ghost 6.21.0 → 6.21.2

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -1,4 +1,5 @@
 const dns = require('node:dns/promises');
+const crypto = require('node:crypto');
 const tpl = require('@tryghost/tpl');
 const logging = require('@tryghost/logging');
 const sanitizeHtml = require('sanitize-html');
@@ -26,7 +27,6 @@ const messages = {
     inviteOnly: 'This site is invite-only, contact the owner for access.',
     paidOnly: 'This site only accepts paid members.',
     memberNotFound: 'No member exists with this e-mail address.',
-    memberNotFoundSignUp: 'No member exists with this e-mail address. Please sign up first.',
     invalidType: 'Invalid checkout type.',
     notConfigured: 'This site is not accepting payments at the moment.',
     invalidNewsletters: 'Cannot subscribe to invalid newsletters {newsletters}',
@@ -799,7 +799,7 @@ module.exports = class RouterController {
         if (!tokenValue) {
             throw new errors.BadRequestError({
                 message: tpl(messages.invalidCode),
-                code: 'INVALID_OTC_REF'
+                code: 'INVALID_OTC'
             });
         }
 
@@ -887,9 +887,9 @@ module.exports = class RouterController {
         const member = await this._memberRepository.get({email: normalizedEmail});
 
         if (!member) {
-            throw new errors.BadRequestError({
-                message: this._allowSelfSignup() ? tpl(messages.memberNotFoundSignUp) : tpl(messages.memberNotFound)
-            });
+            // Return a fake otcRef when OTC was requested so the response
+            // shape is identical regardless of whether a member exists
+            return includeOTC ? {otcRef: crypto.randomUUID()} : {};
         }
 
         const tokenData = {};

package/core/server/services/members/members-api/repositories/member-repository.js

@@ -1725,7 +1725,7 @@ module.exports = class MemberRepository {
         }
 
         // Check subscription doesn't already have an active offer
-        if (await hasActiveOffer(subscriptionModel, this._offersAPI)) {
+        if (await hasActiveOffer(subscriptionModel, this._offersAPI, options)) {
             throw new errors.BadRequestError({
                 message: tpl(messages.subscriptionHasOffer)
             });

package/core/server/services/members/members-api/utils/get-discount-window.js

@@ -1,3 +1,43 @@
+function getLastDayOfMonth(year, month) {
+    return new Date(Date.UTC(year, month + 1, 0)).getUTCDate();
+}
+
+function isLastDayOfMonth(date) {
+    return date.getUTCDate() === getLastDayOfMonth(date.getUTCFullYear(), date.getUTCMonth());
+}
+
+function getAnchoredBillingDate(anchorDate, monthOffset) {
+    const targetMonthIndex = anchorDate.getUTCMonth() + monthOffset;
+    const targetYear = anchorDate.getUTCFullYear() + Math.floor(targetMonthIndex / 12);
+    const targetMonth = ((targetMonthIndex % 12) + 12) % 12;
+    const targetLastDay = getLastDayOfMonth(targetYear, targetMonth);
+    const targetDay = isLastDayOfMonth(anchorDate) ? targetLastDay : Math.min(anchorDate.getUTCDate(), targetLastDay);
+
+    return new Date(Date.UTC(
+        targetYear,
+        targetMonth,
+        targetDay,
+        anchorDate.getUTCHours(),
+        anchorDate.getUTCMinutes(),
+        anchorDate.getUTCSeconds(),
+        anchorDate.getUTCMilliseconds()
+    ));
+}
+
+function getLastDiscountedPayment(nextBillingDate, discountEnd) {
+    const monthOffset =
+        ((discountEnd.getUTCFullYear() - nextBillingDate.getUTCFullYear()) * 12) +
+        (discountEnd.getUTCMonth() - nextBillingDate.getUTCMonth());
+
+    let lastDiscountedBillingDate = getAnchoredBillingDate(nextBillingDate, monthOffset);
+
+    if (lastDiscountedBillingDate > discountEnd) {
+        lastDiscountedBillingDate = getAnchoredBillingDate(nextBillingDate, monthOffset - 1);
+    }
+
+    return lastDiscountedBillingDate;
+}
+
 /**
  * Computes the discount window for a subscription based on available data.
  * Returns {start, end} if a discount window can be determined, null otherwise.
@@ -6,14 +46,35 @@
  * 1. Stripe coupon discounts (post-6.16) - uses discount_start / discount_end
  * 2. Legacy fallback - computes from offer duration and start_date
  *
- * @param {object} subscription - plain object with: discount_start, discount_end, start_date
+ * @param {object} subscription - plain object with: discount_start, discount_end, start_date, current_period_end, plan.interval, plan_interval
  * @param {object|null} offer - offer data with: duration, duration_in_months.
  *   Pass null to skip offer-dependent checks.
  * @returns {{start: *, end: *}|null}
  */
+
 module.exports = function getDiscountWindow(subscription, offer) {
     // Stripe coupon discount (post-6.16 data)
     if (subscription.discount_start) {
+        if (subscription.discount_end && offer?.duration === 'repeating') {
+            const discountEnd = new Date(subscription.discount_end);
+            const currentPeriodEnd = new Date(subscription.current_period_end);
+
+            if (discountEnd <= new Date()) {
+                return null;
+            }
+
+            // A discount ending at, or before, the current billing period end won't affect the next payment
+            if (discountEnd <= currentPeriodEnd) {
+                return null;
+            }
+
+            // Match the end date with the last discounted payment
+            return {
+                start: subscription.discount_start,
+                end: getLastDiscountedPayment(currentPeriodEnd, discountEnd)
+            };
+        }
+
         return {
             start: subscription.discount_start,
             end: subscription.discount_end || null
@@ -34,10 +95,15 @@ module.exports = function getDiscountWindow(subscription, offer) {
     }
 
