ghost 6.61.0 → 6.62.0

package/core/server/services/members/jobs/clean-expired-comped-task.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ObjectId = require('bson-objectid').default;
+const { chunk: chunkArray } = require('lodash');
+const moment = require('moment');
+// Removes expired comped entries from the members_products table, moves the
+// affected members from comped to free and records a comped->free status
+// event for each of them. The three writes commit or roll back together, so a
+// failed run leaves the source rows in place and a repeat run redoes the whole
+// unit of work instead of finishing a half-applied one.
+async function cleanExpiredComped({ db, models, events, logging, sentry, }) {
+    const startedAt = Date.now();
+    const { deletedSubscriptionCount, updatedMemberCount, updatedMembers, now } = await db.knex.transaction(async (trx) => {
+        const expiredCompedRows = await trx('members_products')
+            // we need to be careful about the type here. .format() is the only
+            // thing that works across SQLite and MySQL: an ISO cutoff compares
+            // lexically against SQLite's 'YYYY-MM-DD HH:mm:ss' text and its 'T'
+            // sorts above ' ', wrongly matching same-UTC-day expiries
+            .where('expiry_at', '<', moment.utc().startOf('day').format('YYYY-MM-DD HH:mm:ss'))
+            .select('*');
+        if (!expiredCompedRows.length) {
+            return {
+                deletedSubscriptionCount: 0,
+                updatedMemberCount: 0,
+                updatedMembers: [],
+                now: new Date(),
+            };
+        }
+        const rowIds = expiredCompedRows.map((d) => d.id);
+        const memberIds = expiredCompedRows.map((d) => d.member_id);
+        // Only members still in the comped status change; anyone already paid,
+        // free or deleted is left untouched. The rows are locked for the rest
+        // of the transaction so a concurrent status change cannot slip between
+        // this read and the update below (forUpdate is a no-op on SQLite,
+        // where the single-writer transaction already guarantees this). The
+        // members rows are locked BEFORE the members_products delete so this
+        // transaction acquires locks in the same members -> members_products
+        // order as the member-edit flows (Bookshelf edit, linkSubscription);
+        // the reverse order could deadlock against them.
+        const compedMembers = await trx('members')
+            .whereIn('id', memberIds)
+            .andWhere('status', 'comped')
+            .forUpdate();
+        const deletedCount = await trx('members_products').whereIn('id', rowIds).del();
+        const updateMemberIds = compedMembers.map((d) => d.id);
+        const updatedAt = new Date();
+        const updatedCount = await trx('members').whereIn('id', updateMemberIds).update({
+            status: 'free',
+            updated_at: updatedAt,
+        });
+        const statusEvents = compedMembers.map((member) => {
+            return {
+                id: ObjectId().toHexString(),
+                member_id: member.id,
+                from_status: member.status,
+                to_status: 'free',
+                created_at: updatedAt,
+            };
+        });
+        // SQLite >= 3.32.0 can support 32766 host parameters
+        // each row uses 5 variables so ⌊32766/5⌋ = 6553
+        const chunkSize = 6553;
+        for (const chunk of chunkArray(statusEvents, chunkSize)) {
+            await trx('members_status_events').insert(chunk);
+        }
+        return {
+            deletedSubscriptionCount: deletedCount,
+            updatedMemberCount: updatedCount,
+            updatedMembers: compedMembers,
+            now: updatedAt,
+        };
+    });
+    // Emitted after the commit so listeners never observe state that could
+    // still roll back. A failed emission is logged and skipped rather than
+    // failing the job: the database changes are already durable and the
+    // emitted_event_count below makes the shortfall visible.
+    let emittedEventCount = 0;
+    for (const member of updatedMembers) {
+        const emitted = await emitMemberEditedEvent({ member, now, models, events, logging, sentry });
+        if (emitted) {
+            emittedEventCount += 1;
+        }
+    }
+    logging.info({
+        system: {
+            event: 'clean_expired_comped.completed',
+            deleted_subscription_count: deletedSubscriptionCount,
+            updated_member_count: updatedMemberCount,
+            emitted_event_count: emittedEventCount,
+            duration_ms: Date.now() - startedAt,
+        },
+    }, `[Background Job] clean-expired-comped removed ${deletedSubscriptionCount} expired subscriptions and updated ${updatedMemberCount} members`);
+    return { deletedSubscriptionCount, updatedMemberCount, emittedEventCount };
+}
+// Emits member.edited in the shape its listeners (webhooks in particular)
+// expect: a freshly loaded model whose _previousAttributes carry the
+// pre-cleanup status and _changed the comped->free transition, with an
+// internal context.
+async function emitMemberEditedEvent({ member, now, models, events, logging, sentry, }) {
+    try {
+        const model = await models.Member.findOne({ id: member.id }, { require: true, context: { internal: true } });
+        model._previousAttributes = normalizeDates({
+            ...model.attributes,
+            status: member.status,
+            updated_at: member.updated_at,
+        });
+        model._changed = normalizeDates({
+            status: 'free',
+            updated_at: now,
+        });
+        events.emit('member.edited', model, { context: { internal: true } });
+        return true;
+    }
+    catch (err) {
+        if (isNotFoundError(err)) {
+            logging.warn(`Could not emit member.edited for expired comped member: Member ${member.id} was not found`);
+            return false;
+        }
+        logging.error(err);
+        sentry.captureException(err);
+        return false;
+    }
+}
+function normalizeDates(attributes) {
+    const normalized = { ...attributes };
+    for (const [key, value] of Object.entries(normalized)) {
+        if (key.endsWith('_at') && value && !(value instanceof Date)) {
+            normalized[key] = moment.utc(value).toDate();
+        }
+    }
+    return normalized;
+}
+function isNotFoundError(err) {
+    if (!err || typeof err !== 'object') {
+        return false;
+    }
+    const errorType = 'errorType' in err ? err.errorType : undefined;
+    const name = 'name' in err ? err.name : undefined;
+    const message = 'message' in err ? err.message : undefined;
+    return (errorType === 'NotFoundError' ||
+        name === 'NotFoundError' ||
+        message === 'NotFound' ||
+        message === 'EmptyResponse');
+}
+exports.default = cleanExpiredComped;

