ghost 6.0.5 → 6.0.6

package/core/built/admin/index.html

@@ -6,7 +6,7 @@
     <title>Ghost</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%226.0%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2237bd1e3e4d%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2269d97c1a9c%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%2214e7fdfed0%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%22e3419af21a%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%22b3af6b976f%22%2C%22adminXActivitypubCustomUrl%22%3A%22https%3A%2F%2Fcdn.jsdelivr.net%2Fghost%2Fadmin-x-activitypub%400%2Fdist%2Fadmin-x-activitypub.js%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%226.0%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2237bd1e3e4d%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2269d97c1a9c%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%222845591bec%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%22d90bc80047%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%220d19030cfd%22%2C%22adminXActivitypubCustomUrl%22%3A%22https%3A%2F%2Fcdn.jsdelivr.net%2Fghost%2Fadmin-x-activitypub%400%2Fdist%2Fadmin-x-activitypub.js%22%2C%22adminXActivitypubRemoteConfigUrl%22%3A%22%2F.ghost%2Factivitypub%2Fstable%2Fclient-config%22%7D" />
 
     <meta name="viewport" content="user-scalable=no, width=device-width, initial-scale=1, maximum-scale=1, minimal-ui, viewport-fit=cover" />
     <meta name="pinterest" content="nopin" />
@@ -49,7 +49,7 @@
 
     <script src="assets/vendor-aed0068cf9b67d042dd23a6343545b7b.js"></script>
 <script src="assets/chunk.397.1904882a4a78e2922f07.js"></script>
-<script src="assets/chunk.524.0e2bff9b664f925d7af7.js"></script>
-    <script src="assets/ghost-2b02de85a93ec9a5623180b373cece35.js"></script>
+<script src="assets/chunk.524.56bb70d3e8660d34aef1.js"></script>
+    <script src="assets/ghost-2bcbd118a8ad45fed5401e84a7e87c9a.js"></script>
 </body>
 </html>

package/core/server/data/tinybird/datasources/analytics_events.datasource

@@ -7,11 +7,12 @@ SCHEMA >
     `action` LowCardinality(String) `json:$.action`,
     `version` LowCardinality(String) `json:$.version`,
     `payload` String `json:$.payload`,
-    `site_uuid` LowCardinality(String) `json:$.payload.site_uuid`
+    `site_uuid` LowCardinality(String) `json:$.payload.site_uuid`,
+    `inserted_at` DateTime64(3) DEFAULT now64() `json:$.inserted_at`
 
 ENGINE "MergeTree"
 ENGINE_PARTITION_KEY "toYYYYMM(timestamp)"
 ENGINE_SORTING_KEY "site_uuid, timestamp"
 
 FORWARD_QUERY >
-    SELECT timestamp, session_id, action, version, toString(payload) as payload, site_uuid
+    SELECT timestamp, session_id, action, version, toString(payload) as payload, site_uuid, defaultValueOfTypeName('DateTime64(3)') AS inserted_at

package/core/server/data/tinybird/datasources/analytics_events_test.datasource

@@ -9,11 +9,12 @@ SCHEMA >
     `action` LowCardinality(String) `json:$.action`,
     `version` LowCardinality(String) `json:$.version`,
     `payload` String `json:$.payload`,
-    `site_uuid` LowCardinality(String) `json:$.payload.site_uuid`
+    `site_uuid` LowCardinality(String) `json:$.payload.site_uuid`,
+    `inserted_at` DateTime64(3) DEFAULT now64() `json:$.inserted_at`
 
 ENGINE "MergeTree"
 ENGINE_PARTITION_KEY "toYYYYMM(timestamp)"
 ENGINE_SORTING_KEY "site_uuid, timestamp"
 
 FORWARD_QUERY >
-    SELECT timestamp, session_id, action, version, toString(payload) as payload, site_uuid
+    SELECT timestamp, session_id, action, version, toString(payload) as payload, site_uuid, defaultValueOfTypeName('DateTime64(3)') AS inserted_at

package/core/server/data/tinybird/scripts/configure-ghost.sh

@@ -55,11 +55,13 @@ export TINYBIRD_TRACKER_TOKEN="$TRACKER_TOKEN"
 export tinybird__adminToken="$TINYBIRD_ADMIN_TOKEN"
 export tinybird__workspaceId="$TINYBIRD_WORKSPACE_ID"
 export tinybird__stats__endpoint="http://localhost:7181"
+export tinybird__tracker__endpoint="http://localhost:3000/api/v1/page_hit"
 
