ghost 6.53.0 → 6.54.1

package/core/server/services/members-custom-fields/config.ts

@@ -0,0 +1,38 @@
+import {z} from 'zod';
+
+/**
+ * Resolving Ghost's config into the values this service runs on.
+ *
+ * Config arrives untyped: defaults.json supplies the shipped value, and any
+ * higher layer — an operator's config file, an environment variable, argv — can
+ * replace it with anything at all. Turning that into something usable is a
+ * config concern, so it happens here, at the boundary. The service is handed an
+ * answer and never learns where it came from.
+ */
+
+// A ceiling in the form the service needs it. A numeric string is accepted
+// because a value supplied through an environment variable can arrive as one.
+const Ceiling = z
+    .union([z.number(), z.string().trim().min(1)])
+    .transform(Number)
+    .pipe(z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER));
+
+// defaults.json is the single source of the shipped ceiling: it is the lowest
+// config layer and the file an operator actually reads and edits, so it is read
+// rather than restated. Parsed eagerly because a missing or malformed value
+// there is our bug rather than an operator's, and should fail loudly at boot
+// instead of quietly becoming the fallback for everything below.
+const shippedCeiling: number = Ceiling.parse(
+    require('../../../shared/config/defaults.json').members.customFields.maxDefinitions
+);
+
+// A higher layer can override the shipped value with anything. Something
+// unreadable falls back to the shipped ceiling rather than throwing, because an
+// operator can correct this live and a bad value must not take the feature down
+// with it — and rather than meaning "no ceiling", because a typo must not
+// silently remove the safeguard.
+const MaxDefinitions = Ceiling.catch(shippedCeiling);
+
+export function resolveMaxDefinitions(configured: unknown): number {
+    return MaxDefinitions.parse(configured);
+}

