ghost 6.60.0 → 6.62.0

package/core/server/services/members/import-export/import/stripe-utils.js

@@ -175,7 +175,12 @@ module.exports = class MembersCSVImporterStripeUtils {
           await this.archivePrice(newStripePrice.id);
         } catch (archiveErr) {
           logging.warn(
-            `Failed to archive orphaned Stripe price ${newStripePrice.id} after a failed subscription update: ${archiveErr.message}`,
+            {
+              event: { name: 'members.import.orphaned_price_archive_failed' },
+              err: archiveErr,
+              stripePriceId: newStripePrice.id,
+            },
+            'Failed to archive an orphaned Stripe price after a failed subscription update',
           );
         }
         throw err;

package/core/server/services/members/import-export/index.js

@@ -12,7 +12,6 @@ const exporter_1 = __importDefault(require("./export/exporter"));
 const MembersCSVImporterStripeUtils = require('./import/stripe-utils');
 const db = require('../../../data/db');
 const models = require('../../../models');
-const labs = require('../../../../shared/labs');
 const logging = require('@tryghost/logging');
 const sentry = require('../../../../shared/sentry');
 // Build the members CSV importer. This is the composition root: today's models and
@@ -57,13 +56,15 @@ function makeImporter(deps) {
             transacting: options.transacting,
         }),
     };
-    // Gated by the same labs flag as the export, so the two halves round-trip or stay
-    // silent together: off, activeFields resolves empty and every custom_fields.* column
-    // is dropped.
     const customFields = {
-        activeFields: async () => labs.isSet('membersCustomFields') ? deps.customFields.definitions.browse() : [],
+        activeFields: async () => deps.customFields.definitions.browse(),
         planWrite: (values) => deps.customFields.values.planWrite(values),
-        applyWrite: (memberId, plan, executor) => deps.customFields.values.applyWrite(memberId, plan, { executor }),
+        // Every value the import writes came out of the file, whichever column carried it.
+        // An import has no id to give until runs are tracked, so it names its kind only.
+        applyWrite: (memberId, plan, executor) => deps.customFields.values.applyWrite(memberId, plan, {
+            writtenBy: { type: 'import', id: null },
+            executor,
+        }),
     };
     // Inline jobs never reach the job manager's Sentry handler, which is wired to the
     // offloaded worker path only, so a throw here would be seen by nobody.
@@ -100,9 +101,7 @@ function makeImporter(deps) {
 }
 // Build the members CSV exporter. The same composition root from the other direction:
 // knex and the members id lookup are wired here, and the custom fields definitions and
-// values services are injected (boot builds them before this one). The labs flag alone
-// decides whether custom field columns appear, so nothing flag-shaped leaks into the
-// exporter itself.
+// values services are injected (boot builds them before this one).
 function makeExporter({ definitions, values, }) {
     const exporter = new exporter_1.default({
         knex: db.knex,
@@ -121,9 +120,8 @@ function makeExporter({ definitions, values, }) {
         },
         customFields: {
             // Boot builds the definitions and values services before this one, so they
-            // are always present -- no not-initialised state to guard. The flag decides
-            // whether their columns are included at all.
-            activeDefinitions: async () => labs.isSet('membersCustomFields') ? definitions.browse() : [],
+            // are always present -- no not-initialised state to guard.
+            activeDefinitions: async () => definitions.browse(),
             valuesForMembers: (memberIds) => values.getValuesForMembers(memberIds),
         },
     });

package/core/server/services/members/jobs/clean-expired-comped-job.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../../jobs-service/job");
+class CleanExpiredCompedJob extends job_1.Job {
+    static type = 'clean-expired-comped';
+}
+exports.default = CleanExpiredCompedJob;

