ghost 5.61.3 → 5.63.0

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -1,4 +1,5 @@
 //@ts-check
+const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:members');
 const {unparse} = require('@tryghost/members-csv');
 const mappers = require('./mappers');
@@ -113,6 +114,26 @@ function serializeAttribution(attribution) {
     };
 }
 
+function serializeNewsletter(newsletter) {
+    const newsletterFields = [
+        'id',
+        'name',
+        'description',
+        'status'
+    ];
+
+    return _.pick(newsletter, newsletterFields);
+}
+
+function serializeNewsletters(newsletters) {
+    return newsletters
+        .filter(newsletter => newsletter.status === 'active')
+        .sort((a, b) => {
+            return a.sort_order - b.sort_order;
+        })
+        .map(newsletter => serializeNewsletter(newsletter));
+}
+
 /**
  * @param {import('bookshelf').Model} member
  * @param {object} options
@@ -174,11 +195,7 @@ function serializeMember(member, options) {
     serialized.email_suppression = json.email_suppression;
 
     if (json.newsletters) {
-        serialized.newsletters = json.newsletters
-            .filter(newsletter => newsletter.status === 'active')
-            .sort((a, b) => {
-                return a.sort_order - b.sort_order;
-            });
+        serialized.newsletters = serializeNewsletters(json.newsletters);
     }
     // override the `subscribed` param to mean "subscribed to any active newsletter"
     serialized.subscribed = false;

package/core/server/api/endpoints/utils/serializers/output/site.js

@@ -11,10 +11,12 @@ module.exports = {
                 'description',
                 'logo',
                 'icon',
+                'cover_image',
                 'accent_color',
                 'locale',
                 'url',
                 'version',
+                'allow_self_signup',
                 'sentry_dsn',
                 'sentry_env'
             ])

package/core/server/data/exporter/table-lists.js

@@ -51,7 +51,9 @@ const BACKUP_TABLES = [
     'milestones',
     'collections',
     'collections_posts',
-    'recommendations'
+    'recommendations',
+    'recommendation_click_events',
+    'recommendation_subscribe_events'
 ];
 
 // NOTE: exposing only tables which are going to be included in a "default" export file

package/core/server/data/migrations/versions/5.63/2023-09-12-11-22-10-add-recommendation-click-events-table.js

@@ -0,0 +1,8 @@
+const {addTable} = require('../../utils');
+
+module.exports = addTable('recommendation_click_events', {
+    id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+    recommendation_id: {type: 'string', maxlength: 24, nullable: false, references: 'recommendations.id', unique: false, cascadeDelete: true},
+    member_id: {type: 'string', maxlength: 24, nullable: true, references: 'members.id', unique: false, setNullDelete: true},
+    created_at: {type: 'dateTime', nullable: false}
+});

package/core/server/data/migrations/versions/5.63/2023-09-12-11-22-11-add-recommendation-subscribe-events-table.js

@@ -0,0 +1,8 @@
+const {addTable} = require('../../utils');
+
+module.exports = addTable('recommendation_subscribe_events', {
+    id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+    recommendation_id: {type: 'string', maxlength: 24, nullable: false, references: 'recommendations.id', unique: false, cascadeDelete: true},
+    member_id: {type: 'string', maxlength: 24, nullable: true, references: 'members.id', unique: false, setNullDelete: true},
+    created_at: {type: 'dateTime', nullable: false}
+});

package/core/server/data/migrations/versions/5.63/2023-09-13-13-03-10-add-ghost-core-content-integration.js

@@ -0,0 +1,57 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const logging = require('@tryghost/logging');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+const coreContentIntegration = {
+    slug: 'ghost-core-content',
+    name: 'Ghost Core Content API',
+    description: 'Internal Content API integration for Admin access',
+    type: 'core'
+};
+
+const addIntegration = async (knex, integration) => {
+    const message = `Adding "${integration.name}" integration`;
+
+    const existing = await knex('integrations').select('id').where('slug', integration.slug).first();
+
+    if (existing?.id) {
+        logging.warn(`Skipping ${message} - already exists`);
+        return;
+    }
+
+    logging.info(message);
+
+    const now = knex.raw('CURRENT_TIMESTAMP');
+    integration.id = (new ObjectID()).toHexString();
+    integration.created_at = now;
+    integration.created_by = meta.MIGRATION_USER;
+
+    await knex('integrations').insert(integration);
+};
+
+const removeIntegration = async (knex, integration) => {
+    const message = `Removing ${integration.name} integration`;
+
+    const existing = await knex('integrations').select('id').where('slug', integration.slug).first();
+
+    if (!existing?.id) {
+        logging.warn(`Skipping ${message} - doesn't exist`);
+        return;
+    }
+
+    logging.info(message);
+
+    await knex('api_keys').where('integration_id', existing.id).del();
+    await knex('integrations').where('id', existing.id).del();
+};
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        await addIntegration(knex, coreContentIntegration);
+    },
+    async function down(knex) {
+        await removeIntegration(knex, coreContentIntegration);
+    }
+);

