ghost 6.61.0 → 6.63.0

package/core/server/adapters/jobs/InMemoryJobsBackend.js

@@ -10,6 +10,9 @@ const later = require('@breejs/later');
 const logging = require('@tryghost/logging');
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 10000;
 const DEFAULT_CONCURRENCY = 3;
+// Envelopes with no routing share this lane; routing to "default" by name is
+// the same lane, not a collision.
+const DEFAULT_QUEUE = 'default';
 function hasSeconds(cron) {
     return cron.trim().split(/\s+/).length >= 6;
 }
@@ -29,60 +32,99 @@ function delay(ms) {
         setTimeout(resolve, ms);
     });
 }
+// Work only flows between start() and shutdown(): boot starts the service
+// before the web app is mounted or any recurring job is scheduled, so an
+// enqueue or recurring registration before start() is a boot-ordering bug and
+// throws, while an enqueue after shutdown() is a benign shutdown race and is
+// dropped.
 class InMemoryJobsBackend extends adapter_base_jobs_1.JobsBackendBase {
     _processor;
     _stopped;
-    _concurrency;
-    _queue;
+    _defaultConcurrency;
+    _queues;
     _recurring;
     constructor(config = {}) {
         super();
         this._processor = null;
         this._stopped = false;
-        this._concurrency = resolveConcurrency(config.concurrency);
-        this._queue = this._createQueue();
+        this._defaultConcurrency = resolveConcurrency(config.concurrency);
+        this._queues = new Map();
         this._recurring = new Map();
     }
-    _createQueue() {
-        const queue = fastq_1.default.promise((envelope) => this._deliver(envelope), this._concurrency);
-        // Paused until start() attaches a processor; enqueue buffers meanwhile.
-        queue.pause();
-        return queue;
+    _makeQueue(concurrency) {
+        return fastq_1.default.promise((envelope) => this._deliver(envelope), concurrency);
     }
-    start({ processor }) {
+    start({ processor, queues }) {
+        const declared = new Map();
+        for (const [name, { concurrency }] of Object.entries(queues ?? {})) {
+            // A declaration the backend cannot satisfy must fail loudly here, never
+            // silently fall back (see the jobs-base README).
+            if (concurrency !== undefined && (!Number.isInteger(concurrency) || concurrency < 1)) {
+                throw new errors_1.default.IncorrectUsageError({
+                    message: `Invalid concurrency for declared queue "${name}": ${JSON.stringify(concurrency)}. Expected a positive integer.`,
+                });
+            }
+            declared.set(name, concurrency ?? this._defaultConcurrency);
+        }
+        // State only changes once every declaration is valid, so a rejected
+        // start() never leaves a partially started backend that accepts work.
         this._processor = processor;
         this._stopped = false;
-        this._queue.resume();
+        for (const [name, concurrency] of declared) {
+            this._queues.set(name, this._makeQueue(concurrency));
+        }
     }
-    enqueue(envelope) {
+    enqueue(envelope, routing) {
         if (this._stopped) {
             return;
         }
-        this._queue.push(envelope);
-    }
-    async _deliver(envelope) {
-        const processor = this._processor;
-        if (!processor) {
+        if (!this._processor) {
             throw new errors_1.default.IncorrectUsageError({
-                message: 'InMemoryJobsBackend attempted a delivery with no processor attached - the backend lifecycle is broken.',
+                message: `Cannot enqueue job "${envelope.type}" before the jobs backend is started.`,
             });
         }
+        const name = routing?.queue ?? DEFAULT_QUEUE;
+        let queue = this._queues.get(name);
+        if (!queue) {
+            // Lanes are created lazily: the default lane, and any queue name no
+            // handler declared, each get their own lane at the default concurrency.
+            queue = this._makeQueue(this._defaultConcurrency);
+            this._queues.set(name, queue);
+        }
+        queue.push(envelope);
+    }
+    async _deliver(envelope) {
         try {
-            await processor(envelope);
+            await this._processor(envelope);
         }
         catch (err) {
             logging.error(`Job "${envelope.type}" delivery failed`, err);
         }
     }
-    scheduleRecurring(envelope, { cron }) {
+    scheduleRecurring(envelope, { cron }, routing) {
+        if (this._stopped) {
+            return;
+        }
+        if (!this._processor) {
+            throw new errors_1.default.IncorrectUsageError({
+                message: `Cannot schedule recurring job "${envelope.type}" before the jobs backend is started.`,
+            });
+        }
         // First schedule per type wins; a re-registration must not disturb a
         // schedule that is already running (parity with a durable backend).
-        if (this._stopped || this._recurring.has(envelope.type)) {
+        if (this._recurring.has(envelope.type)) {
             return;
         }
         const parsed = later.parse.cron(cron, hasSeconds(cron));
         const timer = later.setInterval(() => {
-            this.enqueue(envelope);
+            // A throw inside a later timer callback would be an uncaughtException;
+            // a recurring tick must never take the process down.
+            try {
+                this.enqueue(envelope, routing);
+            }
+            catch (err) {
+                logging.error(`Recurring job "${envelope.type}" tick failed to enqueue`, err);
+            }
         }, parsed);
         this._recurring.set(envelope.type, timer);
     }
@@ -99,14 +141,17 @@ class InMemoryJobsBackend extends adapter_base_jobs_1.JobsBackendBase {
         for (const type of [...this._recurring.keys()]) {
             this._clearRecurring(type);
         }
-        const queue = this._queue;
-        queue.kill();
-        if (!queue.idle()) {
-            await Promise.race([queue.drained(), delay(timeoutMs)]);
+        const queues = [...this._queues.values()];
+        for (const queue of queues) {
+            queue.kill();
+        }
+        const draining = queues.filter((queue) => !queue.idle());
+        if (draining.length > 0) {
+            await Promise.race([Promise.all(draining.map((queue) => queue.drained())), delay(timeoutMs)]);
         }
-        // Fresh (paused) queue so a re-boot never inherits this lifecycle's
-        // abandoned in-flight deliveries against its concurrency limit.
-        this._queue = this._createQueue();
+        // Discard the queues so a re-boot never inherits this lifecycle's
+        // abandoned in-flight deliveries against its concurrency limits.
+        this._queues = new Map();
         this._processor = null;
     }
 }

