ghost 5.5.0 → 5.7.1

package/core/server/services/bulk-email/bulk-email-processor.js

@@ -7,6 +7,7 @@ const logging = require('@tryghost/logging');
 const models = require('../../models');
 const mailgunProvider = require('./mailgun');
 const sentry = require('../../../shared/sentry');
+const labs = require('../../../shared/labs');
 const debug = require('@tryghost/debug')('mega');
 const postEmailSerializer = require('../mega/post-email-serializer');
 
@@ -170,6 +171,11 @@ module.exports = {
             // Load newsletter data on email
             await emailBatchModel.relations.email.getLazyRelation('newsletter', {require: false, ...knexOptions});
 
+            if (labs.isSet('newsletterPaywall')) {
+                // Load post data on email - for content gating on paywall
+                await emailBatchModel.relations.email.getLazyRelation('post', {require: false, ...knexOptions});
+            }
+
             // send the email
             const sendResponse = await this.send(emailBatchModel.relations.email.toJSON(), recipientRows, memberSegment);
 

package/core/server/services/comments/controller.js

@@ -0,0 +1,92 @@
+/**
+ * @typedef {import('../../api/shared/frame')} Frame
+ */
+
+const {MethodNotAllowedError} = require('@tryghost/errors');
+const tpl = require('@tryghost/tpl');
+
+const messages = {
+    cannotDestroyComments: 'You cannot destroy comments.'
+};
+
+module.exports = class CommentsController {
+    /**
+     * @param {import('./service')} service
+     * @param {import('./stats')} stats
+     */
+    constructor(service, stats) {
+        this.service = service;
+        this.stats = stats;
+    }
+
+    /**
+     * @param {Frame} frame
+     */
+    async browse(frame) {
+        return this.service.getComments(frame.options);
+    }
+
+    /**
+     * @param {Frame} frame
+     */
+    async read(frame) {
+        return await this.service.getCommentByID(frame.data.id, frame.options);
+    }
+
+    /**
+     * @param {Frame} frame
+     */
+    async edit(frame) {
+        if (frame.data.comments[0].status === 'deleted') {
+            return await this.service.deleteComment(
+                frame.options.id,
+                frame?.options?.context?.member?.id,
+                frame.options
+            );
+        }
+
+        return await this.service.editCommentContent(
+            frame.options.id,
+            frame?.options?.context?.member?.id,
+            frame.data.comments[0].html,
+            frame.options
+        );
+    }
+
+    /**
+     * @param {Frame} frame
+     */
+    async add(frame) {
+        const data = frame.data.comments[0];
+
+        if (data.parent_id) {
+            return await this.service.replyToComment(
+                data.parent_id,
+                frame.options.context.member.id,
+                data.html,
+                frame.options
+            );
+        }
+
+        return await this.service.commentOnPost(
+            data.post_id,
+            frame.options.context.member.id,
+            data.html,
+            frame.options
+        );
+    }
+
+    async destroy() {
+        throw new MethodNotAllowedError({
+            message: tpl(messages.cannotDestroyComments)
+        });
+    }
+
+    async count(frame) {
+        if (!frame?.data?.ids) {
+            return await this.stats.getAllCounts();
+        }
+
+        return await this.stats.getCountsByPost(frame.data.ids);
+    }
+};

package/core/server/services/comments/email-templates/new-comment-reply.hbs

@@ -106,7 +106,7 @@
           <div class="content" style="box-sizing: border-box; display: block; Margin: 0 auto; max-width: 600px; padding: 30px 20px;">
 
             <!-- START CENTERED CONTAINER -->
-            <span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">Someone left a comment on your post</span>
+            <span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">Someone just replied to your comment</span>
             <table class="main" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; background: #ffffff; border-radius: 8px;">
 
               <!-- START MAIN CONTENT AREA -->
@@ -116,7 +116,7 @@
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
                         <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 20px; color: #15212A; font-weight: bold; line-height: 25px; margin: 0; margin-bottom: 15px;">Hey there,</p>
-                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 32px;">Someone just replied to your comment on <a href="{{postUrl}}" target="_blank">{{postTitle}}</a>.</p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 32px;">Someone just replied to your comment on <a href="{{postUrl}}" target="_blank" style="font-weight: bold; text-decoration: underline;">{{postTitle}}</a>.</p>
 
