ghost 6.37.1 → 6.38.0

package/core/frontend/helpers/social_accounts.js

@@ -0,0 +1,91 @@
+// # Social Accounts Helper
+// Usage:
+//   {{#social_accounts @site}}
+//       <a href="{{href}}" target="_blank" rel="noopener" aria-label="{{name}}">
+//           {{> (concat "icons/" type)}}
+//       </a>
+//   {{/social_accounts}}
+//
+// Iterates over the social accounts on the given source object in canonical
+// order, yielding `{type, href, username, name}` for each platform with a
+// username set.
+//
+// A source must be passed explicitly:
+//   {{#social_accounts @site}}    - site-level accounts
+//   {{#social_accounts author}}   - a specific author
+//   {{#social_accounts this}}     - the current context (e.g. inside {{#foreach authors}})
+const errors = require('@tryghost/errors');
+const tpl = require('@tryghost/tpl');
+const {socialUrls} = require('../services/proxy');
+const {hbs} = require('../services/handlebars');
+
+const createFrame = hbs.handlebars.createFrame;
+
+const messages = {
+    sourceRequired: 'The {{#social_accounts}} helper requires a source argument, e.g. {{#social_accounts @site}}...{{/social_accounts}}.',
+    blockRequired: 'The {{#social_accounts}} helper must be used as a block helper, e.g. {{#social_accounts @site}}...{{/social_accounts}}.'
+};
+
+// Canonical order mirrors the admin settings UI (SOCIAL_PLATFORM_KEYS).
+const SOCIAL_PLATFORMS = [
+    {type: 'twitter', name: 'X'},
+    {type: 'facebook', name: 'Facebook'},
+    {type: 'linkedin', name: 'LinkedIn'},
+    {type: 'bluesky', name: 'Bluesky'},
+    {type: 'threads', name: 'Threads'},
+    {type: 'mastodon', name: 'Mastodon'},
+    {type: 'tiktok', name: 'TikTok'},
+    {type: 'youtube', name: 'YouTube'},
+    {type: 'instagram', name: 'Instagram'}
+];
+
+module.exports = function social_accounts(source, options) { // eslint-disable-line camelcase
+    // {{#social_accounts}} with no positional arg: handlebars passes only options.
+    if (arguments.length < 2) {
+        throw new errors.IncorrectUsageError({
+            level: 'normal',
+            message: tpl(messages.sourceRequired),
+            help: 'https://ghost.org/docs/themes/helpers/social-accounts/'
+        });
+    }
+
+    options = options || {};
+    options.data = options.data || {};
+
+    const {fn, inverse, data} = options;
+
+    if (typeof fn !== 'function') {
+        throw new errors.IncorrectUsageError({
+            level: 'normal',
+            message: tpl(messages.blockRequired),
+            help: 'https://ghost.org/docs/themes/helpers/social-accounts/'
+        });
+    }
+
+    const accounts = SOCIAL_PLATFORMS.reduce((acc, {type, name}) => {
+        const username = source && source[type];
+        if (username && typeof socialUrls[type] === 'function') {
+            acc.push({type, name, username, href: socialUrls[type](username)});
+        }
+        return acc;
+    }, []);
+
+    if (!accounts.length) {
+        return inverse ? inverse(this) : '';
+    }
+
+    const frame = createFrame(data);
+    let output = '';
+
+    accounts.forEach((account, index) => {
+        frame.index = index;
+        frame.number = index + 1;
+        frame.first = index === 0;
+        frame.last = index === accounts.length - 1;
+        frame.even = index % 2 === 1;
+        frame.odd = !frame.even;
+        output += fn(account, {data: frame});
+    });
+
+    return output;
+};

package/core/frontend/services/sitemap/handler.js

@@ -13,7 +13,13 @@ module.exports = function handler(siteApp) {
         next();
     };
 
-    siteApp.get('/sitemap.xml', function sitemapXML(req, res) {
+    siteApp.get('/sitemap.xml', async function sitemapXML(req, res, next) {
+        try {
+            await manager.ensurePopulatedFromDatabase();
+        } catch (err) {
+            return next(err);
+        }
+
         res.set({
             'Cache-Control': 'public, max-age=' + config.get('caching:sitemap:maxAge'),
             'Content-Type': 'text/xml'
@@ -22,11 +28,17 @@ module.exports = function handler(siteApp) {
         res.send(manager.getIndexXml());
     });
 
