ghost 6.54.1 → 6.56.0

package/core/frontend/services/routing/parent-router.js

@@ -13,6 +13,7 @@ const express = require('../../../shared/express');
 const _ = require('lodash');
 const url = require('url');
 const security = require('@tryghost/security');
+const {resolveResourceRead} = require('./api-adapter');
 const urlUtils = require('../../../shared/url-utils').default;
 const registry = require('./registry');
 
@@ -197,6 +198,11 @@ class ParentRouter {
 
     /**
      * @description Figure out if the router has a redirect enabled.
+     *
+     * A route claims a resource by reading it: `data: tag.bacon` on this router
+     * means /tag/bacon/ should redirect here from wherever else it lives. Only
+     * `read` entries claim a slug, and an entry can opt out with `redirect: false`.
+     *
      * @param {string} routerType
      * @param {string} slug
      * @returns {boolean}
@@ -204,14 +210,21 @@ class ParentRouter {
     isRedirectEnabled(routerType, slug) {
         debug('isRedirectEnabled', this.name, this.route && this.route.value, routerType, slug);
 
-        if (!this.data || !Object.keys(this.data.router)) {
+        if (!this.data) {
             return false;
         }
 
-        return _.find(this.data.router, function (entries, type) {
-            if (routerType === type) {
-                return _.find(entries, {redirect: true, slug: slug});
+        // Top-level shorthand (`data: tag.bacon`) is a single unnamed entry.
+        const entries = typeof this.data === 'string' ? [this.data] : Object.values(this.data);
+
+        return entries.some((entry) => {
+            if (typeof entry !== 'string' && entry.redirect === false) {
+                return false;
             }
+
+            const read = resolveResourceRead(entry);
+
+            return !!read && read.resource === routerType && read.slug === slug;
         });
     }
 

package/core/frontend/services/routing/permalink-adapter.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toExpressNotation = toExpressNotation;
+exports.toDomainNotation = toDomainNotation;
+/**
+ * Convert a domain-model permalink into Express / URL-service notation.
+ *
+ * @example toExpressNotation('/{slug}/')               // => '/:slug/'
+ * @example toExpressNotation('/{primary_tag}/{slug}/') // => '/:primary_tag/:slug/'
+ * @example toExpressNotation('/:slug/')                // => '/:slug/' (idempotent)
+ */
+function toExpressNotation(permalink) {
+    return permalink.replace(/{(\w+)}/g, ':$1');
+}
+/**
+ * Convert an Express / URL-service permalink back into domain-model notation.
+ * Will be used on the download path when serialising the canonical shape back
+ * to YAML — no production caller yet.
+ *
+ * @example toDomainNotation('/:slug/')               // => '/{slug}/'
+ * @example toDomainNotation('/:primary_tag/:slug/')  // => '/{primary_tag}/{slug}/'
+ * @example toDomainNotation('/{slug}/')              // => '/{slug}/' (idempotent)
+ */
+function toDomainNotation(permalink) {
+    return permalink.replace(/:(\w+)/g, '{$1}');
+}

package/core/frontend/services/routing/permalink-adapter.ts

@@ -0,0 +1,23 @@
+/**
+ * Convert a domain-model permalink into Express / URL-service notation.
+ *
+ * @example toExpressNotation('/{slug}/')               // => '/:slug/'
+ * @example toExpressNotation('/{primary_tag}/{slug}/') // => '/:primary_tag/:slug/'
+ * @example toExpressNotation('/:slug/')                // => '/:slug/' (idempotent)
+ */
+export function toExpressNotation(permalink: string): string {
+    return permalink.replace(/{(\w+)}/g, ':$1');
+}
+
+/**
+ * Convert an Express / URL-service permalink back into domain-model notation.
+ * Will be used on the download path when serialising the canonical shape back
+ * to YAML — no production caller yet.
+ *
+ * @example toDomainNotation('/:slug/')               // => '/{slug}/'
+ * @example toDomainNotation('/:primary_tag/:slug/')  // => '/{primary_tag}/{slug}/'
+ * @example toDomainNotation('/{slug}/')              // => '/{slug}/' (idempotent)
+ */
+export function toDomainNotation(permalink: string): string {
+    return permalink.replace(/:(\w+)/g, '{$1}');
+}

package/core/frontend/services/routing/registry.js

@@ -1,58 +1,82 @@
 const _ = require('lodash');
-let routes = [];
-let routers = {};
 