                         <table border="0" cellpadding="0" cellspacing="0" class="btn btn-primary" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; box-sizing: border-box; background: #F9F9FA; border-radius: 7px;">
                         <tbody>
@@ -154,7 +154,7 @@
                                 <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: auto;">
                                   <tbody>
                                     <tr>
-                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: {{accentColor}}; border-radius: 5px; text-align: center;"> <a href="{{postUrl}}#ghost-comments-root" target="_blank" style="display: inline-block; color: #ffffff; background-color: {{accentColor}}; border: solid 1px {{accentColor}}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: {{accentColor}};">View comments</a> </td>
+                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: {{accentColor}}; border-radius: 5px; text-align: center;"> <a href="{{postUrl}}#ghost-comments" target="_blank" style="display: inline-block; color: #ffffff; background-color: {{accentColor}}; border: solid 1px {{accentColor}}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: {{accentColor}};">View comments</a> </td>
                                     </tr>
                                   </tbody>
                                 </table>
@@ -164,7 +164,7 @@
                         </table>
                         <hr/>
                         <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 5px;">You can also copy & paste this URL into your browser:</p>
-                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top:0; color: #3A464C;">{{postUrl}}#ghost-comments-root</p>
+                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top:0; color: #3A464C;">{{postUrl}}#ghost-comments</p>
                       </td>
                     </tr>
 

package/core/server/services/comments/email-templates/new-comment-reply.txt.js

@@ -4,7 +4,7 @@ module.exports = function (data) {
 
 Someone just replied to your comment on "${data.postTitle}"
 
-${data.postUrl}#ghost-comments-root
+${data.postUrl}#ghost-comments
 
 ---
 

package/core/server/services/comments/email-templates/new-comment.hbs

@@ -116,7 +116,7 @@
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
                         <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 20px; color: #15212A; font-weight: bold; line-height: 25px; margin: 0; margin-bottom: 15px;">Hey there,</p>
-                          <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 32px;">Someone just left a comment on your post <a href="{{postUrl}}" target="_blank">{{postTitle}}</a>.</p>
+                          <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 32px;">Someone just left a comment on your post <a href="{{postUrl}}" target="_blank" style="font-weight: bold; text-decoration: underline;">{{postTitle}}</a>.</p>
 
                         <table border="0" cellpadding="0" cellspacing="0" class="btn btn-primary" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; box-sizing: border-box; background: #F9F9FA; border-radius: 7px;">
                         <tbody>
@@ -154,7 +154,7 @@
                                 <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: auto;">
                                   <tbody>
                                     <tr>
-                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: {{accentColor}}; border-radius: 5px; text-align: center;"> <a href="{{postUrl}}#ghost-comments-root" target="_blank" style="display: inline-block; color: #ffffff; background-color: {{accentColor}}; border: solid 1px {{accentColor}}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: {{accentColor}};">View comments</a> </td>
+                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: {{accentColor}}; border-radius: 5px; text-align: center;"> <a href="{{postUrl}}#ghost-comments" target="_blank" style="display: inline-block; color: #ffffff; background-color: {{accentColor}}; border: solid 1px {{accentColor}}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: {{accentColor}};">View comments</a> </td>
                                     </tr>
                                   </tbody>
                                 </table>
@@ -164,7 +164,7 @@
                         </table>
                         <hr/>
                         <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 5px;">You can also copy & paste this URL into your browser:</p>
-                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top:0; color: #3A464C;">{{postUrl}}#ghost-comments-root</p>
+                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top:0; color: #3A464C;">{{postUrl}}#ghost-comments</p>
                       </td>
                     </tr>
 

package/core/server/services/comments/email-templates/new-comment.txt.js

@@ -5,7 +5,7 @@ Hey there,
 
 Someone just posted a comment on your post "${data.postTitle}"
 
