ghost 6.53.0 → 6.54.1

package/core/server/services/members/import-export/index.js

@@ -0,0 +1,90 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeImporter = makeImporter;
+exports.makeExporter = makeExporter;
+const importer_1 = __importDefault(require("./import/importer"));
+const reader_1 = __importDefault(require("./import/reader"));
+const spool_1 = require("./import/spool");
+const exporter_1 = __importDefault(require("./export/exporter"));
+const MembersCSVImporterStripeUtils = require('./import/stripe-utils');
+const db = require('../../../data/db');
+const models = require('../../../models');
+const labs = require('../../../../shared/labs');
+// Build the members CSV importer. This is the composition root: today's models and
+// services are wired behind the collaborators the importer declares, one per
+// concern, so nothing Bookshelf-shaped leaks into the import service itself.
+function makeImporter(deps) {
+    // The members repository resolves asynchronously and is stable once ready, so
+    // cache the promise and reuse it across every call the import makes.
+    let membersRepositoryPromise;
+    const getMembersRepository = () => (membersRepositoryPromise ??= deps.getMembersRepository());
+    // The members aggregate, plus the import label lookup folded in so the label
+    // (member-tagging data) does not need a source of its own.
+    const members = {
+        get: async (query, options) => (await getMembersRepository()).get(query, options),
+        create: async (values, options) => (await getMembersRepository()).create(values, options),
+        update: async (values, options) => (await getMembersRepository()).update(values, options),
+        getCustomerIdByEmail: async (email) => (await getMembersRepository()).getCustomerIdByEmail(email),
+        linkStripeCustomer: async (link, options) => (await getMembersRepository()).linkStripeCustomer(link, options),
+        getImportLabel: name => models.Label.findOne({ name })
+    };
+    // The completion email: its recipient, links and delivery in one collaborator.
+    const email = {
+        send: deps.sendEmail,
+        getDefaultRecipient: async () => (await models.User.getOwnerUser()).get('email'),
+        urlFor: deps.urlFor
+    };
+    // Gifts is initialised at boot and always present at request time; the getter
+    // resolves it lazily so the ready service is picked up whenever a row uses it.
+    const gifts = {
+        reassignRedeemer: (giftId, memberId, options) => deps.getGiftService().reassignRedeemer(giftId, memberId, options)
+    };
+    return new importer_1.default({
+        knex: deps.knex,
+        readRows: reader_1.default,
+        spool: (0, spool_1.createRowSpool)(),
+        members,
+        tiers: {
+            getDefault: deps.getDefaultTier,
+            getByName: deps.getTierByName
+        },
+        stripe: new MembersCSVImporterStripeUtils({
+            stripeAPIService: deps.stripeAPIService,
+            productRepository: deps.productRepository
+        }),
+        gifts,
+        email,
+        addJob: deps.addJob,
+        getTimezone: deps.getTimezone,
+        getInlineThreshold: deps.getInlineThreshold
+    });
+}
+// Build the members CSV exporter. The same composition root from the other direction:
+// knex and the members id lookup are wired here, and the custom fields definitions and
+// values services are injected (boot builds them before this one). The labs flag alone
+// decides whether custom field columns appear, so nothing flag-shaped leaks into the
+// exporter itself.
+function makeExporter({ definitions, values }) {
+    const exporter = new exporter_1.default({
+        knex: db.knex,
+        members: {
+            // Minimal query, only to fetch the ids of the filtered members; the stream
+            // reads their related data itself.
+            findFilteredIds: async (options) => {
+                const page = await models.Member.findPage({ ...options, withRelated: [], columns: ['id'], limit: 'all' });
+                return page.data.map((member) => member.id);
+            }
+        },
+        customFields: {
+            // Boot builds the definitions and values services before this one, so they
+            // are always present -- no not-initialised state to guard. The flag decides
+            // whether their columns are included at all.
+            activeDefinitions: async () => (labs.isSet('membersCustomFields') ? definitions.browse() : []),
+            valuesForMembers: memberIds => values.getValuesForMembers(memberIds)
+        }
+    });
+    return (options = {}) => exporter.export(options);
+}