 /**
- * @description The router registry is helpful for debugging purposes and let's you search existing routes and routers.
+ * Every registered router is a Ghost router — `ParentRouter` itself (the site
+ * and apps routers) or one of its subclasses (Collection, StaticRoutes,
+ * Taxonomy, StaticPages, Preview, Email, Unsubscribe). They wrap an Express
+ * router, reachable via `.router()`, but are not one themselves: the registry's
+ * own lookups read Ghost-side members (`.name`, `.routerName`, `.reset()`,
+ * `.getRssUrl()`) that an Express router does not have.
+ *
+ * Type-only import — no runtime require, so this does not close a cycle with
+ * `parent-router.js`, which requires this module.
+ *
+ * @typedef {import('./parent-router')} ParentRouter
  */
-module.exports = {
+
+/**
+ * @description The router registry is helpful for debugging purposes and lets you search existing routes and routers.
+ *
+ * Exported as a single shared instance so that every consumer
+ * (`routing/index.js`, `parent-router.js`) operates on the same registry, the
+ * same way the previous module-level state did — just held on an instance
+ * rather than in module-scoped `let` variables.
+ */
+class Registry {
+    constructor() {
+        /** @type {Array<{route: string, from: string}>} */
+        this.routes = [];
+        /** @type {Object<string, ParentRouter>} */
+        this.routers = {};
+    }
+
     /**
-     * @description Get's called if you register a url pattern in express.
+     * @description Gets called if you register a url pattern in express.
      * @param {string} routerName
      * @param {string} route
      */
     setRoute(routerName, route) {
-        routes.push({route: route, from: routerName});
-    },
+        this.routes.push({route: route, from: routerName});
+    }
 
     /**
-     * @description Get's called if you register a router in express.
+     * @description Gets called if you register a router in express.
      * @param {string} name
-     * @param {import('express').Router} router
+     * @param {ParentRouter} router
      */
     setRouter(name, router) {
-        routers[name] = router;
-    },
+        this.routers[name] = router;
+    }
 
     /**
      * @description Get all registered routes.
-     * @returns {Array}
+     * @returns {Array<{route: string, from: string}>}
      */
     getAllRoutes() {
-        return _.cloneDeep(routes);
-    },
+        return _.cloneDeep(this.routes);
+    }
 
     /**
      * @description Get router by name.
      * @param {string} name
-     * @returns {import('express').Router}
+     * @returns {ParentRouter|undefined}
      */
     getRouter(name) {
-        return routers[name];
-    },
+        return this.routers[name];
+    }
 
     /**
-     * Gets a router by it's internal router name
+     * Gets a router by its internal router name
      * @param {string} name internal router name
-     * @returns {import('express').Router}
+     * @returns {ParentRouter|undefined}
      */
     getRouterByName(name) {
-        for (let routerKey in routers) {
-            if (routers[routerKey].name === name) {
-                return routers[routerKey];
+        for (let routerKey in this.routers) {
+            if (this.routers[routerKey].name === name) {
+                return this.routers[routerKey];
             }
         }
-    },
+    }
 
     /**
      *
@@ -77,7 +101,7 @@ module.exports = {
     getRssUrl(options) {
         let rssUrl = null;
 
