ghost 6.57.1 → 6.58.0

package/core/server/services/members-custom-fields/definitions-service.js

@@ -11,8 +11,7 @@ const custom_field_types_1 = require("@tryghost/custom-field-types");
 const codec_1 = require("./codec");
 const schema_1 = require("./schema");
 const queries_1 = require("./queries");
-// @tryghost/string ships no types; slugify is the same helper tags/labels use.
-const { slugify } = require('@tryghost/string');
+const key_1 = require("./key");
 // The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to
 // our raw-knex query: nql parses the `filter` string to a Mongo query, mongo-knex
 // turns that into parametrised WHERE clauses. Neither needs a Bookshelf model.
@@ -26,21 +25,19 @@ const TABLE = 'members_custom_fields';
 const columns = require('../../data/schema').tables[TABLE];
 const MAX_NAME_LENGTH = columns.name.maxlength;
 const MAX_KEY_LENGTH = columns.key.maxlength;
-const MAX_SLUG_ITERATIONS = 1000;
-// Reserve room for a `-<n>` suffix (n up to MAX_SLUG_ITERATIONS).
-const MAX_KEY_BASE_LENGTH = MAX_KEY_LENGTH - (String(MAX_SLUG_ITERATIONS).length + 1);
+const MAX_KEY_ITERATIONS = 1000;
+// Reserve room for a `_<n>` suffix (n up to MAX_KEY_ITERATIONS).
+const MAX_KEY_BASE_LENGTH = MAX_KEY_LENGTH - (String(MAX_KEY_ITERATIONS).length + 1);
 // A key becomes a property name on the plain objects that carry a member's values —
 // on both sides of the wire, since `custom_fields` is JSON and a client gets a plain
 // object from JSON.parse. A key naming a member of Object.prototype reads back as
-// inherited rather than absent wherever one of those objects is indexed, and
-// `__proto__` holds no value at all: the values schema drops it during parse, and
-// assigning it sets a prototype rather than a property.
+// inherited rather than absent wherever one of those objects is indexed.
 //
 // Derived rather than listed, because the set is a consequence of how keys are
-// minted: slugifying lowercases, so only an already-lowercase prototype name can
-// survive to become a key. Currently `constructor` and `__proto__`.
+// minted: minting lowercases and trims leading underscores, so a prototype name
+// survives only if it has neither. `constructor` is the only one.
 const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype)
-    .filter(name => slugify(name) === name);
+    .filter(name => (0, key_1.mintableKey)(name) === name);
 const FieldName = zod_1.z.string().trim().min(1, { message: 'Custom field name is required.' }).max(MAX_NAME_LENGTH, { message: 'Custom field name is too long.' });
 // The backend mints the key from the name, so create takes just a name and type.
 const AddFieldInput = zod_1.z.object({
@@ -58,6 +55,11 @@ const MAX_FIELDS_PER_REQUEST = 100;
 const AddFieldsInput = zod_1.z.array(AddFieldInput)
     .min(1)
     .max(MAX_FIELDS_PER_REQUEST, { message: `Custom fields can only be created ${MAX_FIELDS_PER_REQUEST} at a time.` });
+// Only the key is read; the client sends whole field objects because that is the shape
+// the API speaks in.
+const ReorderInput = zod_1.z.array(zod_1.z.object({
+    key: zod_1.z.string().min(1, { message: 'Every custom field in the order needs a key.' })
+})).min(1, { message: 'The order must name every custom field.' });
 // Name and status are mutable. `key` and `type` are accepted so the immutability
 // rules can reject a change loudly; they are never persisted.
 const EditFieldInput = zod_1.z.object({
@@ -86,15 +88,21 @@ class CustomFieldDefinitionsService {
         // supplied `filter` can widen that — Settings pulls active and archived
         // together in one request (`filter=status:[active,archived]`).
         //
-        // Insertion order for now — when the UI needs a persistent user-defined
-        // order, add a `sort_order` column and order by it.
+        // Whichever set comes back, it comes back in the publisher's order: filtering
+        // narrows the list, it never reorders it.
         const query = options.filter
             ? applyFilter(this.knex(TABLE), options.filter)
             : (0, queries_1.activeFields)(this.knex);
-        const rows = await query
-            .orderBy('created_at', 'asc')
-            .orderBy('id', 'asc')
-            .select('*');
+        return this.list(query);
+    }
+    /**
+     * Decode a definition query into the domain, in the publisher's order.
+     *
+     * Typed off `activeFields` so the builder keeps the table's row type: every caller
+     * hands over a query against the definitions table, whatever it has narrowed.
+     */
+    async list(query) {
+        const rows = await (0, queries_1.inFieldOrder)(query).select('*');
         return rows.map(row => zod_1.z.decode(codec_1.customFieldCodec, row));
     }
     async read(key) {
@@ -111,8 +119,8 @@ class CustomFieldDefinitionsService {
      *
      * Running inside the transaction also makes a batch self-consistent for free —
      * `assertNameAvailable` and `mintKey` see the rows inserted earlier in the same
-     * batch, so two items sharing a name are caught and two items sharing a slug
-     * get distinct keys, exactly as if they had arrived as separate requests.
+     * batch, so two items sharing a name are caught and two items deriving the same
+     * key get distinct ones, exactly as if they had arrived as separate requests.
      */
     async add(context, input) {
         const requestedCount = Array.isArray(input) ? input.length : 0;
@@ -126,10 +134,10 @@ class CustomFieldDefinitionsService {
             });
         }
         const fields = parsed.data;
-        // Slugify before opening the transaction: it needs no database access, and
+        // Mint before opening the transaction: it needs no database access, and
         // an unusable name is a payload problem worth reporting on its own terms.
         const bases = fields.map((field, index) => {
-            const base = slugify(field.name);
+            const base = (0, key_1.mintableKey)(field.name);
             if (!base) {
                 throw new errors_1.default.ValidationError({
                     message: 'Custom field name must contain at least one usable character.',
