ghost 6.61.0 → 6.63.0

package/core/server/api/endpoints/tags-public.js

@@ -1,12 +1,16 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const models = require('../../models');
 const tagsPublicService = require('../../services/tags-public');
+const { rejectTagsContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 
 const ALLOWED_INCLUDES = ['count.posts'];
+const ALLOWED_READ_FIELDS = ['id', 'slug', 'visibility'];
 
 const messages = {
   tagNotFound: 'Tag not found.',
+  missingIdentifier: 'A tag id or slug is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -28,7 +32,11 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.TagPublic.findPage(frame.options);
+      const options = {
+        ...frame.options,
+        mongoTransformer: rejectTagsContentApiRestrictedFieldsTransformer,
+      };
+      return models.TagPublic.findPage(options);
     },
   },
 
@@ -37,7 +45,7 @@ const controller = {
       cacheInvalidate: false,
     },
     options: ['include', 'filter', 'fields', 'debug'],
-    data: ['id', 'slug', 'visibility'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -47,7 +55,18 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.TagPublic.findOne(frame.data, frame.options);
+      // GET bodies bypass the framework's declared data fields. Preserve the
+      // public visibility constraint, but require an actual tag identifier.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (![data.id, data.slug].some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
+      const options = {
+        ...frame.options,
+        mongoTransformer: rejectTagsContentApiRestrictedFieldsTransformer,
+      };
+      const model = await models.TagPublic.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.tagNotFound),

package/core/server/api/endpoints/tiers-checkout-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const members_custom_fields_1 = require("../../services/members-custom-fields");
+const members_metafields_1 = require("../../services/members-metafields");
 const tier_checkout_config_1 = require("../../services/tier-checkout-config");
 const tiersService = require('../../services/tiers');
 /**
@@ -50,7 +50,7 @@ const controller = {
         validation: { options: { id: { required: true } } },
         permissions: { docName: 'products', method: 'edit' },
         async query(frame) {
-            await tiersService.checkout.edit((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.id, frame.data.tiers_checkout_config?.[0] ?? {});
+            await tiersService.checkout.edit((0, members_metafields_1.actingContext)(frame.options.context), frame.options.id, frame.data.tiers_checkout_config?.[0] ?? {});
             return [await forTier(frame.options.id)];
         },
     },

package/core/server/api/endpoints/tiers-public.js

@@ -1,4 +1,38 @@
+const logging = require('@tryghost/logging');
+const labs = require('../../../shared/labs');
 const tiersService = require('../../services/tiers');
+const { requirementsByTier } = require('../../services/tier-checkout-config');
+
+/**
+ * What each tier asks a member for, or nothing when the site does not do that.
+ *
+ * Looked up per request rather than kept with the tier, because a tier is loaded into
+ * memory once at boot and these rows change underneath it: deleting a custom field
+ * cascades a tier's binding away without that repository ever hearing about it, so a copy
+ * taken at boot would go on promising to ask for a field the site no longer has.
+ *
+ * One lookup per response, and only for this payload. Staff read these settings through a
+ * resource of their own that carries them in full, and the payloads carrying tiers in
+ * bulk each build their own reduced projection of a tier, so none of them pays for this.
+ *
+ * A failure costs the requirements and nothing else. A tier a reader cannot see the price
+ * of is worse than one whose delivery question they meet a moment later.
+ */
+async function requirements() {
+  if (!labs.isSet('stripeCheckoutCollection')) {
+    return undefined;
+  }
+
+  try {
+    return requirementsByTier(await tiersService.checkout.browse());
+  } catch (err) {
+    logging.error(
+      { event: { name: 'tiers.requirements.read_failed' }, err },
+      'Failed to read what tiers ask a member for',
+    );
+    return undefined;
+  }
+}
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -13,7 +47,10 @@ const controller = {
     async query(frame) {
       const page = await tiersService.api.browse(frame.options);
 
