ghost 6.60.0 → 6.62.0

package/core/server/services/members-custom-fields/definitions-service.js

@@ -8,6 +8,7 @@ const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
+const identity_1 = require("@tryghost/custom-field-types/identity");
 const codec_1 = require("./codec");
 const schema_1 = require("./schema");
 const queries_1 = require("./queries");
@@ -33,10 +34,12 @@ const MAX_KEY_BASE_LENGTH = MAX_KEY_LENGTH - (String(MAX_KEY_ITERATIONS).length
 // object from JSON.parse. A key naming a member of Object.prototype reads back as
 // inherited rather than absent wherever one of those objects is indexed.
 //
-// Derived rather than listed, because the set is a consequence of how keys are
-// minted: minting lowercases and trims leading underscores, so a prototype name
-// survives only if it has neither. `constructor` is the only one.
-const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype).filter((name) => (0, key_1.mintableKey)(name) === name);
+// Derived rather than listed, from the format a key may take rather than from how one
+// is minted: a caller can state a key instead of deriving it from a name, so what has
+// to be reserved is every prototype name a well-formed key could spell. The ones that
+// carry a capital cannot be spelled at all and need no reserving; `constructor` and
+// `__proto__` can.
+const RESERVED_KEYS = Object.getOwnPropertyNames(Object.prototype).filter((name) => key_1.KEY_CHARACTERS.test(name));
 const FieldName = zod_1.z
     .string()
     .trim()
@@ -90,7 +93,29 @@ class CustomFieldDefinitionsService {
         // restart. Where the number comes from is the caller's business.
         this.getMaxDefinitions = getMaxDefinitions;
     }
+    async hasAnyActive() {
+        const [field] = await this.list((0, queries_1.activeFields)(this.knex).limit(1));
+        return Boolean(field);
+    }
+    /**
+     * The fields table has no namespace column: every row in it belongs to the publisher's
+     * `custom` namespace, so no other namespace can have a stored field.
+     */
+    isStored(namespace) {
+        return namespace === identity_1.CUSTOM_NAMESPACE;
+    }
+    assertDefinable(namespace) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.ValidationError({
+                message: `Fields cannot be defined in the "${namespace}" namespace.`,
+                property: 'namespace',
+            });
+        }
+    }
     async browse(options = {}) {
+        if (options.namespace !== undefined && !this.isStored(options.namespace)) {
+            return [];
+        }
         // Archived fields are hidden by default: most surfaces (member details, the
         // filter picker, the importer) only ever want active fields. A caller-
         // supplied `filter` can widen that — Settings pulls active and archived
@@ -113,12 +138,12 @@ class CustomFieldDefinitionsService {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
         return rows.map((row) => zod_1.z.decode(codec_1.customFieldCodec, row));
     }
-    async read(key) {
-        const row = await this.knex(TABLE).where('key', key).first();
-        if (!row) {
+    async read(namespace, key) {
+        const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
+        if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
-        return zod_1.z.decode(codec_1.customFieldCodec, row);
+        return field;
     }
     /**
      * Create one or more field definitions. All-or-nothing: the batch runs in a
@@ -130,7 +155,8 @@ class CustomFieldDefinitionsService {
      * batch, so two items sharing a name are caught and two items deriving the same
      * key get distinct ones, exactly as if they had arrived as separate requests.
      */
-    async add(context, input) {
+    async add(context, namespace, input) {
+        this.assertDefinable(namespace);
         const requestedCount = Array.isArray(input) ? input.length : 0;
         const parsed = AddFieldsInput.safeParse(input);
         if (!parsed.success) {
@@ -167,13 +193,11 @@ class CustomFieldDefinitionsService {
                 for (const [index, field] of fields.entries()) {
                     await this.assertNameAvailable(trx, field.name);
                     const key = await this.mintKey(trx, bases[index]);
-                    await trx(TABLE).insert({
-                        id: new bson_objectid_1.default().toHexString(),
+                    await this.insertField(trx, {
                         key,
                         name: field.name,
                         type: field.type,
-                        sort_order: firstSortOrder + index,
-                        created_at: new Date(),
+                        sortOrder: firstSortOrder + index,
                     });
                     keys.push(key);
                 }
@@ -194,7 +218,69 @@ class CustomFieldDefinitionsService {
         // Logged after the commit: the action log is a separate Bookshelf write
         // outside this transaction, so recording inside it would leave orphaned
         // "added" entries for fields a rollback never created.
