ghost 6.60.0 → 6.61.0

package/core/server/services/members-custom-fields/bindings-service.js

@@ -0,0 +1,119 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomFieldBindingsService = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const schema_1 = require("./schema");
+const FIELDS_TABLE = 'members_custom_fields';
+const BINDINGS_TABLE = 'members_custom_field_bindings';
+/**
+ * Where a source sends what it collected: a `port` is the name that source uses for a
+ * thing, and the binding resolves it to one of the publisher's fields.
+ */
+class CustomFieldBindingsService {
+    knex;
+    values;
+    constructor({ knex, values }) {
+        this.knex = knex;
+        this.values = values;
+    }
+    async bind(db, productId, port, customFieldKey, now) {
+        const existing = await db(BINDINGS_TABLE).where({ product_id: productId, port }).first();
+        if (existing?.custom_field_key === customFieldKey) {
+            await db(BINDINGS_TABLE).where('id', existing.id).update({ updated_at: now });
+            return existing.id;
+        }
+        if (existing) {
+            await db(BINDINGS_TABLE).where('id', existing.id).del();
+        }
+        const bindingId = new bson_objectid_1.default().toHexString();
+        await db(BINDINGS_TABLE).insert({
+            id: bindingId,
+            product_id: productId,
+            port,
+            custom_field_key: customFieldKey,
+            created_at: now,
+            updated_at: now,
+        });
+        return bindingId;
+    }
+    /** Stops the writing. Whatever hangs off the binding cascades with it. */
+    async remove(db, productId, port) {
+        await db(BINDINGS_TABLE).where({ product_id: productId, port }).del();
+    }
+    /**
+     * Values arrive in the order they are to be applied: where two land in one field, the
+     * last of them is what the field holds.
+     */
+    async writeCollected(memberId, productId, collected) {
+        for (const { port, value } of collected) {
+            const destination = await this.resolve(productId, port);
+            if (!destination) {
+                continue;
+            }
+            await this.writeOne(memberId, destination, value);
+        }
+    }
+    async writeOne(memberId, into, value) {
+        let planned;
+        try {
+            planned = await this.values.planWrite({ [into.key]: value });
+        }
+        catch (err) {
+            logging_1.default.warn({
+                event: { name: 'members.custom_fields.collected_value_rejected' },
+                err,
+                memberId,
+                customFieldKey: into.key,
+            }, 'A collected value could not be saved');
+            return;
+        }
+        try {
+            await this.values.applyWrite(memberId, planned, {
+                writtenBy: { type: 'binding', id: into.bindingId },
+            });
+        }
+        catch (err) {
+            logging_1.default.error({
+                event: { name: 'members.custom_fields.collected_value_write_failed' },
+                err,
+                memberId,
+                customFieldKey: into.key,
+                bindingId: into.bindingId,
+            }, 'Failed to store a collected custom field value');
+        }
+    }
+    async resolve(productId, port) {
+        const row = await this.knex(BINDINGS_TABLE)
+            .join(FIELDS_TABLE, `${BINDINGS_TABLE}.custom_field_key`, `${FIELDS_TABLE}.key`)
+            .where(`${BINDINGS_TABLE}.product_id`, productId)
+            .where(`${BINDINGS_TABLE}.port`, port)
+            // An archived destination is still where this goes, and still not somewhere a value
+            // can land, so the write drops rather than waiting.
+            .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
+            .select(`${BINDINGS_TABLE}.id as binding_id`, `${FIELDS_TABLE}.key`, `${FIELDS_TABLE}.type`)
+            .first();
+        if (!row) {
+            return null;
+        }
+        // Decoded rather than trusted: a join is a read boundary, and `type` is what decides
+        // how the collected value is read. Unreadable counts as unresolved rather than
+        // throwing, so one bad row skips its value the way an unbound port does instead of
+        // failing everything else the same checkout collected.
+        const bound = schema_1.DbBoundField.safeParse(row);
+        if (!bound.success) {
+            logging_1.default.warn({
+                event: { name: 'members.custom_fields.binding_unreadable' },
+                err: bound.error,
+                productId,
+                port,
+            }, 'A binding could not be read');
+            return null;
+        }
+        return { bindingId: bound.data.binding_id, key: bound.data.key, type: bound.data.type };
+    }
+}
+exports.CustomFieldBindingsService = CustomFieldBindingsService;

