ghost 5.62.0 → 5.63.0

package/core/server/data/migrations/versions/5.63/2023-09-13-13-03-10-add-ghost-core-content-integration.js

@@ -0,0 +1,57 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const logging = require('@tryghost/logging');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+const coreContentIntegration = {
+    slug: 'ghost-core-content',
+    name: 'Ghost Core Content API',
+    description: 'Internal Content API integration for Admin access',
+    type: 'core'
+};
+
+const addIntegration = async (knex, integration) => {
+    const message = `Adding "${integration.name}" integration`;
+
+    const existing = await knex('integrations').select('id').where('slug', integration.slug).first();
+
+    if (existing?.id) {
+        logging.warn(`Skipping ${message} - already exists`);
+        return;
+    }
+
+    logging.info(message);
+
+    const now = knex.raw('CURRENT_TIMESTAMP');
+    integration.id = (new ObjectID()).toHexString();
+    integration.created_at = now;
+    integration.created_by = meta.MIGRATION_USER;
+
+    await knex('integrations').insert(integration);
+};
+
+const removeIntegration = async (knex, integration) => {
+    const message = `Removing ${integration.name} integration`;
+
+    const existing = await knex('integrations').select('id').where('slug', integration.slug).first();
+
+    if (!existing?.id) {
+        logging.warn(`Skipping ${message} - doesn't exist`);
+        return;
+    }
+
+    logging.info(message);
+
+    await knex('api_keys').where('integration_id', existing.id).del();
+    await knex('integrations').where('id', existing.id).del();
+};
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        await addIntegration(knex, coreContentIntegration);
+    },
+    async function down(knex) {
+        await removeIntegration(knex, coreContentIntegration);
+    }
+);

package/core/server/data/migrations/versions/5.63/2023-09-13-13-34-11-add-ghost-core-content-integration-key.js

@@ -0,0 +1,87 @@
+// For information on writing migrations, see https://www.notion.so/ghost/Database-migrations-eb5b78c435d741d2b34a582d57c24253
+
+const {InternalServerError} = require('@tryghost/errors');
+const logging = require('@tryghost/logging');
+const security = require('@tryghost/security');
+const {default: ObjectID} = require('bson-objectid');
+const {createTransactionalMigration, meta} = require('../../utils');
+
+const coreContentIntegration = {
+    slug: 'ghost-core-content',
+    name: 'Ghost Core Content API',
+    description: 'Internal Content API integration for Admin access',
+    type: 'core'
+};
+
+const addIntegrationContentKey = async (knex, integration) => {
+    const message = `Adding "${integration.name}" integration content key`;
+
+    const existingIntegration = await knex('integrations').select('id').where({
+        slug: integration.slug
+    }).first();
+
+    if (!existingIntegration) {
+        throw new InternalServerError({
+            message: `Could not find "${integration.name}" integration`
+        });
+    }
+
+    const existing = await knex('api_keys').select('id')
+        .where('integration_id', existingIntegration.id)
+        .where('type', 'content')
+        .first();
+
+    if (existing?.id) {
+        logging.warn(`Skipping ${message} - already exists`);
+        return;
+    }
+
+    logging.info(message);
+
+    await knex('api_keys').insert({
+        id: (new ObjectID()).toHexString(),
+        type: 'content',
+        secret: security.secret.create('content'),
+        role_id: null,
+        integration_id: existingIntegration.id,
+        created_at: knex.raw('current_timestamp'),
+        created_by: meta.MIGRATION_USER
+    });
+};
+
+const removeIntegrationContentKey = async (knex, integration) => {
+    const message = `Removing "${integration.name}" integration content key`;
+
+    const existingIntegration = await knex('integrations').select('id').where({
+        slug: integration.slug
+    }).first();
+
+    if (!existingIntegration?.id) {
+        logging.warn(`Skipping ${message} - integration does not exist`);
+        return;
+    }
+
+    const existing = await knex('api_keys').select('id').where({
+        integration_id: existingIntegration.id,
+        type: 'content'
+    }).first();
+
+    if (!existing?.id) {
+        logging.warn(`Skipping ${message} - content key does not exist`);
+        return;
+    }
+
+    logging.info(message);
+
+    await knex('api_keys').where('id', existing.id).del();
+};
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        await addIntegrationContentKey(knex, coreContentIntegration);
+    },
+
+    async function down(knex) {
+        await removeIntegrationContentKey(knex, coreContentIntegration);
+    }
+);

