ghost 6.54.0 → 6.55.0

package/core/server/models/user.js

@@ -6,7 +6,6 @@ const limitService = require('../services/limits');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const security = require('@tryghost/security');
-const {pipeline} = require('@tryghost/promise');
 const validatePassword = require('../lib/validate-password');
 const permissions = require('../services/permissions');
 const urlUtils = require('../../shared/url-utils').default;
@@ -572,91 +571,68 @@ User = ghostBookshelf.Model.extend({
      * @extends ghostBookshelf.Model.edit to handle returning the full object
      * **See:** [ghostBookshelf.Model.edit](base.js.html#edit)
      */
-    edit: function edit(data, unfilteredOptions) {
+    edit: async function edit(data, unfilteredOptions) {
         const options = this.filterOptions(unfilteredOptions, 'edit');
         const self = this;
-        const ops = [];
 
         if (data.roles && data.roles.length > 1) {
-            return Promise.reject(
-                new errors.ValidationError({
-                    message: tpl(messages.onlyOneRolePerUserSupported)
-                })
-            );
+            throw new errors.ValidationError({
+                message: tpl(messages.onlyOneRolePerUserSupported)
+            });
         }
 
         if (data.email) {
-            ops.push(function checkForDuplicateEmail() {
-                return self.getByEmail(data.email, options).then(function then(user) {
-                    if (user && user.id !== options.id) {
-                        return Promise.reject(new errors.ValidationError({
-                            message: tpl(messages.userUpdateError.emailIsAlreadyInUse)
-                        }));
-                    }
+            const existingUser = await self.getByEmail(data.email, options);
+            if (existingUser && existingUser.id !== options.id) {
+                throw new errors.ValidationError({
+                    message: tpl(messages.userUpdateError.emailIsAlreadyInUse)
                 });
-            });
+            }
         }
 
-        ops.push(function update() {
-            return ghostBookshelf.Model.edit.call(self, data, options).then(async (user) => {
-                let roleId;
+        const user = await ghostBookshelf.Model.edit.call(self, data, options);
 
-                if (!data.roles || !data.roles.length) {
-                    return user;
-                }
-
-                roleId = data.roles[0].id || data.roles[0];
-
-                return user.roles().fetch().then((roles) => {
-                    // return if the role is already assigned
-                    if (roles.models[0].id === roleId) {
-                        return;
-                    }
+        if (!data.roles || !data.roles.length) {
+            return user;
+        }
 
-                    if (ASSIGNABLE_ROLES.includes(roleId)) {
-                        // return if the role is already assigned
-                        if (roles.models[0].get('name') === roleId) {
-                            return;
-                        }
+        const roleId = data.roles[0].id || data.roles[0];
+        const roles = await user.roles().fetch();
+        let roleToAssign;
 
-                        return ghostBookshelf.model('Role').findOne({
-                            name: roleId
-                        });
-                    } else if (ObjectId.isValid(roleId)){
-                        return ghostBookshelf.model('Role').findOne({
-                            id: roleId
-                        });
-                    } else {
-                        return Promise.reject(
-                            new errors.ValidationError({
-                                message: tpl(messages.invalidRoleValue.message),
-                                context: tpl(messages.invalidRoleValue.context),
-                                help: tpl(messages.invalidRoleValue.help)
-                            })
-                        );
-                    }
-                }).then((roleToAssign) => {
-                    if (roleToAssign && roleToAssign.get('name') === 'Owner') {
-                        return Promise.reject(
-                            new errors.ValidationError({
-                                message: tpl(messages.methodDoesNotSupportOwnerRole)
-                            })
-                        );
-                    } else if (roleToAssign) {
-                        // assign all other roles
-                        return user.roles().updatePivot({role_id: roleToAssign.id});
-                    }
-                }).then(() => {
-                    options.status = 'all';
-                    return self.findOne({id: user.id}, options);
-                }).then((model) => {
-                    model._changed = user._changed;
-                    return model;
+        if (roles.models[0].id !== roleId) {
+            if (ASSIGNABLE_ROLES.includes(roleId)) {
+                if (roles.models[0].get('name') !== roleId) {
+                    roleToAssign = await ghostBookshelf.model('Role').findOne({
+                        name: roleId
+                    });
+                }
+            } else if (ObjectId.isValid(roleId)) {
+                roleToAssign = await ghostBookshelf.model('Role').findOne({
+                    id: roleId
                 });
+            } else {
+                throw new errors.ValidationError({
+                    message: tpl(messages.invalidRoleValue.message),
+                    context: tpl(messages.invalidRoleValue.context),
+                    help: tpl(messages.invalidRoleValue.help)
+                });
+            }
+        }
+
+        if (roleToAssign && roleToAssign.get('name') === 'Owner') {
+            throw new errors.ValidationError({
+                message: tpl(messages.methodDoesNotSupportOwnerRole)
             });
-        });
+        } else if (roleToAssign) {
+            // assign all other roles
+            await user.roles().updatePivot({role_id: roleToAssign.id});
+        }
 
