ghost 6.25.0 → 6.25.1

package/core/server/services/verification-trigger.js

@@ -3,17 +3,7 @@ const DomainEvents = require('@tryghost/domain-events');
 const {MemberCreatedEvent} = require('../../shared/events');
 
 const messages = {
-    emailVerificationNeeded: `We're hard at work processing your import. To make sure you get great deliverability, we'll need to enable some extra features for your account. A member of our team will be in touch with you by email to review your account make sure everything is configured correctly so you're ready to go.`,
-    emailVerificationEmailSubject: `Email needs verification`,
-    emailVerificationEmailMessageImport: `Email verification needed for site: {siteUrl}, has imported: {amountTriggered} members in the last 30 days.`,
-    emailVerificationEmailMessageAdmin: `Email verification needed for site: {siteUrl} has added: {amountTriggered} members through the Admin client in the last 30 days.`,
-    emailVerificationEmailMessageAPI: `Email verification needed for site: {siteUrl} has added: {amountTriggered} members through the API in the last 30 days.`
-};
-
-const verificationMessageBySource = {
-    api: messages.emailVerificationEmailMessageAPI,
-    admin: messages.emailVerificationEmailMessageAdmin,
-    import: messages.emailVerificationEmailMessageImport
+    emailVerificationNeeded: `We're hard at work processing your import. To make sure you get great deliverability, we'll need to enable some extra features for your account. A member of our team will be in touch by email to review your account and make sure everything is configured correctly so you're ready to go.`
 };
 
 class VerificationTrigger {
@@ -26,8 +16,6 @@ class VerificationTrigger {
      * @param {() => boolean} deps.isVerified Check Ghost config to see if we are already verified
      * @param {() => boolean} deps.isVerificationRequired Check Ghost settings to see whether verification has been requested
      * @param {(value: boolean) => void} deps.setVerificationRequired Directly update the settings cache for email_verification_required
-     * @param {() => boolean} deps.isVerificationFlowEnabled Check whether webhook-based verification flow is enabled
-     * @param {(content: {subject: string, message: string, amountTriggered: number}) => Promise<void>} deps.sendVerificationEmail Sends an email to the escalation address to confirm that customer needs to be verified
      * @param {(content: {amountTriggered: number, threshold: number, method: string}) => Promise<boolean>} deps.sendVerificationWebhook Sends a webhook to the escalation service to confirm that customer needs to be verified
      * @param {any} deps.Settings Ghost Settings model
      * @param {any} deps.eventRepository For querying events
@@ -39,8 +27,6 @@ class VerificationTrigger {
         isVerified,
         isVerificationRequired,
         setVerificationRequired,
-        isVerificationFlowEnabled,
-        sendVerificationEmail,
         sendVerificationWebhook,
         Settings,
         eventRepository
@@ -51,9 +37,7 @@ class VerificationTrigger {
         this._isVerified = isVerified;
         this._isVerificationRequired = isVerificationRequired;
         this._setVerificationRequired = setVerificationRequired || (() => {});
-        this._isVerificationFlowEnabled = isVerificationFlowEnabled || (() => false);
-        this._sendVerificationEmail = sendVerificationEmail;
-        this._sendVerificationWebhook = sendVerificationWebhook;
+        this._sendVerificationWebhook = sendVerificationWebhook || (async () => false);
         this._Settings = Settings;
         this._eventRepository = eventRepository;
 
@@ -76,13 +60,9 @@ class VerificationTrigger {
         return this._getImportTriggerThreshold();
     }
 
-    _shouldUseWebhookFlow() {
-        return this._isVerificationFlowEnabled() && typeof this._sendVerificationWebhook === 'function';
-    }
-
     /**
      *
-     * @param {MemberCreatedEvent} event
+     * @param {InstanceType<typeof MemberCreatedEvent>} event
      */
     async _handleMemberCreatedEvent(event) {
         const source = event.data?.source;
@@ -94,25 +74,29 @@ class VerificationTrigger {
             sourceThreshold = this._adminTriggerThreshold;
         }
 
-        if (['api', 'admin'].includes(source) && isFinite(sourceThreshold)) {
+        if (['api', 'admin'].includes(source) && Number.isFinite(sourceThreshold)) {
             const createdAt = new Date();
             createdAt.setDate(createdAt.getDate() - 30);
             const events = await this._eventRepository.getSignupEvents({}, {
-                source: source,
+                source,
                 created_at: {
                     $gt: createdAt.toISOString().replace('T', ' ').substring(0, 19)
                 }
             });
 
+            // TODO: Fix off-by-one issue in event dispatch: https://linear.app/ghost/issue/BER-3507/off-by-one-errors-in-event-query-pagination
+            const addOneForCurrentEvent = events.meta.pagination.total < events.meta.pagination.limit && events.data.length !== events.meta.pagination.total;
+            const currentImport = events.meta.pagination.total + (addOneForCurrentEvent ? 1 : 0);
+
             const membersTotal = (await this._eventRepository.getSignupEvents({}, {
                 source: 'member'
             })).meta.pagination.total;
 
             const effectiveThreshold = Math.max(sourceThreshold, membersTotal);
 
