ghost 6.56.0 → 6.57.1

package/core/server/services/url/routable-resources.js

@@ -1,22 +1,21 @@
 const errors = require('@tryghost/errors');
 
 /**
- * Enumerates the routable resources of a type: the rows the lazy URL service
- * would produce a URL for. This is the lazy counterpart of the eager
- * service's boot walk — same raw-knex fast path, same public-visibility
- * gates — computed on demand instead of held in memory.
+ * Enumerates the routable resources of a type: the rows the URL service would
+ * produce a URL for. Computed on demand rather than held in memory.
  *
- * Callers name the extra columns they want back; everything else stays out
- * of memory. The columns URL computation needs (permalink fields, filter
- * columns, relations) come from the lazy service itself, so rows are never
- * thin for the active routing config.
+ * Callers name the extra columns they want back; everything else stays out of
+ * memory. The columns URL computation itself needs (permalink fields, filter
+ * columns, relations) are passed in by the URL service, which is the source of
+ * truth for what the active routing config reads — so rows are never thin for
+ * it.
  */
 
 // Which rows of each type are routable. visibility:public alone is not
 // enough for tags and authors: without the has-posts join, empty tags and
 // staff user accounts would be routable/listable.
 const TYPE_CONFIG = {
-    posts: {modelName: 'Post', table: 'posts', filter: 'status:published+type:post'},
+    posts: {modelName: 'Post', table: 'posts', filter: 'status:published+type:post', canCarryRelations: true},
     pages: {modelName: 'Post', table: 'posts', filter: 'status:published+type:page'},
     tags: {
         modelName: 'Tag',
@@ -37,80 +36,72 @@ const RELATION_FIELDS = {
     authors: ['users.id', 'users.slug']
 };
 
-// Keeps each SQLite query under the bound-variable limit (#5810) — the same
-// strategy as the eager boot walk (services/url/resources.js).
+// Keeps each SQLite query under the bound-variable limit (#5810).
 const SQLITE_BATCH_SIZE = 999;
 
 /**
- * @param {Object} deps
- * @param {Object} deps.lazyUrlService - source of truth for the columns and
- * relations the active routing config reads
- * @returns {(type: string, options?: {columns?: string[]}) => Promise<Object[]>}
+ * @param {string} type
+ * @param {Object} [options]
+ * @param {string[]} [options.columns] - extra columns the caller wants back
+ * @param {string[]} [options.requiredFields] - columns URL computation reads
+ * @param {string[]} [options.requiredRelations] - relations URL computation
+ * reads; ignored for types that carry none
+ * @returns {Promise<Object[]>}
  */
-function createFetchRoutableResources({lazyUrlService}) {
-    if (!lazyUrlService) {
+async function fetchRoutableResources(type, {columns = [], requiredFields = [], requiredRelations = []} = {}) {
+    const typeConfig = TYPE_CONFIG[type];
+    if (!typeConfig) {
         throw new errors.IncorrectUsageError({
-            message: 'fetchRoutableResources requires a lazy URL service backend'
+            message: `Unknown routable resource type: ${type}`
         });
     }
 
-    return async function fetchRoutableResources(type, {columns = []} = {}) {
-        const typeConfig = TYPE_CONFIG[type];
-        if (!typeConfig) {
-            throw new errors.IncorrectUsageError({
-                message: `Unknown routable resource type: ${type}`
-            });
-        }
-
-        // Lazy requires: the model layer must not load before boot wires it.
-        const models = require('../../models');
-        const schema = require('../../data/schema');
-        const DatabaseInfo = require('@tryghost/database-info');
+    // Required here rather than at the top so this module can be loaded
+    // for its shape without pulling in the model layer.
+    const models = require('../../models');
+    const schema = require('../../data/schema');
+    const DatabaseInfo = require('@tryghost/database-info');
 
