ghost 6.44.0 → 6.44.1

package/core/server/models/role-utils.js

@@ -1,18 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkUserPermissionsForRole = checkUserPermissionsForRole;
+exports.setIsRoles = setIsRoles;
 // check if the user has an assigned role
 // so that we can stop writing this everywhere:
 //_.some(loadedPermissions.user.roles, {name: 'Administrator'})
-
 function checkUserPermissionsForRole(loadedPermissions, roleName) {
     if (!loadedPermissions?.user?.roles) {
         return false;
     }
-
     return loadedPermissions.user.roles.some(role => role.name === roleName);
 }
-
 function setIsRoles(loadedPermissions) {
     // utility function to parse the permissions object and set up all the "is" variables.
-    let resultsObject = {
+    const resultsObject = {
         isOwner: false,
         isAdmin: false,
         isEditor: false,
@@ -33,6 +34,3 @@ function setIsRoles(loadedPermissions) {
     resultsObject.isEitherEditor = resultsObject.isEditor || resultsObject.isSuperEditor;
     return resultsObject;
 }
-
-exports.setIsRoles = setIsRoles;
-exports.checkUserPermissionsForRole = checkUserPermissionsForRole;

package/core/server/models/role-utils.ts

@@ -0,0 +1,56 @@
+import type {ReadonlyDeep} from 'type-fest';
+
+type LoadedPermissionsWithRoles = ReadonlyDeep<{
+    user?: {
+        roles?: Array<{name: string}>;
+    } | null;
+}>;
+
+type RoleFlags = {
+    isOwner: boolean;
+    isAdmin: boolean;
+    isEditor: boolean;
+    isAuthor: boolean;
+    isContributor: boolean;
+    isSuperEditor: boolean;
+    isEitherEditor: boolean;
+};
+
+// check if the user has an assigned role
+// so that we can stop writing this everywhere:
+//_.some(loadedPermissions.user.roles, {name: 'Administrator'})
+
+export function checkUserPermissionsForRole(
+    loadedPermissions: LoadedPermissionsWithRoles | null | undefined,
+    roleName: string
+): boolean {
+    if (!loadedPermissions?.user?.roles) {
+        return false;
+    }
+
+    return loadedPermissions.user.roles.some(role => role.name === roleName);
+}
+
+export function setIsRoles(loadedPermissions: LoadedPermissionsWithRoles | null | undefined): RoleFlags {
+    // utility function to parse the permissions object and set up all the "is" variables.
+    const resultsObject: RoleFlags = {
+        isOwner: false,
+        isAdmin: false,
+        isEditor: false,
+        isAuthor: false,
+        isContributor: false,
+        isSuperEditor: false,
+        isEitherEditor: false
+    };
+    if (!loadedPermissions?.user?.roles) {
+        return resultsObject;
+    }
+    resultsObject.isOwner = checkUserPermissionsForRole(loadedPermissions, 'Owner');
+    resultsObject.isAdmin = checkUserPermissionsForRole(loadedPermissions, 'Administrator');
+    resultsObject.isEditor = checkUserPermissionsForRole(loadedPermissions, 'Editor');
+    resultsObject.isAuthor = checkUserPermissionsForRole(loadedPermissions, 'Author');
+    resultsObject.isContributor = checkUserPermissionsForRole(loadedPermissions, 'Contributor');
+    resultsObject.isSuperEditor = checkUserPermissionsForRole(loadedPermissions, 'Super Editor');
+    resultsObject.isEitherEditor = resultsObject.isEditor || resultsObject.isSuperEditor;
+    return resultsObject;
+}

package/core/server/services/adapter-manager/adapter-manager.js

@@ -140,8 +140,12 @@ module.exports = class AdapterManager {
                 // that includes the adapter's own path, which would false-positive.
                 const firstLine = err.message.split('\n')[0];
                 if (!firstLine.includes(pathToAdapter)) {
+                    // Name the unresolved module so the error is actionable, e.g.
+                    // "Cannot find module 'superagent'" -> 'superagent'.
+                    const missingMatch = /Cannot find module '([^']+)'/.exec(firstLine);
+                    const missingModule = missingMatch ? ` '${missingMatch[1]}'` : '';
                     throw new errors.IncorrectUsageError({
-                        message: `You are missing dependencies in your adapter ${pathToAdapter}`,
+                        message: `You are missing a dependency${missingModule} in your adapter ${pathToAdapter}`,
                         err
                     });
                 }