-${data.postUrl}#ghost-comments-root
+${data.postUrl}#ghost-comments
 
 ---
 

package/core/server/services/comments/email-templates/report.hbs

@@ -154,7 +154,7 @@
                                 <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: auto;">
                                   <tbody>
                                     <tr>
-                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: {{accentColor}}; border-radius: 5px; text-align: center;"> <a href="{{postUrl}}#ghost-comments-root" target="_blank" style="display: inline-block; color: #ffffff; background-color: {{accentColor}}; border: solid 1px {{accentColor}}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: {{accentColor}};">View comment</a> </td>
+                                      <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: {{accentColor}}; border-radius: 5px; text-align: center;"> <a href="{{postUrl}}#ghost-comments" target="_blank" style="display: inline-block; color: #ffffff; background-color: {{accentColor}}; border: solid 1px {{accentColor}}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: {{accentColor}};">View comment</a> </td>
                                     </tr>
                                   </tbody>
                                 </table>
@@ -164,7 +164,7 @@
                         </table>
                         <hr/>
                         <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 5px;">You can also copy & paste this URL into your browser:</p>
-                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top:0; color: #3A464C;">{{postUrl}}#ghost-comments-root</p>
+                        <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 25px; margin-top:0; color: #3A464C;">{{postUrl}}#ghost-comments</p>
                       </td>
                     </tr>
 

package/core/server/services/comments/email-templates/report.txt.js

@@ -7,7 +7,7 @@ ${data.reporter} has reported the comment below on ${data.postTitle}. This comme
 ${data.memberName} (${data.memberEmail}):
 ${data.commentText}
 
-${data.postUrl}#ghost-comments-root
+${data.postUrl}#ghost-comments
 
 ---
 

package/core/server/services/comments/emails.js

@@ -26,7 +26,7 @@ class CommentsServiceEmails {
             }
 
             const to = author.get('email');
-            const subject = '💬 You have a new comment on one of your posts';
+            const subject = '💬 New comment on your post: ' + post.get('title');
 
             const memberName = member.get('name') || 'Anonymous';
 
@@ -72,7 +72,7 @@ class CommentsServiceEmails {
         }
 
         const to = parentMember.get('email');
-        const subject = '💬 You have a new reply on one of your comments';
+        const subject = '↪️ New reply to your comment on ' + this.settingsCache.get('title');
 
         const post = await this.models.Post.findOne({id: reply.get('post_id')});
         const member = await this.models.Member.findOne({id: reply.get('member_id')});
@@ -129,7 +129,7 @@ class CommentsServiceEmails {
             postTitle: post.get('title'),
             postUrl: this.urlService.getUrlByResourceId(post.get('id'), {absolute: true}),
             commentHtml: comment.get('html'),
-            commentText: htmlToPlaintext.email(comment.get('html')),
+            commentText: htmlToPlaintext.comment(comment.get('html')),
             commentDate: moment(comment.get('created_at')).tz(this.settingsCache.get('timezone')).format('D MMM YYYY'),
             
             reporterName: reporter.name,

package/core/server/services/comments/index.js

@@ -1,6 +1,8 @@
 class CommentsServiceWrapper {
     init() {
         const CommentsService = require('./service');
+        const CommentsController = require('./controller');
+        const CommentsStats = require('./stats');
 
         const config = require('../../../shared/config');
         const logging = require('@tryghost/logging');
@@ -10,6 +12,8 @@ class CommentsServiceWrapper {
         const settingsCache = require('../../../shared/settings-cache');
         const urlService = require('../url');
         const urlUtils = require('../../../shared/url-utils');
+        const membersService = require('../members');
+        const db = require('../../data/db');
 
         this.api = new CommentsService({
             config,
@@ -18,8 +22,13 @@ class CommentsServiceWrapper {
             mailer,
             settingsCache,
             urlService,
-            urlUtils
+            urlUtils,
+            contentGating: membersService.contentGating
         });
+
+        const stats = new CommentsStats({db});
+
+        this.controller = new CommentsController(this.api, stats);
     }
 }
 

package/core/server/services/comments/service.js

@@ -8,23 +8,75 @@ const messages = {
     memberNotFound: 'Unable to find member',
     likeNotFound: 'Unable to find like',
     alreadyLiked: 'This comment was liked already',
-    replyToReply: 'Can not reply to a reply'
+    replyToReply: 'Can not reply to a reply',
+    commentsNotEnabled: 'Comments are not enabled for this site.',
+    cannotCommentOnPost: 'You do not have permission to comment on this post.'
 };
 
