ghost 6.61.0 → 6.63.0

package/core/server/services/tier-checkout-config/serializers.js

@@ -1,14 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toCheckoutConfigResponse = exports.CheckoutConfigInput = void 0;
+exports.requirementsByTier = requirementsByTier;
 const zod_1 = require("zod");
-const field_ports_1 = require("../stripe/services/checkout/field-ports");
-const allowed_countries_1 = require("../stripe/services/checkout/allowed-countries");
+const checkout_1 = require("@tryghost/checkout");
 const models_1 = require("./models");
 // Every country Stripe will take, sent at once, was measured as accepted — so the only
 // ceiling is the list itself, and a request naming more than there are countries is naming
-// something twice.
-const MAX_ALLOWED_COUNTRIES = allowed_countries_1.STRIPE_ALLOWED_COUNTRIES.length;
+// something twice. A request that means all of them omits the list instead.
+const MAX_ALLOWED_COUNTRIES = checkout_1.STRIPE_ALLOWED_COUNTRIES.length;
 const QuestionInput = zod_1.z.object({
     key: zod_1.z.string().min(1, { error: 'Every checkout question needs a custom field key.' }),
     label: zod_1.z.string().trim().min(1).nullish(),
@@ -21,7 +21,7 @@ const CountryCode = zod_1.z
     .trim()
     .regex(/^[A-Za-z]{2}$/, { error: 'Enter a 2-letter country code, like US.' })
     .toUpperCase()
-    .refine(allowed_countries_1.isStripeAllowedCountry, {
+    .refine(checkout_1.isStripeAllowedCountry, {
     error: 'Stripe will not ship to that country, so a checkout cannot offer it.',
 });
 /**
@@ -37,8 +37,8 @@ const Destination = zod_1.z.strictObject({ custom_field_key: CustomFieldKey }, {
 exports.CheckoutConfigInput = zod_1.z.strictObject({
     custom_fields: zod_1.z
         .array(QuestionInput)
-        .max(field_ports_1.MAX_CHECKOUT_CUSTOM_FIELDS, {
-        error: `A checkout can ask at most ${field_ports_1.MAX_CHECKOUT_CUSTOM_FIELDS} questions.`,
+        .max(checkout_1.MAX_CHECKOUT_CUSTOM_FIELDS, {
+        error: `A checkout can ask at most ${checkout_1.MAX_CHECKOUT_CUSTOM_FIELDS} questions.`,
     })
         .refine((questions) => new Set(questions.map((question) => question.key)).size === questions.length, { error: 'This checkout already asks for that field.' })
         .optional(),
@@ -47,10 +47,14 @@ exports.CheckoutConfigInput = zod_1.z.strictObject({
         zod_1.z.strictObject({ collect: zod_1.z.literal(false) }),
         zod_1.z.strictObject({
             collect: zod_1.z.literal(true),
+            // Absent means everywhere the processor ships. Empty is refused rather than
+            // read as everywhere: a publisher who cleared the list said something, and it
+            // was not "deliver worldwide".
             allowed_countries: zod_1.z
                 .array(CountryCode, { error: 'Choose at least one country you deliver to.' })
                 .min(1, { error: 'Choose at least one country you deliver to.' })
-                .max(MAX_ALLOWED_COUNTRIES),
+                .max(MAX_ALLOWED_COUNTRIES)
+                .optional(),
             name: Destination,
             address: Destination,
         }),
@@ -75,7 +79,8 @@ const CollectionResource = zod_1.z.object({
 });
 const ShippingResource = zod_1.z.object({
     collect: zod_1.z.literal(true),
-    allowed_countries: zod_1.z.array(zod_1.z.string()),
+    /** Absent means everywhere, the same way it does on the way in. */
