ghost 6.54.1 → 6.56.0

package/core/server/services/members-custom-fields/values-service.js

@@ -21,6 +21,21 @@ const MAX_KEY_LENGTH = 191;
 // validated by its own field type's schema, which isn't known until the key is
 // resolved to a definition.
 const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_KEY_LENGTH), zod_1.z.unknown());
+// JSON.parse as a total function. Anything unreadable — unparseable text, or the null
+// a nullable column can always return — reads as `undefined`, which no value schema
+// accepts. That way a corrupt blob is turned away by the same check that turns away a
+// well-formed one of the wrong shape, instead of needing a branch of its own.
+function decodeJson(raw) {
+    if (raw === null) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * The value half of member custom fields: reading and writing what a member holds
  * for each defined field. It belongs to the member aggregate — a value is data
@@ -137,8 +152,9 @@ class CustomFieldValuesService {
     /**
      * Resolve input into the writes it implies, rejecting anything invalid, and
      * writing nothing. Returned so a caller can validate before it commits to a
-     * change it would have to unwind (the member edit validates up front), then
-     * apply the same plan without re-resolving or re-validating.
+     * change it would have to unwind (the member edit and the importer both validate
+     * up front, before opening a transaction), then apply the same plan without
+     * re-resolving or re-validating.
      */
     async planWrite(input) {
         const values = this.parseValues(input);
@@ -187,25 +203,129 @@ class CustomFieldValuesService {
         }
         return writes;
     }
+    /**
+     * @private
+     * The composite values this member already holds for the fields in a plan,
+     * keyed by field id. Composites only: a scalar has nothing to merge into.
+     *
+     * Read through the caller's executor, never the base connection. On a
+     * single-connection pool a read off `this.knex` inside an open transaction
+     * waits for the connection that transaction is holding, and hangs.
+     *
+     * A blob that won't decode is left out, so the write replaces it rather than
+     * merging into something unreadable.
+     */
+    async storedComposites(trx, memberId, writes) {
+        const composites = new Map();
+        // Merging is only meaningful for a value with parts, which is a fact about the
+        // type's shape rather than the column it lands in. Asking the storage type
+        // instead would sweep in the first json-backed type that isn't a record — a
+        // multi-select held as a list, say — and log a decode failure for every row of
+        // an import, over a value that reads back perfectly well.
+        const fieldIds = writes
+            .filter(({ field, value }) => value !== undefined && (0, custom_field_types_1.subFieldsOf)(field.type) !== null)
+            .map(({ field }) => field.id);
+        if (fieldIds.length === 0) {
+            return composites;
+        }
+        const rows = await trx(VALUES_TABLE)
+            .where('member_id', memberId)
+            .whereIn('custom_field_id', fieldIds)
+            .whereNotNull('value_json')
+            .select('custom_field_id', 'value_json')
+            // Merging reads a value and writes it back, so the row has to stay still in
+            // between: without the lock a write committing after this read is overwritten
+            // by the sub-fields it just replaced. knex omits this on SQLite, which needs
+            // no lock — its pool is a single connection, so writes never overlap.
+            .forUpdate();
+        for (const row of rows) {
+            // The blob is the edge here: the columns come from a query written just
+            // above, but whatever an earlier write left in value_json is unknown until
+            // it is read back. Parsing it is what narrows the type, and it rejects the
+            // array, null or bare number the column could equally be holding.
+            const stored = schema_1.StoredCompositeValue.safeParse(decodeJson(row.value_json));
+            if (stored.success) {
+                composites.set(row.custom_field_id, stored.data);
+                continue;
+            }
+            logging_1.default.warn(`Replacing an unreadable custom field value rather than merging into it (member '${memberId}', field '${row.custom_field_id}').`);
+        }
+        return composites;
+    }
+    /**
+     * @private
+     * The stored sub-fields with the incoming ones written over them, re-checked
+     * against the field type before it is handed back.
+     *
+     * The re-check is what makes this safe to write without a second thought. Both
+     * halves were valid when they were written, but "valid" is a moving target: the
+     * stored half may predate a change to the type, so it can carry a sub-field the
+     * type has since dropped or a bound it has since tightened. Parsing the result
