ghost 6.61.0 → 6.62.0

package/core/server/api/endpoints/{member-custom-fields.js → member-metafields.js}

@@ -2,89 +2,88 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const members_custom_fields_1 = require("../../services/members-custom-fields");
 const permissionsService = require('../../services/permissions');
-// There is no Bookshelf model for this resource, so permissions are checked
-// explicitly against the member_custom_field object type (the default
-// `permissions: true` handler would try to load a model that doesn't exist).
+// With `permissions: true` the framework checks against the Bookshelf model named after
+// the resource. These fields have no Bookshelf model, so each handler asks the permissions
+// service directly.
 function canThis(frame) {
     return permissionsService.canThis(frame.options.context);
 }
 const noCacheInvalidation = { cacheInvalidate: false };
 const controller = {
-    docName: 'members_custom_fields',
+    docName: 'members_metafields',
     browse: {
         headers: noCacheInvalidation,
-        // `filter` narrows by status (the definition list is otherwise small and
-        // global, returned whole). Archived fields are hidden by default; Settings
-        // passes `filter=status:[active,archived]` to see both. No pagination or order
-        // options: the list comes back in the publisher's own order, which is changed
-        // by reordering it rather than by asking for it differently.
-        options: ['filter'],
+        options: ['namespace', 'filter'],
+        validation: { options: { namespace: { required: true } } },
         permissions(frame) {
             return canThis(frame).browse.member_custom_field();
         },
         query(frame) {
-            return members_custom_fields_1.definitions.browse({ filter: frame.options.filter });
+            return members_custom_fields_1.definitions.browse({
+                namespace: frame.options.namespace,
+                filter: frame.options.filter,
+            });
         },
     },
     read: {
         headers: noCacheInvalidation,
-        options: ['key'],
-        validation: { options: { key: { required: true } } },
+        options: ['namespace', 'key'],
+        validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions(frame) {
             return canThis(frame).read.member_custom_field(frame.options.key);
         },
         query(frame) {
-            return members_custom_fields_1.definitions.read(frame.options.key);
+            return members_custom_fields_1.definitions.read(frame.options.namespace, frame.options.key);
         },
     },
     add: {
         statusCode: 201,
         headers: noCacheInvalidation,
+        options: ['namespace'],
+        validation: { options: { namespace: { required: true } } },
         permissions(frame) {
             return canThis(frame).add.member_custom_field();
         },
-        // The whole array is passed through: create is a batch, applied
-        // all-or-nothing. A client sending a single definition (as Admin does)
-        // is just the one-item case and sees no change.
         query(frame) {
-            return members_custom_fields_1.definitions.add((0, members_custom_fields_1.actingContext)(frame.options.context), frame.data.members_custom_fields);
+            return members_custom_fields_1.definitions.add((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
         },
     },
-    // Order belongs to the list, so it is set by PUTting the list. No `/order` sub-route:
-    // `order` is a key a publisher could mint, and the route would shadow it.
     reorder: {
         headers: noCacheInvalidation,
+        options: ['namespace'],
+        validation: { options: { namespace: { required: true } } },
         permissions(frame) {
             return canThis(frame).edit.member_custom_field();
         },
         query(frame) {
-            return members_custom_fields_1.definitions.reorder((0, members_custom_fields_1.actingContext)(frame.options.context), frame.data.members_custom_fields);
+            return members_custom_fields_1.definitions.reorder((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
         },
     },
     edit: {
         headers: noCacheInvalidation,
-        options: ['key'],
-        validation: { options: { key: { required: true } } },
+        options: ['namespace', 'key'],
+        validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions(frame) {
             return canThis(frame).edit.member_custom_field(frame.options.key);
         },
         query(frame) {
-            return members_custom_fields_1.definitions.edit((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.key, frame.data.members_custom_fields[0]);
+            return members_custom_fields_1.definitions.edit((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key, frame.data.members_metafields[0]);
         },
     },
     destroy: {
         statusCode: 204,
         headers: noCacheInvalidation,
-        options: ['key'],
-        validation: { options: { key: { required: true } } },
+        options: ['namespace', 'key'],
+        validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions(frame) {
             return canThis(frame).destroy.member_custom_field(frame.options.key);
         },
         async query(frame) {
-            await members_custom_fields_1.definitions.destroy((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.key);
+            await members_custom_fields_1.definitions.destroy((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key);
             return null;
         },
     },
 };
-// module.exports (not export): the API framework loads controllers via require().
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
 module.exports = controller;

package/core/server/api/endpoints/members.js

@@ -44,10 +44,10 @@ const messages = {
   resourceNotFound: '{resource} not found.',
 };
 