package/core/server/services/members/jobs/index.js

@@ -1,13 +1,17 @@
-const path = require('path');
 const logging = require('@tryghost/logging');
-const jobsService = require('../../jobs');
+const errors = require('@tryghost/errors');
 const CleanTokensJob = require('./clean-tokens-job').default;
+const CleanExpiredCompedJob = require('./clean-expired-comped-job').default;
+const cleanTokensTask = require('./clean-tokens-task').default;
+const cleanExpiredCompedTask = require('./clean-expired-comped-task').default;
 
 let hasScheduled = {
   expiredComped: false,
   tokens: false,
 };
 
+let tasks;
+
 function alreadyScheduledOrTest(key) {
   return hasScheduled[key] || process.env.NODE_ENV.startsWith('test');
 }
@@ -19,43 +23,63 @@ function randomDailyCron(maxHour = 24) {
   return `${s} ${m} ${h} * * *`;
 }
 
-function scheduleJob(key, name, jobFile, maxHour = 6) {
-  if (alreadyScheduledOrTest(key)) {
-    return hasScheduled[key];
+function getTasks() {
+  if (!tasks) {
+    throw new errors.IncorrectUsageError({
+      message: 'Member jobs used before init(). Call init() from boot first.',
+    });
   }
+  return tasks;
+}
 
-  const s = Math.floor(Math.random() * 60);
-  const m = Math.floor(Math.random() * 60);
-  const h = Math.floor(Math.random() * maxHour);
+module.exports = {
+  // Composition root for the member cleanup tasks. Idempotent because tests
+  // may boot more than once per process.
+  init() {
+    if (tasks) {
+      return;
+    }
 
-  const at = `${s} ${m} ${h} * * *`;
+    const db = require('../../../data/db');
+    const models = require('../../../models');
+    const events = require('../../../lib/common/events');
+    const sentry = require('../../../../shared/sentry');
 
-  logging.info(`[Background Job] ${name} scheduled at ${at}`);
-  jobsService.addJob({
-    at,
-    job: path.resolve(__dirname, jobFile),
-    name,
-  });
+    tasks = {
+      cleanTokens: () => cleanTokensTask({ db, logging }),
+      cleanExpiredComped: () => cleanExpiredCompedTask({ db, models, events, logging, sentry }),
+    };
+  },
 
-  hasScheduled[key] = true;
+  cleanTokens() {
+    return getTasks().cleanTokens();
+  },
 
-  return true;
-}
+  cleanExpiredComped() {
+    return getTasks().cleanExpiredComped();
+  },
 