-        return pipeline(ops);
+        options.status = 'all';
+        const model = await self.findOne({id: user.id}, options);
+        model._changed = user._changed;
+        return model;
     },
 
     /**

package/core/server/services/auth/session/session-service.js

@@ -208,7 +208,34 @@ module.exports = function createSessionService({
      * @returns {Promise<void>}
      */
     async function createSessionForUser(req, res, user) {
-        const session = await getSession(req, res);
+        const previousSession = await getSession(req, res);
+
+        // Carried over to the new session so verification state survives login
+        const {
+            user_id: previousUserId,
+            verified: previousVerified,
+            auth_code_challenge: previousAuthCodeChallenge,
+            auth_code_generated_at: previousAuthCodeGeneratedAt
+        } = previousSession;
+
+        // Ensure a new session is always created
+        await new Promise((resolve, reject) => {
+            req.session.regenerate((err) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                resolve();
+            });
+        });
+
+        const session = req.session;
+        session.user_id = previousUserId;
+        // A different user doesn't inherit the previous user's verification
+        session.verified = previousUserId && previousUserId !== user.id ? undefined : previousVerified;
+        session.auth_code_challenge = previousAuthCodeChallenge;
+        session.auth_code_generated_at = previousAuthCodeGeneratedAt;
+
         const origin = getOriginOfRequest(req);
         await assignUserToSession({
             session,

package/core/server/services/automations/automations-api.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.browse = browse;
 exports.read = read;
+exports.browseActionLinks = browseActionLinks;
 exports.edit = edit;
 exports.requestPoll = requestPoll;
 exports.trigger = trigger;
@@ -15,6 +16,7 @@ exports.retryStep = retryStep;
 exports.recordEmailSent = recordEmailSent;
 exports.getAutomatedEmailRecipientsByMailgunIds = getAutomatedEmailRecipientsByMailgunIds;
 exports.trackEmailDeliveredAndOpened = trackEmailDeliveredAndOpened;
+exports.trackEmailClicked = trackEmailClicked;
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
@@ -30,6 +32,7 @@ const StartAutomationsPollEvent = require('./events/start-automations-poll-event
 const MAX_AUTOMATION_ACTIONS = 20;
 const messages = {
     automationNotFound: 'Automation not found.',
+    automationActionNotFound: 'Automation action not found.',
     invalidAutomationPayload: 'Automation edit payload must include status, actions, and edges.',
     invalidAutomationStatus: 'Automation status must be one of: active, inactive.',
     duplicateAutomationActionIdentity: 'Automation action identifiers must be unique.',
@@ -47,8 +50,8 @@ const waitActionSchema = zod_1.z.object({
     type: zod_1.z.literal('wait'),
     data: zod_1.z.object({
         wait_hours: zod_1.z.number().int().positive()
-    }).strict()
-}).strict();
+    })
+});
 const sendEmailActionSchema = zod_1.z.object({
     id: objectIdSchema,
     type: zod_1.z.literal('send_email'),
@@ -56,12 +59,12 @@ const sendEmailActionSchema = zod_1.z.object({
         email_subject: zod_1.z.string(),
         email_lexical: zod_1.z.string(),
         email_design_setting_id: zod_1.z.string().min(1)
-    }).strict()
-}).strict();
+    })
+});
 const edgeSchema = zod_1.z.object({
     source_action_id: objectIdSchema,
     target_action_id: objectIdSchema
-}).strict();
+});
 const editAutomationDataSchema = zod_1.z.object({
     status: zod_1.z.enum(['active', 'inactive']),
     actions: zod_1.z.array(zod_1.z.discriminatedUnion('type', [
@@ -69,7 +72,7 @@ const editAutomationDataSchema = zod_1.z.object({
         sendEmailActionSchema
     ])).min(1).max(MAX_AUTOMATION_ACTIONS),
     edges: zod_1.z.array(edgeSchema)
-}).strict();
+});
 const repository = (0, database_automations_repository_1.createDatabaseAutomationsRepository)({
     knex,
     fakeWaitHoursMultiplier: (0, fake_wait_hours_multiplier_1.parseFakeWaitHoursMultiplier)(config.get('automations:fakeWaitHoursMultiplier'))
@@ -86,6 +89,15 @@ async function read(automationId) {
     }
     return automation;
 }
+async function browseActionLinks(automationId, actionId) {
+    const links = await repository.getAutomationActionLinks(automationId, actionId);
+    if (!links) {
+        throw new errors_1.default.NotFoundError({
+            message: (0, tpl_1.default)(messages.automationActionNotFound)
+        });
+    }
+    return links;
+}
 async function edit(automationId, data) {
     const parsedData = await validateEditData(data);
     const automation = await repository.edit(automationId, parsedData);
@@ -311,3 +323,6 @@ async function getAutomatedEmailRecipientsByMailgunIds(...args) {
 async function trackEmailDeliveredAndOpened(...args) {
     return await repository.trackEmailDeliveredAndOpened(...args);
 }
+async function trackEmailClicked(...args) {
+    await repository.trackEmailClicked(...args);
+}

