ghost 5.79.6 → 5.80.1

package/core/server/api/endpoints/settings.js

@@ -122,7 +122,7 @@ module.exports = {
 
     edit: {
         headers: {
-            cacheInvalidate: true
+            cacheInvalidate: false
         },
         permissions: {
             unsafeAttrsObject(frame) {
@@ -134,10 +134,8 @@ module.exports = {
 
             let result = await settingsBREADService.edit(frame.data.settings, frame.options, stripeConnectData);
 
-            if (_.isEmpty(result)) {
-                this.headers.cacheInvalidate = false;
-            } else {
-                this.headers.cacheInvalidate = true;
+            if (!_.isEmpty(result)) {
+                frame.setHeader('X-Cache-Invalidate', '/*');
             }
 
             // We need to return all settings here, because we have calculated settings that might change

package/core/server/api/endpoints/tags.js

@@ -124,9 +124,7 @@ module.exports = {
                     }
 
                     if (model.wasChanged()) {
-                        this.headers.cacheInvalidate = true;
-                    } else {
-                        this.headers.cacheInvalidate = false;
+                        frame.setHeader('X-Cache-Invalidate', '/*');
                     }
 
                     return model;

package/core/server/api/endpoints/themes.js

@@ -91,7 +91,7 @@ module.exports = {
                 const {theme, themeOverridden} = await themeService.api.installFromGithub(frame.options.ref);
 
                 if (themeOverridden) {
-                    this.headers.cacheInvalidate = true;
+                    frame.setHeader('X-Cache-Invalidate', '/*');
                 }
 
                 events.emit('theme.uploaded', {name: theme.name});
@@ -125,8 +125,7 @@ module.exports = {
             return themeService.api.setFromZip(zip)
                 .then(({theme, themeOverridden}) => {
                     if (themeOverridden) {
-                        // CASE: clear cache
-                        this.headers.cacheInvalidate = true;
+                        frame.setHeader('X-Cache-Invalidate', '/*');
                     }
                     events.emit('theme.uploaded', {name: theme.name});
                     return theme;

package/core/server/api/endpoints/users.js

@@ -170,7 +170,9 @@ module.exports = {
                         }));
                     }
 
-                    this.headers.cacheInvalidate = shouldInvalidateCacheAfterChange(model);
+                    if (shouldInvalidateCacheAfterChange(model)) {
+                        frame.setHeader('X-Cache-Invalidate', '/*');
+                    }
 
                     return model;
                 });

package/core/server/api/endpoints/utils/serializers/input/comments.js

@@ -14,5 +14,19 @@ module.exports = {
             }
             return relation;
         });
+    },
+
+    browse(apiConfig, frame) {
+        // for top-level comments we show newest comments first and paginate to older
+        if (!frame.options.order) {
+            frame.options.order = 'created_at DESC, id DESC';
+        }
+    },
+
+    replies(apiConfig, frame) {
+        // for replies we show the oldest comments first and paginate to newer
+        if (!frame.options.order) {
+            frame.options.order = 'created_at ASC, id ASC';
+        }
     }
 };

package/core/server/api/endpoints/utils/serializers/output/mappers/posts.js

@@ -66,6 +66,10 @@ module.exports = async (model, frame, options = {}) => {
             jsonModel.tiers = tiersData ? tiersData.filter(t => t.type === 'paid') : [];
         }
 
+        if (jsonModel.visibility === 'tiers' && Array.isArray(jsonModel.tiers)) {
+            jsonModel.tiers = jsonModel.tiers.filter(t => t.type === 'paid');
+        }
+
         if (!['members', 'public', 'paid', 'tiers'].includes(jsonModel.visibility)) {
             const tiers = await postsService.getProductsFromVisibilityFilter(jsonModel.visibility);
 

package/core/server/models/post.js

@@ -1004,6 +1004,12 @@ Post = ghostBookshelf.Model.extend({
             this.set('tiers', this.get('tiers').map(t => ({
                 id: t.id
             })));
+
+            // Don't associate the free tier with the post
+            const freeTier = await ghostBookshelf.model('Product').findOne({type: 'free'}, {require: false, transacting: options.transacting ?? undefined});
+            if (freeTier) {
+                this.set('tiers', this.get('tiers').filter(t => t.id !== freeTier.id));
+            }
         }
 
         if (labs.isSet('collectionsCard') && this.get('type') === 'post' && (newStatus === 'published' || olderStatus === 'published')) {

package/core/server/services/comments/CommentsController.js

@@ -35,6 +35,22 @@ module.exports = class CommentsController {
      * @param {Frame} frame
      */
     async browse(frame) {
+        if (frame.options.post_id) {
+            if (frame.options.filter) {
+                frame.options.mongoTransformer = function (query) {
+                    return {
+                        $and: [
+                            {
+                                post_id: frame.options.post_id
+                            },
+                            query
+                        ]
+                    };
+                };
+            } else {
+                frame.options.filter = `post_id:${frame.options.post_id}`;
+            }
+        }
         return this.service.getComments(frame.options);
     }
 
