ghost 6.60.0 → 6.62.0

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -9,16 +9,13 @@ const messages = {
   memberNotFound: 'Member not found.',
   customFieldsOnAdd:
     'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.',
+  customFieldsWithoutWriter:
+    'Custom field values cannot be set by a request with no authenticated user or integration.',
 };
 
 // Stored in the action's `context.action_name`; Admin maps it to a display label.
 const CUSTOM_FIELDS_EDITED_ACTION = 'custom_fields_edited';
 
-/**
- * @typedef {object} ILabsService
- * @prop {(key: string) => boolean} isSet
- */
-
 /**
  * @typedef {object} IEmailService
  * @prop {(data: {email: string, requestedType: string}) => Promise<any>} sendEmailWithMagicLink
@@ -43,7 +40,6 @@ module.exports = class MemberBREADService {
    * @param {object} deps
    * @param {import('../repositories/member-repository')} deps.memberRepository
    * @param {import('../../../offers/application/offers-api')} deps.offersAPI
-   * @param {ILabsService} deps.labsService
    * @param {IEmailService} deps.emailService
    * @param {IStripeService} deps.stripeService
    * @param {import('../../../member-attribution/member-attribution-service')} deps.memberAttributionService
@@ -52,10 +48,10 @@ module.exports = class MemberBREADService {
    * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
    * @param {IGiftsModule} deps.giftService
    * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
+   * @param {import('../../../members-custom-fields/definitions-service').CustomFieldDefinitionsService} deps.customFieldDefinitions Required: boot builds it before the members service
    */
   constructor({
     memberRepository,
-    labsService,
     emailService,
     stripeService,
     offersAPI,
@@ -66,13 +62,12 @@ module.exports = class MemberBREADService {
     commentsService,
     giftService,
     customFieldValues,
+    customFieldDefinitions,
   }) {
     this.offersAPI = offersAPI;
     /** @private */
     this.memberRepository = memberRepository;
     /** @private */
-    this.labsService = labsService;
-    /** @private */
     this.emailService = emailService;
     /** @private */
     this.stripeService = stripeService;
@@ -90,31 +85,25 @@ module.exports = class MemberBREADService {
     this.giftService = giftService;
     /** @private */
     this.customFieldValues = customFieldValues;
+    /** @private */
+    this.customFieldDefinitions = customFieldDefinitions;
   }
 
   /**
-   * @private
-   * Custom field values keyed by member id, or `null` when the feature is off —
-   * the flag lives here, so callers just check the result: `null` means omit the
-   * `custom_fields` key entirely, keeping a pre-feature member payload identical.
+   * Metafields are extra fields a publisher can define on member records, such as a shoe
+   * size or a delivery address. Their values live in their own table, so they are fetched
+   * here rather than loaded alongside the member.
    *
-   * A read gets values on the flag alone, with no opt-in include: a member's
-   * custom fields are their own data, like labels and tiers, which a read
-   * already returns unasked. `include` is for things that are expensive or
-   * aggregate (email_recipients, counts), and one flat lookup on a read that
-   * already issues a dozen queries is neither. The flag, not an include, is what
-   * protects consumers that predate the feature — an include would outlive it
-   * and become permanent API surface.
-   *
-   * Browse is the opposite — opt-in via `include=custom_fields`, exactly how
-   * `products`/`tiers` already behave: a read always carries them, a list only
-   * when asked. Read and browse must stay format-identical, so a browse that
-   * asks gets the same key a read gives unasked.
+   * Returns null when the site has defined no fields, which tells the caller to leave the
+   * `metafields` key off the member payload rather than send an empty object: a key added to
+   * an API response cannot be withdrawn without breaking whoever started reading it, and
+   * most sites have never defined a field, so those sites keep the payload they had before
+   * this feature existed.
    * @param {string[]} memberIds
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
   async fetchCustomFieldValues(memberIds) {
-    if (!this.labsService.isSet('membersCustomFields')) {
+    if (!(await this.customFieldDefinitions.hasAnyActive())) {
       return null;
     }
 