-        for (const field of created) {
+        await this.recordCreated(context, created);
+        return created;
+    }
+    /**
+     * Given an executor it joins that transaction; given none it opens its own. Unlike
+     * `add`, the key is stated rather than minted from the name, and nothing about it is
+     * worked around: a caller states a key because something else already names that key,
+     * so a variant of it would be a field nothing points at.
+     *
+     * The field is returned rather than logged: the history writes on its own connection,
+     * which a single-connection pool would deadlock against an open transaction.
+     */
+    async addOne(wanted, { executor = this.knex } = {}) {
+        // Before any database access, the way `add` mints before opening its transaction:
+        // an unusable key is a payload problem worth reporting on its own terms.
+        assertKeyUsable(wanted.key);
+        const write = async (db) => {
+            await this.assertWithinLimit(db, 1);
+            await this.assertKeyAvailable(db, wanted.key);
+            await this.assertNameAvailable(db, wanted.name);
+            await this.insertField(db, {
+                key: wanted.key,
+                name: wanted.name,
+                type: wanted.type,
+                sortOrder: await this.nextSortOrder(db),
+            });
+            const [created] = await this.readMany(db, [wanted.key]);
+            return created;
+        };
+        // knex's marker for a transactor: join it rather than nesting a savepoint under it.
+        return executor.isTransaction ? write(executor) : executor.transaction(write);
+    }
+    /**
+     * Only for a stated key. Minting picks a free one instead, so this reads as a clean 422
+     * where the unique index would read as a 500.
+     */
+    async assertKeyAvailable(db, key) {
+        const taken = await db(TABLE).where('key', key).first();
+        if (taken) {
+            throw new errors_1.default.ValidationError({
+                message: 'A custom field with this key already exists.',
+                property: 'key',
+            });
+        }
+    }
+    async insertField(db, field) {
+        await db(TABLE).insert({
+            id: new bson_objectid_1.default().toHexString(),
+            key: field.key,
+            name: field.name,
+            type: field.type,
+            sort_order: field.sortOrder,
+            created_at: new Date(),
+        });
+    }
+    /** `read` for a caller that is deciding rather than serving: absent is an answer. */
+    async findByKey(key, { executor = this.knex } = {}) {
+        const row = await executor(TABLE).where('key', key).first();
+        return row ? zod_1.z.decode(codec_1.customFieldCodec, row) : null;
+    }
+    /** The same entry `add` writes. Only the caller knows its transaction committed. */
+    async recordCreated(context, fields) {
+        for (const field of fields) {
             await this.recordAction({
                 context,
                 verb: 'create',
@@ -202,7 +288,6 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: field.name, key: field.key },
             });
         }
-        return created;
     }
     /**
      * The operational ceiling on how many definitions a site can hold. This is a
@@ -249,7 +334,8 @@ class CustomFieldDefinitionsService {
      * fresh rank, so a move is well-defined even where every rank is still the default.
      * Returns every definition, archived included, matching what the request named.
