ghost 6.60.0 → 6.62.0

package/core/server/services/tier-checkout-config/queries.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIELDS_TABLE = exports.BINDINGS_TABLE = exports.CONFIG_TABLE = exports.QUESTIONS_TABLE = void 0;
+exports.collectionRowsForTier = collectionRowsForTier;
+exports.configuredCollectionRows = configuredCollectionRows;
+exports.questionRows = questionRows;
+const schema_1 = require("../members-custom-fields/schema");
+const checkout_1 = require("@tryghost/checkout");
+const schema_2 = require("./schema");
+exports.QUESTIONS_TABLE = 'products_checkout_fields';
+exports.CONFIG_TABLE = 'products_checkout_config';
+exports.BINDINGS_TABLE = 'members_custom_field_bindings';
+exports.FIELDS_TABLE = 'members_custom_fields';
+const ACTIVE = schema_1.FIELD_STATUS.active;
+const optionColumns = Object.keys(schema_2.DbCheckoutOptions.shape).map((column) => `${exports.CONFIG_TABLE}.${column}`);
+function collectionQuery(db) {
+    const bindTo = (alias, port) => function () {
+        this.on(`${alias}.product_id`, 'products.id').andOn(db.raw(`${alias}.port = ?`, [port]));
+    };
+    const landsIn = (alias, binding) => function () {
+        this.on(`${alias}.key`, `${binding}.custom_field_key`).andOn(db.raw(`${alias}.status = ?`, [ACTIVE]));
+    };
+    const query = db('products')
+        .leftJoin(exports.CONFIG_TABLE, `${exports.CONFIG_TABLE}.product_id`, 'products.id')
+        .leftJoin({ name_binding: exports.BINDINGS_TABLE }, bindTo('name_binding', checkout_1.STRIPE_PORT.shippingName))
+        .leftJoin({ name_field: exports.FIELDS_TABLE }, landsIn('name_field', 'name_binding'))
+        .leftJoin({ shipping_binding: exports.BINDINGS_TABLE }, bindTo('shipping_binding', checkout_1.STRIPE_PORT.shippingAddress))
+        .leftJoin({ shipping_field: exports.FIELDS_TABLE }, landsIn('shipping_field', 'shipping_binding'))
+        .leftJoin({ phone_binding: exports.BINDINGS_TABLE }, bindTo('phone_binding', checkout_1.STRIPE_PORT.phone))
+        .leftJoin({ phone_field: exports.FIELDS_TABLE }, landsIn('phone_field', 'phone_binding'))
+        .orderBy('products.id', 'asc')
+        .select([
+        'products.id as product_id',
+        `${exports.CONFIG_TABLE}.id as config_id`,
+        ...optionColumns,
+        'name_binding.custom_field_key as shipping_name_key',
+        'name_field.key as shipping_name_collectable',
+        'shipping_binding.custom_field_key as shipping_address_key',
+        'shipping_field.key as shipping_address_collectable',
+        'phone_binding.custom_field_key as phone_key',
+        'phone_field.key as phone_collectable',
+    ]);
+    return query;
+}
+/** One row, whether or not that tier has ever been configured. */
+function collectionRowsForTier(db, productId) {
+    return collectionQuery(db).where('products.id', productId);
+}
+/**
+ * This query starts from products, so without a filter it would return every tier on the
+ * site, configured or not. A tier only gets a row in products_checkout_config when someone
+ * saves checkout settings for it, so requiring that row narrows the list to the tiers
+ * somebody has actually set up. A tier that was set up and then had everything switched off
+ * keeps its row and stays in the list, reporting that it collects nothing.
+ */
+function configuredCollectionRows(db) {
+    return collectionQuery(db).whereNotNull(`${exports.CONFIG_TABLE}.id`);
+}
+function questionRows(db, productId) {
+    const query = db(exports.QUESTIONS_TABLE)
+        .join(exports.BINDINGS_TABLE, `${exports.BINDINGS_TABLE}.id`, `${exports.QUESTIONS_TABLE}.binding_id`)
+        .leftJoin({ question_field: exports.FIELDS_TABLE }, function () {
+        this.on('question_field.key', `${exports.BINDINGS_TABLE}.custom_field_key`).andOn(db.raw('question_field.status = ?', [ACTIVE]));
+    })
+        .orderBy(`${exports.BINDINGS_TABLE}.product_id`, 'asc')
+        .orderBy(`${exports.QUESTIONS_TABLE}.sort_order`, 'asc')
+        .orderBy(`${exports.QUESTIONS_TABLE}.id`, 'asc')
+        .select([
+        `${exports.BINDINGS_TABLE}.product_id`,
+        `${exports.BINDINGS_TABLE}.port`,
+        `${exports.QUESTIONS_TABLE}.label`,
+        `${exports.QUESTIONS_TABLE}.optional`,
+        'question_field.name as question_name',
+        'question_field.type as question_type',
+    ]);
+    if (productId) {
+        return query.where(`${exports.BINDINGS_TABLE}.product_id`, productId);
+    }
+    return query;
+}