@@ -392,7 +381,16 @@ module.exports = class MemberBREADService {
     }
   }
 
-  async read(data, options = {}) {
+  /**
+   * @param {object} data
+   * @param {object} [options]
+   * @param {boolean} [options.withCustomFields] Pass false to leave custom field values
+   *   off the result. Ghost calls this method to identify a signed-in reader on every page
+   *   view of a themed site, and that caller renders the member through a fixed list of
+   *   fields that has never included custom ones. Fetching them there costs two database
+   *   queries per page view whose results are then thrown away.
+   */
+  async read(data, { withCustomFields = true, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -453,43 +451,25 @@ module.exports = class MemberBREADService {
     const unsubscribeUrl = this.settingsHelpers.createUnsubscribeUrl(member.uuid);
     member.unsubscribe_url = unsubscribeUrl;
 
-    const customFields = await this.fetchCustomFieldValues([member.id]);
-    if (customFields) {
-      member.custom_fields = customFields.get(member.id) ?? {};
+    if (withCustomFields) {
+      const customFields = await this.fetchCustomFieldValues([member.id]);
+      if (customFields) {
+        member.metafields = customFields.get(member.id) ?? {};
+      }
     }
 
     return member;
   }
 
-  /**
-   * @private
-   * The write-side flag gate, paired with `fetchCustomFieldValues` on the read
-   * side. The schema declares `custom_fields` for every site, so the key arrives
-   * whether or not the feature is on and this is what decides it goes no further.
-   * @param {object} data
-   */
-  dropCustomFieldsWhenDisabled(data) {
-    if (!this.labsService.isSet('membersCustomFields')) {
-      delete data.custom_fields;
-    }
-  }
-
   async add(data, options) {
-    this.dropCustomFieldsWhenDisabled(data);
-
-    // Values cannot be set on create, only on a subsequent edit. `namesValues`
-    // both judges the body and rejects a malformed one, so a body refused here is
-    // refused on edit for the same reason.
-    if (this.customFieldValues.namesValues(data.custom_fields)) {
+    if (this.customFieldValues.namesValues(this.customFieldValues.unwrapWire(data.metafields))) {
       throw new errors.ValidationError({
         message: tpl(messages.customFieldsOnAdd),
-        property: 'custom_fields',
+        property: 'metafields',
       });
     }
 
-    // Not a member column, so it comes off before the repository sees it. Only
-    // an absent key or one naming no values gets this far.
-    delete data.custom_fields;
+    delete data.metafields;
 
     if (!this.stripeService.configured && (data.comped || data.stripe_customer_id)) {
       const property = data.comped ? 'comped' : 'stripe_customer_id';
@@ -585,15 +565,9 @@ module.exports = class MemberBREADService {
   async edit(data, options) {
     delete data.last_seen_at;
 
-    this.dropCustomFieldsWhenDisabled(data);
-
-    // Values live in their own table, so they come off the member data before
-    // the repository sees it — `custom_fields` is not a member column. The gate
-    // above has already dropped it when the feature is off, so by this point its
-    // presence is the signal to write.
-    const customFields = data.custom_fields;
+    const customFields = this.customFieldValues.unwrapWire(data.metafields);
     const writeCustomFields = customFields !== undefined;
-    delete data.custom_fields;
+    delete data.metafields;
 
     // Plan (which validates) before the member is touched, so a bad value 422s
     // here rather than after the member edit has been applied — and keep the
@@ -654,7 +628,23 @@ module.exports = class MemberBREADService {
     }
 
     if (plannedCustomFields) {
-      await this.customFieldValues.applyWrite(model.id, plannedCustomFields);
+      // Every value reaching here was typed into the Admin API, so the writer is
+      // whoever made the request — the same pair the action log records, so the two
+      // agree about who did it rather than one saying only that it was "admin".
+      //
+      // The only route to this branch is the authenticated Admin API, so an anonymous
+      // request is a mistake somewhere upstream rather than a writer to invent a name
+      // for. Refusing keeps every stored writer resolvable.
+      const context = options.context || {};
+      if (!context.integration && !context.user) {
+        throw new errors.IncorrectUsageError({
+          message: tpl(messages.customFieldsWithoutWriter),
+        });
+      }
+      const writtenBy = context.integration
+        ? { type: 'integration', id: context.integration.id }
+        : { type: 'user', id: context.user };
+      await this.customFieldValues.applyWrite(model.id, plannedCustomFields, { writtenBy });
 
