ghost 6.57.1 → 6.58.0

package/core/server/services/posts/posts-service.js

@@ -6,6 +6,7 @@ const ObjectId = require('bson-objectid').default;
 const pick = require('lodash/pick');
 const DomainEvents = require('@tryghost/domain-events');
 const PostEmailHandler = require('./post-email-handler');
+const {validateAdminApiBulkFilterTransformer} = require('../../api/endpoints/utils/api-filter-utils');
 
 const messages = {
     invalidVisibilityFilter: 'Invalid visibility filter.',
@@ -27,6 +28,15 @@ class PostsService {
         this.postEmailHandler = new PostEmailHandler({models, emailService});
     }
 
+    #getFilteredBulkPostQuery(options) {
+        return this.models.Post.getFilteredCollectionQuery({
+            filter: options.filter,
+            status: 'all',
+            transacting: options.transacting,
+            mongoTransformer: validateAdminApiBulkFilterTransformer
+        });
+    }
+
     /**
      *
      * @param {Object} options - frame options
@@ -215,11 +225,7 @@ class PostsService {
             }
         }
 
-        const postRows = await this.models.Post.getFilteredCollectionQuery({
-            filter: options.filter,
-            status: 'all',
-            transacting: options.transacting
-        }).select('posts.id');
+        const postRows = await this.#getFilteredBulkPostQuery(options).select('posts.id');
 
         const postTags = data.tags.reduce((pt, tag) => {
             return pt.concat(postRows.map((post) => {
@@ -245,7 +251,7 @@ class PostsService {
     /**
      *
      * @param {Object} options
-     * @returns Promise<{successful: number, unsuccessful: number, deleteIds: string[]}>
+     * @returns Promise<{successful: number, unsuccessful: number, deleteIds: string[], allDraft: boolean}>
      */
     async #bulkDestroy(options) {
         if (!options.transacting) {
@@ -257,12 +263,11 @@ class PostsService {
             });
         }
 
-        const postRows = await this.models.Post.getFilteredCollectionQuery({
-            filter: options.filter,
-            status: 'all',
-            transacting: options.transacting
-        }).leftJoin('emails', 'posts.id', 'emails.post_id').select('posts.id', 'emails.id as email_id');
+        const postRows = await this.#getFilteredBulkPostQuery(options)
+            .leftJoin('emails', 'posts.id', 'emails.post_id')
+            .select('posts.id', 'posts.status', 'emails.id as email_id');
         const deleteIds = postRows.map(row => row.id);
+        const allDraft = postRows.length > 0 && postRows.every(row => row.status === 'draft');
 
         // We also need to collect the email ids because the email relation doesn't have cascase, and we need to delete the related relations of the post
         const deleteEmailIds = postRows.map(row => row.email_id).filter(id => !!id);
@@ -328,6 +333,7 @@ class PostsService {
         const result = await this.models.Post.bulkDestroy(deleteIds, 'posts', {...options, throwErrors: true});
 
         result.deleteIds = deleteIds;
+        result.allDraft = allDraft;
 
         return result;
     }
@@ -354,11 +360,7 @@ class PostsService {
             });
         }
 
-        const postRows = await this.models.Post.getFilteredCollectionQuery({
-            filter: options.filter,
-            status: 'all',
-            transacting: options.transacting
-        }).select('posts.id');
+        const postRows = await this.#getFilteredBulkPostQuery(options).select('posts.id');
 
         const editIds = postRows.map(row => row.id);
 

package/core/server/services/public-config/config.js

@@ -75,7 +75,7 @@ module.exports = function getConfigProperties() {
         configProperties.stats = getTinybirdStatsPayload(statsConfig, siteUuid);
     }
 
-    if (labs.isSet('featurebaseFeedback') && config.get('featurebase')) {
+    if (config.get('featurebase')) {
         // Expose only the public featurebase config properties
         configProperties.featurebase = {
             enabled: config.get('featurebase:enabled'),

package/core/server/services/route-settings/dynamic-routing-service.js

@@ -81,6 +81,8 @@ class DynamicRoutingService {
         const parseYaml = require('./yaml-parser');
         const {parseRouteSettings} = require('./route-settings-parser');
         const urlService = require('../url');
+        // Deferred: bridge reaches back here via api/endpoints/settings.js,
+        // so hoisting this would resolve to a half-initialised export.
         const bridge = require('../../../bridge');
 