@@ -143,11 +151,22 @@ class CustomFieldDefinitionsService {
         try {
             created = await this.knex.transaction(async (trx) => {
                 await this.assertWithinLimit(trx, fields.length);
+                // Read once, before the loop: a batch appends as consecutive ranks, so
+                // the five fields of one request land in the order the request gave
+                // them rather than all sharing the end of the list.
+                const firstSortOrder = await this.nextSortOrder(trx);
                 const keys = [];
                 for (const [index, field] of fields.entries()) {
                     await this.assertNameAvailable(trx, field.name);
                     const key = await this.mintKey(trx, bases[index]);
-                    await trx(TABLE).insert({ id: new bson_objectid_1.default().toHexString(), key, name: field.name, type: field.type, created_at: new Date() });
+                    await trx(TABLE).insert({
+                        id: new bson_objectid_1.default().toHexString(),
+                        key,
+                        name: field.name,
+                        type: field.type,
+                        sort_order: firstSortOrder + index,
+                        created_at: new Date()
+                    });
                     keys.push(key);
                 }
                 return this.readMany(trx, keys);
@@ -210,6 +229,66 @@ class CustomFieldDefinitionsService {
             errorDetails: { limit: max, total, requested: addedCount }
         });
     }
+    /**
+     * Set the order of the whole list, stated rather than adjusted: every row gets a
+     * fresh rank, so a move is well-defined even where every rank is still the default.
+     * Returns every definition, archived included, matching what the request named.
+     */
+    async reorder(context, input) {
+        const parsed = ReorderInput.safeParse(input);
+        if (!parsed.success) {
+            const issue = parsed.error.issues[0];
+            throw new errors_1.default.ValidationError({ message: issue.message, property: propertyOf(issue.path) });
+        }
+        const keys = parsed.data.map(item => item.key);
+        const ordered = await this.knex.transaction(async (trx) => {
+            await this.assertNamesEveryField(trx, keys);
+            // Ranks come from the request's order; the statements go out in key order, so
+            // two concurrent reorders take their row locks in the same sequence and
+            // cannot deadlock. `updated_at` is left alone — the definitions did not
+            // change, the list around them did.
+            const ranks = new Map(keys.map((key, rank) => [key, rank]));
+            for (const key of [...keys].sort()) {
+                await trx(TABLE).where('key', key).update({ sort_order: ranks.get(key) });
+            }
+            return this.list(trx(TABLE));
+        });
+        await this.recordAction({
+            context,
+            verb: 'reorder',
+            subject: null,
+            details: { action_name: 'reordered', count: ordered.length }
+        });
+        return ordered;
+    }
+    /**
+     * A partial order is ambiguous, so a reorder that does not name every field exactly
+     * once is refused rather than half-applied. A client that loaded before a colleague
+     * added a field cannot name it, and is told to reload.
+     */
+    async assertNamesEveryField(db, keys) {
+        const named = new Set(keys);
+        const existing = new Set(await db(TABLE).pluck('key'));
+        const matches = named.size === keys.length
+            && named.size === existing.size
+            && keys.every(key => existing.has(key));
+        if (!matches) {
+            throw new errors_1.default.ValidationError({
+                message: 'The order must name every custom field exactly once. Reload and try again.',
+                property: 'key'
+            });
+        }
+    }
+    /** A new field is appended. Archived fields hold ranks too, so it lands past them. */
+    async nextSortOrder(db) {
+        const row = await db(TABLE).max({ highest: 'sort_order' }).first();
+        const highest = row?.highest;
+        // No fields yet, so this one starts the order.
+        if (highest === null || highest === undefined) {
+            return 0;
+        }
+        return Number(highest) + 1;
+    }
     /** Read back a batch in the order its keys were created, not the table's order. */
     async readMany(db, keys) {
         const rows = await db(TABLE).whereIn('key', keys).select('*');
@@ -217,12 +296,15 @@ class CustomFieldDefinitionsService {
         return keys.map(key => zod_1.z.decode(codec_1.customFieldCodec, byKey.get(key)));
     }
     /**
-     * Pick a free key from the name's slug: `base`, then `base-2`, `base-3`, ...
+     * Pick a free key from the name's base: `base`, then `base_2`, `base_3`, ...
      * Reads the keys already taken by that base — including archived fields, so a
-     * slug is never reused once minted. Mirrors how tags/labels generate slugs.
+     * key is never reused once minted.
      */
     async mintKey(db, base) {
-        const safeBase = base.slice(0, MAX_KEY_BASE_LENGTH);
+        // Trimmed again after cutting, because the cut can land mid-separator and
+        // a key that ends in one is not a shape minting is allowed to produce. The
+        // base starts with an alphanumeric, so something always survives.
+        const safeBase = base.slice(0, MAX_KEY_BASE_LENGTH).replace(/_+$/, '');
         const taken = new Set([
             ...RESERVED_KEYS,
             ...await db(TABLE).where('key', 'like', `${safeBase}%`).pluck('key')
@@ -230,8 +312,8 @@ class CustomFieldDefinitionsService {
         if (!taken.has(safeBase)) {
             return safeBase;
         }
-        for (let suffix = 2; suffix <= MAX_SLUG_ITERATIONS; suffix += 1) {
-            const candidate = `${safeBase}-${suffix}`;
+        for (let suffix = 2; suffix <= MAX_KEY_ITERATIONS; suffix += 1) {
+            const candidate = `${safeBase}_${suffix}`;
             if (!taken.has(candidate)) {
                 return candidate;
             }