package/core/server/data/migrations/versions/5.63/2023-09-13-13-34-11-add-ghost-core-content-integration-key.js

@@ -0,0 +1,87 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const {InternalServerError} = require('@tryghost/errors');
+const logging = require('@tryghost/logging');
+const security = require('@tryghost/security');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+const coreContentIntegration = {
+    slug: 'ghost-core-content',
+    name: 'Ghost Core Content API',
+    description: 'Internal Content API integration for Admin access',
+    type: 'core'
+};
+
+const addIntegrationContentKey = async (knex, integration) => {
+    const message = `Adding "${integration.name}" integration content key`;
+
+    const existingIntegration = await knex('integrations').select('id').where({
+        slug: integration.slug
+    }).first();
+
+    if (!existingIntegration) {
+        throw new InternalServerError({
+            message: `Could not find "${integration.name}" integration`
+        });
+    }
+
+    const existing = await knex('api_keys').select('id')
+        .where('integration_id', existingIntegration.id)
+        .where('type', 'content')
+        .first();
+
+    if (existing?.id) {
+        logging.warn(`Skipping ${message} - already exists`);
+        return;
+    }
+
+    logging.info(message);
+
+    await knex('api_keys').insert({
+        id: (new ObjectID()).toHexString(),
+        type: 'content',
+        secret: security.secret.create('content'),
+        role_id: null,
+        integration_id: existingIntegration.id,
+        created_at: knex.raw('current_timestamp'),
+        created_by: meta.MIGRATION_USER
+    });
+};
+
+const removeIntegrationContentKey = async (knex, integration) => {
+    const message = `Removing "${integration.name}" integration content key`;
+
+    const existingIntegration = await knex('integrations').select('id').where({
+        slug: integration.slug
+    }).first();
+
+    if (!existingIntegration?.id) {
+        logging.warn(`Skipping ${message} - integration does not exist`);
+        return;
+    }
+
+    const existing = await knex('api_keys').select('id').where({
+        integration_id: existingIntegration.id,
+        type: 'content'
+    }).first();
+
+    if (!existing?.id) {
+        logging.warn(`Skipping ${message} - content key does not exist`);
+        return;
+    }
+
+    logging.info(message);
+
+    await knex('api_keys').where('id', existing.id).del();
+};
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        await addIntegrationContentKey(knex, coreContentIntegration);
+    },
+
+    async function down(knex) {
+        await removeIntegrationContentKey(knex, coreContentIntegration);
+    }
+);

package/core/server/data/schema/fixtures/fixtures.json

@@ -807,6 +807,13 @@
                     "description": "Internal frontend integration",
                     "type": "internal",
                     "api_keys": [{"type": "content"}]
+                },
+                {
+                    "slug": "ghost-core-content",
+                    "name": "Ghost Core Content API",
+                    "description": "Internal Content API integration for Admin access",
+                    "type": "core",
+                    "api_keys": [{"type": "content"}]
                 }
             ]
         }

package/core/server/data/schema/schema.js

@@ -1079,5 +1079,17 @@ module.exports = {
         one_click_subscribe: {type: 'boolean', nullable: false, defaultTo: false},
         created_at: {type: 'dateTime', nullable: false},
         updated_at: {type: 'dateTime', nullable: true}
+    },
+    recommendation_click_events: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        recommendation_id: {type: 'string', maxlength: 24, nullable: false, references: 'recommendations.id', unique: false, cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, references: 'members.id', unique: false, setNullDelete: true},
+        created_at: {type: 'dateTime', nullable: false}
+    },
+    recommendation_subscribe_events: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        recommendation_id: {type: 'string', maxlength: 24, nullable: false, references: 'recommendations.id', unique: false, cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, references: 'members.id', unique: false, setNullDelete: true},
+        created_at: {type: 'dateTime', nullable: false}
     }
 };