package/core/server/services/members/jobs/clean-expired-comped-task.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ObjectId = require('bson-objectid').default;
+const { chunk: chunkArray } = require('lodash');
+const moment = require('moment');
+// Removes expired comped entries from the members_products table, moves the
+// affected members from comped to free and records a comped->free status
+// event for each of them. The three writes commit or roll back together, so a
+// failed run leaves the source rows in place and a repeat run redoes the whole
+// unit of work instead of finishing a half-applied one.
+async function cleanExpiredComped({ db, models, events, logging, sentry, }) {
+    const startedAt = Date.now();
+    const { deletedSubscriptionCount, updatedMemberCount, updatedMembers, now } = await db.knex.transaction(async (trx) => {
+        const expiredCompedRows = await trx('members_products')
+            // we need to be careful about the type here. .format() is the only
+            // thing that works across SQLite and MySQL: an ISO cutoff compares
+            // lexically against SQLite's 'YYYY-MM-DD HH:mm:ss' text and its 'T'
+            // sorts above ' ', wrongly matching same-UTC-day expiries
+            .where('expiry_at', '<', moment.utc().startOf('day').format('YYYY-MM-DD HH:mm:ss'))
+            .select('*');
+        if (!expiredCompedRows.length) {
+            return {
+                deletedSubscriptionCount: 0,
+                updatedMemberCount: 0,
+                updatedMembers: [],
+                now: new Date(),
+            };
+        }
+        const rowIds = expiredCompedRows.map((d) => d.id);
+        const memberIds = expiredCompedRows.map((d) => d.member_id);
+        // Only members still in the comped status change; anyone already paid,
+        // free or deleted is left untouched. The rows are locked for the rest
+        // of the transaction so a concurrent status change cannot slip between
+        // this read and the update below (forUpdate is a no-op on SQLite,
+        // where the single-writer transaction already guarantees this). The
+        // members rows are locked BEFORE the members_products delete so this
+        // transaction acquires locks in the same members -> members_products
+        // order as the member-edit flows (Bookshelf edit, linkSubscription);
+        // the reverse order could deadlock against them.
+        const compedMembers = await trx('members')
+            .whereIn('id', memberIds)
+            .andWhere('status', 'comped')
+            .forUpdate();
+        const deletedCount = await trx('members_products').whereIn('id', rowIds).del();
+        const updateMemberIds = compedMembers.map((d) => d.id);
+        const updatedAt = new Date();
+        const updatedCount = await trx('members').whereIn('id', updateMemberIds).update({
+            status: 'free',
+            updated_at: updatedAt,
+        });
+        const statusEvents = compedMembers.map((member) => {
+            return {
+                id: ObjectId().toHexString(),
+                member_id: member.id,
+                from_status: member.status,
+                to_status: 'free',
+                created_at: updatedAt,
+            };
+        });
+        // SQLite >= 3.32.0 can support 32766 host parameters
+        // each row uses 5 variables so ⌊32766/5⌋ = 6553
+        const chunkSize = 6553;
+        for (const chunk of chunkArray(statusEvents, chunkSize)) {
+            await trx('members_status_events').insert(chunk);
+        }
+        return {
+            deletedSubscriptionCount: deletedCount,
+            updatedMemberCount: updatedCount,
+            updatedMembers: compedMembers,
+            now: updatedAt,
+        };
+    });
+    // Emitted after the commit so listeners never observe state that could
+    // still roll back. A failed emission is logged and skipped rather than
+    // failing the job: the database changes are already durable and the
+    // emitted_event_count below makes the shortfall visible.
+    let emittedEventCount = 0;
+    for (const member of updatedMembers) {
+        const emitted = await emitMemberEditedEvent({ member, now, models, events, logging, sentry });
+        if (emitted) {
+            emittedEventCount += 1;
+        }
+    }
+    logging.info({
+        system: {
+            event: 'clean_expired_comped.completed',
+            deleted_subscription_count: deletedSubscriptionCount,
+            updated_member_count: updatedMemberCount,
+            emitted_event_count: emittedEventCount,
+            duration_ms: Date.now() - startedAt,
+        },
+    }, `[Background Job] clean-expired-comped removed ${deletedSubscriptionCount} expired subscriptions and updated ${updatedMemberCount} members`);
+    return { deletedSubscriptionCount, updatedMemberCount, emittedEventCount };
+}
+// Emits member.edited in the shape its listeners (webhooks in particular)
+// expect: a freshly loaded model whose _previousAttributes carry the
+// pre-cleanup status and _changed the comped->free transition, with an
+// internal context.
+async function emitMemberEditedEvent({ member, now, models, events, logging, sentry, }) {
+    try {
+        const model = await models.Member.findOne({ id: member.id }, { require: true, context: { internal: true } });
+        model._previousAttributes = normalizeDates({
+            ...model.attributes,
+            status: member.status,
+            updated_at: member.updated_at,
+        });
+        model._changed = normalizeDates({
+            status: 'free',
+            updated_at: now,
+        });
+        events.emit('member.edited', model, { context: { internal: true } });
+        return true;
+    }
+    catch (err) {
+        if (isNotFoundError(err)) {
+            logging.warn(`Could not emit member.edited for expired comped member: Member ${member.id} was not found`);
+            return false;
+        }
+        logging.error(err);
+        sentry.captureException(err);
+        return false;
+    }
+}
+function normalizeDates(attributes) {
+    const normalized = { ...attributes };
+    for (const [key, value] of Object.entries(normalized)) {
+        if (key.endsWith('_at') && value && !(value instanceof Date)) {
+            normalized[key] = moment.utc(value).toDate();
+        }
+    }
+    return normalized;
+}
+function isNotFoundError(err) {
+    if (!err || typeof err !== 'object') {
+        return false;
+    }
+    const errorType = 'errorType' in err ? err.errorType : undefined;
+    const name = 'name' in err ? err.name : undefined;
+    const message = 'message' in err ? err.message : undefined;
+    return (errorType === 'NotFoundError' ||
+        name === 'NotFoundError' ||
+        message === 'NotFound' ||
+        message === 'EmptyResponse');
+}
+exports.default = cleanExpiredComped;