         // Parse and validate before anything is persisted — an invalid

package/core/server/services/settings-helpers/settings-helpers.js

@@ -182,7 +182,6 @@ class SettingsHelpers {
         unsubscribeUrl.pathname = `${unsubscribeUrl.pathname}/unsubscribe/`.replace('//', '/');
         if (uuid) {
             // hash key with member uuid for verification (and to not leak uuid) - it's possible to update member email prefs without logging in
-            // @ts-ignore
             const hmac = crypto.createHmac('sha256', key).update(`${uuid}`).digest('hex');
             unsubscribeUrl.searchParams.set('uuid', uuid);
             unsubscribeUrl.searchParams.set('key', hmac);

package/core/server/services/stats/posts-stats-service.js

@@ -971,9 +971,7 @@ class PostsStatsService {
             const dailyChanges = [];
             for (const row of rawDeltas) {
                 if (row) {
-                    // @ts-ignore
                     const dateValue = row.date || '';
-                    // @ts-ignore
                     const changeValue = row.value || 0;
                     dailyChanges.push({
                         date: String(dateValue),

package/core/server/services/stripe/stripe-api.js

@@ -1,6 +1,4 @@
-// @ts-ignore
 const {VersionMismatchError} = require('@tryghost/errors');
-// @ts-ignore
 const debug = require('@tryghost/debug')('stripe');
 const ghostConfig = require('../../../shared/config');
 const stripe = require('stripe');
@@ -67,6 +65,7 @@ module.exports = class StripeAPI {
      * StripeAPI
      * @param {object} deps
      * @param {object} deps.labs
+     * @param {(key: string) => boolean} deps.labs.isSet
      */
     constructor(deps) {
         /** @type {Stripe} */
@@ -223,8 +222,7 @@ module.exports = class StripeAPI {
             unit_amount: options.amount,
             active: options.active,
             nickname: options.nickname,
-            // @ts-ignore
-            custom_unit_amount: options.custom_unit_amount, // missing in .d.ts definitions in the Stripe node version we use, but should be supported in Stripe API at this version (:
+            custom_unit_amount: options.custom_unit_amount,
             recurring: options.type === 'recurring' && options.interval ? {
                 interval: options.interval
             } : undefined
@@ -593,7 +591,6 @@ module.exports = class StripeAPI {
             managed_payments: MANAGED_PAYMENTS_DISABLED,
             success_url: options.successUrl || this._config.checkoutSessionSuccessUrl,
             cancel_url: options.cancelUrl || this._config.checkoutSessionCancelUrl,
-            // @ts-ignore - we need to update to latest stripe library to correctly use newer features
             allow_promotion_codes: discounts ? undefined : this._config.enablePromoCodes,
             automatic_tax: {
                 enabled: this._config.enableAutomaticTax
@@ -622,7 +619,6 @@ module.exports = class StripeAPI {
 
         this._applyAutomaticTaxSessionOptions(stripeSessionOptions, {hasCustomer: Boolean(customerId)});
 
-        // @ts-ignore
         const session = await this._stripe.checkout.sessions.create(stripeSessionOptions);
 
         return session;
@@ -692,7 +688,6 @@ module.exports = class StripeAPI {
 
         this._applyAutomaticTaxSessionOptions(stripeSessionOptions, {hasCustomer: Boolean(customer)});
 
-        // @ts-ignore
         const session = await this._stripe.checkout.sessions.create(stripeSessionOptions);
         return session;
     }
@@ -750,7 +745,6 @@ module.exports = class StripeAPI {
 
         this._applyAutomaticTaxSessionOptions(stripeSessionOptions, {hasCustomer: Boolean(customer)});
 