-        // Callers speak include; raw_knex only speaks exclude, so translate
-        // against the table schema here, once.
-        const include = new Set(['id', ...columns, ...lazyUrlService.getRequiredFields(type)]);
-        const options = {
-            modelName: typeConfig.modelName,
-            filter: typeConfig.filter,
-            exclude: Object.keys(schema.tables[typeConfig.table]).filter(column => !include.has(column))
-        };
-        if (typeConfig.shouldHavePosts) {
-            options.shouldHavePosts = typeConfig.shouldHavePosts;
-        }
+    // Callers speak include; raw_knex only speaks exclude, so translate
+    // against the table schema here, once.
+    const include = new Set(['id', ...columns, ...requiredFields]);
+    const options = {
+        modelName: typeConfig.modelName,
+        filter: typeConfig.filter,
+        exclude: Object.keys(schema.tables[typeConfig.table]).filter(column => !include.has(column))
+    };
+    if (typeConfig.shouldHavePosts) {
+        options.shouldHavePosts = typeConfig.shouldHavePosts;
+    }
 
-        // Relations only when the active routing config reads them (e.g.
-        // /:primary_tag/:slug/ permalinks, tag-filtered collections). Pages
-        // never carry relations, mirroring the eager resource config.
-        if (type === 'posts') {
-            const relations = lazyUrlService.getRequiredRelations();
-            if (relations.length) {
-                options.withRelated = relations;
-                options.withRelatedFields = {};
-                for (const relation of relations) {
-                    options.withRelatedFields[relation] = RELATION_FIELDS[relation];
-                }
-            }
+    // Relations only when the active routing config reads them (e.g.
+    // /:primary_tag/:slug/ permalinks, tag-filtered collections), and only for
+    // the types that have any — see canCarryRelations above.
+    if (typeConfig.canCarryRelations && requiredRelations.length) {
+        options.withRelated = requiredRelations;
+        options.withRelatedFields = {};
+        for (const relation of requiredRelations) {
+            options.withRelatedFields[relation] = RELATION_FIELDS[relation];
         }
+    }
 
-        let rows;
-        if (!DatabaseInfo.isSQLite(models.Base.knex)) {
-            rows = await models.Base.Model.raw_knex.fetchAll(options);
-        } else {
-            rows = [];
-            let offset = 0;
-            let batch;
-            do {
-                // orderBy makes the pagination deterministic; without it the
-                // row order between batches is unspecified.
-                batch = await models.Base.Model.raw_knex.fetchAll({...options, orderBy: 'id', offset, limit: SQLITE_BATCH_SIZE});
-                rows.push(...batch);
-                offset += SQLITE_BATCH_SIZE;
-            } while (batch.length);
-        }
+    let rows;
+    if (!DatabaseInfo.isSQLite(models.Base.knex)) {
+        rows = await models.Base.Model.raw_knex.fetchAll(options);
+    } else {
+        rows = [];
+        let offset = 0;
+        let batch;
+        do {
+            // orderBy makes the pagination deterministic; without it the
+            // row order between batches is unspecified.
+            batch = await models.Base.Model.raw_knex.fetchAll({...options, orderBy: 'id', offset, limit: SQLITE_BATCH_SIZE});
+            rows.push(...batch);
+            offset += SQLITE_BATCH_SIZE;
+        } while (batch.length);
+    }
 
-        return rows;
-    };
+    return rows;
 }
 
-module.exports = {createFetchRoutableResources};
+module.exports = {fetchRoutableResources};