package/core/server/services/audience-feedback/audience-feedback-service.js

@@ -1,4 +1,4 @@
-const toPlain = require('../../lib/common/to-plain');
+const {toPlain} = require('../../lib/common/to-plain');
 
 class AudienceFeedbackService {
     /** @type URL */

package/core/server/services/automations/automations-api.js

@@ -28,7 +28,9 @@ const messages = {
     invalidAutomationEdgeEndpoint: 'Automation edges must reference actions in the submitted graph.',
     duplicateAutomationEdge: 'Automation edges must be unique.',
     invalidAutomationEdge: 'Automation edges cannot connect an action to itself.',
-    invalidAutomationGraphShape: 'Automation graph must be a single linear path without branches or cycles.'
+    invalidAutomationGraphShape: 'Automation graph must be a single linear path without branches or cycles.',
+    emptyEmailSubjectWhenActive: 'Active automations require a subject line for every email.',
+    emptyEmailBodyWhenActive: 'Active automations require a body for every email.'
 };
 const objectIdSchema = zod_1.z.string().refine(value => bson_objectid_1.default.isValid(value));
 const waitActionSchema = zod_1.z.object({
@@ -42,7 +44,7 @@ const sendEmailActionSchema = zod_1.z.object({
     id: objectIdSchema,
     type: zod_1.z.literal('send_email'),
     data: zod_1.z.object({
-        email_subject: zod_1.z.string().min(1),
+        email_subject: zod_1.z.string(),
         email_lexical: zod_1.z.string().refine((value) => {
             try {
                 JSON.parse(value);
@@ -111,8 +113,41 @@ function validateEditData(data) {
         throwValidationError(buildInvalidAutomationPayloadMessage(result.error.issues));
     }
     validateGraph(result.data.actions, result.data.edges);
+    validateActiveEmailSteps(result.data.status, result.data.actions);
     return result.data;
 }
+// Drafts may persist empty email steps, but an active automation must have a
+// complete subject and body for every email it sends — mirroring the editor's
+// publish-time validation.
+function validateActiveEmailSteps(status, actions) {
+    if (status !== 'active') {
+        return;
+    }
+    for (const action of actions) {
+        if (action.type !== 'send_email') {
+            continue;
+        }
+        if (!action.data.email_subject.trim()) {
+            throwValidationError(messages.emptyEmailSubjectWhenActive, 'actions');
+        }
+        if (isEmptyLexical(action.data.email_lexical)) {
+            throwValidationError(messages.emptyEmailBodyWhenActive, 'actions');
+        }
+    }
+}
+function isEmptyLexical(lexical) {
+    try {
+        const parsed = JSON.parse(lexical);
+        const children = parsed?.root?.children;
+        if (!children || children.length === 0) {
+            return true;
+        }
+        return children.length === 1 && children[0].type === 'paragraph' && (!children[0].children || children[0].children.length === 0);
+    }
+    catch {
+        return true;
+    }
+}
 function buildInvalidAutomationPayloadMessage(issues) {
     if (!issues.length) {
         return messages.invalidAutomationPayload;

package/core/server/services/automations/automations-api.ts

@@ -25,7 +25,9 @@ const messages = {
     invalidAutomationEdgeEndpoint: 'Automation edges must reference actions in the submitted graph.',
     duplicateAutomationEdge: 'Automation edges must be unique.',
     invalidAutomationEdge: 'Automation edges cannot connect an action to itself.',
-    invalidAutomationGraphShape: 'Automation graph must be a single linear path without branches or cycles.'
+    invalidAutomationGraphShape: 'Automation graph must be a single linear path without branches or cycles.',
+    emptyEmailSubjectWhenActive: 'Active automations require a subject line for every email.',
+    emptyEmailBodyWhenActive: 'Active automations require a body for every email.'
 };
 
 const objectIdSchema = z.string().refine(value => ObjectId.isValid(value));
@@ -42,7 +44,7 @@ const sendEmailActionSchema = z.object({
     id: objectIdSchema,
     type: z.literal('send_email'),
     data: z.object({
-        email_subject: z.string().min(1),
+        email_subject: z.string(),
         email_lexical: z.string().refine((value) => {
             try {
                 JSON.parse(value);
@@ -126,9 +128,48 @@ function validateEditData(data: unknown): EditAutomationData {
     }
 
     validateGraph(result.data.actions, result.data.edges);
+    validateActiveEmailSteps(result.data.status, result.data.actions);
     return result.data;
 }
 
