ghost 6.57.1 → 6.58.0

package/core/server/services/members/import-export/import/completion-email.js

@@ -1,9 +1,42 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = buildCompletionEmail;
+exports.default = buildImportEmail;
 const csv_1 = require("../csv");
+const email_template_1 = __importStar(require("./email-template"));
 const csv_2 = require("@tryghost/custom-field-types/csv");
-const emailTemplate = require('./email-template');
 // Turn an ORM validation error into copy a member manager can act on. Presentation
 // only: the API response keeps the raw messages, and just the emailed report is
 // rewritten. Takes one reason at a time, so a rewrite matching to the end of its input
@@ -47,42 +80,43 @@ function toErrorReportRow(row) {
         error: humaniseError(row)
     };
 }
-// The error report attached to the completion email: the failed rows as CSV. It shares
-// the serialiser with the export but not the shaping -- the export writes db members,
-// this echoes submitted rows. Member columns come from the shaper's keys (so the type
+// The error report attached to the completion email: the failed rows as CSV, called only
+// when there are rows to list. It shares the serialiser with the export but not the
+// shaping -- the export writes db members, this echoes submitted rows. Member columns come from the shaper's keys (so the type
 // stays the single source); the custom_fields.* columns across the rows are threaded in
 // before the last error column, and each row's custom cells merged on.
 function buildErrorReport(errors) {
-    if (errors.length === 0) {
-        return (0, csv_1.serialize)([]);
-    }
     const memberColumns = Object.keys(toErrorReportRow(errors[0])).filter(column => column !== 'error');
     const customColumns = [...new Set(errors.flatMap(row => Object.keys(customFieldCells(row))))];
     const columns = [...memberColumns, ...customColumns, 'error'];
     const rows = errors.map(row => ({ ...toErrorReportRow(row), ...customFieldCells(row) }));
     return (0, csv_1.serialize)(rows, { columns });
 }
-// Compose the completion email for a finished import: the summary and its links,
-// plus the attached error report. Owns how the outcome is presented, so the
-// importer yields only the result and never touches email or CSV formatting.
-function buildCompletionEmail({ result, recipient, labelName, importLabel, urlFor }) {
-    const siteUrl = new URL(urlFor('home', null, true));
-    const membersUrl = new URL('members', urlFor('admin', null, true));
-    if (importLabel) {
-        membersUrl.searchParams.set('label', importLabel.slug);
-    }
-    const html = emailTemplate({ result, siteUrl, membersUrl, emailRecipient: recipient, importLabel });
-    const subject = result.imported > 0 ? 'Your member import is complete' : 'Your member import was unsuccessful';
+// The one email an import sends, whatever became of it. What the publisher is told and
+// what is attached both follow from the result: no result means nothing was written, so
+// there is nothing in their file to fix and an attached CSV would say there was, and no
+// failed rows means there is nothing for a report to list.
+function buildImportEmail({ result, recipient, labelName, links }) {
+    const summary = !result ? 'did-not-run' : (result.imported > 0 ? 'added' : 'all-failed');
     return {
         to: recipient,
-        subject,
-        html,
+        subject: email_template_1.headingFor[summary],
+        html: (0, email_template_1.default)({
+            summary,
+            imported: result?.imported ?? 0,
+            errorCount: result?.errors.length ?? 0,
+            siteUrl: links.siteUrl(),
+            membersUrl: links.membersUrl(result?.importLabel?.slug),
+            emailRecipient: recipient
+        }),
         forceTextContent: true,
-        attachments: [{
-                filename: `${labelName} - Errors.csv`,
-                content: buildErrorReport(result.errors),
-                contentType: 'text/csv',
-                contentDisposition: 'attachment'
-            }]
+        attachments: result?.errors.length
+            ? [{
+                    filename: `${labelName} - Errors.csv`,
+                    content: buildErrorReport(result.errors),
+                    contentType: 'text/csv',
+                    contentDisposition: 'attachment'
+                }]
+            : []
     };
 }