package/core/server/services/tier-checkout-config/schema.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbCheckoutOptions = exports.DbCheckoutConfig = exports.DbCheckoutQuestion = void 0;
+const zod_1 = require("zod");
+const boolean_1 = require("../../lib/db-types/boolean");
+const date_1 = require("../../lib/db-types/date");
+exports.DbCheckoutQuestion = zod_1.z.object({
+    id: zod_1.z.string(),
+    binding_id: zod_1.z.string(),
+    sort_order: zod_1.z.number(),
+    label: zod_1.z.string().nullable(),
+    optional: boolean_1.DbBoolean,
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
+});
+/**
+ * Options only. Whether a tier collects something it keeps is the binding; a tax number is
+ * the exception, since Stripe keeps it and Ghost never does, so there is nothing to bind.
+ */
+exports.DbCheckoutConfig = zod_1.z.object({
+    id: zod_1.z.string(),
+    product_id: zod_1.z.string(),
+    shipping_allowed_countries: zod_1.z.string().nullable(),
+    tax_number_collect: boolean_1.DbBoolean,
+    created_at: date_1.DbDate,
+    updated_at: date_1.DbDate.nullable(),
+});
+exports.DbCheckoutOptions = exports.DbCheckoutConfig.omit({
+    id: true,
+    product_id: true,
+    created_at: true,
+    updated_at: true,
+});

