ghost 5.3.1 → 5.5.0

package/core/frontend/helpers/comments.js

@@ -1,15 +1,28 @@
 const {SafeString} = require('../services/handlebars');
-const {config, urlUtils, getFrontendKey, labs} = require('../services/proxy');
+const {urlUtils, getFrontendKey, labs, settingsCache} = require('../services/proxy');
+const {getFrontendAppConfig, getDataAttributes} = require('../utils/frontend-apps');
 
 async function comments(options) {
     // todo: For now check on the comment id to exclude normal pages (we probably have a better way to do this)
 
     const commentId = this.comment_id;
-        
+
     if (!commentId) {
         return;
     }
-    
+
+    /**
+     * We need to check if comments enabled, because the theme might not be using the other available helpers to check
+     * if comments is enabled + the member has access
+     * @type {'all'|'paid'|'off'}
+     */
+    const commentsEnabled = settingsCache.get('comments_enabled');
+    const hasAccess = !!this.access;
+
+    if (commentsEnabled === 'off' || !hasAccess) {
+        return;
+    }
+
     let colorScheme = 'auto';
     if (options.hash.color_scheme === 'dark' || options.hash.color_scheme === 'light') {
         colorScheme = options.hash.color_scheme;
@@ -26,28 +39,27 @@ async function comments(options) {
     }
 
     const frontendKey = await getFrontendKey();
+    const {scriptUrl, stylesUrl, appVersion} = getFrontendAppConfig('comments');
 
     const data = {
         'ghost-comments': urlUtils.getSiteUrl(),
         api: urlUtils.urlFor('api', {type: 'content'}, true),
         admin: urlUtils.urlFor('admin', true),
         key: frontendKey,
+        styles: stylesUrl,
         'post-id': this.id,
         'sentry-dsn': '', /* todo: insert sentry dsn key here */
         'color-scheme': colorScheme,
         'avatar-saturation': avatarSaturation,
         'accent-color': accentColor,
-        'app-version': config.get('comments:version')
+        'app-version': appVersion,
+        'comments-enabled': commentsEnabled
     };
 
-    let dataAttributes = '';
-
-    Object.entries(data).forEach(([key, value]) => {
-        dataAttributes += `data-${key}="${value}" `;
-    });
+    const dataAttributes = getDataAttributes(data);
 
     return new SafeString(`
-        <script defer src="${config.get('comments:url')}" ${dataAttributes} crossorigin="anonymous"></script>
+        <script defer src="${scriptUrl}" ${dataAttributes} crossorigin="anonymous"></script>
     `);
 }
 

package/core/frontend/helpers/ghost_head.js

@@ -13,6 +13,7 @@ const logging = require('@tryghost/logging');
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('ghost_head');
 const templateStyles = require('./tpl/styles');
+const {getFrontendAppConfig, getDataAttributes} = require('../utils/frontend-apps');
 
 const {get: getMetaData, getAssetUrl} = metaData;
 
@@ -47,9 +48,20 @@ function getMembersHelper(data, frontendKey) {
     if (!settingsCache.get('members_enabled')) {
         return '';
     }
+    const {scriptUrl} = getFrontendAppConfig('portal');
+
+    const colorString = (_.has(data, 'site._preview') && data.site.accent_color) ? data.site.accent_color : '';
+    const attributes = {
+        ghost: urlUtils.getSiteUrl(),
+        key: frontendKey,
+        api: urlUtils.urlFor('api', {type: 'content'}, true)
+    };
+    if (colorString) {
+        attributes['accent-color'] = colorString;
+    }
+    const dataAttributes = getDataAttributes(attributes);
 
-    const colorString = _.has(data, 'site._preview') && data.site.accent_color ? ` data-accent-color="${data.site.accent_color}"` : '';
-    let membersHelper = `<script defer src="${config.get('portal:url')}" data-ghost="${urlUtils.getSiteUrl()}"${colorString} data-key="${frontendKey}" data-api="${urlUtils.urlFor('api', {type: 'content'}, true)}" crossorigin="anonymous"></script>`;
+    let membersHelper = `<script defer src="${scriptUrl}" ${dataAttributes} crossorigin="anonymous"></script>`;
     membersHelper += (`<style id="gh-members-styles">${templateStyles}</style>`);
     if (settingsCache.get('paid_members_enabled')) {
         membersHelper += '<script async src="https://js.stripe.com/v3/"></script>';
@@ -59,8 +71,14 @@ function getMembersHelper(data, frontendKey) {
 