package/core/server/services/members/import-export/import/email-template.js

@@ -1,15 +1,28 @@
-function formatNumber(number) {
-    return number.toLocaleString();
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.headingFor = void 0;
+exports.default = renderImportEmail;
+function formatNumber(value) {
+    return value.toLocaleString();
 }
-
 const iff = (cond, yes, no) => (cond ? yes : no);
-module.exports = ({result, siteUrl, membersUrl, emailRecipient}) => `
+// The heading is a pure function of the outcome, and the subject is the same sentence, so
+// both are read from here rather than derived twice and left to disagree.
+exports.headingFor = {
+    'did-not-run': 'Your member import could not be completed',
+    'all-failed': 'Your member import was unsuccessful',
+    added: 'Your member import is complete'
+};
+// The states are exclusive, so each paragraph below tests for exactly one.
+function renderImportEmail({ summary, imported, errorCount, siteUrl, membersUrl, emailRecipient }) {
+    const heading = exports.headingFor[summary];
+    return `
 <!doctype html>
 <html>
   <head>
     <meta name="viewport" content="width=device-width">
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-    <title>Your member import is complete</title>
+    <title>${heading}</title>
     <style>
     /* -------------------------------------
         RESPONSIVE AND MOBILE FRIENDLY STYLES
@@ -115,7 +128,7 @@ module.exports = ({result, siteUrl, membersUrl, emailRecipient}) => `
           <div class="content" style="box-sizing: border-box; display: block; Margin: 0 auto; max-width: 600px; padding: 30px 20px;">
 
             <!-- START CENTERED CONTAINER -->
-            <span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">Your member import is complete</span>
+            <span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">${heading}</span>
             <table class="main" style="border-collapse: separate; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; background: #ffffff; border-radius: 8px;">
 
               <!-- START MAIN CONTENT AREA -->
@@ -127,32 +140,32 @@ module.exports = ({result, siteUrl, membersUrl, emailRecipient}) => `
                       </tr>
                       <tr>
                           <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; vertical-align: top;">
-                            <p class="title" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 21px; color: #3A464C; font-weight: normal; line-height: 25px; margin-bottom: 30px; margin-top: 50px; font-weight: 600; color: #15212A;">${iff(result.imported > 0, `Your member import is complete`, `Your member import was unsuccessful`)}</p>
+                            <p class="title" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 21px; color: #3A464C; font-weight: normal; line-height: 25px; margin-bottom: 30px; margin-top: 50px; font-weight: 600; color: #15212A;">${heading}</p>
                           </td>
                       </tr>
-                    ${iff(result.imported === 0 && result.errors.length === 0, `
+                    ${iff(summary === 'did-not-run', `
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; padding-bottom: 16px;">
-                          <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 0px;">No members were added.</p>
+                          <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 0px;">Something went wrong on our end and your import couldn't be completed. There's nothing wrong with your file. Please try uploading it again.</p>
                       </td>
                     </tr>
                     `, ``)}
-                    ${iff(result.imported > 0, `
+                    ${iff(summary === 'added', `
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; padding-bottom: 16px;">
-                          <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 0px;">A total of <strong style="font-weight: 600;">${formatNumber(result.imported)}</strong> ${iff(result.imported === 1, 'person', 'people')} were successfully added or updated in your list of members, and now have access to your site.</p>
+                          <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 0px;">A total of <strong style="font-weight: 600;">${formatNumber(imported)}</strong> ${iff(imported === 1, 'person was', 'people were')} successfully added or updated in your list of members, and now ${iff(imported === 1, 'has', 'have')} access to your site.</p>
                       </td>
                     </tr>`, ``)}
-                    ${iff(result.errors.length > 0, `
+                    ${iff(errorCount > 0, `
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; padding-bottom: 16px;">
                         <p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 16px; color: #3A464C; font-weight: normal; margin: 0; line-height: 25px; margin-bottom: 0px;">
-                        ${iff(result.imported === 0, `No members were added.`, `<strong style="font-weight: 600;">${formatNumber(result.errors.length)}</strong> ${iff(result.errors.length === 1, `member was`, `members were`)} skipped due to errors.`)} There's a validated CSV file attached to this email with the list of errors so that you can fix them and re-upload the CSV to complete the import.</p>
+                        ${iff(summary === 'all-failed', `No members were added.`, `<strong style="font-weight: 600;">${formatNumber(errorCount)}</strong> ${iff(errorCount === 1, `member was`, `members were`)} skipped due to errors.`)} The CSV file attached to this email lists each one with the reason it wasn't imported.</p>
                       </td>
                     </tr>`, '')}
                     <tr>
                       <td style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; padding-bottom: 12px; padding-top: 16px;">
-                        <a href="${membersUrl.href}" target="_blank" style="display: inline-block; color: #ffffff; background-color: #15212A; border: solid 1px #15212A; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: #15212A;">${iff(result.imported > 0, `View members`, `Try again`)}</a>
+                        <a href="${membersUrl.href}" target="_blank" style="display: inline-block; color: #ffffff; background-color: #15212A; border: solid 1px #15212A; border-radius: 5px; box-sizing: border-box; cursor: pointer; text-decoration: none; font-size: 16px; font-weight: normal; margin: 0; padding: 9px 22px 10px; border-color: #15212A;">${iff(summary === 'added', `View members`, `Try again`)}</a>
                       </td>
                     </tr>
                   </table>
@@ -179,4 +192,4 @@ module.exports = ({result, siteUrl, membersUrl, emailRecipient}) => `
   </body>
 </html>
 `;
-
+}