     if (offer.duration === 'repeating' && offer.duration_in_months > 0) {
-        const end = new Date(subscription.start_date);
-        end.setUTCMonth(end.getUTCMonth() + offer.duration_in_months);
+        const end = getAnchoredBillingDate(new Date(subscription.start_date), offer.duration_in_months - 1);
+        const currentPeriodEnd = new Date(subscription.current_period_end);
+
+        if (end <= new Date()) {
+            return null;
+        }
 
-        if (new Date() >= end) {
+        // A discount ending before the end of the current billing period won't affect the next payment
+        if (end < currentPeriodEnd) {
             return null;
         }
 

package/core/server/services/members/members-api/utils/has-active-offer.js

@@ -1,28 +1,24 @@
 const getDiscountWindow = require('./get-discount-window');
 
 /**
- * Determines if a subscription currently has an active offer.
+ * Determines if a subscription has an offer that still affects the next payment,
+ * or an active trial.
  * Uses discount_start/discount_end (synced from Stripe) when available,
  * falls back to offer duration lookup for legacy data (pre-6.16).
  *
  * @param {object} subscriptionModel - Bookshelf model for members_stripe_customers_subscriptions
  * @param {object} offersAPI - OffersAPI instance with getOffer()
+ * @param {object} [options] - Optional query options such as transacting
  * @returns {Promise<boolean>}
  */
-module.exports = async function hasActiveOffer(subscriptionModel, offersAPI) {
+module.exports = async function hasActiveOffer(subscriptionModel, offersAPI, options = {}) {
     const subscriptionData = {
         discount_start: subscriptionModel.get('discount_start'),
         discount_end: subscriptionModel.get('discount_end'),
-        start_date: subscriptionModel.get('start_date')
+        start_date: subscriptionModel.get('start_date'),
+        current_period_end: subscriptionModel.get('current_period_end')
     };
 
-    // Check for active Stripe discount (post-6.16 data)
-    // discount_start takes precedence over trial and legacy fallback
-    const discountWindow = getDiscountWindow(subscriptionData, null);
-    if (discountWindow) {
-        return !discountWindow.end || new Date(discountWindow.end) > new Date();
-    }
-
     // Check for active trial (trial offers)
     const trialEndAt = subscriptionModel.get('trial_end_at');
     if (trialEndAt && new Date(trialEndAt) > new Date()) {
@@ -37,14 +33,14 @@ module.exports = async function hasActiveOffer(subscriptionModel, offersAPI) {
 
     // Look up the offer to determine if it's still active based on duration
     try {
-        const offer = await offersAPI.getOffer({id: offerId});
+        const offer = await offersAPI.getOffer({id: offerId}, options);
         if (!offer) {
             return false;
         }
 
-        const legacyWindow = getDiscountWindow(subscriptionData, offer);
-        if (legacyWindow) {
-            return !legacyWindow.end || new Date(legacyWindow.end) > new Date();
+        const discountWindow = getDiscountWindow(subscriptionData, offer);
+        if (discountWindow) {
+            return !discountWindow.end || new Date(discountWindow.end) > new Date();
         }
 
         return false;

package/core/server/services/oembed/oembed-service.js

@@ -262,7 +262,15 @@ class OEmbedService {
      * @param {string} url
      * @param {string} html
      *
-     * @returns {Promise<Object>}
+     * @returns {Promise<{
+     *     version: '1.0',
+     *     type: 'bookmark',
+     *     url: string,
+     *     metadata: Omit<import('metascraper').Metadata, 'image'|'logo'> & {
+     *         thumbnail?: string,
+     *         icon?: string
+     *     }
+     * }>}
      */
     async fetchBookmarkData(url, html, type) {
         const got = require('got');