 function getSearchHelper(frontendKey) {
     const adminUrl = urlUtils.getAdminUrl() || urlUtils.getSiteUrl();
-
-    let helper = `<script defer src="${config.get('sodoSearch:url')}" data-sodo-search="${adminUrl}" data-version="${config.get('sodoSearch:version')}" data-key="${frontendKey}" crossorigin="anonymous"></script>`;
+    const {scriptUrl, stylesUrl} = getFrontendAppConfig('sodoSearch');
+    const attrs = {
+        key: frontendKey,
+        styles: stylesUrl,
+        'sodo-search': adminUrl
+    };
+    const dataAttrs = getDataAttributes(attrs);
+    let helper = `<script defer src="${scriptUrl}" ${dataAttrs} crossorigin="anonymous"></script>`;
 
     return helper;
 }

package/core/frontend/helpers/total_members.js

@@ -0,0 +1,17 @@
+// # Total Members Helper
+// Usage: `{{total_members}}`
+
+const {SafeString} = require('../services/handlebars');
+const {memberCountRounding, getMemberStats} = require('../utils/member-count');
+
+module.exports = async function total_members () { //eslint-disable-line
+    if (this.total) {
+        return new SafeString(memberCountRounding(this.total));
+    } else {
+        let memberStats = await getMemberStats();
+        const {total} = memberStats;
+        return new SafeString(total > 0 ? memberCountRounding(total) : 0);
+    }
+};
+
+module.exports.async = true;

package/core/frontend/helpers/total_paid_members.js

@@ -0,0 +1,16 @@
+// {{total_paid_members}} helper
+
+const {SafeString} = require('../services/handlebars');
+const {memberCountRounding, getMemberStats} = require('../utils/member-count');
+
+module.exports = async function total_paid_members () { //eslint-disable-line
+    if (this.paid) {
+        return new SafeString(memberCountRounding(this.paid));
+    } else {
+        let memberStats = await getMemberStats();
+        const {paid} = memberStats;
+        return new SafeString(paid > 0 ? memberCountRounding(paid) : 0);
+    }
+};
+
+module.exports.async = true;

package/core/frontend/utils/frontend-apps.js

@@ -0,0 +1,33 @@
+const {config} = require('../services/proxy');
+
+function getFrontendAppConfig(app) {
+    const appVersion = config.get(`${app}:version`);
+    let scriptUrl = config.get(`${app}:url`);
+    let stylesUrl = config.get(`${app}:styles`);
+    if (scriptUrl.includes('{version}')) {
+        scriptUrl = scriptUrl.replace('{version}', appVersion);
+    }
+    if (stylesUrl?.includes('{version}')) {
+        stylesUrl = stylesUrl.replace('{version}', appVersion);
+    }
+    return {
+        scriptUrl,
+        stylesUrl,
+        appVersion
+    };
+}
+
+function getDataAttributes(data) {
+    let dataAttributes = '';
+
+    if (!data) {
+        return dataAttributes;
+    }
+    Object.entries(data).forEach(([key, value]) => {
+        dataAttributes += `data-${key}="${value}" `;
+    });
+
+    return dataAttributes.trim();
+}
+
+module.exports = {getFrontendAppConfig, getDataAttributes};