       // Custom fields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.
@@ -815,7 +805,7 @@ module.exports = class MemberBREADService {
         delete member.products;
       }
       if (customFieldsByMember) {
-        member.custom_fields = customFieldsByMember.get(model.id) ?? {};
+        member.metafields = customFieldsByMember.get(model.id) ?? {};
       }
       member.email_suppression = {
         suppressed: bulkSuppressionData[index].suppressed || !!model.get('email_disabled'),

package/core/server/services/members/members-api/services/payments-service.js

@@ -14,6 +14,8 @@ class PaymentsService {
    * @param {import('../../../offers/application/offers-api')} deps.offersAPI
    * @param {import('../../../stripe/stripe-api')} deps.stripeAPIService
    * @param {{get(key: string): any}} deps.settingsCache
+   * @param {{checkout: import('../../../tier-checkout-config').TierCheckoutConfigService}} deps.tiersService
+   * @param {{isSet(flag: string): boolean}} deps.labsService
    */
   constructor(deps) {
     /** @private */
@@ -30,6 +32,10 @@ class PaymentsService {
     this.stripeAPIService = deps.stripeAPIService;
     /** @private */
     this.settingsCache = deps.settingsCache;
+    /** @private */
+    this.tiersService = deps.tiersService;
+    /** @private */
+    this.labsService = deps.labsService;
     DomainEvents.subscribe(OfferCreatedEvent, async (event) => {
       await this.getCouponForOffer(event.data.offer.id);
     });
@@ -114,11 +120,19 @@ class PaymentsService {
     const price = await this.getPriceForTierCadence(tier, cadence);
 
     const data = {
-      metadata,
+      // The tier being bought, recorded on the session so the completed event can find
+      // the configuration that produced its questions. Nothing else carries it: a
+      // completed session names prices and products, and mapping those back is a
+      // lookup that can fail where this cannot.
+      metadata: { ...metadata, ghostTierId: tier.id.toHexString() },
       successUrl: successUrl,
       cancelUrl: cancelUrl,
       trialDays: trialDays ?? tier.trialDays,
       coupon: coupon?.id,
+      // Resolved here rather than cached with the tier, so a field archived a minute
+      // ago stops being asked on the next checkout. A failure to resolve must not
+      // stop a member paying, so it costs the questions and nothing else.
+      checkout: await this.getCheckoutConfigForTier(tier),
     };
 
     // If we already have a coupon, we don't want to give trial days over it
@@ -135,6 +149,38 @@ class PaymentsService {
     return session.url;
   }
 
+  /**
+   * What this tier's checkout should ask for beyond the payment, or nothing.
+   *
+   * Undefined on every path but the configured one, including the flag being off: the
+   * session builder adds no parameters for it, so an unconfigured site's request to
+   * Stripe is exactly the request it made before this existed.
+   *
+   * @private
+   * @param {import('../../../tiers/tier')} tier
+   */
+  async getCheckoutConfigForTier(tier) {
+    const checkoutConfig = this.tiersService?.checkout;
+    if (!this.labsService?.isSet('stripeCheckoutCollection') || !checkoutConfig) {
+      return undefined;
+    }
+    try {
+      return await checkoutConfig.resolve(tier.id.toHexString());
+    } catch (err) {
+      // A checkout that asks one fewer question still takes the money; one that fails
+      // to be created takes none. This is the whole reason it is caught.
+      logging.error(
+        {
+          event: { name: 'stripe_checkout.tier_config.resolve_failed' },
+          err,
+          tierId: tier.id.toHexString(),
+        },
+        'Failed to resolve what a tier checkout should collect',
+      );
+      return undefined;
+    }
+  }
+
   /**
    * @param {object} params
    * @param {Member} [params.member]