      */
-    async reorder(context, input) {
+    async reorder(context, namespace, input) {
+        this.assertDefinable(namespace);
         const parsed = ReorderInput.safeParse(input);
         if (!parsed.success) {
             const issue = parsed.error.issues[0];
@@ -368,7 +454,10 @@ class CustomFieldDefinitionsService {
             });
         }
     }
-    async edit(context, key, input) {
+    async edit(context, namespace, key, input) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
+        }
         const parsed = EditFieldInput.safeParse(input);
         if (!parsed.success) {
             throw new errors_1.default.ValidationError({
@@ -377,7 +466,7 @@ class CustomFieldDefinitionsService {
             });
         }
         const patch = parsed.data;
-        const existing = await this.read(key);
+        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key);
         // Key and type are immutable after creation: values are addressed by key
         // and interpreted by type, so changing either would silently orphan or
         // corrupt stored values. Reject a differing value rather than ignore it.
@@ -431,7 +520,7 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: patch.name ?? existing.name, key },
             });
         }
-        return this.read(key);
+        return this.read(identity_1.CUSTOM_NAMESPACE, key);
     }
     /**
      * Permanently delete a field and every member value attached to it (the FK
@@ -440,7 +529,10 @@ class CustomFieldDefinitionsService {
      * which makes accidental data loss a deliberate two-step. Archiving is the
      * reversible soft state (see `edit` with a status change).
      */
-    async destroy(context, key) {
+    async destroy(context, namespace, key) {
+        if (!this.isStored(namespace)) {
+            throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
+        }
         const field = await this.knex(TABLE).where('key', key).first();
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
@@ -460,6 +552,36 @@ class CustomFieldDefinitionsService {
     }
 }
 exports.CustomFieldDefinitionsService = CustomFieldDefinitionsService;
+/**
+ * The shape a stated key has to have. Minting derives one that is usable by
+ * construction, so this is the check that path never needed: a caller stating its own
+ * key has said nothing about the format, and guarding here covers every route in
+ * rather than whichever one arrived first.
+ *
+ * The length bound is the column's own, not `mintKey`'s: that one holds back room for a
+ * `_<n>` collision suffix, and a stated key is written exactly as given and never
+ * suffixed, so the whole column is available to it.
+ */
+function assertKeyUsable(key) {
+    if (!key_1.KEY_CHARACTERS.test(key)) {
+        throw new errors_1.default.ValidationError({
+            message: 'A custom field key can only contain lowercase letters, numbers and underscores.',
+            property: 'key',
+        });
+    }
+    if (key.length > MAX_KEY_LENGTH) {
+        throw new errors_1.default.ValidationError({
+            message: `A custom field key can be at most ${MAX_KEY_LENGTH} characters.`,
+            property: 'key',
+        });
+    }
+    if (RESERVED_KEYS.includes(key)) {
+        throw new errors_1.default.ValidationError({
+            message: `${key} cannot be used as a custom field key.`,
+            property: 'key',
+        });
+    }
+}
 // The field a zod issue points at. Create validates an array, so an issue's path
 // is prefixed with the item's index (`[0, 'name']`); `property` names the field
 // that is wrong, so the numeric prefix is dropped. Which item it was is reported
@@ -490,6 +612,24 @@ function applyFilter(query, filter) {
     let mongoQuery;
     try {
         mongoQuery = nql(filter).toJSON();
+    }
+    catch (err) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Could not parse the filter parameter.',
+            property: 'filter',
+            err: err,
+        });
+    }
+    // The table has no `namespace` column, so mongo-knex would compile this into SQL against a
+    // column that does not exist. Refuse it at the edge, naming the URL as the way to pick a
+    // namespace, rather than surface a database error.
+    if (filterReferencesAttribute(mongoQuery, 'namespace')) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Filtering on namespace is not supported. Scope by the namespace route instead.',
+            property: 'filter',
+        });
+    }
+    try {
         knexify(query, mongoQuery, { tableName: TABLE });
     }
     catch (err) {
@@ -508,12 +648,15 @@ function applyFilter(query, filter) {
 // $and/$or/$nor combinators — so a status filter at any nesting counts as the
 // caller opting in to (or out of) archived fields.