package/core/server/services/members-custom-fields/definitions-service.js

@@ -29,12 +29,35 @@ const MAX_KEY_LENGTH = columns.key.maxlength;
 const MAX_SLUG_ITERATIONS = 1000;
 // Reserve room for a `-<n>` suffix (n up to MAX_SLUG_ITERATIONS).
 const MAX_KEY_BASE_LENGTH = MAX_KEY_LENGTH - (String(MAX_SLUG_ITERATIONS).length + 1);
+// A key becomes a property name on the plain objects that carry a member's values —
+// on both sides of the wire, since `custom_fields` is JSON and a client gets a plain
+// object from JSON.parse. A key naming a member of Object.prototype reads back as
+// inherited rather than absent wherever one of those objects is indexed, and
+// `__proto__` holds no value at all: the values schema drops it during parse, and
+// assigning it sets a prototype rather than a property.
+//
+// Derived rather than listed, because the set is a consequence of how keys are
+// minted: slugifying lowercases, so only an already-lowercase prototype name can
+// survive to become a key. Currently `constructor` and `__proto__`.
+const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype)
+    .filter(name => slugify(name) === name);
 const FieldName = zod_1.z.string().trim().min(1, { message: 'Custom field name is required.' }).max(MAX_NAME_LENGTH, { message: 'Custom field name is too long.' });
 // The backend mints the key from the name, so create takes just a name and type.
 const AddFieldInput = zod_1.z.object({
     name: FieldName,
     type: custom_field_types_1.FieldTypeSchema
 });
+// A bound on the work one request can ask for, separate from how many definitions
+// a site may hold in total. Every definition in a batch costs several queries
+// inside one open write transaction, so an operator raising the site ceiling must
+// not also mean a single request can ask for an unbounded amount of that work.
+const MAX_FIELDS_PER_REQUEST = 100;
+// Create accepts a batch. The framework guarantees a non-empty array by the time a
+// query runs, but the service validates the whole payload up front so a bad item
+// anywhere fails the request before anything is written.
+const AddFieldsInput = zod_1.z.array(AddFieldInput)
+    .min(1)
+    .max(MAX_FIELDS_PER_REQUEST, { message: `Custom fields can only be created ${MAX_FIELDS_PER_REQUEST} at a time.` });
 // Name and status are mutable. `key` and `type` are accepted so the immutability
 // rules can reject a change loudly; they are never persisted.
 const EditFieldInput = zod_1.z.object({
@@ -46,9 +69,16 @@ const EditFieldInput = zod_1.z.object({
 class CustomFieldDefinitionsService {
     knex;
     recordAction;
-    constructor({ knex, recordAction }) {
+    getMaxDefinitions;
+    constructor({ knex, recordAction, getMaxDefinitions }) {
         this.knex = knex;
         this.recordAction = recordAction;
+        // A getter, not a value: the ceiling can be raised or lowered at any time,
+        // and a Ghost container holds no state across requests, so the limit that
+        // applies is whatever it resolves to when the request lands. Asking on
+        // every create means a change takes effect on the next one, with no
+        // restart. Where the number comes from is the caller's business.
+        this.getMaxDefinitions = getMaxDefinitions;
     }
     async browse(options = {}) {
         // Archived fields are hidden by default: most surfaces (member details, the
@@ -74,20 +104,54 @@ class CustomFieldDefinitionsService {
         }
         return zod_1.z.decode(codec_1.customFieldCodec, row);
     }
+    /**
+     * Create one or more field definitions. All-or-nothing: the batch runs in a
+     * single transaction, so a name clash or the operational cap on the third item
+     * leaves the first two unwritten rather than half-applying the request.
+     *
+     * Running inside the transaction also makes a batch self-consistent for free —
+     * `assertNameAvailable` and `mintKey` see the rows inserted earlier in the same
+     * batch, so two items sharing a name are caught and two items sharing a slug
+     * get distinct keys, exactly as if they had arrived as separate requests.
+     */
     async add(context, input) {
-        const parsed = AddFieldInput.safeParse(input);
+        const requestedCount = Array.isArray(input) ? input.length : 0;
+        const parsed = AddFieldsInput.safeParse(input);
         if (!parsed.success) {
-            throw new errors_1.default.ValidationError({ message: parsed.error.issues[0].message, property: parsed.error.issues[0].path[0]?.toString() });
-        }
-        const base = slugify(parsed.data.name);
-        if (!base) {
-            throw new errors_1.default.ValidationError({ message: 'Custom field name must contain at least one usable character.', property: 'name' });
+            const issue = parsed.error.issues[0];
+            throw new errors_1.default.ValidationError({
+                message: issue.message,