 class CommentsService {
-    constructor({config, logging, models, mailer, settingsCache, urlService, urlUtils}) {
-        this.config = config;
-        this.logging = logging;
+    constructor({config, logging, models, mailer, settingsCache, urlService, urlUtils, contentGating}) {
+        /** @private */
         this.models = models;
-        this.mailer = mailer;
+
+        /** @private */
         this.settingsCache = settingsCache;
-        this.urlService = urlService;
-        this.urlUtils = urlUtils;
+
+        /** @private */
+        this.contentGating = contentGating;
 
         const Emails = require('./emails');
-        this.emails = new Emails(this);
+        /** @private */
+        this.emails = new Emails({
+            config,
+            logging,
+            models,
+            mailer,
+            settingsCache,
+            urlService,
+            urlUtils
+        });
+    }
+
+    /**
+     * @returns {'off'|'all'|'paid'}
+     */
+    get enabled() {
+        const setting = this.settingsCache.get('comments_enabled');
+        if (setting === 'off' || setting === 'all' || setting === 'paid') {
+            return setting;
+        }
+        return 'off';
+    }
+
+    /** @private */
+    checkEnabled() {
+        if (this.enabled === 'off') {
+            throw new errors.MethodNotAllowedError({
+                message: tpl(messages.commentsNotEnabled)
+            });
+        }
+    }
+
+    /** @private */
+    checkCommentAccess(memberModel) {
+        if (this.enabled === 'paid' && memberModel.get('status') === 'free') {
+            throw new errors.NoPermissionError({
+                message: tpl(messages.cannotCommentOnPost)
+            });
+        }
+    }
+
+    /** @private */
+    checkPostAccess(postModel, memberModel) {
+        const access = this.contentGating.checkPostAccess(postModel.toJSON(), memberModel.toJSON());
+        if (access === this.contentGating.BLOCK_ACCESS) {
+            throw new errors.NoPermissionError({
+                message: tpl(messages.cannotCommentOnPost)
+            });
+        }
     }
 
+    /** @private */
     async sendNewCommentNotifications(comment) {
         await this.emails.notifyPostAuthors(comment);
 
@@ -34,6 +86,7 @@ class CommentsService {
     }
 
     async reportComment(commentId, reporter) {
+        this.checkEnabled();
         const comment = await this.models.Comment.findOne({id: commentId}, {require: true});
 
         // Check if this reporter already reported this comment (then don't send an email)?
@@ -56,11 +109,22 @@ class CommentsService {
         await this.emails.notifiyReport(comment, reporter);
     }
 
+    /**
+     * @param {any} options
+     */
+    async getComments(options) {
+        this.checkEnabled();
+        const page = await this.models.Comment.findPage(options);
+
+        return page;
+    }
+
     /**
      * @param {string} id - The ID of the Comment to get
      * @param {any} options
      */
     async getCommentByID(id, options) {
+        this.checkEnabled();
         const model = await this.models.Comment.findOne({id}, options);
 
         if (!model) {
@@ -79,13 +143,25 @@ class CommentsService {
      * @param {any} options
      */
     async commentOnPost(post, member, comment, options) {
-        await this.models.Member.findOne({
+        this.checkEnabled();
+        const memberModel = await this.models.Member.findOne({
             id: member
         }, {
             require: true,
             ...options
         });
 
+        this.checkCommentAccess(memberModel);
+
+        const postModel = await this.models.Post.findOne({
+            id: post
+        }, {
+            require: true,
+            ...options
+        });
+
+        this.checkPostAccess(postModel, memberModel);
+
         const model = await this.models.Comment.add({
             post_id: post,
             member_id: member,
@@ -114,13 +190,16 @@ class CommentsService {
      * @param {any} options
      */
     async replyToComment(parent, member, comment, options) {
-        await this.models.Member.findOne({
+        this.checkEnabled();
+        const memberModel = await this.models.Member.findOne({
             id: member
         }, {
             require: true,
             ...options
         });
 