package/core/server/services/members/import-export/index.ts

@@ -0,0 +1,118 @@
+import type {Knex} from 'knex';
+import MembersCSVImporter, {type MembersRepository, type GiftService, type EmailNotifications, type Tier} from './import/importer';
+import readMemberRows from './import/reader';
+import {createRowSpool} from './import/spool';
+import MembersCSVExporter, {type ExportOptions, type CustomFieldDefinition} from './export/exporter';
+
+const MembersCSVImporterStripeUtils = require('./import/stripe-utils');
+const db = require('../../../data/db');
+const models = require('../../../models');
+const labs = require('../../../../shared/labs');
+
+// The raw collaborators the members service hands the import composition root, before
+// they are adapted into the ports the importer declares. The members repository is the
+// importer's aggregate minus the import-label lookup, which the root folds in itself.
+interface ImporterServices {
+    knex: Knex;
+    getMembersRepository(): Promise<Omit<MembersRepository, 'getImportLabel'>>;
+    getDefaultTier(): Promise<Tier>;
+    getTierByName(name: string): Promise<Tier | null>;
+    getGiftService(): GiftService;
+    sendEmail: EmailNotifications['send'];
+    urlFor: EmailNotifications['urlFor'];
+    addJob(job: {job: () => Promise<void>; offloaded: boolean; name: string}): void;
+    getTimezone(): string;
+    getInlineThreshold(): number;
+    stripeAPIService: unknown;
+    productRepository: unknown;
+}
+
+// The custom fields services the members service hands the export composition root.
+interface CustomFieldsServices {
+    definitions: {browse(): Promise<CustomFieldDefinition[]>};
+    values: {getValuesForMembers(memberIds: string[]): Promise<Map<string, Record<string, unknown>>>};
+}
+
+// Build the members CSV importer. This is the composition root: today's models and
+// services are wired behind the collaborators the importer declares, one per
+// concern, so nothing Bookshelf-shaped leaks into the import service itself.
+export function makeImporter(deps: ImporterServices) {
+    // The members repository resolves asynchronously and is stable once ready, so
+    // cache the promise and reuse it across every call the import makes.
+    let membersRepositoryPromise: Promise<Omit<MembersRepository, 'getImportLabel'>> | undefined;
+    const getMembersRepository = () => (membersRepositoryPromise ??= deps.getMembersRepository());
+
+    // The members aggregate, plus the import label lookup folded in so the label
+    // (member-tagging data) does not need a source of its own.
+    const members: MembersRepository = {
+        get: async (query, options) => (await getMembersRepository()).get(query, options),
+        create: async (values, options) => (await getMembersRepository()).create(values, options),
+        update: async (values, options) => (await getMembersRepository()).update(values, options),
+        getCustomerIdByEmail: async email => (await getMembersRepository()).getCustomerIdByEmail(email),
+        linkStripeCustomer: async (link, options) => (await getMembersRepository()).linkStripeCustomer(link, options),
+        getImportLabel: name => models.Label.findOne({name})
+    };
+
+    // The completion email: its recipient, links and delivery in one collaborator.
+    const email: EmailNotifications = {
+        send: deps.sendEmail,
+        getDefaultRecipient: async () => (await models.User.getOwnerUser()).get('email'),
+        urlFor: deps.urlFor
+    };
+
+    // Gifts is initialised at boot and always present at request time; the getter
+    // resolves it lazily so the ready service is picked up whenever a row uses it.
+    const gifts: GiftService = {
+        reassignRedeemer: (giftId, memberId, options) => deps.getGiftService().reassignRedeemer(giftId, memberId, options)
+    };
+
+    return new MembersCSVImporter({
+        knex: deps.knex,
+        readRows: readMemberRows,
+        spool: createRowSpool(),
+        members,
+        tiers: {
+            getDefault: deps.getDefaultTier,
+            getByName: deps.getTierByName
+        },
+        stripe: new MembersCSVImporterStripeUtils({
+            stripeAPIService: deps.stripeAPIService,
+            productRepository: deps.productRepository
+        }),
+        gifts,
+        email,
+        addJob: deps.addJob,
+        getTimezone: deps.getTimezone,
+        getInlineThreshold: deps.getInlineThreshold
+    });
+}
+
+// Build the members CSV exporter. The same composition root from the other direction:
+// knex and the members id lookup are wired here, and the custom fields definitions and
+// values services are injected (boot builds them before this one). The labs flag alone
+// decides whether custom field columns appear, so nothing flag-shaped leaks into the
+// exporter itself.
+export function makeExporter({definitions, values}: CustomFieldsServices): (options?: ExportOptions) => Promise<NodeJS.ReadableStream> {
+    const exporter = new MembersCSVExporter({
+        knex: db.knex,
+
+        members: {
+            // Minimal query, only to fetch the ids of the filtered members; the stream
+            // reads their related data itself.
+            findFilteredIds: async (options) => {
+                const page = await models.Member.findPage({...options, withRelated: [], columns: ['id'], limit: 'all'});
+                return page.data.map((member: {id: string}) => member.id);
+            }
+        },
+
+        customFields: {
+            // Boot builds the definitions and values services before this one, so they
+            // are always present -- no not-initialised state to guard. The flag decides
+            // whether their columns are included at all.
+            activeDefinitions: async (): Promise<CustomFieldDefinition[]> => (labs.isSet('membersCustomFields') ? definitions.browse() : []),
+            valuesForMembers: memberIds => values.getValuesForMembers(memberIds)
+        }
+    });
+
+    return (options = {}) => exporter.export(options);
+}