+                property: propertyOf(issue.path),
+                context: batchContext(issue.path[0], requestedCount)
+            });
         }
-        await this.assertNameAvailable(parsed.data.name);
-        const id = new bson_objectid_1.default().toHexString();
-        const key = await this.mintKey(base);
+        const fields = parsed.data;
+        // Slugify before opening the transaction: it needs no database access, and
+        // an unusable name is a payload problem worth reporting on its own terms.
+        const bases = fields.map((field, index) => {
+            const base = slugify(field.name);
+            if (!base) {
+                throw new errors_1.default.ValidationError({
+                    message: 'Custom field name must contain at least one usable character.',
+                    property: 'name',
+                    context: batchContext(index, requestedCount)
+                });
+            }
+            return base;
+        });
+        let created;
         try {
-            await this.knex(TABLE).insert({ id, key, name: parsed.data.name, type: parsed.data.type, created_at: new Date() });
+            created = await this.knex.transaction(async (trx) => {
+                await this.assertWithinLimit(trx, fields.length);
+                const keys = [];
+                for (const [index, field] of fields.entries()) {
+                    await this.assertNameAvailable(trx, field.name);
+                    const key = await this.mintKey(trx, bases[index]);
+                    await trx(TABLE).insert({ id: new bson_objectid_1.default().toHexString(), key, name: field.name, type: field.type, created_at: new Date() });
+                    keys.push(key);
+                }
+                return this.readMany(trx, keys);
+            });
         }
         catch (err) {
             // mintKey already picked a free key, so a unique violation here only
@@ -98,17 +162,71 @@ class CustomFieldDefinitionsService {
             }
             throw err;
         }
-        await this.recordAction({ context, verb: 'create', subject: key, details: { primary_name: parsed.data.name } });
-        return this.read(key);
+        // Logged after the commit: the action log is a separate Bookshelf write
+        // outside this transaction, so recording inside it would leave orphaned
+        // "added" entries for fields a rollback never created.
+        for (const field of created) {
+            await this.recordAction({ context, verb: 'create', subject: field.id, details: { primary_name: field.name, key: field.key } });
+        }
+        return created;
+    }
+    /**
+     * The operational ceiling on how many definitions a site can hold. This is a
+     * safeguard against the database load unbounded definitions would create, not
+     * a pricing or packaging limit, so it applies wherever the feature is available
+     * and is deliberately not routed through the entitlement-driven limit service.
+     *
+     * Both active and archived definitions count: an archived field still occupies
+     * a row and still carries its members' values, so archiving alone frees no
+     * space. Deleting an archived field is what releases a slot.
+     *
+     * The count is a consistent read, not a locking one, so two creates landing at
+     * the same instant can both pass and take a site one over. That is deliberate:
+     * this is a ceiling on database load, and holding a table lock across every
+     * create to make it exact would cost more than the overshoot it prevents.
+     *
+     */
+    async assertWithinLimit(db, addedCount) {
+        const max = this.getMaxDefinitions();
+        const row = await db(TABLE).count({ count: '*' }).first();
+        const total = Number(row?.count ?? 0);
+        if (total + addedCount <= max) {
+            return;
+        }
+        // Two different situations reach here and they need different advice. At or
+        // over the ceiling there is nothing to do but free a slot. With slots still
+        // free the request was simply too big, and telling that operator to delete
+        // something is wrong: they have room, just not this much.
+        const remaining = max - total;
+        const advice = remaining > 0
+            ? `You can add ${remaining} more.`
+            : 'Delete a field you no longer need to make room.';
+        throw new errors_1.default.HostLimitError({
+            message: `Custom fields are limited to ${max} per site. ${advice}`,
+            code: 'CUSTOM_FIELDS_LIMIT_REACHED',
+            // `requested` is carried alongside the limit-service shape so a batch
+            // rejection is self-describing: without it a client sees free slots and
+            // a refusal, and has to re-derive its own payload size to explain why.
+            errorDetails: { limit: max, total, requested: addedCount }
+        });
+    }
