ghost 6.61.0 → 6.63.0

package/core/server/services/members/members-api/controllers/member-controller.js

@@ -146,6 +146,17 @@ module.exports = class MemberController {
 
       if (tierId && cadence) {
         const tier = await this._tiersService.api.read(tierId);
+
+        if (!tier) {
+          res.writeHead(404);
+          return res.end('Not Found.');
+        }
+
+        if (tier.status !== 'active') {
+          res.writeHead(403);
+          return res.end('Tier is archived.');
+        }
+
         const stripePrice = await this._paymentsService.getPriceForTierCadence(tier, cadence);
 
         await this._memberRepository.updateSubscription({

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -140,7 +140,6 @@ module.exports = class RouterController {
    * @param {any} deps.offersAPI
    * @param {any} deps.paymentsService
    * @param {any} deps.memberRepository
-   * @param {any} deps.StripePrice
    * @param {() => boolean} deps.allowSelfSignup
    * @param {any} deps.magicLinkService
    * @param {import('../../../stripe/stripe-api')} deps.stripeAPIService
@@ -160,7 +159,6 @@ module.exports = class RouterController {
     paymentsService,
     tiersService,
     memberRepository,
-    StripePrice,
     allowSelfSignup,
     magicLinkService,
     stripeAPIService,
@@ -180,7 +178,6 @@ module.exports = class RouterController {
     this._paymentsService = paymentsService;
     this._tiersService = tiersService;
     this._memberRepository = memberRepository;
-    this._StripePrice = StripePrice;
     this._allowSelfSignup = allowSelfSignup;
     this._magicLinkService = magicLinkService;
     this._stripeAPIService = stripeAPIService;
@@ -602,11 +599,11 @@ module.exports = class RouterController {
     if (member) {
       options.successUrl = this._generateSuccessUrl(options.successUrl, tier.welcomePageURL);
 
-      const restrictCheckout = member.get('status') === 'paid';
+      // Existing paid members must manage their subscription instead of creating another.
+      // Other members must prove ownership of the provided email before checking out.
+      const restrictCheckout = member.get('status') === 'paid' || !options.isAuthenticated;
 
       if (restrictCheckout) {
-        // This member is already subscribed to a paid tier
-        // We don't want to create a duplicate subscription
         if (!options.isAuthenticated && options.email) {
           try {
             await this._sendEmailWithMagicLink({ email: options.email, requestedType: 'signin' });

package/core/server/services/members/members-api/members-api.js

@@ -7,6 +7,8 @@ const PaymentsService = require('./services/payments-service');
 const TokenService = require('./services/token-service');
 const GeolocationService = require('./services/geolocation-service');
 const MemberBREADService = require('./services/member-bread-service');
+const metafields = require('../../members-metafields');
+const { MemberAccountService } = require('../account-service');
 const MemberRepository = require('./repositories/member-repository');
 const NextPaymentCalculator = require('./services/next-payment-calculator');
 
@@ -41,7 +43,6 @@ module.exports = function MembersAPI({
     MemberProductEvent,
     MemberEmailChangeEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberLinkClickEvent,
     EmailSpamComplaintEvent,
     Offer,
@@ -71,7 +72,8 @@ module.exports = function MembersAPI({
   commentsService,
   emailAddressService,
   giftService,
-  customFieldValues,
+  metafieldValues,
+  metafieldDefinitions,
 }) {
   const tokenService = new TokenService({
     privateKey,
@@ -119,7 +121,6 @@ module.exports = function MembersAPI({
     MemberStatusEvent,
     MemberLoginEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberLinkClickEvent,
     MemberFeedback,
     EmailSpamComplaintEvent,
@@ -147,7 +148,6 @@ module.exports = function MembersAPI({
         });
       },
     },
-    labsService,
     stripeService: stripeAPIService,
     memberAttributionService,
     emailSuppressionList,
@@ -155,7 +155,8 @@ module.exports = function MembersAPI({
     nextPaymentCalculator,
     commentsService,
     giftService,
-    customFieldValues,
+    metafieldValues,
+    metafieldDefinitions,
   });
 