-      return page;
+      // Carried on the page rather than fetched while serializing, so the serializer
+      // renders what it was handed. The admin controller looks none up, which is what
+      // keeps them off the admin payload — no serializer needs to ask who is calling.
+      return { ...page, requirements: await requirements() };
     },
   },
 };

package/core/server/api/endpoints/users.js

@@ -2,13 +2,12 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
 const permissionsService = require('../../services/permissions');
-const dbBackup = require('../../data/db/backup');
 const auth = require('../../services/auth');
 const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
 const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 const UsersService = require('../../services/users');
-const userService = new UsersService({ dbBackup, models, auth, apiMail, apiSettings });
+const userService = new UsersService({ models, auth, apiMail, apiSettings });
 const ALLOWED_INCLUDES = ['count.posts', 'permissions', 'roles', 'roles.permissions'];
 const UNSAFE_ATTRS = ['status', 'roles'];
 
@@ -191,6 +190,7 @@ const controller = {
   },
 
   destroy: {
+    statusCode: 204,
     headers: {
       cacheInvalidate: true,
     },

package/core/server/api/endpoints/utils/api-filter-utils.js

@@ -3,21 +3,173 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectNewslettersContentApiRestrictedFieldsTransformer = exports.rejectPagesContentApiRestrictedFieldsTransformer = exports.rejectPostsContentApiRestrictedFieldsTransformer = exports.rejectTagsContentApiRestrictedFieldsTransformer = exports.rejectAuthorsContentApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.rejectAuthorsRestrictedOrderFields = rejectAuthorsRestrictedOrderFields;
+exports.rejectTagsRestrictedOrderFields = rejectTagsRestrictedOrderFields;
+exports.rejectPostsContentApiRestrictedOrderFields = rejectPostsContentApiRestrictedOrderFields;
+exports.rejectPagesContentApiRestrictedOrderFields = rejectPagesContentApiRestrictedOrderFields;
+exports.rejectNewslettersContentApiRestrictedOrderFields = rejectNewslettersContentApiRestrictedOrderFields;
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const mongo_utils_1 = require("@tryghost/mongo-utils");
-const CONTENT_API_RESTRICTED_FIELDS = new Set(['password', 'email']);
+const schema = require('../../../data/schema').tables;
+// Never filterable or orderable through the Content API, on any resource or relation.
+const CONTENT_API_RESTRICTED_FIELDS = new Set([
+    'password',
+    'email',
+    'email_only',
+    'html',
+    'lexical',
+    'locale',
+    'mobiledoc',
+    'newsletter_id',
+    'plaintext',
+    'email_recipient_filter',
+    'published_by',
+]);
+const CONTENT_API_RESTRICTED_RELATIONS = new Set(['mobiledoc_revisions', 'post_revisions']);
+const CONTENT_API_PAGE_RESTRICTED_FIELDS = new Set(['email_subject']);
+const CONTENT_API_POST_RESTRICTED_FIELDS = new Set(['show_title_and_feature_image']);
+const CONTENT_API_NEWSLETTER_FIELDS = new Set([
+    'id',
+    'uuid',
+    'name',
+    'description',
+    'slug',
+    'sender_email',
+    'subscribe_on_signup',
+    'visibility',
+    'sort_order',
+    'created_at',
+    'updated_at',
+]);
+// User fields and relations the Content API does not expose: blocked as bare fields on authors and via author relations elsewhere.
+// Not blocked as bare fields on other resources, where visibility/status are legitimate filters.
+const CONTENT_API_USER_RESTRICTED_FIELDS = new Set([
+    'status',
+    'last_seen',
+    'created_at',
+    'updated_at',
+    'roles',
+    'roles_users',
+    'visibility',
+    'locale',
+    'accessibility',
+    'paid_subscription_started_notification',
+    'paid_subscription_canceled_notification',
+    'tour',
+    'comment_notifications',
+    'recommendation_notifications',
+    'gift_subscription_notifications',
+    'mention_notifications',
+    'donation_notifications',
+    'milestone_notifications',
+    'free_member_signup_notification',
+]);
+const CONTENT_API_AUTHOR_RELATIONS = new Set(['author', 'authors', 'primary_author']);
+const CONTENT_API_TAG_RESTRICTED_FIELDS = new Set([
+    'created_at',
+    'updated_at',
+    'parent_id',
+    'parent',
+]);
+const CONTENT_API_TAG_RELATIONS = new Set(['tag', 'tags', 'primary_tag']);
 const ADMIN_API_RESTRICTED_FIELDS = new Set(['password']);
+function getOrderAttributes(tableName) {
+    return Object.keys(schema[tableName])
+        .map((field) => `${tableName}.${field}`)
+        .filter((field) => !field.includes('@@'));
+}
+const CONTENT_API_AUTHOR_ORDER_ATTRIBUTES = getOrderAttributes('users');
+const CONTENT_API_TAG_ORDER_ATTRIBUTES = getOrderAttributes('tags');
+const CONTENT_API_NEWSLETTER_ORDER_ATTRIBUTES = getOrderAttributes('newsletters');
+const CONTENT_API_POST_ORDER_ATTRIBUTES = [
+    ...getOrderAttributes('posts'),
+    ...getOrderAttributes('posts_meta').filter((field) => !['posts_meta.id', 'posts_meta.post_id'].includes(field)),