package/core/server/lib/lexical.js

@@ -1,4 +1,5 @@
 const path = require('path');
+const errors = require('@tryghost/errors');
 const urlUtils = require('../../shared/url-utils');
 const config = require('../../shared/config');
 const storage = require('../adapters/storage');
@@ -6,6 +7,7 @@ const storage = require('../adapters/storage');
 let nodes;
 let lexicalHtmlRenderer;
 let urlTransformMap;
+let postsService;
 
 function populateNodes() {
     const {DEFAULT_NODES} = require('@tryghost/kg-default-nodes');
@@ -27,6 +29,23 @@ module.exports = {
     },
 
     async render(lexical, userOptions = {}) {
+        if (!postsService) {
+            const getPostServiceInstance = require('../services/posts/posts-service');
+            postsService = getPostServiceInstance();
+        }
+
+        const getCollectionPosts = async (collectionSlug, postCount) => {
+            const transacting = userOptions.transacting;
+            const {data} = await postsService.browsePosts({
+                context: {public: true}, // mimic Content API request
+                collection: collectionSlug,
+                limit: postCount,
+                transacting
+            });
+            let posts = data.map(p => p.toJSON());
+            return posts;
+        };
+
         const options = Object.assign({
             siteUrl: config.get('url'),
             imageOptimization: config.get('imageOptimization'),
@@ -42,7 +61,8 @@ module.exports = {
             createDocument() {
                 const {JSDOM} = require('jsdom');
                 return (new JSDOM()).window.document;
-            }
+            },
+            getCollectionPosts
         }, userOptions);
 
         return await this.lexicalHtmlRenderer.render(lexical, options);
@@ -78,5 +98,19 @@ module.exports = {
         }
 
         return urlTransformMap;
+    },
+
+    get htmlToLexicalConverter() {
+        try {
+            return require('@tryghost/kg-html-to-lexical').htmlToLexical;
+        } catch (err) {
+            throw new errors.InternalServerError({
+                message: 'Unable to convert from source HTML to Lexical',
+                context: 'The html-to-lexical package was not installed',
+                help: 'Please review any errors from the install process by checking the Ghost logs',
+                code: 'HTML_TO_LEXICAL_INSTALLATION',
+                err: err
+            });
+        }
     }
 };

package/core/server/models/post.js

@@ -552,6 +552,16 @@ Post = ghostBookshelf.Model.extend({
         let tagsToSave;
         const ops = [];
 
+        // normally we don't allow both mobiledoc & lexical through at the API level but there's
+        // an exception for ?source=html which always sets both when the lexical editor is enabled.
+        // That's necessary because at the input serializer layer we don't have access to the
+        // actual model to check if this would result in a change of format
+        if (this.previous('mobiledoc') && this.get('lexical')) {
+            this.set('lexical', null);
+        } else if (this.get('mobiledoc') && this.get('lexical')) {
+            this.set('mobiledoc', null);
+        }
+
         // CASE: disallow published -> scheduled
         // @TODO: remove when we have versioning based on updated_at
         if (newStatus !== olderStatus && newStatus === 'scheduled' && olderStatus === 'published') {
@@ -653,7 +663,7 @@ Post = ghostBookshelf.Model.extend({
 
         // If we're force re-rendering we want to make sure that all image cards
         // have original dimensions stored in the payload for use by card renderers
-        if (options.force_rerender) {
+        if (options.force_rerender && this.get('mobiledoc')) {
             this.set('mobiledoc', await mobiledocLib.populateImageSizes(this.get('mobiledoc')));
         }
 