package/core/server/services/members/jobs/index.js

@@ -1,13 +1,17 @@
-const path = require('path');
 const logging = require('@tryghost/logging');
-const jobsService = require('../../jobs');
+const errors = require('@tryghost/errors');
 const CleanTokensJob = require('./clean-tokens-job').default;
+const CleanExpiredCompedJob = require('./clean-expired-comped-job').default;
+const cleanTokensTask = require('./clean-tokens-task').default;
+const cleanExpiredCompedTask = require('./clean-expired-comped-task').default;
 
 let hasScheduled = {
   expiredComped: false,
   tokens: false,
 };
 
+let tasks;
+
 function alreadyScheduledOrTest(key) {
   return hasScheduled[key] || process.env.NODE_ENV.startsWith('test');
 }
@@ -19,43 +23,63 @@ function randomDailyCron(maxHour = 24) {
   return `${s} ${m} ${h} * * *`;
 }
 
-function scheduleJob(key, name, jobFile, maxHour = 6) {
-  if (alreadyScheduledOrTest(key)) {
-    return hasScheduled[key];
+function getTasks() {
+  if (!tasks) {
+    throw new errors.IncorrectUsageError({
+      message: 'Member jobs used before init(). Call init() from boot first.',
+    });
   }
+  return tasks;
+}
 
-  const s = Math.floor(Math.random() * 60);
-  const m = Math.floor(Math.random() * 60);
-  const h = Math.floor(Math.random() * maxHour);
+module.exports = {
+  // Composition root for the member cleanup tasks. Idempotent because tests
+  // may boot more than once per process.
+  init() {
+    if (tasks) {
+      return;
+    }
 
-  const at = `${s} ${m} ${h} * * *`;
+    const db = require('../../../data/db');
+    const models = require('../../../models');
+    const events = require('../../../lib/common/events');
+    const sentry = require('../../../../shared/sentry');
 