+// Drafts may persist empty email steps, but an active automation must have a
+// complete subject and body for every email it sends — mirroring the editor's
+// publish-time validation.
+function validateActiveEmailSteps(status: EditAutomationData['status'], actions: EditAutomationData['actions']) {
+    if (status !== 'active') {
+        return;
+    }
+
+    for (const action of actions) {
+        if (action.type !== 'send_email') {
+            continue;
+        }
+
+        if (!action.data.email_subject.trim()) {
+            throwValidationError(messages.emptyEmailSubjectWhenActive, 'actions');
+        }
+
+        if (isEmptyLexical(action.data.email_lexical)) {
+            throwValidationError(messages.emptyEmailBodyWhenActive, 'actions');
+        }
+    }
+}
+
+function isEmptyLexical(lexical: string): boolean {
+    try {
+        const parsed = JSON.parse(lexical);
+        const children = parsed?.root?.children;
+
+        if (!children || children.length === 0) {
+            return true;
+        }
+
+        return children.length === 1 && children[0].type === 'paragraph' && (!children[0].children || children[0].children.length === 0);
+    } catch {
+        return true;
+    }
+}
+
 function buildInvalidAutomationPayloadMessage(issues: z.core.$ZodIssue[]) {
     if (!issues.length) {
         return messages.invalidAutomationPayload;

package/core/server/services/comments/comments-controller.js

@@ -12,7 +12,8 @@ const tpl = require('@tryghost/tpl');
 
 const messages = {
     cannotDestroyComments: 'You cannot destroy comments.',
-    memberNotFound: 'Unable to find member'
+    memberNotFound: 'Unable to find member',
+    unsupportedReportCountFilter: 'Unsupported count.reports filter'
 };
 
 module.exports = class CommentsController {
@@ -25,12 +26,51 @@ module.exports = class CommentsController {
         this.stats = stats;
     }
 
-    async #setImpersonationContext(options) {
-        if (options.impersonate_member_uuid) {
-            options.context = options.context || {};
-            options.context.member = options.context.member || {};
-            options.context.member.id = await this.service.getMemberIdByUUID(options.impersonate_member_uuid);
+    #withPostFilter(options) {
+        const nextOptions = {...options};
+
+        if (!options.post_id) {
+            return nextOptions;
+        }
+
+        if (options.filter) {
+            const postId = options.post_id;
+            const existingTransformer = options.mongoTransformer;
+            nextOptions.mongoTransformer = function (query) {
+                const transformedQuery = existingTransformer ? existingTransformer(query) : query;
+
+                return {
+                    $and: [
+                        {
+                            post_id: postId
+                        },
+                        transformedQuery
+                    ]
+                };
+            };
+        } else {
+            nextOptions.filter = `post_id:${options.post_id}`;
+        }
+
+        return nextOptions;
+    }
+
+    async #withImpersonationContext(options) {
+        const nextOptions = {...options};
+
+        if (!options.impersonate_member_uuid) {
+            return nextOptions;
         }
+
+        nextOptions.context = {
+            ...options.context,
+            member: {
+                ...options.context?.member,
+                id: await this.service.getMemberIdByUUID(options.impersonate_member_uuid)
+            }
+        };
+
+        return nextOptions;
     }
 
     #checkMember(frame) {
@@ -73,6 +113,12 @@ module.exports = class CommentsController {
             } else if (val.$ne !== undefined) {
                 reportCount = {op: '!=', value: val.$ne};
             }
+
+            if (!reportCount) {
+                throw new errors.BadRequestError({
+                    message: tpl(messages.unsupportedReportCountFilter)
+                });
+            }
         }
 
         // If there's remaining filter, use transformer to replace parsed result
@@ -92,53 +138,23 @@ module.exports = class CommentsController {
      * @param {Frame} frame
      */
     async browse(frame) {
-        if (frame.options.post_id) {
-            if (frame.options.filter) {
-                frame.options.mongoTransformer = function (query) {
-                    return {
-                        $and: [
-                            {
-                                post_id: frame.options.post_id
-                            },
-                            query
-                        ]
-                    };
-                };
-            } else {
-                frame.options.filter = `post_id:${frame.options.post_id}`;
-            }
-        }
-
-        return await this.service.getComments(frame.options);
+        return await this.service.getComments(this.#withPostFilter(frame.options));
     }
 