+];
 function hasRestrictedSegment(key, fields) {
     return key
         .toLowerCase()
         .split('.')
         .some((segment) => fields.has(segment));
 }
+function hasRestrictedUserSegment(key) {
+    const segments = key.toLowerCase().split('.');
+    return segments.some((segment, index) => index > 0 &&
+        CONTENT_API_AUTHOR_RELATIONS.has(segments[index - 1]) &&
+        CONTENT_API_USER_RESTRICTED_FIELDS.has(segment));
+}
+function hasRestrictedTagSegment(key) {
+    const segments = key.toLowerCase().split('.');
+    return segments.some((segment, index) => index > 0 &&
+        CONTENT_API_TAG_RELATIONS.has(segments[index - 1]) &&
+        CONTENT_API_TAG_RESTRICTED_FIELDS.has(segment));
+}
+function isContentApiRestrictedKey(key) {
+    return (hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS) ||
+        hasRestrictedSegment(key, CONTENT_API_RESTRICTED_RELATIONS) ||
+        hasRestrictedUserSegment(key) ||
+        hasRestrictedTagSegment(key));
+}
+function isAuthorsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_USER_RESTRICTED_FIELDS));
+}
+function isTagsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_TAG_RESTRICTED_FIELDS));
+}
+function isPostsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_POST_RESTRICTED_FIELDS));
+}
+function isPagesContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_PAGE_RESTRICTED_FIELDS));
+}
+function isNewslettersContentApiRestrictedKey(key) {
+    const normalizedKey = key.toLowerCase();
+    const fieldKey = normalizedKey.startsWith('newsletters.')
+        ? normalizedKey.slice('newsletters.'.length)
+        : normalizedKey;
+    return !CONTENT_API_NEWSLETTER_FIELDS.has(fieldKey);
+}
+function rejectRestrictedOrderFields(order, orderAttributes, isRestricted) {
+    if (!order) {
+        return order;
+    }
+    const allowedClauses = (Array.isArray(order) ? order : [order])
+        .flatMap((value) => value.split(','))
+        .map((clause) => clause.trim())
+        .filter(Boolean)
+        .filter((clause) => {
+        const [field] = clause.split(/\s+/);
+        const normalizedField = field.toLowerCase();
+        const resolvedField = orderAttributes.find((orderAttribute) => orderAttribute.endsWith(normalizedField)) ||
+            normalizedField;
+        return !isRestricted(resolvedField);
+    });
+    return allowedClauses.length ? allowedClauses.join(',') : undefined;
+}
 const rejectContentApiRestrictedFieldsTransformer = (input) => {
-    return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS));
+    return (0, mongo_utils_1.rejectStatements)(input, isContentApiRestrictedKey);
 };
 exports.rejectContentApiRestrictedFieldsTransformer = rejectContentApiRestrictedFieldsTransformer;
+const rejectAuthorsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isAuthorsContentApiRestrictedKey);
+};
+exports.rejectAuthorsContentApiRestrictedFieldsTransformer = rejectAuthorsContentApiRestrictedFieldsTransformer;
+const rejectTagsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isTagsContentApiRestrictedKey);
+};
+exports.rejectTagsContentApiRestrictedFieldsTransformer = rejectTagsContentApiRestrictedFieldsTransformer;
+const rejectPostsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isPostsContentApiRestrictedKey);
+};
+exports.rejectPostsContentApiRestrictedFieldsTransformer = rejectPostsContentApiRestrictedFieldsTransformer;
+const rejectPagesContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isPagesContentApiRestrictedKey);
+};
+exports.rejectPagesContentApiRestrictedFieldsTransformer = rejectPagesContentApiRestrictedFieldsTransformer;
+const rejectNewslettersContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isNewslettersContentApiRestrictedKey);
+};
+exports.rejectNewslettersContentApiRestrictedFieldsTransformer = rejectNewslettersContentApiRestrictedFieldsTransformer;
 const rejectAdminApiRestrictedFieldsTransformer = (input) => {
     return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
 };
@@ -32,3 +184,18 @@ const validateAdminApiBulkFilterTransformer = (input) => {
     return input;
 };
 exports.validateAdminApiBulkFilterTransformer = validateAdminApiBulkFilterTransformer;
+function rejectAuthorsRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_AUTHOR_ORDER_ATTRIBUTES, isAuthorsContentApiRestrictedKey);
+}
+function rejectTagsRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_TAG_ORDER_ATTRIBUTES, isTagsContentApiRestrictedKey);
+}
+function rejectPostsContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_POST_ORDER_ATTRIBUTES, isPostsContentApiRestrictedKey);
+}
+function rejectPagesContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_POST_ORDER_ATTRIBUTES, isPagesContentApiRestrictedKey);
+}
+function rejectNewslettersContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_NEWSLETTER_ORDER_ATTRIBUTES, isNewslettersContentApiRestrictedKey);
+}