package/core/server/services/tier-checkout-config/serializers.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toCheckoutConfigResponse = exports.CheckoutConfigInput = void 0;
+const zod_1 = require("zod");
+const checkout_1 = require("@tryghost/checkout");
+const models_1 = require("./models");
+// Every country Stripe will take, sent at once, was measured as accepted — so the only
+// ceiling is the list itself, and a request naming more than there are countries is naming
+// something twice. A request that means all of them omits the list instead.
+const MAX_ALLOWED_COUNTRIES = checkout_1.STRIPE_ALLOWED_COUNTRIES.length;
+const QuestionInput = zod_1.z.object({
+    key: zod_1.z.string().min(1, { error: 'Every checkout question needs a custom field key.' }),
+    label: zod_1.z.string().trim().min(1).nullish(),
+    optional: zod_1.z.boolean().optional(),
+});
+// Not checked against a list of countries: membership of that list is contested, and Ghost
+// is not its arbiter.
+const CountryCode = zod_1.z
+    .string()
+    .trim()
+    .regex(/^[A-Za-z]{2}$/, { error: 'Enter a 2-letter country code, like US.' })
+    .toUpperCase()
+    .refine(checkout_1.isStripeAllowedCountry, {
+    error: 'Stripe will not ship to that country, so a checkout cannot offer it.',
+});
+/**
+ * Where a collected value lands is the request's to state. Ghost keeps no convention about
+ * it, so a block that collects names its destination and one that does not carries nothing
+ * to name.
+ */
+const DESTINATION_REQUIRED = 'Say which custom field this is collected into.';
+const CustomFieldKey = zod_1.z
+    .string({ error: DESTINATION_REQUIRED })
+    .min(1, { error: DESTINATION_REQUIRED });
+const Destination = zod_1.z.strictObject({ custom_field_key: CustomFieldKey }, { error: DESTINATION_REQUIRED });
+exports.CheckoutConfigInput = zod_1.z.strictObject({
+    custom_fields: zod_1.z
+        .array(QuestionInput)
+        .max(checkout_1.MAX_CHECKOUT_CUSTOM_FIELDS, {
+        error: `A checkout can ask at most ${checkout_1.MAX_CHECKOUT_CUSTOM_FIELDS} questions.`,
+    })
+        .refine((questions) => new Set(questions.map((question) => question.key)).size === questions.length, { error: 'This checkout already asks for that field.' })
+        .optional(),
+    shipping: zod_1.z
+        .discriminatedUnion('collect', [
+        zod_1.z.strictObject({ collect: zod_1.z.literal(false) }),
+        zod_1.z.strictObject({
+            collect: zod_1.z.literal(true),
+            // Absent means everywhere the processor ships. Empty is refused rather than
+            // read as everywhere: a publisher who cleared the list said something, and it
+            // was not "deliver worldwide".
+            allowed_countries: zod_1.z
+                .array(CountryCode, { error: 'Choose at least one country you deliver to.' })
+                .min(1, { error: 'Choose at least one country you deliver to.' })
+                .max(MAX_ALLOWED_COUNTRIES)
+                .optional(),
+            name: Destination,
+            address: Destination,
+        }),
+    ])
+        .optional(),
+    tax_number: zod_1.z.strictObject({ collect: zod_1.z.boolean() }).optional(),
+    phone: zod_1.z
+        .discriminatedUnion('collect', [
+        zod_1.z.strictObject({ collect: zod_1.z.literal(false) }),
+        zod_1.z.strictObject({ collect: zod_1.z.literal(true), custom_field_key: CustomFieldKey }),
+    ])
+        .optional(),
+});
+const QuestionResource = zod_1.z.object({
+    key: zod_1.z.string(),
+    label: zod_1.z.string().nullable(),
+    optional: zod_1.z.boolean(),
+});
+const CollectionResource = zod_1.z.object({
+    collect: zod_1.z.literal(true),
+    custom_field_key: zod_1.z.string(),
+});
+const ShippingResource = zod_1.z.object({
+    collect: zod_1.z.literal(true),
+    /** Absent means everywhere, the same way it does on the way in. */
+    allowed_countries: zod_1.z.array(zod_1.z.string()).optional(),
+    name: zod_1.z.object({ custom_field_key: zod_1.z.string() }),
+    address: zod_1.z.object({ custom_field_key: zod_1.z.string() }),
+});
+const CheckoutConfigResource = zod_1.z.object({
+    tier_id: zod_1.z.string(),
+    custom_fields: zod_1.z.array(QuestionResource),
+    shipping: ShippingResource.optional(),
+    tax_number: zod_1.z.object({ collect: zod_1.z.literal(true) }).optional(),
+    phone: CollectionResource.optional(),
+});
+const CheckoutConfigResponse = zod_1.z.object({
+    tiers_checkout_config: zod_1.z.array(CheckoutConfigResource),
+});
+/** One resource per tier, so a browse and a read differ only in how many come back. */
+exports.toCheckoutConfigResponse = zod_1.z
+    .array(models_1.TierCheckoutConfig)
+    .transform((configs) => ({
+    tiers_checkout_config: configs.map((config) => ({
+        tier_id: config.tierId,
+        custom_fields: config.customFields,
+        // A block appears only when the tier collects that thing, so a client reads
+        // presence rather than a flag it would have to check.
+        ...(config.shipping
+            ? {
+                shipping: {
+                    collect: true,
+                    ...(config.shipping.allowedCountries
+                        ? { allowed_countries: config.shipping.allowedCountries }
+                        : {}),
+                    name: { custom_field_key: config.shipping.nameCustomFieldKey },
+                    address: { custom_field_key: config.shipping.addressCustomFieldKey },
+                },
+            }
+            : {}),
+        ...(config.taxNumber ? { tax_number: { collect: true } } : {}),
+        ...(config.phone
+            ? {
+                phone: {
+                    collect: true,
+                    custom_field_key: config.phone.customFieldKey,
+                },
+            }
+            : {}),
+    })),
+}))
+    .pipe(CheckoutConfigResponse);