   const geolocationService = new GeolocationService();
@@ -202,7 +203,6 @@ module.exports = function MembersAPI({
     paymentsService,
     tiersService,
     memberRepository,
-    StripePrice,
     allowSelfSignup,
     magicLinkService,
     stripeAPIService,
@@ -358,11 +358,27 @@ module.exports = function MembersAPI({
   }
 
   async function getMemberIdentityData(email) {
-    return memberBREADService.read({ email });
+    return memberBREADService.read({ email }, { metafieldsFor: null });
+  }
+
+  const account = new MemberAccountService({
+    memberBREADService,
+    members: users,
+    emailSuppressionList,
+    metafieldValues: metafields.values,
+  });
+
+  async function getMemberIdentity(transientId) {
+    if (!transientId) {
+      return null;
+    }
+
+    const member = await users.get({ transient_id: transientId });
+    return member ? { id: member.id, email: member.get('email') } : null;
   }
 
   async function getMemberIdentityDataFromTransientId(transientId) {
-    return memberBREADService.read({ transient_id: transientId });
+    return memberBREADService.read({ transient_id: transientId }, { metafieldsFor: null });
   }
 
   async function cycleTransientId(memberId) {
@@ -502,6 +518,7 @@ module.exports = function MembersAPI({
     getMemberIdentityToken,
     getMemberEntitlementToken,
     getMemberIdentityDataFromTransientId,
+    getMemberIdentity,
     getMemberIdentityData,
     cycleTransientId,
     setMemberGeolocationFromIp,
@@ -510,6 +527,7 @@ module.exports = function MembersAPI({
     sendEmailWithMagicLink,
     getMagicLink,
     members: users,
+    account,
     memberBREADService,
     events: eventRepository,
     productRepository,

package/core/server/services/members/members-api/repositories/event-repository.js

@@ -34,13 +34,11 @@ module.exports = class EventRepository {
     MemberStatusEvent,
     MemberLoginEvent,
     MemberCreatedEvent,
-    SubscriptionCreatedEvent,
     MemberPaidSubscriptionEvent,
     MemberLinkClickEvent,
     MemberFeedback,
     EmailSpamComplaintEvent,
     Comment,
-    labsService,
     memberAttributionService,
     urlService,
     MemberEmailChangeEvent,
@@ -55,10 +53,8 @@ module.exports = class EventRepository {
     this._MemberLoginEvent = MemberLoginEvent;
     this._EmailRecipient = EmailRecipient;
     this._Comment = Comment;
-    this._labsService = labsService;
     this._urlService = urlService;
     this._MemberCreatedEvent = MemberCreatedEvent;
-    this._SubscriptionCreatedEvent = SubscriptionCreatedEvent;
     this._MemberLinkClickEvent = MemberLinkClickEvent;
     this._MemberFeedback = MemberFeedback;
     this._EmailSpamComplaintEvent = EmailSpamComplaintEvent;

package/core/server/services/members/members-api/repositories/member-repository.js

@@ -878,10 +878,10 @@ module.exports = class MemberRepository {
         (n) => n.attributes.status === 'archived',
       );
 
-      if (archivedNewsletters.length > 0) {
-        // if (!memberData.newsletters) {
-        //     memberData.newsletters = [];
-        // }
+      // bookshelf-relations only touches the join table when the key is present,
+      // so an update that does not set newsletters leaves them all attached and
+      // has nothing to preserve.
+      if (memberData.newsletters && archivedNewsletters.length > 0) {
         archivedNewsletters.forEach((n) => memberData.newsletters.push(n));
       }
     }

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -1,4 +1,5 @@
 const errors = require('@tryghost/errors');
+const { ADMIN } = require('../../../members-metafields');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
 const moment = require('moment');
@@ -7,20 +8,15 @@ const messages = {
   stripeNotConnected: 'Missing Stripe connection.',
   memberAlreadyExists: 'Member already exists.',
   memberNotFound: 'Member not found.',
-  customFieldsOnAdd:
+  metafieldsOnAdd:
     'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.',
-  customFieldsWithoutWriter:
+  metafieldsWithoutWriter:
     'Custom field values cannot be set by a request with no authenticated user or integration.',
 };
 
 // Stored in the action's `context.action_name`; Admin maps it to a display label.
 const CUSTOM_FIELDS_EDITED_ACTION = 'custom_fields_edited';
 