-        const collectionIndexRouter = _.find(routers, {name: 'CollectionRouter', routerName: 'index'});
+        const collectionIndexRouter = _.find(this.routers, {name: 'CollectionRouter', routerName: 'index'});
 
         if (collectionIndexRouter) {
             rssUrl = collectionIndexRouter.getRssUrl(options);
@@ -88,7 +112,7 @@ module.exports = {
             }
         }
 
-        const collectionRouters = _.filter(routers, {name: 'CollectionRouter'});
+        const collectionRouters = _.filter(this.routers, {name: 'CollectionRouter'});
 
         if (collectionRouters && collectionRouters.length === 1) {
             rssUrl = collectionRouters[0].getRssUrl(options);
@@ -108,32 +132,34 @@ module.exports = {
         }
 
         return rssUrl;
-    },
+    }
 
     /**
      * @description Reset all routes.
      */
     resetAllRoutes() {
-        routes = [];
-    },
+        this.routes = [];
+    }
 
     /**
      * @description Reset all routers.
      */
     resetAllRouters() {
-        _.each(routers, (value) => {
+        _.each(this.routers, (value) => {
             if (value && typeof value.reset === 'function') {
                 value.reset();
             }
         });
 
-        routers = {};
-    },
+        this.routers = {};
+    }
 
     /**
      * @description Clear all routers (for testing).
      */
     clearAllRouters() {
-        routers = {};
+        this.routers = {};
     }
-};
+}
+
+module.exports = new Registry();

package/core/frontend/services/routing/router-manager.js

@@ -1,5 +1,4 @@
 const debug = require('@tryghost/debug')('frontend:routing');
-const _ = require('lodash');
 const StaticRoutesRouter = require('./static-routes-router');
 const StaticPagesRouter = require('./static-pages-router');
 const CollectionRouter = require('./collection-router');
@@ -91,10 +90,10 @@ class RouterManager {
      * 5. Static Pages: Weaker than collections, because we first try to find a post slug and fallback to lookup a static page.
      * 6. Internal Apps: Weakest
      *
-     * @param {object} routerSettings
+     * @param {RouteSettings} routeSettings
      */
-    start(routerSettings) {
-        debug('routing start', routerSettings);
+    start(routeSettings) {
+        debug('routing start', routeSettings);
         const RESOURCE_CONFIG = require(`./config`);
 
         const unsubscribeRouter = new UnsubscribeRouter();
@@ -111,30 +110,30 @@ class RouterManager {
         this.siteRouter.mountRouter(previewRouter.router());
         this.registry.setRouter('previewRouter', previewRouter);
 
-        _.each(routerSettings.routes, (value, key) => {
-            const staticRoutesRouter = new StaticRoutesRouter(key, value, this.routerCreated.bind(this));
+        for (const route of routeSettings.routes) {
+            const staticRoutesRouter = new StaticRoutesRouter(route.path, route, this.routerCreated.bind(this));
             this.siteRouter.mountRouter(staticRoutesRouter.router());
 
             this.registry.setRouter(staticRoutesRouter.identifier, staticRoutesRouter);
-        });
+        }
 
-        _.each(routerSettings.collections, (value, key) => {
-            const collectionRouter = new CollectionRouter(key, value, RESOURCE_CONFIG, this.routerCreated.bind(this));
+        for (const collection of routeSettings.collections) {
+            const collectionRouter = new CollectionRouter(collection.path, collection, RESOURCE_CONFIG, this.routerCreated.bind(this));
             this.siteRouter.mountRouter(collectionRouter.router());
             this.registry.setRouter(collectionRouter.identifier, collectionRouter);
-        });
+        }
 
         const staticPagesRouter = new StaticPagesRouter(RESOURCE_CONFIG, this.routerCreated.bind(this));
         this.siteRouter.mountRouter(staticPagesRouter.router());
 
         this.registry.setRouter('staticPagesRouter', staticPagesRouter);
 
