ghost 6.40.0 → 6.41.0

package/core/server/adapters/scheduling/types.ts

@@ -0,0 +1,36 @@
+/**
+ * Shape of a job the scheduler adapter queues. Time is a unix timestamp;
+ * url carries a JWT-signed admin token; extra forwards through to the
+ * HTTP callback the adapter fires.
+ */
+export interface SchedulerJob {
+    time: number;
+    url: string;
+    extra: {
+        httpMethod: string;
+        oldTime?: number | null;
+    };
+}
+
+/**
+ * Implemented by scheduler-using subsystems (post-scheduling, automations,
+ * gift reminders). The adapter calls `rescheduleAll` on every registered
+ * rescheduler when something requires the queue to be rebuilt — currently
+ * after an internal API key rotation.
+ */
+export interface Rescheduler {
+    rescheduleAll(opts?: {previousKey?: {id: string; secret: string}}): Promise<void>;
+}
+
+/**
+ * The contract Ghost expects of any concrete scheduling adapter. Adapters
+ * that extend `SchedulingBase` inherit `register` and `rescheduleAll` for
+ * free; the three runtime methods (`schedule`, `unschedule`, `run`) are
+ * the ones each adapter implementation must provide.
+ */
+export interface SchedulerAdapter {
+    run(): void;
+    schedule(job: SchedulerJob): void;
+    unschedule(job: SchedulerJob, opts?: {bootstrap?: boolean}): void;
+    register(rescheduler: Rescheduler): void;
+}

package/core/server/api/endpoints/authentication.js

@@ -12,7 +12,17 @@ const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
 const UsersService = require('../../services/users');
 const userService = new UsersService({dbBackup, models, auth, apiMail, apiSettings});
-const {deleteAllSessions} = require('../../services/auth/session');
+const adapterManager = require('../../services/adapter-manager');
+const schedulerAdapter = adapterManager.getAdapter('scheduling');
+
+async function destroyRequestSession(req) {
+    if (!req || !req.session) {
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        req.session.destroy(err => (err ? reject(err) : resolve()));
+    });
+}
 
 const messages = {
     notTheBlogOwner: 'You are not the site owner.'
@@ -224,15 +234,26 @@ const controller = {
         }
     },
 
-    resetAllPasswords: {
-        statusCode: 204,
+    reset: {
+        statusCode: 200,
         headers: {
             cacheInvalidate: false
         },
         permissions: true,
         async query(frame) {
-            await userService.resetAllPasswords(frame.options);
-            await deleteAllSessions();
+            const result = await auth.resetAuthentication({
+                schedulerAdapter,
+                userService,
+                options: frame.options
+            });
+
+            // Express-session would otherwise re-save the current request's
+            // session on the response, resurrecting the row deleteAllSessions
+            // just wiped. Destroying the request session prevents the re-save
+            // and emits a Set-Cookie that expires the cookie on the client.
+            await destroyRequestSession(frame.original.session && frame.original.session.req);
+
+            return result;
         }
     }
 };

package/core/server/api/endpoints/schedules.js

@@ -1,4 +1,3 @@
-const models = require('../../models');
 const postScheduling = require('../../services/posts/post-scheduling');
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -52,35 +51,6 @@ const controller = {
             response[resourceType] = [scheduledResource];
             return response;
         }
-    },
-
-    getScheduled: {
-        // NOTE: this method is for internal use only by DefaultScheduler
-        //       it is not exposed anywhere!
-        headers: {
-            cacheInvalidate: false
-        },
-        permissions: false,
-        validation: {
-            options: {
-                resource: {
-                    required: true,
-                    values: ['posts', 'pages']
-                }
-            }
-        },
-        async query(frame) {
-            const resourceModel = 'Post';
-            const resourceType = (frame.options.resource === 'post') ? 'post' : 'page';
-            const cleanOptions = {};
-            cleanOptions.filter = `status:scheduled+type:${resourceType}`;
-            cleanOptions.columns = ['id', 'published_at', 'created_at', 'type'];
-
-            const result = await models[resourceModel].findAll(cleanOptions);
-            let response = {};
-            response[resourceType] = result;
-            return response;
-        }
     }
 };
 