package/core/server/services/members-custom-fields/definitions-service.js

@@ -33,10 +33,12 @@ const MAX_KEY_BASE_LENGTH = MAX_KEY_LENGTH - (String(MAX_KEY_ITERATIONS).length
 // object from JSON.parse. A key naming a member of Object.prototype reads back as
 // inherited rather than absent wherever one of those objects is indexed.
 //
-// Derived rather than listed, because the set is a consequence of how keys are
-// minted: minting lowercases and trims leading underscores, so a prototype name
-// survives only if it has neither. `constructor` is the only one.
-const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype).filter((name) => (0, key_1.mintableKey)(name) === name);
+// Derived rather than listed, from the format a key may take rather than from how one
+// is minted: a caller can state a key instead of deriving it from a name, so what has
+// to be reserved is every prototype name a well-formed key could spell. The ones that
+// carry a capital cannot be spelled at all and need no reserving; `constructor` and
+// `__proto__` can.
+const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype).filter((name) => key_1.KEY_CHARACTERS.test(name));
 const FieldName = zod_1.z
     .string()
     .trim()
@@ -114,11 +116,11 @@ class CustomFieldDefinitionsService {
         return rows.map((row) => zod_1.z.decode(codec_1.customFieldCodec, row));
     }
     async read(key) {
-        const row = await this.knex(TABLE).where('key', key).first();
-        if (!row) {
+        const [field] = await this.list((0, queries_1.fieldByKey)(this.knex, key));
+        if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
-        return zod_1.z.decode(codec_1.customFieldCodec, row);
+        return field;
     }
     /**
      * Create one or more field definitions. All-or-nothing: the batch runs in a
@@ -167,13 +169,11 @@ class CustomFieldDefinitionsService {
                 for (const [index, field] of fields.entries()) {
                     await this.assertNameAvailable(trx, field.name);
                     const key = await this.mintKey(trx, bases[index]);
-                    await trx(TABLE).insert({
-                        id: new bson_objectid_1.default().toHexString(),
+                    await this.insertField(trx, {
                         key,
                         name: field.name,
                         type: field.type,
-                        sort_order: firstSortOrder + index,
-                        created_at: new Date(),
+                        sortOrder: firstSortOrder + index,
                     });
                     keys.push(key);
                 }
@@ -194,7 +194,69 @@ class CustomFieldDefinitionsService {
         // Logged after the commit: the action log is a separate Bookshelf write
         // outside this transaction, so recording inside it would leave orphaned
         // "added" entries for fields a rollback never created.
-        for (const field of created) {
+        await this.recordCreated(context, created);
+        return created;
+    }
+    /**
+     * Given an executor it joins that transaction; given none it opens its own. Unlike
+     * `add`, the key is stated rather than minted from the name, and nothing about it is
+     * worked around: a caller states a key because something else already names that key,
+     * so a variant of it would be a field nothing points at.
+     *
+     * The field is returned rather than logged: the history writes on its own connection,
+     * which a single-connection pool would deadlock against an open transaction.
+     */
+    async addOne(wanted, { executor = this.knex } = {}) {
+        // Before any database access, the way `add` mints before opening its transaction:
+        // an unusable key is a payload problem worth reporting on its own terms.
+        assertKeyUsable(wanted.key);
+        const write = async (db) => {
+            await this.assertWithinLimit(db, 1);
+            await this.assertKeyAvailable(db, wanted.key);
+            await this.assertNameAvailable(db, wanted.name);
+            await this.insertField(db, {
+                key: wanted.key,
+                name: wanted.name,
+                type: wanted.type,
+                sortOrder: await this.nextSortOrder(db),
+            });
+            const [created] = await this.readMany(db, [wanted.key]);
+            return created;
+        };
+        // knex's marker for a transactor: join it rather than nesting a savepoint under it.
+        return executor.isTransaction ? write(executor) : executor.transaction(write);
+    }
+    /**
+     * Only for a stated key. Minting picks a free one instead, so this reads as a clean 422
+     * where the unique index would read as a 500.
+     */
+    async assertKeyAvailable(db, key) {
+        const taken = await db(TABLE).where('key', key).first();
+        if (taken) {
+            throw new errors_1.default.ValidationError({
+                message: 'A custom field with this key already exists.',
+                property: 'key',
+            });
+        }
+    }
+    async insertField(db, field) {
+        await db(TABLE).insert({
+            id: new bson_objectid_1.default().toHexString(),
+            key: field.key,
+            name: field.name,
+            type: field.type,
+            sort_order: field.sortOrder,
+            created_at: new Date(),
+        });
+    }
+    /** `read` for a caller that is deciding rather than serving: absent is an answer. */
+    async findByKey(key, { executor = this.knex } = {}) {
+        const row = await executor(TABLE).where('key', key).first();
+        return row ? zod_1.z.decode(codec_1.customFieldCodec, row) : null;
+    }
+    /** The same entry `add` writes. Only the caller knows its transaction committed. */
+    async recordCreated(context, fields) {
+        for (const field of fields) {
             await this.recordAction({
                 context,
                 verb: 'create',
@@ -202,7 +264,6 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: field.name, key: field.key },
             });
         }
-        return created;
     }
     /**
      * The operational ceiling on how many definitions a site can hold. This is a
@@ -460,6 +521,36 @@ class CustomFieldDefinitionsService {
     }
 }
 exports.CustomFieldDefinitionsService = CustomFieldDefinitionsService;
+/**
+ * The shape a stated key has to have. Minting derives one that is usable by
+ * construction, so this is the check that path never needed: a caller stating its own
+ * key has said nothing about the format, and guarding here covers every route in
+ * rather than whichever one arrived first.
+ *
+ * The length bound is the column's own, not `mintKey`'s: that one holds back room for a
+ * `_<n>` collision suffix, and a stated key is written exactly as given and never
+ * suffixed, so the whole column is available to it.
+ */
+function assertKeyUsable(key) {
+    if (!key_1.KEY_CHARACTERS.test(key)) {
+        throw new errors_1.default.ValidationError({
+            message: 'A custom field key can only contain lowercase letters, numbers and underscores.',
+            property: 'key',
+        });
+    }
+    if (key.length > MAX_KEY_LENGTH) {
+        throw new errors_1.default.ValidationError({
+            message: `A custom field key can be at most ${MAX_KEY_LENGTH} characters.`,
+            property: 'key',
+        });
+    }
+    if (RESERVED_KEYS.includes(key)) {
+        throw new errors_1.default.ValidationError({
+            message: `${key} cannot be used as a custom field key.`,
+            property: 'key',
+        });
+    }
+}
 // The field a zod issue points at. Create validates an array, so an issue's path
 // is prefixed with the item's index (`[0, 'name']`); `property` names the field
 // that is wrong, so the numeric prefix is dropped. Which item it was is reported