package/core/server/services/url/router-filter.js

@@ -6,8 +6,9 @@ exports.buildFilter = buildFilter;
 exports.filterMatches = filterMatches;
 const nql = require('@tryghost/nql');
 const logging = require('@tryghost/logging');
-// A deliberate copy of the eager UrlGenerator's NQL semantics: while both
-// services run side by side, eager is the parity oracle and must stay separate.
+// NQL evaluation for routes.yaml collection filters, kept in one place so the
+// forward lookup, ownership check and reverse lookup all decide membership the
+// same way.
 exports.EXPANSIONS = [
     { key: 'author', replacement: 'authors.slug' },
     { key: 'tags', replacement: 'tags.slug' },
@@ -46,8 +47,15 @@ function buildFilter(filter) {
     }
     return nql(filter, { expansions: exports.EXPANSIONS, transformer: PAGE_TRANSFORMER });
 }
-// A null filter always matches; a filter that throws is a non-match, not an
-// error, mirroring the eager generator's try/catch.
+// A null filter always matches; anything that throws is a non-match, not an
+// error.
+//
+// That covers malformed filters as well as odd records, because NQL parses
+// lazily: `buildFilter` returns happily for a filter like `((`, and the parse
+// error surfaces here on the first `queryJSON`. So this catch is the only
+// thing standing between a bad routes.yaml filter and a site that cannot
+// route — do not narrow it on the assumption that compilation already
+// failed somewhere upstream. Pinned in router-filter.test.js.
 function filterMatches(compiledFilter, record) {
     if (!compiledFilter) {
         return true;

package/core/server/services/url/router-filter.ts

@@ -1,8 +1,9 @@
 const nql = require('@tryghost/nql');
 const logging = require('@tryghost/logging');
 
-// A deliberate copy of the eager UrlGenerator's NQL semantics: while both
-// services run side by side, eager is the parity oracle and must stay separate.
+// NQL evaluation for routes.yaml collection filters, kept in one place so the
+// forward lookup, ownership check and reverse lookup all decide membership the
+// same way.
 export const EXPANSIONS = [
     {key: 'author', replacement: 'authors.slug'},
     {key: 'tags', replacement: 'tags.slug'},
@@ -50,8 +51,15 @@ export function buildFilter(filter: string | null | undefined): CompiledFilter |
     return nql(filter, {expansions: EXPANSIONS, transformer: PAGE_TRANSFORMER});
 }
 
-// A null filter always matches; a filter that throws is a non-match, not an
-// error, mirroring the eager generator's try/catch.
+// A null filter always matches; anything that throws is a non-match, not an
+// error.
+//
+// That covers malformed filters as well as odd records, because NQL parses
+// lazily: `buildFilter` returns happily for a filter like `((`, and the parse
+// error surfaces here on the first `queryJSON`. So this catch is the only
+// thing standing between a bad routes.yaml filter and a site that cannot
+// route — do not narrow it on the assumption that compilation already
+// failed somewhere upstream. Pinned in router-filter.test.js.
 export function filterMatches(compiledFilter: CompiledFilter | null, record: Record<string, unknown>): boolean {
     if (!compiledFilter) {
         return true;

package/core/server/services/webhooks/index.js

@@ -7,7 +7,7 @@ module.exports = {
         const models = require('../../models');
         const limitService = require('../../services/limits');
         const events = require('../../lib/common/events');
-        const urlService = require('../url').facade;
+        const urlService = require('../url');
         const createSerialize = require('./serialize');
         const createPayload = require('./payload');
         const WebhookTrigger = require('./webhook-trigger');

package/core/server/services/webhooks/serialize.js

@@ -3,7 +3,17 @@
 // routing an under-loaded post 404s. Ask the URL service which relations it
 // needs and load only the ones missing — reloading a relation the event
 // already carries (e.g. authors) would strip its nested roles from the
-// payload. Returns [] under eager routing, which resolves URLs by id.
+// payload. `getRequiredRelations()` is [] when the routing config reads
+// none, so this is a no-op on a default routes.yaml.
+// `model._changed` carries raw model keys, but `previous` is picked off the
+// API-serialized payload, where some keys are renamed (members `products` → `tiers`).
+const SERIALIZED_KEYS = {
+    members: {
+        products: 'tiers',
+        stripeSubscriptions: 'subscriptions'
+    }
+};
+
 const loadRequiredUrlRelations = async (model, urlService) => {
     const required = urlService.getRequiredRelations();
     const missing = required.filter(relation => !model.relations[relation]);
@@ -79,7 +89,7 @@ module.exports = ({urlService}) => async (event, model) => {
             .serializers
             .handle
             .output(model, {docName: docName, method: 'read'}, api.serializers.output, frame);
-        previous = _.pick(frame.response[docName][0], changed);
+        previous = _.pick(frame.response[docName][0], changed.map(key => SERIALIZED_KEYS[docName]?.[key] ?? key));
     }
 