+     * strips what no longer belongs instead of faithfully persisting it on every
+     * import from here on.
+     *
+     * A merged value that won't parse falls back to the incoming value alone rather
+     * than failing. The row is trying to write something valid, and refusing it over
+     * data that was already in the database punishes the wrong write.
+     */
+    mergeComposite(field, existing, incoming) {
+        const merged = custom_field_types_1.FIELD_TYPES[field.type].value.safeParse({ ...existing, ...incoming });
+        if (merged.success) {
+            return merged.data;
+        }
+        logging_1.default.warn(`Replacing a custom field value that no longer validates rather than merging into it (field '${field.key}').`);
+        return incoming;
+    }
     /**
      * Apply a plan from `planWrite`.
      *
      * Merge, not replace: only the fields in the plan are touched, so a caller
-     * that doesn't know about a field can't erase it. The whole plan is applied in
-     * one transaction, so a mid-batch failure rolls the batch back.
+     * that doesn't know about a field can't erase it.
+     *
+     * `mergeComposites` extends that same rule from a field to a composite's
+     * sub-fields, because a sub-field is a field: a row writes the sub-fields it
+     * fills and leaves the rest alone, exactly as a blank `name` column leaves a
+     * member's name alone. The CSV import needs it — without it a file naming one
+     * address column would replace the whole address, clearing five sub-fields it
+     * never mentioned. The API does not merge: a PUT sends a whole address, so
+     * what it sends is what should be stored.
+     *
+     * The merge is asked for here rather than at plan time, where the caller's intent
+     * is otherwise expressed, because it cannot happen before a transaction is open:
+     * it reads the stored value and writes it back, and the row lock that keeps those
+     * two steps together only exists inside the transaction. `planWrite` runs before
+     * one is opened -- the importer plans a row, then opens a transaction per member --
+     * so a merge decided there would have to read outside the lock it depends on.
+     *
+     * Always transactional, so a mid-batch failure rolls the batch back. Passed an
+     * executor it joins that transaction -- the importer passes its per-member one, so a
+     * failed value write takes the member with it; passed nothing it opens its own.
      */
-    async applyWrite(memberId, writes) {
+    async applyWrite(memberId, writes, executor = this.knex, { mergeComposites = false } = {}) {
         if (writes.length === 0) {
             return;
         }
-        await this.knex.transaction(async (trx) => {
+        const apply = async (trx) => {
+            const stored = mergeComposites
+                ? await this.storedComposites(trx, memberId, writes)
+                : new Map();
             for (const { field, value } of writes) {
                 const target = { member_id: memberId, custom_field_id: field.id };
                 if (value === undefined) {
                     await trx(VALUES_TABLE).where(target).del();
                     continue;
                 }
-                const valueColumns = (0, storage_1.storageColumnsFor)(field.type, value);
+                // Both sides of the merge go through the same shape check, so it joins
+                // two objects the type system knows about rather than two assertions.
+                // The plan already validated `value` against its field type, so for a
+                // composite this parse cannot fail; a scalar simply doesn't match, and
+                // falls through to being written as it stands.
+                const existing = stored.get(field.id);
+                const incoming = schema_1.StoredCompositeValue.safeParse(value);
+                const merged = existing && incoming.success
+                    ? this.mergeComposite(field, existing, incoming.data)
+                    : value;
+                const valueColumns = (0, storage_1.storageColumnsFor)(field.type, merged);
                 await trx(VALUES_TABLE)
                     .insert({ id: new bson_objectid_1.default().toHexString(), ...target, ...valueColumns, created_at: new Date() })
                     // The unique index on (member_id, custom_field_id) is
@@ -213,7 +333,15 @@ class CustomFieldValuesService {
                     .onConflict(['member_id', 'custom_field_id'])
                     .merge({ ...valueColumns, updated_at: new Date() });
             }
-        });
+        };
+        // isTransaction is knex's marker for a transactor: join an existing transaction
+        // rather than nesting a savepoint under it, otherwise open one.
+        if (executor.isTransaction) {
+            await apply(executor);
+        }
+        else {
+            await executor.transaction(apply);
+        }
     }
 }
 exports.CustomFieldValuesService = CustomFieldValuesService;