-// `custom_fields` is a browse include only: a read returns values whenever the
-// flag is on, the same way it returns tiers. Values are not a member relation, so
-// the input serializer lifts the key out of withRelated before the model sees it.
-const allowedIncludes = ['email_recipients', 'products', 'tiers', 'custom_fields'];
+// `metafields` is not a relation on the member model. It is allowed here only so callers
+// can ask for it with `include=`; the input serializer removes it before the model tries
+// to eager-load it.
+const allowedIncludes = ['email_recipients', 'products', 'tiers', 'metafields'];
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {

package/core/server/api/endpoints/posts.js

@@ -129,13 +129,13 @@ const controller = {
       method: 'importContent',
     },
     async query(frame) {
-      // The CSV must be parsed before the response goes out: the uploaded temp file is
-      // deleted as soon as it is sent. The posts are written by a background job behind
-      // the 202.
+      // The content-import service stages and validates the upload before this response;
+      // Multer deletes the request temp file as soon as the 202 is sent.
       const { importId, total } = await contentImportService.importCSV({
         filePath: frame.file.path,
         fileName: frame.file.name,
         mapping: frame.data.mapping,
+        requestUserEmail: frame.user ? frame.user.get('email') : null,
       });
       return { meta: { import_id: importId, total } };
     },

package/core/server/api/endpoints/utils/serializers/input/members.js

@@ -34,16 +34,13 @@ function mapSubscribedFlagToNewsletterRelation(frame) {
   });
 }
 
-// Values are not a member relation — they're stored per field type and read by
-// the custom fields service — so `include=custom_fields` must not reach the model
-// layer as something to eager-load. Lift it out and leave a flag browse can act on.
-function liftCustomFieldsInclude(frame) {
-  if (!frame.options.withRelated.includes('custom_fields')) {
+function liftMetafieldsInclude(frame) {
+  if (!frame.options.withRelated.includes('metafields')) {
     return;
   }
 
   frame.options.withRelated = frame.options.withRelated.filter(
-    (relation) => relation !== 'custom_fields',
+    (relation) => relation !== 'metafields',
   );
   frame.options.includeCustomFields = true;
 }
@@ -54,7 +51,7 @@ module.exports = {
       return;
     }
 
-    liftCustomFieldsInclude(frame);
+    liftMetafieldsInclude(frame);
 
     frame.options.withRelated = frame.options.withRelated.map((relation) => {
       if (relation === 'tiers') {

package/core/server/api/endpoints/utils/serializers/output/index.js

@@ -76,8 +76,8 @@ module.exports = {
     return require('./members');
   },
 
-  get members_custom_fields() {
-    return require('./member-custom-fields');
+  get members_metafields() {
+    return require('./member-metafields');
   },
 
   get tiers() {

package/core/server/api/endpoints/utils/serializers/output/{member-custom-fields.js → member-metafields.js}

@@ -7,13 +7,11 @@ const serializeOne = (field, _apiConfig, frame) => {
 const serializeMany = (fields, _apiConfig, frame) => {
     frame.response = serializers_1.toCustomFieldsResponse.parse(fields);
 };
-// module.exports (not export): the API framework loads serializers via require(). The endpoint ->
-// serializer mapping lives here; the response shaping lives with the members-custom-fields service.
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
 module.exports = {
     browse: serializeMany,
     read: serializeOne,
-    // Create is a batch, so it returns every definition it made. The response is
-    // already an array, so a one-item create looks exactly as it did before.
     add: serializeMany,
     reorder: serializeMany,
     edit: serializeOne,

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -131,10 +131,8 @@ function serializeMember(member, options) {
     serialized.tiers = json.products;
   }
 