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -467,6 +467,13 @@ module.exports = class RouterController {
                 });
             }
 
+            if (offer.status && offer.status !== 'active') {
+                throw new BadRequestError({
+                    message: tpl(messages.offerArchived),
+                    context: 'Offer with id "' + offerId + '" is no longer active'
+                });
+            }
+
             if (!offer.tier) {
                 throw new BadRequestError({
                     message: 'Offer does not have a tier'

package/core/server/services/members/members-api/members-api.js

@@ -81,10 +81,11 @@ module.exports = function MembersAPI({
     sentry,
     settingsHelpers,
     urlUtils,
+    urlService,
     commentsService,
     emailAddressService,
     giftService,
-    customFieldsService
+    customFieldValues
 }) {
     const tokenService = new TokenService({
         privateKey,
@@ -123,6 +124,7 @@ module.exports = function MembersAPI({
     });
 
     const eventRepository = new EventRepository({
+        urlService,
         DonationPaymentEvent,
         EmailRecipient,
         MemberSubscribeEvent,
@@ -167,7 +169,7 @@ module.exports = function MembersAPI({
         nextPaymentCalculator,
         commentsService,
         giftService,
-        customFieldsService
+        customFieldValues
     });
 
     const geolocationService = new GeolocationService();

package/core/server/services/members/members-api/repositories/event-repository.js

@@ -34,6 +34,7 @@ module.exports = class EventRepository {
         Comment,
         labsService,
         memberAttributionService,
+        urlService,
         MemberEmailChangeEvent,
         AutomatedEmailRecipient,
         Gift
@@ -47,6 +48,7 @@ module.exports = class EventRepository {
         this._EmailRecipient = EmailRecipient;
         this._Comment = Comment;
         this._labsService = labsService;
+        this._urlService = urlService;
         this._MemberCreatedEvent = MemberCreatedEvent;
         this._SubscriptionCreatedEvent = SubscriptionCreatedEvent;
         this._MemberLinkClickEvent = MemberLinkClickEvent;
@@ -59,6 +61,12 @@ module.exports = class EventRepository {
         this._knex = db.knex;
     }
 
