ghost 6.47.0 → 6.48.0

package/core/frontend/services/routing/controllers/entry/gift-links.ts

@@ -0,0 +1,92 @@
+import {format, parse} from 'node:url';
+import type {ParsedUrlQueryInput} from 'node:querystring';
+import type {Request} from 'express';
+import type {Entry, EntryResponse} from '../entry';
+
+const dataService = require('../../../data');
+const renderer = require('../../../rendering');
+const proxy = require('../../../proxy');
+const hbs = require('../../../theme-engine/engine');
+
+/**
+ * Build this request's URL with `?gift` removed, preserving path, subdirectory
+ * and other query params. Rebuilt from req.query (qs-parsed) so bracket forms
+ * like `?gift[]=x` are dropped too — otherwise the stripped redirect would loop.
+ */
+function strippedGiftUrl(req: Request): string {
+    const query = {...req.query} as ParsedUrlQueryInput;
+    delete query.gift;
+    return format({pathname: parse(req.originalUrl).pathname, query});
+}
+
+/**
+ * Flag the render as a gift view so `ghost_foot` injects the toast. Stores the
+ * token (not just a boolean) for a later analytics pass-through. Internal flag,
+ * not a public theme API.
+ */
+function setGiftTemplateFlag(res: EntryResponse, token: string): void {
+    const localTemplateOptions = hbs.getLocalTemplateOptions(res.locals);
+    hbs.updateLocalTemplateOptions(res.locals, {
+        ...localTemplateOptions,
+        data: {
+            ...localTemplateOptions.data,
+            _gift: token
+        }
+    });
+}
+
+/**
+ * Whether this request is an attempt to use a gift link: the feature is enabled
+ * and a `?gift` param is present (in any form).
+ */
+export function isGiftRequest(req: Request): boolean {
+    return proxy.labs.isSet('giftLinks') && req.query.gift !== undefined;
+}
+
+/**
+ * The gift token from the request, or null. A non-string form (e.g. `?gift[]=x`)
+ * isn't a token.
+ */
+function giftToken(req: Request): string | null {
+    return typeof req.query.gift === 'string' ? req.query.gift : null;
+}
+
+/**
+ * Re-read the entry as a paid-member shim (the grant `/p/` previews use) to
+ * reveal gated content, then render it. The shim is passed as the read context
+ * only, so it never leaks into res.locals/@member.
+ */
+async function renderUnlocked(req: Request, res: EntryResponse, token: string) {
+    const giftLookup = await dataService.entryLookup(req.path, res.routerOptions, {
+        ...res.locals,
+        member: await proxy.createPaidMemberShim()
+    });
+
+    // Don't index the unlocked variant; keep the token out of the Referer on
+    // sub-resource requests.
+    res.set('X-Robots-Tag', 'noindex');
+    res.set('Referrer-Policy', 'no-referrer');
+    setGiftTemplateFlag(res, token);
+
+    return renderer.renderEntry(req, res)(giftLookup.entry);
+}
+
+/**
+ * CASE: gift-link reader access. A gift link is the post's real URL plus
+ * `?gift=TOKEN`; the token is verified against the entry living at this URL, so
+ * a token for one post can never unlock another. A valid token unlocks the
+ * entry; anything else strips `?gift` and 301s to the clean URL.
+ */
+export async function serveGiftRequest(req: Request, res: EntryResponse, entry: Entry) {
+    const token = giftToken(req);
+
+    if (token && await proxy.giftLinks.service.isValidTokenForPost(token, entry.id)) {
+        return renderUnlocked(req, res, token);
+    }
+
+    // Invalid token, or one for a different post: strip it and 301 to the clean
+    // URL (the page still renders, paywalled). res.redirect, not
+    // urlUtils.redirect301, so the no-store set for ?gift requests survives and
+    // the token-bearing redirect isn't cached.
+    return res.redirect(301, strippedGiftUrl(req));
+}