 # If running in GitHub Actions, also export to GITHUB_ENV
 if [ -n "$GITHUB_ENV" ]; then
     echo "tinybird__adminToken=$TINYBIRD_ADMIN_TOKEN" >> $GITHUB_ENV
     echo "tinybird__workspaceId=$TINYBIRD_WORKSPACE_ID" >> $GITHUB_ENV
-    echo "tinybird__stats__endpoint=http://localhost:7181" >> $GITHUB_ENV
+    echo "tinybird__stats__endpoint=$tinybird__stats__endpoint" >> $GITHUB_ENV
     echo "TINYBIRD_TRACKER_TOKEN=$TINYBIRD_TRACKER_TOKEN" >> $GITHUB_ENV
-fi
+    echo "tinybird__tracker__endpoint=$tinybird__tracker__endpoint" >> $GITHUB_ENV
+fi

package/core/server/services/lib/magic-link/MagicLink.js

@@ -1,6 +1,7 @@
 const {IncorrectUsageError, BadRequestError} = require('@tryghost/errors');
 const {isEmail} = require('@tryghost/validator');
 const tpl = require('@tryghost/tpl');
+
 const messages = {
     invalidEmail: 'Email is not valid'
 };
@@ -17,6 +18,8 @@ const messages = {
  * @typedef {Object} TokenProvider<T, D>
  * @prop {(data: D) => Promise<T>} create
  * @prop {(token: T) => Promise<D>} validate
+ * @prop {(token: T) => Promise<string | null>} [getIdByToken]
+ * @prop {(tokenId: string, tokenValue: T) => string} [deriveOTC]
  */
 
 /**
@@ -34,6 +37,7 @@ class MagicLink {
      * @param {typeof defaultGetHTML} [options.getHTML]
      * @param {typeof defaultGetSubject} [options.getSubject]
      * @param {object} [options.sentry]
+     * @param {{isSet(name: string): boolean}} [options.labsService]
      */
     constructor(options) {
         if (!options || !options.transporter || !options.tokenProvider || !options.getSigninURL) {
@@ -46,6 +50,7 @@ class MagicLink {
         this.getHTML = options.getHTML || defaultGetHTML;
         this.getSubject = options.getSubject || defaultGetSubject;
         this.sentry = options.sentry || undefined;
+        this.labsService = options.labsService || undefined;
     }
 
     /**
@@ -56,7 +61,8 @@ class MagicLink {
      * @param {TokenData} options.tokenData - The data for token
      * @param {string} [options.type='signin'] - The type to be passed to the url and content generator functions
      * @param {string} [options.referrer=null] - The referrer of the request, if exists. The member will be redirected back to this URL after signin.
-     * @returns {Promise<{token: Token, info: SentMessageInfo}>}
+     * @param {boolean} [options.includeOTC=false] - Whether to send a one-time-code in the email.
+     * @returns {Promise<{token: Token, tokenId: string | null, info: SentMessageInfo}>}
      */
     async sendMagicLink(options) {
         this.sentry?.captureMessage?.(`[Magic Link] Generating magic link`, {extra: options});
@@ -73,14 +79,38 @@ class MagicLink {
 
         const url = this.getSigninURL(token, type, options.referrer);
 
+        let otc = null;
+        if (this.labsService?.isSet('membersSigninOTC') && options.includeOTC) {
+            try {
+                otc = await this.getOTCFromToken(token);
+            } catch (err) {
+                this.sentry?.captureException?.(err);
+                otc = null;
+            }
+        }
+
         const info = await this.transporter.sendMail({
             to: options.email,
-            subject: this.getSubject(type),
-            text: this.getText(url, type, options.email),
-            html: this.getHTML(url, type, options.email)
+            subject: this.getSubject(type, otc),
+            text: this.getText(url, type, options.email, otc),
+            html: this.getHTML(url, type, options.email, otc)
         });
 