 function filterReferencesStatus(query) {
+    return filterReferencesAttribute(query, 'status');
+}
+function filterReferencesAttribute(query, attribute) {
     return Object.entries(query).some(([key, value]) => {
-        if (key === 'status') {
+        if (key === attribute) {
             return true;
         }
         if ((key === '$and' || key === '$or' || key === '$nor') && Array.isArray(value)) {
-            return value.some((sub) => filterReferencesStatus(sub));
+            return value.some((sub) => filterReferencesAttribute(sub, attribute));
         }
         return false;
     });

package/core/server/services/members-custom-fields/filter.js

@@ -5,34 +5,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CUSTOM_FIELDS_RELATION = void 0;
 exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransformer;
-// The members filter reaches custom field values through a `custom_fields` relation
-// on the Member model (the values table joined on member_id). A field is named by its
-// `key` — the stable public slug — and matched on its `value`; a composite field's
-// part is named as `value.<part>`, and a part's presence as `path.<part>`:
+// Translates the metafield clauses of a members filter into a query over the
+// values table. A metafield is a publisher-defined field on a member; it is
+// addressed as `namespace.key`, and a composite value such as an address names
+// one of its parts by appending it: `namespace.key.part`.
 //
-//   (custom_fields.key:'company'+custom_fields.value:'Ghost')               // value
-//   (custom_fields.key:'shipping_address'+custom_fields.value.country:'GB')
-//   custom_fields.key:'phone'  /  custom_fields.key:-'phone'                // field set / not set
-//   (custom_fields.key:'shipping_address'+custom_fields.path:'country')     // part set
-//   (custom_fields.key:'shipping_address'+custom_fields.path:-'country')    // part not set
+//   (metafields.key:'custom.company'+metafields.value:'Ghost')
+//   (metafields.key:'custom.shipping_address.country'+metafields.value:'GB')
+//   metafields.key:'custom.company'                     // has a value
+//   metafields.key:-'custom.shipping_address.country'   // that part is not set
 //
-// The values table stores one row per leaf: `custom_field_key` (the field's stable key),
-// `path` (empty for a scalar, the part's key for a composite), and `value_text`. A scalar
-// field is just a leaf at path ''; "the field", "a part", and "the whole field" are the
-// same thing — a set of leaf rows pinned by (custom_field_key, [path], [value]). So every
-// filter is one `$elemMatch` over those columns: positive asserts a matching leaf exists,
-// `$not` asserts none does. The public grammar is the storage vocabulary here — the key
-// sits on the row — so the transformer emits it straight, with no id lookup and no field
-// catalog read. That is what lets the Member model chain it inline on every members query,
-// rather than each call site remembering to wire it. A key that names no current field
-// matches no leaf; the admin never offers an archived or deleted field in the filter UI,
-// though the API leaves them queryable.
+// The values table holds one row per stored value: `custom_field_key`, `path`
+// (empty for a plain field, the part's name for one part of a composite) and
+// `value_text`. A filter addresses those columns directly, so each one becomes a
+// single $elemMatch over them — positive asserts a matching row exists, $not
+// asserts none does — with no lookup against the field definitions.
 const errors_1 = __importDefault(require("@tryghost/errors"));
-const RELATION = 'custom_fields';
+const identity_1 = require("@tryghost/custom-field-types/identity");
+const RELATION = 'metafields';
 const PREFIX = `${RELATION}.`;
 const KEY_ATTRIBUTE = `${PREFIX}key`;
 const VALUE_ATTRIBUTE = `${PREFIX}value`;
-const PATH_ATTRIBUTE = `${PREFIX}path`;
 const ROOT_PATH = '';
 // Only recurse into plain objects/arrays; a RegExp, Date, etc. is a leaf value that
 // must pass through by reference (recursing would strip a regex to `{}`).
@@ -42,8 +35,7 @@ function isPlainObject(value) {
         !Array.isArray(value) &&
         (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null));
 }
-// A single-clause object whose one key targets the custom_fields relation.