-    siteApp.get('/sitemap-:resource.xml', verifyResourceType, function sitemapResourceXML(req, res) {
+    siteApp.get('/sitemap-:resource.xml', verifyResourceType, async function sitemapResourceXML(req, res, next) {
         const type = req.params.resource.replace(/-\d+$/, '');
         const pageParam = (req.params.resource.match(/-(\d+)$/) || [null, null])[1];
         const page = pageParam ? parseInt(pageParam, 10) : 1;
 
+        try {
+            await manager.ensurePopulatedFromDatabase();
+        } catch (err) {
+            return next(err);
+        }
+
         const content = manager.getSiteMapXml(type, page);
         // Prevent x-1.xml as it is a duplicate of x.xml and empty sitemaps
         // (except for the first page so that at least one sitemap exists per type)

package/core/frontend/services/sitemap/site-map-manager.js

@@ -1,5 +1,7 @@
 const DomainEvents = require('@tryghost/domain-events');
+const config = require('../../../shared/config');
 const {URLResourceUpdatedEvent} = require('../../../shared/events');
+const toPlain = require('../../../server/lib/common/to-plain');
 const IndexMapGenerator = require('./site-map-index-generator');
 const PagesMapGenerator = require('./page-map-generator');
 const PostsMapGenerator = require('./post-map-generator');
@@ -21,6 +23,20 @@ class SiteMapManager {
         this.tags = options.tags || this.createTagsGenerator(options);
         this.index = options.index || this.createIndexGenerator(options);
 
+        // The lazy URL service does not fire url.added / url.removed /
+        // URLResourceUpdatedEvent. When that mode is active the sitemap
+        // populates itself from the database on first request instead.
+        this._lazyRouting = options.lazyRouting === undefined
+            ? config.get('lazyRouting')
+            : options.lazyRouting;
+        this._populated = false;
+        this._populating = null;
+        // Each routers.reset bumps this generation. An in-flight populate
+        // captures the generation it started in; if that generation is no
+        // longer current when the populate settles, its result is discarded
+        // so we don't mark a stale (potentially mid-reset) lookup as ready.
+        this._populationGeneration = 0;
+
         events.on('router.created', (router) => {
             if (router.name === 'StaticRoutesRouter') {
                 this.pages.addUrl(router.getRoute({absolute: true}), {id: router.identifier, staticRoute: true});
@@ -31,23 +47,31 @@ class SiteMapManager {
             }
         });
 
-        DomainEvents.subscribe(URLResourceUpdatedEvent, (event) => {
-            this[event.data.resourceType].updateURL(event.data);
-        });
+        if (!this._lazyRouting) {
+            DomainEvents.subscribe(URLResourceUpdatedEvent, (event) => {
+                this[event.data.resourceType].updateURL(event.data);
+            });
 
-        events.on('url.added', (obj) => {
-            this[obj.resource.config.type].addUrl(obj.url.absolute, obj.resource.data);
-        });
+            events.on('url.added', (obj) => {
+                this[obj.resource.config.type].addUrl(obj.url.absolute, obj.resource.data);
+            });
 
-        events.on('url.removed', (obj) => {
-            this[obj.resource.config.type].removeUrl(obj.url.absolute, obj.resource.data);
-        });
+            events.on('url.removed', (obj) => {
+                this[obj.resource.config.type].removeUrl(obj.url.absolute, obj.resource.data);
+            });
+        }
 
         events.on('routers.reset', () => {
             this.pages && this.pages.reset();
             this.posts && this.posts.reset();
             this.users && this.users.reset();
             this.tags && this.tags.reset();
+            // Force the next sitemap request to repopulate from the DB.
+            // Bumping the generation invalidates any populate currently in
+            // flight (its `.then` will see a stale generation and bail).
+            this._populated = false;
+            this._populating = null;
+            this._populationGeneration += 1;
         });
     }
 
