ghost 6.53.0 → 6.54.0

package/core/server/services/indexnow-ping/indexnow-ping-service.ts

@@ -0,0 +1,319 @@
+/**
+ * IndexNow Integration Service
+ *
+ * IndexNow is a protocol that allows websites to notify search engines about
+ * content changes for faster indexing. Instead of waiting for crawlers to
+ * discover updates, we proactively ping the IndexNow API when posts are
+ * published or updated.
+ *
+ * Protocol: https://www.indexnow.org/documentation
+ *
+ * How it works:
+ * 1. Ghost generates a unique API key (32-char hex string)
+ * 2. The key is stored in settings and served at /{key}.txt for verification
+ * 3. When a post is published/updated, we send a GET request to IndexNow:
+ *    GET https://api.indexnow.org/indexnow?url={post-url}&key={key}&keyLocation={key-file-url}
+ * 4. IndexNow distributes the notification to participating search engines
+ *    (Bing, Yandex, Seznam.cz, Naver, and others)
+ *
+ * The API key file is served by the middleware in:
+ * ghost/core/core/frontend/web/middleware/serve-indexnow-key.js
+ */
+
+import errors from '@tryghost/errors';
+import tpl from '@tryghost/tpl';
+
+import {
+    messages,
+    INDEXNOW_LOG_KEY,
+    INDEXNOW_ENDPOINT,
+    defaultPostSlugs,
+    seoFields
+} from './constants';
+
+type SettingsCache = {
+    get(key: string): unknown;
+};
+
+type Config = {
+    isPrivacyDisabled(key: string): boolean;
+};
+
+type Labs = {
+    isSet(flag: string): boolean;
+};
+
+type UrlService = {
+    facade: {
+        getUrlForResource(resource: Record<string, unknown>, options: {absolute: boolean}): string | null;
+    };
+};
+
+type UrlUtils = {
+    urlFor(context: string, absolute: boolean): string;
+    urlJoin(...parts: string[]): string;
+};
+
+type Logging = {
+    info(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+    error(...args: unknown[]): void;
+};
+
+type RequestFn = (url: string, options: Record<string, unknown>) => Promise<{statusCode: number}>;
+
+type PostModel = {
+    get(field: string): unknown;
+    previous(field: string): unknown;
+    related(relation: string): {toJSON(): unknown[]};
+    toJSON(): Record<string, unknown>;
+};
+
+type ModelEventListener = (model: PostModel, options?: {importing?: boolean}) => void;
+
+type ModelEvents = {
+    removeListener(event: string, listener: ModelEventListener): ModelEvents;
+    on(event: string, listener: ModelEventListener): ModelEvents;
+};
+
+type Post = {
+    id?: string;
+    slug?: string;
+    type?: string;
+    [key: string]: unknown;
+};
+
+export type IndexNowPingServiceDeps = {
+    settingsCache: SettingsCache;
+    config: Config;
+    labs: Labs;
+    urlService: UrlService;
+    urlUtils: UrlUtils;
+    request: RequestFn;
+    logging: Logging;
+    events: ModelEvents;
+};
+
+export class IndexNowPingService {
+    settingsCache: SettingsCache;
+    config: Config;
+    labs: Labs;
+    urlService: UrlService;
+    urlUtils: UrlUtils;
+    request: RequestFn;
+    logging: Logging;
+    events: ModelEvents;
+    listener: ModelEventListener;
+
+    constructor({settingsCache, config, labs, urlService, urlUtils, request, logging, events}: IndexNowPingServiceDeps) {
+        this.settingsCache = settingsCache;
+        this.config = config;
+        this.labs = labs;
+        this.urlService = urlService;
+        this.urlUtils = urlUtils;
+        this.request = request;
+        this.logging = logging;
+        this.events = events;
+
+        // Stable reference so removeListener() can de-register it across reboots.
+        this.listener = this.handlePostEvent.bind(this);
+    }
+
+    /**
+     * Get existing API key from settings.
+     * The key is auto-generated on boot by the settings service.
+     */
+    getApiKey(): string | null {
+        return (this.settingsCache.get('indexnow_api_key') as string | undefined) || null;