package/core/server/services/automations/automations-api.ts

@@ -20,6 +20,7 @@ const MAX_AUTOMATION_ACTIONS = 20;
 
 const messages = {
     automationNotFound: 'Automation not found.',
+    automationActionNotFound: 'Automation action not found.',
     invalidAutomationPayload: 'Automation edit payload must include status, actions, and edges.',
     invalidAutomationStatus: 'Automation status must be one of: active, inactive.',
     duplicateAutomationActionIdentity: 'Automation action identifiers must be unique.',
@@ -39,8 +40,8 @@ const waitActionSchema = z.object({
     type: z.literal('wait'),
     data: z.object({
         wait_hours: z.number().int().positive()
-    }).strict()
-}).strict();
+    })
+});
 
 const sendEmailActionSchema = z.object({
     id: objectIdSchema,
@@ -49,13 +50,13 @@ const sendEmailActionSchema = z.object({
         email_subject: z.string(),
         email_lexical: z.string(),
         email_design_setting_id: z.string().min(1)
-    }).strict()
-}).strict();
+    })
+});
 
 const edgeSchema = z.object({
     source_action_id: objectIdSchema,
     target_action_id: objectIdSchema
-}).strict();
+});
 
 const editAutomationDataSchema = z.object({
     status: z.enum(['active', 'inactive']),
@@ -64,7 +65,7 @@ const editAutomationDataSchema = z.object({
         sendEmailActionSchema
     ])).min(1).max(MAX_AUTOMATION_ACTIONS),
     edges: z.array(edgeSchema)
-}).strict();
+});
 
 const repository = createDatabaseAutomationsRepository({
     knex,
@@ -87,6 +88,18 @@ export async function read(automationId: string) {
     return automation;
 }
 
+export async function browseActionLinks(automationId: string, actionId: string) {
+    const links = await repository.getAutomationActionLinks(automationId, actionId);
+
+    if (!links) {
+        throw new errors.NotFoundError({
+            message: tpl(messages.automationActionNotFound)
+        });
+    }
+
+    return links;
+}
+
 export async function edit(automationId: string, data: unknown) {
     const parsedData = await validateEditData(data);
 
@@ -375,3 +388,9 @@ export async function trackEmailDeliveredAndOpened(
 ) {
     return await repository.trackEmailDeliveredAndOpened(...args);
 }
+
+export async function trackEmailClicked(
+    ...args: Parameters<AutomationsRepository['trackEmailClicked']>
+) {
+    await repository.trackEmailClicked(...args);
+}

package/core/server/services/automations/automations-repository.ts

@@ -1,4 +1,5 @@
 import type {ReadonlyDeep} from 'type-fest';
+import type {Knex} from 'knex';
 
 export interface Pagination {
     page: number;
@@ -25,12 +26,18 @@ export interface WaitAction {
 }
 
 export interface AutomationEmailStats {
+    email_clicked_count: number;
     email_sent_count: number;
     email_opened_count: number;
     opened_rate: number | null;
     clicked_rate: number | null;
 }
 
+export interface AutomationActionLink {
+    url: string;
+    clicked_count: number;
+}
+
 export interface SendEmailAction {
     id: string;
     type: 'send_email';
@@ -130,6 +137,7 @@ export type AutomationStepTerminalStatus =
 export interface AutomationsRepository {
     browse(): Promise<Page<AutomationSummary>>;
     getById(id: string): Promise<Automation | null>;
+    getAutomationActionLinks(automationId: string, actionId: string): Promise<AutomationActionLink[] | null>;
     edit(id: string, data: EditAutomationData): Promise<Automation | null>;
     trigger(options: {
         memberEmail: string;
@@ -194,4 +202,15 @@ export interface AutomationsRepository {
     trackEmailDeliveredAndOpened(
         eventsByAutomatedEmailRecipientId: ReadonlyDeep<Map<string, AutomatedEmailEvents>>
     ): Promise<void>;
+    /**
+     * Track the first click for an automated email recipient.
+     *
+     */
+    trackEmailClicked(options: {
+        automationActionRevisionId: string;
+        memberId: string;
+        clickedAt: Readonly<Date>;
+    }, transactionOptions?: {
+        transacting?: Knex.Transaction;
+    }): Promise<void>;
 }