@@ -690,7 +700,7 @@ Post = ghostBookshelf.Model.extend({
             )
         ) {
             try {
-                this.set('html', await lexicalLib.render(this.get('lexical')));
+                this.set('html', await lexicalLib.render(this.get('lexical'), {transacting: options.transacting}));
             } catch (err) {
                 throw new errors.ValidationError({
                     message: tpl(messages.invalidLexicalStructure),

package/core/server/models/recommendation-click-event.js

@@ -0,0 +1,22 @@
+const errors = require('@tryghost/errors');
+const ghostBookshelf = require('./base');
+
+const RecommendationClickEvent = ghostBookshelf.Model.extend({
+    tableName: 'recommendation_click_events'
+}, {
+    async edit() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot edit RecommendationClickEvent'
+        });
+    },
+
+    async destroy() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot destroy RecommendationClickEvent'
+        });
+    }
+});
+
+module.exports = {
+    RecommendationClickEvent: ghostBookshelf.model('RecommendationClickEvent', RecommendationClickEvent)
+};

package/core/server/models/recommendation-subscribe-event.js

@@ -0,0 +1,22 @@
+const errors = require('@tryghost/errors');
+const ghostBookshelf = require('./base');
+
+const RecommendationSubscribeEvent = ghostBookshelf.Model.extend({
+    tableName: 'recommendation_subscribe_events'
+}, {
+    async edit() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot edit RecommendationSubscribeEvent'
+        });
+    },
+
+    async destroy() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot destroy RecommendationSubscribeEvent'
+        });
+    }
+});
+
+module.exports = {
+    RecommendationSubscribeEvent: ghostBookshelf.model('RecommendationSubscribeEvent', RecommendationSubscribeEvent)
+};

package/core/server/services/collections/BookshelfCollectionsRepository.js

@@ -1,6 +1,7 @@
 const logger = require('@tryghost/logging');
 const Collection = require('@tryghost/collections').Collection;
 const sentry = require('../../../shared/sentry');
+const {default: ObjectID} = require('bson-objectid');
 /**
  * @typedef {import('@tryghost/collections/src/CollectionRepository')} CollectionRepository
  */
@@ -10,8 +11,10 @@ const sentry = require('../../../shared/sentry');
  */
 module.exports = class BookshelfCollectionsRepository {
     #model;
-    constructor(model) {
+    #relationModel;
+    constructor(model, relationModel) {
         this.#model = model;
+        this.#relationModel = relationModel;
     }
 
     async createTransaction(cb) {
@@ -101,10 +104,21 @@ module.exports = class BookshelfCollectionsRepository {
      * @returns {Promise<void>}
      */
     async save(collection, options = {}) {
+        if (!options.transaction) {
+            return this.createTransaction((transaction) => {
+                return this.save(collection, {
+                    ...options,
+                    transaction
+                });
+            });
+        }
+
         if (collection.deleted) {
-            await this.#model.destroy({id: collection.id});
+            await this.#relationModel.query().delete().where('collection_id', collection.id).transacting(options.transaction);
+            await this.#model.query().delete().where('id', collection.id).transacting(options.transaction);
             return;
         }
+
         const data = {
             id: collection.id,
             slug: collection.slug,
@@ -113,7 +127,6 @@ module.exports = class BookshelfCollectionsRepository {
             filter: collection.filter,
             type: collection.type,
             feature_image: collection.featureImage || null,
-            posts: collection.posts.map(postId => ({id: postId})),
             created_at: collection.createdAt,
             updated_at: collection.updatedAt
         };
@@ -122,7 +135,8 @@ module.exports = class BookshelfCollectionsRepository {
             {id: data.id},
             {
                 require: false,
-                transacting: options.transaction
+                transacting: options.transaction,
+                withRelated: ['collectionPosts']
             }
         );
 