package/core/server/services/members/import-export/import/importer.js

@@ -10,7 +10,6 @@ const csv_2 = require("@tryghost/custom-field-types/csv");
 const metrics = require('@tryghost/metrics');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
-const logging = require('@tryghost/logging');
 const messages = {
     freeMemberNotAllowedImportTier: 'You cannot import a free member with a specified tier.',
     invalidImportTier: '"{tier}" is not a valid tier.',
@@ -51,10 +50,11 @@ class MembersCSVImporter {
     _gifts;
     _customFields;
     _email;
+    _report;
     _addJob;
     _getTimezone;
     _getInlineThreshold;
-    constructor({ knex, readRows, spool, members, tiers, stripe, gifts, customFields, email, addJob, getTimezone, getInlineThreshold }) {
+    constructor({ knex, readRows, spool, members, tiers, stripe, gifts, customFields, email, report, addJob, getTimezone, getInlineThreshold }) {
         this._knex = knex;
         this._readRows = readRows;
         this._spool = spool;
@@ -64,6 +64,7 @@ class MembersCSVImporter {
         this._gifts = gifts;
         this._customFields = customFields;
         this._email = email;
+        this._report = report;
         this._addJob = addJob;
         this._getTimezone = getTimezone;
         this._getInlineThreshold = getInlineThreshold;
@@ -73,8 +74,7 @@ class MembersCSVImporter {
         const labelName = buildImportLabelName(this._getTimezone());
         const extraLabels = request.extraLabels ?? [];
         if (canImportInline(rows.length, hasExpensiveColumns(rows), this._getInlineThreshold())) {
-            const result = await this.importRows(rows, labelName, extraLabels);
-            await verificationTrigger.testImportThreshold();
+            const result = await this.importRows(rows, labelName, extraLabels, verificationTrigger);
             return { deferred: false, originalImportSize: rows.length, result };
         }
         await this.deferImport(rows, { labelName, extraLabels, requestUserEmail: request.requestUserEmail }, verificationTrigger);
@@ -82,9 +82,7 @@ class MembersCSVImporter {
     }
     async importInline(request, verificationTrigger) {
         const rows = await this._readRows(request.filePath, request.mapping);
-        const result = await this.importRows(rows, buildImportLabelName(this._getTimezone()), request.extraLabels ?? []);
-        await verificationTrigger.testImportThreshold();
-        return result;
+        return this.importRows(rows, buildImportLabelName(this._getTimezone()), request.extraLabels ?? [], verificationTrigger);
     }
     async deferImport(rows, { labelName, extraLabels, requestUserEmail }, verificationTrigger) {
         // Resolved here, not at the API boundary, so the owner lookup only runs when
@@ -97,57 +95,80 @@ class MembersCSVImporter {
             name: 'members-import'
         });
     }
-    // Swallows its own errors: a failed import or email must not leave the queued job
-    // rejected, and the verification trigger must still run afterwards either way.
+    // Must resolve in every case: the job manager reads a rejected inline job as a defect
+    // in the job itself, and there is no retry behind it.
     async runImportJob(spooled, { labelName, extraLabels, emailRecipient }, verificationTrigger) {
+        // Null until the import produces one: parsing and mapping already happened inside
+        // the request, so anything failing from here is ours rather than the file's.
+        let result = null;
         try {
             const spooledRows = await spooled.read();
-            const result = await this.importRows(spooledRows, labelName, extraLabels);
-            const importLabel = result.importLabel ?? null;
-            await this._email.send((0, completion_email_1.default)({
-                result,
-                recipient: emailRecipient,