 

package/core/server/web/api/endpoints/admin/routes.js

@@ -85,8 +85,8 @@ module.exports = function apiRoutes() {
     // ## Schedules
     router.put('/schedules/:resource/:id', mw.authAdminApiWithUrl, http(api.schedules.publish));
 
-    // ## Gift Reminders
-    router.put('/gifts/flush_reminders', mw.authAdminApiWithUrl, http(api.giftReminders.flushReminders));
+    // ## Gifts
+    router.put('/gifts/flush_reminders', mw.authAdminApiWithUrl, http(api.gifts.flushReminders));
 
     // ## Settings
     router.get('/settings/routes/yaml', mw.authAdminApi, http(api.settings.download));

package/core/shared/config/env/config.testing-mysql.json

@@ -115,7 +115,6 @@
     "useMinFiles": false,
     "paths": {
         "fixtures": "test/utils/fixtures/fixtures",
-        "defaultSettings": "test/utils/fixtures/default-settings.json",
-        "urlCache": "test/utils/fixtures/urls"
+        "defaultSettings": "test/utils/fixtures/default-settings.json"
     }
 }

package/core/shared/config/env/config.testing.json

@@ -111,7 +111,6 @@
     "useMinFiles": false,
     "paths": {
         "fixtures": "test/utils/fixtures/fixtures",
-        "defaultSettings": "test/utils/fixtures/default-settings.json",
-        "urlCache": "test/utils/fixtures/urls"
+        "defaultSettings": "test/utils/fixtures/default-settings.json"
     }
 }

package/core/shared/custom-theme-settings-cache/custom-theme-settings-bread-service.js

@@ -26,4 +26,8 @@ module.exports = class CustomThemeSettingsBREADService {
     async destroy(data, options = {}) {
         return this.Model.destroy(data, options);
     }
+
+    async transaction(fn) {
+        return this.Model.transaction(fn);
+    }
 };

package/core/shared/custom-theme-settings-cache/custom-theme-settings-service.js

@@ -164,6 +164,45 @@ module.exports = class CustomThemeSettingsService {
         return settingsObjects;
     }
 
+    /**
+     * Duplicate stored settings from one theme to another, e.g. when a theme
+     * is saved as a copy under a new name.
+     *
+     * No-ops if the destination theme already has stored settings so existing
+     * customisations are never overwritten. Values are copied verbatim - they
+     * are reconciled against the destination theme's settings definition by
+     * the sync that runs when that theme is activated.
+     *
+     * @param {string} fromThemeName
+     * @param {string} toThemeName
+     */
+    async copySettingsBetweenThemes(fromThemeName, toThemeName) {
+        const sourceCollection = await this._repository.browse({filter: `theme:'${fromThemeName}'`});
+
+        // single transaction so a failure part-way leaves no partial copy
+        // behind that would make later attempts skip the copy. The
+        // destination check locks inside the same transaction so concurrent
+        // copies can't both see an empty destination and insert duplicates
+        await this._repository.transaction(async (transacting) => {
+            const destinationCollection = await this._repository.browse({filter: `theme:'${toThemeName}'`, transacting, forUpdate: true});
+
+            if (destinationCollection.toJSON().length > 0) {
+                debug(`Skipping copy of custom theme settings from '${fromThemeName}' to '${toThemeName}' - destination already has settings`);
+                return;
+            }
+
+            for (const setting of sourceCollection.toJSON()) {
+                debug(`Copying custom theme setting '${fromThemeName}.${setting.key}' to '${toThemeName}'`);
+                await this._repository.add({
+                    theme: toThemeName,
+                    key: setting.key,
+                    type: setting.type,
+                    value: setting.value
+                }, {transacting});
+            }
+        });
+    }
+
     // Private -----------------------------------------------------------------
 