package/core/server/data/schema/fixtures/fixtures.json

@@ -807,6 +807,13 @@
                     "description": "Internal frontend integration",
                     "type": "internal",
                     "api_keys": [{"type": "content"}]
+                },
+                {
+                    "slug": "ghost-core-content",
+                    "name": "Ghost Core Content API",
+                    "description": "Internal Content API integration for Admin access",
+                    "type": "core",
+                    "api_keys": [{"type": "content"}]
                 }
             ]
         }

package/core/server/data/schema/schema.js

@@ -1079,5 +1079,17 @@ module.exports = {
         one_click_subscribe: {type: 'boolean', nullable: false, defaultTo: false},
         created_at: {type: 'dateTime', nullable: false},
         updated_at: {type: 'dateTime', nullable: true}
+    },
+    recommendation_click_events: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        recommendation_id: {type: 'string', maxlength: 24, nullable: false, references: 'recommendations.id', unique: false, cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, references: 'members.id', unique: false, setNullDelete: true},
+        created_at: {type: 'dateTime', nullable: false}
+    },
+    recommendation_subscribe_events: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        recommendation_id: {type: 'string', maxlength: 24, nullable: false, references: 'recommendations.id', unique: false, cascadeDelete: true},
+        member_id: {type: 'string', maxlength: 24, nullable: true, references: 'members.id', unique: false, setNullDelete: true},
+        created_at: {type: 'dateTime', nullable: false}
     }
 };

package/core/server/lib/lexical.js

@@ -7,6 +7,7 @@ const storage = require('../adapters/storage');
 let nodes;
 let lexicalHtmlRenderer;
 let urlTransformMap;
+let postsService;
 
 function populateNodes() {
     const {DEFAULT_NODES} = require('@tryghost/kg-default-nodes');
@@ -28,6 +29,23 @@ module.exports = {
     },
 
     async render(lexical, userOptions = {}) {
+        if (!postsService) {
+            const getPostServiceInstance = require('../services/posts/posts-service');
+            postsService = getPostServiceInstance();
+        }
+
+        const getCollectionPosts = async (collectionSlug, postCount) => {
+            const transacting = userOptions.transacting;
+            const {data} = await postsService.browsePosts({
+                context: {public: true}, // mimic Content API request
+                collection: collectionSlug,
+                limit: postCount,
+                transacting
+            });
+            let posts = data.map(p => p.toJSON());
+            return posts;
+        };
+
         const options = Object.assign({
             siteUrl: config.get('url'),
             imageOptimization: config.get('imageOptimization'),
@@ -43,7 +61,8 @@ module.exports = {
             createDocument() {
                 const {JSDOM} = require('jsdom');
                 return (new JSDOM()).window.document;
-            }
+            },
+            getCollectionPosts
         }, userOptions);
 
         return await this.lexicalHtmlRenderer.render(lexical, options);

package/core/server/models/base/plugins/crud.js

@@ -44,12 +44,6 @@ module.exports = function (Bookshelf) {
                 });
             }
 
-            if (options.page && options.limit) {
-                itemCollection
-                    .query('limit', options.limit)
-                    .query('offset', options.limit * (options.page - 1));
-            }
-
             const result = await itemCollection.fetchAll(options);
             if (options.withRelated) {
                 _.each(result.models, function each(item) {

package/core/server/models/base/plugins/sanitize.js

@@ -45,7 +45,7 @@ module.exports = function (Bookshelf) {
             case 'findOne':
                 return baseOptions.concat(extraOptions, ['columns', 'require', 'mongoTransformer']);
             case 'findAll':
-                return baseOptions.concat(extraOptions, ['filter', 'columns', 'mongoTransformer', 'page', 'limit']);
+                return baseOptions.concat(extraOptions, ['filter', 'columns', 'mongoTransformer']);
             case 'findPage':
                 return baseOptions.concat(extraOptions, ['filter', 'order', 'autoOrder', 'page', 'limit', 'columns', 'mongoTransformer']);
             default:

