ghost 6.57.1 → 6.58.0

package/core/server/api/endpoints/gift-links.ts

@@ -1,87 +0,0 @@
-import {service, type RequestContext} from '../../services/gift-links';
-
-const permissionsService = require('../../services/permissions');
-
-interface Frame {
-    options: {
-        id: string;
-        context: unknown;
-        [key: string]: unknown;
-    };
-}
-
-async function assertCanEditAndGift(frame: Frame): Promise<void> {
-    const {context, id} = frame.options;
-    await permissionsService.canThis(context).manage.gift_link(id);
-    await permissionsService.canThis(context).edit.post(id);
-}
-
-function requestContextFromFrame(frame: Frame): RequestContext {
-    const context = (frame.options.context ?? {}) as {user?: string; integration?: {id: string}};
-    if (context.integration) {
-        return {actor: {id: context.integration.id, type: 'integration'}};
-    }
-    if (context.user) {
-        return {actor: {id: context.user, type: 'user'}};
-    }
-    return {actor: null};
-}
-
-const noCacheInvalidation = {cacheInvalidate: false};
-
-const controller = {
-    docName: 'gift_links',
-
-    browse: {
-        headers: noCacheInvalidation,
-        options: ['id'],
-        validation: {options: {id: {required: true}}},
-        permissions(frame: Frame) {
-            return assertCanEditAndGift(frame);
-        },
-        query(frame: Frame) {
-            return service!.getPost(frame.options.id);
-        }
-    },
-
-    ensure: {
-        headers: noCacheInvalidation,
-        statusCode: 200,
-        options: ['id'],
-        validation: {options: {id: {required: true}}},
-        permissions(frame: Frame) {
-            return assertCanEditAndGift(frame);
-        },
-        query(frame: Frame) {
-            return service!.ensure(requestContextFromFrame(frame), frame.options.id);
-        }
-    },
-
-    create: {
-        headers: noCacheInvalidation,
-        statusCode: 200,
-        options: ['id'],
-        validation: {options: {id: {required: true}}},
-        permissions(frame: Frame) {
-            return assertCanEditAndGift(frame);
-        },
-        query(frame: Frame) {
-            return service!.create(requestContextFromFrame(frame), frame.options.id);
-        }
-    },
-
-    removeAll: {
-        headers: noCacheInvalidation,
-        statusCode: 200,
-        permissions(frame: Frame) {
-            return permissionsService.canThis(frame.options.context).removeAll.gift_link();
-        },
-        async query(frame: Frame) {
-            const count = await service!.removeAll(requestContextFromFrame(frame));
-            return {count};
-        }
-    }
-};
-
-// module.exports (not export): the API framework loads controllers via require().
-module.exports = controller;

package/core/server/api/endpoints/libraries.d.ts

@@ -1,2 +0,0 @@
-// Type declarations for untyped modules used by TypeScript endpoints
-declare module '@tryghost/api-framework';

package/core/server/api/endpoints/member-commenting.ts

@@ -1,92 +0,0 @@
-import membersService from '../../services/members';
-
-const INVALIDATE_MEMBERS_CACHE = {value: '/members/'};
-
-interface DisableFrame {
-    options: {
-        id: string;
-        context: unknown;
-    };
-    data: {
-        reason: string;
-        expires_at: Date | null;
-        hide_comments: boolean;
-    };
-}
-
-interface EnableFrame {
-    options: {
-        id: string;
-        context: unknown;
-    };
-}
-
-const controller = {
-    docName: 'member_commenting',
-
-    disable: {
-        statusCode: 200,
-        headers: {
-            cacheInvalidate: INVALIDATE_MEMBERS_CACHE
-        },
-        options: [
-            'id'
-        ],
-        data: [
-            'reason',
-            'expires_at',
-            'hide_comments'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            method: 'edit',
-            docName: 'member'
-        },
-        async query(frame: DisableFrame) {
-            return membersService.api.memberBREADService.disableCommenting(
-                frame.options.id,
-                frame.data.reason,
-                frame.data.expires_at || null,
-                frame.data.hide_comments || false,
-                frame.options.context
-            );
-        }
-    },
-
-    enable: {
-        statusCode: 200,
-        headers: {
-            cacheInvalidate: INVALIDATE_MEMBERS_CACHE
-        },
-        options: [
-            'id'
-        ],
-        validation: {
-            options: {
-                id: {
-                    required: true
-                }
-            }
-        },
-        permissions: {
-            method: 'edit',
-            docName: 'member'
-        },
-        async query(frame: EnableFrame) {
-            return membersService.api.memberBREADService.enableCommenting(
-                frame.options.id,
-                frame.options.context
-            );
-        }
-    }
-};
-
-// module.exports required - using `export` causes the module to fail to register
-// with the web framework as it's loaded via require()
-module.exports = controller;