+    allowed_countries: zod_1.z.array(zod_1.z.string()).optional(),
     name: zod_1.z.object({ custom_field_key: zod_1.z.string() }),
     address: zod_1.z.object({ custom_field_key: zod_1.z.string() }),
 });
@@ -102,7 +107,9 @@ exports.toCheckoutConfigResponse = zod_1.z
             ? {
                 shipping: {
                     collect: true,
-                    allowed_countries: config.shipping.allowedCountries,
+                    ...(config.shipping.allowedCountries
+                        ? { allowed_countries: config.shipping.allowedCountries }
+                        : {}),
                     name: { custom_field_key: config.shipping.nameCustomFieldKey },
                     address: { custom_field_key: config.shipping.addressCustomFieldKey },
                 },
@@ -120,3 +127,59 @@ exports.toCheckoutConfigResponse = zod_1.z
     })),
 }))
     .pipe(CheckoutConfigResponse);
+/**
+ * What a tier asks a member for, as the tier payload carries it.
+ *
+ * The same rows as the publisher's resource above, minus everything about where a value
+ * lands. A member supplies a delivery address rather than a value for a named field, and
+ * which field holds it is the publisher's business; naming it here would invite a client
+ * to write there directly. The tax number goes too, because the processor keeps one
+ * against the customer it invoices and Ghost never stores it. So do the checkout
+ * questions, which a tier change does not draw.
+ *
+ * Not named for the collection, deliberately: a collection in this domain is a collected
+ * thing together with the field it lands in, and that second half is exactly the part
+ * this drops.
+ */
+const TierRequirements = zod_1.z.object({
+    /**
+     * A block appears only when the tier asks for that thing, and says so as well, the same
+     * way the publisher's resource does. Presence and the flag agree, so a client may read
+     * whichever it finds clearer.
+     *
+     * Neither says whether a thing may be skipped, because nothing here may be: everything
+     * a tier requires is required. Collection a member could decline is the change that
+     * would need a field of its own rather than a new reading of these two.
+     */
+    shipping: zod_1.z
+        .object({
+        collect: zod_1.z.literal(true),
+        /** Absent means everywhere the processor ships, the same as for a publisher. */
+        allowed_countries: zod_1.z.array(zod_1.z.string()).optional(),
+    })
+        .optional(),
+    phone: zod_1.z.object({ collect: zod_1.z.literal(true) }).optional(),
+});
+/**
+ * Keyed by tier, because the payload this joins onto is a list of tiers and a lookup is
+ * the only thing it needs. Tiers a publisher has never set up are absent, and a tier that
+ * collects only a tax number resolves to nothing asked.
+ */
+function requirementsByTier(configs) {
+    return new Map(configs.map((config) => [
+        config.tierId,
+        TierRequirements.parse({
+            ...(config.shipping
+                ? {
+                    shipping: {
+                        collect: true,
+                        ...(config.shipping.allowedCountries
+                            ? { allowed_countries: config.shipping.allowedCountries }
+                            : {}),
+                    },
+                }
+                : {}),
+            ...(config.phone ? { phone: { collect: true } } : {}),
+        }),
+    ]));
+}

