ghost 6.53.0 → 6.54.1

package/core/server/api/endpoints/member-custom-fields.ts

@@ -67,8 +67,11 @@ const controller = {
         permissions(frame: Frame) {
             return canThis(frame).add.member_custom_field();
         },
+        // The whole array is passed through: create is a batch, applied
+        // all-or-nothing. A client sending a single definition (as Admin does)
+        // is just the one-item case and sees no change.
         query(frame: Frame) {
-            return definitions!.add(requestContextFromFrame(frame), frame.data.members_custom_fields[0]);
+            return definitions!.add(requestContextFromFrame(frame), frame.data.members_custom_fields);
         }
     },
 

package/core/server/api/endpoints/members.js

@@ -3,14 +3,27 @@
 const moment = require('moment-timezone');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
-const models = require('../../models');
 const membersService = require('../../services/members');
 
-const settingsCache = require('../../../shared/settings-cache');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 const {getCSVExportFileName} = require('./utils/csv-export-filename');
 
+// Shape the import service's outcome into the API response envelope: an inline import
+// reports its stats and label, a deferred one only how much it accepted.
+function importCSVResponse(outcome) {
+    if (outcome.deferred) {
+        return {meta: {originalImportSize: outcome.originalImportSize}};
+    }
+    return {
+        meta: {
+            originalImportSize: outcome.originalImportSize,
+            stats: {imported: outcome.result.imported, invalid: outcome.result.errors},
+            import_label: outcome.result.importLabel || null
+        }
+    };
+}
+
 const messages = {
     memberNotFound: 'Member not found.',
     notSendingWelcomeEmail: 'Email verification required, welcome email is disabled',
@@ -418,33 +431,17 @@ const controller = {
             method: 'add'
         },
         async query(frame) {
-            const siteTimezone = settingsCache.get('timezone');
-
-            const importLabel = {
-                name: `Import ${moment().tz(siteTimezone).format('YYYY-MM-DD HH:mm')}`
-            };
-
-            const globalLabels = [importLabel].concat(frame.data.labels);
-            const pathToCSV = frame.file.path;
-            const headerMapping = frame.data.mapping;
-
-            let email;
-            if (frame.user) {
-                email = frame.user.get('email');
-            } else {
-                email = (await models.User.getOwnerUser()).get('email');
-            }
-
-            return membersService.processImport({
-                pathToCSV,
-                headerMapping,
-                globalLabels,
-                importLabel,
-                LabelModel: models.Label,
-                user: {
-                    email: email
-                }
+            // The endpoint adapts the request frame into the import service's arguments
+            // and shapes its outcome into the response envelope, so neither the frame nor
+            // the meta shape crosses into the domain. The recipient is the request user;
+            // the service falls back to the site owner when there is none.
+            const outcome = await membersService.importCSV({
+                filePath: frame.file.path,
+                mapping: frame.data.mapping,
+                extraLabels: frame.data.labels || [],
+                requestUserEmail: frame.user ? frame.user.get('email') : null
             });
+            return importCSVResponse(outcome);
         }
     },
 

package/core/server/api/endpoints/pages.js

@@ -2,6 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.paid_conversions', 'post_revisions', 'post_revisions.author'];
 const UNSAFE_ATTRS = ['status', 'authors', 'visibility'];
 
@@ -44,7 +45,11 @@ const controller = {
             unsafeAttrs: UNSAFE_ATTRS
         },
         query(frame) {
-            return models.Post.findPage(frame.options);
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
+            return models.Post.findPage(options);
         }
     },
 

package/core/server/api/endpoints/posts.js

@@ -1,7 +1,8 @@
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const models = require('../../models');
 const {getCSVExportFileName} = require('./utils/csv-export-filename');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
+const {rejectAdminApiRestrictedFieldsTransformer} = require('./utils/api-filter-utils');
 const allowedIncludes = [
     'tags',
     'authors',
@@ -78,7 +79,11 @@ const controller = {
             unsafeAttrs: unsafeAttrs
         },
         query(frame) {
-            return postsService.browsePosts(frame.options);
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
+            return postsService.browsePosts(options);
         }
     },
 
@@ -106,13 +111,33 @@ const controller = {
         },
         validation: {},
         async query(frame) {
+            const options = {
+                ...frame.options,
+                mongoTransformer: rejectAdminApiRestrictedFieldsTransformer
+            };
             return {
-                data: await postsService.export(frame),
+                data: await postsService.export(options),
                 filename: getCSVExportFileName('analytics')
             };
         }
     },
 