package/core/frontend/services/routing/controllers/entry/markdown.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMdRequest = isMdRequest;
+exports.serveMdRequest = serveMdRequest;
+exports.isAcceptsRequest = isAcceptsRequest;
+exports.serveAcceptsRequest = serveAcceptsRequest;
+const canonical_url_1 = __importDefault(require("./canonical-url"));
+const config = require('../../../../../shared/config');
+const urlUtils = require('../../../../../shared/url-utils');
+const { getAcceptedMarkdownContentType, getMarkdownPath, renderEntryMarkdown } = require('../../../llms/markdown');
+const MEMBERS_ONLY_MARKDOWN = '# Members-only content\n\nThis post requires a subscription and is not available for public access.\n';
+function llmsEnabled(req) {
+    const llmsService = req.app.get('llmsService') || null;
+    return Boolean(llmsService && llmsService.isEnabled());
+}
+function isPublic(entry) {
+    return entry.visibility === 'public';
+}
+function serveMarkdown(res, entry) {
+    const llmsIndexUrl = urlUtils.urlFor({ relativeUrl: '/llms.txt' }, true);
+    res.set('Cache-Control', `public, max-age=${config.get('caching:llms:maxAge')}`);
+    res.set('Content-Location', getMarkdownPath(new URL(entry.url).pathname));
+    res.type('text/markdown');
+    return res.send(renderEntryMarkdown(entry, { llmsIndexUrl }));
+}
+/**
+ * Whether this is a `.md` URL request (the scoped suffix route sets the flag).
+ */
+function isMdRequest(res) {
+    return Boolean(res.routerOptions.isMarkdownRequest);
+}
+/**
+ * Serve a `.md` URL as markdown for LLM consumption. When the feature is
+ * disabled we redirect to the canonical (html) url; members-only content is
+ * refused.
+ */
+function serveMdRequest(req, res, entry) {
+    if (!llmsEnabled(req)) {
+        return res.redirect(302, (0, canonical_url_1.default)(req, entry));
+    }
+    if (!isPublic(entry)) {
+        return res.status(403).type('text/markdown').send(MEMBERS_ONLY_MARKDOWN);
+    }
+    return serveMarkdown(res, entry);
+}
+/**
+ * Whether the request negotiates markdown via the Accept header — only for a
+ * public entry with the llms feature enabled, otherwise it renders as html.
+ */
+function isAcceptsRequest(req, entry) {
+    return isPublic(entry) && Boolean(getAcceptedMarkdownContentType(req)) && llmsEnabled(req);
+}
+/**
+ * Serve markdown negotiated via the Accept header.
+ */
+function serveAcceptsRequest(res, entry) {
+    res.vary('Accept');
+    return serveMarkdown(res, entry);
+}

package/core/frontend/services/routing/controllers/entry/markdown.ts

@@ -0,0 +1,66 @@
+import type {Request, Response} from 'express';
+import type {Entry, EntryResponse} from '../entry';
+import buildCanonicalUrl from './canonical-url';
+
+const config = require('../../../../../shared/config');
+const urlUtils = require('../../../../../shared/url-utils');
+const {getAcceptedMarkdownContentType, getMarkdownPath, renderEntryMarkdown} = require('../../../llms/markdown');
+
+const MEMBERS_ONLY_MARKDOWN = '# Members-only content\n\nThis post requires a subscription and is not available for public access.\n';
+
+function llmsEnabled(req: Request): boolean {
+    const llmsService = req.app.get('llmsService') || null;
+    return Boolean(llmsService && llmsService.isEnabled());
+}
+
+function isPublic(entry: Entry): boolean {
+    return entry.visibility === 'public';
+}
+
+function serveMarkdown(res: Response, entry: Entry) {
+    const llmsIndexUrl = urlUtils.urlFor({relativeUrl: '/llms.txt'}, true);
+    res.set('Cache-Control', `public, max-age=${config.get('caching:llms:maxAge')}`);
+    res.set('Content-Location', getMarkdownPath(new URL(entry.url).pathname));
+    res.type('text/markdown');
+    return res.send(renderEntryMarkdown(entry, {llmsIndexUrl}));
+}
+
+/**
+ * Whether this is a `.md` URL request (the scoped suffix route sets the flag).
+ */
+export function isMdRequest(res: EntryResponse): boolean {
+    return Boolean(res.routerOptions.isMarkdownRequest);
+}
+
+/**
+ * Serve a `.md` URL as markdown for LLM consumption. When the feature is
+ * disabled we redirect to the canonical (html) url; members-only content is
+ * refused.
+ */
+export function serveMdRequest(req: Request, res: Response, entry: Entry) {
+    if (!llmsEnabled(req)) {
+        return res.redirect(302, buildCanonicalUrl(req, entry));
+    }
+
+    if (!isPublic(entry)) {
+        return res.status(403).type('text/markdown').send(MEMBERS_ONLY_MARKDOWN);
+    }
+
+    return serveMarkdown(res, entry);
+}
+
+/**
+ * Whether the request negotiates markdown via the Accept header — only for a
+ * public entry with the llms feature enabled, otherwise it renders as html.
+ */
+export function isAcceptsRequest(req: Request, entry: Entry): boolean {
+    return isPublic(entry) && Boolean(getAcceptedMarkdownContentType(req)) && llmsEnabled(req);
+}
+
+/**
+ * Serve markdown negotiated via the Accept header.
+ */
+export function serveAcceptsRequest(res: Response, entry: Entry) {
+    res.vary('Accept');
+    return serveMarkdown(res, entry);
+}