package/core/server/api/endpoints/utils/serializers/output/authentication.js

@@ -71,5 +71,15 @@ module.exports = {
                 valid: !!data
             }]
         };
+    },
+
+    reset(data, apiConfig, frame) {
+        frame.response = {
+            security_action: [{
+                action: 'reset_authentication',
+                api_keys_rotated: data?.apiKeysRotated ?? 0,
+                users_locked: data?.usersLocked ?? 0
+            }]
+        };
     }
 };

package/core/server/data/migrations/versions/6.41/2026-05-13-12-00-00-rename-reset-all-passwords-permission.js

@@ -0,0 +1,21 @@
+const {createTransactionalMigration} = require('../../utils');
+
+// The `resetAllPasswords` action on the `authentication` object backed the
+// orphaned `/authentication/global_password_reset` endpoint. That endpoint is
+// replaced by `/authentication/reset`, which rotates every credential
+// (api keys, passwords, sessions) in one shot — so we rename the existing
+// permission row to match its new contract rather than introduce a fresh row
+// alongside a stale one.
+
+module.exports = createTransactionalMigration(
+    async function up(knex) {
+        await knex('permissions')
+            .where({action_type: 'resetAllPasswords', object_type: 'authentication'})
+            .update({name: 'Reset authentication', action_type: 'reset'});
+    },
+    async function down(knex) {
+        await knex('permissions')
+            .where({action_type: 'reset', object_type: 'authentication'})
+            .update({name: 'Reset all passwords', action_type: 'resetAllPasswords'});
+    }
+);

package/core/server/data/schema/fixtures/fixtures.json

@@ -630,8 +630,8 @@
                     "object_type": "offer"
                 },
                 {
-                    "name": "Reset all passwords",
-                    "action_type": "resetAllPasswords",
+                    "name": "Reset authentication",
+                    "action_type": "reset",
                     "object_type": "authentication"
                 },
                 {
@@ -957,7 +957,7 @@
                     "snippet": "all",
                     "custom_theme_setting": "all",
                     "offer": "all",
-                    "authentication": "resetAllPasswords",
+                    "authentication": "reset",
                     "members_stripe_connect": "auth",
                     "newsletter": "all",
                     "explore": "read",

package/core/server/models/api-key.js

@@ -3,6 +3,7 @@ const security = require('@tryghost/security');
 const ghostBookshelf = require('./base');
 const {Role} = require('./role');
 
+// secretlint-disable-next-line @secretlint/secretlint-rule-pattern
 const ApiKey = ghostBookshelf.Model.extend({
     tableName: 'api_keys',
 
@@ -61,6 +62,22 @@ const ApiKey = ghostBookshelf.Model.extend({
     refreshSecret(data, options) {
         const secret = security.secret.create(data.type);
         return this.edit(Object.assign({}, data, {secret}), options);
+    },
+
+    /**
+     * Refresh the secret on every API key row, returning the count rotated.
+     * Used by the danger-zone reset flow; callers are expected to wrap this
+     * in a transaction.
+     *
+     * @param {Object} options
+     * @returns {Promise<{count: number}>}
+     */
+    async refreshAllSecrets(options) {
+        const apiKeys = await this.findAll(options);
+        for (const apiKey of apiKeys.models) {
+            await this.refreshSecret(apiKey.toJSON(), Object.assign({}, options, {id: apiKey.id}));
+        }
+        return {count: apiKeys.length};
     }
 });
 