+    importCSV: {
+        statusCode: 202,
+        headers: {
+            cacheInvalidate: false
+        },
+        permissions: {
+            docName: 'content_imports',
+            method: 'importContent'
+        },
+        async query() {
+            // CSV processing lands in a later milestone — for now the endpoint
+            // only accepts the upload (gated by the csvContentImporter flag)
+            return {};
+        }
+    },
+
     read: {
         headers: {
             cacheInvalidate: false

package/core/server/api/endpoints/search-index-public.js

@@ -1,5 +1,6 @@
 const models = require('../../models');
 const urlService = require('../../services/url');
+const {requiredUrlColumns} = require('./utils/serializers/input/utils/url');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const postsService = getPostServiceInstance();
 
@@ -21,7 +22,7 @@ const controller = {
                 filter: 'type:post',
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'slug', 'title', 'excerpt', 'url', 'updated_at', 'visibility'],
+                columns: requiredUrlColumns('posts', ['id', 'slug', 'title', 'excerpt', 'url', 'updated_at', 'visibility']),
                 ...urlRelationsWhenLazyRouting()
             };
 
@@ -37,7 +38,7 @@ const controller = {
             const options = {
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'slug', 'name', 'url', 'profile_image']
+                columns: requiredUrlColumns('authors', ['id', 'slug', 'name', 'url', 'profile_image'])
             };
 
             return models.Author.findPage(options);
@@ -52,7 +53,7 @@ const controller = {
             const options = {
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'slug', 'name', 'url'],
+                columns: requiredUrlColumns('tags', ['id', 'slug', 'name', 'url']),
                 filter: 'visibility:public'
             };
 

package/core/server/api/endpoints/search-index.js

@@ -1,5 +1,6 @@
 const models = require('../../models');
 const urlService = require('../../services/url');
+const {requiredUrlColumns} = require('./utils/serializers/input/utils/url');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const postsService = getPostServiceInstance();
 
@@ -24,7 +25,7 @@ const controller = {
                 filter: 'type:post+status:[draft,published,scheduled,sent]',
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility'],
+                columns: requiredUrlColumns('posts', ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility']),
                 ...urlRelationsWhenLazyRouting()
             };
 
@@ -44,7 +45,7 @@ const controller = {
                 filter: 'type:page+status:[draft,published,scheduled]',
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility'],
+                columns: requiredUrlColumns('pages', ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility']),
                 ...urlRelationsWhenLazyRouting()
             };
 
@@ -63,7 +64,7 @@ const controller = {
             const options = {
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'slug', 'name', 'url']
+                columns: requiredUrlColumns('tags', ['id', 'slug', 'name', 'url'])
             };
 
             return models.Tag.findPage(options);
@@ -81,7 +82,7 @@ const controller = {
             const options = {
                 limit: '10000',
                 order: 'updated_at DESC',
-                columns: ['id', 'slug', 'url', 'name', 'profile_image']
+                columns: requiredUrlColumns('authors', ['id', 'slug', 'url', 'name', 'profile_image'])
             };
 
             return models.User.findPage(options);

package/core/server/api/endpoints/settings-public.js

@@ -1,6 +1,6 @@
 const settingsCache = require('../../../shared/settings-cache');
 const labs = require('../../../shared/labs');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const ghostVersion = require('@tryghost/version');
 
 /** @type {import('@tryghost/api-framework').Controller} */

package/core/server/api/endpoints/settings.js

@@ -1,4 +1,5 @@
 const _ = require('lodash');
+const fs = require('fs-extra');
 const models = require('../../models');
 const routeSettings = require('../../services/route-settings');
 const {BadRequestError} = require('@tryghost/errors');
@@ -171,7 +172,8 @@ const controller = {
             method: 'edit'
         },
         async query(frame) {
-            await routeSettings.api.upload(frame.file.path);
+            const content = await fs.readFile(frame.file.path, 'utf8');
+            await routeSettings.api.upload(content);
             const getRoutesHash = () => routeSettings.api.getCurrentHash();
             await settingsService.syncRoutesHash(getRoutesHash);
         }

package/core/server/api/endpoints/utils/serializers/input/utils/url.js

@@ -1,4 +1,4 @@
-const urlUtils = require('../../../../../../../shared/url-utils');
+const urlUtils = require('../../../../../../../shared/url-utils').default;
 const urlService = require('../../../../../../services/url');
 const localUtils = require('../../../index');
 