-        // @ts-ignore
         const session = await this._stripe.checkout.sessions.create(stripeSessionOptions);
 
         return session;
@@ -783,7 +777,6 @@ module.exports = class StripeAPI {
 
             // Note: this is required for dynamic payment methods
             // https://docs.stripe.com/api/checkout/sessions/create#create_checkout_session-currency
-            // @ts-ignore
             currency: this.labs.isSet('additionalPaymentMethods') ? options.currency : undefined
         });
 

package/core/server/web/api/endpoints/admin/middleware.js

@@ -66,7 +66,6 @@ const tokenPermissionCheck = function tokenPermissionCheck(req, res, next) {
         newsletters: ['GET', 'PUT', 'POST'],
         automations: ['PUT'],
         config: ['GET'],
-        explore: ['GET'],
         schedules: ['PUT'],
         gifts: ['PUT'],
         files: ['POST'],

package/core/server/web/api/endpoints/admin/routes.js

@@ -23,9 +23,6 @@ module.exports = function apiRoutes() {
     router.get('/config', mw.authAdminApi, http(api.config.read));
     router.get('/config/featurebase', mw.authAdminApi, http(api.config.featurebase));
 
-    // ## Ghost Explore
-    router.get('/explore', mw.authAdminApi, http(api.explore.read));
-
     // ## Posts
     router.get('/posts', mw.authAdminApi, http(api.posts.browse));
     router.get('/posts/export', mw.authAdminApi, http(api.posts.exportCSV));
@@ -161,6 +158,8 @@ module.exports = function apiRoutes() {
     // Registered before /members/:id so the literal path isn't captured by :id.
     router.get('/members/custom_fields', mw.authAdminApi, labs.enabledMiddleware('membersCustomFields'), http(api.membersCustomFields.browse));
     router.post('/members/custom_fields', mw.authAdminApi, labs.enabledMiddleware('membersCustomFields'), http(api.membersCustomFields.add));
+    // A PUT on the collection sets the publisher's order for the whole list.
+    router.put('/members/custom_fields', mw.authAdminApi, labs.enabledMiddleware('membersCustomFields'), http(api.membersCustomFields.reorder));
     router.get('/members/custom_fields/:key', mw.authAdminApi, labs.enabledMiddleware('membersCustomFields'), http(api.membersCustomFields.read));
     router.put('/members/custom_fields/:key', mw.authAdminApi, labs.enabledMiddleware('membersCustomFields'), http(api.membersCustomFields.edit));
     router.delete('/members/custom_fields/:key', mw.authAdminApi, labs.enabledMiddleware('membersCustomFields'), http(api.membersCustomFields.destroy));

package/core/server/web/comments/routes.js

@@ -8,9 +8,11 @@ const tpl = require('@tryghost/tpl');
 
 const bodyParser = require('body-parser');
 const membersService = require('../../../server/services/members');
+const privateSiteAccess = require('../../../shared/private-site-access');
 
 const messages = {
-    memberCommentingDisabled: 'Your commenting ability has been disabled.'
+    memberCommentingDisabled: 'Your commenting ability has been disabled.',
+    privateSiteAccessRequired: 'Comment browsing is not available'
 };
 
 /**
@@ -27,29 +29,50 @@ function checkMemberCommenting(req, res, next) {
     next();
 }
 
+/**
+ * Middleware to reject comment read requests without a valid private-site
+ * session when the site is in private mode.
+ */
+function checkCanReadComments(req, res, next) {
+    if (res.isPrivateBlog && !privateSiteAccess.hasAccess(req)) {
+        return next(new errors.NoPermissionError({
+            message: tpl(messages.privateSiteAccessRequired)
+        }));
+    }
+    next();
+}
+
 /**
  * @returns {import('express').Router}
  */
 module.exports = function apiRoutes() {
     const router = express.Router('comment api');
     router.use(bodyParser.json({limit: '50mb'}));
+    router.use(privateSiteAccess.loadSession);
 