-/**
- * @typedef {object} ILabsService
- * @prop {(key: string) => boolean} isSet
- */
-
 /**
  * @typedef {object} IEmailService
  * @prop {(data: {email: string, requestedType: string}) => Promise<any>} sendEmailWithMagicLink
@@ -45,7 +41,6 @@ module.exports = class MemberBREADService {
    * @param {object} deps
    * @param {import('../repositories/member-repository')} deps.memberRepository
    * @param {import('../../../offers/application/offers-api')} deps.offersAPI
-   * @param {ILabsService} deps.labsService
    * @param {IEmailService} deps.emailService
    * @param {IStripeService} deps.stripeService
    * @param {import('../../../member-attribution/member-attribution-service')} deps.memberAttributionService
@@ -53,11 +48,11 @@ module.exports = class MemberBREADService {
    * @param {import('../../../settings-helpers/settings-helpers')} deps.settingsHelpers
    * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
    * @param {IGiftsModule} deps.giftService
-   * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
+   * @param {import('../../../members-metafields/values-service').MetafieldValuesService} deps.metafieldValues Required: boot builds it before the members service
+   * @param {import('../../../members-metafields/definitions-service').MetafieldDefinitionsService} deps.metafieldDefinitions Required: boot builds it before the members service
    */
   constructor({
     memberRepository,
-    labsService,
     emailService,
     stripeService,
     offersAPI,
@@ -67,14 +62,13 @@ module.exports = class MemberBREADService {
     nextPaymentCalculator,
     commentsService,
     giftService,
-    customFieldValues,
+    metafieldValues,
+    metafieldDefinitions,
   }) {
     this.offersAPI = offersAPI;
     /** @private */
     this.memberRepository = memberRepository;
     /** @private */
-    this.labsService = labsService;
-    /** @private */
     this.emailService = emailService;
     /** @private */
     this.stripeService = stripeService;
@@ -91,36 +85,30 @@ module.exports = class MemberBREADService {
     /** @private */
     this.giftService = giftService;
     /** @private */
-    this.customFieldValues = customFieldValues;
+    this.metafieldValues = metafieldValues;
+    /** @private */
+    this.metafieldDefinitions = metafieldDefinitions;
   }
 
   /**
-   * @private
-   * Custom field values keyed by member id, or `null` when the feature is off —
-   * the flag lives here, so callers just check the result: `null` means omit the
-   * `custom_fields` key entirely, keeping a pre-feature member payload identical.
-   *
-   * A read gets values on the flag alone, with no opt-in include: a member's
-   * custom fields are their own data, like labels and tiers, which a read
-   * already returns unasked. `include` is for things that are expensive or
-   * aggregate (email_recipients, counts), and one flat lookup on a read that
-   * already issues a dozen queries is neither. The flag, not an include, is what
-   * protects consumers that predate the feature — an include would outlive it
-   * and become permanent API surface.
+   * Metafields are extra fields a publisher can define on member records, such as a shoe
+   * size or a delivery address. Their values live in their own table, so they are fetched
+   * here rather than loaded alongside the member.
    *
-   * Browse is the opposite — opt-in via `include=custom_fields`, exactly how
-   * `products`/`tiers` already behave: a read always carries them, a list only
-   * when asked. Read and browse must stay format-identical, so a browse that
-   * asks gets the same key a read gives unasked.
+   * Returns null when the site has defined no fields, which tells the caller to leave the
+   * `metafields` key off the member payload rather than send an empty object: a key added to
+   * an API response cannot be withdrawn without breaking whoever started reading it, and
+   * most sites have never defined a field, so those sites keep the payload they had before
+   * this feature existed.
    * @param {string[]} memberIds
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
-  async fetchCustomFieldValues(memberIds) {
-    if (!this.labsService.isSet('membersCustomFields')) {
+  async fetchMetafieldValues(memberIds, audience) {
+    if (!(await this.metafieldDefinitions.hasAnyActive())) {
       return null;
     }
 
-    return this.customFieldValues.getValuesForMembers(memberIds);
+    return this.metafieldValues.getValuesForMembers(memberIds, audience);
   }
 