-  // Present on a read whenever the flag is on; absent otherwise, and absent on
-  // browse. An empty object is a member with no values set.
-  if (json.custom_fields) {
-    serialized.custom_fields = json.custom_fields;
+  if (json.metafields) {
+    serialized.metafields = json.metafields;
   }
 
   serialized.current_subscription = json.current_subscription || null;

package/core/server/api/endpoints/utils/validators/input/invitations.js

@@ -4,7 +4,6 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 
 const messages = {
-  noEmailProvided: 'No email provided.',
   noNameProvided: 'No name provided.',
   noPasswordProvided: 'No password provided.',
   noTokenProvided: 'No token provided.',
@@ -21,10 +20,6 @@ module.exports = {
       return Promise.reject(new errors.ValidationError({ message: tpl(messages.noTokenProvided) }));
     }
 
-    if (!data.email) {
-      return Promise.reject(new errors.ValidationError({ message: tpl(messages.noEmailProvided) }));
-    }
-
     if (!data.password) {
       return Promise.reject(
         new errors.ValidationError({ message: tpl(messages.noPasswordProvided) }),

package/core/server/api/endpoints/utils/validators/input/pages.js

@@ -8,7 +8,7 @@ const messages = {
   onlySingleContentSource: 'Pages can have either a mobiledoc or a lexical property, never both.',
   onlySingleContentSourceContext:
     'Both the mobiledoc and lexical properties are set, one must be null',
-  onlySingleContentSourceHelp: 'https://ghost.org/docs/admin-api/#the-post-object',
+  onlySingleContentSourceHelp: 'https://docs.ghost.org/admin-api/#the-post-object',
 };
 
 const validateVisibility = async function (frame) {

package/core/server/api/endpoints/utils/validators/input/posts.js

@@ -8,7 +8,7 @@ const messages = {
   onlySingleContentSource: 'Posts can have either a mobiledoc or a lexical property, never both.',
   onlySingleContentSourceContext:
     'Both the mobiledoc and lexical properties are set, one must be null',
-  onlySingleContentSourceHelp: 'https://ghost.org/docs/admin-api/#the-post-object',
+  onlySingleContentSourceHelp: 'https://docs.ghost.org/admin-api/#the-post-object',
 };
 
 const validateVisibility = async function (frame) {

package/core/server/data/importer/importers/data/data-importer.js

@@ -99,7 +99,7 @@ DataImporter = {
       return Promise.reject(
         new IncorrectUsageError({
           message: 'Wrong importer structure. `meta` is missing.',
-          help: 'https://ghost.org/docs/migration/custom/',
+          help: 'https://docs.ghost.org/migration/custom/',
         }),
       );
     }
@@ -108,7 +108,7 @@ DataImporter = {
       return Promise.reject(
         new IncorrectUsageError({
           message: 'Wrong importer structure. `meta.version` is missing.',
-          help: 'https://ghost.org/docs/migration/custom/',
+          help: 'https://docs.ghost.org/migration/custom/',
         }),
       );
     }
@@ -119,7 +119,7 @@ DataImporter = {
       return Promise.reject(
         new IncorrectUsageError({
           message: 'Detected unsupported file structure.',
-          help: 'Please install Ghost 1.0, import the file and then update your blog to the latest Ghost version.\nVisit https://ghost.org/docs/update/ or ask for help in our https://forum.ghost.org.',
+          help: 'Please install Ghost 1.0, import the file and then update your blog to the latest Ghost version.\nVisit https://docs.ghost.org/update/ or ask for help in our https://forum.ghost.org.',
         }),
       );
     }

package/core/server/data/migrations/utils/migrations.js

@@ -117,7 +117,7 @@ function createFinalMigration(major) {
     async function up() {
       throw new errors.InternalServerError({
         message: `Unable to run migrations`,
-        context: `You must be on the latest v${major}.x to update across major versions - https://ghost.org/docs/update/`,
+        context: `You must be on the latest v${major}.x to update across major versions - https://docs.ghost.org/update/`,
         help: `Run 'ghost update v${major}' to get the latest v${major}.x version, then run 'ghost update' to get to the latest.`,
       });
     },

package/core/server/lib/image/image-size.js

@@ -31,6 +31,12 @@ class ImageSize {
       },
       response_timeout: this.config.get('times:getImageSizeTimeoutInMS') || 10000,
     };
+
+    // Coalesces concurrent getImageSizeFromUrl() calls for the same URL so we only
+    // ever issue one underlying request/read per URL at a time. A single post's
+    // coverImage/ogImage/twitterImage often resolve to the same feature_image URL
+    // and are looked up concurrently, which otherwise fans out into duplicate requests.
+    this.inFlightImageSizeLookups = new Map();
   }
 