package/core/server/api/endpoints/utils/public-cache-keys.js

@@ -27,6 +27,9 @@ function generateAuthData(frame) {
     const member = frame.options?.context?.member;
     if (member) {
         return {
+            // Transistor embeds contain the individual member UUID. Use null for
+            // UUID-less shims so they also avoid old entitlement-only cache entries.
+            uuid: member.uuid ?? null,
             free: member.status === 'free',
             tiers: member.products?.map((product) => product.slug).sort(),
         };

package/core/server/api/endpoints/utils/serializers/input/authors.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:
 const url = require('./utils/url');
 const slugFilterOrder = require('./utils/slug-filter-order');
 const utils = require('../../index');
+const { rejectAuthorsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
   if (!frame.options.order && frame.options.filter) {
@@ -20,6 +21,7 @@ module.exports = {
     url.forceUrlColumns(frame, 'authors');
 
     if (utils.isContentAPI(frame)) {
+      frame.options.order = rejectAuthorsRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
     }
   },

package/core/server/api/endpoints/utils/serializers/input/members.js

@@ -1,6 +1,8 @@
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:members');
 const mapNQLKeyValues = require('@tryghost/nql').utils.mapKeyValues;
+const { chainTransformers } = require('@tryghost/mongo-utils');
+const { validateAdminApiBulkFilterTransformer } = require('../../api-filter-utils');
 
 function defaultRelations(frame) {
   if (frame.options.withRelated) {
@@ -16,7 +18,7 @@ function defaultRelations(frame) {
 
 // @TODO: move this into the member repository in members-api
 function mapSubscribedFlagToNewsletterRelation(frame) {
-  frame.options.mongoTransformer = mapNQLKeyValues({
+  const transformer = mapNQLKeyValues({
     key: {
       from: 'subscribed',
       to: 'newsletters.status',
@@ -32,20 +34,27 @@ function mapSubscribedFlagToNewsletterRelation(frame) {
       },
     ],
   });
+
+  frame.options.mongoTransformer = frame.options.mongoTransformer
+    ? chainTransformers(frame.options.mongoTransformer, transformer)
+    : transformer;
+}
+
+function validateBulkFilter(frame) {
+  frame.options.mongoTransformer = frame.options.mongoTransformer
+    ? chainTransformers(validateAdminApiBulkFilterTransformer, frame.options.mongoTransformer)
+    : validateAdminApiBulkFilterTransformer;
 }
 