-module.exports = {
-  async scheduleExpiredCompCleanupJob() {
-    return scheduleJob('expiredComped', 'clean-expired-comped', 'clean-expired-comped.js');
+  async scheduleExpiredCompCleanupJob(jobsService) {
+    if (alreadyScheduledOrTest('expiredComped')) {
+      return;
+    }
+
+    // Keep the legacy off-peak window: a random time between 00:00 and 05:59
+    const cron = randomDailyCron(6);
+    logging.info(`[Background Job] clean-expired-comped scheduled at ${cron}`);
+    await jobsService.scheduleRecurring(new CleanExpiredCompedJob(), { cron });
+
+    hasScheduled.expiredComped = true;
   },
 
-  async scheduleTokenCleanupJob() {
+  async scheduleTokenCleanupJob(jobsService) {
     if (alreadyScheduledOrTest('tokens')) {
       return;
     }
 
-    const classBasedJobs = require('../../jobs-service').getInstance();
     const cron = randomDailyCron();
     logging.info(`[Background Job] clean-tokens scheduled at ${cron}`);
-    await classBasedJobs.scheduleRecurring(new CleanTokensJob(), { cron });
+    await jobsService.scheduleRecurring(new CleanTokensJob(), { cron });
 
     hasScheduled.tokens = true;
   },

package/core/server/services/members/members-api/controllers/member-controller.js

@@ -146,6 +146,17 @@ module.exports = class MemberController {
 
       if (tierId && cadence) {
         const tier = await this._tiersService.api.read(tierId);
+
+        if (!tier) {
+          res.writeHead(404);
+          return res.end('Not Found.');
+        }
+
+        if (tier.status !== 'active') {
+          res.writeHead(403);
+          return res.end('Tier is archived.');
+        }
+
         const stripePrice = await this._paymentsService.getPriceForTierCadence(tier, cadence);
 
         await this._memberRepository.updateSubscription({

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -140,7 +140,6 @@ module.exports = class RouterController {
    * @param {any} deps.offersAPI
    * @param {any} deps.paymentsService
    * @param {any} deps.memberRepository
-   * @param {any} deps.StripePrice
    * @param {() => boolean} deps.allowSelfSignup
    * @param {any} deps.magicLinkService
    * @param {import('../../../stripe/stripe-api')} deps.stripeAPIService
@@ -160,7 +159,6 @@ module.exports = class RouterController {
     paymentsService,
     tiersService,
     memberRepository,
-    StripePrice,
     allowSelfSignup,
     magicLinkService,
     stripeAPIService,
@@ -180,7 +178,6 @@ module.exports = class RouterController {
     this._paymentsService = paymentsService;
     this._tiersService = tiersService;
     this._memberRepository = memberRepository;
-    this._StripePrice = StripePrice;
     this._allowSelfSignup = allowSelfSignup;
     this._magicLinkService = magicLinkService;
     this._stripeAPIService = stripeAPIService;
@@ -602,11 +599,11 @@ module.exports = class RouterController {
     if (member) {
       options.successUrl = this._generateSuccessUrl(options.successUrl, tier.welcomePageURL);
 
-      const restrictCheckout = member.get('status') === 'paid';
+      // Existing paid members must manage their subscription instead of creating another.
+      // Other members must prove ownership of the provided email before checking out.
+      const restrictCheckout = member.get('status') === 'paid' || !options.isAuthenticated;
 
       if (restrictCheckout) {
-        // This member is already subscribed to a paid tier
-        // We don't want to create a duplicate subscription
         if (!options.isAuthenticated && options.email) {
           try {
             await this._sendEmailWithMagicLink({ email: options.email, requestedType: 'signin' });

package/core/server/services/members/members-api/members-api.js

@@ -41,7 +41,6 @@ module.exports = function MembersAPI({
     MemberProductEvent,
     MemberEmailChangeEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberLinkClickEvent,
     EmailSpamComplaintEvent,
     Offer,
@@ -72,6 +71,7 @@ module.exports = function MembersAPI({
   emailAddressService,
   giftService,
   customFieldValues,
+  customFieldDefinitions,
 }) {
   const tokenService = new TokenService({
     privateKey,
@@ -119,7 +119,6 @@ module.exports = function MembersAPI({
     MemberStatusEvent,
     MemberLoginEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberLinkClickEvent,
     MemberFeedback,
     EmailSpamComplaintEvent,
@@ -147,7 +146,6 @@ module.exports = function MembersAPI({
         });
       },
     },
-    labsService,
     stripeService: stripeAPIService,
     memberAttributionService,
     emailSuppressionList,
@@ -156,6 +154,7 @@ module.exports = function MembersAPI({
     commentsService,
     giftService,
     customFieldValues,
+    customFieldDefinitions,
   });
 