package/core/frontend/utils/member-count.js

@@ -0,0 +1,50 @@
+const humanNumber = require('human-number');
+const {api} = require('../services/proxy');
+
+async function getMemberStats() {
+    let memberStats = this.data || await api.stats.memberCountHistory.query();
+    const {free, paid, comped} = memberStats.meta.totals;
+    let total = free + paid + comped;
+    return {free, paid, comped, total};
+}
+
+const numberWithCommas = (n) => {
+    return n.toLocaleString();
+};
+
+const rounding = (n, roundTo) => {
+    return Math.floor(n / roundTo) * roundTo;
+};
+
+// Rounding https://github.com/TryGhost/Team/issues/1667
+const memberCountRounding = (memberCount) => {
+    if (memberCount <= 50) {
+        return memberCount;
+    }
+
+    if (memberCount > 50 && memberCount <= 100) {
+        return `${numberWithCommas(rounding(memberCount, 10))}+`;
+    }
+
+    if (memberCount > 100 && memberCount <= 1000) {
+        return `${numberWithCommas(rounding(memberCount, 50))}+`;
+    }
+
+    if (memberCount > 1000 && memberCount <= 10000) {
+        return `${numberWithCommas(rounding(memberCount, 100))}+`;
+    }
+
+    if (memberCount > 10000 && memberCount <= 100000) {
+        return `${numberWithCommas(rounding(memberCount, 1000))}+`;
+    }
+
+    if (memberCount > 100000 && memberCount <= 1000000) {
+        return `${humanNumber(rounding(memberCount, 10000)).toLowerCase()}+`;
+    }
+
+    if (memberCount > 1000000) {
+        return `${humanNumber(rounding(memberCount, 100000)).toLowerCase()}+`;
+    }
+};
+
+module.exports = {memberCountRounding, getMemberStats};

package/core/frontend/web/middleware/cors.js

@@ -13,7 +13,8 @@ function corsOptionsDelegate(req, callback) {
     const origin = req.header('Origin');
     const corsOptions = {
         origin: false, // disallow cross-origin requests by default
-        credentials: true // required to allow admin-client to login to private sites
+        credentials: true, // required to allow admin-client to login to private sites
+        maxAge: config.get('caching:cors:maxAge')
     };
 
     if (!origin || origin === 'null') {

package/core/server/api/endpoints/comments-comments.js

@@ -3,6 +3,7 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
 const db = require('../../data/db');
+const commentsService = require('../../services/comments');
 const ALLOWED_INCLUDES = ['post', 'member', 'likes', 'replies'];
 const UNSAFE_ATTRS = ['status'];
 
@@ -51,17 +52,8 @@ module.exports = {
             }
         },
         permissions: true,
-        query(frame) {
-            return models.Comment.findOne(frame.data, frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.commentNotFound)
-                        }));
-                    }
-
-                    return model;
-                });
+        async query(frame) {
+            return await commentsService.api.getCommentByID(frame.data.id, frame.options);
         }
     },
 
@@ -82,17 +74,21 @@ module.exports = {
             }
         },
         permissions: true,
-        query(frame) {
-            return models.Comment.edit(frame.data.comments[0], frame.options)
-                .then((model) => {
-                    if (!model) {
-                        return Promise.reject(new errors.NotFoundError({
-                            message: tpl(messages.commentNotFound)
-                        }));
-                    }
+        async query(frame) {
+            if (frame.data.comments[0].status === 'deleted') {
+                return await commentsService.api.deleteComment(
+                    frame.options.id,
+                    frame?.options?.context?.member?.id,
+                    frame.options
+                );
+            }
 
-                    return model;
-                });
+            return await commentsService.api.editCommentContent(
+                frame.options.id,
+                frame?.options?.context?.member?.id,
+                frame.data.comments[0].html,
+                frame.options
+            );
         }
     },
 
@@ -115,20 +111,24 @@ module.exports = {
         permissions: {
             unsafeAttrs: UNSAFE_ATTRS
         },
-        query(frame) {
-            // TODO: move to comment service
+        async query(frame) {
             const data = frame.data.comments[0];
 
-            if (frame.options?.context?.member?.id) {
-                data.member_id = frame.options.context.member.id;
-
-                // todo: add validation that the parent comment is on the same post, and not deleted
-                return models.Comment.add(data, frame.options);
-            } else {
-                return Promise.reject(new errors.NotFoundError({
-                    message: tpl(messages.memberNotFound)
-                }));
+            if (data.parent_id) {
+                return await commentsService.api.replyToComment(
+                    data.parent_id,
+                    frame.options.context.member.id,
+                    data.html,
+                    frame.options
+                );
             }
+
+            return await commentsService.api.commentOnPost(
+                data.post_id,
+                frame.options.context.member.id,
+                data.html,
+                frame.options
+            );
         }
     },
 