package/core/frontend/services/routing/controllers/entry.js

@@ -1,114 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entryController = entryController;
+const markdown = __importStar(require("./entry/markdown"));
+const giftLinks = __importStar(require("./entry/gift-links"));
+const canonical_url_1 = __importDefault(require("./entry/canonical-url"));
 const debug = require('@tryghost/debug')('services:routing:controllers:entry');
-const url = require('url');
 const config = require('../../../../shared/config');
 const urlUtils = require('../../../../shared/url-utils');
 const dataService = require('../../data');
 const renderer = require('../../rendering');
-const {getAcceptedMarkdownContentType, getMarkdownPath, renderEntryMarkdown} = require('../../llms/markdown');
-
-function getLlmsService(req) {
-    return req.app.get('llmsService') || null;
-}
-
-function serveMarkdown(res, entry) {
-    const llmsIndexUrl = urlUtils.urlFor({relativeUrl: '/llms.txt'}, true);
-    res.set('Cache-Control', `public, max-age=${config.get('caching:llms:maxAge')}`);
-    res.set('Content-Location', getMarkdownPath(new URL(entry.url).pathname));
-    res.type('text/markdown');
-    return res.send(renderEntryMarkdown(entry, {llmsIndexUrl}));
+/**
+ * The request's last url param is `/edit`: redirect to the admin editor, or fall
+ * through to a 404 when admin redirects are disabled.
+ */
+function editRedirect(res, next, entry) {
+    if (!config.get('admin:redirects')) {
+        debug('is edit url but admin redirects are disabled');
+        return next();
+    }
+    debug('redirect. is edit url');
+    const resourceType = res.routerOptions.context?.includes('page') ? 'page' : 'post';
+    return urlUtils.redirectToAdmin(302, res, `/#/editor/${resourceType}/${entry.id}`);
 }
-
 /**
- * @description Entry controller.
- * @param {Object} req
- * @param {Object} res
- * @param {Function} next
- * @returns {Promise}
+ * The requested path no longer matches the entry's canonical url — happens with
+ * date permalinks after a publish date change.
  */
-module.exports = function entryController(req, res, next) {
+function isPermalinkStale(req, entry) {
+    return urlUtils.absoluteToRelative(entry.url, { withoutSubdirectory: true }) !== req.path;
+}
+async function entryController(req, res, next) {
     debug('entryController', res.routerOptions);
-
-    return dataService.entryLookup(req.path, res.routerOptions, res.locals)
-        .then(function then(lookup) {
-            // Format data 1
-            const entry = lookup ? lookup.entry : false;
-
-            if (!entry) {
-                debug('no entry');
-                return next();
-            }
-
-            // CASE: postlookup can detect options for example /edit, unknown options get ignored and end in 404
-            if (lookup.isUnknownOption) {
-                debug('isUnknownOption');
-                return next();
-            }
-
-            // CASE: last param is of url is /edit, redirect to admin
-            if (lookup.isEditURL) {
-                if (!config.get('admin:redirects')) {
-                    debug('is edit url but admin redirects are disabled');
-                    return next();
-                }
-
-                debug('redirect. is edit url');
-                const resourceType = res.routerOptions?.context?.includes('page') ? 'page' : 'post';
-
-                return urlUtils.redirectToAdmin(302, res, `/#/editor/${resourceType}/${entry.id}`);
-            }
-
-            // CASE: .md URL — serve entry as markdown for LLM consumption
-            if (res.routerOptions.isMarkdownRequest) {
-                const llmsService = getLlmsService(req);
-                if (!llmsService || !llmsService.isEnabled()) {
-                    return res.redirect(302, url.format({
-                        pathname: url.parse(entry.url).pathname,
-                        search: url.parse(req.originalUrl).search
-                    }));
-                }
-
-                if (entry.visibility !== 'public') {
-                    return res.status(403).type('text/markdown').send(
-                        '# Members-only content\n\nThis post requires a subscription and is not available for public access.\n'
-                    );
-                }
-
-                return serveMarkdown(res, entry);
-            }
-
-            /**
-             * CASE: Permalink is not valid anymore, we redirect him permanently to the correct one
-             *       This should only happen if you have date permalinks enabled and you change
-             *       your publish date.
-             *
-             * @NOTE:
-             *
-             * Ensure we redirect to the correct post url including subdirectory.
-             */
-            if (urlUtils.absoluteToRelative(entry.url, {withoutSubdirectory: true}) !== req.path) {
-                debug('redirect');
-
-                return urlUtils.redirect301(res, url.format({
-                    pathname: url.parse(entry.url).pathname,
-                    search: url.parse(req.originalUrl).search
-                }));
-            }
-
-            // CASE: Accept: text/markdown content negotiation
-            if (entry.visibility === 'public') {
-                const markdownContentType = getAcceptedMarkdownContentType(req);
-
-                if (markdownContentType) {
-                    const llmsService = getLlmsService(req);
-
-                    if (llmsService && llmsService.isEnabled()) {
-                        res.vary('Accept');
-                        return serveMarkdown(res, entry);
-                    }
-                }
-            }
-
-            return renderer.renderEntry(req, res)(entry);
-        })
-        .catch(renderer.handleError(next));
-};
+    try {
+        const lookup = await dataService.entryLookup(req.path, res.routerOptions, res.locals);
+        const entry = lookup ? lookup.entry : false;
+        if (!entry || lookup.isUnknownOption) {
+            debug('no entry or unknown option');
+            return next();
+        }
+        if (lookup.isEditURL) {
+            return editRedirect(res, next, entry);
+        }
+        // MUST run before the permalink redirect below: a `.md` path can never
+        // equal the entry's canonical (html) path, so the redirect would always
+        // fire and 301 the request to html, losing the markdown intent.
+        if (markdown.isMdRequest(res)) {
+            return markdown.serveMdRequest(req, res, entry);
+        }
+        if (isPermalinkStale(req, entry)) {
+            debug('redirect');
+            return urlUtils.redirect301(res, (0, canonical_url_1.default)(req, entry));
+        }
+        // MUST run after the permalink redirect above: negotiation rides on the
+        // canonical URL, so a stale dated-permalink URL is 301'd to canonical
+        // first, then markdown is served.
+        if (markdown.isAcceptsRequest(req, entry)) {
+            return markdown.serveAcceptsRequest(res, entry);
+        }
+        if (giftLinks.isGiftRequest(req)) {
+            return await giftLinks.serveGiftRequest(req, res, entry);
+        }
+        return renderer.renderEntry(req, res)(entry);
+    }
+    catch (err) {
+        return renderer.handleError(next)(err);
+    }
+}
+;