   const geolocationService = new GeolocationService();
@@ -202,7 +201,6 @@ module.exports = function MembersAPI({
     paymentsService,
     tiersService,
     memberRepository,
-    StripePrice,
     allowSelfSignup,
     magicLinkService,
     stripeAPIService,
@@ -358,11 +356,11 @@ module.exports = function MembersAPI({
   }
 
   async function getMemberIdentityData(email) {
-    return memberBREADService.read({ email });
+    return memberBREADService.read({ email }, { withCustomFields: false });
   }
 
   async function getMemberIdentityDataFromTransientId(transientId) {
-    return memberBREADService.read({ transient_id: transientId });
+    return memberBREADService.read({ transient_id: transientId }, { withCustomFields: false });
   }
 
   async function cycleTransientId(memberId) {

package/core/server/services/members/members-api/repositories/event-repository.js

@@ -34,13 +34,11 @@ module.exports = class EventRepository {
     MemberStatusEvent,
     MemberLoginEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberPaidSubscriptionEvent,
     MemberLinkClickEvent,
     MemberFeedback,
     EmailSpamComplaintEvent,
     Comment,
-    labsService,
     memberAttributionService,
     urlService,
     MemberEmailChangeEvent,
@@ -55,10 +53,8 @@ module.exports = class EventRepository {
     this._MemberLoginEvent = MemberLoginEvent;
     this._EmailRecipient = EmailRecipient;
     this._Comment = Comment;
-    this._labsService = labsService;
     this._urlService = urlService;
     this._MemberCreatedEvent = MemberCreatedEvent;
-    this._SubscriptionCreatedEvent = SubscriptionCreatedEvent;
     this._MemberLinkClickEvent = MemberLinkClickEvent;
     this._MemberFeedback = MemberFeedback;
     this._EmailSpamComplaintEvent = EmailSpamComplaintEvent;

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -16,11 +16,6 @@ const messages = {
 // Stored in the action's `context.action_name`; Admin maps it to a display label.
 const CUSTOM_FIELDS_EDITED_ACTION = 'custom_fields_edited';
 
-/**
- * @typedef {object} ILabsService
- * @prop {(key: string) => boolean} isSet
- */
-
 /**
  * @typedef {object} IEmailService
  * @prop {(data: {email: string, requestedType: string}) => Promise<any>} sendEmailWithMagicLink
@@ -45,7 +40,6 @@ module.exports = class MemberBREADService {
    * @param {object} deps
    * @param {import('../repositories/member-repository')} deps.memberRepository
    * @param {import('../../../offers/application/offers-api')} deps.offersAPI
-   * @param {ILabsService} deps.labsService
    * @param {IEmailService} deps.emailService
    * @param {IStripeService} deps.stripeService
    * @param {import('../../../member-attribution/member-attribution-service')} deps.memberAttributionService
@@ -54,10 +48,10 @@ module.exports = class MemberBREADService {
    * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
    * @param {IGiftsModule} deps.giftService
    * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
+   * @param {import('../../../members-custom-fields/definitions-service').CustomFieldDefinitionsService} deps.customFieldDefinitions Required: boot builds it before the members service
    */
   constructor({
     memberRepository,
-    labsService,
     emailService,
     stripeService,
     offersAPI,
@@ -68,13 +62,12 @@ module.exports = class MemberBREADService {
     commentsService,
     giftService,
     customFieldValues,
+    customFieldDefinitions,
   }) {
     this.offersAPI = offersAPI;
     /** @private */
     this.memberRepository = memberRepository;
     /** @private */
-    this.labsService = labsService;
-    /** @private */
     this.emailService = emailService;
     /** @private */
     this.stripeService = stripeService;
@@ -92,31 +85,25 @@ module.exports = class MemberBREADService {
     this.giftService = giftService;
     /** @private */
     this.customFieldValues = customFieldValues;
+    /** @private */
+    this.customFieldDefinitions = customFieldDefinitions;
   }
 