   /**
@@ -394,7 +382,18 @@ module.exports = class MemberBREADService {
     }
   }
 
-  async read(data, options = {}) {
+  /**
+   * @param {object} data
+   * @param {object} [options]
+   * @param {import('../../../members-metafields').Audience | null} [options.metafieldsFor]
+   *   Who the extra fields a publisher defined are being read for, or null to leave them
+   *   off entirely. Null is not the same as "nobody may see them": it means this caller
+   *   never shows them, so fetching them is two database queries whose results are thrown
+   *   away. Ghost identifies a signed-in reader on every page view of a themed site
+   *   through this method, and that caller renders a member through a fixed list of
+   *   fields which has never included these.
+   */
+  async read(data, { metafieldsFor = ADMIN, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -455,43 +454,25 @@ module.exports = class MemberBREADService {
     const unsubscribeUrl = this.settingsHelpers.createUnsubscribeUrl(member.uuid);
     member.unsubscribe_url = unsubscribeUrl;
 
-    const customFields = await this.fetchCustomFieldValues([member.id]);
-    if (customFields) {
-      member.custom_fields = customFields.get(member.id) ?? {};
+    if (metafieldsFor) {
+      const metafields = await this.fetchMetafieldValues([member.id], metafieldsFor);
+      if (metafields) {
+        member.metafields = metafields.get(member.id) ?? {};
+      }
     }
 
     return member;
   }
 
-  /**
-   * @private
-   * The write-side flag gate, paired with `fetchCustomFieldValues` on the read
-   * side. The schema declares `custom_fields` for every site, so the key arrives
-   * whether or not the feature is on and this is what decides it goes no further.
-   * @param {object} data
-   */
-  dropCustomFieldsWhenDisabled(data) {
-    if (!this.labsService.isSet('membersCustomFields')) {
-      delete data.custom_fields;
-    }
-  }
-
   async add(data, options) {
-    this.dropCustomFieldsWhenDisabled(data);
-
-    // Values cannot be set on create, only on a subsequent edit. `namesValues`
-    // both judges the body and rejects a malformed one, so a body refused here is
-    // refused on edit for the same reason.
-    if (this.customFieldValues.namesValues(data.custom_fields)) {
+    if (this.metafieldValues.namesValues(this.metafieldValues.unwrapWire(data.metafields))) {
       throw new errors.ValidationError({
-        message: tpl(messages.customFieldsOnAdd),
-        property: 'custom_fields',
+        message: tpl(messages.metafieldsOnAdd),
+        property: 'metafields',
       });
     }
 
-    // Not a member column, so it comes off before the repository sees it. Only
-    // an absent key or one naming no values gets this far.
-    delete data.custom_fields;
+    delete data.metafields;
 
     if (!this.stripeService.configured && (data.comped || data.stripe_customer_id)) {
       const property = data.comped ? 'comped' : 'stripe_customer_id';
@@ -587,22 +568,16 @@ module.exports = class MemberBREADService {
   async edit(data, options) {
     delete data.last_seen_at;
 
-    this.dropCustomFieldsWhenDisabled(data);
-
-    // Values live in their own table, so they come off the member data before
-    // the repository sees it — `custom_fields` is not a member column. The gate
-    // above has already dropped it when the feature is off, so by this point its
-    // presence is the signal to write.
-    const customFields = data.custom_fields;
-    const writeCustomFields = customFields !== undefined;
-    delete data.custom_fields;
+    const metafields = this.metafieldValues.unwrapWire(data.metafields);
+    const writeMetafields = metafields !== undefined;
+    delete data.metafields;
 
     // Plan (which validates) before the member is touched, so a bad value 422s
     // here rather than after the member edit has been applied — and keep the
     // plan to apply once below, so the values aren't resolved and validated
     // twice.
-    const plannedCustomFields = writeCustomFields
-      ? await this.customFieldValues.planWrite(customFields)
+    const plannedMetafields = writeMetafields
+      ? await this.metafieldValues.planWrite(metafields, ADMIN)
       : null;
 
     let model;
@@ -655,7 +630,7 @@ module.exports = class MemberBREADService {
       }
     }
 