+    }
+
+    /**
+     * Check if any SEO-relevant fields have changed.
+     * These are fields that affect how the post appears in search results.
+     */
+    hasSeoRelevantChanges(model: PostModel): boolean {
+        return seoFields.some(field => model.get(field) !== model.previous(field));
+    }
+
+    /**
+     * Ping IndexNow with a URL.
+     */
+    async ping(post: Post): Promise<void> {
+        // Skip pages - only ping for posts
+        if (post.type === 'page') {
+            return;
+        }
+
+        // Skip if site is private
+        if (this.settingsCache.get('is_private')) {
+            return;
+        }
+
+        // Skip if IndexNow pings are disabled via privacy config
+        if (this.config.isPrivacyDisabled('useIndexNow')) {
+            return;
+        }
+
+        // Skip if IndexNow is not enabled in labs
+        if (!this.labs.isSet('indexnow')) {
+            return;
+        }
+
+        // Don't ping for the default posts
+        if (post.slug && defaultPostSlugs.indexOf(post.slug) > -1) {
+            return;
+        }
+
+        // Everything from URL resolution onwards sits inside the swallow-and-log
+        // envelope: the lazy URL service evaluates collection filters during
+        // resolution and can throw, and IndexNow failures must never disrupt
+        // publishing.
+        let url: string | null = null;
+        try {
+            url = this.urlService.facade.getUrlForResource({...post, type: 'posts'}, {absolute: true});
+
+            if (!url || url.endsWith('/404/')) {
+                this.logging.warn({
+                    event: {name: 'indexnow.unresolved_url'},
+                    post: {id: post.id, slug: post.slug, url}
+                }, `${INDEXNOW_LOG_KEY} Skipped ping - post has no resolvable URL`);
+                return;
+            }
+
+            // Get the API key (auto-generated on boot by settings service)
+            const key = this.getApiKey();
+            if (!key) {
+                this.logging.warn({
+                    event: {name: 'indexnow.api_key_missing'},
+                    post: {id: post.id, slug: post.slug}
+                }, `${INDEXNOW_LOG_KEY} API key not available`);
+                return;
+            }
+
+            // Get the site URL for the keyLocation parameter
+            const siteUrl = this.urlUtils.urlFor('home', true);
+
+            // Build the IndexNow request URL
+            const indexNowUrl = new URL(INDEXNOW_ENDPOINT);
+            indexNowUrl.searchParams.set('url', url);
+            indexNowUrl.searchParams.set('key', key);
+            indexNowUrl.searchParams.set('keyLocation', this.urlUtils.urlJoin(siteUrl, `${key}.txt`));
+
+            const response = await this.request(indexNowUrl.toString(), {
+                timeout: {
+                    request: 5 * 1000 // 5 second timeout
+                }
+            });
+
+            if (response.statusCode !== 200 && response.statusCode !== 202) {
+                throw new errors.InternalServerError({
+                    message: `IndexNow returned unexpected status: ${response.statusCode}`,
+                    statusCode: response.statusCode
+                });
+            }
+
+            this.logging.info({
+                event: {name: 'indexnow.pinged'},
+                post: {id: post.id, slug: post.slug, url},
+                http: {response: {status_code: response.statusCode}}
+            }, `${INDEXNOW_LOG_KEY} Successfully pinged ${url}`);
+        } catch (err) {
+            // Log errors but don't throw - IndexNow failures shouldn't disrupt publishing
+            const errorLike = err as {statusCode?: number; response?: {statusCode?: number}; message?: string};
+            const statusCode = errorLike.statusCode ?? errorLike.response?.statusCode ?? null;