package/core/server/services/members-custom-fields/values-service.ts

@@ -3,8 +3,8 @@ import errors from '@tryghost/errors';
 import logging from '@tryghost/logging';
 import type {Knex} from 'knex';
 import {z} from 'zod';
-import {FIELD_TYPES, type FieldType} from '@tryghost/custom-field-types';
-import {DbCustomFieldValueWithField, FIELD_STATUS} from './schema';
+import {FIELD_TYPES, subFieldsOf, type FieldType} from '@tryghost/custom-field-types';
+import {DbCustomFieldValueWithField, FIELD_STATUS, StoredCompositeValue} from './schema';
 import {activeFields} from './queries';
 import {storageCodecFor, storageColumnsFor} from './storage';
 
@@ -20,6 +20,21 @@ const MAX_KEY_LENGTH = 191;
 // resolved to a definition.
 const ValuesInput = z.record(z.string().max(MAX_KEY_LENGTH), z.unknown());
 
+// JSON.parse as a total function. Anything unreadable — unparseable text, or the null
+// a nullable column can always return — reads as `undefined`, which no value schema
+// accepts. That way a corrupt blob is turned away by the same check that turns away a
+// well-formed one of the wrong shape, instead of needing a branch of its own.
+function decodeJson(raw: string | null): unknown {
+    if (raw === null) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(raw);
+    } catch {
+        return undefined;
+    }
+}
+
 // The field facts the value path needs: the id to write the FK, the key to match
 // input against, the name for error messages, and the type to pick the validator
 // and storage column. All columns on members_custom_fields, so a value operation
@@ -164,8 +179,9 @@ export class CustomFieldValuesService {
     /**
      * Resolve input into the writes it implies, rejecting anything invalid, and
      * writing nothing. Returned so a caller can validate before it commits to a
-     * change it would have to unwind (the member edit validates up front), then
-     * apply the same plan without re-resolving or re-validating.
+     * change it would have to unwind (the member edit and the importer both validate
+     * up front, before opening a transaction), then apply the same plan without
+     * re-resolving or re-validating.
      */
     async planWrite(input: unknown): Promise<PlannedWrite[]> {
         const values = this.parseValues(input);
@@ -221,19 +237,126 @@ export class CustomFieldValuesService {
         return writes;
     }
 