-        return {token, info};
+        // return tokenId so we can pass it as a reference to the client so it
+        // can pass it back as a reference when verifying the OTC. We only do
+        // this if we've successfully generated an OTC to avoid clients showing
+        // a token input field when the email doesn't contain an OTC
+        let tokenId = null;
+        if (this.labsService?.isSet('membersSigninOTC') && otc) {
+            try {
+                tokenId = await this.getIdFromToken(token);
+            } catch (err) {
+                this.sentry?.captureException?.(err);
+                tokenId = null;
+            }
+        }
+
+        return {token, tokenId, info};
     }
 
     /**
@@ -99,6 +129,38 @@ class MagicLink {
         return this.getSigninURL(token, type, options.referrer);
     }
 
+    /**
+     * getIdFromToken
+     *
+     * @param {Token} token - The token to get the id from
+     * @returns {Promise<string|null>} id - The id of the token
+     */
+    async getIdFromToken(token) {
+        if (typeof this.tokenProvider.getIdByToken !== 'function') {
+            return null;
+        }
+
+        const id = await this.tokenProvider.getIdByToken(token);
+        return id;
+    }
+
+    /**
+     * getOTCFromToken
+     *
+     * @param {Token} token - The token to get the otc from
+     * @returns {Promise<string|null>} otc - The otc of the token
+     */
+    async getOTCFromToken(token) {
+        const tokenId = await this.getIdFromToken(token);
+
+        if (!tokenId || typeof this.tokenProvider.deriveOTC !== 'function') {
+            return null;
+        }
+
+        const otc = await this.tokenProvider.deriveOTC(tokenId, token);
+        return otc;
+    }
+
     /**
      * getDataFromToken
      *
@@ -117,13 +179,19 @@ class MagicLink {
  * @param {URL} url - The url which will trigger sign in flow
  * @param {string} type - The type of email to send e.g. signin, signup
  * @param {string} email - The recipient of the email to send
+ * @param {string} otc - Optional one-time-code
  * @returns {string} text - The text content of an email to send
  */
-function defaultGetText(url, type, email) {
+function defaultGetText(url, type, email, otc) {
     let msg = 'sign in';
     if (type === 'signup') {
         msg = 'confirm your email address';
     }
+
+    if (otc) {
+        return `Enter the code ${otc} or click here to ${msg} ${url}. This msg was sent to ${email}`;
+    }
+
     return `Click here to ${msg} ${url}. This msg was sent to ${email}`;
 }
 
@@ -133,13 +201,19 @@ function defaultGetText(url, type, email) {
  * @param {URL} url - The url which will trigger sign in flow
  * @param {string} type - The type of email to send e.g. signin, signup
  * @param {string} email - The recipient of the email to send
+ * @param {string} otc - Optional one-time-code
  * @returns {string} HTML - The HTML content of an email to send
  */
-function defaultGetHTML(url, type, email) {
+function defaultGetHTML(url, type, email, otc) {
     let msg = 'sign in';
     if (type === 'signup') {
         msg = 'confirm your email address';
     }
+
+    if (otc) {
+        return `Enter the code ${otc} or <a href="${url}">click here to ${msg}</a> This msg was sent to ${email}`;
+    }
+
     return `<a href="${url}">Click here to ${msg}</a> This msg was sent to ${email}`;
 }
 
@@ -147,12 +221,18 @@ function defaultGetHTML(url, type, email) {
  * defaultGetSubject
  *
  * @param {string} type - The type of email to send e.g. signin, signup
+ * @param {string} otc - Optional one-time-code
  * @returns {string} subject - The subject of an email to send
  */
-function defaultGetSubject(type) {
+function defaultGetSubject(type, otc) {
     if (type === 'signup') {
         return `Signup!`;
     }
+
+    if (otc) {
+        return `Your signin verification code is ${otc}`;
+    }
+
     return `Signin!`;
 }
 

package/core/server/services/members/SingleUseTokenProvider.js

@@ -1,5 +1,7 @@
 // @ts-check
 const {ValidationError} = require('@tryghost/errors');
+const crypto = require('node:crypto');
+const {hotp} = require('otplib');
 