-        _.each(routerSettings.taxonomies, (value, key) => {
-            const taxonomyRouter = new TaxonomyRouter(key, value, RESOURCE_CONFIG, this.routerCreated.bind(this));
+        for (const [key, permalink] of Object.entries(routeSettings.taxonomies)) {
+            const taxonomyRouter = new TaxonomyRouter(key, permalink, RESOURCE_CONFIG, this.routerCreated.bind(this));
             this.siteRouter.mountRouter(taxonomyRouter.router());
 
             this.registry.setRouter(taxonomyRouter.identifier, taxonomyRouter);
-        });
+        }
 
         const appRouter = new ParentRouter('AppsRouter');
         this.siteRouter.mountRouter(appRouter.router());
@@ -181,15 +180,12 @@ module.exports = RouterManager;
 
 /**
  * @typedef {Object} RouterConfig
- * @property {RouteSettings} [routeSettings] - JSON config representing routes
+ * @property {RouteSettings} [routeSettings] - parsed route settings domain model
  * @property {URLServiceFacade} urlService - resource-based URL service facade
  */
 
 /**
- * @typedef {Object} RouteSettings
- * @property {Object} routes
- * @property {Object} collections
- * @property {Object} taxonomies
+ * @typedef {import('@tryghost/adapter-base-route-settings').RouteSettings} RouteSettings
  */
 
 /**

package/core/frontend/services/routing/static-routes-router.js

@@ -15,7 +15,7 @@ class StaticRoutesRouter extends ParentRouter {
 
         this.route = {value: mainRoute};
         this.templates = object.templates || [];
-        this.data = object.data || {query: {}, router: {}};
+        this.data = object.data || {};
         this.routerName = mainRoute === '/' ? 'index' : mainRoute.replace(/\//g, '');
         this.routerCreated = routerCreated;
 
@@ -30,12 +30,12 @@ class StaticRoutesRouter extends ParentRouter {
             this.limit = object.limit;
             this.order = object.order;
 
-            this.controller = object.controller;
+            this.type = object.type;
 
             debug(this.route.value, this.templates, this.filter, this.data);
             this._registerChannelRoutes();
         } else {
-            this.contentType = object.content_type;
+            this.contentType = object.contentType;
             debug(this.route.value, this.templates);
             this._registerStaticRoute();
         }
@@ -56,11 +56,11 @@ class StaticRoutesRouter extends ParentRouter {
         }
 
         // REGISTER: channel route
-        this.mountRoute(this.route.value, controllers[this.controller]);
+        this.mountRoute(this.route.value, controllers[this.type]);
 
         // REGISTER: pagination
         this.router().param('page', middleware.pageParam);
-        this.mountRoute(urlUtils.urlJoin(this.route.value, 'page', ':page(\\d+)'), controllers[this.controller]);
+        this.mountRoute(urlUtils.urlJoin(this.route.value, 'page', ':page(\\d+)'), controllers[this.type]);
 
         this.routerCreated(this);
     }
@@ -74,13 +74,13 @@ class StaticRoutesRouter extends ParentRouter {
      */
     _prepareChannelContext(req, res, next) {
         res.routerOptions = {
-            type: this.controller,
+            type: this.type,
             name: this.routerName,
             context: [this.routerName],
             filter: this.filter,
             limit: this.limit,
             order: this.order,
-            data: this.data.query,
+            data: this.data,
             templates: this.templates
         };
 
@@ -117,7 +117,7 @@ class StaticRoutesRouter extends ParentRouter {
                     message: `Missing template ${res.routerOptions.templates.map(x => `${x}.hbs`).join(', ')} for route "${req.originalUrl}".`
                 });
             },
-            data: this.data.query,
+            data: this.data,
             context: [this.routerName],
             contentType: this.contentType
         };
@@ -131,11 +131,9 @@ class StaticRoutesRouter extends ParentRouter {
      * @returns {boolean}
      */
     isChannel(object) {
-        if (object && object.controller && object.controller === 'channel') {
-            return true;
-        }
-
-        return this.controller === 'channel';
+        // parseRouteSettings always sets `type` ('channel' | 'template') on
+        // every route, so a channel is simply `type === 'channel'`.
+        return object?.type === 'channel';
     }
 }
 

package/core/frontend/services/routing/taxonomy-router.js

@@ -5,6 +5,7 @@ const RSSRouter = require('./rss-router');
 const urlUtils = require('../../../shared/url-utils').default;
 const controllers = require('./controllers');
 const middleware = require('./middleware');
+const {toExpressNotation} = require('./permalink-adapter');
 
