ghost 6.57.1 → 6.58.0

package/core/server/services/recommendations/service/unsafe-data.ts

@@ -1,217 +0,0 @@
-import errors from '@tryghost/errors';
-
-type UnsafeDataContext = {
-    field?: string[]
-}
-
-function serializeField(field: string[]) {
-    if (field.length === 0) {
-        return 'data';
-    }
-    return field.join('.');
-}
-
-type NullData = {
-    readonly string: null,
-    readonly boolean: null,
-    readonly number: null,
-    readonly integer: null,
-    readonly url: null
-    enum(allowedValues: unknown[]): null
-    key(key: string): NullData
-    optionalKey(key: string): NullData
-    readonly array: null
-    index(index: number): NullData
-}
-
-/**
- * NOTE: should be moved to a separate package in case this pattern is found to be useful
- */
-export class UnsafeData {
-    protected data: unknown;
-    protected context: UnsafeDataContext;
-
-    constructor(data: unknown, context: UnsafeDataContext = {}) {
-        this.data = data;
-        this.context = context;
-    }
-
-    protected get field() {
-        return serializeField(this.context.field ?? []);
-    }
-
-    protected addKeyToField(key: string) {
-        return this.context.field ? [...this.context.field, key] : [key];
-    }
-
-    protected fieldWithKey(key: string) {
-        return serializeField(this.addKeyToField(key));
-    }
-
-    /**
-     * Returns undefined if the key is not present on the object. Note that this doesn't check for null.
-     */
-    optionalKey(key: string): UnsafeData|undefined {
-        if (typeof this.data !== 'object' || this.data === null) {
-            throw new errors.ValidationError({message: `${this.field} must be an object`});
-        }
-
-        if (!Object.prototype.hasOwnProperty.call(this.data, key)) {
-            return undefined;
-        }
-
-        return new UnsafeData((this.data as Record<string, unknown>)[key], {
-            field: this.addKeyToField(key)
-        });
-    }
-
-    key(key: string): UnsafeData {
-        if (typeof this.data !== 'object' || this.data === null) {
-            throw new errors.ValidationError({message: `${this.field} must be an object`});
-        }
-
-        if (!Object.prototype.hasOwnProperty.call(this.data, key)) {
-            throw new errors.ValidationError({message: `${this.fieldWithKey(key)} is required`});
-        }
-
-        return new UnsafeData((this.data as Record<string, unknown>)[key], {
-            field: this.addKeyToField(key)
-        });
-    }
-
-    /**
-     * Use this to get a nullable value:
-     * ```
-     * const url: string|null = data.key('url').nullable.string
-     * ```
-     */
-    get nullable(): UnsafeData|NullData {
-        if (this.data === null) {
-            const d: NullData = {
-                get string() {
-                    return null;
-                },
-                get boolean() {
-                    return null;
-                },
-                get number() {
-                    return null;
-                },
-                get integer() {
-                    return null;
-                },
-                get url() {
-                    return null;
-                },
-                enum() {
-                    return null;
-                },
-                key() {
-                    return d;
-                },
-                optionalKey() {
-                    return d;
-                },
-                get array() {
-                    return null;
-                },
-                index() {
-                    return d;
-                }
-            };
-            return d;
-        }
-        return this;
-    }
-
-    get string(): string {
-        if (typeof this.data !== 'string') {
-            throw new errors.ValidationError({message: `${this.field} must be a string`});
-        }
-        return this.data;
-    }
-
-    get boolean(): boolean {
-        if (typeof this.data !== 'boolean') {
-            throw new errors.ValidationError({message: `${this.field} must be a boolean`});
-        }
-        return this.data;
-    }
-
-    get number(): number {
-        if (typeof this.data === 'string') {
-            const parsed = parseFloat(this.data);
-            if (isNaN(parsed) || parsed.toString() !== this.data) {
-                throw new errors.ValidationError({message: `${this.field} must be a number, got ${typeof this.data}`});