 class SingleUseTokenProvider {
     /**
@@ -8,12 +10,14 @@ class SingleUseTokenProvider {
      * @param {number} dependencies.validityPeriod - How long a token is valid for from it's creation in milliseconds.
      * @param {number} dependencies.validityPeriodAfterUsage - How long a token is valid after first usage, in milliseconds.
      * @param {number} dependencies.maxUsageCount - How many times a token can be used.
+     * @param {string} [dependencies.secret] - Secret for generating and verifying OTP codes.
      */
-    constructor({SingleUseTokenModel, validityPeriod, validityPeriodAfterUsage, maxUsageCount}) {
+    constructor({SingleUseTokenModel, validityPeriod, validityPeriodAfterUsage, maxUsageCount, secret}) {
         this.model = SingleUseTokenModel;
         this.validityPeriod = validityPeriod;
         this.validityPeriodAfterUsage = validityPeriodAfterUsage;
         this.maxUsageCount = maxUsageCount;
+        this.secret = secret;
     }
 
     /**
@@ -106,6 +110,62 @@ class SingleUseTokenProvider {
             return {};
         }
     }
+
+    /**
+     * @private
+     * @method deriveCounter
+     * Derives a counter from a token ID and value
+     *
+     * @param {string} tokenId
+     * @param {string} tokenValue
+     * @returns {number}
+     */
+    deriveCounter(tokenId, tokenValue) {
+        const msg = `${tokenId}|${tokenValue}`;
+        const digest = crypto.createHash('sha256').update(msg).digest();
+        return digest.readUInt32BE(0);
+    }
+
+    /**
+     * @method deriveOTC
+     * Derives an OTC (one-time code) from a token ID and value
+     *
+     * @param {string} tokenId - Token ID
+     * @param {string} tokenValue - Token value
+     * @returns {string} The generated one-time code
+     */
+    deriveOTC(tokenId, tokenValue) {
+        if (!this.secret) {
+            throw new ValidationError({
+                message: 'Cannot derive OTC: secret not configured'
+            });
+        }
+
+        if (!tokenId || !tokenValue) {
+            throw new ValidationError({
+                message: 'Cannot derive OTC: tokenId and tokenValue are required'
+            });
+        }
+
+        const counter = this.deriveCounter(tokenId, tokenValue);
+        return hotp.generate(this.secret, counter);
+    }
+
+    /**
+     * @method getIdByToken
+     * Retrieves the ID associated with a given token.
+     *
+     * @param {string} token - The token to look up.
+     * @returns {Promise<string|null>} The ID if found, or null if not found or on error.
+     */
+    async getIdByToken(token) {
+        try {
+            const model = await this.model.findOne({token});
+            return model ? model.get('id') : null;
+        } catch (err) {
+            return null;
+        }
+    }
 }
 
 module.exports = SingleUseTokenProvider;

package/core/server/services/members/api.js

@@ -57,7 +57,8 @@ function createApiInstance(config) {
                 SingleUseTokenModel: models.SingleUseToken,
                 validityPeriod: MAGIC_LINK_TOKEN_VALIDITY,
                 validityPeriodAfterUsage: MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE,
-                maxUsageCount: MAGIC_LINK_TOKEN_MAX_USAGE_COUNT
+                maxUsageCount: MAGIC_LINK_TOKEN_MAX_USAGE_COUNT,
+                secret: settingsCache.get('members_email_auth_secret')
             })
         },
         mail: {
@@ -75,7 +76,7 @@ function createApiInstance(config) {
                     return ghostMailer.send(msg);
                 }
             },
-            getSubject(type) {
+            getSubject(type, otc) {
                 const siteTitle = settingsCache.get('title');
                 switch (type) {
                 case 'subscribe':
@@ -88,10 +89,14 @@ function createApiInstance(config) {
                     return `📫 ${t(`Confirm your email update for {siteTitle}!`, {siteTitle, interpolation: {escapeValue: false}})}`;
                 case 'signin':
                 default:
-                    return `🔑 ${t(`Secure sign in link for {siteTitle}`, {siteTitle, interpolation: {escapeValue: false}})}`;
+                    if (otc) {
+                        return `🔑 ${t('Your verification code for {siteTitle}', {siteTitle, interpolation: {escapeValue: false}})}`;
+                    } else {
+                        return `🔑 ${t(`Secure sign in link for {siteTitle}`, {siteTitle, interpolation: {escapeValue: false}})}`;
+                    }
                 }
             },
-            getText(url, type, email) {
+            getText(url, type, email, otc) {
                 const siteTitle = settingsCache.get('title');
                 switch (type) {
                 case 'subscribe':
@@ -162,10 +167,14 @@ function createApiInstance(config) {
                         `;
                 case 'signin':
                 default:
+                    /* eslint-disable indent */
                     return trimLeadingWhitespace`
                         ${t(`Hey there,`)}
 