@@ -69,6 +86,7 @@ const ApiKeys = ghostBookshelf.Collection.extend({
 });
 
 module.exports = {
+    // secretlint-disable-next-line @secretlint/secretlint-rule-pattern
     ApiKey: ghostBookshelf.model('ApiKey', ApiKey),
     ApiKeys: ghostBookshelf.collection('ApiKeys', ApiKeys)
 };

package/core/server/models/user.js

@@ -174,6 +174,24 @@ User = ghostBookshelf.Model.extend({
         return this.get('status') === 'locked';
     },
 
+    /**
+     * Replace this user's password with an opaque random value, and mark
+     * them as locked unless they are already inactive (suspended). Suspended
+     * users must not be transitioned out of `inactive` — they retain the
+     * suspended-signin path — but their password is still rotated so a
+     * compromised credential cannot survive a future unsuspend.
+     */
+    lock: function lock(options) {
+        const update = {
+            // secretlint-disable-next-line @secretlint/secretlint-rule-pattern
+            password: security.identifier.uid(50)
+        };
+        if (this.get('status') !== 'inactive') {
+            update.status = 'locked';
+        }
+        return this.save(update, {...options, patch: true});
+    },
+
     isInactive: function isInactive() {
         return this.get('status') === 'inactive';
     },

package/core/server/services/adapter-manager/config.js

@@ -25,5 +25,11 @@ module.exports = function getAdapterServiceConfig(config) {
         };
     }
 
+    // FileStore needs Ghost's resolved content path, which isn't
+    // representable as a static value in defaults.json.
+    if (adapterServiceConfig.redirects?.FileStore) {
+        adapterServiceConfig.redirects.FileStore.basePath ||= config.getContentPath('data');
+    }
+
     return adapterServiceConfig;
 };

package/core/server/services/adapter-manager/index.js

@@ -16,6 +16,7 @@ adapterManager.registerAdapter('storage', require('ghost-storage-base'));
 adapterManager.registerAdapter('scheduling', require('../../adapters/scheduling/scheduling-base'));
 adapterManager.registerAdapter('sso', require('../../adapters/sso/SSOBase'));
 adapterManager.registerAdapter('cache', require('@tryghost/adapter-base-cache'));
+adapterManager.registerAdapter('redirects', require('../../adapters/redirects/RedirectsStoreBase'));
 
 module.exports = {
     /**

package/core/server/services/auth/index.js

@@ -17,5 +17,9 @@ module.exports = {
 
     get passwordreset() {
         return require('./passwordreset');
+    },
+
+    get resetAuthentication() {
+        return require('./reset-authentication').default;
     }
 };

package/core/server/services/auth/reset-authentication.js

@@ -0,0 +1,50 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = resetAuthentication;
+const internal_keys_1 = __importDefault(require("../internal-keys"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const modelsDefault = require('../../models');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { deleteAllSessions: deleteAllSessionsDefault } = require('./session');
+/**
+ * Rotation, user lock and the audit row commit in a single transaction so
+ * app crashes mid-flight can't leave the system half-rotated or lose the
+ * audit trail. Session deletion runs immediately after the commit, before
+ * the rescheduleAll, so a failure inside the adapter can't leave stale
+ * session rows live for an attacker.
+ *
+ * The schedulerAdapter and userService come from boot's lifecycle, so they
+ * are explicit parameters. The auth-domain primitives (models, internalKeys,
+ * sessions) default to their module singletons; tests pass overrides.
+ */
+async function resetAuthentication({ schedulerAdapter, userService, options, models = modelsDefault, internalKeys = internal_keys_1.default, deleteAllSessions = deleteAllSessionsDefault }) {
+    const previousSchedulerKey = await internalKeys.get('ghost-scheduler');
+    const actorId = options?.context?.user ?? null;
+    const { apiKeysRotated, usersLocked } = await models.Base.transaction(async (tx) => {
+        const txOptions = Object.assign({}, options, { transacting: tx });
+        const { count: rotated } = await models.ApiKey.refreshAllSecrets(txOptions);
+        const { count: locked } = await userService.lockAll(txOptions);
+        if (actorId) {
+            await models.Action.add({
+                event: 'edited',
+                resource_type: 'security_action',
+                resource_id: null,
+                actor_type: 'user',
+                actor_id: actorId,
+                context: {
+                    action_name: 'reset_authentication',
+                    api_keys_rotated: rotated,
+                    users_locked: locked
+                }
+            }, { transacting: tx, autoRefresh: false });
+        }
+        return { apiKeysRotated: rotated, usersLocked: locked };
+    });
+    internalKeys.clear();
+    await deleteAllSessions();
+    await schedulerAdapter.rescheduleAll({ previousKey: previousSchedulerKey });
+    return { apiKeysRotated, usersLocked };
+}