package/core/server/services/tier-checkout-config/service.js

@@ -0,0 +1,304 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TierCheckoutConfigService = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const zod_1 = require("zod");
+const schema_1 = require("../members-custom-fields/schema");
+const checkout_1 = require("@tryghost/checkout");
+const codec_1 = require("./codec");
+const queries_1 = require("./queries");
+const models_1 = require("./models");
+const serializers_1 = require("./serializers");
+/**
+ * A request states its settings in named sections: one for shipping, one for phone. Each
+ * section stands for one or more of the values Stripe hands back when a checkout is
+ * completed — shipping covers both the recipient's name and their address, phone covers
+ * only the phone number.
+ *
+ * Naming those values here means that a request which includes a section settles every
+ * value in it: each one is either given a destination or has its old one removed. Without
+ * this list, a value the request never mentioned could keep a destination from an earlier
+ * save that the publisher believes they have turned off.
+ */
+const BLOCK_PORTS = {
+    shipping: [checkout_1.STRIPE_PORT.shippingName, checkout_1.STRIPE_PORT.shippingAddress],
+    phone: [checkout_1.STRIPE_PORT.phone],
+};
+class TierCheckoutConfigService {
+    knex;
+    bindings;
+    fields;
+    constructor({ knex, bindings, fields, }) {
+        this.knex = knex;
+        this.bindings = bindings;
+        this.fields = fields;
+    }
+    async browse() {
+        const rows = decodeCollection(await (0, queries_1.configuredCollectionRows)(this.knex));
+        if (rows.length === 0) {
+            return [];
+        }
+        const asked = await this.questions();
+        return rows.map((row) => assemble(row, asked.get(row.tierId) ?? []));
+    }
+    async read(productId) {
+        const [row] = decodeCollection(await (0, queries_1.collectionRowsForTier)(this.knex, productId));
+        if (!row) {
+            throw new errors_1.default.NotFoundError({ message: 'Tier not found.' });
+        }
+        if (!row.configured) {
+            return null;
+        }
+        const asked = await this.questions(productId);
+        return assemble(row, asked.get(productId) ?? []);
+    }
+    async resolve(productId) {
+        const [row] = decodeCollection(await (0, queries_1.collectionRowsForTier)(this.knex, productId));
+        if (!row?.configured) {
+            return { customFields: [], ...(0, models_1.emptyCollection)() };
+        }
+        const asked = await this.questions(productId);
+        const customFields = (asked.get(productId) ?? []).flatMap((entry) => entry.askable ? [{ ...entry.question, ...entry.askable }] : []);
+        return { customFields, ...row.collecting };
+    }
+    /**
+     * Saves the checkout settings a request states, and leaves the rest alone.
+     *
+     * A request only has to include the sections it wants to change. Say nothing about
+     * shipping and the shipping settings stay exactly as they were, so a client that only
+     * knows how to edit the questions cannot wipe out the shipping settings by omitting
+     * them.
+     */
+    async edit(context, productId, input) {
+        const stated = parseInput(input);
+        const now = new Date();
+        if (stated.custom_fields) {
+            await assertQuestionsAskable(this.knex, stated.custom_fields);
+        }
+        const plan = await this.planCollection(stated);
+        const created = await this.knex.transaction(async (trx) => {
+            await assertTierExists(trx, productId);
+            await writeOptions(trx, productId, stated, now);
+            for (const port of plan.clear) {
+                await this.bindings.remove(trx, productId, port);
+            }
+            const made = [];
+            for (const wanted of plan.create) {
+                made.push(await this.fields.addOne(wanted, { executor: trx }));
+            }
+            for (const { port, key } of plan.bind) {
+                await this.bindings.bind(trx, productId, port, key, now);
+            }
+            if (stated.custom_fields) {
+                await this.writeQuestions(trx, productId, stated.custom_fields, now);
+            }
+            return made;
+        });
+        await this.fields.recordCreated(context, created);
+    }
+    async questions(productId) {
+        const rows = await (0, queries_1.questionRows)(this.knex, productId);
+        const byTier = new Map();
+        for (const row of rows) {