-            }
-            return new UnsafeData(parsed, this.context).number;
-        }
-
-        if (typeof this.data !== 'number') {
-            throw new errors.ValidationError({message: `${this.field} must be a number, got ${typeof this.data}`});
-        }
-        if (Number.isNaN(this.data) || !Number.isFinite(this.data)) {
-            throw new errors.ValidationError({message: `${this.field} must be a finite number`});
-        }
-        return this.data;
-    }
-
-    get integer(): number {
-        if (typeof this.data === 'string') {
-            const parsed = parseInt(this.data);
-            if (isNaN(parsed) || parsed.toString() !== this.data) {
-                throw new errors.ValidationError({message: `${this.field} must be an integer`});
-            }
-            return new UnsafeData(parseInt(this.data), this.context).integer;
-        }
-
-        const number = this.number;
-        if (!Number.isSafeInteger(number)) {
-            throw new errors.ValidationError({message: `${this.field} must be an integer`});
-        }
-        return number;
-    }
-
-    get url(): URL {
-        if (this.data instanceof URL) {
-            return this.data;
-        }
-
-        const string = this.string;
-        try {
-            const url = new URL(string);
-
-            if (!['http:', 'https:'].includes(url.protocol)) {
-                throw new errors.ValidationError({message: `${this.field} must be a valid URL`});
-            }
-            return url;
-        } catch {
-            throw new errors.ValidationError({message: `${this.field} must be a valid URL`});
-        }
-    }
-
-    enum<T>(allowedValues: T[]): T {
-        if (!allowedValues.includes(this.data as T)) {
-            throw new errors.ValidationError({message: `${this.field} must be one of ${allowedValues.join(', ')}`});
-        }
-        return this.data as T;
-    }
-
-    get array(): UnsafeData[] {
-        if (!Array.isArray(this.data)) {
-            throw new errors.ValidationError({message: `${this.field} must be an array`});
-        }
-        return this.data.map((d, i) => new UnsafeData(d, {field: this.addKeyToField(`${i}`)}));
-    }
-
-    index(index: number) {
-        const arr = this.array;
-        if (index < 0 || !Number.isSafeInteger(index)) {
-            throw new errors.IncorrectUsageError({message: `index must be a positive integer`});
-        }
-        if (index >= arr.length) {
-            throw new errors.ValidationError({message: `${this.field} must be an array of length ${index + 1}`});
-        }
-        return arr[index];
-    }
-}

package/core/server/services/recommendations/service/well-known-service.ts

@@ -1,47 +0,0 @@
-import {Recommendation} from './recommendation';
-import fs from 'fs/promises';
-import _path from 'path';
-
-type UrlUtils = {
-    relativeToAbsolute(url: string): string
-}
-type Options = {
-    /**
-     * Where to publish the wellknown file
-     */
-    dir: string,
-    urlUtils: UrlUtils
-}
-
-export class WellknownService {
-    dir: string;
-    urlUtils: UrlUtils;
-
-    constructor({dir, urlUtils}: Options) {
-        this.dir = dir;
-        this.urlUtils = urlUtils;
-    }
-
-    #formatRecommendation(recommendation: Recommendation) {
-        return {
-            url: recommendation.url,
-            updated_at: (recommendation.updatedAt ?? recommendation.createdAt).toISOString(),
-            created_at: (recommendation.createdAt).toISOString()
-        };
-    }
-
-    getPath() {
-        return _path.join(this.dir, '/.well-known/recommendations.json');
-    }
-
-    getURL(): URL {
-        return new URL(this.urlUtils.relativeToAbsolute('/.well-known/recommendations.json'));
-    }
-
-    async set(recommendations: Recommendation[]) {
-        const content = JSON.stringify(recommendations.map(r => this.#formatRecommendation(r)));
-        const path = this.getPath();
-        await fs.mkdir(_path.dirname(path), {recursive: true});
-        await fs.writeFile(path, content);
-    }
-}

package/core/server/services/remote-flags/index.ts

@@ -1,101 +0,0 @@
-import logging from '@tryghost/logging';
-import {RemoteFlagsService} from './remote-flags-service';
-import * as flagOverrides from '../../../shared/labs-flag-overrides';
-
-// @tryghost/request ships no types; require() avoids an implicit-any under the strict tsconfig.