package/core/server/services/tier-checkout-config/service.js

@@ -7,12 +7,11 @@ exports.TierCheckoutConfigService = void 0;
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
-const schema_1 = require("../members-custom-fields/schema");
-const field_ports_1 = require("../stripe/services/checkout/field-ports");
+const schema_1 = require("../members-metafields/schema");
+const checkout_1 = require("@tryghost/checkout");
 const codec_1 = require("./codec");
 const queries_1 = require("./queries");
 const models_1 = require("./models");
-const destinations_1 = require("./destinations");
 const serializers_1 = require("./serializers");
 /**
  * A request states its settings in named sections: one for shipping, one for phone. Each
@@ -26,8 +25,8 @@ const serializers_1 = require("./serializers");
  * save that the publisher believes they have turned off.
  */
 const BLOCK_PORTS = {
-    shipping: [field_ports_1.STRIPE_PORT.shippingName, field_ports_1.STRIPE_PORT.shippingAddress],
-    phone: [field_ports_1.STRIPE_PORT.phone],
+    shipping: [checkout_1.STRIPE_PORT.shippingName, checkout_1.STRIPE_PORT.shippingAddress],
+    phone: [checkout_1.STRIPE_PORT.phone],
 };
 class TierCheckoutConfigService {
     knex;
@@ -115,10 +114,10 @@ class TierCheckoutConfigService {
     async planCollection(stated) {
         const wanted = [];
         if (stated.shipping?.collect) {
-            wanted.push({ port: field_ports_1.STRIPE_PORT.shippingName, key: stated.shipping.name.custom_field_key }, { port: field_ports_1.STRIPE_PORT.shippingAddress, key: stated.shipping.address.custom_field_key });
+            wanted.push({ port: checkout_1.STRIPE_PORT.shippingName, key: stated.shipping.name.custom_field_key }, { port: checkout_1.STRIPE_PORT.shippingAddress, key: stated.shipping.address.custom_field_key });
         }
         if (stated.phone?.collect) {
-            wanted.push({ port: field_ports_1.STRIPE_PORT.phone, key: stated.phone.custom_field_key });
+            wanted.push({ port: checkout_1.STRIPE_PORT.phone, key: stated.phone.custom_field_key });
         }
         const bound = new Set(wanted.map(({ port }) => port));
         const clear = [];
@@ -129,7 +128,7 @@ class TierCheckoutConfigService {
         }
         const create = new Map();
         for (const { port, key } of wanted) {
-            const wants = destinations_1.PORT_FIELD[port];
+            const wants = checkout_1.PORT_FIELD[port];
             const existing = await this.fields.findByKey(key);
             if (existing) {
                 assertCollectableInto(port, existing, wants.type);
@@ -240,7 +239,9 @@ function assertCollectableInto(port, field, valueType) {
 }
 async function writeOptions(trx, productId, stated, now) {
     const all = zod_1.z.encode(codec_1.optionsCodec, {
-        shippingAllowedCountries: stated.shipping?.collect ? stated.shipping.allowed_countries : [],
+        shippingAllowedCountries: stated.shipping?.collect
+            ? (stated.shipping.allowed_countries ?? null)
+            : null,
         taxNumber: stated.tax_number?.collect ?? false,
     });
     // Only the columns this request spoke about are written, so two requests changing
@@ -262,7 +263,7 @@ async function writeOptions(trx, productId, stated, now) {
         .merge({ ...columns, updated_at: now });
 }
 async function assertQuestionsAskable(db, questions) {
-    const collides = questions.find((question) => (0, field_ports_1.isStripePort)(question.key));
+    const collides = questions.find((question) => (0, checkout_1.isStripePort)(question.key));
     if (collides) {
         throw new errors_1.default.ValidationError({
             message: `A field keyed ${collides.key} cannot be asked at checkout, because that is what this checkout calls something it collects for itself.`,
@@ -286,16 +287,16 @@ async function assertQuestionsAskable(db, questions) {
                 property: 'checkout.custom_fields',
             });
         }
-        if (!(0, field_ports_1.isCheckoutEligible)(field.type)) {
+        if (!(0, checkout_1.isCheckoutEligible)(field.type)) {
             throw new errors_1.default.ValidationError({
                 message: `A ${field.type} field cannot be asked for at checkout.`,
                 property: 'checkout.custom_fields',
             });
         }
         const prompt = question.label ?? field.name;
-        if (prompt.length > field_ports_1.MAX_CHECKOUT_LABEL_LENGTH) {
+        if (prompt.length > checkout_1.MAX_CHECKOUT_LABEL_LENGTH) {
             throw new errors_1.default.ValidationError({
-                message: `A checkout question can be at most ${field_ports_1.MAX_CHECKOUT_LABEL_LENGTH} characters. Give this one a shorter label.`,
+                message: `A checkout question can be at most ${checkout_1.MAX_CHECKOUT_LABEL_LENGTH} characters. Give this one a shorter label.`,
                 property: 'checkout.custom_fields',
             });
         }

package/core/server/services/tiers/service.js

@@ -32,14 +32,14 @@ class TiersServiceWrapper {
     });
 