-    if (plannedCustomFields) {
+    if (plannedMetafields) {
       // Every value reaching here was typed into the Admin API, so the writer is
       // whoever made the request — the same pair the action log records, so the two
       // agree about who did it rather than one saying only that it was "admin".
@@ -666,15 +641,15 @@ module.exports = class MemberBREADService {
       const context = options.context || {};
       if (!context.integration && !context.user) {
         throw new errors.IncorrectUsageError({
-          message: tpl(messages.customFieldsWithoutWriter),
+          message: tpl(messages.metafieldsWithoutWriter),
         });
       }
       const writtenBy = context.integration
         ? { type: 'integration', id: context.integration.id }
         : { type: 'user', id: context.user };
-      await this.customFieldValues.applyWrite(model.id, plannedCustomFields, { writtenBy });
+      await this.metafieldValues.applyWrite(model.id, plannedMetafields, { writtenBy });
 
-      // Custom fields aren't a member column or relation, so an edit touching
+      // Metafields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.
       // Declare the change into `_changed` — as bookshelf-relations does for a
       // labels change — so the member's edited lifecycle fires its usual signals
@@ -684,13 +659,13 @@ module.exports = class MemberBREADService {
       // populated `_changed` and fired the edited event during update(), so
       // re-firing would duplicate it (this also covers a full PUT that resends
       // unchanged member fields — `_changed` stays empty there too). That
-      // combined event omits `custom_fields` from `_changed`, which nothing
-      // reads: custom fields aren't in the webhook payload (they're injected
+      // combined event omits `metafields` from `_changed`, which nothing
+      // reads: metafields aren't in the webhook payload (they're injected
       // into read/browse responses, not the model), and `_changed` only gates
       // whether the event fires.
       const memberUnchanged = !model._changed || Object.keys(model._changed).length === 0;
-      if (memberUnchanged && plannedCustomFields.length > 0) {
-        model._changed = { custom_fields: true };
+      if (memberUnchanged && plannedMetafields.length > 0) {
+        model._changed = { metafields: true };
         // A mixed edit keeps the generic label on purpose: relabelling the
         // one action a member change already fired would bury that change
         // behind this one.
@@ -819,8 +794,11 @@ module.exports = class MemberBREADService {
 
     // One query for the whole page, not one per member. `null` when the flag
     // is off or the caller didn't ask — the same truthiness guard read uses.
-    const customFieldsByMember = options.includeCustomFields
-      ? await this.fetchCustomFieldValues(page.data.map((model) => model.id))
+    const metafieldsByMember = options.includeMetafields
+      ? await this.fetchMetafieldValues(
+          page.data.map((model) => model.id),
+          ADMIN,
+        )
       : null;
 
     const data = page.data.map((model, index) => {
@@ -832,8 +810,8 @@ module.exports = class MemberBREADService {
       if (!originalWithRelated.includes('products')) {
         delete member.products;
       }
-      if (customFieldsByMember) {
-        member.custom_fields = customFieldsByMember.get(model.id) ?? {};
+      if (metafieldsByMember) {
+        member.metafields = metafieldsByMember.get(model.id) ?? {};
       }
       member.email_suppression = {
         suppressed: bulkSuppressionData[index].suppressed || !!model.get('email_disabled'),

package/core/server/services/members/members-api/services/payments-service.js

@@ -161,7 +161,7 @@ class PaymentsService {
    */
   async getCheckoutConfigForTier(tier) {
     const checkoutConfig = this.tiersService?.checkout;
-    if (!this.labsService?.isSet('membersCustomFields') || !checkoutConfig) {
+    if (!this.labsService?.isSet('stripeCheckoutCollection') || !checkoutConfig) {
       return undefined;
     }
     try {

package/core/server/services/members/members-ssr.js

@@ -307,6 +307,24 @@ class MembersSSR {
    *
    * @returns {Promise<Member>}
    */
+  /**
+   * Who this session belongs to, without loading them.
+   *
+   * The counterpart to `getMemberDataFromSession`, for callers that need to know a
+   * member is there rather than what is on their record.
+   *
+   * @method getMemberIdentityFromSession
+   * @param {Request} req
+   * @param {Response} res
+   *
+   * @returns {Promise<{id: string, email: string} | null>}
+   */
+  async getMemberIdentityFromSession(req, res) {
+    const transientId = this._getSessionCookies(req, res);
+    const api = await this._getMembersApi();
+    return api.getMemberIdentity(transientId);
+  }
+
   async getMemberDataFromSession(req, res) {
     const transientId = this._getSessionCookies(req, res);
     const member = await this._getMemberIdentityDataFromTransientId(transientId);