+    /**
+     * @private
+     * The composite values this member already holds for the fields in a plan,
+     * keyed by field id. Composites only: a scalar has nothing to merge into.
+     *
+     * Read through the caller's executor, never the base connection. On a
+     * single-connection pool a read off `this.knex` inside an open transaction
+     * waits for the connection that transaction is holding, and hangs.
+     *
+     * A blob that won't decode is left out, so the write replaces it rather than
+     * merging into something unreadable.
+     */
+    private async storedComposites(trx: Knex, memberId: string, writes: PlannedWrite[]): Promise<Map<string, Record<string, unknown>>> {
+        const composites = new Map<string, Record<string, unknown>>();
+        // Merging is only meaningful for a value with parts, which is a fact about the
+        // type's shape rather than the column it lands in. Asking the storage type
+        // instead would sweep in the first json-backed type that isn't a record — a
+        // multi-select held as a list, say — and log a decode failure for every row of
+        // an import, over a value that reads back perfectly well.
+        const fieldIds = writes
+            .filter(({field, value}) => value !== undefined && subFieldsOf(field.type) !== null)
+            .map(({field}) => field.id);
+
+        if (fieldIds.length === 0) {
+            return composites;
+        }
+
+        const rows = await trx(VALUES_TABLE)
+            .where('member_id', memberId)
+            .whereIn('custom_field_id', fieldIds)
+            .whereNotNull('value_json')
+            .select('custom_field_id', 'value_json')
+            // Merging reads a value and writes it back, so the row has to stay still in
+            // between: without the lock a write committing after this read is overwritten
+            // by the sub-fields it just replaced. knex omits this on SQLite, which needs
+            // no lock — its pool is a single connection, so writes never overlap.
+            .forUpdate();
+
+        for (const row of rows) {
+            // The blob is the edge here: the columns come from a query written just
+            // above, but whatever an earlier write left in value_json is unknown until
+            // it is read back. Parsing it is what narrows the type, and it rejects the
+            // array, null or bare number the column could equally be holding.
+            const stored = StoredCompositeValue.safeParse(decodeJson(row.value_json));
+            if (stored.success) {
+                composites.set(row.custom_field_id, stored.data);
+                continue;
+            }
+            logging.warn(`Replacing an unreadable custom field value rather than merging into it (member '${memberId}', field '${row.custom_field_id}').`);
+        }
+
+        return composites;
+    }
+
+    /**
+     * @private
+     * The stored sub-fields with the incoming ones written over them, re-checked
+     * against the field type before it is handed back.
+     *
+     * The re-check is what makes this safe to write without a second thought. Both
+     * halves were valid when they were written, but "valid" is a moving target: the
+     * stored half may predate a change to the type, so it can carry a sub-field the
+     * type has since dropped or a bound it has since tightened. Parsing the result
+     * strips what no longer belongs instead of faithfully persisting it on every
+     * import from here on.
+     *
+     * A merged value that won't parse falls back to the incoming value alone rather
+     * than failing. The row is trying to write something valid, and refusing it over
+     * data that was already in the database punishes the wrong write.
+     */
+    private mergeComposite(field: ActiveField, existing: Record<string, unknown>, incoming: Record<string, unknown>): unknown {
+        const merged = FIELD_TYPES[field.type].value.safeParse({...existing, ...incoming});
+        if (merged.success) {
+            return merged.data;
+        }
+
+        logging.warn(`Replacing a custom field value that no longer validates rather than merging into it (field '${field.key}').`);
+        return incoming;
+    }
+
     /**
      * Apply a plan from `planWrite`.
      *
      * Merge, not replace: only the fields in the plan are touched, so a caller
-     * that doesn't know about a field can't erase it. The whole plan is applied in
-     * one transaction, so a mid-batch failure rolls the batch back.
+     * that doesn't know about a field can't erase it.
+     *
+     * `mergeComposites` extends that same rule from a field to a composite's
+     * sub-fields, because a sub-field is a field: a row writes the sub-fields it
+     * fills and leaves the rest alone, exactly as a blank `name` column leaves a
+     * member's name alone. The CSV import needs it — without it a file naming one
+     * address column would replace the whole address, clearing five sub-fields it
+     * never mentioned. The API does not merge: a PUT sends a whole address, so
+     * what it sends is what should be stored.
+     *
+     * The merge is asked for here rather than at plan time, where the caller's intent
+     * is otherwise expressed, because it cannot happen before a transaction is open:
+     * it reads the stored value and writes it back, and the row lock that keeps those
+     * two steps together only exists inside the transaction. `planWrite` runs before
+     * one is opened -- the importer plans a row, then opens a transaction per member --
+     * so a merge decided there would have to read outside the lock it depends on.
+     *
+     * Always transactional, so a mid-batch failure rolls the batch back. Passed an
+     * executor it joins that transaction -- the importer passes its per-member one, so a
+     * failed value write takes the member with it; passed nothing it opens its own.
      */
-    async applyWrite(memberId: string, writes: PlannedWrite[]): Promise<void> {
+    async applyWrite(
+        memberId: string,
+        writes: PlannedWrite[],
+        executor: Knex = this.knex,
+        {mergeComposites = false}: {mergeComposites?: boolean} = {}
+    ): Promise<void> {
         if (writes.length === 0) {
             return;
         }
 