package/core/frontend/services/routing/controllers/entry.ts

@@ -0,0 +1,97 @@
+import type {NextFunction, Request, Response} from 'express';
+import * as markdown from './entry/markdown';
+import * as giftLinks from './entry/gift-links';
+import buildCanonicalUrl from './entry/canonical-url';
+
+const debug = require('@tryghost/debug')('services:routing:controllers:entry');
+const config = require('../../../../shared/config');
+const urlUtils = require('../../../../shared/url-utils');
+const dataService = require('../../data');
+const renderer = require('../../rendering');
+
+// Routing context the router attaches to the matched entry's response.
+export interface RouterOptions {
+    isMarkdownRequest?: boolean;
+    context?: string[];
+    [key: string]: unknown;
+}
+
+export interface EntryResponse extends Response {
+    routerOptions: RouterOptions;
+}
+
+// The resolved post/page entry from the data layer; only the fields used here are typed.
+export interface Entry {
+    id: string;
+    url: string;
+    visibility: string;
+    [key: string]: unknown;
+}
+
+/**
+ * The request's last url param is `/edit`: redirect to the admin editor, or fall
+ * through to a 404 when admin redirects are disabled.
+ */
+function editRedirect(res: EntryResponse, next: NextFunction, entry: Entry) {
+    if (!config.get('admin:redirects')) {
+        debug('is edit url but admin redirects are disabled');
+        return next();
+    }
+
+    debug('redirect. is edit url');
+    const resourceType = res.routerOptions.context?.includes('page') ? 'page' : 'post';
+    return urlUtils.redirectToAdmin(302, res, `/#/editor/${resourceType}/${entry.id}`);
+}
+
+/**
+ * The requested path no longer matches the entry's canonical url — happens with
+ * date permalinks after a publish date change.
+ */
+function isPermalinkStale(req: Request, entry: Entry): boolean {
+    return urlUtils.absoluteToRelative(entry.url, {withoutSubdirectory: true}) !== req.path;
+}
+
+export async function entryController(req: Request, res: EntryResponse, next: NextFunction): Promise<void | Response> {
+    debug('entryController', res.routerOptions);
+
+    try {
+        const lookup = await dataService.entryLookup(req.path, res.routerOptions, res.locals);
+        const entry = lookup ? lookup.entry : false;
+
+        if (!entry || lookup.isUnknownOption) {
+            debug('no entry or unknown option');
+            return next();
+        }
+
+        if (lookup.isEditURL) {
+            return editRedirect(res, next, entry);
+        }
+
+        // MUST run before the permalink redirect below: a `.md` path can never
+        // equal the entry's canonical (html) path, so the redirect would always
+        // fire and 301 the request to html, losing the markdown intent.
+        if (markdown.isMdRequest(res)) {
+            return markdown.serveMdRequest(req, res, entry);
+        }
+
+        if (isPermalinkStale(req, entry)) {
+            debug('redirect');
+            return urlUtils.redirect301(res, buildCanonicalUrl(req, entry));
+        }
+
+        // MUST run after the permalink redirect above: negotiation rides on the
+        // canonical URL, so a stale dated-permalink URL is 301'd to canonical
+        // first, then markdown is served.
+        if (markdown.isAcceptsRequest(req, entry)) {
+            return markdown.serveAcceptsRequest(res, entry);
+        }
+
+        if (giftLinks.isGiftRequest(req)) {
+            return await giftLinks.serveGiftRequest(req, res, entry);
+        }
+
+        return renderer.renderEntry(req, res)(entry);
+    } catch (err) {
+        return renderer.handleError(next)(err);
+    }
+};