package/core/server/services/auth/reset-authentication.ts

@@ -0,0 +1,75 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import type {Knex} from 'knex';
+import type {InternalApiKey, InternalKeys} from '../internal-keys';
+import internalKeysDefault from '../internal-keys';
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const modelsDefault = require('../../models');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const {deleteAllSessions: deleteAllSessionsDefault} = require('./session');
+
+interface ResetAuthenticationArgs {
+    schedulerAdapter: {rescheduleAll(opts: {previousKey?: InternalApiKey}): Promise<unknown>};
+    userService: {lockAll(options: any): Promise<{count: number}>};
+    options: {context?: {user?: string}; [key: string]: unknown};
+    models?: any;
+    internalKeys?: InternalKeys;
+    deleteAllSessions?: () => Promise<void>;
+}
+
+interface ResetAuthenticationResult {
+    apiKeysRotated: number;
+    usersLocked: number;
+}
+
+/**
+ * Rotation, user lock and the audit row commit in a single transaction so
+ * app crashes mid-flight can't leave the system half-rotated or lose the
+ * audit trail. Session deletion runs immediately after the commit, before
+ * the rescheduleAll, so a failure inside the adapter can't leave stale
+ * session rows live for an attacker.
+ *
+ * The schedulerAdapter and userService come from boot's lifecycle, so they
+ * are explicit parameters. The auth-domain primitives (models, internalKeys,
+ * sessions) default to their module singletons; tests pass overrides.
+ */
+export default async function resetAuthentication({
+    schedulerAdapter,
+    userService,
+    options,
+    models = modelsDefault,
+    internalKeys = internalKeysDefault,
+    deleteAllSessions = deleteAllSessionsDefault
+}: ResetAuthenticationArgs): Promise<ResetAuthenticationResult> {
+    const previousSchedulerKey = await internalKeys.get('ghost-scheduler');
+    const actorId = options?.context?.user ?? null;
+
+    const {apiKeysRotated, usersLocked} = await models.Base.transaction(async (tx: Knex.Transaction) => {
+        const txOptions = Object.assign({}, options, {transacting: tx});
+
+        const {count: rotated} = await models.ApiKey.refreshAllSecrets(txOptions);
+        const {count: locked} = await userService.lockAll(txOptions);
+
+        if (actorId) {
+            await models.Action.add({
+                event: 'edited',
+                resource_type: 'security_action',
+                resource_id: null,
+                actor_type: 'user',
+                actor_id: actorId,
+                context: {
+                    action_name: 'reset_authentication',
+                    api_keys_rotated: rotated,
+                    users_locked: locked
+                }
+            }, {transacting: tx, autoRefresh: false});
+        }
+
+        return {apiKeysRotated: rotated, usersLocked: locked};
+    });
+
+    internalKeys.clear();
+    await deleteAllSessions();
+    await schedulerAdapter.rescheduleAll({previousKey: previousSchedulerKey});
+
+    return {apiKeysRotated, usersLocked};
+}

package/core/server/services/automations/index.js

@@ -18,10 +18,12 @@ const memberWelcomeEmailService = require('../member-welcome-emails/service');
  *         httpMethod: string;
  *     };
  * }) => void} schedule
+ * @prop {(rescheduler: {rescheduleAll: () => unknown}) => void} register
  */
 
 class AutomationsService {
     #initialized = false;
+    #enqueuePollNow;
 