     // What a tier's checkout asks, kept beside the tier rather than inside it: these
-    // rows are read live on every request, because deleting a custom field cascades a
+    // rows are read live on every request, because deleting a metafield cascades a
     // question away without the repository above ever seeing it, and a cached copy
     // would go on naming a field the site no longer has.
     //
-    // Boot builds the custom fields services before this one, so both collaborators
+    // Boot builds the metafields services before this one, so both collaborators
     // are ready by the time this runs.
     const { TierCheckoutConfigService } = require('../tier-checkout-config');
-    const { bindings, definitions } = require('../members-custom-fields');
+    const { bindings, definitions } = require('../members-metafields');
     this.checkout = new TierCheckoutConfigService({
       knex: models.Base.knex,
       // A binding is where a collected value lands, and the same rows are what a completed

package/core/server/services/update-check/index.js

@@ -2,7 +2,7 @@ const api = require('../../api').endpoints;
 const config = require('../../../shared/config');
 const logging = require('@tryghost/logging');
 const urlUtils = require('../../../shared/url-utils').default;
-const jobsService = require('../jobs');
+const UpdateCheckJob = require('./jobs/update-check-job').default;
 
 const request = require('@tryghost/request');
 const ghostVersion = require('@tryghost/version');
@@ -66,7 +66,7 @@ module.exports = async ({
   await updateChecker.check();
 };
 
-module.exports.scheduleRecurringJobs = () => {
+const scheduleRecurringJob = async (jobsService) => {
   // use a random seconds/minutes/hours value to avoid spikes to the update service API
   const s = Math.floor(Math.random() * 60); // 0-59
   const m = Math.floor(Math.random() * 60); // 0-59
@@ -74,17 +74,17 @@ module.exports.scheduleRecurringJobs = () => {
 
   const at = `${s} ${m} ${h} * * *`;
   logging.info(`[Background Job] update-check scheduled at ${at}`);
-  jobsService.addJob({
-    at, // Every day
-    job: require('path').resolve(__dirname, 'run-update-check.js'),
-    name: 'update-check',
-  });
+  await jobsService.scheduleRecurring(new UpdateCheckJob(), { cron: at });
 };
 
-module.exports.scheduleBootJob = () => {
-  logging.info('[Background Job] update-check-boot queued');
-  jobsService.addJob({
-    job: require('path').resolve(__dirname, 'run-update-check.js'),
-    name: 'update-check-boot',
-  });
+const scheduleBootJob = async (jobsService) => {
+  logging.info('[Background Job] update-check boot run queued');
+  await jobsService.dispatch(new UpdateCheckJob());
+};
+
+module.exports.scheduleJobs = async (jobsService) => {
+  await scheduleRecurringJob(jobsService);
+  if (config.get('updateCheck:forceUpdate')) {
+    await scheduleBootJob(jobsService);
+  }
 };

package/core/server/services/update-check/jobs/update-check-job.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../../jobs-service/job");
+class UpdateCheckJob extends job_1.Job {
+    static type = 'update-check';
+}
+exports.default = UpdateCheckJob;

package/core/server/services/update-check/update-check-service.js

@@ -99,7 +99,7 @@ class UpdateCheckService {
     );
 
     err.context = tpl(messages.checkingForUpdatesFailedError);
-    err.help = tpl(messages.checkingForUpdatesFailedHelp, { url: 'https://ghost.org/docs/' });
+    err.help = tpl(messages.checkingForUpdatesFailedHelp, { url: 'https://docs.ghost.org/' });
 
     this.logging.error(
       {
@@ -120,7 +120,7 @@ class UpdateCheckService {
    * Only the Ghost version is sent so the service can return the relevant
    * release and security notifications. No site data is collected.
    *
-   * @see https://ghost.org/docs/concepts/config/#privacy
+   * @see https://docs.ghost.org/concepts/config/#privacy
    * @returns {Promise}
    */
   async updateCheckRequest() {