   // processes the Buffer result of an image file using image-size
@@ -153,6 +159,24 @@ class ImageSize {
    * @returns {Promise<Object>} imageObject or error
    */
   getImageSizeFromUrl(imagePath) {
+    if (this.inFlightImageSizeLookups.has(imagePath)) {
+      return this.inFlightImageSizeLookups.get(imagePath);
+    }
+
+    const promise = this._getImageSizeFromUrl(imagePath).finally(() => {
+      this.inFlightImageSizeLookups.delete(imagePath);
+    });
+    this.inFlightImageSizeLookups.set(imagePath, promise);
+
+    return promise;
+  }
+
+  /**
+   * @description read image dimensions from URL, without in-flight deduplication
+   * @param {string} imagePath as URL
+   * @returns {Promise<Object>} imageObject or error
+   */
+  _getImageSizeFromUrl(imagePath) {
     if (this.storageUtils.isLocalImage(imagePath)) {
       // don't make a request for a locally stored image
       return this.getImageSizeFromStoragePath(imagePath);

package/core/server/lib/package-json/parse.js

@@ -37,7 +37,7 @@ async function parse(path) {
       message: tpl(messages.themeFileIsMalformed),
       context: path,
       err: parseError,
-      help: tpl(messages.willBeRequired, { url: 'https://ghost.org/docs/themes/' }),
+      help: tpl(messages.willBeRequired, { url: 'https://docs.ghost.org/themes/' }),
     });
   }
 
@@ -47,7 +47,7 @@ async function parse(path) {
     throw new errors.IncorrectUsageError({
       message: tpl(messages.nameOrVersionMissing),
       context: path,
-      help: tpl(messages.willBeRequired, { url: 'https://ghost.org/docs/themes/' }),
+      help: tpl(messages.willBeRequired, { url: 'https://docs.ghost.org/themes/' }),
     });
   }
 

package/core/server/models/member.js

@@ -3,7 +3,6 @@ const crypto = require('crypto');
 const _ = require('lodash');
 const { chainTransformers } = require('@tryghost/mongo-utils');
 const config = require('../../shared/config');
-const labs = require('../../shared/labs');
 const { MemberCommentingCodec } = require('../services/members/commenting');
 const {
   CUSTOM_FIELDS_RELATION,
@@ -191,18 +190,12 @@ const Member = ghostBookshelf.Model.extend(
       ];
     },
 
-    // Chain the custom-field filter transformer at this single choke point — the method
-    // every members query routes its filter through (list, CSV export, bulk edit/destroy,
-    // count, email send all reach it via findPage or getFilteredCollectionQuery) — so a
-    // saved `custom_fields.*` segment works the same everywhere without each call site
-    // wiring it. Runs only behind the flag and only when the filter names the relation; the
-    // transformer maps the public `key`/`value` grammar onto the leaf-row columns.
+    // Every members query routes its filter through this one method: list, CSV export, bulk
+    // edit and delete, counts and email sends all reach it via findPage or
+    // getFilteredCollectionQuery. Chaining the metafield filter transformer here covers them
+    // all without any call site wiring it.
     applyDefaultAndCustomFilters(options) {
-      if (
-        labs.isSet('membersCustomFields') &&
-        options.filter &&
-        options.filter.includes(`${CUSTOM_FIELDS_RELATION.tableNameAs}.`)
-      ) {
+      if (options.filter && options.filter.includes(`${CUSTOM_FIELDS_RELATION.tableNameAs}.`)) {
         const transformer = createCustomFieldsFilterTransformer();
         options.mongoTransformer = options.mongoTransformer
           ? chainTransformers(options.mongoTransformer, transformer)
@@ -213,11 +206,7 @@ const Member = ghostBookshelf.Model.extend(
 