-  logging.info(`[Background Job] ${name} scheduled at ${at}`);
-  jobsService.addJob({
-    at,
-    job: path.resolve(__dirname, jobFile),
-    name,
-  });
+    tasks = {
+      cleanTokens: () => cleanTokensTask({ db, logging }),
+      cleanExpiredComped: () => cleanExpiredCompedTask({ db, models, events, logging, sentry }),
+    };
+  },
 
-  hasScheduled[key] = true;
+  cleanTokens() {
+    return getTasks().cleanTokens();
+  },
 
-  return true;
-}
+  cleanExpiredComped() {
+    return getTasks().cleanExpiredComped();
+  },
 
-module.exports = {
-  async scheduleExpiredCompCleanupJob() {
-    return scheduleJob('expiredComped', 'clean-expired-comped', 'clean-expired-comped.js');
+  async scheduleExpiredCompCleanupJob(jobsService) {
+    if (alreadyScheduledOrTest('expiredComped')) {
+      return;
+    }
+
+    // Keep the legacy off-peak window: a random time between 00:00 and 05:59
+    const cron = randomDailyCron(6);
+    logging.info(`[Background Job] clean-expired-comped scheduled at ${cron}`);
+    await jobsService.scheduleRecurring(new CleanExpiredCompedJob(), { cron });
+
+    hasScheduled.expiredComped = true;
   },
 
-  async scheduleTokenCleanupJob() {
+  async scheduleTokenCleanupJob(jobsService) {
     if (alreadyScheduledOrTest('tokens')) {
       return;
     }
 
-    const classBasedJobs = require('../../jobs-service').getInstance();
     const cron = randomDailyCron();
     logging.info(`[Background Job] clean-tokens scheduled at ${cron}`);
-    await classBasedJobs.scheduleRecurring(new CleanTokensJob(), { cron });
+    await jobsService.scheduleRecurring(new CleanTokensJob(), { cron });
 
     hasScheduled.tokens = true;
   },

package/core/server/services/members/members-api/controllers/member-controller.js

@@ -146,6 +146,17 @@ module.exports = class MemberController {
 
       if (tierId && cadence) {
         const tier = await this._tiersService.api.read(tierId);
+
+        if (!tier) {
+          res.writeHead(404);
+          return res.end('Not Found.');
+        }
+
+        if (tier.status !== 'active') {
+          res.writeHead(403);
+          return res.end('Tier is archived.');
+        }
+
         const stripePrice = await this._paymentsService.getPriceForTierCadence(tier, cadence);
 
         await this._memberRepository.updateSubscription({

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -140,7 +140,6 @@ module.exports = class RouterController {
    * @param {any} deps.offersAPI
    * @param {any} deps.paymentsService
    * @param {any} deps.memberRepository
-   * @param {any} deps.StripePrice
    * @param {() => boolean} deps.allowSelfSignup
    * @param {any} deps.magicLinkService
    * @param {import('../../../stripe/stripe-api')} deps.stripeAPIService
@@ -160,7 +159,6 @@ module.exports = class RouterController {
     paymentsService,
     tiersService,
     memberRepository,
-    StripePrice,
     allowSelfSignup,
     magicLinkService,
     stripeAPIService,
@@ -180,7 +178,6 @@ module.exports = class RouterController {
     this._paymentsService = paymentsService;
     this._tiersService = tiersService;
     this._memberRepository = memberRepository;
-    this._StripePrice = StripePrice;
     this._allowSelfSignup = allowSelfSignup;
     this._magicLinkService = magicLinkService;
     this._stripeAPIService = stripeAPIService;
@@ -602,11 +599,11 @@ module.exports = class RouterController {
     if (member) {
       options.successUrl = this._generateSuccessUrl(options.successUrl, tier.welcomePageURL);
 