package/core/server/models/post.js

@@ -700,7 +700,7 @@ Post = ghostBookshelf.Model.extend({
             )
         ) {
             try {
-                this.set('html', await lexicalLib.render(this.get('lexical')));
+                this.set('html', await lexicalLib.render(this.get('lexical'), {transacting: options.transacting}));
             } catch (err) {
                 throw new errors.ValidationError({
                     message: tpl(messages.invalidLexicalStructure),

package/core/server/models/recommendation-click-event.js

@@ -0,0 +1,22 @@
+const errors = require('@tryghost/errors');
+const ghostBookshelf = require('./base');
+
+const RecommendationClickEvent = ghostBookshelf.Model.extend({
+    tableName: 'recommendation_click_events'
+}, {
+    async edit() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot edit RecommendationClickEvent'
+        });
+    },
+
+    async destroy() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot destroy RecommendationClickEvent'
+        });
+    }
+});
+
+module.exports = {
+    RecommendationClickEvent: ghostBookshelf.model('RecommendationClickEvent', RecommendationClickEvent)
+};

package/core/server/models/recommendation-subscribe-event.js

@@ -0,0 +1,22 @@
+const errors = require('@tryghost/errors');
+const ghostBookshelf = require('./base');
+
+const RecommendationSubscribeEvent = ghostBookshelf.Model.extend({
+    tableName: 'recommendation_subscribe_events'
+}, {
+    async edit() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot edit RecommendationSubscribeEvent'
+        });
+    },
+
+    async destroy() {
+        throw new errors.IncorrectUsageError({
+            message: 'Cannot destroy RecommendationSubscribeEvent'
+        });
+    }
+});
+
+module.exports = {
+    RecommendationSubscribeEvent: ghostBookshelf.model('RecommendationSubscribeEvent', RecommendationSubscribeEvent)
+};

package/core/server/services/collections/BookshelfCollectionsRepository.js

@@ -1,6 +1,7 @@
 const logger = require('@tryghost/logging');
 const Collection = require('@tryghost/collections').Collection;
 const sentry = require('../../../shared/sentry');
+const {default: ObjectID} = require('bson-objectid');
 /**
  * @typedef {import('@tryghost/collections/src/CollectionRepository')} CollectionRepository
  */
@@ -10,8 +11,10 @@ const sentry = require('../../../shared/sentry');
  */
 module.exports = class BookshelfCollectionsRepository {
     #model;
-    constructor(model) {
+    #relationModel;
+    constructor(model, relationModel) {
         this.#model = model;
+        this.#relationModel = relationModel;
     }
 
     async createTransaction(cb) {
@@ -101,10 +104,21 @@ module.exports = class BookshelfCollectionsRepository {
      * @returns {Promise<void>}
      */
     async save(collection, options = {}) {
+        if (!options.transaction) {
+            return this.createTransaction((transaction) => {
+                return this.save(collection, {
+                    ...options,
+                    transaction
+                });
+            });
+        }
+
         if (collection.deleted) {
-            await this.#model.destroy({id: collection.id});
+            await this.#relationModel.query().delete().where('collection_id', collection.id).transacting(options.transaction);
+            await this.#model.query().delete().where('id', collection.id).transacting(options.transaction);
             return;
         }
+
         const data = {
             id: collection.id,
             slug: collection.slug,
@@ -113,7 +127,6 @@ module.exports = class BookshelfCollectionsRepository {
             filter: collection.filter,
             type: collection.type,
             feature_image: collection.featureImage || null,
-            posts: collection.posts.map(postId => ({id: postId})),
             created_at: collection.createdAt,
             updated_at: collection.updatedAt
         };
@@ -122,7 +135,8 @@ module.exports = class BookshelfCollectionsRepository {
             {id: data.id},
             {
                 require: false,
-                transacting: options.transaction
+                transacting: options.transaction,
+                withRelated: ['collectionPosts']
             }
         );
 