package/core/server/services/members-custom-fields/filter.js

@@ -0,0 +1,199 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CUSTOM_FIELDS_RELATION = void 0;
+exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransformer;
+// The members filter reaches custom field values through a `custom_fields` relation
+// on the Member model (the values table joined on member_id). A field is named by its
+// `key` — the stable public slug — and matched on its `value`; a composite field's
+// part is named as `value.<part>`, and a part's presence as `path.<part>`:
+//
+//   (custom_fields.key:'company'+custom_fields.value:'Ghost')               // value
+//   (custom_fields.key:'shipping_address'+custom_fields.value.country:'GB')
+//   custom_fields.key:'phone'  /  custom_fields.key:-'phone'                // field set / not set
+//   (custom_fields.key:'shipping_address'+custom_fields.path:'country')     // part set
+//   (custom_fields.key:'shipping_address'+custom_fields.path:-'country')    // part not set
+//
+// The values table stores one row per leaf: `custom_field_key` (the field's stable key),
+// `path` (empty for a scalar, the part's key for a composite), and `value_text`. A scalar
+// field is just a leaf at path ''; "the field", "a part", and "the whole field" are the
+// same thing — a set of leaf rows pinned by (custom_field_key, [path], [value]). So every
+// filter is one `$elemMatch` over those columns: positive asserts a matching leaf exists,
+// `$not` asserts none does. The public grammar is the storage vocabulary here — the key
+// sits on the row — so the transformer emits it straight, with no id lookup and no field
+// catalog read. That is what lets the Member model chain it inline on every members query,
+// rather than each call site remembering to wire it. A key that names no current field
+// matches no leaf; the admin never offers an archived or deleted field in the filter UI,
+// though the API leaves them queryable.
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const RELATION = 'custom_fields';
+const PREFIX = `${RELATION}.`;
+const KEY_ATTRIBUTE = `${PREFIX}key`;
+const VALUE_ATTRIBUTE = `${PREFIX}value`;
+const PATH_ATTRIBUTE = `${PREFIX}path`;
+const ROOT_PATH = '';
+// Only recurse into plain objects/arrays; a RegExp, Date, etc. is a leaf value that
+// must pass through by reference (recursing would strip a regex to `{}`).
+function isPlainObject(value) {
+    return typeof value === 'object'
+        && value !== null
+        && !Array.isArray(value)
+        && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+// A single-clause object whose one key targets the custom_fields relation.
+function isCustomFieldClause(node) {
+    if (!isPlainObject(node)) {
+        return false;
+    }
+    const keys = Object.keys(node);
+    return keys.length === 1 && keys[0].startsWith(PREFIX);
+}
+// A grouped compound: an $and whose clauses all target the relation and name exactly one
+// `key`. Its clauses describe one leaf row.
+//
+// Exactly one, not at least one: two whole-field filters ANDed together arrive as a flat
+// `key:'a'+key:'b'`, since a bare key clause needs no group of its own. That is two
+// filters — a member with a value for both — not one leaf that is somehow both fields, so
+// it has to fall through and be transformed a clause at a time.
+function isCustomFieldCompound(clauses) {
+    if (!Array.isArray(clauses) || clauses.length < 2 || !clauses.every(isCustomFieldClause)) {
+        return false;
+    }
+    return clauses.filter(clause => Object.keys(clause)[0] === KEY_ATTRIBUTE).length === 1;
+}
+// `custom_fields.value` addresses the scalar (root) leaf; `custom_fields.value.<part>`
+// a composite's part. Returns the row `path` the attribute selects, or null if the
+// attribute isn't a value clause.
+function pathForValueAttribute(attribute) {
+    if (attribute === VALUE_ATTRIBUTE) {
+        return ROOT_PATH;
+    }
+    if (attribute.startsWith(`${VALUE_ATTRIBUTE}.`)) {
+        return attribute.slice(`${VALUE_ATTRIBUTE}.`.length);
+    }
+    return null;
+}
+// The single `{$ne}` shape all negations arrive as (is-not-set on a key or part).
+function negatedString(value) {
+    return isPlainObject(value) && typeof value.$ne === 'string' ? value.$ne : null;
+}
+function createCustomFieldsFilterTransformer() {
+    // The grammar carries the field key in the clause value; take it as a string,
+    // defaulting to one no field can hold so a malformed clause matches nothing.
+    const keyOf = (value) => (typeof value === 'string' ? value : '');
+    // One (maybe-negated) $elemMatch over the leaf columns: positive is "a leaf pinned
+    // by these matches", `$not` is "no leaf does".
+    function buildElemMatch(fieldKey, conditions, negate) {