-                        ${t('Welcome back! Use this link to securely sign in to your {siteTitle} account:', {siteTitle, interpolation: {escapeValue: false}})}
+                        ${otc
+                            ? `${t('Your verification code for {siteTitle}', {siteTitle, interpolation: {escapeValue: false}})}: ${otc}\n\n${t('Or use this link to securely sign in', {interpolation: {escapeValue: false}})}:`
+                            : `${t('Welcome back! Use this link to securely sign in to your {siteTitle} account:', {siteTitle, interpolation: {escapeValue: false}})}`
+                        }
 
                         ${url}
 
@@ -177,10 +186,11 @@ function createApiInstance(config) {
 
                         ${t('Sent to {email}', {email})}
                         ${t('If you did not make this request, you can safely ignore this email.')}
-                        `;
+                    `;
+                    /* eslint-enable indent */
                 }
             },
-            getHTML(url, type, email) {
+            getHTML(url, type, email, otc) {
                 const siteTitle = settingsCache.get('title');
                 const siteUrl = urlUtils.urlFor('home', true);
                 const domain = urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)', 'i'));
@@ -197,7 +207,7 @@ function createApiInstance(config) {
                     return updateEmail({t, url, email, siteTitle, accentColor, siteDomain, siteUrl});
                 case 'signin':
                 default:
-                    return signinEmail({t, url, email, siteTitle, accentColor, siteDomain, siteUrl});
+                    return signinEmail({t, url, otc, email, siteTitle, accentColor, siteDomain, siteUrl});
                 }
             }
         },