+            const parts = zod_1.z.decode(codec_1.questionRowCodec, row);
+            const forTier = byTier.get(parts.tierId) ?? [];
+            forTier.push(parts);
+            byTier.set(parts.tierId, forTier);
+        }
+        return byTier;
+    }
+    async planCollection(stated) {
+        const wanted = [];
+        if (stated.shipping?.collect) {
+            wanted.push({ port: checkout_1.STRIPE_PORT.shippingName, key: stated.shipping.name.custom_field_key }, { port: checkout_1.STRIPE_PORT.shippingAddress, key: stated.shipping.address.custom_field_key });
+        }
+        if (stated.phone?.collect) {
+            wanted.push({ port: checkout_1.STRIPE_PORT.phone, key: stated.phone.custom_field_key });
+        }
+        const bound = new Set(wanted.map(({ port }) => port));
+        const clear = [];
+        for (const block of ['shipping', 'phone']) {
+            if (stated[block]) {
+                clear.push(...BLOCK_PORTS[block].filter((port) => !bound.has(port)));
+            }
+        }
+        const create = new Map();
+        for (const { port, key } of wanted) {
+            const wants = checkout_1.PORT_FIELD[port];
+            const existing = await this.fields.findByKey(key);
+            if (existing) {
+                assertCollectableInto(port, existing, wants.type);
+                continue;
+            }
+            const alreadyPlanned = create.get(key);
+            if (alreadyPlanned && alreadyPlanned.type !== wants.type) {
+                throw new errors_1.default.ValidationError({
+                    message: `This can only be collected into a ${wants.type} field.`,
+                    property: `checkout.${port}.custom_field_key`,
+                });
+            }
+            if (!alreadyPlanned) {
+                create.set(key, { key, name: wants.name, type: wants.type });
+            }
+        }
+        return { clear, create: [...create.values()], bind: wanted };
+    }
+    /**
+     * Saves the questions this tier asks its buyers during checkout.
+     *
+     * A binding records that one value coming back from Stripe belongs in one custom field,
+     * and it identifies the value by the name Stripe uses for it. For a question that name
+     * is the custom field's own key: Ghost sends the key to Stripe as the question's
+     * identifier, and Stripe returns the buyer's answer labelled with that same key. That is
+     * why the key is passed twice below — once as the name Stripe will answer under, and
+     * once as the field the answer is stored in.
+     */
+    async writeQuestions(trx, productId, questions, now) {
+        const asked = new Set(questions.map((question) => question.key));
+        const alreadyAsked = await trx(queries_1.QUESTIONS_TABLE)
+            .join(queries_1.BINDINGS_TABLE, `${queries_1.BINDINGS_TABLE}.id`, `${queries_1.QUESTIONS_TABLE}.binding_id`)
+            .where(`${queries_1.BINDINGS_TABLE}.product_id`, productId)
+            .select(`${queries_1.BINDINGS_TABLE}.port`);
+        for (const { port } of alreadyAsked) {
+            if (!asked.has(port)) {
+                await this.bindings.remove(trx, productId, port);
+            }
+        }
+        for (const [index, question] of questions.entries()) {
+            const bindingId = await this.bindings.bind(trx, productId, question.key, question.key, now);
+            await trx(queries_1.QUESTIONS_TABLE).where('binding_id', bindingId).del();
+            await trx(queries_1.QUESTIONS_TABLE).insert({
+                id: new bson_objectid_1.default().toHexString(),
+                binding_id: bindingId,
+                sort_order: index,
+                label: question.label ?? null,
+                optional: question.optional ?? true,
+                created_at: now,
+            });
+        }
+    }
+}
+exports.TierCheckoutConfigService = TierCheckoutConfigService;
+function parseInput(input) {
+    const parsed = serializers_1.CheckoutConfigInput.safeParse(input);
+    if (parsed.success) {
+        return parsed.data;
+    }
+    const issue = parsed.error.issues[0];
+    throw new errors_1.default.ValidationError({
+        message: issue.message,
+        property: issue.path.join('.') || 'checkout',
+    });
+}
+function decodeCollection(rows) {
+    return rows.map((row) => zod_1.z.decode(codec_1.collectionRowCodec, row));
+}
+function assemble(row, asked) {
+    return {
+        tierId: row.tierId,
+        customFields: asked.map((entry) => entry.question),
+        ...row.collection,
+    };
+}
+async function assertTierExists(db, productId) {