+        const match = { custom_field_key: fieldKey, ...conditions };
+        if (negate) {
+            return { [RELATION]: { $not: { $elemMatch: match } } };
+        }
+        return { [RELATION]: { $elemMatch: match } };
+    }
+    // A `(key + value[.part] | path)` compound. A `value` clause pins the part and its
+    // value; a `path` clause pins the part's presence (no value), and a negated path is
+    // is-not-set — no such leaf — which negates the whole match.
+    function toElemMatch(clauses) {
+        let fieldKey = '';
+        let hasKey = false;
+        let hasLeaf = false;
+        const conditions = {};
+        let negate = false;
+        const oneLeafOnly = () => {
+            if (hasLeaf) {
+                throw new errors_1.default.BadRequestError({
+                    message: 'A custom field filter takes one value or path clause.'
+                });
+            }
+            hasLeaf = true;
+        };
+        for (const clause of clauses) {
+            const [attribute, value] = Object.entries(clause)[0];
+            if (attribute === KEY_ATTRIBUTE) {
+                if (hasKey) {
+                    throw new errors_1.default.BadRequestError({
+                        message: `A custom field filter takes one "${KEY_ATTRIBUTE}" clause.`
+                    });
+                }
+                hasKey = true;
+                fieldKey = keyOf(value);
+            }
+            else if (attribute === PATH_ATTRIBUTE) {
+                oneLeafOnly();
+                const negatedPath = negatedString(value);
+                conditions.path = negatedPath ?? value;
+                negate = negatedPath !== null;
+            }
+            else {
+                const path = pathForValueAttribute(attribute);
+                if (path === null) {
+                    // Not the key, a value/value.<part>, or a path: it names no leaf
+                    // column, so dropping it would silently widen the match to the key
+                    // alone. Fail closed instead.
+                    throw new errors_1.default.BadRequestError({
+                        message: `Unsupported custom field filter clause "${attribute}".`
+                    });
+                }
+                oneLeafOnly();
+                conditions.path = path;
+                conditions.value_text = value;
+            }
+        }
+        return buildElemMatch(fieldKey, conditions, negate);
+    }
+    // A standalone `key` clause is whole-field is-set / is-not-set: a leaf for this
+    // field exists (any part), or none does.
+    function fromKeyClause(value) {
+        const negatedKey = negatedString(value);
+        if (negatedKey !== null) {
+            return buildElemMatch(keyOf(negatedKey), {}, true);
+        }
+        return buildElemMatch(keyOf(value), {}, false);
+    }
+    function transform(node) {
+        if (Array.isArray(node)) {
+            return node.map(transform);
+        }
+        if (!isPlainObject(node)) {
+            return node;
+        }
+        if (isCustomFieldCompound(node.$and)) {
+            return toElemMatch(node.$and);
+        }
+        const out = {};
+        for (const [key, value] of Object.entries(node)) {
+            if (key === KEY_ATTRIBUTE) {
+                Object.assign(out, fromKeyClause(value));
+            }
+            else if (key.startsWith(PREFIX)) {
+                // A value or path clause only means something paired with its key in one
+                // leaf, which arrives as the compound handled above. A `custom_fields.*`
+                // clause reaching here is unpaired (or its pair was not grouped), so fail
+                // closed rather than pass it to mongo-knex as a column that does not exist.
+                throw new errors_1.default.BadRequestError({
+                    message: `A "${key}" filter must be grouped with its "${KEY_ATTRIBUTE}" clause, for example (${KEY_ATTRIBUTE}:'a_field'+${VALUE_ATTRIBUTE}:'a value').`
+                });
+            }
+            else {
+                out[key] = transform(value);
+            }
+        }
+        return out;
+    }
+    return (query) => transform(query);
+}
+/**
+ * The Member filter relation that exposes custom field values. A member has many leaf
+ * rows (one per field, or per part of a composite field), and a predicate asks whether
+ * one of them matches, so this joins the values table on member_id and mongo-knex emits
+ * it as a correlated `members.id IN (…)` subquery — composing with every other member
+ * filter. Registered only behind the `membersCustomFields` flag.
+ */
+exports.CUSTOM_FIELDS_RELATION = {
+    tableName: 'members_custom_field_values',
+    tableNameAs: RELATION,
+    type: 'oneToOne',
+    joinFrom: 'member_id'
+};