+            const {eventName, error} = this.#classifyError(statusCode, err as Error);
+
+            this.logging.warn({
+                event: {name: eventName},
+                post: {id: post.id, slug: post.slug, url},
+                http: {response: {status_code: statusCode}},
+                err: error
+            }, `${INDEXNOW_LOG_KEY} ${error.message}`);
+        }
+    }
+
+    /**
+     * Map an IndexNow response status to a log event name and a structured error.
+     * IndexNow-protocol-specific interpretation; when this logic is lifted into a
+     * shared ping primitive, this becomes the injected `interpret(status)` hook.
+     */
+    #classifyError(statusCode: number | null, err: Error): {eventName: string; error: Error} {
+        if (statusCode === 429) {
+            // Rate limited by IndexNow - we have no retry/backoff, so the ping is dropped
+            return {
+                eventName: 'indexnow.rate_limited',
+                error: new errors.TooManyRequestsError({
+                    err,
+                    message: err.message,
+                    context: tpl(messages.requestFailedError, {service: 'IndexNow'}),
+                    help: tpl(messages.requestFailedHelp, {url: 'https://ghost.org/docs/'})
+                })
+            };
+        }
+
+        if (statusCode === 422 || statusCode === 403) {
+            return {
+                eventName: 'indexnow.key_validation_failed',
+                error: new errors.ValidationError({
+                    err,
+                    message: 'IndexNow key validation failed',
+                    context: tpl(messages.requestFailedError, {service: 'IndexNow'}),
+                    help: 'Ensure your IndexNow API key file is accessible at the correct URL'
+                })
+            };
+        }
+
+        return {
+            eventName: 'indexnow.ping_failed',
+            error: new errors.InternalServerError({
+                err,
+                message: err.message,
+                context: tpl(messages.requestFailedError, {service: 'IndexNow'}),
+                help: tpl(messages.requestFailedHelp, {url: 'https://ghost.org/docs/'})
+            })
+        };
+    }
+
+    /**
+     * Event listener for post.published / post.published.edited.
+     */
+    handlePostEvent(model: PostModel, options?: {importing?: boolean}): void {
+        // CASE: do not ping if we import a database
+        if (options && options.importing) {
+            return;
+        }
+
+        // Content-based deduplication: skip if no SEO-relevant fields changed
+        // This avoids spamming IndexNow when minor non-content edits are made
+        if (!this.hasSeoRelevantChanges(model)) {
+            return;
+        }
+
+        this.ping({
+            ...model.toJSON(),
+            // tags and authors are needed so the lazy URL service can evaluate
+            // collection filters (e.g. `tag:foo`) when resolving the post URL;
+            // without them a tag/author-filtered post resolves to /404/
+            authors: model.related('authors').toJSON(),
+            tags: model.related('tags').toJSON()
+        }).catch(() => {
+            // Errors are already logged inside ping()
+            // This catch is just to prevent unhandled rejection warnings
+        });
+    }
+
+    /**
+     * Register event listeners for IndexNow.
+     */
+    subscribeEvents(): void {
+        // Listen for new posts being published
+        this.events
+            .removeListener('post.published', this.listener)
+            .on('post.published', this.listener);
+
+        // Also listen for published posts being edited
+        this.events
+            .removeListener('post.published.edited', this.listener)
+            .on('post.published.edited', this.listener);
+    }
+}