 /**
  * @description Taxonomies are groupings of posts based on a common relation.
@@ -17,8 +18,9 @@ class TaxonomyRouter extends ParentRouter {
         this.taxonomyKey = key;
         this.RESOURCE_CONFIG = RESOURCE_CONFIG;
 
+        // convert domain `{slug}` -> Express/URL-service `:slug` at this boundary
         this.permalinks = {
-            value: permalinks
+            value: toExpressNotation(permalinks)
         };
 
         this.permalinks.getValue = () => {
@@ -74,7 +76,9 @@ class TaxonomyRouter extends ParentRouter {
             type: 'channel',
             name: this.taxonomyKey,
             permalinks: this.permalinks.getValue(),
-            data: {[this.taxonomyKey]: this.RESOURCE_CONFIG.QUERY[this.taxonomyKey]},
+            // Route data in domain form — the API adapter resolves it to a
+            // controller call, and fetch-data fills `%s` in from the request.
+            data: {[this.taxonomyKey]: {type: 'read', resource: this.getResourceType(), slug: '%s'}},
             filter: this.RESOURCE_CONFIG.TAXONOMIES[this.taxonomyKey].filter,
             resourceType: this.getResourceType(),
             context: [this.taxonomyKey],

package/core/server/api/endpoints/automation-action-links.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const automationsApi = __importStar(require("../../services/automations/automations-api"));
+const controller = {
+    docName: 'automation_action_links',
+    browse: {
+        headers: {
+            cacheInvalidate: false
+        },
+        options: [
+            'automation_id',
+            'action_id'
+        ],
+        validation: {
+            options: {
+                automation_id: {
+                    required: true
+                },
+                action_id: {
+                    required: true
+                }
+            }
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'read'
+        },
+        async query(frame) {
+            return {
+                data: await automationsApi.browseActionLinks(frame.options.automation_id, frame.options.action_id)
+            };
+        }
+    }
+};
+module.exports = controller;

package/core/server/api/endpoints/automation-action-links.ts

@@ -0,0 +1,46 @@
+import * as automationsApi from '../../services/automations/automations-api';
+
+type BrowseFrame = {
+    options: {
+        automation_id: string;
+        action_id: string;
+    };
+};
+
+const controller = {
+    docName: 'automation_action_links',
+
+    browse: {
+        headers: {
+            cacheInvalidate: false
+        },
+        options: [
+            'automation_id',
+            'action_id'
+        ],
+        validation: {
+            options: {
+                automation_id: {
+                    required: true
+                },
+                action_id: {
+                    required: true
+                }
+            }
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'read'
+        },
+        async query(frame: BrowseFrame) {
+            return {
+                data: await automationsApi.browseActionLinks(
+                    frame.options.automation_id,
+                    frame.options.action_id
+                )
+            };
+        }
+    }
+};
+
+module.exports = controller;

package/core/server/api/endpoints/index.js

@@ -11,6 +11,10 @@ module.exports = {
         return apiFramework.pipeline(require('./automations'), localUtils);
     },
 