     /**
      * @param {object} options
@@ -36,13 +38,9 @@ class AutomationsService {
             return;
         }
 
-        const enqueuePollNow = () => {
-            domainEvents.dispatch(StartAutomationsPollEvent.create());
-        };
+        this.#enqueuePollNow = () => domainEvents.dispatch(StartAutomationsPollEvent.create());
 
-        /**
-         * @param {Readonly<Date>} date
-         */
+        /** @param {Readonly<Date>} date */
         const enqueuePollAt = async (date) => {
             try {
                 const key = await internalKeys.get('ghost-scheduler');
@@ -55,18 +53,26 @@ class AutomationsService {
             }
         };
 
-        domainEvents.subscribe(StartAutomationsPollEvent, oneAtATime(async () => {
-            await poll({
-                memberWelcomeEmailService,
-                enqueueAnotherPollNow: enqueuePollNow,
-                enqueueAnotherPollAt: enqueuePollAt
-            });
-        }));
+        domainEvents.subscribe(StartAutomationsPollEvent, oneAtATime(async () => poll({
+            memberWelcomeEmailService,
+            enqueueAnotherPollNow: this.#enqueuePollNow,
+            enqueueAnotherPollAt: enqueuePollAt
+        })));
 
-        enqueuePollNow();
+        schedulerAdapter.register(this);
 
+        this.#enqueuePollNow();
         this.#initialized = true;
     }
+
+    /**
+     * Re-arm the poll chain. A queued poll signed under the previous scheduler
+     * key fails JWT verification when fired; this dispatches a fresh in-process
+     * poll that re-schedules the next callback under the current key.
+     */
+    rescheduleAll() {
+        this.#enqueuePollNow?.();
+    }
 }
 
-module.exports = AutomationsService;
+module.exports = new AutomationsService();

package/core/server/services/custom-redirects/index.js

@@ -1,8 +1,8 @@
 const config = require('../../../shared/config');
 const urlUtils = require('../../../shared/url-utils');
+const adapterManager = require('../adapter-manager');
 
 const DynamicRedirectManager = require('../lib/dynamic-redirect-manager');
-const {FileStore} = require('./file-store');
 const {RedirectsService} = require('./redirects-service');
 const validation = require('./validation');
 
@@ -18,9 +18,7 @@ module.exports = {
     init() {
         redirectManager = makeRedirectManager();
 
-        const store = new FileStore({
-            basePath: config.getContentPath('data')
-        });
+        const store = adapterManager.getAdapter('redirects');
 
         redirectsService = new RedirectsService({
             store,

package/core/server/services/gifts/gift-bookshelf-repository.js

@@ -83,6 +83,13 @@ class GiftBookshelfRepository {
         });
         return collection.models.map(model => this.toGift(model));
     }
+    async findUnsentReminders() {
+        const now = new Date().toISOString();
+        const collection = await this.model.findAll({
+            filter: `status:redeemed+consumes_at:>'${now}'+consumes_soon_reminder_sent_at:null`
+        });
+        return collection.models.map(model => this.toGift(model));
+    }
     async create(gift, options = {}) {
         await this.model.add(this.toRow(gift), options);
     }

package/core/server/services/gifts/gift-bookshelf-repository.ts

@@ -148,6 +148,16 @@ export class GiftBookshelfRepository implements GiftRepository {
         return collection.models.map(model => this.toGift(model));
     }
 