-            if (events.meta.pagination.total > effectiveThreshold) {
+            if (currentImport > effectiveThreshold) {
                 await this._startVerificationProcess({
-                    amount: events.meta.pagination.total,
+                    amount: currentImport,
                     threshold: effectiveThreshold,
                     method: source,
                     throwOnTrigger: false,
@@ -148,24 +132,9 @@ class VerificationTrigger {
         };
     }
 
-    async _startLegacyEmailVerificationProcess({amount, triggerSource, throwOnTrigger}) {
-        // GA removal point: delete this method once webhook delivery fully replaces email escalation.
-        const verificationMessage = verificationMessageBySource[triggerSource] || messages.emailVerificationEmailMessageImport;
-
-        await this._markVerificationRequired();
-
-        await this._sendVerificationEmail({
-            message: verificationMessage,
-            subject: messages.emailVerificationEmailSubject,
-            amountTriggered: amount
-        });
-
-        return this._finishTrigger(throwOnTrigger);
-    }
-
     async getImportThreshold() {
         const volumeThreshold = this._importTriggerThreshold;
-        if (!isFinite(volumeThreshold)) {
+        if (!Number.isFinite(volumeThreshold)) {
             return volumeThreshold;
         }
 
@@ -186,7 +155,7 @@ class VerificationTrigger {
     }
 
     async testImportThreshold() {
-        if (!isFinite(this._importTriggerThreshold)) {
+        if (!Number.isFinite(this._importTriggerThreshold)) {
             // Infinite threshold, quick path
             return;
         }
@@ -210,16 +179,18 @@ class VerificationTrigger {
             }
         });
 
+        const currentImport = events.meta.pagination.total;
+
         const membersTotal = (await this._eventRepository.getSignupEvents({}, {
             source: 'member'
         })).meta.pagination.total;
 
         // Import threshold is either the total number of members (discounting any created by imports in
         // the last 30 days) or the threshold defined in config, whichever is greater.
-        const importThreshold = Math.max(membersTotal - events.meta.pagination.total, this._importTriggerThreshold);
-        if (isFinite(importThreshold) && events.meta.pagination.total > importThreshold) {
+        const importThreshold = Math.max(membersTotal - currentImport, this._importTriggerThreshold);
+        if (Number.isFinite(importThreshold) && currentImport > importThreshold) {
             await this._startVerificationProcess({
-                amount: events.meta.pagination.total,
+                amount: currentImport,
                 threshold: importThreshold,
                 method: 'import',
                 throwOnTrigger: false,
@@ -254,36 +225,30 @@ class VerificationTrigger {
             return {needsVerification: false};
         }
 
-        // Only trigger flag change and escalation notification the first time
+        // Only trigger verification once.
         if (this._isVerificationRequired()) {
             return {needsVerification: false};
         }
 
-        const triggerSource = method ?? source ?? 'import';
+        let webhookWasSent = false;
 
-        if (this._shouldUseWebhookFlow()) {
-            try {
-                const webhookWasSent = await this._sendVerificationWebhook({
-                    amountTriggered: amount,
-                    threshold: threshold ?? amount,
-                    method: triggerSource
-                });
+        try {
+            webhookWasSent = await this._sendVerificationWebhook({
+                amountTriggered: amount,
+                threshold: threshold ?? amount,
+                method: method ?? source ?? 'import'
+            });
+        } catch (error) {
+            // `sendVerificationWebhook` already logs delivery failures.
+            return {needsVerification: false};
+        }
 
-                if (webhookWasSent) {
-                    await this._markVerificationRequired();
-                    return this._finishTrigger(throwOnTrigger);
-                }
-            } catch (error) {
-                // `sendVerificationWebhook` already logs delivery failures.
-            }
+        if (!webhookWasSent) {
+            return {needsVerification: false};
         }
 
-        // Default email flow — used unless the webhook flow is enabled and succeeds.
-        return await this._startLegacyEmailVerificationProcess({
-            amount,
-            triggerSource,
-            throwOnTrigger
-        });
+        await this._markVerificationRequired();
+        return this._finishTrigger(throwOnTrigger);
     }
 }
 

package/core/shared/labs.js

@@ -47,11 +47,11 @@ const PRIVATE_FEATURES = [
     'emailUniqueid',
     'themeTranslation',
     'indexnow',
-    'verificationFlow',
     'membersForward',
     'welcomeEmailsDesignCustomization',
     'pictureImageFormats',
-    'smarterCounts'
+    'smarterCounts',
+    'giftSubscriptions'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.25.0",
+  "version": "6.25.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -88,7 +88,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.25.0.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.25.1.tgz",
     "@tryghost/image-transform": "1.4.13",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.13",
@@ -110,7 +110,7 @@
     "@tryghost/mw-vhost": "1.0.1",
     "@tryghost/nodemailer": "0.3.48",
     "@tryghost/nql": "0.12.10",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.25.0.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.25.1.tgz",
     "@tryghost/pretty-cli": "1.2.47",
     "@tryghost/prometheus-metrics": "1.0.2",
     "@tryghost/promise": "0.3.15",
@@ -275,8 +275,8 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.25.0.tgz",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.25.0.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.25.1.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.25.1.tgz"
   },
   "nx": {
     "targets": {