@@ -108,7 +108,15 @@ const forceUrlRelationsWhenLazy = (frame, routerType) => {
     forceUrlColumnsWhenLazy(frame, routerType);
 };
 
+// Options-object variant of forceUrlColumnsWhenLazy for endpoints that build
+// their query options directly (search index).
+const requiredUrlColumns = (routerType, columns) => {
+    const required = urlService.facade.getRequiredFields(routerType).filter(field => !columns.includes(field));
+    return required.length ? [...columns, ...required] : columns;
+};
+
 module.exports.forPost = forPost;
+module.exports.requiredUrlColumns = requiredUrlColumns;
 module.exports.forUser = forUser;
 module.exports.forTag = forTag;
 module.exports.forSetting = forSetting;

package/core/server/api/endpoints/utils/serializers/output/default.js

@@ -12,6 +12,13 @@ const mapResponse = (docName, mappable, frame) => {
 };
 
 module.exports = {
+    // 204 No Content — see posts.js destroy
+    destroy(response, apiConfig, frame) {
+        debug('destroy', apiConfig.docName);
+
+        frame.response = {[apiConfig.docName]: []};
+    },
+
     all(response, apiConfig, frame) {
         const {docName, method} = apiConfig;
         debug('serializing', docName, method);

package/core/server/api/endpoints/utils/serializers/output/files.js

@@ -1,5 +1,5 @@
 const config = require('../../../../../../shared/config');
-const urlUtils = require('../../../../../../shared/url-utils');
+const urlUtils = require('../../../../../../shared/url-utils').default;
 
 function getURL(urlPath) {
     const media = new RegExp('^' + config.getSubdir() + '/' + urlUtils.STATIC_FILES_URL_PREFIX);

package/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -120,7 +120,10 @@ const commentMapper = (model, frame) => {
 
     if (jsonModel.post) {
         // We could use the post mapper here, but we need less field + don't need all the async behavior support
-        url.forPost(jsonModel.post.id, jsonModel.post, frame);
+        // Comments live on pages as well as posts; the URL service routes by
+        // the passed type, so a page typed 'posts' resolves to /404/.
+        const routerType = jsonModel.post.type === 'page' ? 'pages' : 'posts';
+        url.forPost(jsonModel.post.id, jsonModel.post, frame, routerType);
         response.post = _.pick(jsonModel.post, postFields);
 
         // Compute excerpt from custom_excerpt or plaintext (same logic as post serializer)

package/core/server/api/endpoints/utils/serializers/output/media.js

@@ -1,5 +1,5 @@
 const config = require('../../../../../../shared/config');
-const urlUtils = require('../../../../../../shared/url-utils');
+const urlUtils = require('../../../../../../shared/url-utils').default;
 
 function getURL(urlPath) {
     const media = new RegExp('^' + config.getSubdir() + '/' + urlUtils.STATIC_MEDIA_URL_PREFIX);

package/core/server/api/endpoints/utils/serializers/output/member-custom-fields.js

@@ -4,13 +4,16 @@ const serializers_1 = require("../../../../../services/members-custom-fields/ser
 const serializeOne = (field, _apiConfig, frame) => {
     frame.response = serializers_1.toCustomFieldsResponse.parse([field]);
 };
+const serializeMany = (fields, _apiConfig, frame) => {
+    frame.response = serializers_1.toCustomFieldsResponse.parse(fields);
+};
 // module.exports (not export): the API framework loads serializers via require(). The endpoint ->
 // serializer mapping lives here; the response shaping lives with the members-custom-fields service.
 module.exports = {
-    browse(fields, _apiConfig, frame) {
-        frame.response = serializers_1.toCustomFieldsResponse.parse(fields);
-    },
+    browse: serializeMany,
     read: serializeOne,
-    add: serializeOne,
+    // Create is a batch, so it returns every definition it made. The response is
+    // already an array, so a one-item create looks exactly as it did before.
+    add: serializeMany,
     edit: serializeOne
 };

package/core/server/api/endpoints/utils/serializers/output/member-custom-fields.ts