package/core/server/services/members/emails/signin.js

@@ -1,10 +1,14 @@
-module.exports = ({t, siteTitle, email, url, accentColor = '#15212A', siteDomain, siteUrl}) => `
+/* eslint-disable indent */
+module.exports = ({t, siteTitle, email, url, otc, accentColor = '#15212A', siteDomain, siteUrl}) => `
 <!doctype html>
 <html>
   <head>
     <meta name="viewport" content="width=device-width">
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-    <title>🔑 ${t('Secure sign in link for {siteTitle}', {siteTitle, interpolation: {escapeValue: false}})}</title>
+    ${otc
+        ? `<title>🔑 ${t('Your verification code for {siteTitle}', {siteTitle, interpolation: {escapeValue: false}})}</title>`
+        : `<title>🔑 ${t('Secure sign in link for {siteTitle}', {siteTitle, interpolation: {escapeValue: false}})}</title>`
+    }
     <style>
     /* -------------------------------------
         RESPONSIVE AND MOBILE FRIENDLY STYLES
@@ -117,7 +121,36 @@ module.exports = ({t, siteTitle, email, url, accentColor = '#15212A', siteDomain
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top;">
                         <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 20px; color: #15212A; font-weight: bold; line-height: 24px; margin: 0; margin-bottom: 15px;">${t('Hey there,')}</p>
-                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px; margin-bottom: 32px;">${t('Welcome back! Use this link to securely sign in to your {siteTitle} account:', {siteTitle, interpolation: {escapeValue: false}})}</p>
+                        ${otc ?
+                        `<p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px; margin-bottom: 24px;">${t(`Welcome back! Here's your code to sign in to {siteTitle}. For your security, it's valid for 24 hours`, {siteTitle, interpolation: {escapeValue: false}})}:</p>
+                        <table border="0" cellpadding="0" cellspacing="0" class="btn btn-primary" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; box-sizing: border-box; margin-bottom: 32px;">
+                          <tbody>
+                            <tr>
+                              <td style="padding: 16px; background-color: #F4F5F6; border-radius: 8px; text-align: center; vertical-align: middle;" valign="middle">
+                                <h2 style="text-align: center; vertical-align: center; letter-spacing: 5px; font-size: 24px; color: #15212A; font-weight: 600; line-height: 24px; margin: 0;">${otc}</h2>
+                              </td>
+                            </tr>
+                          </tbody>
+                        </table>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px; margin-bottom: 24px;">${t('Or, skip the code and log in directly')}:</p>
+                        <table border="0" cellpadding="0" cellspacing="0" class="btn btn-primary" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; box-sizing: border-box;">
+                          <tbody>
+                            <tr>
+                              <td align="center" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; padding-bottom: 35px;">
+                                <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%;">
+                                  <tbody>
+                                    <tr>
+                                      <td align="center" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top; background-color: ${accentColor}; border-radius: 5px; text-align: center;"> <a href="${url}" target="_blank" style="display: inline-block; color: #ffffff; background-color: ${accentColor}; border: solid 1px ${accentColor}; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: ${accentColor};">${t('Sign in now')}</a> </td>
+                                    </tr>
+                                  </tbody>
+                                </table>
+                              </td>
+                            </tr>
+                          </tbody>
+                        </table>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px;">${t('Alternatively you can copy and paste this URL to your browser')}:</p>`
+                        :
+                        `<p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px; margin-bottom: 32px;">${t('Welcome back! Use this link to securely sign in to your {siteTitle} account:', {siteTitle, interpolation: {escapeValue: false}})}</p>
                         <table border="0" cellpadding="0" cellspacing="0" class="btn btn-primary" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; box-sizing: border-box;">
                           <tbody>
                             <tr>
@@ -136,7 +169,8 @@ module.exports = ({t, siteTitle, email, url, accentColor = '#15212A', siteDomain
                         <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 24px; margin: 0; margin-bottom: 11px;">${t('For your security, the link will expire in 24 hours time.')}</p>
                         <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; line-height: 24px; margin: 0; margin-bottom: 30px;">${t('See you soon!')}</p>
                         <hr/>
-                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px;">${t('You can also copy & paste this URL into your browser:')}</p>
+                        <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; color: #3A464C; font-weight: normal; margin: 0; line-height: 24px;">${t('You can also copy & paste this URL into your browser:')}</p>`
+                        }
                         <p style="word-break: break-all; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 15px; line-height: 22px; margin-top:0; color: #3A464C;">${url}</p>
                       </td>
                     </tr>

package/core/server/services/members/members-api/controllers/RouterController.js

@@ -626,7 +626,12 @@ module.exports = class RouterController {
             if (emailType === 'signup' || emailType === 'subscribe') {
                 await this._handleSignup(req, normalizedEmail, referrer);
             } else {
-                await this._handleSignin(req, normalizedEmail, referrer);
+                const signIn = await this._handleSignin(req, normalizedEmail, referrer);
+
+                if (this.labsService.isSet('membersSigninOTC') && signIn.tokenId) {
+                    res.writeHead(201, {'Content-Type': 'application/json'});
+                    return res.end(JSON.stringify({otc_ref: signIn.tokenId}));
+                }
             }
 
             res.writeHead(201);
@@ -679,7 +684,13 @@ module.exports = class RouterController {
     }
 
     async _handleSignin(req, normalizedEmail, referrer = null) {
-        const {emailType} = req.body;
+        const {emailType, otc} = req.body;
+
+        let includeOTC = false;
+
+        if (this.labsService.isSet('membersSigninOTC') && (otc === true || otc === 'true')) {
+            includeOTC = true;
+        }
 
         const member = await this._memberRepository.get({email: normalizedEmail});
 
@@ -690,7 +701,7 @@ module.exports = class RouterController {
         }
 
         const tokenData = {};
-        return await this._sendEmailWithMagicLink({email: normalizedEmail, tokenData, requestedType: emailType, referrer});
+        return await this._sendEmailWithMagicLink({email: normalizedEmail, tokenData, requestedType: emailType, referrer, includeOTC});
     }
 
     /**

package/core/server/services/members/members-api/members-api.js

@@ -158,7 +158,8 @@ module.exports = function MembersAPI({
         getText,
         getHTML,
         getSubject,
-        sentry
+        sentry,
+        labsService
     });
 
     const paymentsService = new PaymentsService({
@@ -207,7 +208,7 @@ module.exports = function MembersAPI({
 
     const users = memberRepository;
 