package/core/server/api/endpoints/authentication.js

@@ -7,11 +7,10 @@ const web = require('../../web');
 const models = require('../../models');
 const auth = require('../../services/auth');
 const invitations = require('../../services/invitations');
-const dbBackup = require('../../data/db/backup');
 const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
 const UsersService = require('../../services/users');
-const userService = new UsersService({ dbBackup, models, auth, apiMail, apiSettings });
+const userService = new UsersService({ models, auth, apiMail, apiSettings });
 const adapterManager = require('../../services/adapter-manager').default;
 const schedulerAdapter = adapterManager.getAdapter('scheduling');
 

package/core/server/api/endpoints/authors-public.js

@@ -1,12 +1,15 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const models = require('../../models');
-const { rejectContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { rejectAuthorsContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 
 const ALLOWED_INCLUDES = ['count.posts'];
+const ALLOWED_READ_FIELDS = ['id', 'slug'];
 
 const messages = {
   notFound: 'Author not found.',
+  missingIdentifier: 'An author id or slug is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -29,7 +32,7 @@ const controller = {
     query(frame) {
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectAuthorsContentApiRestrictedFieldsTransformer,
       };
       return models.Author.findPage(options);
     },
@@ -40,7 +43,7 @@ const controller = {
       cacheInvalidate: false,
     },
     options: ['include', 'filter', 'fields'],
-    data: ['id', 'slug', 'email', 'role'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -50,12 +53,19 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
+      // GET bodies bypass the framework's declared data fields. Restrict the
+      // actual lookup too, before the model turns it into SQL predicates.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (!Object.values(data).some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectAuthorsContentApiRestrictedFieldsTransformer,
       };
 
-      const model = await models.Author.findOne(frame.data, options);
+      const model = await models.Author.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.notFound),

package/core/server/api/endpoints/emails.js

@@ -51,6 +51,19 @@ const controller = {
     },
   },
 
+  sendingStatus: {
+    headers: {
+      cacheInvalidate: false,
+    },
+    data: ['id'],
+    permissions: {
+      method: 'read',
+    },
+    async query(frame) {
+      return await emailService.controller.getSendingStatus(frame);
+    },
+  },
+
   retry: {
     headers: {
       cacheInvalidate: false,

package/core/server/api/endpoints/index.js

@@ -112,8 +112,8 @@ module.exports = {
     return apiFramework.pipeline(require('./members'), localUtils);
   },
 