-                labelName,
-                importLabel,
-                urlFor: this._email.urlFor
-            }));
+            result = await this.importRows(spooledRows, labelName, extraLabels, verificationTrigger);
         }
-        catch (e) {
-            logging.error('Error in members import job');
-            logging.error(e);
+        catch (error) {
+            // importRows only throws before its write loop, so nothing was written.
+            this._report(error);
         }
         finally {
-            await spooled.remove();
+            await this.settle(() => spooled.remove());
         }
-        try {
+        // Whatever became of it, the publisher hears exactly once. If this is what fails,
+        // there is nobody left to tell but us.
+        await this.settle(() => this._email.send((0, completion_email_1.default)({
+            result,
+            recipient: emailRecipient,
+            labelName,
+            links: this._email.links
+        })));
+    }
+    // Only the write itself may throw. Callers rely on that to tell an import that never
+    // ran from one that ran and then failed to tidy up after itself.
+    async importRows(rows, labelName, extraLabels, verificationTrigger) {
+        const startedAt = Date.now();
+        const prepared = await this.prepareRun(labelName, extraLabels);
+        const written = await this.writeRows(rows, prepared);
+        const result = { imported: written.imported, errors: written.errors };
+        // Bookkeeping, and the publisher's result is already in hand. Nothing below is
+        // load-bearing for what they are told, so it is left to throw into one report
+        // rather than each step defending itself. The label is read first because only
+        // it reaches the publisher, as the link their email arrives with.
+        await this.settle(async () => {
+            if (written.imported > 0) {
+                result.importLabel = (await this._members.getImportLabel(labelName))?.toJSON();
+            }
+            await metrics.metric('members-import', {
+                imported: written.imported,
+                errors: written.errors.length,
+                value: Date.now() - startedAt
+            });
+            await this.archiveStripePrices(written.archivableStripePriceIds);
             await verificationTrigger.testImportThreshold();
-        }
-        catch (e) {
-            logging.error('Error in members import job when testing import threshold');
-            logging.error(e);
-        }
+        });
+        return result;
+    }
+    async prepareRun(labelName, extraLabels) {
+        return {
+            defaultTier: await this._tiers.getDefault(),
+            // Empty when the feature is off, so a carried-through column is dropped.
+            activeCustomFields: await this._customFields.activeFields(),
+            globalLabels: [{ name: labelName }, ...extraLabels]
+        };
     }
-    // The members import kernel, shared by the inline and deferred paths. Each row is
-    // created or updated in its own transaction, so one row's failure rolls back only
-    // itself; failures are collected, and any Stripe prices an import tier created are
-    // archived at the end.
-    async importRows(rows, labelName, extraLabels) {
-        const importLabel = { name: labelName };
-        const globalLabels = [importLabel, ...extraLabels];
-        const performStart = Date.now();
-        const defaultTier = await this._tiers.getDefault();
-        // The field set a custom_fields.* column is read against; empty when the feature
-        // is off, so a carried-through column is dropped and the write boundary stays shut.
-        const activeCustomFields = await this._customFields.activeFields();
+    // Must not throw: once a row has committed, an import that failed halfway is not one