-    const countsCache = shared.middleware.cacheControl(
+    const publicCountsCache = shared.middleware.cacheControl(
         'public',
         {maxAge: config.get('caching:commentsCountAPI:maxAge')}
     );
-    router.get('/counts', countsCache, http(api.commentsMembers.counts));
+    const privateCountsCache = shared.middleware.cacheControl('private');
+    const countsCache = (req, res, next) => {
+        if (res.isPrivateBlog) {
+            return privateCountsCache(req, res, next);
+        }
+        return publicCountsCache(req, res, next);
+    };
+    router.get('/counts', checkCanReadComments, countsCache, http(api.commentsMembers.counts));
 
-    // Authenticated Routes
+    // Load the optional member session for member-specific comment state
     router.use(membersService.middleware.loadMemberSession);
 
     // Enforce capped limit parameter
     router.use(shared.middleware.maxLimitCap);
 
-    router.get('/', http(api.commentsMembers.browse));
-    router.get('/post/:post_id', http(api.commentsMembers.browse));
-    router.get('/:id', http(api.commentsMembers.read));
-    router.get('/:id/replies', http(api.commentsMembers.replies));
+    router.get('/', checkCanReadComments, http(api.commentsMembers.browse));
+    router.get('/post/:post_id', checkCanReadComments, http(api.commentsMembers.browse));
+    router.get('/:id', checkCanReadComments, http(api.commentsMembers.read));
+    router.get('/:id/replies', checkCanReadComments, http(api.commentsMembers.replies));
 
     // Write operations require member to have commenting ability enabled
     router.post('/', checkMemberCommenting, http(api.commentsMembers.add));

package/core/shared/config/defaults.json

@@ -56,6 +56,12 @@
             "active": "FileStore",
             "FileStore": {},
             "S3RouteSettingsStore": {}
+        },
+        "jobs": {
+            "active": "InMemoryJobsBackend",
+            "InMemoryJobsBackend": {
+                "concurrency": 3
+            }
         }
     },
     "storage": {
@@ -235,7 +241,7 @@
         },
         "assets": {
             "contentBasedHash": {
-                "enabled": false,
+                "enabled": true,
                 "maxSize": 100000
             }
         }
@@ -273,6 +279,15 @@
     "adminFrameProtection": true,
     "sendWelcomeEmail": true,
     "stripeDirect": false,
+    "machinePayments": {
+        "mpp": {
+            "secretKey": null,
+            "stripeNetwork": "tempo",
+            "tempoCurrency": "0x20c000000000000000000000b9537d11c60e8b50",
+            "testnet": false,
+            "networkId": null
+        }
+    },
     "enableStripePromoCodes": false,
     "enableTipsAndDonations": true,
     "emailAnalytics": {
@@ -306,7 +321,7 @@
     },
     "comments": {
         "url": "https://cdn.jsdelivr.net/ghost/comments-ui@~{version}/umd/comments-ui.min.js",
-        "version": "1.5"
+        "version": "1.6"
     },
     "adminToolbar": {
         "url": "https://cdn.jsdelivr.net/ghost/admin-toolbar@~{version}/umd/admin-toolbar.min.js",

package/core/shared/config/loader.js

@@ -41,6 +41,7 @@ const nconf_1 = __importDefault(require("nconf"));
 const node_path_1 = __importDefault(require("node:path"));
 const config_url_helpers_1 = require("@tryghost/config-url-helpers");
 const localUtils = __importStar(require("./utils"));
+const secrets_1 = require("./secrets");
 const helpers_1 = require("./helpers");
 const _debug = require('@tryghost/debug')._base;
 const debug = _debug('ghost:config');
@@ -54,9 +55,17 @@ function loadNconf(options) {
     // ## Load Config
     // no channel can override the overrides
     nconf.file('overrides', node_path_1.default.join(baseConfigPath, 'overrides.json'));
-    // command line arguments take precedence, then environment variables
+    // command line arguments take precedence, then secret files, then environment variables
     nconf.argv();
-    nconf.env({ separator: '__', parseValues: true });
+    // secrets are not parsed - a password like `01234` must stay a string
+    nconf.add('secrets', { type: 'literal', store: (0, secrets_1.loadSecretsFromEnv)() });
+    nconf.env({
+        separator: '__',
+        parseValues: true,
+        // the secrets store has already resolved these, so keep the file paths themselves
+        // out of config - otherwise e.g. `database:connection` gains a bogus `password_FILE` key
+        transform: ({ key, value }) => ((0, secrets_1.isSecretFileRef)(key) ? false : { key, value })
+    });
     // Now load various config json files
     nconf.file('custom-env', node_path_1.default.join(customConfigPath, 'config.' + env + '.json'));
     if (!env.startsWith('testing')) {