package/core/server/services/members-custom-fields/index.js

@@ -1,15 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.values = exports.definitions = void 0;
+exports.bindings = exports.values = exports.definitions = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
+const bindings_service_1 = require("./bindings-service");
 const actions_1 = require("./actions");
 const config_1 = require("./config");
+var actions_2 = require("./actions");
+Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
 function init() {
-    // The two are constructed together below, so checking both keeps the "both or
-    // neither" invariant explicit rather than trusting one to stand in for the pair.
-    if (exports.definitions && exports.values) {
+    // The three are constructed together below, so checking all of them keeps the "all or
+    // none" invariant explicit rather than trusting one to stand in for the rest.
+    if (exports.definitions && exports.values && exports.bindings) {
         return;
     }
     const { knex } = require('../../data/db');
@@ -31,4 +34,8 @@ function init() {
         knex,
         getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
     });
+    // Built after the values, which is what a binding routes into. It has no handle on the
+    // definitions: making a field is not part of binding to one, so a caller that needs both
+    // asks for both.
+    exports.bindings = new bindings_service_1.CustomFieldBindingsService({ knex, values: exports.values });
 }

package/core/server/services/members-custom-fields/queries.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.activeFields = activeFields;
+exports.fieldByKey = fieldByKey;
 exports.inFieldOrder = inFieldOrder;
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_custom_fields';
@@ -11,6 +12,10 @@ const FIELDS_TABLE = 'members_custom_fields';
 function activeFields(db) {
     return db(FIELDS_TABLE).where('status', schema_1.FIELD_STATUS.active);
 }
+/** One field by key, as the same kind of query the rest of this reads through. */
+function fieldByKey(db, key) {
+    return db(FIELDS_TABLE).where(`${FIELDS_TABLE}.key`, key);
+}
 /**
  * The publisher's order, applied to every read of the list. Here for the same reason the
  * status filter is: a read that forgets it comes back in whatever order the engine chose.