+    // the URL service needs the attributed post's relations (e.g. tags for a
+    // tag-filtered collection) to build its URL; prefix them onto the eager-load
+    #attributionPostRelations(prefix) {
+        return this._urlService.getRequiredRelations().map(relation => `${prefix}.${relation}`);
+    }
+
     async getEventTimeline(options = {}) {
         if (!options.limit) {
             options.limit = 10;
@@ -213,6 +221,7 @@ module.exports = class EventRepository {
             withRelated: [
                 'member',
                 'subscriptionCreatedEvent.postAttribution',
+                ...this.#attributionPostRelations('subscriptionCreatedEvent.postAttribution'),
                 'subscriptionCreatedEvent.userAttribution',
                 'subscriptionCreatedEvent.tagAttribution',
                 'subscriptionCreatedEvent.memberCreatedEvent',
@@ -343,6 +352,7 @@ module.exports = class EventRepository {
             withRelated: [
                 'member',
                 'postAttribution',
+                ...this.#attributionPostRelations('postAttribution'),
                 'userAttribution',
                 'tagAttribution',
                 'signupStatusEvent'
@@ -402,6 +412,7 @@ module.exports = class EventRepository {
             withRelated: [
                 'member',
                 'postAttribution',
+                ...this.#attributionPostRelations('postAttribution'),
                 'userAttribution',
                 'tagAttribution'
             ],
@@ -591,7 +602,7 @@ module.exports = class EventRepository {
     async getCommentEvents(options = {}, filter) {
         options = {
             ...options,
-            withRelated: ['member', 'post', 'post.tags', 'post.authors', 'parent'],
+            withRelated: ['member', 'post', ...this.#attributionPostRelations('post'), 'parent'],
             filter: 'member_id:-null+custom:true',
             useBasicCount: true,
             mongoTransformer: chainTransformers(
@@ -625,7 +636,7 @@ module.exports = class EventRepository {
     async getClickEvents(options = {}, filter) {
         options = {
             ...options,
-            withRelated: ['member', 'link', 'link.post', 'link.post.tags', 'link.post.authors'],
+            withRelated: ['member', 'link', 'link.post', ...this.#attributionPostRelations('link.post')],
             filter: 'custom:true',
             useBasicCount: true,
             mongoTransformer: chainTransformers(

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -6,7 +6,8 @@ const moment = require('moment');
 const messages = {
     stripeNotConnected: 'Missing Stripe connection.',
     memberAlreadyExists: 'Member already exists.',
-    memberNotFound: 'Member not found.'
+    memberNotFound: 'Member not found.',
+    customFieldsOnAdd: 'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.'
 };
 
 // Stored in the action's `context.action_name`; Admin maps it to a display label.
@@ -36,15 +37,6 @@ const CUSTOM_FIELDS_EDITED_ACTION = 'custom_fields_edited';
  * @prop {{getActiveByMembers: (memberIds: string[]) => Promise<Map<string, {cadence: 'month' | 'year', currency: string, amount: number}>>}} service
  */
 
-/**
- * @typedef {object} ICustomFieldsServiceWrapper
- * @prop {{
- *   getValuesForMembers: (memberIds: string[]) => Promise<Map<string, Record<string, unknown>>>,
- *   planWrite: (values: unknown) => Promise<object[]>,
- *   applyWrite: (memberId: string, writes: object[]) => Promise<void>
- * }} values
- */
-
 module.exports = class MemberBREADService {
     /**
      * @param {object} deps
@@ -58,9 +50,9 @@ module.exports = class MemberBREADService {
      * @param {import('../../../settings-helpers/settings-helpers')} deps.settingsHelpers
      * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
      * @param {IGiftServiceWrapper} deps.giftService
-     * @param {ICustomFieldsServiceWrapper} deps.customFieldsService
+     * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
      */
-    constructor({memberRepository, labsService, emailService, stripeService, offersAPI, memberAttributionService, emailSuppressionList, settingsHelpers, nextPaymentCalculator, commentsService, giftService, customFieldsService}) {
+    constructor({memberRepository, labsService, emailService, stripeService, offersAPI, memberAttributionService, emailSuppressionList, settingsHelpers, nextPaymentCalculator, commentsService, giftService, customFieldValues}) {
         this.offersAPI = offersAPI;
         /** @private */
         this.memberRepository = memberRepository;
@@ -83,7 +75,7 @@ module.exports = class MemberBREADService {
         /** @private */
         this.giftService = giftService;
         /** @private */
-        this.customFieldsService = customFieldsService;
+        this.customFieldValues = customFieldValues;
     }
 