package/core/frontend/services/routing/controllers/index.js

@@ -1,6 +1,6 @@
 module.exports = {
     get entry() {
-        return require('./entry');
+        return require('./entry').entryController;
     },
 
     get collection() {

package/core/frontend/web/middleware/frontend-caching.js

@@ -2,6 +2,7 @@
  * @file Middleware to set the appropriate cache headers on the frontend
  */
 const config = require('../../../shared/config');
+const labs = require('../../../shared/labs');
 const shared = require('../../../server/web/shared');
 const {api} = require('../../services/proxy');
 const preview = require('../../services/theme-engine/preview');
@@ -69,6 +70,14 @@ const getMiddleware = async (getFreeTier = async () => {
             return shared.middleware.cacheControl('noCache')(req, res, next);
         }
 
+        // CASE: never cache gift-link reads. A ?gift render holds unlocked gated
+        // content with no member cookie, so the edge would otherwise serve it to
+        // everyone. Keyed on the param's presence so an empty `?gift=` still
+        // bypasses.
+        if (req.query?.gift !== undefined && labs.isSet('giftLinks')) {
+            return shared.middleware.cacheControl('noCache')(req, res, next);
+        }
+
         // CASE: Cache member's content if this feature is enabled
         if (req.member && shouldCacheMembersContent) {
             // Set the 'cache-control' header to 'public'

package/core/server/adapters/cache/Redis.js

@@ -5,7 +5,6 @@
  * @see core/shared/config/defaults.json
  * @see core/server/services/adapter-manager/adapter-manager.js
  */
-/* eslint-disable ghost/filenames/match-regex */
 const RedisCache = require('../lib/redis/AdapterCacheRedis');
 
 module.exports = RedisCache;

package/core/server/adapters/redirects/RedirectsStoreBase.d.ts

@@ -1,7 +1,3 @@
-/* eslint-disable ghost/filenames/match-regex --
- * PascalCase mirrors the runtime `RedirectsStoreBase.js` so the TS
- * adapter can default-import via the matching declaration file.
- */
 declare class RedirectsStoreBase {
     readonly requiredFns: ReadonlyArray<string>;
 }

package/core/server/adapters/scheduling/scheduling-default.js

@@ -36,6 +36,13 @@ function SchedulingDefault(options) {
 
     this.deletedJobs = {};
     this.isRunning = false;
+
+    // The HTTP client is held as an instance property so unit tests can
+    // swap it for a deterministic stub. Doing the dependency injection in
+    // the constructor (rather than `require`ing inside _pingUrl) avoids
+    // pulling `@tryghost/request`'s cacheable-lookup singleton — racy
+    // under nock + shared workers — into the unit-test path.
+    this.request = request;
 }
 
 util.inherits(SchedulingDefault, SchedulingBase);
@@ -292,7 +299,7 @@ SchedulingDefault.prototype._pingUrl = function (object) {
         }
     }
 
-    return request(url, options).catch((err) => {
+    return this.request(url, options).catch((err) => {
         const {statusCode} = err;
 
         // CASE: post/page was deleted already