+    /** Read back a batch in the order its keys were created, not the table's order. */
+    async readMany(db, keys) {
+        const rows = await db(TABLE).whereIn('key', keys).select('*');
+        const byKey = new Map(rows.map(row => [row.key, row]));
+        return keys.map(key => zod_1.z.decode(codec_1.customFieldCodec, byKey.get(key)));
     }
     /**
      * Pick a free key from the name's slug: `base`, then `base-2`, `base-3`, ...
      * Reads the keys already taken by that base — including archived fields, so a
      * slug is never reused once minted. Mirrors how tags/labels generate slugs.
      */
-    async mintKey(base) {
+    async mintKey(db, base) {
         const safeBase = base.slice(0, MAX_KEY_BASE_LENGTH);
-        const taken = new Set(await this.knex(TABLE).where('key', 'like', `${safeBase}%`).pluck('key'));
+        const taken = new Set([
+            ...RESERVED_KEYS,
+            ...await db(TABLE).where('key', 'like', `${safeBase}%`).pluck('key')
+        ]);
         if (!taken.has(safeBase)) {
             return safeBase;
         }
@@ -132,8 +250,8 @@ class CustomFieldDefinitionsService {
      * allow it in the SQLite test/dev suites. `exceptKey` lets a field keep its
      * own name on an unrelated edit.
      */
-    async assertNameAvailable(name, exceptKey) {
-        const query = this.knex(TABLE).whereRaw('LOWER(name) = ?', [name.toLowerCase()]);
+    async assertNameAvailable(db, name, exceptKey) {
+        const query = db(TABLE).whereRaw('LOWER(name) = ?', [name.toLowerCase()]);
         if (exceptKey) {
             query.whereNot('key', exceptKey);
         }
@@ -161,7 +279,7 @@ class CustomFieldDefinitionsService {
         // Only write (and log a rename) when the name actually changes, so
         // re-saving an unchanged field is a no-op rather than a spurious edit.
         if (patch.name !== undefined && patch.name !== existing.name) {
-            await this.assertNameAvailable(patch.name, key);
+            await this.assertNameAvailable(this.knex, patch.name, key);
             try {
                 await this.knex(TABLE)
                     .where('key', key)
@@ -173,7 +291,7 @@ class CustomFieldDefinitionsService {
                 }
                 throw err;
             }
-            await this.recordAction({ context, verb: 'rename', subject: key, details: { primary_name: patch.name, previous_name: existing.name } });
+            await this.recordAction({ context, verb: 'rename', subject: existing.id, details: { primary_name: patch.name, key, previous_name: existing.name } });
         }
         // A status change is the archive/restore transition. Only write (and log)
         // when it actually flips, so re-sending the current status is a no-op.
@@ -182,7 +300,7 @@ class CustomFieldDefinitionsService {
                 .where('key', key)
                 .update({ status: patch.status, updated_at: new Date() });
             const verb = patch.status === schema_1.FIELD_STATUS.archived ? 'archive' : 'restore';
-            await this.recordAction({ context, verb, subject: key, details: { primary_name: patch.name ?? existing.name } });
+            await this.recordAction({ context, verb, subject: existing.id, details: { primary_name: patch.name ?? existing.name, key } });
         }
         return this.read(key);
     }
@@ -202,10 +320,27 @@ class CustomFieldDefinitionsService {
             throw new errors_1.default.ValidationError({ message: 'Only archived custom fields can be deleted. Archive the field first.' });
         }
         await this.knex(TABLE).where('key', key).del();
-        await this.recordAction({ context, verb: 'delete', subject: key, details: { primary_name: field.name } });
+        await this.recordAction({ context, verb: 'delete', subject: field.id, details: { primary_name: field.name, key } });
     }
 }
 exports.CustomFieldDefinitionsService = CustomFieldDefinitionsService;
+// The field a zod issue points at. Create validates an array, so an issue's path
+// is prefixed with the item's index (`[0, 'name']`); `property` names the field
+// that is wrong, so the numeric prefix is dropped. Which item it was is reported
+// separately by batchContext, keeping `property` the bare field name a client can
+// map straight onto its form input.
+function propertyOf(path) {
+    return path.find(segment => typeof segment === 'string');
+}
+// Which definition of a batch an error belongs to. Only set when the request
+// carried more than one: a lone definition needs no pointer, and every client
+// today sends exactly one, so this stays absent on the common path.
+function batchContext(index, requestedCount) {
+    if (requestedCount <= 1 || typeof index !== 'number') {
+        return undefined;
+    }
+    return `Custom field ${index + 1} of ${requestedCount}.`;
+}
 function isUniqueConstraintViolation(error) {
     const code = error?.code;
     return code === 'ER_DUP_ENTRY' || code === 'SQLITE_CONSTRAINT';