     /**

package/core/shared/events/index.js

@@ -12,6 +12,5 @@ module.exports = {
     OfferRedemptionEvent: require('./offer-redemption-event'),
     SubscriptionActivatedEvent: require('./subscription-activated-event'),
     SubscriptionCancelledEvent: require('./subscription-cancelled-event'),
-    SubscriptionCreatedEvent: require('./subscription-created-event'),
-    URLResourceUpdatedEvent: require('./url-resource-updated-event')
+    SubscriptionCreatedEvent: require('./subscription-created-event')
 };

package/core/shared/labs.js

@@ -27,13 +27,13 @@ const messages = {
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
 const GA_FEATURES = [
+    'automationAnalytics',
     'customFonts',
     'explore',
     'commentsThreads',
     'commentsPinning',
     'featurebaseFeedback',
     'dangerZoneResetAuth',
-    'indexnow',
     'llmsTxt'
 ];
 
@@ -48,11 +48,10 @@ const PUBLIC_BETA_FEATURES = [
 // Which is only visible if the developer experiments flag is enabled
 const PRIVATE_FEATURES = [
     'automations',
-    'automationAnalytics',
+    'automationRunAnalytics',
     'stripeAutomaticTax',
     'importMemberTier',
     'csvContentImporter',
-    'urlCache',
     'lexicalIndicators',
     'adminUIRefresh',
     'emailCustomization',
@@ -65,7 +64,8 @@ const PRIVATE_FEATURES = [
     'memberDetailsReact',
     'membersCustomFields',
     'paywallImprovements',
-    'giftSubCustomization'
+    'giftSubCustomization',
+    'tagDetailsReact'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.56.0",
+  "version": "6.57.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -56,7 +56,7 @@
     "@tryghost/api-framework": "3.3.5",
     "@tryghost/bookshelf-plugins": "2.3.2",
     "@tryghost/brute-knex": "3.2.1",
-    "@tryghost/color-utils": "0.2.19",
+    "@tryghost/color-utils": "0.2.20",
     "@tryghost/config-url-helpers": "1.0.27",
     "@tryghost/custom-fonts": "1.0.11",
     "@tryghost/database-info": "2.3.2",
@@ -111,7 +111,6 @@
     "countries-and-timezones": "3.9.0",
     "csso": "5.0.5",
     "csv-writer": "1.6.0",
-    "date-fns": "2.30.0",
     "dequal": "2.0.3",
     "dompurify": "3.4.11",
     "downsize-cjs": "1.1.2",
@@ -192,22 +191,22 @@
     "ua-parser-js": "1.0.41",
     "xml": "1.0.1",
     "zod": "4.4.3",
-    "@tryghost/adapter-base-cache": "file:components/tryghost-adapter-base-cache-0.2.0.tgz",
-    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
     "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
-    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.0.tgz",
+    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
     "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.1.tgz",
     "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
+    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
+    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.1.tgz",
+    "@tryghost/adapter-base-cache": "file:components/tryghost-adapter-base-cache-0.2.0.tgz",
     "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
     "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.3.tgz",
-    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.3.tgz",
-    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.3.tgz",
-    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.1.4.tgz",
+    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.4.tgz",
+    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.4.tgz",
     "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.4.3.tgz",
-    "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
     "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
+    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.1.5.tgz",
+    "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
     "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
-    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
     "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.3.3.tgz"
   },
   "optionalDependencies": {