-      const restrictCheckout = member.get('status') === 'paid';
+      // Existing paid members must manage their subscription instead of creating another.
+      // Other members must prove ownership of the provided email before checking out.
+      const restrictCheckout = member.get('status') === 'paid' || !options.isAuthenticated;
 
       if (restrictCheckout) {
-        // This member is already subscribed to a paid tier
-        // We don't want to create a duplicate subscription
         if (!options.isAuthenticated && options.email) {
           try {
             await this._sendEmailWithMagicLink({ email: options.email, requestedType: 'signin' });

package/core/server/services/members/members-api/members-api.js

@@ -41,7 +41,6 @@ module.exports = function MembersAPI({
     MemberProductEvent,
     MemberEmailChangeEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberLinkClickEvent,
     EmailSpamComplaintEvent,
     Offer,
@@ -72,6 +71,7 @@ module.exports = function MembersAPI({
   emailAddressService,
   giftService,
   customFieldValues,
+  customFieldDefinitions,
 }) {
   const tokenService = new TokenService({
     privateKey,
@@ -119,7 +119,6 @@ module.exports = function MembersAPI({
     MemberStatusEvent,
     MemberLoginEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberLinkClickEvent,
     MemberFeedback,
     EmailSpamComplaintEvent,
@@ -147,7 +146,6 @@ module.exports = function MembersAPI({
         });
       },
     },
-    labsService,
     stripeService: stripeAPIService,
     memberAttributionService,
     emailSuppressionList,
@@ -156,6 +154,7 @@ module.exports = function MembersAPI({
     commentsService,
     giftService,
     customFieldValues,
+    customFieldDefinitions,
   });
 
   const geolocationService = new GeolocationService();
@@ -179,6 +178,11 @@ module.exports = function MembersAPI({
     offersAPI,
     stripeAPIService,
     settingsCache,
+    // The service wrapper, not the checkout config it builds: tiers and members are
+    // initialised in the same Promise.all, so reading the property here would capture
+    // whatever it was before tiers finished — usually undefined.
+    tiersService,
+    labsService,
   });
 
   const memberController = new MemberController({
@@ -197,7 +201,6 @@ module.exports = function MembersAPI({
     paymentsService,
     tiersService,
     memberRepository,
-    StripePrice,
     allowSelfSignup,
     magicLinkService,
     stripeAPIService,
@@ -353,11 +356,11 @@ module.exports = function MembersAPI({
   }
 
   async function getMemberIdentityData(email) {
-    return memberBREADService.read({ email });
+    return memberBREADService.read({ email }, { withCustomFields: false });
   }
 
   async function getMemberIdentityDataFromTransientId(transientId) {
-    return memberBREADService.read({ transient_id: transientId });
+    return memberBREADService.read({ transient_id: transientId }, { withCustomFields: false });
   }
 
   async function cycleTransientId(memberId) {

package/core/server/services/members/members-api/repositories/event-repository.js

@@ -34,13 +34,11 @@ module.exports = class EventRepository {
     MemberStatusEvent,
     MemberLoginEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberPaidSubscriptionEvent,
     MemberLinkClickEvent,
     MemberFeedback,
     EmailSpamComplaintEvent,
     Comment,
-    labsService,
     memberAttributionService,
     urlService,
     MemberEmailChangeEvent,
@@ -55,10 +53,8 @@ module.exports = class EventRepository {
     this._MemberLoginEvent = MemberLoginEvent;
     this._EmailRecipient = EmailRecipient;
     this._Comment = Comment;
-    this._labsService = labsService;
     this._urlService = urlService;
     this._MemberCreatedEvent = MemberCreatedEvent;
-    this._SubscriptionCreatedEvent = SubscriptionCreatedEvent;
     this._MemberLinkClickEvent = MemberLinkClickEvent;
     this._MemberFeedback = MemberFeedback;
     this._EmailSpamComplaintEvent = EmailSpamComplaintEvent;