+    get automationActionLinks() {
+        return apiFramework.pipeline(require('./automation-action-links'), localUtils);
+    },
+
     get automationEmailPreviews() {
         return apiFramework.pipeline(require('./automation-email-previews'), localUtils);
     },

package/core/server/api/endpoints/settings.js

@@ -174,8 +174,6 @@ const controller = {
         async query(frame) {
             const content = await fs.readFile(frame.file.path, 'utf8');
             await routeSettings.api.upload(content);
-            const getRoutesHash = () => routeSettings.api.getCurrentHash();
-            await settingsService.syncRoutesHash(getRoutesHash);
         }
     },
 

package/core/server/api/endpoints/utils/serializers/output/utils/url.js

@@ -24,7 +24,17 @@ const forPost = (id, attrs, frame, type = 'posts') => {
         return attrs;
     }
 
-    attrs.url = urlService.facade.getUrlForResource({...attrs, id, type}, {absolute: true});
+    // Diagnostic only: hand the compare-mode URL service the producing api
+    // endpoint. The parity/thin-resource logs capture a caller stack, but it
+    // truncates at the async api-framework boundary and never names the
+    // endpoint; the api-framework Frame carries it, so pass it through. Omitted
+    // for non-api callers (mentions, email) whose frame has no endpoint fields.
+    const options = {absolute: true};
+    if (frame && (frame.docName || frame.method)) {
+        options.serializerContext = {apiType: frame.apiType, docName: frame.docName, method: frame.method};
+    }
+
+    attrs.url = urlService.facade.getUrlForResource({...attrs, id, type}, options);
 
     /**
      * CASE: admin api should serve preview urls

package/core/server/data/migrations/versions/6.55/2026-07-27-11-25-44-add-to-hash-to-redirects.js

@@ -0,0 +1,51 @@
+const logging = require('@tryghost/logging');
+const {combineNonTransactionalMigrations, createAddColumnMigration, createNonTransactionalMigration} = require('../../utils');
+const {addIndex, addUnique, dropIndex, dropUnique, getIndexes} = require('../../../schema/commands');
+
+const uniqueColumns = ['automation_action_revision_id', 'to_hash'];
+const leftoverIndexName = 'redirects_automation_action_revision_id_index';
+
+module.exports = combineNonTransactionalMigrations(
+    createAddColumnMigration('redirects', 'to_hash', {
+        type: 'binary',
+        maxlength: 32,
+        nullable: true
+    }, {algorithm: 'auto'}),
+    createNonTransactionalMigration(
+        async function up(knex) {
+            await addUnique('redirects', uniqueColumns, knex);
+
+            // A previous down() leaves a standalone index behind (see below).
+            // InnoDB drops the index it created for the foreign key itself once
+            // the composite unique can serve the constraint, but not one we
+            // created, so drop it here to keep a rolled-back-and-remigrated
+            // database in the same shape as every other one.
+            const indexes = await getIndexes('redirects', knex);
+
+            if (indexes.includes(leftoverIndexName)) {
+                await dropIndex('redirects', ['automation_action_revision_id'], knex);
+            }
+        },
+        async function down(knex) {
+            try {
+                await dropUnique('redirects', uniqueColumns, knex);
+            } catch (err) {
+                // The composite unique ends up as the only index covering the
+                // automation_action_revision_id FK: fresh installs create it
+                // that way, and on upgrades InnoDB drops the FK's own index
+                // once the composite can serve the constraint. MySQL won't
+                // drop the last index a foreign key depends on, so re-add a
+                // single-column one when it objects.
+                if (err.code === 'ER_DROP_INDEX_FK') {
+                    logging.warn('Cannot drop unique constraint over redirects(automation_action_revision_id, to_hash) while it backs the foreign key, re-adding index for automation_action_revision_id');
+
+                    await addIndex('redirects', ['automation_action_revision_id'], knex);
+                    await dropUnique('redirects', uniqueColumns, knex);
+                    return;
+                }
+
+                throw err;
+            }
+        }
+    )
+);

package/core/server/data/migrations/versions/6.55/2026-07-28-12-08-00-remove-routes-hash-from-settings.js

@@ -0,0 +1,5 @@
+const {combineTransactionalMigrations, removeSetting} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    removeSetting('routes_hash')
+);