@@ -9,13 +9,17 @@ const serializeOne = (field: CustomField, _apiConfig: unknown, frame: Frame): vo
     frame.response = toCustomFieldsResponse.parse([field]);
 };
 
+const serializeMany = (fields: CustomField[], _apiConfig: unknown, frame: Frame): void => {
+    frame.response = toCustomFieldsResponse.parse(fields);
+};
+
 // module.exports (not export): the API framework loads serializers via require(). The endpoint ->
 // serializer mapping lives here; the response shaping lives with the members-custom-fields service.
 module.exports = {
-    browse(fields: CustomField[], _apiConfig: unknown, frame: Frame): void {
-        frame.response = toCustomFieldsResponse.parse(fields);
-    },
+    browse: serializeMany,
     read: serializeOne,
-    add: serializeOne,
+    // Create is a batch, so it returns every definition it made. The response is
+    // already an array, so a one-item create looks exactly as it did before.
+    add: serializeMany,
     edit: serializeOne
 };

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -1,10 +1,12 @@
 //@ts-check
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:members');
-const {unparse} = require('@tryghost/members-csv');
+const {serialize: serializeCSV} = require('../../../../../services/members/import-export/csv');
+// The export CSV row shape and its encode live in the domain (typed against the export
+// row) rather than here, so a change to the export row is caught by the compiler.
+const {toExportCsvRow} = require('../../../../../services/members/import-export/export/exporter');
 const mappers = require('./mappers');
 const {Transform} = require('stream');
-const papaparse = require('papaparse');
 const {createCSVStreamResponse} = require('./stream-csv-response');
 module.exports = {
     browse: createSerializer('browse', paginatedMembers),
@@ -25,69 +27,6 @@ module.exports = {
     activityFeed: createSerializer('activityFeed', activityFeed)
 };
 
-// Columns to export in CSV
-const CSV_HEADERS = [
-    'id',
-    'email',
-    'name',
-    'note',
-    'subscribed_to_emails',
-    'complimentary_plan',
-    'stripe_customer_id',
-    'created_at',
-    'deleted_at',
-    'labels',
-    'tiers',
-    'gift_id'
-];
-
-/**
- * Formats a single member for CSV export
- * @param {Object} member - Member object
- * @returns {Object} Formatted member
- */
-function formatMemberForCSV(member) {
-    let labels = '';
-    if (Array.isArray(member.labels)) {
-        labels = member.labels.map((l) => {
-            return typeof l === 'string' ? l : l.name;
-        }).join(',');
-    }
-
-    let tiers = '';
-    if (Array.isArray(member.tiers)) {
-        tiers = member.tiers.map((tier) => {
-            return tier.name;
-        }).join(',');
-    }
-
-    // Convert boolean 'false' to empty string for tests to pass
-    // Only comped = true should result in 'true', otherwise empty string
-    const complimentaryPlan = member.comped === true ? 'true' : '';
-
-    // Gift members carry the gift id so an exported CSV can be re-imported and reassigned
-    // back to a (possibly new) member record via the gifts table
-    const giftId = member.gift_id || '';
-
-    // Convert subscribed boolean to string representation
-    const subscribedToEmails = member.subscribed === true ? 'true' : 'false';
-
-    return {
-        id: member.id,
-        email: member.email,
-        name: member.name,
-        note: member.note,
-        subscribed_to_emails: subscribedToEmails,
-        complimentary_plan: complimentaryPlan,
-        stripe_customer_id: member.stripe_customer_id,
-        created_at: member.created_at,
-        deleted_at: member.deleted_at || null,
-        labels: labels,
-        tiers: tiers,
-        gift_id: giftId
-    };
-}
-
 /**
  * @template PageMeta
  *
@@ -429,38 +368,27 @@ function serializeNewsletters(newsletters) {
  * @returns {Transform} Transform stream that converts objects to CSV
  */
 function createCSVTransform() {
-    let isFirstChunk = true;
-    
+    // Locked in from the first row rather than declared up front: custom fields
+    // add a column per site, so the column set isn't known until a row arrives.
+    // Every row carries the same keys, so the first is representative.
+    let fields = null;
+
     return new Transform({
         objectMode: true,
         transform(member, encoding, callback) {
             try {
                 // Format the member data for CSV
-                const formattedMember = formatMemberForCSV(member);
-                
+                const formattedMember = toExportCsvRow(member);
+
                 // For first chunk, include the headers
-                if (isFirstChunk) {
-                    const csv = papaparse.unparse({
-                        fields: CSV_HEADERS,
-                        data: [formattedMember]
-                    }, {
-                        header: true,
-                        escapeFormulae: true,
-                        newline: '\r\n' // Explicitly set Windows-style line endings for compatibility
-                    });
-                    isFirstChunk = false;
+                if (fields === null) {
+                    fields = Object.keys(formattedMember);
+                    const csv = serializeCSV([formattedMember], {columns: fields, header: true});
                     callback(null, csv);
                 } else {
                     // For subsequent chunks, don't include headers, just the data
-                    const csv = papaparse.unparse({
-                        fields: CSV_HEADERS,
-                        data: [formattedMember]
-                    }, {
-                        header: false,
-                        escapeFormulae: true,
-                        newline: '\r\n' // Explicitly set Windows-style line endings for compatibility
-                    });
-                    
+                    const csv = serializeCSV([formattedMember], {columns: fields, header: false});
+
                     // Make sure each row starts with a newline to ensure separation between rows
                     // Ensure consistent line endings by using explicit CR+LF sequence
                     callback(null, '\r\n' + csv.replace(/^\r?\n+/, ''));
@@ -475,28 +403,21 @@ function createCSVTransform() {
 /**
  * @template PageMeta
  *
- * @param {{data: any[]|Object, filename?: string}} data
+ * @param {{data: NodeJS.ReadableStream, filename?: string}} data
  *
- * @returns {string|Function} - A CSV string or response handler function
+ * @returns {Function} - A response handler that streams the CSV
  */
 function exportCSV(data) {
     debug('exportCSV');
 