@@ -86,6 +110,106 @@ class SiteMapManager {
     getSiteMapXml(type, page) {
         return this[type].getXml(page);
     }
+
+    /**
+     * Populate the sitemap from the database. Used when the lazy URL service
+     * is active and the URL-added/-removed events are not firing. Idempotent;
+     * a second call is a no-op while the first is in flight or has finished.
+     */
+    async ensurePopulatedFromDatabase() {
+        if (!this._lazyRouting || this._populated) {
+            return;
+        }
+        if (this._populating) {
+            return this._populating;
+        }
+        const generation = this._populationGeneration;
+        const populating = this._populateFromDatabase().then(
+            () => {
+                // If a routers.reset happened while we were running, the
+                // generators have been wiped. Don't flip _populated; let the
+                // next request kick off a fresh populate.
+                if (this._populationGeneration === generation) {
+                    this._populated = true;
+                }
+                // Only clear our own handle. routers.reset already nulled
+                // _populating and a successor populate may have replaced it
+                // — clobbering would orphan the successor.
+                if (this._populating === populating) {
+                    this._populating = null;
+                }
+            },
+            (err) => {
+                if (this._populating === populating) {
+                    this._populating = null;
+                }
+                throw err;
+            }
+        );
+        this._populating = populating;
+        return this._populating;
+    }
+
+    async _populateFromDatabase() {
+        const models = require('../../../server/models');
+        const urlService = require('../../../server/services/url');
+        const facade = urlService.facade;
+
+        // Use TagPublic/Author for the shouldHavePosts gate (so tags/users
+        // with no published posts are excluded). The visibility filter is
+        // applied in TYPE_BROWSE_OPTIONS below; together these mirror what
+        // the eager URL service does in services/url/config.js.
+        await Promise.all([
+            this._loadType(models.Post, 'posts', this.posts, facade),
+            this._loadType(models.Post, 'pages', this.pages, facade),
+            this._loadType(models.TagPublic, 'tags', this.tags, facade),
+            this._loadType(models.Author, 'authors', this.users, facade)
+        ]);
+    }
+
+    async _loadType(Model, type, generator, facade) {
+        const baseOptions = browseOptionsFor(type);
+        let page = 1;
+        // eslint-disable-next-line no-constant-condition
+        while (true) {
+            const result = await Model.findPage({...baseOptions, page});
+            for (const model of result.data) {
+                const datum = toPlain(model);
+                const url = facade.getUrlForResource({...datum, type}, {absolute: true});
+                if (url && !url.match(/\/404\//)) {
+                    generator.addUrl(url, datum);
+                }
+            }
+            const totalPages = result?.meta?.pagination?.pages;
+            // Guard against unexpected response shapes (missing meta,
+            // empty page) so we don't loop forever.
+            if (!totalPages || page >= totalPages || result.data.length === 0) {
+                break;
+            }
+            page += 1;
+        }
+    }
+}
+
+// Per-router-type browse options for the lazy populate path. Mirrors the
+// eager URL service's resource queries (services/url/config.js): posts/pages
+// filter by published+type, tags/authors by visibility:public.
+//
+// `withRelated: ['tags', 'authors']` for posts: needed so the Bookshelf
+// model's toJSON output includes `primary_tag` and `primary_author`, which
+// custom permalink templates like `/:primary_tag/:slug/` evaluate against.
+// Without this preload the lazy sitemap would emit `/undefined/.../` for
+// any site using a primary_tag/primary_author permalink. Pages exclude
+// these in the eager config so we mirror that.
+const TYPE_BROWSE_OPTIONS = {
+    posts: {limit: 200, status: 'published', filter: 'type:post', withRelated: ['tags', 'authors']},
+    pages: {limit: 200, status: 'published', filter: 'type:page'},
+    tags: {limit: 200, filter: 'visibility:public'},
+    authors: {limit: 200, filter: 'visibility:public'}
+};
+
+function browseOptionsFor(type) {
+    return TYPE_BROWSE_OPTIONS[type] || {limit: 200};
 }
 
 module.exports = SiteMapManager;

package/core/frontend/web/middleware/handle-image-sizes.js

@@ -48,6 +48,10 @@ module.exports = function handleImageSizes(req, res, next) {
         if (format) {
             url = url.replace(`/format/${format}`, '');
         }
+
+        // Strip multiple leading slashes to prevent protocol-relative redirects
+        url = url.replace(/^\/+/, '/');
+
         return res.redirect(url);
     };
 

package/core/server/api/endpoints/automations.js

@@ -1,6 +1,12 @@
-const domainEvents = require('@tryghost/domain-events');
-const models = require('../../models');
-const StartAutomationsPollEvent = require('../../services/automations/events/start-automations-poll-event');
+const errors = require('@tryghost/errors');
+const automationsApi = require('../../services/automations/automations-api');
+
+const VALID_AUTOMATION_STATUSES = ['active', 'inactive'];
+
+const messages = {
+    invalidAutomationStatus: 'Automation status must be one of: active, inactive.',
+    invalidAutomationStatusHelp: 'Use "active" or "inactive" for automation status.'
+};
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -12,15 +18,7 @@ const controller = {
         },
         permissions: true,
         async query() {
-            const automations = await models.WelcomeEmailAutomation.findAll();
-            return {
-                data: automations.map(automation => ({
-                    id: automation.get('id'),
-                    name: automation.get('name'),
-                    slug: automation.get('slug'),
-                    status: automation.get('status')
-                }))
-            };
+            return await automationsApi.browse();
         }
     },
 