package/core/server/api/endpoints/member-custom-fields.ts

@@ -1,106 +0,0 @@
-import {definitions, type RequestContext} from '../../services/members-custom-fields';
-
-const permissionsService = require('../../services/permissions');
-
-interface Frame {
-    // The framework rejects a missing or empty root key with a 400, so on add/edit
-    // members_custom_fields is a non-empty array by the time a query runs. The item's
-    // contents stay unknown until the service validates them.
-    data: {members_custom_fields: unknown[]};
-    options: {key: string; context: unknown; [key: string]: unknown};
-}
-
-// There is no Bookshelf model for this resource, so permissions are checked
-// explicitly against the member_custom_field object type (the default
-// `permissions: true` handler would try to load a model that doesn't exist).
-function canThis(frame: Frame) {
-    return permissionsService.canThis(frame.options.context);
-}
-
-function requestContextFromFrame(frame: Frame): RequestContext {
-    const context = (frame.options.context ?? {}) as {user?: string; integration?: {id: string}};
-    if (context.integration) {
-        return {actor: {id: context.integration.id, type: 'integration'}};
-    }
-    if (context.user) {
-        return {actor: {id: context.user, type: 'user'}};
-    }
-    return {actor: null};
-}
-
-const noCacheInvalidation = {cacheInvalidate: false};
-
-const controller = {
-    docName: 'members_custom_fields',
-
-    browse: {
-        headers: noCacheInvalidation,
-        // `filter` narrows by status (the definition list is otherwise small and
-        // global, returned whole in a fixed order). Archived fields are hidden by
-        // default; Settings passes `filter=status:[active,archived]` to see both.
-        // No pagination/order options — a future sort_order column would change the
-        // order server-side, not add a client option.
-        options: ['filter'],
-        permissions(frame: Frame) {
-            return canThis(frame).browse.member_custom_field();
-        },
-        query(frame: Frame) {
-            return definitions!.browse({filter: frame.options.filter as string | undefined});
-        }
-    },
-
-    read: {
-        headers: noCacheInvalidation,
-        options: ['key'],
-        validation: {options: {key: {required: true}}},
-        permissions(frame: Frame) {
-            return canThis(frame).read.member_custom_field(frame.options.key);
-        },
-        query(frame: Frame) {
-            return definitions!.read(frame.options.key);
-        }
-    },
-
-    add: {
-        statusCode: 201,
-        headers: noCacheInvalidation,
-        permissions(frame: Frame) {
-            return canThis(frame).add.member_custom_field();
-        },
-        // The whole array is passed through: create is a batch, applied
-        // all-or-nothing. A client sending a single definition (as Admin does)
-        // is just the one-item case and sees no change.
-        query(frame: Frame) {
-            return definitions!.add(requestContextFromFrame(frame), frame.data.members_custom_fields);
-        }
-    },
-
-    edit: {
-        headers: noCacheInvalidation,
-        options: ['key'],
-        validation: {options: {key: {required: true}}},
-        permissions(frame: Frame) {
-            return canThis(frame).edit.member_custom_field(frame.options.key);
-        },
-        query(frame: Frame) {
-            return definitions!.edit(requestContextFromFrame(frame), frame.options.key, frame.data.members_custom_fields[0]);
-        }
-    },
-
-    destroy: {
-        statusCode: 204,
-        headers: noCacheInvalidation,
-        options: ['key'],
-        validation: {options: {key: {required: true}}},
-        permissions(frame: Frame) {
-            return canThis(frame).destroy.member_custom_field(frame.options.key);
-        },
-        async query(frame: Frame) {
-            await definitions!.destroy(requestContextFromFrame(frame), frame.options.key);
-            return null;
-        }
-    }
-};
-
-// module.exports (not export): the API framework loads controllers via require().
-module.exports = controller;