-        await this.knex.transaction(async (trx) => {
+        const apply = async (trx: Knex) => {
+            const stored = mergeComposites
+                ? await this.storedComposites(trx, memberId, writes)
+                : new Map<string, Record<string, unknown>>();
+
             for (const {field, value} of writes) {
                 const target = {member_id: memberId, custom_field_id: field.id};
 
@@ -242,7 +365,18 @@ export class CustomFieldValuesService {
                     continue;
                 }
 
-                const valueColumns = storageColumnsFor(field.type, value);
+                // Both sides of the merge go through the same shape check, so it joins
+                // two objects the type system knows about rather than two assertions.
+                // The plan already validated `value` against its field type, so for a
+                // composite this parse cannot fail; a scalar simply doesn't match, and
+                // falls through to being written as it stands.
+                const existing = stored.get(field.id);
+                const incoming = StoredCompositeValue.safeParse(value);
+                const merged = existing && incoming.success
+                    ? this.mergeComposite(field, existing, incoming.data)
+                    : value;
+
+                const valueColumns = storageColumnsFor(field.type, merged);
                 await trx(VALUES_TABLE)
                     .insert({id: new ObjectID().toHexString(), ...target, ...valueColumns, created_at: new Date()})
                     // The unique index on (member_id, custom_field_id) is
@@ -250,6 +384,14 @@ export class CustomFieldValuesService {
                     .onConflict(['member_id', 'custom_field_id'])
                     .merge({...valueColumns, updated_at: new Date()});
             }
-        });
+        };
+
+        // isTransaction is knex's marker for a transactor: join an existing transaction
+        // rather than nesting a savepoint under it, otherwise open one.
+        if (executor.isTransaction) {
+            await apply(executor);
+        } else {
+            await executor.transaction(apply);
+        }
     }
 }

package/core/server/services/mentions/service.js

@@ -29,7 +29,11 @@ async function getPostData(post) {
 
 function getPostUrl(id, postData) {
     const jsonModel = {...postData};
-    outputSerializerUrlUtil.forPost(id, jsonModel, {options: {}});
+    // The URL service routes by resource type. Pages and posts share the Post
+    // model, so the page's own type must reach forPost — otherwise it defaults
+    // to 'posts', matches no post collection, and 404s under the lazy service.
+    const type = postData.type === 'page' ? 'pages' : 'posts';
+    outputSerializerUrlUtil.forPost(id, jsonModel, {options: {}}, type);
     return jsonModel.url;
 }
 

package/core/server/services/oembed/oembed-service.js

@@ -9,6 +9,7 @@ const charset = require('charset');
 const iconv = require('iconv-lite');
 const path = require('path');
 const crypto = require('crypto');
+const imageTransform = require('@tryghost/image-transform');
 
 // Some sites block non-standard user agents so we need to mimic a typical browser
 // Note: the Ghost/5.0 string _may_ be in use by 3rd parties so use caution when updating across majors
@@ -39,7 +40,26 @@ const messages = {
     insufficientMetadata: 'URL contains insufficient metadata.',
     unknownProvider: 'No provider found for supplied URL.',
     unableToFetchOembed: 'Unable to fetch requested embed.',
-    unauthorized: 'URL contains a private resource.'
+    unauthorized: 'URL contains a private resource.',
+    unconvertibleSvg: 'SVG image is too large or compressed to convert.'
+};
+
+const SVG_RASTER_SIZE = 256;
+const SVG_RASTER_TIMEOUT_SECONDS = 10;
+const MAX_SVG_BYTES = 32 * 1024;
+const GZIP_MAGIC = [0x1f, 0x8b];
+
+const SVG_EXTENSIONS = new Set(['.svg', '.svgz']);
+const SVG_SNIFF_BYTES = 1024;
+
+const shouldRasterize = (buffer, ext) => {
+    if (SVG_EXTENSIONS.has(ext.toLowerCase())) {
+        return true;
+    }
+
+    const head = buffer.subarray(0, SVG_SNIFF_BYTES).toString('utf8').trimStart();
+
+    return head.startsWith('<') && /<svg[\s:>]/i.test(head);
 };
 