-const request = require('@tryghost/request');
-// Every site seeds a site_uuid setting, so it's a universal ramp key.
-const settingsCache = require('../../../shared/settings-cache');
-
-// Config slice this module needs; injected so init() stays testable.
-interface ConfigLike {
-    get(key: string): unknown;
-}
-
-interface RemoteFlagsConfig {
-    enabled?: boolean;
-    url?: string | null;
-    pollInterval?: unknown;
-}
-
-// Floor for the poll interval: many instances can share one manifest host, so a
-// too-small or units-confused (seconds-as-ms) value is rejected, not honored.
-const MIN_POLL_INTERVAL_MS = 60 * 1000;
-
-let instance: RemoteFlagsService | null = null;
-
-/**
- * Start the poller if enabled for this instance. Config-gated and opt-in: inert
- * unless `remoteFlags` is enabled with a `url` (self-hosted/dev leave it unset).
- * The site's UUID is the ramp bucket key; it's absent only in edge cases, where
- * ramps are skipped but full overrides still apply. Polling is fire-and-forget so
- * boot is never blocked on the first fetch.
- *
- * @returns the running service, or null when inert
- */
-export function init(config: ConfigLike): RemoteFlagsService | null {
-    if (instance) {
-        return instance;
-    }
-
-    const remoteFlags = (config.get('remoteFlags') as RemoteFlagsConfig) || {};
-
-    if (remoteFlags.enabled !== true || !remoteFlags.url) {
-        return null;
-    }
-
-    const siteUuid = settingsCache.get('site_uuid') as string | undefined;
-
-    let url: URL;
-    try {
-        // Validate the url once at start (not on every poll); hand the service a ready URL.
-        url = new URL(remoteFlags.url);
-    } catch {
-        logging.warn({
-            system: {event: 'remote_flags.invalid_url'}
-        }, `Remote feature flags url is not a valid URL, not starting: ${remoteFlags.url}`);
-        return null;
-    }
-
-    // Optional poll interval (ms): honor a finite value >= the floor, else warn and
-    // use the service default.
-    let pollInterval: number | undefined;
-    const configuredInterval = remoteFlags.pollInterval;
-    if (configuredInterval !== undefined && configuredInterval !== null) {
-        if (typeof configuredInterval === 'number' && Number.isFinite(configuredInterval) && configuredInterval >= MIN_POLL_INTERVAL_MS) {
-            pollInterval = configuredInterval;
-        } else {
-            logging.warn({
-                system: {event: 'remote_flags.invalid_poll_interval'}
-            }, `Remote feature flags pollInterval must be a number >= ${MIN_POLL_INTERVAL_MS}ms, using the default: ${configuredInterval}`);
-        }
-    }
-
-    instance = new RemoteFlagsService({
-        url,
-        siteUuid,
-        applyOverrides: overrides => flagOverrides.replace(overrides),
-        request,
-        pollInterval
-    });
-
-    // Fire-and-forget: start() never rejects, so this won't block boot or throw unhandled.
-    instance.start();
-
-    return instance;
-}
-
-/**
- * Stop the poller. Halts polling; intentionally leaves the last-applied overrides
- * in place rather than clearing them.