     /**
@@ -112,7 +104,7 @@ module.exports = class MemberBREADService {
             return null;
         }
 
-        return this.customFieldsService.values.getValuesForMembers(memberIds);
+        return this.customFieldValues.getValuesForMembers(memberIds);
     }
 
     /**
@@ -444,7 +436,36 @@ module.exports = class MemberBREADService {
         return member;
     }
 
+    /**
+     * @private
+     * The write-side flag gate, paired with `fetchCustomFieldValues` on the read
+     * side. The schema declares `custom_fields` for every site, so the key arrives
+     * whether or not the feature is on and this is what decides it goes no further.
+     * @param {object} data
+     */
+    dropCustomFieldsWhenDisabled(data) {
+        if (!this.labsService.isSet('membersCustomFields')) {
+            delete data.custom_fields;
+        }
+    }
+
     async add(data, options) {
+        this.dropCustomFieldsWhenDisabled(data);
+
+        // Values cannot be set on create, only on a subsequent edit. `namesValues`
+        // both judges the body and rejects a malformed one, so a body refused here is
+        // refused on edit for the same reason.
+        if (this.customFieldValues.namesValues(data.custom_fields)) {
+            throw new errors.ValidationError({
+                message: tpl(messages.customFieldsOnAdd),
+                property: 'custom_fields'
+            });
+        }
+
+        // Not a member column, so it comes off before the repository sees it. Only
+        // an absent key or one naming no values gets this far.
+        delete data.custom_fields;
+
         if (!this.stripeService.configured && (data.comped || data.stripe_customer_id)) {
             const property = data.comped ? 'comped' : 'stripe_customer_id';
             throw new errors.ValidationError({
@@ -527,10 +548,12 @@ module.exports = class MemberBREADService {
     async edit(data, options) {
         delete data.last_seen_at;
 
+        this.dropCustomFieldsWhenDisabled(data);
+
         // Values live in their own table, so they come off the member data before
-        // the repository sees it — `custom_fields` is not a member column. It only
-        // reaches here at all when the flag is on (the input validator strips it
-        // otherwise), so its presence is the signal to write.
+        // the repository sees it — `custom_fields` is not a member column. The gate
+        // above has already dropped it when the feature is off, so by this point its
+        // presence is the signal to write.
         const customFields = data.custom_fields;
         const writeCustomFields = customFields !== undefined;
         delete data.custom_fields;
@@ -540,7 +563,7 @@ module.exports = class MemberBREADService {
         // plan to apply once below, so the values aren't resolved and validated
         // twice.
         const plannedCustomFields = writeCustomFields
-            ? await this.customFieldsService.values.planWrite(customFields)
+            ? await this.customFieldValues.planWrite(customFields)
             : null;
 
         let model;
@@ -589,7 +612,7 @@ module.exports = class MemberBREADService {
         }
 
         if (plannedCustomFields) {
-            await this.customFieldsService.values.applyWrite(model.id, plannedCustomFields);
+            await this.customFieldValues.applyWrite(model.id, plannedCustomFields);
 
             // Custom fields aren't a member column or relation, so an edit touching
             // only them leaves `model._changed` empty and the save fires nothing.