package/core/server/services/invites/index.js

@@ -1,7 +1,7 @@
 const settingsCache = require('../../../shared/settings-cache');
 const settingsHelpers = require('../settings-helpers');
 const mailService = require('../../services/mail');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const Invites = require('./invites');
 
 module.exports = new Invites({

package/core/server/services/lib/mailgun-client.js

@@ -4,12 +4,12 @@ const logging = require('@tryghost/logging');
 const metrics = require('@tryghost/metrics');
 const errors = require('@tryghost/errors');
 
+const DEFAULT_BATCH_SIZE = 1000;
+
 module.exports = class MailgunClient {
     #config;
     #settings;
 
-    static DEFAULT_BATCH_SIZE = 1000;
-
     constructor({config, settings}) {
         this.#config = config;
         this.#settings = settings;
@@ -393,7 +393,7 @@ module.exports = class MailgunClient {
      * @returns {number}
      */
     getBatchSize() {
-        return this.#config.get('bulkEmail')?.batchSize ?? this.DEFAULT_BATCH_SIZE;
+        return this.#config.get('bulkEmail')?.batchSize ?? DEFAULT_BATCH_SIZE;
     }
 
     /**

package/core/server/services/link-redirection/index.js

@@ -1,6 +1,6 @@
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const LinkRedirectRepository = require('./link-redirect-repository');
-const adapterManager = require('../adapter-manager');
+const adapterManager = require('../adapter-manager').default;
 const config = require('../../../shared/config');
 const EventRegistry = require('../../lib/common/events');
 

package/core/server/services/link-redirection/link-redirect-repository.js

@@ -1,4 +1,4 @@
-const LinkRedirect = require('./link-redirect');
+const {LinkRedirect} = require('./link-redirect');
 const ObjectID = require('bson-objectid').default;
 const debug = require('@tryghost/debug')('LinkRedirectRepository');
 

package/core/server/services/link-redirection/link-redirect.js

@@ -1,26 +1,25 @@
-const ObjectID = require('bson-objectid').default;
-
-module.exports = class LinkRedirect {
-    /** @type {ObjectID} */
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinkRedirect = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+class LinkRedirect {
     link_id;
-    /** @type {URL} */
     from;
-    /** @type {URL} */
     to;
-    /** @type {boolean} */
     edited;
-
     constructor(data) {
         if (!data.id) {
-            this.link_id = new ObjectID();
+            this.link_id = new bson_objectid_1.default();
         }
-
         if (typeof data.id === 'string') {
-            this.link_id = ObjectID.createFromHexString(data.id);
+            this.link_id = bson_objectid_1.default.createFromHexString(data.id);
         }
-
         this.from = data.from;
         this.to = data.to;
         this.edited = !!data.edited;
     }
-};
+}
+exports.LinkRedirect = LinkRedirect;

package/core/server/services/link-redirection/link-redirect.ts

@@ -0,0 +1,22 @@
+import ObjectID from 'bson-objectid';
+
+export class LinkRedirect {
+    link_id: undefined | ObjectID;
+    from: URL;
+    to: URL;
+    edited: boolean;
+
+    constructor(data: {id?: string; from: URL; to: URL; edited?: boolean}) {
+        if (!data.id) {
+            this.link_id = new ObjectID();
+        }
+
+        if (typeof data.id === 'string') {
+            this.link_id = ObjectID.createFromHexString(data.id);
+        }
+
+        this.from = data.from;
+        this.to = data.to;
+        this.edited = !!data.edited;
+    }
+}

package/core/server/services/link-redirection/link-redirects-service.js

@@ -1,7 +1,7 @@
 const crypto = require('crypto');
 const DomainEvents = require('@tryghost/domain-events');
 const RedirectEvent = require('./redirect-event');
-const LinkRedirect = require('./link-redirect');
+const {LinkRedirect} = require('./link-redirect');
 
 /**
  * @typedef {object} ILinkRedirectRepository

package/core/server/services/link-tracking/full-post-link.js

@@ -12,7 +12,7 @@ module.exports = class FullPostLink {
     /** @type {ObjectID} */
     post_id;
     
-    /** @type {import('../link-redirection/link-redirect')} */
+    /** @type {import('../link-redirection/link-redirect').LinkRedirect} */
     link;
 
     /** @type {FullPostLinkCount} */
@@ -21,7 +21,7 @@ module.exports = class FullPostLink {
     /**
      * @param {object} data
      * @param {string|ObjectID} data.post_id
-     * @param {import('../link-redirection/link-redirect')} data.link
+     * @param {import('../link-redirection/link-redirect').LinkRedirect} data.link
      * @param {FullPostLinkCount} data.count
      */
     constructor(data) {

package/core/server/services/link-tracking/index.js

@@ -1,7 +1,7 @@
 const LinkClickRepository = require('./link-click-repository');
 const PostLinkRepository = require('./post-link-repository');
 const errors = require('@tryghost/errors');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 
 class LinkTrackingServiceWrapper {
     async init() {

package/core/server/services/mail/ghost-mailer.js

@@ -6,7 +6,7 @@ const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const settingsCache = require('../../../shared/settings-cache');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const metrics = require('@tryghost/metrics');
 const emailAddress = require('../email-address');
 const messages = {

