ghost 5.98.1 → 5.100.0

package/core/server/services/activitypub/index.js

@@ -0,0 +1 @@
+module.exports = require('./ActivityPubServiceWrapper');

package/core/server/services/comments/CommentsController.js

@@ -51,7 +51,8 @@ module.exports = class CommentsController {
                 frame.options.filter = `post_id:${frame.options.post_id}`;
             }
         }
-        return this.service.getComments(frame.options);
+
+        return await this.service.getComments(frame.options);
     }
 
     /**
@@ -114,6 +115,7 @@ module.exports = class CommentsController {
         if (data.parent_id) {
             result = await this.service.replyToComment(
                 data.parent_id,
+                data.in_reply_to_id,
                 frame.options.context.member.id,
                 data.html,
                 frame.options

package/core/server/services/comments/CommentsService.js

@@ -83,7 +83,10 @@ class CommentsService {
         await this.emails.notifyPostAuthors(comment);
 
         if (comment.get('parent_id')) {
-            await this.emails.notifyParentCommentAuthor(comment);
+            await this.emails.notifyParentCommentAuthor(comment, {type: 'parent'});
+        }
+        if (comment.get('in_reply_to_id')) {
+            await this.emails.notifyParentCommentAuthor(comment, {type: 'in_reply_to'});
         }
     }
 
@@ -253,11 +256,12 @@ class CommentsService {
 
     /**
      * @param {string} parent - The ID of the Comment to reply to
+     * @param {string} inReplyTo - The ID of the Reply to reply to
      * @param {string} member - The ID of the Member to comment as
      * @param {string} comment - The HTML content of the Comment
      * @param {any} options
      */
-    async replyToComment(parent, member, comment, options) {
+    async replyToComment(parent, inReplyTo, member, comment, options) {
         this.checkEnabled();
         const memberModel = await this.models.Member.findOne({
             id: member
@@ -281,6 +285,7 @@ class CommentsService {
                 message: tpl(messages.replyToReply)
             });
         }
+
         const postModel = await this.models.Post.findOne({
             id: parentComment.get('post_id')
         }, {
@@ -291,10 +296,27 @@ class CommentsService {
 
         this.checkPostAccess(postModel, memberModel);
 
+        let inReplyToComment;
+        if (parent && inReplyTo) {
+            inReplyToComment = await this.getCommentByID(inReplyTo, options);
+
+            // we only allow references to published comments to avoid leaking
+            // hidden data via the snippet included in API responses
+            if (inReplyToComment && inReplyToComment.get('status') !== 'published') {
+                inReplyToComment = null;
+            }
+
+            // we don't allow in_reply_to references across different parents
+            if (inReplyToComment && inReplyToComment.get('parent_id') !== parent) {
+                inReplyToComment = null;
+            }
+        }
+
         const model = await this.models.Comment.add({
             post_id: parentComment.get('post_id'),
             member_id: member,
             parent_id: parentComment.id,
+            in_reply_to_id: inReplyToComment && inReplyToComment.get('id'),
             html: comment,
             status: 'published'
         }, options);

package/core/server/services/comments/CommentsServiceEmails.js

@@ -60,8 +60,13 @@ class CommentsServiceEmails {
         }
     }
 
-    async notifyParentCommentAuthor(reply) {
-        const parent = await this.models.Comment.findOne({id: reply.get('parent_id')});
+    async notifyParentCommentAuthor(reply, {type = 'parent'} = {}) {
+        let parent;
+        if (type === 'in_reply_to') {
+            parent = await this.models.Comment.findOne({id: reply.get('in_reply_to_id')});
+        } else {
+            parent = await this.models.Comment.findOne({id: reply.get('parent_id')});
+        }
         const parentMember = parent.related('member');
 
         if (parent?.get('status') !== 'published' || !parentMember.get('enable_comment_notifications')) {

package/core/server/services/email-analytics/EmailAnalyticsServiceWrapper.js

@@ -1,4 +1,6 @@
 const logging = require('@tryghost/logging');
+const JobManager = require('../../services/jobs');
+const path = require('path');
 
 class EmailAnalyticsServiceWrapper {
     init() {
@@ -11,7 +13,7 @@ class EmailAnalyticsServiceWrapper {
         const MailgunProvider = require('@tryghost/email-analytics-provider-mailgun');
         const {EmailRecipientFailure, EmailSpamComplaintEvent, Email} = require('../../models');
         const StartEmailAnalyticsJobEvent = require('./events/StartEmailAnalyticsJobEvent');
-
+        const {MemberEmailAnalyticsUpdateEvent} = require('@tryghost/member-events');
         const domainEvents = require('@tryghost/domain-events');
         const config = require('../../../shared/config');
         const settings = require('../../../shared/settings-cache');
@@ -47,7 +49,8 @@ class EmailAnalyticsServiceWrapper {
             providers: [
                 new MailgunProvider({config, settings})
             ],
-            queries
+            queries,
+            domainEvents
         });
 