package/core/server/services/url/router-filter.js

@@ -1,11 +1,14 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EXPANSIONS = void 0;
 exports.routerTypeOf = routerTypeOf;
 exports.buildFilter = buildFilter;
 exports.filterMatches = filterMatches;
-const nql = require('@tryghost/nql');
-const logging = require('@tryghost/logging');
+const nql_1 = __importDefault(require("@tryghost/nql"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
 // NQL evaluation for routes.yaml collection filters, kept in one place so the
 // forward lookup, ownership check and reverse lookup all decide membership the
 // same way.
@@ -17,7 +20,7 @@ exports.EXPANSIONS = [
     { key: 'primary_tag', replacement: 'primary_tag.slug' },
     { key: 'primary_author', replacement: 'primary_author.slug' },
 ];
-const PAGE_TRANSFORMER = nql.utils.mapKeyValues({
+const PAGE_TRANSFORMER = nql_1.default.utils.mapKeyValues({
     key: { from: 'page', to: 'type' },
     values: [
         { from: false, to: 'post' },
@@ -45,7 +48,7 @@ function buildFilter(filter) {
     if (!filter) {
         return null;
     }
-    return nql(filter, { expansions: exports.EXPANSIONS, transformer: PAGE_TRANSFORMER });
+    return (0, nql_1.default)(filter, { expansions: exports.EXPANSIONS, transformer: PAGE_TRANSFORMER });
 }
 // A null filter always matches; anything that throws is a non-match, not an
 // error.
@@ -65,12 +68,7 @@ function filterMatches(compiledFilter, record) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        logging.warn('NQL match failed', message);
+        logging_1.default.warn('NQL match failed', message);
         return false;
     }
 }
-module.exports = { EXPANSIONS: exports.EXPANSIONS, routerTypeOf, buildFilter, filterMatches };
-module.exports.EXPANSIONS = exports.EXPANSIONS;
-module.exports.routerTypeOf = routerTypeOf;
-module.exports.buildFilter = buildFilter;
-module.exports.filterMatches = filterMatches;

package/core/server/services/users.js

@@ -1,5 +1,4 @@
 // @ts-check
-const path = require('path');
 const ObjectId = require('bson-objectid').default;
 
 /**
@@ -7,11 +6,6 @@ const ObjectId = require('bson-objectid').default;
  */
 const DomainEvents = require('@tryghost/domain-events/lib/DomainEvents');
 
-/**
- * @typedef {Object} IdbBackup
- * @prop {() => Promise<string>} backup
- */
-
 /**
  * @typedef {Object} IModels
  * @prop {Object} Base
@@ -40,14 +34,12 @@ const DomainEvents = require('@tryghost/domain-events/lib/DomainEvents');
 class Users {
   /**
    * @param {Object} dependencies
-   * @param {IdbBackup} dependencies.dbBackup
    * @param {IModels} dependencies.models
    * @param {IAuth} dependencies.auth
    * @param {Object} dependencies.apiMail
    * @param {Object} dependencies.apiSettings
    */
-  constructor({ dbBackup, models, auth, apiMail, apiSettings }) {
-    this.dbBackup = dbBackup;
+  constructor({ models, auth, apiMail, apiSettings }) {
     this.models = models;
     this.auth = auth;
     this.apiMail = apiMail;
@@ -183,14 +175,6 @@ class Users {
    * @returns
    */
   async destroyUser(frameOptions) {
-    let filename = null;
-    const backupPath = await this.dbBackup.backup();
-
-    if (backupPath) {
-      const parsedFileName = path.parse(backupPath);
-      filename = `${parsedFileName.name}${parsedFileName.ext}`;
-    }
-
     return this.models.Base.transaction(async (t) => {
       frameOptions.transacting = t;
 
@@ -234,8 +218,6 @@ class Users {
       }
 
       await this.models.User.destroy(Object.assign({ status: 'all' }, frameOptions));
-
-      return filename;
     });
   }
 }

package/core/server/web/admin/controller.js

@@ -46,7 +46,7 @@ module.exports = function adminController(req, res) {
       throw new errors.IncorrectUsageError({
         message: tpl(messages.templateError.message, { templatePath }),
         context: tpl(messages.templateError.context),
-        help: tpl(messages.templateError.help, { link: 'https://ghost.org/docs/install/source/' }),
+        help: tpl(messages.templateError.help, { link: 'https://docs.ghost.org/install/source/' }),
         err,
       });
     }

package/core/server/web/api/endpoints/admin/routes.js

@@ -161,7 +161,7 @@ module.exports = function apiRoutes() {
   router.put(
     '/tiers/:id/checkout_config',
     mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
+    labs.enabledMiddleware('stripeCheckoutCollection'),
     http(api.tiersCheckoutConfig.edit),
   );
 
@@ -195,36 +195,39 @@ module.exports = function apiRoutes() {
 
   router.get('/members/stripe_connect', mw.authAdminApi, http(api.membersStripeConnect.auth));
 