   /**
-   * @private
-   * Custom field values keyed by member id, or `null` when the feature is off —
-   * the flag lives here, so callers just check the result: `null` means omit the
-   * `custom_fields` key entirely, keeping a pre-feature member payload identical.
-   *
-   * A read gets values on the flag alone, with no opt-in include: a member's
-   * custom fields are their own data, like labels and tiers, which a read
-   * already returns unasked. `include` is for things that are expensive or
-   * aggregate (email_recipients, counts), and one flat lookup on a read that
-   * already issues a dozen queries is neither. The flag, not an include, is what
-   * protects consumers that predate the feature — an include would outlive it
-   * and become permanent API surface.
+   * Metafields are extra fields a publisher can define on member records, such as a shoe
+   * size or a delivery address. Their values live in their own table, so they are fetched
+   * here rather than loaded alongside the member.
    *
-   * Browse is the opposite — opt-in via `include=custom_fields`, exactly how
-   * `products`/`tiers` already behave: a read always carries them, a list only
-   * when asked. Read and browse must stay format-identical, so a browse that
-   * asks gets the same key a read gives unasked.
+   * Returns null when the site has defined no fields, which tells the caller to leave the
+   * `metafields` key off the member payload rather than send an empty object: a key added to
+   * an API response cannot be withdrawn without breaking whoever started reading it, and
+   * most sites have never defined a field, so those sites keep the payload they had before
+   * this feature existed.
    * @param {string[]} memberIds
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
   async fetchCustomFieldValues(memberIds) {
-    if (!this.labsService.isSet('membersCustomFields')) {
+    if (!(await this.customFieldDefinitions.hasAnyActive())) {
       return null;
     }
 
@@ -394,7 +381,16 @@ module.exports = class MemberBREADService {
     }
   }
 
-  async read(data, options = {}) {
+  /**
+   * @param {object} data
+   * @param {object} [options]
+   * @param {boolean} [options.withCustomFields] Pass false to leave custom field values
+   *   off the result. Ghost calls this method to identify a signed-in reader on every page
+   *   view of a themed site, and that caller renders the member through a fixed list of
+   *   fields that has never included custom ones. Fetching them there costs two database
+   *   queries per page view whose results are then thrown away.
+   */
+  async read(data, { withCustomFields = true, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -455,43 +451,25 @@ module.exports = class MemberBREADService {
     const unsubscribeUrl = this.settingsHelpers.createUnsubscribeUrl(member.uuid);
     member.unsubscribe_url = unsubscribeUrl;
 
-    const customFields = await this.fetchCustomFieldValues([member.id]);
-    if (customFields) {
-      member.custom_fields = customFields.get(member.id) ?? {};
+    if (withCustomFields) {
+      const customFields = await this.fetchCustomFieldValues([member.id]);
+      if (customFields) {
+        member.metafields = customFields.get(member.id) ?? {};
+      }
     }
 
     return member;
   }
 
-  /**
-   * @private
-   * The write-side flag gate, paired with `fetchCustomFieldValues` on the read
-   * side. The schema declares `custom_fields` for every site, so the key arrives
-   * whether or not the feature is on and this is what decides it goes no further.
-   * @param {object} data
-   */
-  dropCustomFieldsWhenDisabled(data) {
-    if (!this.labsService.isSet('membersCustomFields')) {
-      delete data.custom_fields;
-    }
-  }
-
   async add(data, options) {
-    this.dropCustomFieldsWhenDisabled(data);
-
-    // Values cannot be set on create, only on a subsequent edit. `namesValues`
-    // both judges the body and rejects a malformed one, so a body refused here is
-    // refused on edit for the same reason.
-    if (this.customFieldValues.namesValues(data.custom_fields)) {
+    if (this.customFieldValues.namesValues(this.customFieldValues.unwrapWire(data.metafields))) {
       throw new errors.ValidationError({
         message: tpl(messages.customFieldsOnAdd),
-        property: 'custom_fields',
+        property: 'metafields',
       });
     }
 
-    // Not a member column, so it comes off before the repository sees it. Only
-    // an absent key or one naming no values gets this far.
-    delete data.custom_fields;
+    delete data.metafields;
 
     if (!this.stripeService.configured && (data.comped || data.stripe_customer_id)) {
       const property = data.comped ? 'comped' : 'stripe_customer_id';
@@ -587,15 +565,9 @@ module.exports = class MemberBREADService {
   async edit(data, options) {
     delete data.last_seen_at;
 