@@ -58,20 +74,33 @@ module.exports = class CommentsController {
     async edit(frame) {
         this.#checkMember(frame);
 
+        let result;
         if (frame.data.comments[0].status === 'deleted') {
-            return await this.service.deleteComment(
+            result = await this.service.deleteComment(
                 frame.options.id,
                 frame?.options?.context?.member?.id,
                 frame.options
             );
+        } else {
+            result = await this.service.editCommentContent(
+                frame.options.id,
+                frame?.options?.context?.member?.id,
+                frame.data.comments[0].html,
+                frame.options
+            );
         }
 
-        return await this.service.editCommentContent(
-            frame.options.id,
-            frame?.options?.context?.member?.id,
-            frame.data.comments[0].html,
-            frame.options
-        );
+        if (result) {
+            const postId = result.get('post_id');
+            const parentId = result.get('parent_id');
+            const pathsToInvalidate = [
+                postId ? `/api/members/comments/post/${postId}/` : null,
+                parentId ? `/api/members/comments/${parentId}/replies/` : null
+            ].filter(path => path !== null);
+            frame.setHeader('X-Cache-Invalidate', pathsToInvalidate.join(', '));
+        }
+
+        return result;
     }
 
     /**
@@ -81,21 +110,34 @@ module.exports = class CommentsController {
         this.#checkMember(frame);
         const data = frame.data.comments[0];
 
+        let result;
         if (data.parent_id) {
-            return await this.service.replyToComment(
+            result = await this.service.replyToComment(
                 data.parent_id,
                 frame.options.context.member.id,
                 data.html,
                 frame.options
             );
+        } else {
+            result = await this.service.commentOnPost(
+                data.post_id,
+                frame.options.context.member.id,
+                data.html,
+                frame.options
+            );
         }
 
-        return await this.service.commentOnPost(
-            data.post_id,
-            frame.options.context.member.id,
-            data.html,
-            frame.options
-        );
+        if (result) {
+            const postId = result.get('post_id');
+            const parentId = result.get('parent_id');
+            const pathsToInvalidate = [
+                postId ? `/api/members/comments/post/${postId}/` : null,
+                parentId ? `/api/members/comments/${parentId}/replies/` : null
+            ].filter(path => path !== null);
+            frame.setHeader('X-Cache-Invalidate', pathsToInvalidate.join(', '));
+        }
+
+        return result;
     }
 
     async destroy() {
@@ -120,11 +162,25 @@ module.exports = class CommentsController {
     async like(frame) {
         this.#checkMember(frame);
 
-        return await this.service.likeComment(
+        const result = await this.service.likeComment(
             frame.options.id,
             frame.options?.context?.member,
             frame.options
         );
+
+        const comment = await this.service.getCommentByID(frame.options.id);
+
+        if (comment) {
+            const postId = comment.get('post_id');
+            const parentId = comment.get('parent_id');
+            const pathsToInvalidate = [
+                postId ? `/api/members/comments/post/${postId}/` : null,
+                parentId ? `/api/members/comments/${parentId}/replies/` : null
+            ].filter(path => path !== null);
+            frame.setHeader('X-Cache-Invalidate', pathsToInvalidate.join(', '));
+        }
+
+        return result;
     }
 
     /**
@@ -133,11 +189,25 @@ module.exports = class CommentsController {
     async unlike(frame) {
         this.#checkMember(frame);
 
-        return await this.service.unlikeComment(
+        const result = await this.service.unlikeComment(
             frame.options.id,
             frame.options?.context?.member,
             frame.options
         );
+
+        const comment = await this.service.getCommentByID(frame.options.id);
+
+        if (comment) {
+            const postId = comment.get('post_id');
+            const parentId = comment.get('parent_id');
+            const pathsToInvalidate = [
+                postId ? `/api/members/comments/post/${postId}/` : null,
+                parentId ? `/api/members/comments/${parentId}/replies/` : null
+            ].filter(path => path !== null);
+            frame.setHeader('X-Cache-Invalidate', pathsToInvalidate.join(', '));
+        }
+
+        return result;
     }
 
     /**

package/core/server/services/members/api.js

@@ -27,6 +27,24 @@ const ghostMailer = new mail.GhostMailer();
 
 module.exports = createApiInstance;
 