package/core/server/services/members/middleware.js

@@ -4,7 +4,7 @@ const logging = require('@tryghost/logging');
 const membersService = require('./service');
 const emailSuppressionList = require('../email-suppression-list');
 const models = require('../../models');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const spamPrevention = require('../../web/shared/middleware/api/spam-prevention');
 const {
     formattedMemberResponse,

package/core/server/services/members/service.js

@@ -4,12 +4,12 @@ const tpl = require('@tryghost/tpl');
 const MembersSSR = require('./members-ssr');
 const db = require('../../data/db');
 const MembersConfigProvider = require('./members-config-provider');
-const makeMembersCSVImporter = require('./importer');
+const {makeImporter, makeExporter} = require('./import-export');
+const {resolveInlineThreshold} = require('./import-export/config');
 const MembersStats = require('./stats/members-stats');
 const memberJobs = require('./jobs');
 const logging = require('@tryghost/logging');
-const urlUtils = require('../../../shared/url-utils');
-const labsService = require('../../../shared/labs');
+const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
 const config = require('../../../shared/config');
 const models = require('../../models');
@@ -46,10 +46,12 @@ const membersStats = new MembersStats({
 let membersApi;
 let verificationTrigger;
 
-const initMembersCSVImporter = ({stripeAPIService}) => {
-    return makeMembersCSVImporter({
-        storagePath: config.getContentPath('data'),
+const buildImporterDeps = ({stripeAPIService}) => {
+    return {
         getTimezone: () => settingsCache.get('timezone'),
+        // A getter rather than a value because the threshold is an operator
+        // setting that can change between requests
+        getInlineThreshold: () => resolveInlineThreshold(config.get('members:importer:inlineThreshold')),
         getMembersRepository: async () => {
             const api = await module.exports.api;
             return api.members;
@@ -75,16 +77,12 @@ const initMembersCSVImporter = ({stripeAPIService}) => {
         },
         getGiftService: () => giftService.service,
         sendEmail: ghostMailer.send.bind(ghostMailer),
-        isSet: flag => labsService.isSet(flag),
         addJob: jobsService.addJob.bind(jobsService),
         knex: db.knex,
         urlFor: urlUtils.urlFor.bind(urlUtils),
-        context: {
-            importer: true
-        },
         stripeAPIService,
         productRepository: membersApi.productRepository
-    });
+    };
 };
 
 const initVerificationTrigger = () => {
@@ -150,10 +148,22 @@ module.exports = {
         }
         module.exports.verificationTrigger = verificationTrigger;
 
-        const membersCSVImporter = initMembersCSVImporter({stripeAPIService: stripeService.api});
-        module.exports.processImport = async (options) => {
-            return await membersCSVImporter.process({...options, verificationTrigger});
-        };
+        const importerDeps = buildImporterDeps({stripeAPIService: stripeService.api});
+        const membersCSVImporter = makeImporter(importerDeps);
+        // The importer takes plain arguments and returns the domain outcome; callers build
+        // the request and shape the response. importCSV decides inline vs deferred by load
+        // (the endpoint); importInline always runs now (the Revue data import). This only
+        // supplies the verification trigger, a members-service internal.
+        module.exports.importCSV = (request) => membersCSVImporter.importCSV(request, verificationTrigger);
+        module.exports.importInline = (request) => membersCSVImporter.importInline(request, verificationTrigger);
+
+        // Constructed here rather than required statically: the exporter needs the
+        // custom fields services, which boot builds before this one.
+        const customFields = require('../members-custom-fields');
+        module.exports.export = makeExporter({
+            definitions: customFields.definitions,
+            values: customFields.values
+        });
 
         if (!env?.startsWith('testing')) {
             const membersMigrationJobName = 'members-migrations';
@@ -193,10 +203,11 @@ module.exports = {
 
     stripeConnect: require('./stripe-connect'),
 
-    processImport: null,
+    importCSV: null,
+    importInline: null,
 
     stats: membersStats,
-    export: require('./exporter/query')
+    export: null
 };
 
 module.exports.middleware = require('./middleware');

package/core/server/services/members/stripe-connect.js

@@ -4,7 +4,7 @@ const {Buffer} = require('buffer');
 const {randomBytes} = require('crypto');
 
 const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 
 const messages = {
     incorrectState: 'State did not match.'