-    // Check if data.data is a stream (has the pipe method)
-    if (data.data && typeof data.data.pipe === 'function') {
-        debug('CSV stream response');
-
-        // Fall back to the legacy filename if the endpoint didn't provide one
-        const datetime = (new Date()).toJSON().substring(0, 10);
-        const filename = data.filename || `members.${datetime}.csv`;
+    // The export endpoint always yields a stream (response.stream: true), so there is
+    // only ever a stream to pipe.
+    const datetime = (new Date()).toJSON().substring(0, 10);
+    const filename = data.filename || `members.${datetime}.csv`;
 
-        return createCSVStreamResponse({
-            source: data.data,
-            transform: createCSVTransform(),
-            filename
-        });
-    }
-
-    // Otherwise use the unparse function for array data
-    return unparse(data.data);
+    return createCSVStreamResponse({
+        source: data.data,
+        transform: createCSVTransform(),
+        filename
+    });
 }

package/core/server/api/endpoints/utils/serializers/output/pages.js

@@ -3,6 +3,13 @@ const mappers = require('./mappers');
 const tiersService = require('../../../../../services/tiers');
 
 module.exports = {
+    // 204 No Content — see posts.js destroy
+    destroy(models, apiConfig, frame) {
+        debug('destroy');
+
+        frame.response = {pages: []};
+    },
+
     async all(models, apiConfig, frame) {
         debug('all');
 

package/core/server/api/endpoints/utils/serializers/output/posts.js

@@ -5,6 +5,15 @@ const {createCSVTransform} = require('./posts-csv-transform');
 const {createCSVStreamResponse} = require('./stream-csv-response');
 
 module.exports = {
+    // 204 No Content — bookshelf clears the destroyed model's attributes
+    // (only relations remain), so there is nothing serializable left and
+    // computing its URL would hand the URL service a relations-only resource.
+    destroy(models, apiConfig, frame) {
+        debug('destroy');
+
+        frame.response = {posts: []};
+    },
+
     async all(models, apiConfig, frame) {
         debug('all');
 
@@ -62,6 +71,10 @@ module.exports = {
         });
     },
 
+    importCSV(result, apiConfig, frame) {
+        frame.response = result;
+    },
+
     bulkEdit(bulkActionResult, _apiConfig, frame) {
         frame.response = {
             bulk: {

package/core/server/api/endpoints/utils/serializers/output/utils/url.js

@@ -1,5 +1,5 @@
 const urlService = require('../../../../../../services/url');
-const urlUtils = require('../../../../../../../shared/url-utils');
+const urlUtils = require('../../../../../../../shared/url-utils').default;
 const localUtils = require('../../../index');
 
 const forPost = (id, attrs, frame, type = 'posts') => {