- */
-export function stop(): void {
-    if (instance) {
-        instance.stop();
-        instance = null;
-    }
-}
-
-export function getInstance(): RemoteFlagsService | null {
-    return instance;
-}

package/core/server/services/remote-flags/remote-flags-service.ts

@@ -1,236 +0,0 @@
-import logging from '@tryghost/logging';
-import {resolve} from './resolve';
-
-const DEFAULT_POLL_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
-const DEFAULT_JITTER_MS = 60 * 1000; // up to 1 minute of spread per poll
-const REQUEST_TIMEOUT_MS = 10 * 1000;
-
-type FlagOverrides = Record<string, boolean>;
-
-interface RequestResponse {
-    statusCode?: number;
-    body?: string;
-    headers?: Record<string, string | undefined>;
-}
-
-// @tryghost/request validates with validator.isURL, which only accepts strings and
-// rejects a URL object outright, so the client is always called with a string.
-type RequestFn = (url: string, options: Record<string, unknown>) => Promise<RequestResponse>;
-
-export interface RemoteFlagsServiceDeps {
-    /** canonical manifest URL (one per environment) */
-    url: URL;
-    /** this site's UUID (the ramp bucket key); undefined disables ramps but not full overrides */
-    siteUuid?: string;
-    /** sink for resolved overrides (the shared override store's replace()) */
-    applyOverrides: (overrides: FlagOverrides) => void;
-    /** @tryghost/request-compatible client */
-    request: RequestFn;
-    /** base poll interval in ms */
-    pollInterval?: number;
-    /** max random extra delay per poll in ms */
-    jitter?: number;
-    /** returns 0..1 (injectable for tests) */
-    getRandom?: () => number;
-}
-
-/**
- * Polls the manifest, resolves it for this site, and writes the result to the
- * shared override store. Fail-open by design: a missing/broken/unreachable manifest
- * keeps last-known-good (or clears) and never throws, so it can't take a site down.
- * The HTTP client and override sink are injected for testing.
- */
-export class RemoteFlagsService {
-    url: URL;
-    siteUuid?: string;
-    applyOverrides: (overrides: FlagOverrides) => void;
-    request: RequestFn;
-    pollInterval: number;
-    jitter: number;
-    getRandom: () => number;
-
-    _etag: string | null;
-    _resolvedKey: string | null;
-    _timer: ReturnType<typeof setTimeout> | null;
-    _started: boolean;
-    _refreshing: boolean;
-
-    constructor(deps: RemoteFlagsServiceDeps) {
-        this.url = deps.url;
-        this.siteUuid = deps.siteUuid;
-        this.applyOverrides = deps.applyOverrides;
-        this.request = deps.request;
-        this.pollInterval = deps.pollInterval || DEFAULT_POLL_INTERVAL_MS;
-        this.jitter = deps.jitter === undefined ? DEFAULT_JITTER_MS : deps.jitter;
-        this.getRandom = deps.getRandom || Math.random;
-
-        this._etag = null; // last seen ETag, for conditional GETs
-        this._resolvedKey = null; // serialized last-applied resolved map, for change detection
-        this._timer = null;
-        this._started = false;
-        this._refreshing = false;
-    }
-
-    /**
-     * Fetch, resolve, and apply the manifest once. Never rejects. Overlapping calls
-     * are coalesced so concurrent refreshes can't race the cached ETag.
-     */
-    async refresh(): Promise<void> {
-        if (this._refreshing) {
-            return;
-        }
-        this._refreshing = true;
-        try {
-            await this._doRefresh();
-        } finally {
-            this._refreshing = false;
-        }
-    }
-
-    /** @private */
-    async _doRefresh(): Promise<void> {
-        let response: RequestResponse;
-        try {
-            const headers: Record<string, string> = {};
-            if (this._etag) {
-                headers['if-none-match'] = this._etag;
-            }
-            // Pass the string form: @tryghost/request rejects a URL object.
-            response = await this.request(this.url.href, {
-                method: 'GET',
-                headers,
-                throwHttpErrors: false,
-                responseType: 'text',
-                followRedirect: false,
-                retry: {limit: 0},
-                timeout: {request: REQUEST_TIMEOUT_MS}
-            });
-        } catch (err) {
-            // Network/timeout error: keep last-known-good, change nothing.