+    const tier = await db('products').where('id', productId).first();
+    if (!tier) {
+        throw new errors_1.default.NotFoundError({ message: 'Tier not found.' });
+    }
+}
+/**
+ * Refuses a custom field that cannot hold what Stripe will send back.
+ *
+ * A request names the custom field each collected value should be saved into. That field
+ * has to be active, because an archived field accepts no new values, and it has to store
+ * the right kind of data: Stripe returns a structured address for the shipping address,
+ * and plain text for a name or a phone number.
+ *
+ * Both refusals are deliberate rather than defensive. Ghost could save the value into some
+ * other field, or accept the request and quietly collect nothing, but a publisher who named
+ * a field meant that field. Being told now is better than finding out weeks later that
+ * nothing was ever recorded.
+ */
+function assertCollectableInto(port, field, valueType) {
+    if (field.status !== schema_1.FIELD_STATUS.active) {
+        throw new errors_1.default.ValidationError({
+            message: 'An archived custom field cannot receive collected data. Restore it first.',
+            property: `checkout.${port}.custom_field_key`,
+        });
+    }
+    if (field.type !== valueType) {
+        throw new errors_1.default.ValidationError({
+            message: `This can only be collected into a ${valueType} field.`,
+            property: `checkout.${port}.custom_field_key`,
+        });
+    }
+}
+async function writeOptions(trx, productId, stated, now) {
+    const all = zod_1.z.encode(codec_1.optionsCodec, {
+        shippingAllowedCountries: stated.shipping?.collect
+            ? (stated.shipping.allowed_countries ?? null)
+            : null,
+        taxNumber: stated.tax_number?.collect ?? false,
+    });
+    // Only the columns this request spoke about are written, so two requests changing
+    // different parts of the same tier cannot undo each other, and a request that mentions
+    // neither still leaves the row behind as the record that this tier has been set up.
+    const columns = {
+        ...(stated.shipping ? { shipping_allowed_countries: all.shipping_allowed_countries } : {}),
+        ...(stated.tax_number ? { tax_number_collect: all.tax_number_collect } : {}),
+    };
+    await trx(queries_1.CONFIG_TABLE)
+        .insert({
+        id: new bson_objectid_1.default().toHexString(),
+        product_id: productId,
+        created_at: now,
+        updated_at: now,
+        ...columns,
+    })
+        .onConflict('product_id')
+        .merge({ ...columns, updated_at: now });
+}
+async function assertQuestionsAskable(db, questions) {
+    const collides = questions.find((question) => (0, checkout_1.isStripePort)(question.key));
+    if (collides) {
+        throw new errors_1.default.ValidationError({
+            message: `A field keyed ${collides.key} cannot be asked at checkout, because that is what this checkout calls something it collects for itself.`,
+            property: 'checkout.custom_fields',
+        });
+    }
+    const keys = questions.map((question) => question.key);
+    if (keys.length === 0) {
+        return;
+    }
+    const rows = await db(queries_1.FIELDS_TABLE)
+        .whereIn(`${queries_1.FIELDS_TABLE}.key`, keys)
+        .where(`${queries_1.FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
+        .select(`${queries_1.FIELDS_TABLE}.key`, `${queries_1.FIELDS_TABLE}.name`, `${queries_1.FIELDS_TABLE}.type`, `${queries_1.FIELDS_TABLE}.status`);
+    const byKey = new Map(rows.map((row) => [row.key, row]));
+    for (const question of questions) {
+        const field = byKey.get(question.key);
+        if (!field) {
+            throw new errors_1.default.ValidationError({
+                message: `Unknown custom field: ${question.key}`,
+                property: 'checkout.custom_fields',
+            });
+        }
+        if (!(0, checkout_1.isCheckoutEligible)(field.type)) {
+            throw new errors_1.default.ValidationError({
+                message: `A ${field.type} field cannot be asked for at checkout.`,
+                property: 'checkout.custom_fields',
+            });
+        }
+        const prompt = question.label ?? field.name;
+        if (prompt.length > checkout_1.MAX_CHECKOUT_LABEL_LENGTH) {
+            throw new errors_1.default.ValidationError({
+                message: `A checkout question can be at most ${checkout_1.MAX_CHECKOUT_LABEL_LENGTH} characters. Give this one a shorter label.`,
+                property: 'checkout.custom_fields',
+            });
+        }
+    }
+}