package/core/server/services/members-custom-fields/key.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_CHARACTERS = void 0;
+exports.mintableKey = mintableKey;
+// Neither package ships types.
+const { stripInvisibleChars } = require('@tryghost/string');
+const unidecode = require('unidecode');
+/** Every character a key may contain. Nothing else survives minting. */
+exports.KEY_CHARACTERS = /^[a-z0-9_]+$/;
+/**
+ * Mint the key a field is addressed by, from the name a publisher chose.
+ *
+ * A key is typed by hand into member filters, CSV columns, email replacement strings
+ * and, later, themes. Those agree on letters, digits and the underscore, and disagree
+ * about everything else, so what a key may contain is stated here as an allowlist
+ * rather than inherited from slugify, whose separator and reserved characters answer
+ * to URLs. The two formats happen to be near-identical today; they are not the same
+ * rule, and this one belongs where its consumers are known.
+ *
+ * Transliteration and invisible-character stripping stay with the libraries that own
+ * them. Only the policy is local.
+ *
+ * Runs collapse and the ends are trimmed, so no key can lead or trail with a
+ * separator. `__proto__` is unmintable as a result, which is worth more than
+ * reserving it would be.
+ *
+ * Returns an empty string for a name with nothing usable in it; the caller decides
+ * what to do about that.
+ */
+function mintableKey(name) {
+    return unidecode(stripInvisibleChars(name))
+        .toLowerCase()
+        // Dropped rather than separated, so a possessive reads as one word.
+        .replace(/'/g, '')
+        .replace(/[^a-z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '');
+}