@@ -130,11 +144,59 @@ module.exports = class BookshelfCollectionsRepository {
             await this.#model.add(data, {
                 transacting: options.transaction
             });
+            const collectionPostsRelations = collection.posts.map((postId, index) => {
+                return {
+                    id: (new ObjectID).toHexString(),
+                    sort_order: collection.type === 'manual' ? index : 0,
+                    collection_id: collection.id,
+                    post_id: postId
+                };
+            });
+            if (collectionPostsRelations.length > 0) {
+                await this.#relationModel.query().insert(collectionPostsRelations).transacting(options.transaction);
+            }
         } else {
-            return this.#model.edit(data, {
+            await this.#model.edit(data, {
                 id: data.id,
                 transacting: options.transaction
             });
+
+            const collectionPostsRelations = collection.posts.map((postId, index) => {
+                return {
+                    id: (new ObjectID).toHexString(),
+                    sort_order: collection.type === 'manual' ? index : 0,
+                    collection_id: collection.id,
+                    post_id: postId
+                };
+            });
+
+            const collectionPostRelationsToDeleteIds = [];
+
+            if (collection.type === 'manual') {
+                await this.#relationModel.query().delete().where('collection_id', collection.id).transacting(options.transaction);
+            } else {
+                const existingRelations = existing.toJSON().collectionPosts;
+
+                for (const existingRelation of existingRelations) {
+                    const found = collectionPostsRelations.find((thing) => {
+                        return thing.post_id === existingRelation.post_id;
+                    });
+                    if (found) {
+                        found.id = null;
+                    } else {
+                        collectionPostRelationsToDeleteIds.push(existingRelation.id);
+                    }
+                }
+            }
+
+            const missingCollectionPostsRelations = collectionPostsRelations.filter(thing => thing.id !== null);
+
+            if (missingCollectionPostsRelations.length > 0) {
+                await this.#relationModel.query().insert(missingCollectionPostsRelations).transacting(options.transaction);
+            }
+            if (collectionPostRelationsToDeleteIds.length > 0) {
+                await this.#relationModel.query().delete().whereIn('id', collectionPostRelationsToDeleteIds).transacting(options.transaction);
+            }
         }
     }
 };

package/core/server/services/collections/service.js

@@ -12,7 +12,7 @@ class CollectionsServiceWrapper {
         const DomainEvents = require('@tryghost/domain-events');
         const postsRepository = require('./PostsRepository').getInstance();
         const models = require('../../models');
-        const collectionsRepositoryInMemory = new BookshelfCollectionsRepository(models.Collection);
+        const collectionsRepositoryInMemory = new BookshelfCollectionsRepository(models.Collection, models.CollectionPost);
 
         const collectionsService = new CollectionsService({
             collectionsRepository: collectionsRepositoryInMemory,
@@ -33,16 +33,16 @@ class CollectionsServiceWrapper {
     async init() {
         const config = require('../../../shared/config');
         const labs = require('../../../shared/labs');
+
         // host setting OR labs "collections" flag has to be enabled to run collections service
-        if (!config.get('hostSettings:collections:enabled') && !(labs.isSet('collections'))) {
-            return;
-        }
+        if (config.get('hostSettings:collections:enabled') || labs.isSet('collections')) {
+            if (inited) {
+                return;
+            }
 
-        if (inited) {
-            return;
+            inited = true;
+            this.api.subscribeToEvents();
         }
-        inited = true;
-        this.api.subscribeToEvents();
     }
 }
 

package/core/server/services/members/middleware.js

@@ -5,7 +5,10 @@ const emailSuppressionList = require('../email-suppression-list');
 const models = require('../../models');
 const urlUtils = require('../../../shared/url-utils');
 const spamPrevention = require('../../web/shared/middleware/api/spam-prevention');
-const {formattedMemberResponse} = require('./utils');
+const {
+    formattedMemberResponse,
+    formatNewsletterResponse
+} = require('./utils');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 
@@ -144,6 +147,11 @@ const getMemberNewsletters = async function getMemberNewsletters(req, res) {
         }
 
         const data = _.pick(memberData.toJSON(), 'uuid', 'email', 'name', 'newsletters', 'enable_comment_notifications', 'status');
+
+        if (data.newsletters) {
+            data.newsletters = formatNewsletterResponse(data.newsletters);
+        }
+
         return res.json(data);
     } catch (err) {
         res.writeHead(400);
@@ -175,6 +183,11 @@ const updateMemberNewsletters = async function updateMemberNewsletters(req, res)
 
         const updatedMember = await membersService.api.members.update(data, options);
         const updatedMemberData = _.pick(updatedMember.toJSON(), ['uuid', 'email', 'name', 'newsletters', 'enable_comment_notifications', 'status']);
+
+        if (updatedMemberData.newsletters) {
+            updatedMemberData.newsletters = formatNewsletterResponse(updatedMemberData.newsletters);
+        }
+
         res.json(updatedMemberData);
     } catch (err) {
         res.writeHead(400);

package/core/server/services/members/utils.js

@@ -4,6 +4,7 @@ function formatNewsletterResponse(newsletters) {
     });
 }
 
+module.exports.formatNewsletterResponse = formatNewsletterResponse;
 module.exports.formattedMemberResponse = function formattedMemberResponse(member) {
     if (!member) {
         return null;

package/core/server/services/recommendations/RecommendationServiceWrapper.js

@@ -4,6 +4,16 @@ class RecommendationServiceWrapper {
      */
     repository;
 