package/core/shared/config/overrides.json

@@ -65,6 +65,7 @@
                 ".cr3",
                 ".css",
                 ".csv",
+                ".deb",
                 ".dng",
                 ".doc",
                 ".docx",
@@ -123,6 +124,7 @@
                 ".py",
                 ".raf",
                 ".rar",
+                ".rpm",
                 ".rtf",
                 ".rw2",
                 ".skp",

package/core/shared/config/secrets.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadSecretsFromEnv = loadSecretsFromEnv;
+exports.isSecretFileRef = isSecretFileRef;
+const node_fs_1 = __importDefault(require("node:fs"));
+const lodash_1 = require("lodash");
+const SUFFIX = '_file';
+/**
+ * Whether an env var name is a reference to a secret file rather than a config value itself.
+ */
+function isSecretFileRef(name, separator = '__') {
+    if (!name.toLowerCase().endsWith(SUFFIX)) {
+        return false;
+    }
+    const keyPath = name.slice(0, -SUFFIX.length).split(separator);
+    // the key must be nested, which keeps unrelated env vars such as SSL_CERT_FILE out
+    return keyPath.length >= 2 && keyPath.every(segment => !!segment);
+}
+/**
+ * Resolve `<config_key>_FILE` env vars into config values by reading the file they point at,
+ * so secrets can be mounted (Docker/Swarm secrets, k8s projected volumes, systemd LoadCredential)
+ * instead of being passed as plaintext env vars.
+ *
+ *   database__connection__password_FILE=/run/secrets/db_password
+ *
+ * The suffix is matched case-insensitively.
+ *
+ * Returns a plain object suitable for an nconf `literal` store.
+ */
+function loadSecretsFromEnv(env = process.env, separator = '__') {
+    const store = {};
+    const seen = new Map();
+    for (const [name, filePath] of Object.entries(env)) {
+        if (!isSecretFileRef(name, separator) || !filePath) {
+            continue;
+        }
+        const varName = name.slice(0, -SUFFIX.length);
+        if (env[varName] !== undefined) {
+            // new Error is allowed here, as we do not want config to depend on @tryghost/error
+            // eslint-disable-next-line ghost/ghost-custom/no-native-error
+            throw new Error(`Cannot set both ${varName} and ${name} - use one or the other.`);
+        }
+        const duplicate = seen.get(varName);
+        if (duplicate) {
+            // env var names are case-sensitive on POSIX, so the same key can be set twice —
+            // only a conflict if they disagree about which file to read
+            if (duplicate.filePath !== filePath) {
+                // eslint-disable-next-line ghost/ghost-custom/no-native-error
+                throw new Error(`Cannot set both ${duplicate.name} and ${name} to different files - they resolve to the same config key.`);
+            }
+            continue;
+        }
+        seen.set(varName, { name, filePath });
+        let contents;
+        try {
+            contents = node_fs_1.default.readFileSync(filePath, 'utf8');
+        }
+        catch (err) {
+            // eslint-disable-next-line ghost/ghost-custom/no-native-error
+            throw new Error(`Could not read the secret file referenced by ${name}: ${filePath}`, { cause: err });
+        }
+        // strip a single trailing newline, matching `$(cat file)` behaviour, but leave
+        // any other surrounding whitespace alone in case it is part of the secret
+        // setWith with Object keeps numeric key segments as plain objects rather than arrays
+        (0, lodash_1.setWith)(store, varName.split(separator), contents.replace(/\r?\n$/, ''), Object);
+    }
+    return store;
+}

package/core/shared/labs.js

@@ -27,14 +27,7 @@ const messages = {
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
 const GA_FEATURES = [
-    'automationAnalytics',
-    'customFonts',
-    'explore',
-    'commentsThreads',
-    'commentsPinning',
-    'featurebaseFeedback',
-    'dangerZoneResetAuth',
-    'llmsTxt'
+    'automationAnalytics'
 ];
 
