheme && checkedTheme.results.warning.length > 0) {
-            themeResult[0].warnings = _.cloneDeep(checkedTheme.results.warning);
+        if (themeErrors && themeErrors.warnings.length) {
+            themeResult[0].warnings = _.cloneDeep(themeErrors.warnings);
         }
 
-        if (checkedTheme && checkedTheme.results.error.length > 0) {
-            themeResult[0].errors = _.cloneDeep(checkedTheme.results.error);
+        if (themeErrors && themeErrors.errors.length) {
+            themeResult[0].errors = _.cloneDeep(themeErrors.errors);
         }
     }
 

package/core/server/services/themes/validate.js

@@ -5,20 +5,46 @@ const config = require('../../../shared/config');
 const labs = require('../../../shared/labs');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const adapterManager = require('../adapter-manager');
+const logging = require('@tryghost/logging');
+const list = require('./list');
 
 const messages = {
     themeHasErrors: 'Theme "{theme}" is not compatible or contains errors.',
     activeThemeHasFatalErrors: 'The currently active theme "{theme}" has fatal errors.',
-    activeThemeHasErrors: 'The currently active theme "{theme}" has errors, but will still work.'
+    activeThemeHasErrors: 'The currently active theme "{theme}" has errors, but will still work.',
+    themeNotLoaded: 'Theme "{themeName}" is not loaded and cannot be checked.'
+};
+
+/**
+ * @typedef {Object} CacheStore
+ * @property {(key: string) => Promise<any>} get - get a value from the cache. Returns undefined if not found
+ * @property {(key: string, value: any) => Promise<void>} set - set a value in the cache
+ * @property {() => Promise<void>} reset - reset the cache
+ */
+
+/**
+ * The cache store for storing the result of the last theme validation
+ * @type {CacheStore}
+ */
+let gscanCacheStore;
+
+module.exports.init = () => {
+    gscanCacheStore = adapterManager.getAdapter('cache:gscan');
 };
 
 const canActivate = function canActivate(checkedTheme) {
-    // CASE: production and no fatal errors
-    // CASE: development returns fatal and none fatal errors, theme is only invalid if fatal errors
-    return !checkedTheme.results.error.length || (config.get('env') === 'development') && !checkedTheme.results.hasFatalErrors;
+    return !checkedTheme.results.hasFatalErrors;
 };
 
-const check = async function check(theme, isZip) {
+const getErrorsFromCheckedTheme = function getErrorsFromCheckedTheme(checkedTheme) {
+    return {
+        errors: checkedTheme.results.error ?? [],
+        warnings: checkedTheme.results.warning ?? []
+    };
+};
+
+const check = async function check(themeName, theme, isZip) {
     debug('Begin: Check');
     // gscan can slow down boot time if we require on boot, for now nest the require.
     const gscan = require('gscan');
@@ -41,16 +67,59 @@ const check = async function check(theme, isZip) {
     }
 
     checkedTheme = gscan.format(checkedTheme, {
-        onlyFatalErrors: config.get('env') === 'production',
+        onlyFatalErrors: false,
         checkVersion: checkedVersion
     });
 
+    // In production we don't want to show warnings
+    // Warnings are meant for developers only
+    if (config.get('env') === 'production') {
+        checkedTheme.results.warning = [];
+    }
+
+    // Cache warnings and errors
+    try {
+        await gscanCacheStore.set(themeName, getErrorsFromCheckedTheme(checkedTheme));
+    } catch (err) {
+        logging.error('Failed to cache gscan result');
+        logging.error(err);
+    }
+
     debug('End: Check');
     return checkedTheme;
 };
 
+/**
+ * Returns the last cached errors and warnings of check() if available.
+ * Otherwise runs check() on the loaded theme with that name (which will always cache the error and warning results)
+ * @returns {Promise<{errors: Array, warnings: Array}>}
+ */
+const getThemeErrors = async function getThemeErrors(themeName) {
+    try {
+        const cachedThemeErrors = await gscanCacheStore.get(themeName);
+        if (cachedThemeErrors) {
+            return cachedThemeErrors;
+        }
+    } catch (err) {
+        logging.error('Failed to get gscan result from cache');
+        logging.error(err);
+    }
+
+    const loadedTheme = list.get(themeName);
+
+    if (!loadedTheme) {
+        throw new errors.ValidationError({
+            message: tpl(messages.themeNotLoaded, {themeName: themeName}),
+            errorDetails: themeName
+        });
+    }
+
+    const result = await check(themeName, loadedTheme);
+    return getErrorsFromCheckedTheme(result);
+};
+
 const checkSafe = async function checkSafe(themeName, theme, isZip) {
-    const checkedTheme = await check(theme, isZip);
+    const checkedTheme = await check(themeName, theme, isZip);
 
     if (canActivate(checkedTheme)) {
         return checkedTheme;
@@ -74,7 +143,8 @@ const getThemeValidationError = (message, themeName, checkedTheme) => {
         message: tpl(messages[message], {theme: themeName}),
         errorDetails: Object.assign(
             _.pick(checkedTheme, ['checkedVersion', 'name', 'path', 'version']), {
-                errors: checkedTheme.results.error
+                errors: checkedTheme.results.error,
+                warnings: checkedTheme.results.warning
             }
         )
     });
@@ -83,4 +153,6 @@ const getThemeValidationError = (message, themeName, checkedTheme) => {
 module.exports.check = check;
 module.exports.checkSafe = checkSafe;
 module.exports.canActivate = canActivate;
+module.exports.getErrorsFromCheckedTheme = getErrorsFromCheckedTheme;
 module.exports.getThemeValidationError = getThemeValidationError;
+module.exports.getThemeErrors = getThemeErrors;

package/core/server/web/api/endpoints/admin/routes.js

@@ -159,6 +159,11 @@ module.exports = function apiRoutes() {
         http(api.themes.download)
     );
 
+    router.get('/themes/active',
+        mw.authAdminApi,
+        http(api.themes.readActive)
+    );
+
     router.post('/themes/upload',
         mw.authAdminApi,
         apiMw.upload.single('file'),

package/core/shared/config/defaults.json

@@ -27,7 +27,8 @@
         "cache": {
             "active": "Memory",
             "settings": {},
-            "imageSizes": {}
+            "imageSizes": {},
+            "gscan": {}
         }
     },
     "storage": {

package/core/shared/labs.js

@@ -17,7 +17,8 @@ const messages = {
 const GA_FEATURES = [
     'sourceAttribution',
     'memberAttribution',
-    'audienceFeedback'
+    'audienceFeedback',
+    'themeErrorsNotification'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
@@ -31,8 +32,7 @@ const ALPHA_FEATURES = [
     'beforeAfterCard',
     'lexicalEditor',
     'suppressionList',
-    'emailStability',
-    'themeErrorsNotification'
+    'emailStability'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];