-    this.dropCustomFieldsWhenDisabled(data);
-
-    // Values live in their own table, so they come off the member data before
-    // the repository sees it — `custom_fields` is not a member column. The gate
-    // above has already dropped it when the feature is off, so by this point its
-    // presence is the signal to write.
-    const customFields = data.custom_fields;
+    const customFields = this.customFieldValues.unwrapWire(data.metafields);
     const writeCustomFields = customFields !== undefined;
-    delete data.custom_fields;
+    delete data.metafields;
 
     // Plan (which validates) before the member is touched, so a bad value 422s
     // here rather than after the member edit has been applied — and keep the
@@ -833,7 +805,7 @@ module.exports = class MemberBREADService {
         delete member.products;
       }
       if (customFieldsByMember) {
-        member.custom_fields = customFieldsByMember.get(model.id) ?? {};
+        member.metafields = customFieldsByMember.get(model.id) ?? {};
       }
       member.email_suppression = {
         suppressed: bulkSuppressionData[index].suppressed || !!model.get('email_disabled'),

package/core/server/services/members/members-api/services/payments-service.js

@@ -161,7 +161,7 @@ class PaymentsService {
    */
   async getCheckoutConfigForTier(tier) {
     const checkoutConfig = this.tiersService?.checkout;
-    if (!this.labsService?.isSet('membersCustomFields') || !checkoutConfig) {
+    if (!this.labsService?.isSet('stripeCheckoutCollection') || !checkoutConfig) {
       return undefined;
     }
     try {

package/core/server/services/members/service.js

@@ -7,7 +7,6 @@ const MembersConfigProvider = require('./members-config-provider');
 const { makeImporter, makeExporter } = require('./import-export');
 const { resolveInlineThreshold } = require('./import-export/config');
 const MembersStats = require('./stats/members-stats');
-const memberJobs = require('./jobs');
 const logging = require('@tryghost/logging');
 const urlUtils = require('../../../shared/url-utils').default;
 const settingsCache = require('../../../shared/settings-cache');
@@ -29,7 +28,7 @@ const messages = {
   sslRequiredForStripe:
     'Cannot run Ghost without SSL when Stripe is connected. Please update your url config to use "https://".',
   remoteWebhooksInDevelopment:
-    'Cannot use remote webhooks in development. See https://ghost.org/docs/webhooks/#stripe-webhooks for developing with Stripe.',
+    'Cannot use remote webhooks in development. See https://docs.ghost.org/webhooks/#stripe-webhooks for developing with Stripe.',
 };
 
 const ghostMailer = new GhostMailer();
@@ -216,9 +215,6 @@ module.exports = {
         );
       }
     }
-
-    // Schedule daily cron job to clean expired comp subs
-    memberJobs.scheduleExpiredCompCleanupJob();
   },
   contentGating: require('./content-gating'),
 

package/core/server/services/members-custom-fields/bindings-service.js

@@ -8,6 +8,7 @@ const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_custom_fields';
+const { CUSTOM_NAMESPACE } = require('@tryghost/custom-field-types/identity');
 const BINDINGS_TABLE = 'members_custom_field_bindings';
 /**
  * Where a source sends what it collected: a `port` is the name that source uses for a
@@ -60,7 +61,7 @@ class CustomFieldBindingsService {
     async writeOne(memberId, into, value) {
         let planned;
         try {
-            planned = await this.values.planWrite({ [into.key]: value });
+            planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value });
         }
         catch (err) {
             logging_1.default.warn({

package/core/server/services/members-custom-fields/codec.js

@@ -2,14 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.customFieldCodec = void 0;
 const zod_1 = require("zod");
+const identity_1 = require("@tryghost/custom-field-types/identity");
 const case_keys_1 = require("../../lib/case-keys");
 const schema_1 = require("./schema");
 const models_1 = require("./models");
-// Maps a members_custom_fields row to/from the domain CustomField (snake_case to
-// camelCase; DbDate decoding happens in DbCustomField).
 exports.customFieldCodec = zod_1.z.codec(schema_1.DbCustomField, models_1.CustomField, {
     // DbCustomField validates `type` as the field-type enum, so the decoded row
     // already carries a FieldType and camelKeys preserves it — no cast needed.
-    decode: (row) => (0, case_keys_1.camelKeys)(row),
-    encode: (field) => (0, case_keys_1.snakeKeys)(field),
+    decode: (row) => ({ ...(0, case_keys_1.camelKeys)(row), namespace: identity_1.CUSTOM_NAMESPACE }),
+    encode: ({ namespace: _namespace, ...field }) => (0, case_keys_1.snakeKeys)(field),
 });