-  // Member custom field definitions. Reading them is open: a site that has never
-  // turned the flag on has none, so the answer is an empty list rather than a 404, and
-  // Admin can ask without first knowing whether it may. Changing them is gated.
-  // Registered before /members/:id so the literal path isn't captured by :id.
-  router.get('/members/custom_fields', mw.authAdminApi, http(api.membersCustomFields.browse));
+  // Reading definitions is deliberately not behind the feature flag: Admin asks every site
+  // for them, and a site without the flag simply has none, so the answer is an empty list
+  // rather than a 404. Creating and changing them is flagged. Registered before /members/:id
+  // so the literal path is not captured as an id.
+  router.get('/members/metafields/:namespace', mw.authAdminApi, http(api.membersMetafields.browse));
   router.post(
-    '/members/custom_fields',
+    '/members/metafields/:namespace',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.add),
+    http(api.membersMetafields.add),
   );
-  // A PUT on the collection sets the publisher's order for the whole list.
   router.put(
-    '/members/custom_fields',
+    '/members/metafields/:namespace',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.reorder),
+    http(api.membersMetafields.reorder),
+  );
+  router.get(
+    '/members/metafields/:namespace/:key',
+    mw.authAdminApi,
+    http(api.membersMetafields.read),
   );
-  router.get('/members/custom_fields/:key', mw.authAdminApi, http(api.membersCustomFields.read));
   router.put(
-    '/members/custom_fields/:key',
+    '/members/metafields/:namespace/:key',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.edit),
+    http(api.membersMetafields.edit),
   );
   router.delete(
-    '/members/custom_fields/:key',
+    '/members/metafields/:namespace/:key',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.destroy),
+    http(api.membersMetafields.destroy),
   );
 
   router.get('/members/:id', mw.authAdminApi, http(api.members.read));
@@ -518,6 +521,7 @@ module.exports = function apiRoutes() {
   // ## Emails
   router.get('/emails', mw.authAdminApi, http(api.emails.browse));
   router.get('/emails/:id', mw.authAdminApi, http(api.emails.read));
+  router.get('/emails/:id/status', mw.authAdminApi, http(api.emails.sendingStatus));
   router.put('/emails/:id/retry', mw.authAdminApi, http(api.emails.retry));
   router.get('/emails/:id/batches', mw.authAdminApi, http(api.emails.browseBatches));
   router.get('/emails/:id/recipient-failures', mw.authAdminApi, http(api.emails.browseFailures));

package/core/server/web/members/account/index.js

@@ -0,0 +1,2 @@
+"use strict";
+module.exports = require('./routes');

package/core/server/web/members/account/routes.js

@@ -0,0 +1,46 @@
+"use strict";
+const express = require('../../../../shared/express');
+const bodyParser = require('body-parser');
+const config = require('../../../../shared/config');
+const { http } = require('@tryghost/api-framework');
+const api = require('../../../api').endpoints;
+const middleware = require('../../../services/members/middleware');
+/**
+ * A member's own account, over HTTP.
+ *
+ * Everything reached by a signed-in member acting on their own record lives here,
+ * so how these routes authenticate is a property of the module rather than a line
+ * each one repeats. Establishing who is asking happens once; each route then says
+ * what it wants done when there is nobody.
+ *
+ * Endpoints reached by someone who is not signed in stay outside this: the
+ * unsubscribe links identify a member by a signed link, and changing an email
+ * address by a token in the body, because in both cases the person following them
+ * has no session.
+ */
+module.exports = function accountRoutes() {
+    const router = express.Router('member-account');
+    router.use(middleware.loadMemberIdentity);
+    // Reading who you are. Answering with nothing when there is no member is the
+    // right answer rather than a failure: a themed page asks this on every view.
+    if (config.get('cacheMembersContent:enabled')) {
+        router.get('/', 
+        // Not for this route's benefit. This configuration stamps a cookie saying
+        // what the reader is entitled to, so a cache can vary on it, and that needs
+        // the member's subscriptions rather than only their identity. It rides here
+        // because Portal asks this endpoint on every page load.
+        middleware.loadMemberSession, middleware.accessInfoSession, middleware.emptyWhenAnonymous, http(api.membersAccount.read));
+    }
+    else {
+        router.get('/', middleware.emptyWhenAnonymous, http(api.membersAccount.read));
+    }
+    router.put('/', bodyParser.json({ limit: '50mb' }), middleware.rejectWhenAnonymous, http(api.membersAccount.update));
+    // The fields a publisher has defined, which a member's client renders inputs
+    // from. Under the account because a member reads them to fill in their own, and
+    // refused to an unknown caller because what a publisher collects is their
+    // configuration rather than something the site announces.
+    router.get('/metafields/:namespace', middleware.rejectWhenAnonymous, http(api.memberMetafieldsMembers.browse));
+    // Letting Ghost email this member again after it stopped.
+    router.delete('/suppression', middleware.rejectWhenAnonymous, http(api.membersAccount.destroySuppression));
+    return router;
+};