package/core/server/api/endpoints/utils/api-filter-utils.ts

@@ -1,22 +0,0 @@
-import {rejectStatements} from '@tryghost/mongo-utils';
-
-const CONTENT_API_RESTRICTED_FIELDS = new Set([
-    'password',
-    'email'
-]);
-
-const ADMIN_API_RESTRICTED_FIELDS = new Set([
-    'password'
-]);
-
-function hasRestrictedSegment(key: string, fields: Set<string>): boolean {
-    return key.toLowerCase().split('.').some(segment => fields.has(segment));
-}
-
-export const rejectContentApiRestrictedFieldsTransformer = (input: unknown) => {
-    return rejectStatements(input, (key: string) => hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS));
-};
-
-export const rejectAdminApiRestrictedFieldsTransformer = (input: unknown) => {
-    return rejectStatements(input, (key: string) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
-};

package/core/server/api/endpoints/utils/gift-link-access.ts

@@ -1,82 +0,0 @@
-/**
- * Gift-link access for the public posts/pages read endpoints. The raw token
- * arrives as internal read context from the frontend entry lookup — it has no
- * HTTP surface, so a `?gift` param on the Content API is ignored.
- */
-import errors from '@tryghost/errors';
-import tpl from '@tryghost/tpl';
-import {service as giftLinksService} from '../../../services/gift-links';
-import membersService from '../../../services/members';
-
-const messages = {
-    invalidGiftToken: 'Invalid gift link token.',
-    missingGiftKeyData: 'applyGiftAccess requires generateGiftKeyData in the endpoint\'s generateCacheKeyData, so a response cache can never serve unlocked content under an anonymous key.'
-};
-
-interface Frame {
-    // frame.original.context, not frame.options.context: the permissions
-    // stage replaces the latter with a parsed copy that drops unknown keys.
-    original: {context?: {member?: unknown; giftToken?: unknown}};
-    giftLinkPostId?: string | null;
-}
-
-function giftTokenFromFrame(frame: Frame): string | null {
-    const token = frame.original.context?.giftToken;
-    return typeof token === 'string' && token !== '' ? token : null;
-}
-
-/**
- * Resolve the token to its post id and stash it for `applyGiftAccess`. Runs in
- * `generateCacheKeyData`, BEFORE the response cache is consulted, so
- * revocations take effect immediately. `present: true` keeps an unresolvable
- * token's key distinct from a plain read's — sharing that key would serve a
- * cached gated 200 where a miss 403s.
- */
-export async function generateGiftKeyData(frame: Frame): Promise<{present: true; postId: string | null} | undefined> {
-    const token = giftTokenFromFrame(frame);
-    if (!token) {
-        return undefined;
-    }
-
-    const post = await giftLinksService!.getPostByToken(token);
-    const postId = post ? post.id : null;
-    frame.giftLinkPostId = postId;
-
-    return {present: true, postId};
-}
-
-/**
- * Verify the token against the entry being read and unlock its gated content
- * via the paid-member shim (the grant `/p/` previews use). The shim is set on
- * the frame's gating context only, so it never surfaces as `@member`. Call
- * after the model fetch: a missing entry stays a 404 regardless of the token;
- * a token that doesn't verify is a 403 with `INVALID_GIFT_TOKEN`.
- *
- * Uses the resolution `generateGiftKeyData` stashed — and refuses to run
- * without it. Resolving here as a fallback would let an endpoint wire up
- * verification without the cache-key half, which no test environment can
- * catch (the response cache is disabled there) but which poisons the
- * anonymous cache key with unlocked content in production.
- */
-export async function applyGiftAccess(frame: Frame, model: {id: string}): Promise<void> {
-    const token = giftTokenFromFrame(frame);
-    if (!token) {
-        return;
-    }
-
-    if (frame.giftLinkPostId === undefined) {
-        throw new errors.IncorrectUsageError({
-            message: tpl(messages.missingGiftKeyData)
-        });
-    }
-
-    if (frame.giftLinkPostId !== model.id) {
-        throw new errors.NoPermissionError({
-            message: tpl(messages.invalidGiftToken),
-            code: 'INVALID_GIFT_TOKEN'
-        });
-    }
-
-    frame.original.context ??= {};
-    frame.original.context.member = await membersService.createPaidMemberShim();
-}