@@ -243,5 +243,23 @@ module.exports = {
                 }));
             }
         }
+    },
+
+    report: {
+        statusCode: 204,
+        options: [
+            'id'
+        ],
+        validation: {},
+        permissions: true,
+        async query(frame) {
+            if (!frame.options?.context?.member?.id) {
+                return Promise.reject(new errors.UnauthorizedError({
+                    message: tpl(messages.memberNotFound)
+                }));
+            }
+
+            await commentsService.api.reportComment(frame.options.id, frame.options?.context?.member);
+        }
     }
 };

package/core/server/api/endpoints/offers-public.js

@@ -20,8 +20,8 @@ module.exports = {
                 });
             }
 
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     }

package/core/server/api/endpoints/offers.js

@@ -16,8 +16,8 @@ module.exports = {
         permissions: true,
         async query(frame) {
             const offers = await offersService.api.listOffers(frame.options);
-            frame.response = {
-                offers
+            return {
+                data: offers
             };
         }
     },
@@ -33,8 +33,8 @@ module.exports = {
                 });
             }
 
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     },
@@ -57,8 +57,8 @@ module.exports = {
                 });
             }
 
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     },
@@ -70,8 +70,8 @@ module.exports = {
         },
         async query(frame) {
             const offer = await offersService.api.createOffer(frame.data.offers[0]);
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     }

package/core/server/api/endpoints/settings.js

@@ -2,17 +2,15 @@ const Promise = require('bluebird');
 const _ = require('lodash');
 const models = require('../../models');
 const routeSettings = require('../../services/route-settings');
-const tpl = require('@tryghost/tpl');
 const {BadRequestError} = require('@tryghost/errors');
 const settingsService = require('../../services/settings/settings-service');
 const membersService = require('../../services/members');
 const stripeService = require('../../services/stripe');
-
+const tpl = require('@tryghost/tpl');
 const settingsBREADService = settingsService.getSettingsBREADServiceInstance();
 
 const messages = {
     failedSendingEmail: 'Failed Sending Email'
-
 };
 
 async function getStripeConnectData(frame) {
@@ -59,6 +57,65 @@ module.exports = {
         }
     },
 
+    verifyKeyUpdate: {
+        headers: {
+            cacheInvalidate: true
+        },
+        permissions: {
+            method: 'edit'
+        },
+        data: [
+            'token'
+        ],
+        async query(frame) {
+            await settingsBREADService.verifyKeyUpdate(frame.data.token);
+            
+            // We need to return all settings here, because we have calculated settings that might change
+            const browse = await settingsBREADService.browse(frame.options.context);
+
+            return browse;
+        }
+    },
+
+    /**
+     * @deprecated
+     */
+    updateMembersEmail: {
+        statusCode: 204,
+        permissions: {
+            method: 'edit'
+        },
+        data: [
+            'email',
+            'type'
+        ],
+        async query(frame) {
+            const {email, type} = frame.data;
+
+            try {
+                // Mapped internally to the newer method of changing emails
+                const actionToKeyMapping = {
+                    supportAddressUpdate: 'members_support_address'
+                };
+                const edit = {
+                    key: actionToKeyMapping[type],
+                    value: email
+                };
+
+                await settingsBREADService.edit([edit], frame.options, null);
+            } catch (err) {
+                throw new BadRequestError({
+                    err,
+                    message: tpl(messages.failedSendingEmail)
+                });
+            }
+        }
+    },
+
+    /**
+     * @todo can get removed, since this is moved to verifyKeyUpdate
+     * @deprecated: keep to not break existing email verification links, but remove after 1 - 2 releases
+     */
     validateMembersEmailUpdate: {
         options: [
             'token',
@@ -108,33 +165,6 @@ module.exports = {
         }
     },
 
-    updateMembersEmail: {
-        statusCode: 204,
-        permissions: {
-            method: 'edit'
-        },
-        data: [
-            'email',
-            'type'
-        ],
-        async query(frame) {
-            const {email, type} = frame.data;
-
-            try {
-                // Send magic link to update fromAddress
-                await membersService.settings.sendEmailAddressUpdateMagicLink({
-                    email,
-                    type
-                });
-            } catch (err) {
-                throw new BadRequestError({
-                    err,
-                    message: tpl(messages.failedSendingEmail)
-                });
-            }
-        }
-    },
-
     disconnectStripeConnectIntegration: {
         statusCode: 204,
         permissions: {
@@ -197,6 +227,8 @@ module.exports = {
 