         // We currently cannot trigger a non-offloaded job from the job manager
@@ -55,6 +58,19 @@ class EmailAnalyticsServiceWrapper {
         domainEvents.subscribe(StartEmailAnalyticsJobEvent, async () => {
             await this.startFetch();
         });
+
+        domainEvents.subscribe(MemberEmailAnalyticsUpdateEvent, async (event) => {
+            const memberId = event.data.memberId;
+            await JobManager.addQueuedJob({
+                name: `update-member-email-analytics-${memberId}`,
+                metadata: {
+                    job: path.resolve(__dirname, 'jobs/update-member-email-analytics'),
+                    data: {
+                        memberId
+                    }
+                }
+            });
+        });
     }
 
     async fetchLatestOpenedEvents({maxEvents} = {maxEvents: Infinity}) {

package/core/server/services/email-analytics/jobs/update-member-email-analytics/index.js

@@ -0,0 +1,13 @@
+const queries = require('../../lib/queries');
+
+/**
+ * Updates email analytics for a specific member
+ * 
+ * @param {Object} options - The options object
+ * @param {string} options.memberId - The ID of the member to update analytics for
+ * @returns {Promise<Object>} The result of the aggregation query (1/0)
+ */
+module.exports = async function updateMemberEmailAnalytics({memberId}) {
+    const result = await queries.aggregateMemberStats(memberId);
+    return result;
+};

package/core/server/services/email-service/EmailServiceWrapper.js

@@ -1,5 +1,7 @@
+const debug = require('@tryghost/debug')('i18n');
 const logging = require('@tryghost/logging');
 const url = require('../../api/endpoints/utils/serializers/output/utils/url');
+const events = require('../../lib/common/events');
 
 class EmailServiceWrapper {
     getPostUrl(post) {
@@ -27,7 +29,7 @@ class EmailServiceWrapper {
         const limitService = require('../limits');
         const labs = require('../../../shared/labs');
         const emailAddressService = require('../email-address');
-
+        const i18nLib = require('@tryghost/i18n');
         const mobiledocLib = require('../../lib/mobiledoc');
         const lexicalLib = require('../../lib/lexical');
         const urlUtils = require('../../../shared/url-utils');
@@ -49,6 +51,25 @@ class EmailServiceWrapper {
         const mailgunClient = new MailgunClient({
             config: configService, settings: settingsCache
         });
+        const i18nLanguage = labs.isSet('i18n') ? settingsCache.get('locale') || 'en' : 'en';
+        const i18n = i18nLib(i18nLanguage, 'newsletter');
+        
+        events.on('settings.labs.edited', () => {
+            if (labs.isSet('i18n')) {
+                debug('labs i18n enabled, updating i18n to', settingsCache.get('locale'));
+                i18n.changeLanguage(settingsCache.get('locale'));
+            } else {
+                debug('labs i18n disabled, updating i18n to en');
+                i18n.changeLanguage('en');
+            }
+        });
+    
+        events.on('settings.locale.edited', (model) => {
+            if (labs.isSet('i18n')) {
+                debug('locale changed, updating i18n to', model.get('value'));
+                i18n.changeLanguage(model.get('value'));
+            } 
+        });
 
         const mailgunEmailProvider = new MailgunEmailProvider({
             mailgunClient,
@@ -73,7 +94,8 @@ class EmailServiceWrapper {
             outboundLinkTagger: memberAttribution.outboundLinkTagger,
             emailAddressService: emailAddressService.service,
             labs,
-            models: {Post}
+            models: {Post},
+            t: i18n.t
         });
 
         const sendingService = new SendingService({

package/core/server/services/i18n.js

@@ -33,4 +33,4 @@ module.exports.init = function () {
             i18nInstance.changeLanguage(model.get('value'));
         }
     });
-};
+};