-    async function sendEmailWithMagicLink({email, requestedType, tokenData, options = {forceEmailType: false}, referrer = null}) {
+    async function sendEmailWithMagicLink({email, requestedType, tokenData, options = {forceEmailType: false}, referrer = null, includeOTC = false}) {
         let type = requestedType;
         if (!options.forceEmailType) {
             const member = await users.get({email});
@@ -217,7 +218,7 @@ module.exports = function MembersAPI({
                 type = 'signup';
             }
         }
-        return magicLinkService.sendMagicLink({email, type, tokenData: Object.assign({email, type}, tokenData), referrer});
+        return magicLinkService.sendMagicLink({email, type, tokenData: Object.assign({email, type}, tokenData), referrer, includeOTC});
     }
 
     /**

package/core/server/services/stats/PostsStatsService.js

@@ -74,7 +74,7 @@ const {getDateBoundaries, applyDateFilter} = require('./utils/date-utils');
 /**
  * @typedef {Object} NewsletterSubscriberStats
  * @property {number} total - Total current subscriber count
- * @property {Array<{date: string, value: number}>} deltas - Daily subscription deltas
+ * @property {Array<{date: string, value: number}>} values - Daily subscription cumulative values
  */
 
 class PostsStatsService {
@@ -932,7 +932,7 @@ class PostsStatsService {
      * @param {string} [options.date_from] - Optional start date filter (YYYY-MM-DD)
      * @param {string} [options.date_to] - Optional end date filter (YYYY-MM-DD)
      * @param {string} [options.timezone] - Timezone to use for date interpretation
-     * @returns {Promise<{data: Array<{total: number, deltas: Array<{date: string, value: number}>}>}>} The newsletter subscriber stats
+     * @returns {Promise<{data: Array<{total: number, values: Array<{date: string, value: number}>}>}>} The newsletter subscriber stats with cumulative values
      */
     async getNewsletterSubscriberStats(newsletterId, options = {}) {
         try {
@@ -956,25 +956,42 @@ class PostsStatsService {
             const totalValue = totalResult[0] ? totalResult[0].total : 0;
             const total = parseInt(String(totalValue), 10);
 
-            // Transform raw database results to properly typed objects
-            const deltas = [];
+            // Transform raw database results (daily changes) to cumulative values
+            const values = [];
+            let cumulativeTotal = 0;
+            
+            // First pass: collect all daily changes from database
+            const dailyChanges = [];
             for (const row of rawDeltas) {
                 if (row) {
                     // @ts-ignore
                     const dateValue = row.date || '';
                     // @ts-ignore
-                    const deltaValue = row.value || 0;
-                    deltas.push({
+                    const changeValue = row.value || 0;
+                    dailyChanges.push({
                         date: String(dateValue),
-                        value: parseInt(String(deltaValue), 10)
+                        change: parseInt(String(changeValue), 10)
                     });
                 }
             }
+            
+            // Calculate the starting point by working backwards from the current total
+            const totalChange = dailyChanges.reduce((sum, item) => sum + item.change, 0);
+            cumulativeTotal = total - totalChange;
+            
+            // Second pass: build cumulative values from daily changes
+            for (const dayData of dailyChanges) {
+                cumulativeTotal += dayData.change;
+                values.push({
+                    date: dayData.date,
+                    value: cumulativeTotal
+                });
+            }
 
             return {
                 data: [{
                     total,
-                    deltas
+                    values
                 }]
             };
         } catch (error) {
@@ -982,7 +999,7 @@ class PostsStatsService {
             return {
                 data: [{
                     total: 0,
-                    deltas: []
+                    values: []
                 }]
             };
         }

package/core/server/services/stats/StatsService.js

@@ -156,7 +156,7 @@ class StatsService {
         
         // If no newsletterId is provided, we can't get specific stats
         if (!newsletterId) {
-            return {data: [{total: 0, deltas: []}]};
+            return {data: [{total: 0, values: []}]};
         }
         
         const result = await this.posts.getNewsletterSubscriberStats(newsletterId, otherOptions);