package/core/server/services/members-custom-fields/queries.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.activeFields = activeFields;
+exports.inFieldOrder = inFieldOrder;
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_custom_fields';
 // Archived fields must stay out of every read and write, and nothing in the database
@@ -10,3 +11,17 @@ const FIELDS_TABLE = 'members_custom_fields';
 function activeFields(db) {
     return db(FIELDS_TABLE).where('status', schema_1.FIELD_STATUS.active);
 }
+/**
+ * The publisher's order, applied to every read of the list. Here for the same reason the
+ * status filter is: a read that forgets it comes back in whatever order the engine chose.
+ *
+ * `created_at` orders a site that has never reordered, where every row still holds the
+ * default rank; `id` settles the rest so the order is total.
+ */
+function inFieldOrder(query) {
+    query
+        .orderBy(`${FIELDS_TABLE}.sort_order`, 'asc')
+        .orderBy(`${FIELDS_TABLE}.created_at`, 'asc')
+        .orderBy(`${FIELDS_TABLE}.id`, 'asc');
+    return query;
+}

package/core/server/services/members-custom-fields/schema.js

@@ -24,7 +24,7 @@ exports.DbCustomField = zod_1.z.object({
 // carries it as a plain string.
 exports.DbCustomFieldValue = zod_1.z.object({
     id: zod_1.z.string(),
-    custom_field_id: zod_1.z.string(),
+    custom_field_key: zod_1.z.string(),
     member_id: zod_1.z.string(),
     path: zod_1.z.string(),
     // Nullable like the column, though nothing here writes a null: a part with no value

package/core/server/services/members-custom-fields/values-service.js

@@ -14,8 +14,11 @@ const queries_1 = require("./queries");
 const storage_1 = require("./storage");
 const FIELDS_TABLE = 'members_custom_fields';
 const VALUES_TABLE = 'members_custom_field_values';
-/** Matches the `members_custom_fields.key` column, so no key a site could hold is refused. */
-const MAX_KEY_LENGTH = 191;
+/**
+ * From the canonical schema, the same source definitions-service reads, so no key a site
+ * could hold is refused and this cannot drift from the `members_custom_fields.key` column.
+ */
+const MAX_KEY_LENGTH = require('../../data/schema').tables[FIELDS_TABLE].key.maxlength;
 /**
  * Rows per insert statement, bounded by knex rather than by either database. SQLite takes
  * a multi-row `VALUES` perfectly well; knex's SQLite dialect emits that form only for a
@@ -62,12 +65,13 @@ class CustomFieldValuesService {
         if (memberIds.length === 0) {
             return new Map();
         }
+        // Not ordered by field: these rows become an object keyed by field, and an object
+        // cannot carry an order. `path` is ordered so composite parts assemble the same
+        // way every time.
         const rows = await this.knex(VALUES_TABLE)
-            .join(FIELDS_TABLE, `${VALUES_TABLE}.custom_field_id`, `${FIELDS_TABLE}.id`)
+            .join(FIELDS_TABLE, `${VALUES_TABLE}.custom_field_key`, `${FIELDS_TABLE}.key`)
             .whereIn(`${VALUES_TABLE}.member_id`, memberIds)
             .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
-            .orderBy(`${FIELDS_TABLE}.created_at`, 'asc')
-            .orderBy(`${FIELDS_TABLE}.id`, 'asc')
             .orderBy(`${VALUES_TABLE}.path`, 'asc')
             .select(`${VALUES_TABLE}.member_id`, `${FIELDS_TABLE}.key`, `${FIELDS_TABLE}.type`, `${VALUES_TABLE}.path`, `${VALUES_TABLE}.value_text`);
         const leaves = [];
@@ -169,36 +173,36 @@ class CustomFieldValuesService {
             // than one per part, under one timestamp, because a write happened once
             // however many rows record it.
             const now = new Date();
-            const clearedFields = [];
+            const clearedKeys = [];
             const clearedPaths = [];
             const rows = [];
             for (const { field, value } of writes) {
                 if (value === undefined) {
-                    clearedFields.push(field.id);
+                    clearedKeys.push(field.key);
                     continue;
                 }
                 const { set, cleared } = (0, storage_1.leavesToWrite)(value);
                 if (cleared.length > 0) {
-                    clearedPaths.push({ fieldId: field.id, paths: cleared });
+                    clearedPaths.push({ fieldKey: field.key, paths: cleared });
                 }
                 rows.push(...set.map(leaf => ({
                     id: new bson_objectid_1.default().toHexString(),
                     member_id: memberId,
-                    custom_field_id: field.id,
+                    custom_field_key: field.key,
                     path: leaf.path,
                     value_text: leaf.value_text,
                     created_at: now,
                     updated_at: now
                 })));
             }
-            if (clearedFields.length > 0) {
-                await trx(VALUES_TABLE).where('member_id', memberId).whereIn('custom_field_id', clearedFields).del();
+            if (clearedKeys.length > 0) {
+                await trx(VALUES_TABLE).where('member_id', memberId).whereIn('custom_field_key', clearedKeys).del();
             }
             if (clearedPaths.length > 0) {
                 // One statement with a group per field, rather than a statement per field.
                 await trx(VALUES_TABLE).where('member_id', memberId).where((builder) => {
-                    for (const { fieldId, paths } of clearedPaths) {
-                        builder.orWhere(pair => pair.where('custom_field_id', fieldId).whereIn('path', paths));
+                    for (const { fieldKey, paths } of clearedPaths) {
+                        builder.orWhere(pair => pair.where('custom_field_key', fieldKey).whereIn('path', paths));
                     }
                 }).del();
             }
@@ -210,7 +214,7 @@ class CustomFieldValuesService {
                     .insert(rows.slice(from, from + UPSERT_CHUNK))
                     // Naming the columns rather than giving values takes each from the row
                     // that lost the conflict, so every part updates to its own value.
-                    .onConflict(['member_id', 'custom_field_id', 'path'])
+                    .onConflict(['member_id', 'custom_field_key', 'path'])
                     .merge(['value_text', 'updated_at']);
             }
         };