+    /**
+     * @type {import('@tryghost/recommendations').BookshelfClickEventRepository}
+     */
+    clickEventRepository;
+
+    /**
+     * @type {import('@tryghost/recommendations').BookshelfSubscribeEventRepository}
+     */
+    subscribeEventRepository;
+
     /**
      * @type {import('@tryghost/recommendations').RecommendationController}
      */
@@ -29,7 +39,8 @@ class RecommendationServiceWrapper {
             BookshelfRecommendationRepository,
             RecommendationService,
             RecommendationController,
-            WellknownService
+            WellknownService,
+            BookshelfClickEventRepository
         } = require('@tryghost/recommendations');
 
         const mentions = require('../mentions');
@@ -50,11 +61,21 @@ class RecommendationServiceWrapper {
         this.repository = new BookshelfRecommendationRepository(models.Recommendation, {
             sentry
         });
+
+        this.clickEventRepository = new BookshelfClickEventRepository(models.RecommendationClickEvent, {
+            sentry
+        });
+        this.subscribeEventRepository = new BookshelfClickEventRepository(models.RecommendationSubscribeEvent, {
+            sentry
+        });
+
         this.service = new RecommendationService({
             repository: this.repository,
             recommendationEnablerService,
             wellknownService,
-            mentionSendingService: mentions.sendingService
+            mentionSendingService: mentions.sendingService,
+            clickEventRepository: this.clickEventRepository,
+            subscribeEventRepository: this.subscribeEventRepository
         });
         this.controller = new RecommendationController({
             service: this.service

package/core/server/services/settings/SettingsBREADService.js

@@ -66,6 +66,11 @@ class SettingsBREADService {
                 const adminUrl = urlUtils.urlFor('admin', true);
                 const signinURL = new URL(adminUrl);
                 signinURL.hash = `/settings/members/?verifyEmail=${token}`;
+                // NOTE: to be removed in future, this is to ensure that the new settings are used when enabled
+                if (labsService && labsService.isSet('adminXSettings')) {
+                    signinURL.hash = `/settings-x/portal/edit?verifyEmail=${token}`;
+                }
+
                 return signinURL.href;
             }
         };

package/core/server/web/members/app.js

@@ -88,6 +88,20 @@ module.exports = function setupMembersApp() {
         announcementRouter()
     );
 
+    // Recommendations
+    membersApp.post(
+        '/api/recommendations/:id/clicked',
+        middleware.loadMemberSession,
+        http(api.recommendationsPublic.trackClicked)
+    );
+
+    // Recommendations
+    membersApp.post(
+        '/api/recommendations/:id/subscribed',
+        middleware.loadMemberSession,
+        http(api.recommendationsPublic.trackSubscribed)
+    );
+
     // Allow external systems to read public settings via the members api
     // Without CORS issues and without a required integration token
     // 1. Detect if a site is Running Ghost

package/core/shared/config/defaults.json

@@ -182,7 +182,7 @@
     },
     "portal": {
         "url": "https://cdn.jsdelivr.net/ghost/portal@~{version}/umd/portal.min.js",
-        "version": "2.35"
+        "version": "2.36"
     },
     "sodoSearch": {
         "url": "https://cdn.jsdelivr.net/ghost/sodo-search@~{version}/umd/sodo-search.min.js",

package/core/shared/settings-cache/public.js

@@ -41,5 +41,6 @@ module.exports = {
     portal_name: 'portal_name',
     portal_button: 'portal_button',
     comments_enabled: 'comments_enabled',
-    recommendations_enabled: 'recommendations_enabled'
+    recommendations_enabled: 'recommendations_enabled',
+    outbound_link_tagging: 'outbound_link_tagging'
 };