 /**
@@ -175,14 +195,35 @@ class OEmbedService {
         }
 
         // Fetch image buffer from the URL
-        const imageBuffer = await this.fetchImageBuffer(imageUrl);
+        let imageBuffer = await this.fetchImageBuffer(imageUrl);
 
         // Extract file name from URL
         const fileName = path.basename(new URL(imageUrl).pathname);
-        const ext = path.extname(fileName);
+        let ext = path.extname(fileName);
         const baseName = ext ? path.basename(fileName, ext) : fileName;
         const name = this.imageStore.getSanitizedFileName(baseName);
 
+        if (shouldRasterize(imageBuffer, ext)) {
+            if (imageBuffer.length > MAX_SVG_BYTES || GZIP_MAGIC.every((byte, index) => imageBuffer[index] === byte)) {
+                throw new errors.ValidationError({
+                    message: tpl(messages.unconvertibleSvg),
+                    context: imageUrl
+                });
+            }
+
+            imageBuffer = await imageTransform.resizeFromBuffer(imageBuffer, {
+                // without `format` this returns the original bytes whenever they
+                // are smaller, storing the SVG under a .png name
+                format: 'png',
+                width: SVG_RASTER_SIZE,
+                height: SVG_RASTER_SIZE,
+                withoutEnlargement: false,
+                timeout: SVG_RASTER_TIMEOUT_SECONDS
+            });
+
+            ext = '.png';
+        }
+
         const uniqueFileName = `${name}-${crypto.randomUUID()}${ext}`;
         const targetPath = path.join(imageType, uniqueFileName);
 

package/core/server/services/posts/posts-service.js

@@ -312,6 +312,17 @@ class PostsService {
             });
         }
 
+        // The `comments.in_reply_to_id` references form chains between a post's
+        // comments, which MySQL cannot resolve while cascade-deleting them
+        // alongside `comments.parent_id`. Clear the references first so the
+        // `comments.post_id` cascade delete can do its job
+        await this.models.Post.bulkEdit(deleteIds, 'comments', {
+            data: {in_reply_to_id: null},
+            column: 'post_id',
+            transacting: options.transacting,
+            throwErrors: true
+        });
+
         // Posts and emails
         await this.models.Post.bulkDestroy(deleteEmailIds, 'emails', {transacting: options.transacting, throwErrors: true});
         const result = await this.models.Post.bulkDestroy(deleteIds, 'posts', {...options, throwErrors: true});

package/core/server/services/route-settings/dynamic-routing-service.js

@@ -1,5 +1,3 @@
-const crypto = require('crypto');
-const fs = require('fs-extra');
 const debug = require('@tryghost/debug')('services:route-settings:service');
 const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
@@ -9,12 +7,6 @@ const messages = {
     loadError: 'Could not load routes.yaml file.'
 };
 
-/**
- * md5 of the expanded default route settings — the routes_hash value for a
- * site that has never customised its routes.
- */
-const DEFAULT_ROUTES_SETTING_HASH = '3d180d52c663d173a6be791ef411ed01';
-
 function isStoredContentError(err) {
     return err.errorType === 'ValidationError' || err.errorType === 'IncorrectUsageError';
 }
@@ -27,26 +19,21 @@ class DynamicRoutingService {
     constructor() {
         /** @type {RouteSettingsStore} */
         this.store = null;
-        this.settingsLoader = null;
         this.routerManager = null;
         this.urlService = null;
     }
 
     /**
-     * Wire the storage-layer dependencies so the API surface (upload, download,
-     * getCurrentHash) works immediately after boot — even when the frontend is
-     * disabled and `start()` is never called.
+     * Wire the storage-layer dependency so the API surface (upload, download)
+     * works immediately after boot — even when the frontend is disabled and
+     * `start()` is never called.
      *
      * @param {object} deps
      * @param {RouteSettingsStore} deps.store - adapter-manager provided store
-     * @param {object} [deps.settingsLoader]  - legacy SettingsLoader used as a
-     *        read-path fallback when the stricter store parser rejects a file
-     *        (see loadRouteSettings)
      */
-    configure({store, settingsLoader}) {
+    configure({store}) {
         debug('configure');
         this.store = store;
-        this.settingsLoader = settingsLoader;
     }
 