package/core/server/services/members-events/last-seen-at-updater.js

@@ -1,7 +1,7 @@
 const {MemberPageViewEvent, MemberCommentEvent, MemberLinkClickEvent} = require('../../../shared/events');
 const moment = require('moment-timezone');
 const {IncorrectUsageError} = require('@tryghost/errors');
-const EmailOpenedEvent = require('../email-service/events/email-opened-event');
+const {EmailOpenedEvent} = require('../email-service/events/email-opened-event');
 const logging = require('@tryghost/logging');
 const LastSeenAtCache = require('./last-seen-at-cache');
 

package/core/server/services/oembed/oembed-service.js

@@ -52,6 +52,10 @@ const GZIP_MAGIC = [0x1f, 0x8b];
 const SVG_EXTENSIONS = new Set(['.svg', '.svgz']);
 const SVG_SNIFF_BYTES = 1024;
 
+const toBuffer = (bytes) => {
+    return Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+};
+
 const shouldRasterize = (buffer, ext) => {
     if (SVG_EXTENSIONS.has(ext.toLowerCase())) {
         return true;
@@ -179,8 +183,8 @@ class OEmbedService {
      * @returns {Promise<Buffer>} - Promise resolving to the image buffer
      */
     async fetchImageBuffer(imageUrl) {
-        const buffer = await this.externalRequest(imageUrl).buffer();
-        return buffer;
+        const bytes = await this.externalRequest(imageUrl).buffer();
+        return toBuffer(bytes);
     }
 
     /**
@@ -306,6 +310,8 @@ class OEmbedService {
                 ...options
             });
 
+        body = toBuffer(body);
+
         try {
             // Detect page encoding which might not be utf-8
             // and decode content

package/core/server/services/permissions/can-this.js

@@ -87,10 +87,13 @@ class CanThisResult {
                         }
                     }
 
+                    // Ensure permission decisions are based on the user's role if present, not their staff-token.
+                    const permissionsForModel = loadedPermissions.user ? {...loadedPermissions, apiKey: null} : loadedPermissions;
+
                     // Offer a chance for the TargetModel to override the results
                     if (TargetModel && _.isFunction(TargetModel.permissible)) {
                         return TargetModel.permissible(
-                            modelId, actType, context, unsafeAttrs, loadedPermissions, hasUserPermission, hasApiKeyPermission
+                            modelId, actType, context, unsafeAttrs, permissionsForModel, hasUserPermission, hasApiKeyPermission
                         );
                     }