package/core/server/services/members-custom-fields/definitions-service.ts

@@ -32,6 +32,19 @@ const MAX_SLUG_ITERATIONS = 1000;
 // Reserve room for a `-<n>` suffix (n up to MAX_SLUG_ITERATIONS).
 const MAX_KEY_BASE_LENGTH = MAX_KEY_LENGTH - (String(MAX_SLUG_ITERATIONS).length + 1);
 
+// A key becomes a property name on the plain objects that carry a member's values —
+// on both sides of the wire, since `custom_fields` is JSON and a client gets a plain
+// object from JSON.parse. A key naming a member of Object.prototype reads back as
+// inherited rather than absent wherever one of those objects is indexed, and
+// `__proto__` holds no value at all: the values schema drops it during parse, and
+// assigning it sets a prototype rather than a property.
+//
+// Derived rather than listed, because the set is a consequence of how keys are
+// minted: slugifying lowercases, so only an already-lowercase prototype name can
+// survive to become a key. Currently `constructor` and `__proto__`.
+const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype)
+    .filter(name => slugify(name) === name);
+
 const FieldName = z.string().trim().min(1, {message: 'Custom field name is required.'}).max(MAX_NAME_LENGTH, {message: 'Custom field name is too long.'});
 
 // The backend mints the key from the name, so create takes just a name and type.
@@ -40,6 +53,19 @@ const AddFieldInput = z.object({
     type: FieldTypeSchema
 });
 
+// A bound on the work one request can ask for, separate from how many definitions
+// a site may hold in total. Every definition in a batch costs several queries
+// inside one open write transaction, so an operator raising the site ceiling must
+// not also mean a single request can ask for an unbounded amount of that work.
+const MAX_FIELDS_PER_REQUEST = 100;
+
+// Create accepts a batch. The framework guarantees a non-empty array by the time a
+// query runs, but the service validates the whole payload up front so a bad item
+// anywhere fails the request before anything is written.
+const AddFieldsInput = z.array(AddFieldInput)
+    .min(1)
+    .max(MAX_FIELDS_PER_REQUEST, {message: `Custom fields can only be created ${MAX_FIELDS_PER_REQUEST} at a time.`});
+
 // Name and status are mutable. `key` and `type` are accepted so the immutability
 // rules can reject a change loudly; they are never persisted.
 const EditFieldInput = z.object({
@@ -52,10 +78,17 @@ const EditFieldInput = z.object({
 export class CustomFieldDefinitionsService {
     private knex: Knex;
     private recordAction: RecordCustomFieldAction;
+    private getMaxDefinitions: () => number;
 
-    constructor({knex, recordAction}: {knex: Knex; recordAction: RecordCustomFieldAction}) {
+    constructor({knex, recordAction, getMaxDefinitions}: {knex: Knex; recordAction: RecordCustomFieldAction; getMaxDefinitions: () => number}) {
         this.knex = knex;
         this.recordAction = recordAction;
+        // A getter, not a value: the ceiling can be raised or lowered at any time,
+        // and a Ghost container holds no state across requests, so the limit that
+        // applies is whatever it resolves to when the request lands. Asking on
+        // every create means a change takes effect on the next one, with no
+        // restart. Where the number comes from is the caller's business.
+        this.getMaxDefinitions = getMaxDefinitions;
     }
 
     async browse(options: {filter?: string} = {}): Promise<CustomField[]> {
@@ -84,23 +117,58 @@ export class CustomFieldDefinitionsService {
         return z.decode(customFieldCodec, row);
     }
 
-    async add(context: RequestContext, input: unknown): Promise<CustomField> {
-        const parsed = AddFieldInput.safeParse(input);
-        if (!parsed.success) {
-            throw new errors.ValidationError({message: parsed.error.issues[0].message, property: parsed.error.issues[0].path[0]?.toString()});
-        }
+    /**
+     * Create one or more field definitions. All-or-nothing: the batch runs in a
+     * single transaction, so a name clash or the operational cap on the third item
+     * leaves the first two unwritten rather than half-applying the request.
+     *
+     * Running inside the transaction also makes a batch self-consistent for free —
+     * `assertNameAvailable` and `mintKey` see the rows inserted earlier in the same
+     * batch, so two items sharing a name are caught and two items sharing a slug
+     * get distinct keys, exactly as if they had arrived as separate requests.
+     */
+    async add(context: RequestContext, input: unknown): Promise<CustomField[]> {
+        const requestedCount = Array.isArray(input) ? input.length : 0;
 