@@ -130,11 +144,59 @@ module.exports = class BookshelfCollectionsRepository {
             await this.#model.add(data, {
                 transacting: options.transaction
             });
+            const collectionPostsRelations = collection.posts.map((postId, index) => {
+                return {
+                    id: (new ObjectID).toHexString(),
+                    sort_order: collection.type === 'manual' ? index : 0,
+                    collection_id: collection.id,
+                    post_id: postId
+                };
+            });
+            if (collectionPostsRelations.length > 0) {
+                await this.#relationModel.query().insert(collectionPostsRelations).transacting(options.transaction);
+            }
         } else {
-            return this.#model.edit(data, {
+            await this.#model.edit(data, {
                 id: data.id,
                 transacting: options.transaction
             });
+
+            const collectionPostsRelations = collection.posts.map((postId, index) => {
+                return {
+                    id: (new ObjectID).toHexString(),
+                    sort_order: collection.type === 'manual' ? index : 0,
+                    collection_id: collection.id,
+                    post_id: postId
+                };
+            });
+
+            const collectionPostRelationsToDeleteIds = [];
+
+            if (collection.type === 'manual') {
+                await this.#relationModel.query().delete().where('collection_id', collection.id).transacting(options.transaction);
+            } else {
+                const existingRelations = existing.toJSON().collectionPosts;
+
+                for (const existingRelation of existingRelations) {
+                    const found = collectionPostsRelations.find((thing) => {
+                        return thing.post_id === existingRelation.post_id;
+                    });
+                    if (found) {
+                        found.id = null;
+                    } else {
+                        collectionPostRelationsToDeleteIds.push(existingRelation.id);
+                    }
+                }
+            }
+
+            const missingCollectionPostsRelations = collectionPostsRelations.filter(thing => thing.id !== null);
+
+            if (missingCollectionPostsRelations.length > 0) {
+                await this.#relationModel.query().insert(missingCollectionPostsRelations).transacting(options.transaction);
+            }
+            if (collectionPostRelationsToDeleteIds.length > 0) {
+                await this.#relationModel.query().delete().whereIn('id', collectionPostRelationsToDeleteIds).transacting(options.transaction);
+            }
         }
     }
 };

package/core/server/services/collections/service.js

@@ -12,7 +12,7 @@ class CollectionsServiceWrapper {
         const DomainEvents = require('@tryghost/domain-events');
         const postsRepository = require('./PostsRepository').getInstance();
         const models = require('../../models');
-        const collectionsRepositoryInMemory = new BookshelfCollectionsRepository(models.Collection);
+        const collectionsRepositoryInMemory = new BookshelfCollectionsRepository(models.Collection, models.CollectionPost);
 
         const collectionsService = new CollectionsService({
             collectionsRepository: collectionsRepositoryInMemory,
@@ -33,16 +33,16 @@ class CollectionsServiceWrapper {
     async init() {
         const config = require('../../../shared/config');
         const labs = require('../../../shared/labs');
+
         // host setting OR labs "collections" flag has to be enabled to run collections service
-        if (!config.get('hostSettings:collections:enabled') && !(labs.isSet('collections'))) {
-            return;
-        }
+        if (config.get('hostSettings:collections:enabled') || labs.isSet('collections')) {
+            if (inited) {
+                return;
+            }
 
-        if (inited) {
-            return;
+            inited = true;
+            this.api.subscribeToEvents();
         }
-        inited = true;
-        this.api.subscribeToEvents();
     }
 }
 

package/core/server/services/members/middleware.js

@@ -5,7 +5,10 @@ const emailSuppressionList = require('../email-suppression-list');
 const models = require('../../models');
 const urlUtils = require('../../../shared/url-utils');
 const spamPrevention = require('../../web/shared/middleware/api/spam-prevention');
-const {formattedMemberResponse} = require('./utils');
+const {
+    formattedMemberResponse,
+    formatNewsletterResponse
+} = require('./utils');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 
@@ -144,6 +147,11 @@ const getMemberNewsletters = async function getMemberNewsletters(req, res) {
         }
 
         const data = _.pick(memberData.toJSON(), 'uuid', 'email', 'name', 'newsletters', 'enable_comment_notifications', 'status');
+
+        if (data.newsletters) {
+            data.newsletters = formatNewsletterResponse(data.newsletters);
+        }
+
         return res.json(data);
     } catch (err) {
         res.writeHead(400);
@@ -175,6 +183,11 @@ const updateMemberNewsletters = async function updateMemberNewsletters(req, res)
 
         const updatedMember = await membersService.api.members.update(data, options);
         const updatedMemberData = _.pick(updatedMember.toJSON(), ['uuid', 'email', 'name', 'newsletters', 'enable_comment_notifications', 'status']);
+
+        if (updatedMemberData.newsletters) {
+            updatedMemberData.newsletters = formatNewsletterResponse(updatedMemberData.newsletters);
+        }
+
         res.json(updatedMemberData);
     } catch (err) {
         res.writeHead(400);

package/core/server/services/members/utils.js

@@ -4,6 +4,7 @@ function formatNewsletterResponse(newsletters) {
     });
 }
 
+module.exports.formatNewsletterResponse = formatNewsletterResponse;
 module.exports.formattedMemberResponse = function formattedMemberResponse(member) {
     if (!member) {
         return null;