     /**
@@ -67,49 +54,31 @@ class DynamicRoutingService {
     }
 
     async loadRouteSettings() {
-        const {expandRouteSettings} = require('./activation-bridge');
-
         try {
-            return expandRouteSettings(await this.store.get());
+            return await this.store.get();
         } catch (err) {
-            if (!this.settingsLoader || err.errorType !== 'ValidationError') {
-                throw err;
+            // A stored-content error means the site's routes.yaml is invalid —
+            // either it fails validation or it isn't parseable YAML. Log a
+            // targeted error so the failure is easy to spot in the logs, then
+            // rethrow so the caller surfaces the genuine error rather than
+            // silently degrading.
+            if (isStoredContentError(err)) {
+                logging.error(new errors.InternalServerError({
+                    message: 'Route settings could not be loaded because the routes.yaml file is invalid. Please fix the file.',
+                    code: 'ROUTE_SETTINGS_VALIDATION_ERROR',
+                    err,
+                    errorDetails: {reason: err.message}
+                }));
             }
-            logging.error(new errors.InternalServerError({
-                message: 'Route settings failed the stricter validation and were loaded with the legacy validator instead. Please review the routes.yaml file.',
-                code: 'ROUTE_SETTINGS_VALIDATION_FALLBACK',
-                err,
-                errorDetails: {reason: err.message}
-            }));
-
-            return this.settingsLoader.loadSettings();
-        }
-    }
-
-    getDefaultHash() {
-        return DEFAULT_ROUTES_SETTING_HASH;
-    }
 
-    async getCurrentHash() {
-        const expanded = await this.loadRouteSettings();
-
-        return crypto.createHash('md5')
-            .update(JSON.stringify(expanded), 'binary')
-            .digest('hex');
+            throw err;
+        }
     }
 
     async download() {
-        try {
-            const settings = await this.store.get();
-
-            return settings.yamlSource;
-        } catch (err) {
-            if (!this.settingsLoader || !isStoredContentError(err)) {
-                throw err;
-            }
+        const settings = await this.store.get();
 
-            return fs.readFile(this.settingsLoader.settingFilePath, 'utf8');
-        }
+        return settings.yamlSource;
     }
 
     async upload(yamlContent) {

package/core/server/services/route-settings/index.js

@@ -1,5 +1,3 @@
-const config = require('../../../shared/config');
-const parseYaml = require('./yaml-parser');
 const DynamicRoutingService = require('./dynamic-routing-service');
 
 const service = new DynamicRoutingService();
@@ -7,15 +5,9 @@ const service = new DynamicRoutingService();
 module.exports = {
     init: async () => {
         const adapterManager = require('../adapter-manager').default;
-        const SettingsLoader = require('./settings-loader');
-        const SettingsPathManager = require('./settings-path-manager');
-
-        const settingsPathManager = new SettingsPathManager({type: 'routes', paths: [config.getContentPath('settings')]});
-        const settingsLoader = new SettingsLoader({parseYaml, settingFilePath: settingsPathManager.getDefaultFilePath()});
 
         service.configure({
-            store: adapterManager.getAdapter('route-settings'),
-            settingsLoader
+            store: adapterManager.getAdapter('route-settings')
         });
     },
 
@@ -27,10 +19,6 @@ module.exports = {
         return service.loadRouteSettings.bind(service);
     },
 
-    get getDefaultHash() {
-        return service.getDefaultHash.bind(service);
-    },
-
     /**
      * Methods backing the Admin API settings endpoint — delegate to the
      * service instance so the endpoint stays decoupled from service wiring.
@@ -41,9 +29,6 @@ module.exports = {
         },
         get download() {
             return service.download.bind(service);
-        },
-        get getCurrentHash() {
-            return service.getCurrentHash.bind(service);
         }
     }
 };