+    // that never ran.
+    async writeRows(rows, prepared) {
+        const { defaultTier, activeCustomFields } = prepared;
         const tierIdCache = new Map();
         const archivableStripePriceIds = [];
         // Copied per row: the member model stamps ids and trims names onto these in
         // place, and each row runs in its own transaction that can roll back. A
         // caller can hand in a nameless label, which the model would drop anyway.
-        const cloneGlobalLabels = () => globalLabels
+        const cloneGlobalLabels = () => prepared.globalLabels
             .map(label => ({ ...label }))
             .filter(label => label.name);
         let imported = 0;
+        let rollbackFailures = 0;
+        let firstRollbackFailure;
         const importErrors = [];
         for (const row of rows) {
             let trx;
@@ -270,22 +291,49 @@ class MembersCSVImporter {
                     .filter((message) => typeof message === 'string');
                 const errorMessage = reasons.join('\n');
                 // trx is unset if the row failed before the transaction opened (a bad
-                // custom field value or gift combination).
+                // custom field value or gift combination). A rejected rollback must not
+                // escape: rows before this one are already committed, and a throw leaving
+                // here would be read as an import that never wrote anything.
                 if (trx) {
-                    await trx.rollback();
+                    try {
+                        await trx.rollback();
+                    }
+                    catch (rollbackError) {
+                        firstRollbackFailure ??= rollbackError;
+                        rollbackFailures += 1;
+                    }
                 }
                 importErrors.push({ ...row, error: errorMessage, errors: reasons });
             }
         }
-        await Promise.all(archivableStripePriceIds.map(id => this._stripe.archivePrice(id)));
-        metrics.metric('members-import', { imported, errors: importErrors.length, value: Date.now() - performStart });
-        if (imported > 0) {
-            // The import label exists now that members carry it, so fetch it to report.
-            // Guarded against a null lookup in case a row is ever counted without it.
-            const importLabelModel = await this._members.getImportLabel(labelName);
-            return { imported, errors: importErrors, importLabel: importLabelModel?.toJSON() };
+        if (rollbackFailures > 0) {
+            this._report(new errors.InternalServerError({
+                message: `Failed to roll back ${rollbackFailures} of ${rows.length} member rows`,
+                err: firstRollbackFailure
+            }));
+        }
+        return { imported, errors: importErrors, archivableStripePriceIds };
+    }
+    async settle(work) {
+        try {
+            return await work();
+        }
+        catch (error) {
+            this._report(error);
+            return undefined;
+        }
+    }
+    async archiveStripePrices(priceIds) {
+        // allSettled so one unarchivable price neither hides the others nor stops them
+        // being attempted.
+        const attempts = await Promise.allSettled(priceIds.map(id => this._stripe.archivePrice(id)));
+        const failed = attempts.filter(attempt => attempt.status === 'rejected');
+        if (failed.length > 0) {
+            throw new errors.InternalServerError({
+                message: `Failed to archive ${failed.length} of ${attempts.length} Stripe prices created by this import`,
+                err: failed[0].reason
+            });
         }
-        return { imported: 0, errors: importErrors };
     }
 }
 // A row error is read next to a spreadsheet, and a value rejection states only what the