package/core/server/services/offers/application/offer-mapper.js

@@ -33,6 +33,29 @@
  * @prop {string|null} last_redeemed
  */
 
+/**
+ * @typedef {object} PublicOfferDTO
+ * @prop {string} id
+ *
+ * @prop {string} display_title
+ * @prop {string} display_description
+ *
+ * @prop {'percent'|'fixed'|'trial'} type
+ *
+ * @prop {'month'|'year'} cadence
+ * @prop {number} amount
+ *
+ * @prop {'once'|'repeating'|'forever'|'trial'} duration
+ * @prop {null|number} duration_in_months
+ *
+ * @prop {string|null} currency
+ *
+ * @prop {'active'|'archived'} status
+ * @prop {'signup'|'retention'} redemption_type
+ *
+ * @prop {{id: string}|null} tier
+ */
+
 class OfferMapper {
     /**
      * @param {Offer} offer
@@ -62,6 +85,31 @@ class OfferMapper {
             last_redeemed: offer.lastRedeemed
         };
     }
+
+    /**
+     * Returns a DTO for a public facing offer (e.g. Portal's retention offer UI)
+     *
+     * @param {Offer} offer
+     * @returns {PublicOfferDTO}
+     */
+    static toPublicDTO(offer) {
+        return {
+            id: offer.id,
+            display_title: offer.displayTitle.value,
+            display_description: offer.displayDescription.value,
+            type: offer.type.value,
+            cadence: offer.cadence.value,
+            amount: offer.amount.value,
+            duration: offer.duration.value.type,
+            duration_in_months: offer.duration.value.type === 'repeating' ? offer.duration.value.months : null,
+            currency: offer.type.value === 'fixed' ? offer.currency.value : null,
+            status: offer.status.value,
+            redemption_type: offer.redemptionType.value,
+            tier: offer.tier
+                ? {id: offer.tier.id}
+                : null
+        };
+    }
 }
 
 module.exports = OfferMapper;

package/core/server/services/offers/application/offers-api.js

@@ -180,7 +180,7 @@ class OffersAPI {
      * @param {string} options.tierId
      * @param {'month'|'year'} options.cadence
      * @param {'signup'|'retention'} [options.redemptionType]
-     * @returns {Promise<OfferMapper.OfferDTO[]>}
+     * @returns {Promise<OfferMapper.PublicOfferDTO[]>}
      */
     async listOffersAvailableToSubscription({subscriptionId, tierId, cadence, redemptionType}) {
         debug(`listOffersAvailableToSubscription: subscriptionId=${subscriptionId}, tierId=${tierId}, cadence=${cadence}, redemptionType=${redemptionType}`);
@@ -246,7 +246,7 @@ class OffersAPI {
             }
 
             debug(`listOffersAvailableToSubscription: returning ${available.length} available offers`);
-            return available.map(OfferMapper.toDTO);
+            return available.map(OfferMapper.toPublicDTO);
         });
     }
 

package/core/shared/config/defaults.json

@@ -240,7 +240,7 @@
     },
     "portal": {
         "url": "https://cdn.jsdelivr.net/ghost/portal@~{version}/umd/portal.min.js",
-        "version": "2.65"
+        "version": "2.66"
     },
     "sodoSearch": {
         "url": "https://cdn.jsdelivr.net/ghost/sodo-search@~{version}/umd/sodo-search.min.js",

package/core/shared/labs.js

@@ -50,7 +50,8 @@ const PRIVATE_FEATURES = [
     'transistor',
     'retentionOffers',
     'membersForward',
-    'welcomeEmailsDesignCustomization'
+    'welcomeEmailsDesignCustomization',
+    'pictureImageFormats'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.21.0",
+  "version": "6.21.2",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -85,7 +85,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.21.0.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.21.2.tgz",
     "@tryghost/image-transform": "1.4.6",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.10",
@@ -107,7 +107,7 @@
     "@tryghost/mw-vhost": "1.0.1",
     "@tryghost/nodemailer": "0.3.48",
     "@tryghost/nql": "0.12.10",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.21.0.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.21.2.tgz",
     "@tryghost/pretty-cli": "1.2.47",
     "@tryghost/prometheus-metrics": "1.0.2",
     "@tryghost/promise": "0.3.15",
@@ -195,7 +195,7 @@
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
     "multer": "2.0.2",
-    "mysql2": "3.18.0",
+    "mysql2": "3.18.1",
     "nconf": "0.13.0",
     "node-fetch": "2.7.0",
     "node-jose": "2.2.0",
@@ -272,8 +272,8 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.21.0.tgz",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.21.0.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.21.2.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.21.2.tgz"
   },
   "nx": {
     "targets": {