 // These features are considered publicly available and can be enabled/disabled by users
@@ -52,20 +45,18 @@ const PRIVATE_FEATURES = [
     'stripeAutomaticTax',
     'importMemberTier',
     'csvContentImporter',
-    'lexicalIndicators',
     'adminUIRefresh',
-    'emailCustomization',
     'tagsX',
     'emailUniqueid',
     'themeTranslation',
     'pictureImageFormats',
-    'smarterCounts',
     'getHelperDeduplication',
-    'memberDetailsReact',
     'membersCustomFields',
     'paywallImprovements',
     'giftSubCustomization',
-    'tagDetailsReact'
+    'tagDetailsReact',
+    'selfServeArchives',
+    'machinePayments'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/core/shared/machine-payments.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Shared eligibility for agent-purchasable paid content.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPurchasableEntry = isPurchasableEntry;
+exports.isMachinePaymentsEnabled = isMachinePaymentsEnabled;
+function isPurchasableEntry(entry) {
+    if (!entry) {
+        return false;
+    }
+    if (entry.visibility === 'paid') {
+        return true;
+    }
+    if (entry.visibility !== 'tiers') {
+        return false;
+    }
+    return Array.isArray(entry.tiers)
+        && entry.tiers.length > 0
+        && entry.tiers.every(tier => tier.type === 'paid');
+}
+/**
+ * Shared enablement check for machine payments (labs + settings + Stripe).
+ */
+function isMachinePaymentsEnabled({ labs, settingsCache, isStripeConnected }) {
+    return labs.isSet('machinePayments')
+        && settingsCache.get('machine_payments_enabled') === true
+        && settingsCache.get('llms_enabled') !== false
+        && isStripeConnected();
+}

package/core/shared/private-site-access/index.js

@@ -0,0 +1,68 @@
+const crypto = require('crypto');
+const session = require('cookie-session');
+const settingsCache = require('../settings-cache');
+
+const privateSession = session({
+    name: 'ghost-private',
+    maxAge: 30 * 24 * 60 * 60 * 1000,
+    signed: false,
+    sameSite: 'none'
+});
+
+function getAccessCode() {
+    const accessCode = settingsCache.get('password');
+    return typeof accessCode === 'string' ? accessCode : '';
+}
+
+function hasAccessCode(accessCode) {
+    return typeof accessCode === 'string' && accessCode.trim().length > 0;
+}
+
+function hashAccessCode(accessCode, salt) {
+    const hasher = crypto.createHash('sha256');
+    hasher.update(accessCode + salt, 'utf8');
+    return hasher.digest('hex');
+}
+
+function hasAccess(req) {
+    const accessCode = getAccessCode();
+    const salt = req.session?.salt || '';
+    const hash = req.session?.token || '';
+
+    if (!salt || !hash || !hasAccessCode(accessCode)) {
+        return false;
+    }
+
+    return hashAccessCode(accessCode, salt) === hash;
+}
+
+function grantAccess(req, submittedAccessCode) {
+    const accessCode = getAccessCode();
+
+    if (!hasAccessCode(accessCode) || !hasAccessCode(submittedAccessCode) || accessCode !== submittedAccessCode) {
+        return false;
+    }
+
+    const salt = Date.now().toString();
+    req.session.token = hashAccessCode(submittedAccessCode, salt);
+    req.session.salt = salt;
+    return true;
+}
+
+function loadSession(req, res, next) {
+    const isPrivateBlog = settingsCache.get('is_private');
+
+    if (!isPrivateBlog) {
+        res.isPrivateBlog = false;
+        return next();
+    }
+
+    res.isPrivateBlog = true;
+    return privateSession(req, res, next);
+}
+
+module.exports = {
+    grantAccess,
+    hasAccess,
+    loadSession
+};