-function isCustomFieldClause(node) {
+function isMetafieldClause(node) {
     if (!isPlainObject(node)) {
         return false;
     }
@@ -57,100 +49,94 @@ function isCustomFieldClause(node) {
 // `key:'a'+key:'b'`, since a bare key clause needs no group of its own. That is two
 // filters — a member with a value for both — not one leaf that is somehow both fields, so
 // it has to fall through and be transformed a clause at a time.
-function isCustomFieldCompound(clauses) {
-    if (!Array.isArray(clauses) || clauses.length < 2 || !clauses.every(isCustomFieldClause)) {
+function isMetafieldCompound(clauses) {
+    if (!Array.isArray(clauses) || clauses.length < 2 || !clauses.every(isMetafieldClause)) {
         return false;
     }
     return clauses.filter((clause) => Object.keys(clause)[0] === KEY_ATTRIBUTE).length === 1;
 }
-// `custom_fields.value` addresses the scalar (root) leaf; `custom_fields.value.<part>`
-// a composite's part. Returns the row `path` the attribute selects, or null if the
-// attribute isn't a value clause.
-function pathForValueAttribute(attribute) {
-    if (attribute === VALUE_ATTRIBUTE) {
-        return ROOT_PATH;
-    }
-    if (attribute.startsWith(`${VALUE_ATTRIBUTE}.`)) {
-        return attribute.slice(`${VALUE_ATTRIBUTE}.`.length);
-    }
-    return null;
-}
-// The single `{$ne}` shape all negations arrive as (is-not-set on a key or part).
+// NQL compiles every negation in this grammar to `{$ne: <string>}`, so a negated clause
+// can arrive in no other shape.
 function negatedString(value) {
     return isPlainObject(value) && typeof value.$ne === 'string' ? value.$ne : null;
 }
+const ANY_PATH = null;
+// A stored key never contains a dot, so a full dotted identity is a key no stored
+// row can equal.
+function unmatchableLeaf(identity) {
+    return { key: (0, identity_1.formatIdentity)(identity), path: identity.partPath };
+}
+function parseLeafAddress(raw) {
+    const identity = typeof raw === 'string' ? (0, identity_1.parseIdentity)(raw) : null;
+    if (!identity) {
+        throw new errors_1.default.BadRequestError({
+            message: `A metafield filter names a field as namespace.key, for example (${KEY_ATTRIBUTE}:'custom.company'+${VALUE_ATTRIBUTE}:'Ghost').`,
+        });
+    }
+    if (identity.namespace !== identity_1.CUSTOM_NAMESPACE) {
+        return unmatchableLeaf(identity);
+    }
+    return { key: identity.key, path: identity.partPath };
+}
 function createCustomFieldsFilterTransformer() {
-    // The grammar carries the field key in the clause value; take it as a string,
-    // defaulting to one no field can hold so a malformed clause matches nothing.
-    const keyOf = (value) => (typeof value === 'string' ? value : '');
     // One (maybe-negated) $elemMatch over the leaf columns: positive is "a leaf pinned
     // by these matches", `$not` is "no leaf does".
-    function buildElemMatch(fieldKey, conditions, negate) {
-        const match = { custom_field_key: fieldKey, ...conditions };
+    function buildElemMatch(target, value, negate) {
+        const match = { custom_field_key: target.key };
+        if (value !== undefined) {
+            match.path = target.path ?? ROOT_PATH;
+            match.value_text = value;
+        }
+        else if (target.path !== ANY_PATH) {
+            match.path = target.path;
+        }
         if (negate) {
             return { [RELATION]: { $not: { $elemMatch: match } } };
         }
         return { [RELATION]: { $elemMatch: match } };
     }
-    // A `(key + value[.part] | path)` compound. A `value` clause pins the part and its
-    // value; a `path` clause pins the part's presence (no value), and a negated path is
-    // is-not-set — no such leaf — which negates the whole match.