package/core/server/services/members/service.js

@@ -7,7 +7,6 @@ const MembersConfigProvider = require('./members-config-provider');
 const { makeImporter, makeExporter } = require('./import-export');
 const { resolveInlineThreshold } = require('./import-export/config');
 const MembersStats = require('./stats/members-stats');
-const memberJobs = require('./jobs');
 const logging = require('@tryghost/logging');
 const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
@@ -29,7 +28,7 @@ const messages = {
   sslRequiredForStripe:
     'Cannot run Ghost without SSL when Stripe is connected. Please update your url config to use "https://".',
   remoteWebhooksInDevelopment:
-    'Cannot use remote webhooks in development. See https://ghost.org/docs/webhooks/#stripe-webhooks for developing with Stripe.',
+    'Cannot use remote webhooks in development. See https://docs.ghost.org/webhooks/#stripe-webhooks for developing with Stripe.',
 };
 
 const ghostMailer = new GhostMailer();
@@ -216,9 +215,6 @@ module.exports = {
         );
       }
     }
-
-    // Schedule daily cron job to clean expired comp subs
-    memberJobs.scheduleExpiredCompCleanupJob();
   },
   contentGating: require('./content-gating'),
 

package/core/server/services/members-custom-fields/actions.js

@@ -3,8 +3,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.actingContext = actingContext;
 exports.recordCustomFieldAction = recordCustomFieldAction;
 const logging_1 = __importDefault(require("@tryghost/logging"));
+/**
+ * Who is acting, read off an API frame's context.
+ *
+ * Here rather than in each endpoint, because two resources now record custom field history
+ * and a second reading of the same shape is a second chance to disagree about it. An
+ * integration and a user are both actors; a request that is neither — a webhook, a job —
+ * has none, and the history says so rather than guessing.
+ */
+function actingContext(context) {
+    const frame = (context ?? {});
+    if (frame.integration) {
+        return { actor: { id: frame.integration.id, type: 'integration' } };
+    }
+    if (frame.user) {
+        return { actor: { id: frame.user, type: 'user' } };
+    }
+    return { actor: null };
+}
 // Field-definition changes map to activity-feed events. A field's timeline reads
 // added -> edited -> archived -> restored, and a permanent delete (only from the
 // archived state) ends it with deleted.
@@ -35,6 +54,13 @@ async function recordCustomFieldAction({ Action, context, verb, subject, details
         }, { autoRefresh: false });
     }
     catch (err) {
-        logging_1.default.error(err);
+        logging_1.default.error({
+            event: { name: 'members.custom_fields.action_log_failed' },
+            err,
+            verb,
+            subject,
+            actorType: context.actor.type,
+            actorId: context.actor.id,
+        }, 'Failed to record a member custom field action');
     }
 }