+        this.checkCommentAccess(memberModel);
+
         const parentComment = await this.getCommentByID(parent, options);
         if (!parentComment) {
             throw new errors.BadRequestError({
@@ -133,6 +212,14 @@ class CommentsService {
                 message: tpl(messages.replyToReply)
             });
         }
+        const postModel = await this.models.Post.findOne({
+            id: parentComment.get('post_id')
+        }, {
+            require: true,
+            ...options
+        });
+
+        this.checkPostAccess(postModel, memberModel);
 
         const model = await this.models.Comment.add({
             post_id: parentComment.get('post_id'),
@@ -161,6 +248,7 @@ class CommentsService {
      * @param {any} options
      */
     async deleteComment(id, member, options) {
+        this.checkEnabled();
         const existingComment = await this.getCommentByID(id, options);
 
         if (existingComment.get('member_id') !== member) {
@@ -188,6 +276,7 @@ class CommentsService {
      * @param {any} options
      */
     async editCommentContent(id, member, comment, options) {
+        this.checkEnabled();
         const existingComment = await this.getCommentByID(id, options);
 
         if (!comment) {
@@ -202,7 +291,8 @@ class CommentsService {
         }
 
         const model = await this.models.Comment.edit({
-            html: comment
+            html: comment,
+            edited_at: new Date()
         }, {
             id,
             require: true,

package/core/server/services/comments/stats.js

@@ -0,0 +1,44 @@
+module.exports = class CommentsStatsService {
+    constructor(deps) {
+        this.db = deps.db;
+    }
+
+    /**
+     * @param {string[]} ids - List of post ids to fetch counts for
+     * @returns {Promise<Object<string, number>>}
+     */
+    async getCountsByPost(ids) {
+        const results = await this.db.knex('comments')
+            .select(this.db.knex.raw(`COUNT(*) AS count, post_id`))
+            .groupBy('post_id')
+            .whereIn('post_id', ids);
+
+        const counts = ids.reduce((memo, id) => {
+            const result = results.find(x => x.post_id === id);
+            return {
+                ...memo,
+                [id]: result?.count || 0
+            };
+        }, {});
+
+        return counts;
+    }
+
+    /**
+     * @returns {Promise<Object<string, number>>}
+     */
+    async getAllCounts() {
+        const results = await this.db.knex('comments')
+            .select(this.db.knex.raw(`COUNT(*) AS count, post_id`))
+            .groupBy('post_id');
+
+        /** @type Object<string, number> */
+        let counts = {};
+
+        for (const row of results) {
+            counts[row.post_id] = row.count;
+        }
+
+        return counts;
+    }
+};

package/core/server/services/mega/email-preview.js

@@ -36,7 +36,11 @@ class EmailPreview {
             );
         });
 
-        return emailContent;
+        return {
+            subject: emailContent.subject,
+            html: emailContent.html,
+            plaintext: emailContent.plaintext
+        };
     }
 }
 

package/core/server/services/mega/mega.js

@@ -69,6 +69,7 @@ const getEmailData = async (postModel, options) => {
     }
 
     return {
+        post: postModel.toJSON(), // for content paywalling
         subject,
         html,
         plaintext,
@@ -87,9 +88,6 @@ const sendTestEmail = async (postModel, toEmails, memberSegment) => {
     let emailData = await getEmailData(postModel);
     emailData.subject = `[Test] ${emailData.subject}`;
 
-    if (memberSegment) {
-        emailData = postEmailSerializer.renderEmailForSegment(emailData, memberSegment);
-    }
     // fetch any matching members so that replacements use expected values
     const recipients = await Promise.all(toEmails.map(async (email) => {
         const member = await membersService.api.members.get({email});
@@ -109,7 +107,7 @@ const sendTestEmail = async (postModel, toEmails, memberSegment) => {
     // enable tracking for previews to match real-world behaviour
     emailData.track_opens = !!settingsCache.get('email_track_opens');
 
-    const response = await bulkEmailService.send(emailData, recipients);
+    const response = await bulkEmailService.send(emailData, recipients, memberSegment);
 
     if (response instanceof bulkEmailService.FailedBatch) {
         return Promise.reject(response.error);