     filterRelations() {
       return {
-        // Custom field values are filterable only behind the feature flag. Gating the
-        // relation here (rather than the whole model) means a `custom_fields.*` filter
-        // is simply an unknown relation when the flag is off, and the filter is
-        // rejected — nothing to special-case downstream.
-        ...(labs.isSet('membersCustomFields') ? { custom_fields: CUSTOM_FIELDS_RELATION } : {}),
+        metafields: CUSTOM_FIELDS_RELATION,
         labels: {
           tableName: 'labels',
           type: 'manyToMany',

package/core/server/models/post.js

@@ -29,9 +29,9 @@ const messages = {
   notEnoughPermission: 'You do not have permission to perform this action',
   invalidNewsletter: "The newsletter parameter doesn't match any active newsletter.",
   invalidMobiledocStructure: 'Invalid mobiledoc structure.',
-  invalidMobiledocStructureHelp: 'https://ghost.org/docs/publishing/',
+  invalidMobiledocStructureHelp: 'https://docs.ghost.org/publishing/',
   invalidLexicalStructure: 'Invalid lexical structure.',
-  invalidLexicalStructureHelp: 'https://ghost.org/docs/publishing/',
+  invalidLexicalStructureHelp: 'https://docs.ghost.org/publishing/',
   emailOnlyWithoutNewsletter: 'Scheduling an email requires a newsletter reference.',
 };
 

package/core/server/models/relations/authors.js

@@ -149,7 +149,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
 
         // CASE: `posts.authors` was not requested, but fetched in specific cases (see top)
         if (
-          !this._originalOptions ||
           !this._originalOptions.withRelated ||
           this._originalOptions.withRelated.indexOf('authors') === -1
         ) {
@@ -157,10 +156,7 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
         }
 
         // If the current column settings allow it...
-        if (
-          !options.columns ||
-          (options.columns && options.columns.indexOf('primary_author') > -1)
-        ) {
+        if (!options.columns || options.columns.indexOf('primary_author') > -1) {
           // ... attach a computed property of primary_author which is the first author
           if (attrs.authors && attrs.authors.length) {
             attrs.primary_author = attrs.authors[0];
@@ -398,20 +394,10 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
         }
 
         function isOwner() {
-          let isCorrectOwner = true;
-
           if (!unsafeAttrs.authors) {
             return false;
           }
-
-          if (unsafeAttrs.authors) {
-            isCorrectOwner =
-              isCorrectOwner &&
-              unsafeAttrs.authors.length &&
-              unsafeAttrs.authors[0].id === context.user;
-          }
-
-          return isCorrectOwner;
+          return unsafeAttrs.authors.length && unsafeAttrs.authors[0].id === context.user;
         }
 
         function isPrimaryAuthor() {

package/core/server/models/user.js

@@ -43,8 +43,13 @@ const messages = {
 };
 
 /**
- * inactive: owner user before blog setup, suspended users
- * locked user: imported users, they get a random password
+ * `inactive`: suspended staff, who cannot sign in or reset their password.
+ * Also used for the initial owner before site setup is complete.
+ * `locked`: users whose password was randomized by an import or authentication
+ * reset. They must reset their password to regain access.
+ *
+ * Both statuses prevent normal sign-in, so they are grouped here. This is not
+ * a suspension check: isInactive() checks only the literal `inactive` status.
  */
 const inactiveStates = ['inactive', 'locked'];
 
@@ -212,6 +217,8 @@ User = ghostBookshelf.Model.extend(
       return this.save(update, { ...options, patch: true });
     },
 
+    // Checks the literal status, not membership in inactiveStates: locked users
+    // must remain eligible for password resets.
     isInactive: function isInactive() {
       return this.get('status') === 'inactive';
     },

package/core/server/services/auth/passwordreset.js

@@ -11,6 +11,7 @@ const mail = require('../mail');
 
 const messages = {
   userNotFound: 'User not found.',
+  userSuspended: 'This account has been suspended.',
   resetPassword: 'Reset Password',
   expired: {
     message: 'Cannot reset password.',
@@ -46,6 +47,14 @@ function generateToken(email, settingsAPI, transaction) {
         throw new errors.NotFoundError({ message: tpl(messages.userNotFound) });
       }
 