package/core/server/services/members-custom-fields/schema.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbBoundField = exports.DbCustomFieldBinding = exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.WrittenBy = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
-const db_date_1 = require("../../lib/db-date");
+const date_1 = require("../../lib/db-types/date");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
 // column, which is static config and cannot import this.
@@ -17,9 +17,21 @@ exports.DbCustomField = zod_1.z.object({
     name: zod_1.z.string(),
     type: custom_field_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
-    created_at: db_date_1.DbDate,
-    updated_at: db_date_1.DbDate.nullable(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
 });
+/**
+ * How a value arrived, not who caused it: who edited a member's fields is already an
+ * action, and Stripe is not a person. `type` is the namespace that makes `id` resolvable —
+ * `users`, `integrations`, `members_custom_field_bindings` — so the one writer that
+ * resolves in no table is the one with no id to give.
+ */
+exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
+    zod_1.z.object({ type: zod_1.z.literal('user'), id: zod_1.z.string() }),
+    zod_1.z.object({ type: zod_1.z.literal('integration'), id: zod_1.z.string() }),
+    zod_1.z.object({ type: zod_1.z.literal('binding'), id: zod_1.z.string() }),
+    zod_1.z.object({ type: zod_1.z.literal('import'), id: zod_1.z.null() }),
+]);
 // One part of a member's value. What a `path` means is storage.ts's business, so the row
 // carries it as a plain string.
 exports.DbCustomFieldValue = zod_1.z.object({
@@ -30,8 +42,13 @@ exports.DbCustomFieldValue = zod_1.z.object({
     // Nullable like the column, though nothing here writes a null: a part with no value
     // has no row.
     value_text: zod_1.z.string().nullable(),
-    created_at: db_date_1.DbDate,
-    updated_at: db_date_1.DbDate.nullable(),
+    // Plain columns rather than the `WrittenBy` union: the rule holds at the write
+    // boundary, so one malformed row cannot throw away a member's whole profile on read.
+    written_by_type: zod_1.z.string(),
+    // Null for the one writer that resolves nowhere: an import, until runs are tracked.
+    written_by_id: zod_1.z.string().nullable(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
 });
 // The field's key travels with the row so a value assembles without a second lookup.
 //
@@ -45,3 +62,17 @@ exports.DbCustomFieldLeaf = zod_1.z.object({
     path: zod_1.z.string(),
     value_text: zod_1.z.string(),
 });
+exports.DbCustomFieldBinding = zod_1.z.object({
+    id: zod_1.z.string(),
+    product_id: zod_1.z.string(),
+    port: zod_1.z.string(),
+    custom_field_key: zod_1.z.string(),
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
+});
+/** A binding joined to the field it points at, which is how a collected value is routed. */
+exports.DbBoundField = zod_1.z.object({
+    binding_id: zod_1.z.string(),
+    key: zod_1.z.string(),
+    type: custom_field_types_1.FieldTypeSchema,
+});

package/core/server/services/members-custom-fields/values-service.js

@@ -80,7 +80,12 @@ class CustomFieldValuesService {
                 leaves.push(schema_1.DbCustomFieldLeaf.parse(row));
             }
             catch (err) {
-                logging_1.default.warn(`Skipping unreadable custom field value (field '${row.key}', path '${row.path}'): ${err instanceof Error ? err.message : String(err)}`);
+                logging_1.default.warn({
+                    event: { name: 'members.custom_fields.value_unreadable' },
+                    err,
+                    customFieldKey: row.key,
+                    path: row.path,
+                }, 'Skipping an unreadable custom field value');
             }
         }
         return (0, storage_1.valuesFromLeaves)(leaves);
@@ -167,10 +172,13 @@ class CustomFieldValuesService {
      * them, and saying nothing about a path leaves it alone. There is no whole-value
      * replace, so a caller that does not know about a field cannot erase it.
      *
+     * `writtenBy` is required and has no default: every writer has to name itself, so a new
+     * one cannot quietly inherit the identity of whichever was written first.
+     *
      * Always transactional. Given an executor it joins that transaction, so the importer's
      * failed value write takes its member with it; given none it opens its own.
      */
-    async applyWrite(memberId, writes, { executor = this.knex } = {}) {
+    async applyWrite(memberId, writes, { writtenBy, executor = this.knex }) {
         if (writes.length === 0) {
             return;
         }
@@ -197,6 +205,8 @@ class CustomFieldValuesService {
                     custom_field_key: field.key,
                     path: leaf.path,
                     value_text: leaf.value_text,
+                    written_by_type: writtenBy.type,
+                    written_by_id: writtenBy.id,
                     created_at: now,
                     updated_at: now,
                 })));
@@ -227,7 +237,9 @@ class CustomFieldValuesService {
                     // Naming the columns rather than giving values takes each from the row
                     // that lost the conflict, so every part updates to its own value.
                     .onConflict(['member_id', 'custom_field_key', 'path'])
-                    .merge(['value_text', 'updated_at']);
+                    // The writer is merged with the value, so a leaf names who wrote what
+                    // it currently holds rather than who wrote its first value.
+                    .merge(['value_text', 'written_by_type', 'written_by_id', 'updated_at']);
             }
         };
         // knex's marker for a transactor: join it rather than nesting a savepoint under it.

package/core/server/services/public-config/config.js

@@ -86,5 +86,12 @@ module.exports = function getConfigProperties() {
     };
   }
 
+  if (config.get('docsbot')) {
+    configProperties.docsbot = {
+      enabled: config.get('docsbot:enabled'),
+      id: config.get('docsbot:id'),
+    };
+  }
+
   return configProperties;
 };