-  get membersCustomFields() {
-    return apiFramework.pipeline(require('./member-custom-fields'), localUtils);
+  get membersMetafields() {
+    return apiFramework.pipeline(require('./member-metafields'), localUtils);
   },
 
   get tiersCheckoutConfig() {
@@ -312,6 +312,14 @@ module.exports = {
     return apiFramework.pipeline(require('./feedback-members'), localUtils, 'members');
   },
 
+  get membersAccount() {
+    return apiFramework.pipeline(require('./members-account'), localUtils, 'members');
+  },
+
+  get memberMetafieldsMembers() {
+    return apiFramework.pipeline(require('./member-metafields-members'), localUtils, 'members');
+  },
+
   get giftsMembers() {
     return apiFramework.pipeline(require('./gifts-members'), localUtils, 'members');
   },

package/core/server/api/endpoints/mail.js

@@ -25,7 +25,7 @@ _private.sendMail = (object) => {
               message: [
                 tpl(messages.unableToSendEmail),
                 tpl(messages.seeLinkForInstructions, {
-                  link: 'https://ghost.org/docs/concepts/config/#mail',
+                  link: 'https://docs.ghost.org/concepts/config/#mail',
                 }),
               ].join(' '),
             },

package/core/server/api/endpoints/member-metafields-members.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const members_metafields_1 = require("../../services/members-metafields");
+const controller = {
+    // The Admin resource's name, so the response Portal reads is the one Admin's
+    // serializer already produces. Only who may ask differs, and that is the route's
+    // business rather than the response's.
+    docName: 'members_metafields',
+    browse: {
+        headers: { cacheInvalidate: false },
+        options: ['namespace'],
+        validation: { options: { namespace: { required: true } } },
+        permissions: false,
+        query(frame) {
+            // No `filter`, which Admin offers: whether a field is archived is a
+            // publisher's business, and a member is only ever shown what they can still
+            // fill in.
+            return members_metafields_1.definitions.browse({ namespace: frame.options.namespace }, members_metafields_1.MEMBERS);
+        },
+    },
+};
+exports.default = controller;
+module.exports = controller;