package/core/server/services/tiers/service.js

@@ -30,6 +30,27 @@ class TiersServiceWrapper {
       repository,
       slugService,
     });
+
+    // What a tier's checkout asks, kept beside the tier rather than inside it: these
+    // rows are read live on every request, because deleting a custom field cascades a
+    // question away without the repository above ever seeing it, and a cached copy
+    // would go on naming a field the site no longer has.
+    //
+    // Boot builds the custom fields services before this one, so both collaborators
+    // are ready by the time this runs.
+    const { TierCheckoutConfigService } = require('../tier-checkout-config');
+    const { bindings, definitions } = require('../members-custom-fields');
+    this.checkout = new TierCheckoutConfigService({
+      knex: models.Base.knex,
+      // A binding is where a collected value lands, and the same rows are what a completed
+      // checkout is routed through later. Handed over rather than reached for, so the
+      // checkout domain states what it needs of them and nothing more.
+      bindings,
+      // Turning a collection on has to leave it somewhere to land, and making a field is
+      // the definitions' to do. A separate collaborator because it is a separate act, and
+      // because deciding whether one is needed belongs to the checkout rather than to them.
+      fields: definitions,
+    });
   }
 }
 

package/core/server/services/update-check/index.js

@@ -2,7 +2,7 @@ const api = require('../../api').endpoints;
 const config = require('../../../shared/config');
 const logging = require('@tryghost/logging');
 const urlUtils = require('../../../shared/url-utils').default;
-const jobsService = require('../jobs');
+const UpdateCheckJob = require('./jobs/update-check-job').default;
 
 const request = require('@tryghost/request');
 const ghostVersion = require('@tryghost/version');
@@ -66,7 +66,7 @@ module.exports = async ({
   await updateChecker.check();
 };
 
-module.exports.scheduleRecurringJobs = () => {
+const scheduleRecurringJob = async (jobsService) => {
   // use a random seconds/minutes/hours value to avoid spikes to the update service API
   const s = Math.floor(Math.random() * 60); // 0-59
   const m = Math.floor(Math.random() * 60); // 0-59
@@ -74,17 +74,17 @@ module.exports.scheduleRecurringJobs = () => {
 
   const at = `${s} ${m} ${h} * * *`;
   logging.info(`[Background Job] update-check scheduled at ${at}`);
-  jobsService.addJob({
-    at, // Every day
-    job: require('path').resolve(__dirname, 'run-update-check.js'),
-    name: 'update-check',
-  });
+  await jobsService.scheduleRecurring(new UpdateCheckJob(), { cron: at });
 };
 
-module.exports.scheduleBootJob = () => {
-  logging.info('[Background Job] update-check-boot queued');
-  jobsService.addJob({
-    job: require('path').resolve(__dirname, 'run-update-check.js'),
-    name: 'update-check-boot',
-  });
+const scheduleBootJob = async (jobsService) => {
+  logging.info('[Background Job] update-check boot run queued');
+  await jobsService.dispatch(new UpdateCheckJob());
+};
+
+module.exports.scheduleJobs = async (jobsService) => {
+  await scheduleRecurringJob(jobsService);
+  if (config.get('updateCheck:forceUpdate')) {
+    await scheduleBootJob(jobsService);
+  }
 };

package/core/server/services/update-check/jobs/update-check-job.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../../jobs-service/job");
+class UpdateCheckJob extends job_1.Job {
+    static type = 'update-check';
+}
+exports.default = UpdateCheckJob;

package/core/server/services/update-check/update-check-service.js

@@ -99,7 +99,7 @@ class UpdateCheckService {
     );
 
     err.context = tpl(messages.checkingForUpdatesFailedError);
-    err.help = tpl(messages.checkingForUpdatesFailedHelp, { url: 'https://ghost.org/docs/' });
+    err.help = tpl(messages.checkingForUpdatesFailedHelp, { url: 'https://docs.ghost.org/' });
 
     this.logging.error(
       {
@@ -120,7 +120,7 @@ class UpdateCheckService {
    * Only the Ghost version is sent so the service can return the relevant
    * release and security notifications. No site data is collected.
    *
-   * @see https://ghost.org/docs/concepts/config/#privacy
+   * @see https://docs.ghost.org/concepts/config/#privacy
    * @returns {Promise}
    */
   async updateCheckRequest() {

package/core/server/web/admin/controller.js

@@ -46,7 +46,7 @@ module.exports = function adminController(req, res) {
       throw new errors.IncorrectUsageError({
         message: tpl(messages.templateError.message, { templatePath }),
         context: tpl(messages.templateError.context),
-        help: tpl(messages.templateError.help, { link: 'https://ghost.org/docs/install/source/' }),
+        help: tpl(messages.templateError.help, { link: 'https://docs.ghost.org/install/source/' }),
         err,
       });
     }