package/core/server/services/members-custom-fields/bindings-service.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomFieldBindingsService = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const schema_1 = require("./schema");
+const FIELDS_TABLE = 'members_custom_fields';
+const { CUSTOM_NAMESPACE } = require('@tryghost/custom-field-types/identity');
+const BINDINGS_TABLE = 'members_custom_field_bindings';
+/**
+ * Where a source sends what it collected: a `port` is the name that source uses for a
+ * thing, and the binding resolves it to one of the publisher's fields.
+ */
+class CustomFieldBindingsService {
+    knex;
+    values;
+    constructor({ knex, values }) {
+        this.knex = knex;
+        this.values = values;
+    }
+    async bind(db, productId, port, customFieldKey, now) {
+        const existing = await db(BINDINGS_TABLE).where({ product_id: productId, port }).first();
+        if (existing?.custom_field_key === customFieldKey) {
+            await db(BINDINGS_TABLE).where('id', existing.id).update({ updated_at: now });
+            return existing.id;
+        }
+        if (existing) {
+            await db(BINDINGS_TABLE).where('id', existing.id).del();
+        }
+        const bindingId = new bson_objectid_1.default().toHexString();
+        await db(BINDINGS_TABLE).insert({
+            id: bindingId,
+            product_id: productId,
+            port,
+            custom_field_key: customFieldKey,
+            created_at: now,
+            updated_at: now,
+        });
+        return bindingId;
+    }
+    /** Stops the writing. Whatever hangs off the binding cascades with it. */
+    async remove(db, productId, port) {
+        await db(BINDINGS_TABLE).where({ product_id: productId, port }).del();
+    }
+    /**
+     * Values arrive in the order they are to be applied: where two land in one field, the
+     * last of them is what the field holds.
+     */
+    async writeCollected(memberId, productId, collected) {
+        for (const { port, value } of collected) {
+            const destination = await this.resolve(productId, port);
+            if (!destination) {
+                continue;
+            }
+            await this.writeOne(memberId, destination, value);
+        }
+    }
+    async writeOne(memberId, into, value) {
+        let planned;
+        try {
+            planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value });
+        }
+        catch (err) {
+            logging_1.default.warn({
+                event: { name: 'members.custom_fields.collected_value_rejected' },
+                err,
+                memberId,
+                customFieldKey: into.key,
+            }, 'A collected value could not be saved');
+            return;
+        }
+        try {
+            await this.values.applyWrite(memberId, planned, {
+                writtenBy: { type: 'binding', id: into.bindingId },
+            });
+        }
+        catch (err) {
+            logging_1.default.error({
+                event: { name: 'members.custom_fields.collected_value_write_failed' },
+                err,
+                memberId,
+                customFieldKey: into.key,
+                bindingId: into.bindingId,
+            }, 'Failed to store a collected custom field value');
+        }
+    }
+    async resolve(productId, port) {
+        const row = await this.knex(BINDINGS_TABLE)
+            .join(FIELDS_TABLE, `${BINDINGS_TABLE}.custom_field_key`, `${FIELDS_TABLE}.key`)
+            .where(`${BINDINGS_TABLE}.product_id`, productId)
+            .where(`${BINDINGS_TABLE}.port`, port)
+            // An archived destination is still where this goes, and still not somewhere a value
+            // can land, so the write drops rather than waiting.
+            .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
+            .select(`${BINDINGS_TABLE}.id as binding_id`, `${FIELDS_TABLE}.key`, `${FIELDS_TABLE}.type`)
+            .first();
+        if (!row) {
+            return null;
+        }
+        // Decoded rather than trusted: a join is a read boundary, and `type` is what decides
+        // how the collected value is read. Unreadable counts as unresolved rather than
+        // throwing, so one bad row skips its value the way an unbound port does instead of
+        // failing everything else the same checkout collected.
+        const bound = schema_1.DbBoundField.safeParse(row);
+        if (!bound.success) {
+            logging_1.default.warn({
+                event: { name: 'members.custom_fields.binding_unreadable' },
+                err: bound.error,
+                productId,
+                port,
+            }, 'A binding could not be read');
+            return null;
+        }
+        return { bindingId: bound.data.binding_id, key: bound.data.key, type: bound.data.type };
+    }
+}
+exports.CustomFieldBindingsService = CustomFieldBindingsService;

package/core/server/services/members-custom-fields/codec.js

@@ -2,14 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.customFieldCodec = void 0;
 const zod_1 = require("zod");
+const identity_1 = require("@tryghost/custom-field-types/identity");
 const case_keys_1 = require("../../lib/case-keys");
 const schema_1 = require("./schema");
 const models_1 = require("./models");
-// Maps a members_custom_fields row to/from the domain CustomField (snake_case to
-// camelCase; DbDate decoding happens in DbCustomField).
 exports.customFieldCodec = zod_1.z.codec(schema_1.DbCustomField, models_1.CustomField, {
     // DbCustomField validates `type` as the field-type enum, so the decoded row
     // already carries a FieldType and camelKeys preserves it — no cast needed.
-    decode: (row) => (0, case_keys_1.camelKeys)(row),
-    encode: (field) => (0, case_keys_1.snakeKeys)(field),
+    decode: (row) => ({ ...(0, case_keys_1.camelKeys)(row), namespace: identity_1.CUSTOM_NAMESPACE }),
+    encode: ({ namespace: _namespace, ...field }) => (0, case_keys_1.snakeKeys)(field),
 });