package/core/server/api/endpoints/member-metafields.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const members_metafields_1 = require("../../services/members-metafields");
+const namespaces_1 = require("../../services/members-metafields/namespaces");
+const permissionsService = require('../../services/permissions');
+// Reading a definition needs no permission. A definition says only that the site collects
+// a shoe size, and every signed-in member is already shown the whole list, so there is
+// nothing here to keep from staff. Defining one is the publisher's own, and with
+// `permissions: true` the framework would check against the Bookshelf model named after
+// the resource — these fields have no Bookshelf model, so each writing handler asks the
+// permissions service directly.
+function canThis(frame) {
+    return permissionsService.canThis(frame.options.context);
+}
+/**
+ * Settle the namespace before the caller.
+ *
+ * Which namespace is being written to decides whose authority applies, so it is resolved
+ * first; only once the publisher turns out to own it does a staff role become the
+ * question. The other order answers a request to define a field somewhere nobody owns
+ * with "you lack a permission", which sends the caller after a permission that would not
+ * have helped.
+ */
+async function canDefine(frame, action) {
+    (0, namespaces_1.assertDefinable)(frame.options.namespace);
+    return action(frame);
+}
+const noCacheInvalidation = { cacheInvalidate: false };
+const controller = {
+    docName: 'members_metafields',
+    browse: {
+        headers: noCacheInvalidation,
+        options: ['namespace', 'filter'],
+        validation: { options: { namespace: { required: true } } },
+        permissions: false,
+        query(frame) {
+            return members_metafields_1.definitions.browse({
+                namespace: frame.options.namespace,
+                filter: frame.options.filter,
+            });
+        },
+    },
+    read: {
+        headers: noCacheInvalidation,
+        options: ['namespace', 'key'],
+        validation: { options: { namespace: { required: true }, key: { required: true } } },
+        permissions: false,
+        query(frame) {
+            return members_metafields_1.definitions.read(frame.options.namespace, frame.options.key);
+        },
+    },
+    add: {
+        statusCode: 201,
+        headers: noCacheInvalidation,
+        options: ['namespace'],
+        validation: { options: { namespace: { required: true } } },
+        permissions(frame) {
+            return canDefine(frame, (f) => canThis(f).add.member_custom_field());
+        },
+        query(frame) {
+            return members_metafields_1.definitions.add((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
+        },
+    },
+    reorder: {
+        headers: noCacheInvalidation,
+        options: ['namespace'],
+        validation: { options: { namespace: { required: true } } },
+        permissions(frame) {
+            return canDefine(frame, (f) => canThis(f).edit.member_custom_field());
+        },
+        query(frame) {
+            return members_metafields_1.definitions.reorder((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.data.members_metafields);
+        },
+    },
+    edit: {
+        headers: noCacheInvalidation,
+        options: ['namespace', 'key'],
+        validation: { options: { namespace: { required: true }, key: { required: true } } },
+        permissions(frame) {
+            return canDefine(frame, (f) => canThis(f).edit.member_custom_field(f.options.key));
+        },
+        query(frame) {
+            return members_metafields_1.definitions.edit((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key, frame.data.members_metafields[0]);
+        },
+    },
+    destroy: {
+        statusCode: 204,
+        headers: noCacheInvalidation,
+        options: ['namespace', 'key'],
+        validation: { options: { namespace: { required: true }, key: { required: true } } },
+        permissions(frame) {
+            return canDefine(frame, (f) => canThis(f).destroy.member_custom_field(f.options.key));
+        },
+        async query(frame) {
+            await members_metafields_1.definitions.destroy((0, members_metafields_1.actingContext)(frame.options.context), frame.options.namespace, frame.options.key);
+            return null;
+        },
+    },
+};
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
+module.exports = controller;

package/core/server/api/endpoints/members-account.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const membersService = require('../../services/members');
+const memberOf = (frame) => frame.options?.context?.member ?? null;
+const controller = {
+    docName: 'members_account',
+    read: {
+        headers: { cacheInvalidate: false },
+        permissions: false,
+        query(frame) {
+            return membersService.api.account.read(memberOf(frame).id);
+        },
+    },
+    /**
+     * Let Ghost email this member again.
+     *
+     * Under the account rather than as a resource of its own: being emailable is a
+     * fact about a member, and the only person who can restore it here is the member
+     * themselves.
+     */
+    destroySuppression: {
+        statusCode: 204,
+        headers: { cacheInvalidate: false },
+        permissions: false,
+        query(frame) {
+            const member = memberOf(frame);
+            return membersService.api.account.allowEmail(member.id, member.email);
+        },
+    },
+    // `update` rather than `edit`: the framework reserves `edit` for the Admin API's
+    // enveloped bodies, and this request has always carried a bare one. The
+    // members-facing gift endpoints name their own verbs for the same reason.
+    update: {
+        headers: { cacheInvalidate: false },
+        permissions: false,
+        query(frame) {
+            return membersService.api.account.edit(frame.data, memberOf(frame).id);
+        },
+    },
+};
+exports.default = controller;
+module.exports = controller;

package/core/server/api/endpoints/members.js

@@ -44,10 +44,10 @@ const messages = {
   resourceNotFound: '{resource} not found.',
 };
 
-// `custom_fields` is a browse include only: a read returns values whenever the
-// flag is on, the same way it returns tiers. Values are not a member relation, so
-// the input serializer lifts the key out of withRelated before the model sees it.
-const allowedIncludes = ['email_recipients', 'products', 'tiers', 'custom_fields'];
+// `metafields` is not a relation on the member model. It is allowed here only so callers
+// can ask for it with `include=`; the input serializer removes it before the model tries
+// to eager-load it.
+const allowedIncludes = ['email_recipients', 'products', 'tiers', 'metafields'];
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {

package/core/server/api/endpoints/newsletters-public.js

@@ -1,4 +1,8 @@
 const models = require('../../models');
+const {
+  rejectNewslettersContentApiRestrictedFieldsTransformer,
+  rejectNewslettersContentApiRestrictedOrderFields,
+} = require('./utils/api-filter-utils');
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,7 +15,12 @@ const controller = {
     options: ['filter', 'fields', 'limit', 'order', 'page'],
     permissions: true,
     query(frame) {
-      return models.Newsletter.findPage(frame.options);
+      const options = {
+        ...frame.options,
+        order: rejectNewslettersContentApiRestrictedOrderFields(frame.options.order),
+        mongoTransformer: rejectNewslettersContentApiRestrictedFieldsTransformer,
+      };
+      return models.Newsletter.findPage(options);
     },
   },
 };

package/core/server/api/endpoints/pages-public.js

@@ -1,14 +1,17 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const models = require('../../models');
-const { rejectContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { rejectPagesContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 const { generateGiftKeyData, applyGiftAccess } = require('./utils/gift-link-access');
 const { generateOptionsData, generateAuthData } = require('./utils/public-cache-keys');
 
 const ALLOWED_INCLUDES = ['tags', 'authors', 'tiers'];
+const ALLOWED_READ_FIELDS = ['id', 'slug', 'uuid'];
 
 const messages = {
   pageNotFound: 'Page not found.',
+  missingIdentifier: 'A page id, slug or uuid is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -44,7 +47,7 @@ const controller = {
     query(frame) {
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPagesContentApiRestrictedFieldsTransformer,
       };
       return models.Post.findPage(options);
     },
@@ -72,7 +75,7 @@ const controller = {
       };
     },
     options: ['include', 'fields', 'formats', 'debug', 'absolute_urls'],
-    data: ['id', 'slug', 'uuid'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -85,11 +88,18 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
+      // GET bodies bypass the framework's declared data fields. Restrict the
+      // actual lookup too, before the model turns it into SQL predicates.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (!Object.values(data).some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPagesContentApiRestrictedFieldsTransformer,
       };
-      const model = await models.Post.findOne(frame.data, options);
+      const model = await models.Post.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.pageNotFound),

package/core/server/api/endpoints/posts-public.js

@@ -1,17 +1,20 @@
 const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const postsPublicService = require('../../services/posts-public');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const postsService = getPostServiceInstance();
-const { rejectContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { rejectPostsContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 const { generateGiftKeyData, applyGiftAccess } = require('./utils/gift-link-access');
 const { generateOptionsData, generateAuthData } = require('./utils/public-cache-keys');
 
 const ALLOWED_INCLUDES = ['tags', 'authors', 'tiers', 'sentiment'];
+const ALLOWED_READ_FIELDS = ['id', 'slug', 'uuid'];
 
 const messages = {
   postNotFound: 'Post not found.',
+  missingIdentifier: 'A post id, slug or uuid is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -68,7 +71,7 @@ const controller = {
     query(frame) {
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPostsContentApiRestrictedFieldsTransformer,
       };
       return postsService.browsePosts(options);
     },
@@ -93,7 +96,7 @@ const controller = {
       };
     },
     options: ['include', 'fields', 'formats', 'debug', 'absolute_urls'],
-    data: ['id', 'slug', 'uuid'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -106,11 +109,18 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
+      // GET bodies bypass the framework's declared data fields. Restrict the
+      // actual lookup too, before the model turns it into SQL predicates.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (!Object.values(data).some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPostsContentApiRestrictedFieldsTransformer,
       };
-      const model = await models.Post.findOne(frame.data, options);
+      const model = await models.Post.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.postNotFound),

package/core/server/api/endpoints/posts.js

@@ -129,13 +129,13 @@ const controller = {
       method: 'importContent',
     },
     async query(frame) {
-      // The CSV must be parsed before the response goes out: the uploaded temp file is
-      // deleted as soon as it is sent. The posts are written by a background job behind
-      // the 202.
+      // The content-import service stages and validates the upload before this response;
+      // Multer deletes the request temp file as soon as the 202 is sent.
       const { importId, total } = await contentImportService.importCSV({
         filePath: frame.file.path,
         fileName: frame.file.name,
         mapping: frame.data.mapping,
+        requestUserEmail: frame.user ? frame.user.get('email') : null,
       });
       return { meta: { import_id: importId, total } };
     },