package/core/server/services/identity-tokens/IdentityTokenServiceWrapper.js

@@ -0,0 +1,28 @@
+const {IdentityTokenService} = require('@tryghost/identity-token-service');
+
+module.exports = class IdentityTokenServiceWrapper {
+    /** @type IdentityTokenService */
+    static instance;
+
+    static async init() {
+        if (IdentityTokenServiceWrapper.instance) {
+            return;
+        }
+
+        const urlUtils = require('../../../shared/url-utils');
+        const issuer = urlUtils.urlFor('admin', true);
+
+        const settings = require('../../../shared/settings-cache');
+        const jose = require('node-jose');
+
+        const privateKey = settings.get('ghost_private_key');
+        const keyStore = jose.JWK.createKeyStore();
+        const key = await keyStore.add(privateKey, 'pem');
+
+        IdentityTokenServiceWrapper.instance = new IdentityTokenService(
+            privateKey,
+            issuer,
+            key.kid
+        );
+    }
+};

package/core/server/services/identity-tokens/index.js

@@ -0,0 +1 @@
+module.exports = require('./IdentityTokenServiceWrapper');

package/core/server/services/jobs/job-service.js

@@ -8,6 +8,7 @@ const logging = require('@tryghost/logging');
 const models = require('../../models');
 const sentry = require('../../../shared/sentry');
 const domainEvents = require('@tryghost/domain-events');
+const config = require('../../../shared/config');
 
 const errorHandler = (error, workerMeta) => {
     logging.info(`Capturing error for worker during execution of job: ${workerMeta.name}`);
@@ -24,7 +25,7 @@ const workerMessageHandler = ({name, message}) => {
 const initTestMode = () => {
     // Output job queue length every 5 seconds
     setInterval(() => {
-        logging.warn(`${jobManager.queue.length()} jobs in the queue. Idle: ${jobManager.queue.idle()}`);
+        logging.warn(`${jobManager.inlineQueue.length()} jobs in the queue. Idle: ${jobManager.inlineQueue.idle()}`);
 
         const runningScheduledjobs = Object.keys(jobManager.bree.workers);
         if (Object.keys(jobManager.bree.workers).length) {
@@ -42,7 +43,7 @@ const initTestMode = () => {
     }, 5000);
 };
 
-const jobManager = new JobManager({errorHandler, workerMessageHandler, JobModel: models.Job, domainEvents});
+const jobManager = new JobManager({errorHandler, workerMessageHandler, JobModel: models.Job, domainEvents, config});
 
 module.exports = jobManager;
 module.exports.initTestMode = initTestMode;

package/core/server/services/mentions-jobs/job-service.js

@@ -24,7 +24,7 @@ const workerMessageHandler = ({name, message}) => {
 const initTestMode = () => {
     // Output job queue length every 5 seconds
     setInterval(() => {
-        logging.warn(`${jobManager.queue.length()} jobs in the queue. Idle: ${jobManager.queue.idle()}`);
+        logging.warn(`${jobManager.inlineQueue.length()} jobs in the queue. Idle: ${jobManager.inlineQueue.idle()}`);
 
         const runningScheduledjobs = Object.keys(jobManager.bree.workers);
         if (Object.keys(jobManager.bree.workers).length) {
@@ -42,7 +42,7 @@ const initTestMode = () => {
     }, 5000);
 };
 
-const jobManager = new JobManager({errorHandler, workerMessageHandler, JobModel: models.Job, domainEvents});
+const jobManager = new JobManager({errorHandler, workerMessageHandler, JobModel: models.Job, domainEvents, isDuplicate: true});
 
 module.exports = jobManager;
 module.exports.initTestMode = initTestMode;

package/core/server/services/oembed/TwitterOEmbedProvider.js

@@ -71,6 +71,14 @@ class TwitterOEmbedProvider {
                 oembedData.tweet_data = body.data;
                 oembedData.tweet_data.includes = body.includes;
             } catch (err) {
+                if (err.response?.body) {
+                    try {
+                        const parsed = JSON.parse(err.response.body);
+                        err.context = parsed;
+                    } catch (e) {
+                        err.context = err.response.body;
+                    }
+                }
                 logging.error(err);
             }
         }

package/core/server/services/oembed/service.js

@@ -1,8 +1,9 @@
 const config = require('../../../shared/config');
+const storage = require('../../adapters/storage');
 const externalRequest = require('../../lib/request-external');
 
 const OEmbed = require('@tryghost/oembed-service');
-const oembed = new OEmbed({config, externalRequest});
+const oembed = new OEmbed({config, externalRequest, storage});
 
 const NFT = require('./NFTOEmbedProvider');
 const nft = new NFT({

package/core/server/services/offers/OfferBookshelfRepository.js

@@ -107,6 +107,8 @@ class OfferBookshelfRepository {
         });
 