+      // Prevent suspended users from generating a reset token. This same check must appear
+      // below in doReset() to account for password reset tokens that were generated prior
+      // to suspension since they have a 24-hour lifetime.
+      // Locked users must still be able to recover access by resetting their password.
+      if (user.isInactive()) {
+        throw new errors.NoPermissionError({ message: tpl(messages.userSuspended) });
+      }
+
       token = security.tokens.resetToken.generateHash({
         expires: moment().add(1, 'days').valueOf(),
         email: email,
@@ -128,6 +137,10 @@ function doReset(options, tokenParts, settingsAPI) {
         }
       }
 
+      if (user.isInactive()) {
+        throw new errors.NoPermissionError({ message: tpl(messages.userSuspended) });
+      }
+
       const updatedUser = await models.User.changePassword(
         {
           oldPassword: oldPassword,

package/core/server/services/comments/comments-controller.js

@@ -14,6 +14,7 @@ const messages = {
   cannotDestroyComments: 'You cannot destroy comments.',
   memberNotFound: 'Unable to find member',
   unsupportedReportCountFilter: 'Unsupported count.reports filter',
+  errorParsingFilter: 'Error parsing filter',
 };
 
 module.exports = class CommentsController {
@@ -26,6 +27,16 @@ module.exports = class CommentsController {
     this.stats = stats;
   }
 
+  #getPostIdFromFilter(query) {
+    if (typeof query.post_id === 'string') {
+      return query.post_id;
+    }
+
+    // Only equality conditions required by an AND can scope a legacy browse.
+    // Choosing an ID from an OR or an exclusion would authorize the wrong posts.
+    return query.$and?.map((part) => this.#getPostIdFromFilter(part)).find(Boolean);
+  }
+
   #withPostFilter(options) {
     const nextOptions = { ...options };
 
@@ -138,7 +149,17 @@ module.exports = class CommentsController {
    * @param {Frame} frame
    */
   async browse(frame) {
-    return await this.service.getComments(this.#withPostFilter(frame.options));
+    const options = { ...frame.options };
+    if (!options.post_id && options.filter) {
+      let query;
+      try {
+        query = nql(options.filter).parse();
+      } catch (err) {
+        throw new errors.BadRequestError({ message: tpl(messages.errorParsingFilter), err });
+      }
+      options.post_id = this.#getPostIdFromFilter(query);
+    }
+    return await this.service.getComments(this.#withPostFilter(options));
   }
 
   async adminBrowse(frame) {
@@ -345,14 +366,14 @@ module.exports = class CommentsController {
   async like(frame) {
     this.#checkMember(frame);
 
+    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
+
     const result = await this.service.likeComment(
       frame.options.id,
       frame.options?.context?.member,
       frame.options,
     );
 
-    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
-
     this.setCacheInvalidationHeaders(comment, frame);
 
     return result;
@@ -364,14 +385,14 @@ module.exports = class CommentsController {
   async unlike(frame) {
     this.#checkMember(frame);
 
+    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
+
     const result = await this.service.unlikeComment(
       frame.options.id,
       frame.options?.context?.member,
       frame.options,
     );
 
-    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
-
     this.setCacheInvalidationHeaders(comment, frame);
 
     return result;
@@ -420,14 +441,14 @@ module.exports = class CommentsController {
   async dislike(frame) {
     this.#checkMember(frame);
 
+    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
+
     const result = await this.service.dislikeComment(
       frame.options.id,
       frame.options?.context?.member,
       frame.options,
     );
 
-    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
-
     this.setCacheInvalidationHeaders(comment, frame);
 
     return result;
@@ -439,14 +460,14 @@ module.exports = class CommentsController {
   async undislike(frame) {
     this.#checkMember(frame);
 
+    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
+
     const result = await this.service.undislikeComment(
       frame.options.id,
       frame.options?.context?.member,
       frame.options,
     );
 
-    const comment = await this.service.getCommentByID(frame.options.id, frame.options);
-
     this.setCacheInvalidationHeaders(comment, frame);
 
     return result;