package/core/server/api/endpoints/utils/public-cache-keys.ts

@@ -1,47 +0,0 @@
-/**
- * Cache-key data helpers shared by the public posts/pages endpoints. Every
- * dimension that changes what a read returns (requested options, the
- * requester's access level, gift-link access) must contribute to the key, or
- * a cached variant leaks across requests that should see different content.
- */
-
-interface CacheKeyFrame {
-    options?: {
-        [key: string]: unknown;
-        context?: {
-            member?: {
-                status?: string;
-                products?: Array<{slug: string}>;
-            };
-        };
-    };
-}
-
-export function generateOptionsData(frame: CacheKeyFrame, options: string[]): Record<string, unknown> {
-    return options.reduce((memo, option) => {
-        let value = frame.options?.[option];
-
-        if (['include', 'fields', 'formats'].includes(option) && typeof value === 'string') {
-            value = value.split(',').sort();
-        }
-
-        if (option === 'page') {
-            value = value || 1;
-        }
-
-        return {
-            ...memo,
-            [option]: value
-        };
-    }, {});
-}
-
-export function generateAuthData(frame: CacheKeyFrame): {free: boolean; tiers: string[] | undefined} | undefined {
-    const member = frame.options?.context?.member;
-    if (member) {
-        return {
-            free: member.status === 'free',
-            tiers: member.products?.map(product => product.slug).sort()
-        };
-    }
-}

package/core/server/api/endpoints/utils/serializers/input/member-commenting.ts

@@ -1,29 +0,0 @@
-import tpl from '@tryghost/tpl';
-import errors from '@tryghost/errors';
-
-const messages = {
-    invalidExpiresAt: 'expires_at must be a valid ISO 8601 date string'
-};
-
-interface Frame {
-    data: {
-        expires_at?: string | Date;
-    };
-}
-
-// module.exports required - using `export` causes the module to fail to register
-// with the serializer layer as it's loaded via require()
-module.exports = {
-    disable(_apiConfig: unknown, frame: Frame): void {
-        if (frame.data.expires_at !== undefined && frame.data.expires_at !== null) {
-            const parsed = new Date(frame.data.expires_at);
-            if (isNaN(parsed.getTime())) {
-                throw new errors.ValidationError({
-                    message: tpl(messages.invalidExpiresAt),
-                    property: 'expires_at'
-                });
-            }
-            frame.data.expires_at = parsed;
-        }
-    }
-};

package/core/server/api/endpoints/utils/serializers/output/explore.js

@@ -1,11 +0,0 @@
-const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:explore');
-
-module.exports = {
-    all(data, apiConfig, frame) {
-        debug('all');
-
-        frame.response = {
-            explore: data
-        };
-    }
-};

package/core/server/api/endpoints/utils/serializers/output/gift-links.ts

@@ -1,21 +0,0 @@
-import {toGiftLinksResponse, toRevokeAllResponse} from '../../../../../services/gift-links/serializers';
-import type {Post} from '../../../../../services/gift-links/models';
-
-interface Frame {
-    response?: unknown;
-}
-
-const serializeGiftLinks = (post: Post, _apiConfig: unknown, frame: Frame): void => {
-    frame.response = toGiftLinksResponse.parse(post.giftLinks);
-};
-
-// module.exports (not export): the API framework loads serializers via require(). The endpoint ->
-// serializer mapping lives here; the response shaping lives with the gift-links service module.
-module.exports = {
-    browse: serializeGiftLinks,
-    ensure: serializeGiftLinks,
-    create: serializeGiftLinks,
-    removeAll(data: {count: number}, _apiConfig: unknown, frame: Frame): void {
-        frame.response = toRevokeAllResponse.parse(data);
-    }
-};

package/core/server/api/endpoints/utils/serializers/output/member-commenting.ts

@@ -1,8 +0,0 @@
-import membersSerializer from './members';
-
-// module.exports required - using `export` causes the module to fail to register
-// with the web framework as it's loaded via require()
-module.exports = {
-    disable: membersSerializer.edit,
-    enable: membersSerializer.edit
-};

package/core/server/api/endpoints/utils/serializers/output/member-custom-fields.ts

@@ -1,25 +0,0 @@
-import {toCustomFieldsResponse} from '../../../../../services/members-custom-fields/serializers';
-import type {CustomField} from '../../../../../services/members-custom-fields';
-
-interface Frame {
-    response?: unknown;
-}
-
-const serializeOne = (field: CustomField, _apiConfig: unknown, frame: Frame): void => {
-    frame.response = toCustomFieldsResponse.parse([field]);
-};
-
-const serializeMany = (fields: CustomField[], _apiConfig: unknown, frame: Frame): void => {
-    frame.response = toCustomFieldsResponse.parse(fields);
-};
-
-// module.exports (not export): the API framework loads serializers via require(). The endpoint ->
-// serializer mapping lives here; the response shaping lives with the members-custom-fields service.
-module.exports = {
-    browse: serializeMany,
-    read: serializeOne,
-    // Create is a batch, so it returns every definition it made. The response is
-    // already an array, so a one-item create looks exactly as it did before.
-    add: serializeMany,
-    edit: serializeOne
-};