         try {
+            const lastRedeemedObject = lastRedeemed.toJSON();
+
             return await Offer.create({
                 id: json.id,
                 name: json.name,
@@ -126,7 +128,7 @@ class OfferBookshelfRepository {
                     name: json.product.name
                 },
                 created_at: json.created_at,
-                last_redeemed: lastRedeemed.toJSON().length > 0 ? lastRedeemed.toJSON()[0].created_at : null
+                last_redeemed: lastRedeemedObject.length > 0 ? lastRedeemedObject[0].created_at : null
             }, null);
         } catch (err) {
             logger.error(err);

package/core/shared/config/defaults.json

@@ -197,12 +197,12 @@
     },
     "portal": {
         "url": "https://cdn.jsdelivr.net/ghost/portal@~{version}/umd/portal.min.js",
-        "version": "2.45"
+        "version": "2.46"
     },
     "sodoSearch": {
         "url": "https://cdn.jsdelivr.net/ghost/sodo-search@~{version}/umd/sodo-search.min.js",
         "styles": "https://cdn.jsdelivr.net/ghost/sodo-search@~{version}/umd/main.css",
-        "version": "1.4"
+        "version": "1.5"
     },
     "announcementBar": {
         "url": "https://cdn.jsdelivr.net/ghost/announcement-bar@~{version}/umd/announcement-bar.min.js",
@@ -210,7 +210,7 @@
     },
     "comments": {
         "url": "https://cdn.jsdelivr.net/ghost/comments-ui@~{version}/umd/comments-ui.min.js",
-        "version": "0.20"
+        "version": "0.21"
     },
     "signupForm": {
         "url": "https://cdn.jsdelivr.net/ghost/signup-form@~{version}/umd/signup-form.min.js",

package/core/shared/config/env/config.testing.json

@@ -11,9 +11,6 @@
     "server": {
         "port": 2369
     },
-    "metrics_server": {
-        "port": 9417
-    },
     "logging": {
         "level": "error"
     },

package/core/shared/labs.js

@@ -16,6 +16,7 @@ const messages = {
 const GA_FEATURES = [
     'audienceFeedback',
     'collections',
+    'i18n',
     'themeErrorsNotification',
     'outboundLinkTagging',
     'announcementBar',
@@ -26,7 +27,6 @@ const GA_FEATURES = [
 //       input for the "labs" setting value
 const BETA_FEATURES = [
     'additionalPaymentMethods',
-    'i18n',
     'activitypub',
     'stripeAutomaticTax',
     'webmentions',

package/core/shared/prometheus-client.js

@@ -1,36 +1,13 @@
-class PrometheusClient {
-    constructor() {
-        this.client = require('prom-client');
-        this.prefix = 'ghost_';
-        this.collectDefaultMetrics();
-    }
+const {PrometheusClient} = require('@tryghost/prometheus-metrics');
+const config = require('./config');
 
-    collectDefaultMetrics() {
-        this.client.collectDefaultMetrics({prefix: this.prefix});
-    }
+let prometheusClient;
 
-    async handleMetricsRequest(req, res) {
-        try {
-            res.set('Content-Type', this.getContentType());
-            res.end(await this.getMetrics());
-        } catch (err) {
-            res.status(500).end(err.message);
-        }
-    }
-
-    async getMetrics() {
-        return this.client.register.metrics();
-    }
-
-    getRegistry() {
-        return this.client.register;
-    }
-
-    getContentType() {
-        return this.getRegistry().contentType;
-    }
+if (!prometheusClient) {
+    const pushgatewayConfig = config.get('prometheus:pushgateway');
+    const prometheusConfig = {pushgateway: pushgatewayConfig};
+    prometheusClient = new PrometheusClient(prometheusConfig);
+    prometheusClient.init();
 }
 
-// Create a singleton instance and export it as the default export
-const prometheusClient = new PrometheusClient();
 module.exports = prometheusClient;

package/core/shared/settings-cache/CacheManager.js

@@ -64,6 +64,10 @@ class CacheManager {
             return cacheEntry;
         }
 
+        // TODO: I think we should be a little smarter here and deserialize the value based on the type
+        //       rather than trying to parse everything as JSON, which is very slow when we do it hundreds
+        //       of times per request.
+
         // Default behavior is to try to resolve the value and return that
         try {
             // CASE: handle literal false
@@ -71,6 +75,11 @@ class CacheManager {
                 return false;
             }
 
+            // CASE: hotpath early return for strings which are already strings
+            if (cacheEntry.type === 'string' && typeof cacheEntry.value === 'string') {
+                return cacheEntry.value || null;
+            }
+
             // CASE: if a string contains a number e.g. "1", JSON.parse will auto convert into integer
             if (!isNaN(Number(cacheEntry.value))) {
                 return cacheEntry.value || null;