     function toElemMatch(clauses) {
-        let fieldKey = '';
-        let hasKey = false;
-        let hasLeaf = false;
-        const conditions = {};
-        let negate = false;
-        const oneLeafOnly = () => {
-            if (hasLeaf) {
-                throw new errors_1.default.BadRequestError({
-                    message: 'A custom field filter takes one value or path clause.',
-                });
-            }
-            hasLeaf = true;
-        };
+        let target;
+        let value;
+        let hasValue = false;
         for (const clause of clauses) {
-            const [attribute, value] = Object.entries(clause)[0];
+            const [attribute, clauseValue] = Object.entries(clause)[0];
             if (attribute === KEY_ATTRIBUTE) {
-                if (hasKey) {
+                if (negatedString(clauseValue) !== null) {
                     throw new errors_1.default.BadRequestError({
-                        message: `A custom field filter takes one "${KEY_ATTRIBUTE}" clause.`,
+                        message: `A negated "${KEY_ATTRIBUTE}" stands alone; it cannot be grouped with a value.`,
                     });
                 }
-                hasKey = true;
-                fieldKey = keyOf(value);
-            }
-            else if (attribute === PATH_ATTRIBUTE) {
-                oneLeafOnly();
-                const negatedPath = negatedString(value);
-                conditions.path = negatedPath ?? value;
-                negate = negatedPath !== null;
+                target = parseLeafAddress(clauseValue);
             }
-            else {
-                const path = pathForValueAttribute(attribute);
-                if (path === null) {
-                    // Not the key, a value/value.<part>, or a path: it names no leaf
-                    // column, so dropping it would silently widen the match to the key
-                    // alone. Fail closed instead.
+            else if (attribute === VALUE_ATTRIBUTE) {
+                if (hasValue) {
                     throw new errors_1.default.BadRequestError({
-                        message: `Unsupported custom field filter clause "${attribute}".`,
+                        message: `A metafield filter takes one "${VALUE_ATTRIBUTE}" clause.`,
                     });
                 }
-                oneLeafOnly();
-                conditions.path = path;
-                conditions.value_text = value;
+                hasValue = true;
+                value = clauseValue;
             }
+            else {
+                throw new errors_1.default.BadRequestError({
+                    message: `Unsupported metafield filter clause "${attribute}".`,
+                });
+            }
+        }
+        if (!target) {
+            throw new errors_1.default.BadRequestError({
+                message: `A metafield filter needs a "${KEY_ATTRIBUTE}" clause.`,
+            });
         }
-        return buildElemMatch(fieldKey, conditions, negate);
+        return buildElemMatch(target, hasValue ? value : undefined, false);
     }
-    // A standalone `key` clause is whole-field is-set / is-not-set: a leaf for this
-    // field exists (any part), or none does.
     function fromKeyClause(value) {
         const negatedKey = negatedString(value);
         if (negatedKey !== null) {
-            return buildElemMatch(keyOf(negatedKey), {}, true);
+            return buildElemMatch(parseLeafAddress(negatedKey), undefined, true);
         }
-        return buildElemMatch(keyOf(value), {}, false);
+        return buildElemMatch(parseLeafAddress(value), undefined, false);
     }
     function transform(node) {
         if (Array.isArray(node)) {
@@ -159,7 +145,7 @@ function createCustomFieldsFilterTransformer() {
         if (!isPlainObject(node)) {
             return node;
         }
-        if (isCustomFieldCompound(node.$and)) {
+        if (isMetafieldCompound(node.$and)) {
             return toElemMatch(node.$and);
         }
         const out = {};
@@ -168,12 +154,8 @@ function createCustomFieldsFilterTransformer() {
                 Object.assign(out, fromKeyClause(value));
             }
             else if (key.startsWith(PREFIX)) {
-                // A value or path clause only means something paired with its key in one
-                // leaf, which arrives as the compound handled above. A `custom_fields.*`
-                // clause reaching here is unpaired (or its pair was not grouped), so fail
-                // closed rather than pass it to mongo-knex as a column that does not exist.