-        const base = slugify(parsed.data.name);
-        if (!base) {
-            throw new errors.ValidationError({message: 'Custom field name must contain at least one usable character.', property: 'name'});
+        const parsed = AddFieldsInput.safeParse(input);
+        if (!parsed.success) {
+            const issue = parsed.error.issues[0];
+            throw new errors.ValidationError({
+                message: issue.message,
+                property: propertyOf(issue.path),
+                context: batchContext(issue.path[0], requestedCount)
+            });
         }
+        const fields = parsed.data;
 
-        await this.assertNameAvailable(parsed.data.name);
+        // Slugify before opening the transaction: it needs no database access, and
+        // an unusable name is a payload problem worth reporting on its own terms.
+        const bases = fields.map((field, index) => {
+            const base = slugify(field.name);
+            if (!base) {
+                throw new errors.ValidationError({
+                    message: 'Custom field name must contain at least one usable character.',
+                    property: 'name',
+                    context: batchContext(index, requestedCount)
+                });
+            }
+            return base;
+        });
 
-        const id = new ObjectID().toHexString();
-        const key = await this.mintKey(base);
+        let created: CustomField[];
         try {
-            await this.knex(TABLE).insert({id, key, name: parsed.data.name, type: parsed.data.type, created_at: new Date()});
+            created = await this.knex.transaction(async (trx) => {
+                await this.assertWithinLimit(trx, fields.length);
+
+                const keys: string[] = [];
+                for (const [index, field] of fields.entries()) {
+                    await this.assertNameAvailable(trx, field.name);
+                    const key = await this.mintKey(trx, bases[index]);
+                    await trx(TABLE).insert({id: new ObjectID().toHexString(), key, name: field.name, type: field.type, created_at: new Date()});
+                    keys.push(key);
+                }
+                return this.readMany(trx, keys);
+            });
         } catch (err) {
             // mintKey already picked a free key, so a unique violation here only
             // means a concurrent create claimed the same key in between. The index
@@ -110,8 +178,65 @@ export class CustomFieldDefinitionsService {
             }
             throw err;
         }
-        await this.recordAction({context, verb: 'create', subject: key, details: {primary_name: parsed.data.name}});
-        return this.read(key);
+
+        // Logged after the commit: the action log is a separate Bookshelf write
+        // outside this transaction, so recording inside it would leave orphaned
+        // "added" entries for fields a rollback never created.
+        for (const field of created) {
+            await this.recordAction({context, verb: 'create', subject: field.id, details: {primary_name: field.name, key: field.key}});
+        }
+        return created;
+    }
+
+    /**
+     * The operational ceiling on how many definitions a site can hold. This is a
+     * safeguard against the database load unbounded definitions would create, not
+     * a pricing or packaging limit, so it applies wherever the feature is available
+     * and is deliberately not routed through the entitlement-driven limit service.
+     *
+     * Both active and archived definitions count: an archived field still occupies
+     * a row and still carries its members' values, so archiving alone frees no
+     * space. Deleting an archived field is what releases a slot.
+     *
+     * The count is a consistent read, not a locking one, so two creates landing at
+     * the same instant can both pass and take a site one over. That is deliberate:
+     * this is a ceiling on database load, and holding a table lock across every
+     * create to make it exact would cost more than the overshoot it prevents.
+     *
+     */
+    private async assertWithinLimit(db: Knex, addedCount: number): Promise<void> {
+        const max = this.getMaxDefinitions();
+
+        const row = await db(TABLE).count({count: '*'}).first();
+        const total = Number(row?.count ?? 0);
+        if (total + addedCount <= max) {
+            return;
+        }
+
+        // Two different situations reach here and they need different advice. At or
+        // over the ceiling there is nothing to do but free a slot. With slots still
+        // free the request was simply too big, and telling that operator to delete
+        // something is wrong: they have room, just not this much.
+        const remaining = max - total;
+        const advice = remaining > 0
+            ? `You can add ${remaining} more.`
+            : 'Delete a field you no longer need to make room.';
+
+        throw new errors.HostLimitError({
+            message: `Custom fields are limited to ${max} per site. ${advice}`,
+            code: 'CUSTOM_FIELDS_LIMIT_REACHED',
+            // `requested` is carried alongside the limit-service shape so a batch
+            // rejection is self-describing: without it a client sees free slots and
+            // a refusal, and has to re-derive its own payload size to explain why.
+            errorDetails: {limit: max, total, requested: addedCount}
+        });
+    }
+
+    /** Read back a batch in the order its keys were created, not the table's order. */
+    private async readMany(db: Knex, keys: string[]): Promise<CustomField[]> {
+        const rows = await db(TABLE).whereIn('key', keys).select('*');
+        const byKey = new Map(rows.map(row => [row.key, row]));
+        return keys.map(key => z.decode(customFieldCodec, byKey.get(key)!));
     }
 