+function trimLeadingWhitespace(strings, ...values) {
+    // Interweave the strings with the
+    // substitution vars first.
+    let output = '';
+    for (let i = 0; i < values.length; i++) {
+        output += strings[i] + values[i];
+    }
+    output += strings[values.length];
+
+    // Split on newlines.
+    const lines = output.split(/(?:\r\n|\n|\r)/);
+
+    // Rip out the leading whitespace on each line.
+    return lines.map((line) => {
+        return line.trimStart();
+    }).join('\n').trim();
+}
+
 function createApiInstance(config) {
     const membersApiInstance = MembersApi({
         tokenConfig: config.getTokenConfig(),
@@ -75,7 +93,7 @@ function createApiInstance(config) {
                 const siteTitle = settingsCache.get('title');
                 switch (type) {
                 case 'subscribe':
-                    return `
+                    return trimLeadingWhitespace`
                         ${t(`Hey there,`)}
 
                         ${t('You\'re one tap away from subscribing to {{siteTitle}} — please confirm your email address with this link:', {siteTitle, interpolation: {escapeValue: false}})}
@@ -92,7 +110,7 @@ function createApiInstance(config) {
                         ${t('If you did not make this request, you can simply delete this message.')} ${t('You will not be subscribed.')}
                         `;
                 case 'signup':
-                    return `
+                    return trimLeadingWhitespace`
                         ${t(`Hey there,`)}
 
                         ${t('Tap the link below to complete the signup process for {{siteTitle}}, and be automatically signed in:', {siteTitle, interpolation: {escapeValue: false}})}
@@ -109,7 +127,7 @@ function createApiInstance(config) {
                         ${t('If you did not make this request, you can simply delete this message.')} ${t('You will not be signed up, and no account will be created for you.')}
                         `;
                 case 'signup-paid':
-                    return `
+                    return trimLeadingWhitespace`
                         ${t(`Hey there,`)}
 
                         ${t('Thank you for subscribing to {{siteTitle}}. Tap the link below to be automatically signed in:', {siteTitle, interpolation: {escapeValue: false}})}
@@ -126,7 +144,7 @@ function createApiInstance(config) {
                         ${t('Thank you for subscribing to {{siteTitle}}!', {siteTitle, interpolation: {escapeValue: false}})}
                         `;
                 case 'updateEmail':
-                    return `
+                    return trimLeadingWhitespace`
                         ${t(`Hey there,`)}
 
                         ${t('Please confirm your email address with this link:')}
@@ -142,7 +160,7 @@ function createApiInstance(config) {
                         `;
                 case 'signin':
                 default:
-                    return `
+                    return trimLeadingWhitespace`
                         ${t(`Hey there,`)}
 
                         ${t('Welcome back! Use this link to securely sign in to your {{siteTitle}} account:', {siteTitle, interpolation: {escapeValue: false}})}

package/core/server/services/posts/post-scheduling-service.js

@@ -55,7 +55,7 @@ class PostSchedulingService {
      *
      * @param {Object} scheduledResource post or page resource object
      * @param {Object} preScheduledResource post or page resource object in state before publishing
-     * @returns {Boolean|Object}
+     * @returns {boolean|{value: string}}
      */
     handleCacheInvalidation(scheduledResource, preScheduledResource) {
         if (

package/core/server/web/comments/routes.js

@@ -11,16 +11,17 @@ module.exports = function apiRoutes() {
     const router = express.Router('comment api');
     router.use(bodyParser.json({limit: '50mb'}));
 
-    // Global handling for member session, ensures a member is logged in to the frontend
-    router.use(membersService.middleware.loadMemberSession);
-
     const countsCache = shared.middleware.cacheControl(
         'public',
         {maxAge: config.get('caching:commentsCountAPI:maxAge')}
     );
     router.get('/counts', countsCache, http(api.commentsMembers.counts));
 
+    // Authenticated Routes
+    router.use(membersService.middleware.loadMemberSession);
+
     router.get('/', http(api.commentsMembers.browse));
+    router.get('/post/:post_id', http(api.commentsMembers.browse));
     router.get('/:id', http(api.commentsMembers.read));
     router.post('/', http(api.commentsMembers.add));
     router.put('/:id', http(api.commentsMembers.edit));

package/core/shared/config/defaults.json

@@ -195,7 +195,7 @@
     },
     "comments": {
         "url": "https://cdn.jsdelivr.net/ghost/comments-ui@~{version}/umd/comments-ui.min.js",
-        "version": "0.13"
+        "version": "0.16"
     },
     "signupForm": {
         "url": "https://cdn.jsdelivr.net/ghost/signup-form@~{version}/umd/signup-form.min.js",