-// Values are not a member relation — they're stored per field type and read by
-// the custom fields service — so `include=custom_fields` must not reach the model
-// layer as something to eager-load. Lift it out and leave a flag browse can act on.
-function liftCustomFieldsInclude(frame) {
-  if (!frame.options.withRelated.includes('custom_fields')) {
+function liftMetafieldsInclude(frame) {
+  if (!frame.options.withRelated.includes('metafields')) {
     return;
   }
 
   frame.options.withRelated = frame.options.withRelated.filter(
-    (relation) => relation !== 'custom_fields',
+    (relation) => relation !== 'metafields',
   );
-  frame.options.includeCustomFields = true;
+  frame.options.includeMetafields = true;
 }
 
 module.exports = {
@@ -54,7 +63,7 @@ module.exports = {
       return;
     }
 
-    liftCustomFieldsInclude(frame);
+    liftMetafieldsInclude(frame);
 
     frame.options.withRelated = frame.options.withRelated.map((relation) => {
       if (relation === 'tiers') {
@@ -128,11 +137,13 @@ module.exports = {
 
   bulkEdit(apiConfig, frame) {
     debug('bulkEdit');
+    validateBulkFilter(frame);
     mapSubscribedFlagToNewsletterRelation(frame);
   },
 
   bulkDestroy(apiConfig, frame) {
     debug('bulkDestroy');
+    validateBulkFilter(frame);
     mapSubscribedFlagToNewsletterRelation(frame);
   },
 };

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -9,6 +9,7 @@ const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
 const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
+const { rejectPagesContentApiRestrictedOrderFields } = require('../../api-filter-utils');
 
 const messages = {
   failedHtmlToLexical: 'Failed to convert HTML to Lexical',
@@ -137,6 +138,7 @@ module.exports = {
       removeSourceFormats(frame); // remove from the format field
       selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options
 
+      frame.options.order = rejectPagesContentApiRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
       forceVisibilityColumn(frame);
       url.forceUrlRelations(frame, 'pages');

package/core/server/api/endpoints/utils/serializers/input/posts.js

@@ -9,6 +9,7 @@ const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
 const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
+const { rejectPostsContentApiRestrictedOrderFields } = require('../../api-filter-utils');
 
 const messages = {
   failedHtmlToLexical: 'Failed to convert HTML to Lexical',
@@ -172,6 +173,7 @@ module.exports = {
       removeSourceFormats(frame); // remove from the format field
       selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options
 
+      frame.options.order = rejectPostsContentApiRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
       forceVisibilityColumn(frame);
       mapWithRelated(frame);

package/core/server/api/endpoints/utils/serializers/input/tags.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:
 const url = require('./utils/url');
 const slugFilterOrder = require('./utils/slug-filter-order');
 const utils = require('../../index');
+const { rejectTagsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
   let defaultOrder = 'name asc';
@@ -22,6 +23,7 @@ module.exports = {
     url.forceUrlColumns(frame, 'tags');
 
     if (utils.isContentAPI(frame)) {
+      frame.options.order = rejectTagsRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
     }
   },

package/core/server/api/endpoints/utils/serializers/output/emails.js

@@ -1,7 +1,14 @@
 const batchMapper = require('./mappers/email-batches');
 const failureMapper = require('./mappers/email-failures');
+const {
+  toEmailStatusesResponse,
+} = require('../../../../../services/email-service/sending-status-serializers');
 
 module.exports = {
+  sendingStatus(response, apiConfig, frame) {
+    frame.response = toEmailStatusesResponse.parse(response);
+  },
+
   browseBatches(response, apiConfig, frame) {
     frame.response = {};
 

package/core/server/api/endpoints/utils/serializers/output/index.js

@@ -20,6 +20,10 @@ module.exports = {
     return require('./member-commenting');
   },
 
+  get members_account() {
+    return require('./members-account');
+  },
+
   get authentication() {
     return require('./authentication');
   },
@@ -76,8 +80,8 @@ module.exports = {
     return require('./members');
   },
 
-  get members_custom_fields() {
-    return require('./member-custom-fields');
+  get members_metafields() {
+    return require('./member-metafields');
   },
 
   get tiers() {

package/core/server/api/endpoints/utils/serializers/output/member-metafields.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const serializers_1 = require("../../../../../services/members-metafields/serializers");
+const serializeOne = (field, _apiConfig, frame) => {
+    frame.response = serializers_1.toMetafieldsResponse.parse([field]);
+};
+const serializeMany = (fields, _apiConfig, frame) => {
+    frame.response = serializers_1.toMetafieldsResponse.parse(fields);
+};
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
+module.exports = {
+    browse: serializeMany,
+    read: serializeOne,
+    add: serializeMany,
+    reorder: serializeMany,
+    edit: serializeOne,
+};

package/core/server/api/endpoints/utils/serializers/output/members-account.js

@@ -0,0 +1,19 @@
+"use strict";
+const { formattedMemberResponse } = require('../../../../../services/members/utils');
+/**
+ * A member's own record, as this API has always written one down.
+ *
+ * The projection itself is unchanged and still lives beside the other member
+ * formatting; what changes is that it is now reached the way every other
+ * serializer is, by this endpoint's `docName`, rather than being called by hand
+ * from a request handler.
+ */
+const serialize = (member, _apiConfig, frame) => {
+    frame.response = formattedMemberResponse(member);
+};
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
+module.exports = {
+    read: serialize,
+    update: serialize,
+};

package/core/server/api/endpoints/utils/serializers/output/members-csv-transform.js

@@ -14,7 +14,7 @@ const { toExportCsvRow } = require('../../../../../services/members/import-expor
  * @returns {Transform} Transform stream that converts objects to CSV
  */
 function createCSVTransform() {
-  // Locked in from the first row rather than declared up front: custom fields
+  // Locked in from the first row rather than declared up front: metafields
   // add a column per site, so the column set isn't known until a row arrives.
   // Every row carries the same keys, so the first is representative.
   let fields = null;

package/core/server/api/endpoints/utils/serializers/output/members.js

@@ -131,10 +131,8 @@ function serializeMember(member, options) {
     serialized.tiers = json.products;
   }
 
-  // Present on a read whenever the flag is on; absent otherwise, and absent on
-  // browse. An empty object is a member with no values set.
-  if (json.custom_fields) {
-    serialized.custom_fields = json.custom_fields;
+  if (json.metafields) {
+    serialized.metafields = json.metafields;
   }
 
   serialized.current_subscription = json.current_subscription || null;

package/core/server/api/endpoints/utils/serializers/output/tiers.js

@@ -20,7 +20,7 @@ module.exports = {
 function paginatedTiers(page, _apiConfig, frame) {
   return {
     tiers: page.data.map((model) => {
-      return serializeTier(model, frame.options);
+      return serializeTier(model, frame.options, page.requirements);
     }),
     meta: page.meta,
   };
@@ -45,7 +45,7 @@ function singleTier(model, _apiConfig, frame) {
  *
  * @returns {SerializedTier}
  */
-function serializeTier(tier, options) {
+function serializeTier(tier, options, requirements = null) {
   const json = tier.toJSON(options);
 
   const serialized = {
@@ -70,6 +70,14 @@ function serializeTier(tier, options) {
     serialized.benefits = null;
   }
 
+  // Only the payload that was asked for these carries them, so a response that did not
+  // look them up says nothing rather than saying every tier asks for nothing. Where they
+  // were looked up, every tier carries the key and an empty one means it asks for
+  // nothing.
+  if (requirements) {
+    serialized.requirements = requirements.get(json.id) ?? {};
+  }
+
   if (serialized.type === 'free') {
     delete serialized.currency;
     delete serialized.monthly_price;

package/core/server/api/endpoints/utils/serializers/output/users.js

@@ -6,16 +6,6 @@ const messages = {
 };
 
 module.exports = {
-  destroy(filename, apiConfig, frame) {
-    debug('destroy');
-
-    frame.response = {
-      meta: {
-        filename: filename,
-      },
-    };
-  },
-
   changePassword(models, apiConfig, frame) {
     debug('changePassword');