package/core/server/services/mail/index.js

@@ -1,5 +1,5 @@
 const path = require('path');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
 const EmailContentGenerator = require('../lib/email-content-generator');
 

package/core/server/services/media-inliner/external-media-inliner.js

@@ -1,6 +1,6 @@
 const mime = require('mime-types');
 const request = require('../../lib/request-external');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 const string = require('@tryghost/string');
@@ -37,7 +37,7 @@ class ExternalMediaInliner {
      * @param {Object} deps.PostMetaModel - PostMeta model
      * @param {Object} deps.TagModel - Tag model
      * @param {Object} deps.UserModel - User model
-     * @param {(extension) => import('ghost-storage-base')} deps.getMediaStorage - getMediaStorage
+     * @param {(extension) => import('ghost-storage-base').StorageBase} deps.getMediaStorage - getMediaStorage
      */
     constructor(deps) {
         this.#PostModel = deps.PostModel;

package/core/server/services/media-inliner/service.js

@@ -4,10 +4,11 @@ module.exports = {
         const MediaInliner = require('./external-media-inliner');
         const models = require('../../models');
         const jobsService = require('../jobs');
+        const adapterManager = require('../../services/adapter-manager').default;
 
-        const mediaStorage = require('../../adapters/storage').getStorage('media');
-        const imageStorage = require('../../adapters/storage').getStorage('images');
-        const fileStorage = require('../../adapters/storage').getStorage('files');
+        const mediaStorage = adapterManager.getAdapter('storage:media');
+        const imageStorage = adapterManager.getAdapter('storage:images');
+        const fileStorage = adapterManager.getAdapter('storage:files');
 
         const config = require('../../../shared/config');
 

package/core/server/services/member-attribution/index.js

@@ -1,5 +1,5 @@
 const urlService = require('../url');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
 const config = require('../../../shared/config');
 

package/core/server/services/member-welcome-emails/service.js

@@ -1,6 +1,6 @@
 const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
 const verifyEmailTemplate = require('../newsletters/emails/verify-email');
 const MagicLink = require('../lib/magic-link/magic-link');

package/core/server/services/members/api.js

@@ -11,7 +11,8 @@ const signupPaidEmail = require('./emails/signup-paid');
 const subscribeEmail = require('./emails/subscribe');
 const updateEmail = require('./emails/update-email');
 const SingleUseTokenProvider = require('./single-use-token-provider');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
+const urlService = require('../url');
 const labsService = require('../../../shared/labs');
 const offersService = require('../offers');
 const tiersService = require('../tiers');
@@ -53,6 +54,7 @@ function trimLeadingWhitespace(strings, ...values) {
 
 function createApiInstance(config) {
     const membersApiInstance = MembersApi({
+        urlService: urlService.facade,
         tokenConfig: config.getTokenConfig(),
         auth: {
             getSigninURL: config.getSigninURL.bind(config),
@@ -259,7 +261,11 @@ function createApiInstance(config) {
         commentsService,
         emailAddressService: emailAddressService.service,
         giftService,
-        customFieldsService
+        // Resolved here rather than passed as the module: the members service needs
+        // the values service itself, and reading it at construction is what ties the
+        // two together in boot order. Custom fields is initialised in initCore, the
+        // members API is built in initServices, so this is always the live instance.
+        customFieldValues: customFieldsService.values
     });
 
     return membersApiInstance;

package/core/server/services/members/csv/index.js

@@ -0,0 +1,10 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unparse = exports.parse = void 0;
+var parse_1 = require("./parse");
+Object.defineProperty(exports, "parse", { enumerable: true, get: function () { return __importDefault(parse_1).default; } });
+var unparse_1 = require("./unparse");
+Object.defineProperty(exports, "unparse", { enumerable: true, get: function () { return __importDefault(unparse_1).default; } });

package/core/server/services/members/csv/index.ts

@@ -0,0 +1,3 @@
+export {default as parse} from './parse';
+export {default as unparse} from './unparse';
+export type {Label, MemberCsvRow} from './types';