package/core/server/api/endpoints/utils/serializers/output/members.d.ts

@@ -1,20 +0,0 @@
-type Serializer = (apiConfig: unknown, frame: unknown) => void;
-
-declare const membersSerializer: {
-    browse: Serializer;
-    read: Serializer;
-    edit: Serializer;
-    add: Serializer;
-    destroy: Serializer;
-    editSubscription: Serializer;
-    createSubscription: Serializer;
-    bulkDestroy: Serializer;
-    bulkEdit: Serializer;
-    exportCSV: Serializer;
-    importCSV: Serializer;
-    memberStats: Serializer;
-    mrrStats: Serializer;
-    activityFeed: Serializer;
-};
-
-export = membersSerializer;

package/core/server/api/endpoints/utils/serializers/output/posts-csv-transform.ts

@@ -1,46 +0,0 @@
-import {Transform, TransformCallback} from 'node:stream';
-import * as papaparse from 'papaparse';
-import {InternalServerError} from '@tryghost/errors';
-
-type Row = Record<string, unknown>;
-
-/**
- * Converts post objects into a CSV, one row at a time.
- *
- * Pipe a `Readable` of post objects in, pipe CSV string out.
- */
-export function createCSVTransform(): Transform {
-    let fields: string[] | null = null;
-
-    return new Transform({
-        objectMode: true,
-        transform(post: Row, _encoding: unknown, callback: TransformCallback) {
-            try {
-                if (fields === null) {
-                    // Lock the column list from the first row's keys, then emit
-                    // the header + the row in a single chunk.
-                    fields = Object.keys(post);
-                    const csv = papaparse.unparse({fields, data: [post]}, {
-                        header: true,
-                        escapeFormulae: true
-                    });
-
-                    callback(null, csv);
-                    return;
-                }
-
-                // Subsequent rows reuse the locked-in field list and skip the header.
-                const csv = papaparse.unparse({fields, data: [post]}, {
-                    header: false,
-                    escapeFormulae: true
-                });
-
-                // papaparse never prepends or appends a newline around its output,
-                // so we add exactly one CRLF to separate this row from the previous.
-                callback(null, '\r\n' + csv);
-            } catch (err) {
-                callback(err instanceof Error ? err : new InternalServerError({message: String(err)}));
-            }
-        }
-    });
-}

package/core/server/api/endpoints/utils/serializers/output/stream-csv-response.ts

@@ -1,47 +0,0 @@
-import {pipeline, Readable, Transform} from 'node:stream';
-import {IncomingMessage, ServerResponse} from 'node:http';
-import {InternalServerError} from '@tryghost/errors';
-
-interface CSVStreamResponseOptions {
-    /** Object-mode readable producing the rows to export. */
-    source: Readable;
-    /** Transform that converts the rows into CSV chunks. */
-    transform: Transform;
-    /** Filename to advertise in the `Content-Disposition` header. */
-    filename: string;
-}
-
-/**
- * Builds the `frame.response` handler for a streaming CSV download, centralising
- * the wiring shared by every CSV export: the Content-Type/Content-Disposition
- * headers, the `no-transform` cache directive (so proxies don't recompress and
- * corrupt the byte stream), and `pipeline()` piping that tears down every stream
- * on error.
- */
-export function createCSVStreamResponse({source, transform, filename}: CSVStreamResponseOptions) {
-    return function streamResponse(req: IncomingMessage, res: ServerResponse, next: (err?: unknown) => void) {
-        if (!filename) {
-            return next(new InternalServerError({
-                message: 'Missing CSV export filename'
-            }));
-        }
-
-        res.setHeader('Content-Type', 'text/csv; charset=utf-8');
-        res.setHeader('Content-Disposition', `Attachment; filename="${filename}"`);
-
-        const cacheControl = res.getHeader('Cache-Control');
-        const cacheControlDirectives = cacheControl ? String(cacheControl).split(',').map((value: string) => value.trim().toLowerCase()) : [];
-        if (!cacheControlDirectives.includes('no-transform')) {
-            res.setHeader('Cache-Control', cacheControl ? `${cacheControl}, no-transform` : 'no-transform');
-        }
-
-        pipeline(source, transform, res, (err) => {
-            // On success, pipeline has already ended the response and there's no
-            // downstream middleware waiting. Only forward errors so the framework's
-            // error handler can log them and (if possible) send a status to the client.
-            if (err) {
-                next(err);
-            }
-        });
-    };
-}