package/core/server/services/members-custom-fields/actions.js

@@ -24,6 +24,9 @@ async function recordCustomFieldAction({ Action, context, verb, subject, details
         await Action.add({
             event: COMMANDS[verb],
             resource_type: 'member_custom_field',
+            // The field's id: this column holds 24 characters, and a key minted from
+            // a publisher-chosen name is bounded by the far wider key column, so only
+            // the id fits every field.
             resource_id: subject,
             actor_type: context.actor.type,
             actor_id: context.actor.id,

package/core/server/services/members-custom-fields/actions.ts

@@ -29,8 +29,9 @@ export type CustomFieldVerb = keyof typeof COMMANDS;
 // `details` is stored in the action's `context` column (Ghost's slot for "diffs,
 // meta"). We always pass the field's `primary_name` so the log reads as a human
 // label, not a bare key — this is what keeps the timeline legible after a hard
-// delete, when the row itself is gone.
-export type CustomFieldActionDetails = {primary_name: string; previous_name?: string};
+// delete, when the row itself is gone. `key` rides alongside it because the key is
+// how a field is addressed publicly — its id never leaves the API.
+export type CustomFieldActionDetails = {primary_name: string; key: string; previous_name?: string};
 
 export type RecordCustomFieldAction =
     (input: {context: RequestContext; verb: CustomFieldVerb; subject: string; details: CustomFieldActionDetails}) => Promise<void>;
@@ -47,6 +48,9 @@ export async function recordCustomFieldAction(
         await Action.add({
             event: COMMANDS[verb],
             resource_type: 'member_custom_field',
+            // The field's id: this column holds 24 characters, and a key minted from
+            // a publisher-chosen name is bounded by the far wider key column, so only
+            // the id fits every field.
             resource_id: subject,
             actor_type: context.actor.type,
             actor_id: context.actor.id,

package/core/server/services/members-custom-fields/config.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveMaxDefinitions = resolveMaxDefinitions;
+const zod_1 = require("zod");
+/**
+ * Resolving Ghost's config into the values this service runs on.
+ *
+ * Config arrives untyped: defaults.json supplies the shipped value, and any
+ * higher layer — an operator's config file, an environment variable, argv — can
+ * replace it with anything at all. Turning that into something usable is a
+ * config concern, so it happens here, at the boundary. The service is handed an
+ * answer and never learns where it came from.
+ */
+// A ceiling in the form the service needs it. A numeric string is accepted
+// because a value supplied through an environment variable can arrive as one.
+const Ceiling = zod_1.z
+    .union([zod_1.z.number(), zod_1.z.string().trim().min(1)])
+    .transform(Number)
+    .pipe(zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER));
+// defaults.json is the single source of the shipped ceiling: it is the lowest
+// config layer and the file an operator actually reads and edits, so it is read
+// rather than restated. Parsed eagerly because a missing or malformed value
+// there is our bug rather than an operator's, and should fail loudly at boot
+// instead of quietly becoming the fallback for everything below.
+const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.customFields.maxDefinitions);
+// A higher layer can override the shipped value with anything. Something
+// unreadable falls back to the shipped ceiling rather than throwing, because an
+// operator can correct this live and a bad value must not take the feature down
+// with it — and rather than meaning "no ceiling", because a typo must not
+// silently remove the safeguard.
+const MaxDefinitions = Ceiling.catch(shippedCeiling);
+function resolveMaxDefinitions(configured) {
+    return MaxDefinitions.parse(configured);
+}