@@ -32,38 +30,33 @@ const controller = {
             'id'
         ],
         permissions: true,
-        query(frame) {
-            // TODO: NY-1265 - replace this static payload with persisted automation data.
-            return {
-                id: frame.data.id,
-                slug: 'member-welcome-email-free',
-                name: 'Welcome email',
-                status: 'active',
-                created_at: '2026-05-05T00:00:00.000Z',
-                updated_at: '2026-05-05T00:00:00.000Z',
-                actions: [{
-                    id: '67f3f3f3f3f3f3f3f3f3f3f4',
-                    type: 'delay',
-                    data: {
-                        delay_hours: 24
-                    }
-                }, {
-                    id: '67f3f3f3f3f3f3f3f3f3f3f5',
-                    type: 'send email',
-                    data: {
-                        email_subject: 'Welcome!',
-                        email_lexical: '{"root":{"children":[]}}',
-                        email_sender_name: null,
-                        email_sender_email: null,
-                        email_sender_reply_to: null,
-                        email_design_setting_id: '680000000000000000000001'
-                    }
-                }],
-                edges: [{
-                    source_action_id: '67f3f3f3f3f3f3f3f3f3f3f4',
-                    target_action_id: '67f3f3f3f3f3f3f3f3f3f3f5'
-                }]
-            };
+        async query(frame) {
+            return await automationsApi.read(frame.data.id);
+        }
+    },
+
+    edit: {
+        headers: {
+            cacheInvalidate: false
+        },
+        options: [
+            'id'
+        ],
+        validation(frame) {
+            const status = frame.data?.automations?.[0]?.status;
+
+            if (!VALID_AUTOMATION_STATUSES.includes(status)) {
+                throw new errors.ValidationError({
+                    message: messages.invalidAutomationStatus,
+                    context: status === undefined ? undefined : `Received status "${status}".`,
+                    help: messages.invalidAutomationStatusHelp,
+                    property: 'status'
+                });
+            }
+        },
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.edit(frame.options.id, frame.data.automations[0]);
         }
     },
 
@@ -77,7 +70,7 @@ const controller = {
             method: 'poll'
         },
         query() {
-            domainEvents.dispatch(StartAutomationsPollEvent.create());
+            automationsApi.requestPoll();
         }
     }
 };

package/core/server/models/member.js

@@ -312,32 +312,29 @@ const Member = ghostBookshelf.Model.extend({
     },
 
     onSaving: function onSaving(model, attr, options) {
-        let labelsToSave = [];
+        const rawLabels = this.get('labels');
 
-        if (_.isUndefined(this.get('labels'))) {
+        if (_.isUndefined(rawLabels)) {
             this.unset('labels');
             return;
         }
 
-        // CASE: detect lowercase/uppercase label slugs
-        if (!_.isUndefined(this.get('labels')) && !_.isNull(this.get('labels'))) {
-            labelsToSave = [];
-
-            //  and deduplicate upper/lowercase tags
-            _.each(this.get('labels'), function each(item) {
-                item.name = item.name && item.name.trim();
-                for (let i = 0; i < labelsToSave.length; i = i + 1) {
-                    if (labelsToSave[i].name && item.name && labelsToSave[i].name.toLocaleLowerCase() === item.name.toLocaleLowerCase()) {
-                        return;
-                    }
-                }
-
-                labelsToSave.push(item);
-            });
-
-            this.set('labels', labelsToSave);
-        }
+        // CASE: trim, drop nameless, and dedupe by case-insensitive name (first wins)
+        const seen = new Set();
+        const labelsToSave = (rawLabels || []).filter((item) => {
+            item.name = item.name && item.name.trim();
+            if (!item.name) {
+                return false;
+            }
+            const key = item.name.toLowerCase();
+            if (seen.has(key)) {
+                return false;
+            }
+            seen.add(key);
+            return true;
+        });
 
+        this.set('labels', labelsToSave);
         this.handleAttachedModels(model);
 