-            logging.warn({
-                system: {event: 'remote_flags.fetch_failed'},
-                err
-            }, 'Remote feature flags fetch failed; keeping last-known-good');
-            return;
-        }
-
-        try {
-            const status = response && response.statusCode;
-
-            if (status === 304) {
-                // Not modified: current overrides are still correct.
-                return;
-            }
-
-            if (status === 404) {
-                // No manifest published: no opinion for anyone, fail open to empty.
-                this._etag = null;
-                this._applyAndMaybeLog({}, null);
-                return;
-            }
-
-            if (!status || status < 200 || status >= 300) {
-                logging.warn({
-                    system: {event: 'remote_flags.fetch_bad_status', statusCode: status || null}
-                }, 'Remote feature flags fetch returned an unexpected status; keeping last-known-good');
-                return;
-            }
-
-            let manifest: unknown;
-            try {
-                manifest = JSON.parse(response.body as string);
-            } catch (parseErr) {
-                logging.warn({
-                    system: {event: 'remote_flags.parse_failed'},
-                    err: parseErr
-                }, 'Remote feature flags manifest was not valid JSON; keeping last-known-good');
-                return;
-            }
-
-            // got lowercases response header keys, so `.etag` is the only spelling.
-            const etag = (response.headers && response.headers.etag) || null;
-            // Commit the ETag only after the manifest has actually been applied: if
-            // apply throws, we keep the old ETag so the next poll re-fetches and
-            // retries instead of getting a 304 for a manifest we never applied.
-            this._applyAndMaybeLog(manifest, etag);
-            this._etag = etag;
-        } catch (err) {
-            // Backstop: resolve()/applyOverrides shouldn't throw, but fail open if they do.
-            logging.warn({
-                system: {event: 'remote_flags.apply_failed'},
-                err
-            }, 'Remote feature flags could not be applied; keeping last-known-good');
-        }
-    }
-
-    /**
-     * Resolve and apply the manifest, logging only when the resolved set changes
-     * (so a steady fleet doesn't log on every poll).
-     * @private
-     */
-    _applyAndMaybeLog(manifest: unknown, etag: string | null): void {
-        const resolved = resolve(manifest, {
-            siteUuid: this.siteUuid
-        });
-
-        this.applyOverrides(resolved);
-
-        // Stable-stringify (sorted keys) so a reordered-but-identical manifest isn't
-        // seen as a change. JSON.stringify's 2nd arg is a key allowlist, here the sorted keys.
-        const key = JSON.stringify(resolved, Object.keys(resolved).sort());
-        if (key !== this._resolvedKey) {
-            this._resolvedKey = key;
-            logging.info({
-                system: {
-                    event: 'remote_flags.applied',
-                    etag: etag || null,
-                    flags: resolved
-                }
-            }, 'Remote feature flags applied');
-        }
-    }
-
-    _scheduleNext(): void {
-        if (!this._started) {
-            return;
-        }
-        // Clear any existing timer so a stop/start cycle can't leave two chains running.
-        if (this._timer) {
-            clearTimeout(this._timer);
-            this._timer = null;
-        }
-        const delay = this.pollInterval + Math.floor(this.getRandom() * this.jitter);
-        this._timer = setTimeout(async () => {
-            await this.refresh();
-            this._scheduleNext();
-        }, delay);
-        // Never hold the process open just for the poll timer.
-        if (this._timer && typeof this._timer.unref === 'function') {
-            this._timer.unref();
-        }
-    }
-
-    /**
-     * Start polling: an immediate refresh (so boot reflects current flag state),
-     * then a jittered recurring poll. Idempotent.
-     */
-    async start(): Promise<void> {
-        if (this._started) {
-            return;
-        }
-        this._started = true;
-        await this.refresh();
-        this._scheduleNext();
-    }
-
-    /**
-     * Stop polling. Does not clear already-applied overrides.
-     */
-    stop(): void {
-        this._started = false;
-        if (this._timer) {
-            clearTimeout(this._timer);
-            this._timer = null;
-        }
-    }
-}