     async adminBrowse(frame) {
-        if (frame.options.post_id) {
-            if (frame.options.filter) {
-                frame.options.mongoTransformer = function (query) {
-                    return {
-                        $and: [
-                            {
-                                post_id: frame.options.post_id
-                            },
-                            query
-                        ]
-                    };
-                };
-            } else {
-                frame.options.filter = `post_id:${frame.options.post_id}`;
-            }
-        }
-
-        frame.options.isAdmin = true;
+        let options = this.#withPostFilter(frame.options);
+        options = {
+            ...options,
+            isAdmin: true
+        };
         // Admin routes in Comments-UI lack member context due to cross-domain constraints (CORS), which prevents
         // credentials from being passed. This causes issues like the inability to determine if a
         // logged-in admin (acting on behalf of a member) has already liked a comment.
         // To resolve this, we retrieve the `impersonate_member_uuid` from the request params and
         // explicitly set it in the context options as the acting member's ID.
         // Note: This approach is applied to several admin routes where member context is required.
-        await this.#setImpersonationContext(frame.options);
-        return await this.service.getAdminComments(frame.options);
+        options = await this.#withImpersonationContext(options);
+        return await this.service.getAdminComments(options);
     }
 
     /**
@@ -221,19 +237,34 @@ module.exports = class CommentsController {
      * @param {Frame} frame
      */
     async adminReplies(frame) {
-        frame.options.isAdmin = true;
-        frame.options.order = 'created_at asc'; // we always want to load replies from oldest to newest
-        await this.#setImpersonationContext(frame.options);
+        let options = {
+            ...frame.options,
+            order: 'created_at asc' // we always want to load replies from oldest to newest
+        };
+        options = await this.#withImpersonationContext(options);
 
-        return this.service.getReplies(frame.options.id, _.omit(frame.options, 'id'));
+        return this.service.getAdminReplies(frame.options.id, _.omit(options, 'id'));
     }
 
     /**
      * @param {Frame} frame
      */
     async read(frame) {
-        await this.#setImpersonationContext(frame.options);
-        return await this.service.getCommentByID(frame.data.id, frame.options);
+        const options = await this.#withImpersonationContext(frame.options);
+        return await this.service.getCommentByID(frame.data.id, options);
+    }
+
+    /**
+     * @param {Frame} frame
+     */
+    async adminRead(frame) {
+        let options = {
+            ...frame.options,
+            isAdmin: true
+        };
+        options = await this.#withImpersonationContext(options);
+
+        return await this.service.getCommentByID(frame.data.id, options);
     }
 
     /**
@@ -337,7 +368,7 @@ module.exports = class CommentsController {
             frame.options
         );
 
-        const comment = await this.service.getCommentByID(frame.options.id);
+        const comment = await this.service.getCommentByID(frame.options.id, frame.options);
 
         if (comment) {
             const postId = comment.get('post_id');
@@ -364,7 +395,7 @@ module.exports = class CommentsController {
             frame.options
         );
 
-        const comment = await this.service.getCommentByID(frame.options.id);
+        const comment = await this.service.getCommentByID(frame.options.id, frame.options);
 
         if (comment) {
             const postId = comment.get('post_id');
@@ -387,7 +418,8 @@ module.exports = class CommentsController {
 
         return await this.service.reportComment(
             frame.options.id,
-            frame.options?.context?.member
+            frame.options?.context?.member,
+            frame.options
         );
     }
 
@@ -427,7 +459,7 @@ module.exports = class CommentsController {
             frame.options
         );
 
-        const comment = await this.service.getCommentByID(frame.options.id);
+        const comment = await this.service.getCommentByID(frame.options.id, frame.options);
 
         if (comment) {
             const postId = comment.get('post_id');
@@ -454,7 +486,7 @@ module.exports = class CommentsController {
             frame.options
         );
 
-        const comment = await this.service.getCommentByID(frame.options.id);
+        const comment = await this.service.getCommentByID(frame.options.id, frame.options);
 
         if (comment) {
             const postId = comment.get('post_id');

package/core/server/services/comments/comments-service-emails.js

@@ -2,7 +2,7 @@ const moment = require('moment');
 const htmlToPlaintext = require('@tryghost/html-to-plaintext');
 const emailService = require('../email-service');
 const CommentsServiceEmailRenderer = require('./comments-service-email-renderer');
-const toPlain = require('../../lib/common/to-plain');
+const {toPlain} = require('../../lib/common/to-plain');
 const {t} = require('../i18n');
 
 class CommentsServiceEmails {