         // CASE: Detect existing labels with same case-insensitive name and replace
@@ -346,12 +343,20 @@ const Member = ghostBookshelf.Model.extend({
                 columns: ['id', 'name']
             }, _.pick(options, 'transacting')))
             .then((labels) => {
+                const existingByName = new Map();
+                for (const lab of labels.models) {
+                    const name = lab.get('name');
+                    if (name) {
+                        existingByName.set(name.toLowerCase(), lab);
+                    }
+                }
+
                 labelsToSave.forEach((label) => {
-                    let existingLabel = labels.find((lab) => {
-                        return label.name.toLowerCase() === lab.get('name').toLowerCase();
-                    });
-                    label.name = (existingLabel && existingLabel.get('name')) || label.name;
-                    label.id = (existingLabel && existingLabel.id) || label.id;
+                    const match = existingByName.get(label.name.toLowerCase());
+                    if (match) {
+                        label.name = match.get('name');
+                        label.id = match.id;
+                    }
                 });
 
                 model.set('labels', labelsToSave);

package/core/server/services/automations/automations-api.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/* eslint-disable @typescript-eslint/no-require-imports */
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const tpl_1 = __importDefault(require("@tryghost/tpl"));
+const fake_database_automations_repository_1 = require("./fake-database-automations-repository");
+const domainEvents = require('@tryghost/domain-events');
+const StartAutomationsPollEvent = require('./events/start-automations-poll-event');
+const temporaryFakeAutomationsDatabase = require('./temporary-fake-database');
+const messages = {
+    automationNotFound: 'Automation not found.'
+};
+let testDatabase = null;
+const repository = (0, fake_database_automations_repository_1.createFakeDatabaseAutomationsRepository)({
+    getDatabase: () => {
+        if (process.env.NODE_ENV?.startsWith('testing')) {
+            testDatabase ??= temporaryFakeAutomationsDatabase.createTemporaryFakeAutomationsDatabase();
+            return testDatabase;
+        }
+        return temporaryFakeAutomationsDatabase.getTemporaryFakeAutomationsDatabase();
+    }
+});
+async function browse() {
+    return await repository.browse();
+}
+async function read(automationId) {
+    const automation = await repository.getById(automationId);
+    if (!automation) {
+        throw new errors_1.default.NotFoundError({
+            message: (0, tpl_1.default)(messages.automationNotFound)
+        });
+    }
+    return automation;
+}
+async function edit(automationId, data) {
+    // TODO (NY-1229): Allow updating other fields and actions/edges.
+    const automation = await repository.edit(automationId, {
+        status: data.status
+    });
+    if (!automation) {
+        throw new errors_1.default.NotFoundError({
+            message: (0, tpl_1.default)(messages.automationNotFound)
+        });
+    }
+    return automation;
+}
+function requestPoll() {
+    domainEvents.dispatch(StartAutomationsPollEvent.create());
+}
+module.exports = {
+    browse,
+    edit,
+    read,
+    requestPoll
+};

package/core/server/services/automations/automations-api.ts

@@ -0,0 +1,71 @@
+/* eslint-disable @typescript-eslint/no-require-imports */
+import errors from '@tryghost/errors';
+import tpl from '@tryghost/tpl';
+import type {DatabaseSync} from 'node:sqlite';
+import {createFakeDatabaseAutomationsRepository} from './fake-database-automations-repository';
+
+const domainEvents = require('@tryghost/domain-events');
+const StartAutomationsPollEvent = require('./events/start-automations-poll-event');
+const temporaryFakeAutomationsDatabase = require('./temporary-fake-database');
+
+const messages = {
+    automationNotFound: 'Automation not found.'
+};
+
+interface EditAutomationData {
+    status: string;
+}
+
+let testDatabase: DatabaseSync | null = null;
+
+const repository = createFakeDatabaseAutomationsRepository({
+    getDatabase: () => {
+        if (process.env.NODE_ENV?.startsWith('testing')) {
+            testDatabase ??= temporaryFakeAutomationsDatabase.createTemporaryFakeAutomationsDatabase();
+            return testDatabase;
+        }
+        return temporaryFakeAutomationsDatabase.getTemporaryFakeAutomationsDatabase();
+    }
+});
+
+async function browse() {
+    return await repository.browse();
+}
+
+async function read(automationId: string) {
+    const automation = await repository.getById(automationId);
+
+    if (!automation) {
+        throw new errors.NotFoundError({
+            message: tpl(messages.automationNotFound)
+        });
+    }
+
+    return automation;
+}
+
+async function edit(automationId: string, data: EditAutomationData) {
+    // TODO (NY-1229): Allow updating other fields and actions/edges.
+    const automation = await repository.edit(automationId, {
+        status: data.status
+    });
+
+    if (!automation) {
+        throw new errors.NotFoundError({
+            message: tpl(messages.automationNotFound)
+        });
+    }
+
+    return automation;
+}
+
+function requestPoll() {
+    domainEvents.dispatch(StartAutomationsPollEvent.create());
+}
+
+module.exports = {
+    browse,
+    edit,
+    read,
+    requestPoll
+};

package/core/server/services/automations/automations-repository.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });