ghost 6.61.0 → 6.63.0

package/core/server/data/tinybird/pipes/mv_hits.pipe

@@ -2,19 +2,23 @@ TOKEN "axis" READ
 
 NODE mv_hits_0
 SQL >
-
-    SELECT timestamp,
+    SELECT
+        timestamp,
         inserted_at,
         -- payload.meta.received_timestamp may be missing or null
-        -- Nullable fields incur performance penalty in clickhouse, so we default to zero (unix epoch) instead of null.
-        parseDateTime64BestEffortOrZero(JSONExtractString(payload, 'meta', 'received_timestamp'), 3) as received_at,
+        -- Nullable fields incur performance penalty in clickhouse, so we default to zero (unix epoch)
+        -- instead of null.
+        parseDateTime64BestEffortOrZero(
+            JSONExtractString(payload, 'meta', 'received_timestamp'), 3
+        ) as received_at,
         action,
         version,
         coalesce(session_id, '0') as session_id,
         JSONExtractString(payload, 'locale') as locale,
         JSONExtractString(payload, 'location') as location,
         case
-            when JSONExtractString(payload, 'referrerSource') = '' then JSONExtractString(payload, 'meta', 'referrerSource')
+            when JSONExtractString(payload, 'referrerSource') = ''
+            then JSONExtractString(payload, 'meta', 'referrerSource')
             else JSONExtractString(payload, 'referrerSource')
         end as referrer,
         JSONExtractString(payload, 'pathname') as pathname,
@@ -35,11 +39,8 @@ SQL >
     FROM analytics_events
     where action = 'page_hit'
 
-
-
 NODE mv_hits_1
 SQL >
-
     SELECT
         site_uuid,
         timestamp,
@@ -47,8 +48,10 @@ SQL >
         inserted_at,
         case
             -- set to -1 if received_at is the unix epoch, or if received_at is after inserted_at
-            when toUnixTimestamp(received_at) = 0 then -1
-            when received_at > inserted_at then -1
+            when toUnixTimestamp(received_at) = 0
+            then -1
+            when received_at > inserted_at
+            then -1
             else date_diff('millisecond', received_at, inserted_at)
         end as ingestion_latency_ms,
         action,
@@ -61,58 +64,91 @@ SQL >
         gift_link,
         location,
         case
-            when referrer = '' then ''
+            when referrer = ''
+            then ''
             -- Social Media Consolidation
-            when referrer IN ('Facebook', 'www.facebook.com', 'l.facebook.com', 'lm.facebook.com', 'm.facebook.com', 'facebook') then 'Facebook'
-            when referrer IN ('Twitter', 'x.com', 'com.twitter.android') then 'Twitter'
-            when referrer IN ('go.bsky.app', 'bsky', 'bsky.app') then 'Bluesky'
-            when referrer IN ('Instagram', 'www.instagram.com') then 'Instagram'
-            when referrer IN ('LinkedIn', 'LINKEDIN_COMPANY') then 'LinkedIn'
-            when referrer IN ('l.threads.com') then 'Threads'
-
+            when
+                referrer IN (
+                    'Facebook',
+                    'www.facebook.com',
+                    'l.facebook.com',
+                    'lm.facebook.com',
+                    'm.facebook.com',
+                    'facebook'
+                )
+            then 'Facebook'
+            when referrer IN ('Twitter', 'x.com', 'com.twitter.android')
+            then 'Twitter'
+            when referrer IN ('go.bsky.app', 'bsky', 'bsky.app')
+            then 'Bluesky'
+            when referrer IN ('Instagram', 'www.instagram.com')
+            then 'Instagram'
+            when referrer IN ('LinkedIn', 'LINKEDIN_COMPANY')
+            then 'LinkedIn'
+            when referrer IN ('l.threads.com')
+            then 'Threads'
             -- Reddit Ecosystem
-            when referrer IN ('www.reddit.com', 'out.reddit.com', 'old.reddit.com', 'com.reddit.frontpage') then 'Reddit'
-
+            when
+                referrer
+                IN ('www.reddit.com', 'out.reddit.com', 'old.reddit.com', 'com.reddit.frontpage')
+            then 'Reddit'
             -- Search Engines (keep distinctions)
-            when referrer IN ('search.brave.com') then 'Brave Search'
-            when referrer IN ('www.ecosia.org') then 'Ecosia'
-
+            when referrer IN ('search.brave.com')
+            then 'Brave Search'
+            when referrer IN ('www.ecosia.org')
+            then 'Ecosia'
             -- Email Services
-            when referrer IN ('Gmail', 'com.google.android.gm', 'mail.google.com') then 'Gmail'
-            when referrer IN ('Outlook.com') then 'Outlook'
-            when referrer IN ('Yahoo!', 'www.yahoo.com', 'Yahoo! Mail', 'r.search.yahoo.com') then 'Yahoo!'
-            when referrer IN ('AOL Mail') then 'AOL Mail'
-
+            when referrer IN ('Gmail', 'com.google.android.gm', 'mail.google.com')
+            then 'Gmail'
+            when referrer IN ('Outlook.com')
+            then 'Outlook'
+            when referrer IN ('Yahoo!', 'www.yahoo.com', 'Yahoo! Mail', 'r.search.yahoo.com')
+            then 'Yahoo!'
+            when referrer IN ('AOL Mail')
+            then 'AOL Mail'
             -- Content Platforms
-            when referrer IN ('flipboard', 'flipboard.com', 'flipboard.app') then 'Flipboard'
-            when referrer IN ('substack', 'substack.com') then 'Substack'
-            when referrer IN ('Ghost.org', 'ghost.org') then 'Ghost'
-            when referrer IN ('buffer') then 'Buffer'
-            when referrer IN ('Taboola') then 'Taboola'
-            when referrer IN ('AppNexus') then 'AppNexus'
-
+            when referrer IN ('flipboard', 'flipboard.com', 'flipboard.app')
+            then 'Flipboard'
+            when referrer IN ('substack', 'substack.com')
+            then 'Substack'
+            when referrer IN ('Ghost.org', 'ghost.org')
+            then 'Ghost'
+            when referrer IN ('buffer')
+            then 'Buffer'
+            when referrer IN ('Taboola')
+            then 'Taboola'
+            when referrer IN ('AppNexus')
+            then 'AppNexus'
             -- Wikipedia
-            when referrer IN ('en.wikipedia.org', 'en.m.wikipedia.org') then 'Wikipedia'
-
+            when referrer IN ('en.wikipedia.org', 'en.m.wikipedia.org')
+            then 'Wikipedia'
             -- Mastodon Network
-            when referrer IN ('mastodon.social', 'mastodon.online', 'org.joinmastodon.android', 'phanpy.social', 'dev.phanpy.social') then 'Mastodon'
-
+            when
+                referrer IN (
+                    'mastodon.social',
+                    'mastodon.online',
+                    'org.joinmastodon.android',
+                    'phanpy.social',
+                    'dev.phanpy.social'
+                )
+            then 'Mastodon'
             -- News Aggregators
-            when referrer IN ('www.memeorandum.com', 'memeorandum.com') then 'Memeorandum'
-            when referrer IN ('ground.news') then 'Ground News'
-            when referrer IN ('apple.news') then 'Apple News'
-            when referrer IN ('www.smartnews.com') then 'SmartNews'
-
+            when referrer IN ('www.memeorandum.com', 'memeorandum.com')
+            then 'Memeorandum'
+            when referrer IN ('ground.news')
+            then 'Ground News'
+            when referrer IN ('apple.news')
+            then 'Apple News'
+            when referrer IN ('www.smartnews.com')
+            then 'SmartNews'
             -- Keep other sources as-is
-            when domainWithoutWWW(referrer) != '' then domainWithoutWWW(referrer)
+            when domainWithoutWWW(referrer) != ''
+            then domainWithoutWWW(referrer)
             else referrer
         end as source,
         pathname,
         href,
-        case  
-            when device = '' then 'unknown'  
-            else device  
-        end as device,
+        case when device = '' then 'unknown' else device end as device,
         case
             when match(user_agent, 'windows')
             then 'windows'
@@ -146,5 +182,5 @@ SQL >
         utm_content
     FROM mv_hits_0
 
-TYPE materialized
+TYPE MATERIALIZED
 DATASOURCE _mv_hits

package/core/server/lib/db-types/count.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbCount = void 0;
+const zod_1 = require("zod");
+const databaseCountInput = zod_1.z.union([zod_1.z.number(), zod_1.z.string().regex(/^\d+$/)]);
+/**
+ * A non-negative integer count, whichever database driver handed it back.
+ *
+ * Aggregate functions such as COUNT can return a decimal string from MySQL and
+ * a number from SQLite. Every read normalises to a safe integer so callers do
+ * not need to handle that driver difference themselves.
+ */
+exports.DbCount = zod_1.z.codec(databaseCountInput, zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER), {
+    decode: (stored) => (typeof stored === 'string' ? Number(stored) : stored),
+    encode: (value) => value,
+});

package/core/server/lib/image/image-size.js

@@ -31,6 +31,12 @@ class ImageSize {
       },
       response_timeout: this.config.get('times:getImageSizeTimeoutInMS') || 10000,
     };
+
+    // Coalesces concurrent getImageSizeFromUrl() calls for the same URL so we only
+    // ever issue one underlying request/read per URL at a time. A single post's
+    // coverImage/ogImage/twitterImage often resolve to the same feature_image URL
+    // and are looked up concurrently, which otherwise fans out into duplicate requests.
+    this.inFlightImageSizeLookups = new Map();
   }
 
   // processes the Buffer result of an image file using image-size
@@ -153,6 +159,24 @@ class ImageSize {
    * @returns {Promise<Object>} imageObject or error
    */
   getImageSizeFromUrl(imagePath) {
+    if (this.inFlightImageSizeLookups.has(imagePath)) {
+      return this.inFlightImageSizeLookups.get(imagePath);
+    }
+
+    const promise = this._getImageSizeFromUrl(imagePath).finally(() => {
+      this.inFlightImageSizeLookups.delete(imagePath);
+    });
+    this.inFlightImageSizeLookups.set(imagePath, promise);
+
+    return promise;
+  }
+
+  /**
+   * @description read image dimensions from URL, without in-flight deduplication
+   * @param {string} imagePath as URL
+   * @returns {Promise<Object>} imageObject or error
+   */
+  _getImageSizeFromUrl(imagePath) {
     if (this.storageUtils.isLocalImage(imagePath)) {
       // don't make a request for a locally stored image
       return this.getImageSizeFromStoragePath(imagePath);

package/core/server/lib/package-json/parse.js

@@ -37,7 +37,7 @@ async function parse(path) {
       message: tpl(messages.themeFileIsMalformed),
       context: path,
       err: parseError,
-      help: tpl(messages.willBeRequired, { url: 'https://ghost.org/docs/themes/' }),
+      help: tpl(messages.willBeRequired, { url: 'https://docs.ghost.org/themes/' }),
     });
   }
 
@@ -47,7 +47,7 @@ async function parse(path) {
     throw new errors.IncorrectUsageError({
       message: tpl(messages.nameOrVersionMissing),
       context: path,
-      help: tpl(messages.willBeRequired, { url: 'https://ghost.org/docs/themes/' }),
+      help: tpl(messages.willBeRequired, { url: 'https://docs.ghost.org/themes/' }),
     });
   }
 

package/core/server/lib/validate-password.js

@@ -1,131 +1,92 @@
-const _ = require('lodash');
-
-const validator = require('@tryghost/validator');
-
-const tpl = require('@tryghost/tpl');
-const settingsCache = require('../../shared/settings-cache');
-const urlUtils = require('../../shared/url-utils').default;
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validatePassword = validatePassword;
+const tpl_1 = __importDefault(require("@tryghost/tpl"));
+// @ts-expect-error This module lacks type definitions.
+const validator_1 = __importDefault(require("@tryghost/validator"));
+// @ts-expect-error This module lacks type definitions.
+const settings_cache_1 = __importDefault(require("../../shared/settings-cache"));
+const url_utils_1 = __importDefault(require("../../shared/url-utils"));
 const messages = {
-  passwordDoesNotComplyLength: 'Your password must be at least {minLength} characters long.',
-  passwordDoesNotComplySecurity: 'Sorry, you cannot use an insecure password.',
+    passwordTooShort: 'Your password must be at least {minLength} characters long.',
+    passwordTooLong: 'Your password is too long.',
+    passwordDoesNotComplySecurity: 'Sorry, you cannot use an insecure password.',
 };
-
 /**
  * Counts repeated characters in a string. When 50% or more characters are the same,
  * we return false and therefore invalidate the string.
- * @param {string} stringToTest The password string to check.
- * @return {boolean}
  */
-function characterOccurance(stringToTest) {
-  const chars = {};
-  let allowedOccurancy;
-  let valid = true;
-
-  stringToTest = _.toString(stringToTest);
-  allowedOccurancy = stringToTest.length / 2;
-
-  // Loop through string and accumulate character counts
-  _.each(stringToTest, function (char) {
-    if (!chars[char]) {
-      chars[char] = 1;
-    } else {
-      chars[char] += 1;
-    }
-  });
-
-  // check if any of the accumulated chars exceed the allowed occurancy
-  // of 50% of the words' length.
-  _.forIn(chars, function (charCount) {
-    if (charCount >= allowedOccurancy) {
-      valid = false;
+function characterOccurrence(stringToTest) {
+    const limit = stringToTest.length / 2;
+    const counts = new Map();
+    for (let i = 0; i < stringToTest.length; i++) {
+        const char = stringToTest[i];
+        const count = (counts.get(char) || 0) + 1;
+        if (count >= limit) {
+            return false;
+        }
+        counts.set(char, count);
     }
-  });
-
-  return valid;
+    return true;
 }
-
-/**
- * Validation against simple password rules
- * Returns false when validation fails and true for a valid password
- * @param {string} password The password string to check.
- * @param {string} email The users email address to validate agains password.
- * @param {string} [blogTitle] Optional blogTitle value, when blog title is not set yet, e. g. in setup process.
- * @return {Object} example for returned validation Object:
- * invalid password: `validationResult: {isValid: false, message: 'Sorry, you cannot use an insecure password.'}`
- * valid password: `validationResult: {isValid: true}`
- */
-function validatePassword(password, email, blogTitle) {
-  const validationResult = { isValid: true };
-  const disallowedPasswords = ['password', 'ghost', 'passw0rd'];
-  let blogUrl = urlUtils.urlFor('home', true);
-
-  const badPasswords = [
-    '1234567890',
-    'qwertyuiop',
-    'qwertzuiop',
-    'asdfghjkl;',
-    'abcdefghij',
-    '0987654321',
-    '1q2w3e4r5t',
-    '12345asdfg',
-  ];
-
-  blogTitle = blogTitle ? blogTitle : settingsCache.get('title');
-  blogUrl = blogUrl.replace(/^http(s?):\/\//, '');
-
-  // password must be longer than 10 characters
-  if (!validator.isLength(password, 10)) {
-    validationResult.isValid = false;
-    validationResult.message = tpl(messages.passwordDoesNotComplyLength, { minLength: 10 });
-
-    return validationResult;
-  }
-
-  // dissallow password from badPasswords list (e. g. '1234567890')
-  _.each(badPasswords, function (badPassword) {
-    if (badPassword === password) {
-      validationResult.isValid = false;
+/** Validation against simple password rules. */
+function validatePassword(password, email, siteTitle) {
+    // password cannot be longer than 256 code units, for performance
+    if (password.length > 256) {
+        return { isValid: false, message: (0, tpl_1.default)(messages.passwordTooLong) };
+    }
+    // password must be longer than 10 characters
+    if (!validator_1.default.isLength(password, 10)) {
+        return { isValid: false, message: (0, tpl_1.default)(messages.passwordTooShort, { minLength: 10 }) };
+    }
+    const invalidValidationResult = {
+        isValid: false,
+        message: (0, tpl_1.default)(messages.passwordDoesNotComplySecurity),
+    };
+    // password must not match with users' email
+    if (email && email.toLowerCase() === password.toLowerCase()) {
+        return invalidValidationResult;
+    }
+    // password must not match with site title
+    siteTitle = siteTitle || settings_cache_1.default.get('title');
+    if (siteTitle && siteTitle.toLowerCase() === password.toLowerCase()) {
+        return invalidValidationResult;
+    }
+    // password must not match with site URL (without protocol, with or without trailing slash)
+    let siteUrl = url_utils_1.default.urlFor('home', true);
+    siteUrl = siteUrl.replace(/^http(s?):\/\//, '');
+    if (siteUrl &&
+        (siteUrl.toLowerCase() === password.toLowerCase() ||
+            siteUrl.toLowerCase().replace(/\/$/, '') === password.toLowerCase())) {
+        return invalidValidationResult;
+    }
+    // disallow password from badPasswords list (e. g. '1234567890')
+    const badPasswords = [
+        '1234567890',
+        'qwertyuiop',
+        'qwertzuiop',
+        'asdfghjkl;',
+        'abcdefghij',
+        '0987654321',
+        '1q2w3e4r5t',
+        '12345asdfg',
+    ];
+    if (badPasswords.includes(password)) {
+        return invalidValidationResult;
+    }
+    // password must not contain the words 'ghost', 'password', or 'passw0rd'
+    const disallowedPasswords = ['password', 'ghost', 'passw0rd'];
+    for (const disallowedPassword of disallowedPasswords) {
+        if (password.toLowerCase().includes(disallowedPassword)) {
+            return invalidValidationResult;
+        }
     }
-  });
-
-  // password must not match with users' email
-  if (email && email.toLowerCase() === password.toLowerCase()) {
-    validationResult.isValid = false;
-  }
-
-  // password must not contain the words 'ghost', 'password', or 'passw0rd'
-  _.each(disallowedPasswords, function (disallowedPassword) {
-    if (password.toLowerCase().indexOf(disallowedPassword) >= 0) {
-      validationResult.isValid = false;
+    // dissallow passwords where 50% or more of characters are the same
+    if (!characterOccurrence(password)) {
+        return invalidValidationResult;
     }
-  });
-
-  // password must not match with blog title
-  if (blogTitle && blogTitle.toLowerCase() === password.toLowerCase()) {
-    validationResult.isValid = false;
-  }
-
-  // password must not match with blog URL (without protocol, with or without trailing slash)
-  if (
-    blogUrl &&
-    (blogUrl.toLowerCase() === password.toLowerCase() ||
-      blogUrl.toLowerCase().replace(/\/$/, '') === password.toLowerCase())
-  ) {
-    validationResult.isValid = false;
-  }
-
-  // dissallow passwords where 50% or more of characters are the same
-  if (!characterOccurance(password)) {
-    validationResult.isValid = false;
-  }
-
-  // Generic error message for the rules where no dedicated error massage is set
-  if (!validationResult.isValid && !validationResult.message) {
-    validationResult.message = tpl(messages.passwordDoesNotComplySecurity);
-  }
-
-  return validationResult;
+    return { isValid: true };
 }
-
-module.exports = validatePassword;

package/core/server/models/action.js

@@ -1,10 +1,10 @@
 const ghostBookshelf = require('./base');
 
-// Member custom fields are owned by a raw-knex service rather than the Bookshelf
+// Member metafields are owned by a raw-knex service rather than the Bookshelf
 // registry. Actions still need a read model for `include=resource` to recognise
 // their polymorphic resource type and load the current field definition.
-const MemberCustomFieldResource = ghostBookshelf.Model.extend({
-  tableName: 'members_custom_fields',
+const MemberMetafieldResource = ghostBookshelf.Model.extend({
+  tableName: 'members_metafields',
 });
 
 const Action = ghostBookshelf.Model.extend(
@@ -26,7 +26,7 @@ const Action = ghostBookshelf.Model.extend(
         candidates.push([User, 'security_action']);
       }
 
-      candidates.push([MemberCustomFieldResource, 'member_custom_field']);
+      candidates.push([MemberMetafieldResource, 'member_custom_field']);
 
       return candidates;
     },

package/core/server/models/base/plugins/filtered-collection.js

@@ -1,3 +1,6 @@
+const _ = require('lodash');
+const { hasPosts } = require('@tryghost/bookshelf-plugins');
+
 /**
  * @param {import('bookshelf')} Bookshelf
  */
@@ -17,6 +20,19 @@ module.exports = function (Bookshelf) {
         // Apply model-specific search behavior
         filteredCollection.applySearchQuery(options);
 
+        // Authors are hidden unless they have posts. Apply that constraint before
+        // fetchPage clones its count query so pagination cannot reveal hidden staff.
+        // Keep this author-specific: tags have separate, established count semantics.
+        if (filteredCollection.shouldHavePosts?.joinTable === 'posts_authors') {
+          filteredCollection.query(
+            hasPosts.addHasPostsWhere(
+              _.result(filteredCollection, 'tableName'),
+              filteredCollection.shouldHavePosts,
+            ),
+          );
+          filteredCollection.shouldHavePosts = null;
+        }
+
         return filteredCollection;
       },
 

package/core/server/models/member.js

@@ -3,12 +3,11 @@ const crypto = require('crypto');
 const _ = require('lodash');
 const { chainTransformers } = require('@tryghost/mongo-utils');
 const config = require('../../shared/config');
-const labs = require('../../shared/labs');
 const { MemberCommentingCodec } = require('../services/members/commenting');
 const {
-  CUSTOM_FIELDS_RELATION,
-  createCustomFieldsFilterTransformer,
-} = require('../services/members-custom-fields/filter');
+  METAFIELDS_RELATION,
+  createMetafieldsFilterTransformer,
+} = require('../services/members-metafields/filter');
 
 const DEEP_OFFSET_THRESHOLD = 1000;
 
@@ -191,19 +190,13 @@ const Member = ghostBookshelf.Model.extend(
       ];
     },
 
-    // Chain the custom-field filter transformer at this single choke point — the method
-    // every members query routes its filter through (list, CSV export, bulk edit/destroy,
-    // count, email send all reach it via findPage or getFilteredCollectionQuery) — so a
-    // saved `custom_fields.*` segment works the same everywhere without each call site
-    // wiring it. Runs only behind the flag and only when the filter names the relation; the
-    // transformer maps the public `key`/`value` grammar onto the leaf-row columns.
+    // Every members query routes its filter through this one method: list, CSV export, bulk
+    // edit and delete, counts and email sends all reach it via findPage or
+    // getFilteredCollectionQuery. Chaining the metafield filter transformer here covers them
+    // all without any call site wiring it.
     applyDefaultAndCustomFilters(options) {
-      if (
-        labs.isSet('membersCustomFields') &&
-        options.filter &&
-        options.filter.includes(`${CUSTOM_FIELDS_RELATION.tableNameAs}.`)
-      ) {
-        const transformer = createCustomFieldsFilterTransformer();
+      if (options.filter && options.filter.includes(`${METAFIELDS_RELATION.tableNameAs}.`)) {
+        const transformer = createMetafieldsFilterTransformer();
         options.mongoTransformer = options.mongoTransformer
           ? chainTransformers(options.mongoTransformer, transformer)
           : transformer;
@@ -213,11 +206,7 @@ const Member = ghostBookshelf.Model.extend(
 
     filterRelations() {
       return {
-        // Custom field values are filterable only behind the feature flag. Gating the
-        // relation here (rather than the whole model) means a `custom_fields.*` filter
-        // is simply an unknown relation when the flag is off, and the filter is
-        // rejected — nothing to special-case downstream.
-        ...(labs.isSet('membersCustomFields') ? { custom_fields: CUSTOM_FIELDS_RELATION } : {}),
+        metafields: METAFIELDS_RELATION,
         labels: {
           tableName: 'labels',
           type: 'manyToMany',

package/core/server/models/post.js

@@ -29,9 +29,9 @@ const messages = {
   notEnoughPermission: 'You do not have permission to perform this action',
   invalidNewsletter: "The newsletter parameter doesn't match any active newsletter.",
   invalidMobiledocStructure: 'Invalid mobiledoc structure.',
-  invalidMobiledocStructureHelp: 'https://ghost.org/docs/publishing/',
+  invalidMobiledocStructureHelp: 'https://docs.ghost.org/publishing/',
   invalidLexicalStructure: 'Invalid lexical structure.',
-  invalidLexicalStructureHelp: 'https://ghost.org/docs/publishing/',
+  invalidLexicalStructureHelp: 'https://docs.ghost.org/publishing/',
   emailOnlyWithoutNewsletter: 'Scheduling an email requires a newsletter reference.',
 };
 

package/core/server/models/relations/authors.js

@@ -149,7 +149,6 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
 
         // CASE: `posts.authors` was not requested, but fetched in specific cases (see top)
         if (
-          !this._originalOptions ||
           !this._originalOptions.withRelated ||
           this._originalOptions.withRelated.indexOf('authors') === -1
         ) {
@@ -157,10 +156,7 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
         }
 
         // If the current column settings allow it...
-        if (
-          !options.columns ||
-          (options.columns && options.columns.indexOf('primary_author') > -1)
-        ) {
+        if (!options.columns || options.columns.indexOf('primary_author') > -1) {
           // ... attach a computed property of primary_author which is the first author
           if (attrs.authors && attrs.authors.length) {
             attrs.primary_author = attrs.authors[0];
@@ -398,20 +394,10 @@ module.exports.extendModel = function extendModel(Post, Posts, ghostBookshelf) {
         }
 
         function isOwner() {
-          let isCorrectOwner = true;
-
           if (!unsafeAttrs.authors) {
             return false;
           }
-
-          if (unsafeAttrs.authors) {
-            isCorrectOwner =
-              isCorrectOwner &&
-              unsafeAttrs.authors.length &&
-              unsafeAttrs.authors[0].id === context.user;
-          }
-
-          return isCorrectOwner;
+          return unsafeAttrs.authors.length && unsafeAttrs.authors[0].id === context.user;
         }
 
         function isPrimaryAuthor() {