package/core/server/services/members/import-export/import/spool.js

@@ -22,7 +22,7 @@ function createRowSpool() {
                     return JSON.parse(await fs_extra_1.default.readFile(spoolPath, 'utf8'));
                 },
                 async remove() {
-                    await fs_extra_1.default.remove(spoolPath).catch(() => { });
+                    await fs_extra_1.default.remove(spoolPath);
                 }
             };
         }

package/core/server/services/members/import-export/index.js

@@ -13,6 +13,8 @@ const MembersCSVImporterStripeUtils = require('./import/stripe-utils');
 const db = require('../../../data/db');
 const models = require('../../../models');
 const labs = require('../../../../shared/labs');
+const logging = require('@tryghost/logging');
+const sentry = require('../../../../shared/sentry');
 // Build the members CSV importer. This is the composition root: today's models and
 // services are wired behind the collaborators the importer declares, one per
 // concern, so nothing Bookshelf-shaped leaks into the import service itself.
@@ -35,7 +37,16 @@ function makeImporter(deps) {
     const email = {
         send: deps.sendEmail,
         getDefaultRecipient: async () => (await models.User.getOwnerUser()).get('email'),
-        urlFor: deps.urlFor
+        links: {
+            siteUrl: () => new URL(deps.urlFor('home', null, true)),
+            membersUrl: (labelSlug) => {
+                const url = new URL('members', deps.urlFor('admin', null, true));
+                if (labelSlug) {
+                    url.searchParams.set('label', labelSlug);
+                }
+                return url;
+            }
+        }
     };
     // Gifts is initialised at boot and always present at request time; the getter
     // resolves it lazily so the ready service is picked up whenever a row uses it.
@@ -54,6 +65,17 @@ function makeImporter(deps) {
         planWrite: values => deps.customFields.values.planWrite(values),
         applyWrite: (memberId, plan, executor) => deps.customFields.values.applyWrite(memberId, plan, { executor })
     };
+    // Inline jobs never reach the job manager's Sentry handler, which is wired to the
+    // offloaded worker path only, so a throw here would be seen by nobody.
+    const report = (error) => {
+        try {
+            logging.error({ event: { name: 'members.import.error' }, err: error }, 'Members import failure');
+            sentry.captureException(error);
+        }
+        catch {
+            // Callers report from catch and finally blocks, so this must not throw.
+        }
+    };
     return new importer_1.default({
         knex: deps.knex,
         readRows: reader_1.default,
@@ -70,6 +92,7 @@ function makeImporter(deps) {
         gifts,
         customFields,
         email,
+        report,
         addJob: deps.addJob,
         getTimezone: deps.getTimezone,
         getInlineThreshold: deps.getInlineThreshold

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -33,7 +33,7 @@ const CUSTOM_FIELDS_EDITED_ACTION = 'custom_fields_edited';
  */
 
 /**
- * @typedef {object} IGiftServiceWrapper
+ * @typedef {object} IGiftsModule
  * @prop {{getMemberPresentations: (memberIds: string[]) => Promise<Map<string, {cadence: 'month' | 'year', currency: string, amount: number}>>}} service
  */
 
@@ -49,7 +49,7 @@ module.exports = class MemberBREADService {
      * @param {import('../../../email-suppression-list/email-suppression-list').IEmailSuppressionList} deps.emailSuppressionList
      * @param {import('../../../settings-helpers/settings-helpers')} deps.settingsHelpers
      * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
-     * @param {IGiftServiceWrapper} deps.giftService
+     * @param {IGiftsModule} deps.giftService
      * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
      */
     constructor({memberRepository, labsService, emailService, stripeService, offersAPI, memberAttributionService, emailSuppressionList, settingsHelpers, nextPaymentCalculator, commentsService, giftService, customFieldValues}) {

package/core/server/services/members/members-config-provider.js

@@ -1,5 +1,15 @@
+const crypto = require('node:crypto');
 const logging = require('@tryghost/logging');
-const createKeypair = require('keypair');
+
+// PKCS#1 PEM, matching the format previously generated by `keypair`
+const generateKeypair = () => {
+    const {publicKey, privateKey} = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: {type: 'pkcs1', format: 'pem'},
+        privateKeyEncoding: {type: 'pkcs1', format: 'pem'}
+    });
+    return {public: publicKey, private: privateKey};
+};
 
 class MembersConfigProvider {
     /**
@@ -54,7 +64,7 @@ class MembersConfigProvider {
 
         if (!privateKey || !publicKey) {
             logging.warn('Could not find members_private_key, using dynamically generated keypair');
-            const keypair = createKeypair({bits: 1024});
+            const keypair = generateKeypair();
             privateKey = keypair.private;
             publicKey = keypair.public;
         }

package/core/server/services/members-custom-fields/actions.js

@@ -11,6 +11,7 @@ const logging_1 = __importDefault(require("@tryghost/logging"));
 const COMMANDS = {
     create: 'added',
     rename: 'edited',
+    reorder: 'edited',
     archive: 'archived',
     restore: 'restored',
     delete: 'deleted'
@@ -26,7 +27,7 @@ async function recordCustomFieldAction({ Action, context, verb, subject, details
             resource_type: 'member_custom_field',
             // The field's id: this column holds 24 characters, and a key minted from
             // a publisher-chosen name is bounded by the far wider key column, so only
-            // the id fits every field.
+            // the id fits every field. Null where the act had no single field.
             resource_id: subject,
             actor_type: context.actor.type,
             actor_id: context.actor.id,