     /**
@@ -119,11 +244,12 @@ export class CustomFieldDefinitionsService {
      * Reads the keys already taken by that base — including archived fields, so a
      * slug is never reused once minted. Mirrors how tags/labels generate slugs.
      */
-    private async mintKey(base: string): Promise<string> {
+    private async mintKey(db: Knex, base: string): Promise<string> {
         const safeBase = base.slice(0, MAX_KEY_BASE_LENGTH);
-        const taken = new Set(
-            await this.knex(TABLE).where('key', 'like', `${safeBase}%`).pluck('key')
-        );
+        const taken = new Set([
+            ...RESERVED_KEYS,
+            ...await db(TABLE).where('key', 'like', `${safeBase}%`).pluck('key')
+        ]);
         if (!taken.has(safeBase)) {
             return safeBase;
         }
@@ -148,8 +274,8 @@ export class CustomFieldDefinitionsService {
      * allow it in the SQLite test/dev suites. `exceptKey` lets a field keep its
      * own name on an unrelated edit.
      */
-    private async assertNameAvailable(name: string, exceptKey?: string): Promise<void> {
-        const query = this.knex(TABLE).whereRaw('LOWER(name) = ?', [name.toLowerCase()]);
+    private async assertNameAvailable(db: Knex, name: string, exceptKey?: string): Promise<void> {
+        const query = db(TABLE).whereRaw('LOWER(name) = ?', [name.toLowerCase()]);
         if (exceptKey) {
             query.whereNot('key', exceptKey);
         }
@@ -181,7 +307,7 @@ export class CustomFieldDefinitionsService {
         // Only write (and log a rename) when the name actually changes, so
         // re-saving an unchanged field is a no-op rather than a spurious edit.
         if (patch.name !== undefined && patch.name !== existing.name) {
-            await this.assertNameAvailable(patch.name, key);
+            await this.assertNameAvailable(this.knex, patch.name, key);
             try {
                 await this.knex(TABLE)
                     .where('key', key)
@@ -192,7 +318,7 @@ export class CustomFieldDefinitionsService {
                 }
                 throw err;
             }
-            await this.recordAction({context, verb: 'rename', subject: key, details: {primary_name: patch.name, previous_name: existing.name}});
+            await this.recordAction({context, verb: 'rename', subject: existing.id, details: {primary_name: patch.name, key, previous_name: existing.name}});
         }
 
         // A status change is the archive/restore transition. Only write (and log)
@@ -202,7 +328,7 @@ export class CustomFieldDefinitionsService {
                 .where('key', key)
                 .update({status: patch.status, updated_at: new Date()});
             const verb = patch.status === FIELD_STATUS.archived ? 'archive' : 'restore';
-            await this.recordAction({context, verb, subject: key, details: {primary_name: patch.name ?? existing.name}});
+            await this.recordAction({context, verb, subject: existing.id, details: {primary_name: patch.name ?? existing.name, key}});
         }
 