                 throw new errors_1.default.BadRequestError({
-                    message: `A "${key}" filter must be grouped with its "${KEY_ATTRIBUTE}" clause, for example (${KEY_ATTRIBUTE}:'a_field'+${VALUE_ATTRIBUTE}:'a value').`,
+                    message: `A "${key}" filter must be grouped with its "${KEY_ATTRIBUTE}" clause, for example (${KEY_ATTRIBUTE}:'custom.a_field'+${VALUE_ATTRIBUTE}:'a value').`,
                 });
             }
             else {
@@ -189,7 +171,7 @@ function createCustomFieldsFilterTransformer() {
  * rows (one per field, or per part of a composite field), and a predicate asks whether
  * one of them matches, so this joins the values table on member_id and mongo-knex emits
  * it as a correlated `members.id IN (…)` subquery — composing with every other member
- * filter. Registered only behind the `membersCustomFields` flag.
+ * filter.
  */
 exports.CUSTOM_FIELDS_RELATION = {
     tableName: 'members_custom_field_values',

package/core/server/services/members-custom-fields/index.js

@@ -1,15 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.values = exports.definitions = void 0;
+exports.bindings = exports.values = exports.definitions = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
+const bindings_service_1 = require("./bindings-service");
 const actions_1 = require("./actions");
 const config_1 = require("./config");
+var actions_2 = require("./actions");
+Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
 function init() {
-    // The two are constructed together below, so checking both keeps the "both or
-    // neither" invariant explicit rather than trusting one to stand in for the pair.
-    if (exports.definitions && exports.values) {
+    // The three are constructed together below, so checking all of them keeps the "all or
+    // none" invariant explicit rather than trusting one to stand in for the rest.
+    if (exports.definitions && exports.values && exports.bindings) {
         return;
     }
     const { knex } = require('../../data/db');
@@ -31,4 +34,8 @@ function init() {
         knex,
         getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
     });
+    // Built after the values, which is what a binding routes into. It has no handle on the
+    // definitions: making a field is not part of binding to one, so a caller that needs both
+    // asks for both.
+    exports.bindings = new bindings_service_1.CustomFieldBindingsService({ knex, values: exports.values });
 }

package/core/server/services/members-custom-fields/key.js

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KEY_CHARACTERS = void 0;
 exports.mintableKey = mintableKey;
+const identity_1 = require("@tryghost/custom-field-types/identity");
 // Neither package ships types.
 const { stripInvisibleChars } = require('@tryghost/string');
 const unidecode = require('unidecode');
 /** Every character a key may contain. Nothing else survives minting. */
-exports.KEY_CHARACTERS = /^[a-z0-9_]+$/;
+exports.KEY_CHARACTERS = identity_1.IDENTITY_SEGMENT;
 /**
  * Mint the key a field is addressed by, from the name a publisher chose.
  *

package/core/server/services/members-custom-fields/models.js

@@ -4,9 +4,9 @@ exports.CustomField = void 0;
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
 const schema_1 = require("./schema");
-// The domain shape of a field definition (camelCase; distinct from the DB row).
 exports.CustomField = zod_1.z.object({
     id: zod_1.z.string(),
+    namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
     type: custom_field_types_1.FieldTypeSchema,

package/core/server/services/members-custom-fields/queries.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.activeFields = activeFields;
+exports.fieldByKey = fieldByKey;
 exports.inFieldOrder = inFieldOrder;
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_custom_fields';
@@ -11,6 +12,10 @@ const FIELDS_TABLE = 'members_custom_fields';
 function activeFields(db) {
     return db(FIELDS_TABLE).where('status', schema_1.FIELD_STATUS.active);
 }
+/** One field by key, as the same kind of query the rest of this reads through. */
+function fieldByKey(db, key) {
+    return db(FIELDS_TABLE).where(`${FIELDS_TABLE}.key`, key);
+}
 /**
  * The publisher's order, applied to every read of the list. Here for the same reason the
  * status filter is: a read that forgets it comes back in whatever order the engine chose.