             // We need to return all settings here, because we have calculated settings that might change
             const browse = await settingsBREADService.browse(frame.options.context);
+            browse.meta = result.meta || {};
+
             return browse;
         }
     },

package/core/server/api/endpoints/utils/serializers/input/settings.js

@@ -31,6 +31,7 @@ const EDITABLE_SETTINGS = [
     'default_content_visibility',
     'default_content_visibility_tiers',
     'members_signup_access',
+    'members_support_address',
     'stripe_secret_key',
     'stripe_publishable_key',
     'stripe_connect_integration_token',

package/core/server/api/endpoints/utils/serializers/output/config.js

@@ -18,7 +18,8 @@ module.exports = {
             'mailgunIsConfigured',
             'emailAnalytics',
             'hostSettings',
-            'tenor'
+            'tenor',
+            'editor'
         ];
 
         frame.response = {

package/core/server/api/endpoints/utils/serializers/output/index.js

@@ -125,10 +125,6 @@ module.exports = {
         return require('./session');
     },
 
-    get offers() {
-        return require('./offers');
-    },
-
     get members_stripe_connect() {
         return require('./members-stripe-connect');
     }

package/core/server/api/endpoints/utils/serializers/output/mappers/activity-feed-events.js

@@ -0,0 +1,17 @@
+const mapComment = require('./comments');
+
+const commentEventMapper = (json, frame) => {
+    return {
+        ...json,
+        data: mapComment(json.data, frame)
+    };
+};
+
+const activityFeedMapper = (event, frame) => {
+    if (event.type === 'comment_event') {
+        return commentEventMapper(event, frame);
+    }
+    return event;
+};
+
+module.exports = activityFeedMapper;

package/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -1,4 +1,5 @@
 const _ = require('lodash');
+const url = require('../utils/url');
 
 const commentFields = [
     'id',
@@ -16,6 +17,13 @@ const memberFields = [
     'avatar_image'
 ];
 
+const postFields = [
+    'id',
+    'uuid',
+    'title',
+    'url'
+];
+
 const commentMapper = (model, frame) => {
     const jsonModel = model.toJSON ? model.toJSON(frame.options) : model;
 
@@ -37,6 +45,16 @@ const commentMapper = (model, frame) => {
         response.replies = jsonModel.replies.map(reply => commentMapper(reply, frame));
     }
 
+    if (jsonModel.parent) {
+        response.parent = commentMapper(jsonModel.parent, frame);
+    }
+
+    if (jsonModel.post) {
+        // We could use the post mapper here, but we need less field + don't need al the async behaviour support
+        url.forPost(jsonModel.post.id, jsonModel.post, frame);
+        response.post = _.pick(jsonModel.post, postFields);
+    }
+
     // todo
     response.liked = false;
     if (jsonModel.likes && frame.original.context.member && frame.original.context.member.id) {

package/core/server/api/endpoints/utils/serializers/output/mappers/index.js

@@ -1,5 +1,6 @@
 module.exports = {
     actions: require('./actions'),
+    activityFeedEvents: require('./activity-feed-events'),
     authors: require('./authors'),
     comments: require('./comments'),
     emails: require('./emails'),
@@ -10,6 +11,7 @@ module.exports = {
     settings: require('./settings'),
     snippets: require('./snippets'),
     tags: require('./tags'),
+    offers: require('./offers'),
     newsletters: require('./newsletters'),
     users: require('./users')
 };

package/core/server/api/endpoints/utils/serializers/output/mappers/offers.js

@@ -0,0 +1,28 @@
+const utils = require('../../../index');
+
+module.exports = (model, frame) => {
+    // Offer data is already returned as json via members service
+    const jsonModel = model;
+
+    if (utils.isContentAPI(frame)) {
+        const serialized = {
+            id: jsonModel.id,
+            name: jsonModel.name,
+            display_title: jsonModel.display_title,
+            display_description: jsonModel.display_description,
+            type: jsonModel.type,
+            cadence: jsonModel.cadence,
+            amount: jsonModel.amount,
+            duration: jsonModel.duration,
+            duration_in_months: jsonModel.duration_in_months,
+            currency_restriction: jsonModel.currency_restriction,
+            currency: jsonModel.currency,
+            status: jsonModel.status,
+            tier: jsonModel.tier
+        };
+
+        return serialized;
+    }
+
+    return jsonModel;
+};