         return this.read(key);
@@ -224,8 +350,27 @@ export class CustomFieldDefinitionsService {
             throw new errors.ValidationError({message: 'Only archived custom fields can be deleted. Archive the field first.'});
         }
         await this.knex(TABLE).where('key', key).del();
-        await this.recordAction({context, verb: 'delete', subject: key, details: {primary_name: field.name}});
+        await this.recordAction({context, verb: 'delete', subject: field.id, details: {primary_name: field.name, key}});
+    }
+}
+
+// The field a zod issue points at. Create validates an array, so an issue's path
+// is prefixed with the item's index (`[0, 'name']`); `property` names the field
+// that is wrong, so the numeric prefix is dropped. Which item it was is reported
+// separately by batchContext, keeping `property` the bare field name a client can
+// map straight onto its form input.
+function propertyOf(path: PropertyKey[]): string | undefined {
+    return path.find(segment => typeof segment === 'string');
+}
+
+// Which definition of a batch an error belongs to. Only set when the request
+// carried more than one: a lone definition needs no pointer, and every client
+// today sends exactly one, so this stays absent on the common path.
+function batchContext(index: PropertyKey | undefined, requestedCount: number): string | undefined {
+    if (requestedCount <= 1 || typeof index !== 'number') {
+        return undefined;
     }
+    return `Custom field ${index + 1} of ${requestedCount}.`;
 }
 
 function isUniqueConstraintViolation(error: unknown): boolean {

package/core/server/services/members-custom-fields/index.js

@@ -5,6 +5,7 @@ exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
 const actions_1 = require("./actions");
+const config_1 = require("./config");
 function init() {
     // The two are constructed together below, so checking both keeps the "both or
     // neither" invariant explicit rather than trusting one to stand in for the pair.
@@ -14,8 +15,20 @@ function init() {
     const { knex } = require('../../data/db');
     const models = require('../../models');
     const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordCustomFieldAction)({ Action: models.Action, context, verb, subject, details });
-    exports.definitions = new definitions_service_1.CustomFieldDefinitionsService({ knex, recordAction });
+    // Resolved here, not in the service: reading config is this module's job, and
+    // the service is handed a number. A getter rather than a value because the
+    // ceiling is an operator setting that can change between requests, and a Ghost
+    // container holds no state across them.
+    const config = require('../../../shared/config');
+    exports.definitions = new definitions_service_1.CustomFieldDefinitionsService({
+        knex,
+        recordAction,
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions'))
+    });
     // The values service reads the field definitions straight from the table, so
-    // it needs only knex — no handle on the definitions service.
-    exports.values = new values_service_1.CustomFieldValuesService({ knex });
+    // it needs knex and the same ceiling — no handle on the definitions service.
+    exports.values = new values_service_1.CustomFieldValuesService({
+        knex,
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions'))
+    });
 }

package/core/server/services/members-custom-fields/index.ts

@@ -1,6 +1,7 @@
 import {CustomFieldDefinitionsService} from './definitions-service';
 import {CustomFieldValuesService} from './values-service';
 import {recordCustomFieldAction, type RecordCustomFieldAction} from './actions';
+import {resolveMaxDefinitions} from './config';
 
 export type {CustomField} from './models';
 export type {RequestContext} from './actions';
@@ -29,8 +30,21 @@ export function init(): void {
     const recordAction: RecordCustomFieldAction = ({context, verb, subject, details}) =>
         recordCustomFieldAction({Action: models.Action, context, verb, subject, details});
 
-    definitions = new CustomFieldDefinitionsService({knex, recordAction});
+    // Resolved here, not in the service: reading config is this module's job, and
+    // the service is handed a number. A getter rather than a value because the
+    // ceiling is an operator setting that can change between requests, and a Ghost
+    // container holds no state across them.
+    const config = require('../../../shared/config');
+
+    definitions = new CustomFieldDefinitionsService({
+        knex,
+        recordAction,
+        getMaxDefinitions: () => resolveMaxDefinitions(config.get('members:customFields:maxDefinitions'))
+    });
     // The values service reads the field definitions straight from the table, so
-    // it needs only knex — no handle on the definitions service.
-    values = new CustomFieldValuesService({knex});
+    // it needs knex and the same ceiling — no handle on the definitions service.
+    values = new CustomFieldValuesService({
+        knex,
+        getMaxDefinitions: () => resolveMaxDefinitions(config.get('members:customFields:maxDefinitions'))
+    });
 }