+    async findUnsentReminders(): Promise<Gift[]> {
+        const now = new Date().toISOString();
+
+        const collection = await this.model.findAll({
+            filter: `status:redeemed+consumes_at:>'${now}'+consumes_soon_reminder_sent_at:null`
+        });
+
+        return collection.models.map(model => this.toGift(model));
+    }
+
     async create(gift: Gift, options: RepositoryTransactionOptions = {}) {
         await this.model.add(this.toRow(gift), options);
     }

package/core/server/services/gifts/gift-reminder-scheduler.js

@@ -0,0 +1,94 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GiftReminderScheduler = void 0;
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const constants_1 = require("./constants");
+// Same-domain (scheduling) primitives, used unconditionally.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const urlUtils = require('../../../shared/url-utils');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { getSignedAdminToken } = require('../../adapters/scheduling/utils');
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+const GIFT_REMINDER_LEAD_MS = constants_1.GIFT_REMINDER_LEAD_DAYS * MS_PER_DAY;
+class GiftReminderScheduler {
+    #apiUrl;
+    #adapter;
+    #internalKeys;
+    #findUnsentReminders;
+    constructor({ apiUrl, adapter, internalKeys, findUnsentReminders }) {
+        this.#apiUrl = apiUrl;
+        this.#adapter = adapter;
+        this.#internalKeys = internalKeys;
+        this.#findUnsentReminders = findUnsentReminders;
+        this.#adapter.register(this);
+    }
+    /**
+     * Queue a single reminder callback for a freshly-redeemed gift. The
+     * callback fires at consumesAt - GIFT_REMINDER_LEAD_DAYS. Already-due
+     * reminders are skipped — the daily cron picks them up.
+     */
+    async scheduleFor(gift) {
+        if (!gift.consumesAt) {
+            return;
+        }
+        const time = gift.consumesAt.getTime() - GIFT_REMINDER_LEAD_MS;
+        if (time <= Date.now()) {
+            return;
+        }
+        try {
+            const key = await this.#internalKeys.get('ghost-scheduler');
+            this.#adapter.schedule(this.#buildJob(time, key));
+        }
+        catch (err) {
+            logging_1.default.error({
+                event: { name: 'gift_reminder_scheduler.schedule.failed' },
+                err,
+                giftToken: gift.token
+            }, 'Failed to schedule gift reminder');
+        }
+    }
+    /**
+     * Re-issue every queued reminder under the current scheduler key. Pass
+     * the pre-rotation secret as `previousKey` so each adapter-queued URL
+     * can be reconstructed for unschedule before resigning with the new
+     * key. Reminders whose fire time has already passed are skipped — the
+     * daily cron picks them up.
+     */
+    async rescheduleAll({ previousKey } = {}) {
+        const currentKey = await this.#internalKeys.get('ghost-scheduler');
+        const unscheduleKey = previousKey ?? currentKey;
+        const pending = await this.#findUnsentReminders();
+        // Same-key rebuild (no previousKey, boot path) → URL signature is
+        // identical to the about-to-be-scheduled job. The default adapter
+        // implements unschedule via tombstones keyed by URL+time, so a same-URL
+        // unschedule poisons the scheduled job. Bootstrap mode skips the
+        // tombstone write. Rotation (previousKey provided) → URLs differ, so
+        // the tombstone correctly targets the old queued entry.
+        const bootstrap = !previousKey;
+        for (const gift of pending) {
+            if (!gift.consumesAt) {
+                continue;
+            }
+            const time = gift.consumesAt.getTime() - GIFT_REMINDER_LEAD_MS;
+            if (time <= Date.now()) {
+                continue;
+            }
+            this.#adapter.unschedule(this.#buildJob(time, unscheduleKey), { bootstrap });
+            this.#adapter.schedule(this.#buildJob(time, currentKey));
+        }
+    }
+    #buildJob(time, key) {
+        const signedAdminToken = getSignedAdminToken({
+            publishedAt: new Date(time).toISOString(),
+            apiUrl: this.#apiUrl,
+            key
+        });
+        const url = new URL(urlUtils.urlJoin(this.#apiUrl, 'gifts', 'flush_reminders'));
+        url.searchParams.set('token', signedAdminToken);
+        return { time, url: url.toString(), extra: { httpMethod: 'PUT' } };
+    }
+}
+exports.GiftReminderScheduler = GiftReminderScheduler;