package/core/server/web/members/app.js

@@ -8,10 +8,10 @@ const audienceFeedbackService = require('../../services/audience-feedback');
 const middleware = membersService.middleware;
 const shared = require('../shared');
 const errorHandler = require('@tryghost/mw-error-handler');
-const config = require('../../../shared/config');
 const { http } = require('@tryghost/api-framework');
 const api = require('../../api').endpoints;
 
+const accountRoutes = require('./account');
 const commentRouter = require('../comments');
 const announcementRouter = require('../announcement');
 const corsMiddleware = require('./middleware/cors');
@@ -57,21 +57,9 @@ module.exports = function setupMembersApp() {
     middleware.updateMemberNewsletters,
   );
 
-  // Get and update member data
-  // Caching members content is an experimental feature
-  const shouldCacheMembersContent = config.get('cacheMembersContent:enabled');
-  if (shouldCacheMembersContent) {
-    membersApp.get(
-      '/api/member',
-      middleware.loadMemberSession,
-      middleware.accessInfoSession,
-      middleware.getMemberData,
-    );
-  } else {
-    membersApp.get('/api/member', middleware.getMemberData);
-  }
-
-  membersApp.put('/api/member', bodyParser.json({ limit: '50mb' }), middleware.updateMemberData);
+  // A member's own account. Its routes and how they authenticate live together.
+  membersApp.use('/api/member', accountRoutes());
+
   membersApp.post('/api/member/email', bodyParser.json({ limit: '50mb' }), (req, res, next) =>
     membersService.api.middleware.updateEmailAddress(req, res, next),
   );
@@ -86,8 +74,6 @@ module.exports = function setupMembersApp() {
   );
 
   // Remove email from suppression list
-  membersApp.delete('/api/member/suppression', middleware.deleteSuppression);
-
   // Manage session
   membersApp.get('/api/session', middleware.getIdentityToken);
   membersApp.delete('/api/session', bodyParser.json({ limit: '5mb' }), middleware.deleteSession);

package/core/shared/config/defaults.json

@@ -80,7 +80,7 @@
   "members": {
     "contentApiAccess": [],
     "paymentProcessors": [],
-    "customFields": {
+    "metafields": {
       "maxDefinitions": 100
     },
     "importer": {

package/core/shared/config/env/config.testing-mysql.json

@@ -11,7 +11,7 @@
     "connection": {
       "host": "127.0.0.1",
       "user": "root",
-      "password": "",
+      "password": "root",
       "database": "ghost_testing"
     }
   },

package/core/shared/labs.js

@@ -27,7 +27,7 @@ const messages = {
 };
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
-const GA_FEATURES = ['automationAnalytics', 'giftSubCustomization'];
+const GA_FEATURES = ['automationAnalytics', 'tagDetailsReact'];
 
 // These features are considered publicly available and can be enabled/disabled by users
 const PUBLIC_BETA_FEATURES = [
@@ -42,20 +42,25 @@ const PUBLIC_BETA_FEATURES = [
 const PRIVATE_FEATURES = [
   'automations',
   'automationRunAnalytics',
+  'automationsTinybirdSync',
   'stripeAutomaticTax',
   'importMemberTier',
   'csvContentImporter',
   'adminUIRefresh',
   'tagsX',
   'emailUniqueid',
+  'improveSendingUI',
   'themeTranslation',
   'pictureImageFormats',
   'getHelperDeduplication',
   'membersCustomFields',
+  'stripeCheckoutCollection',
+  'membersImportRedesign',
   'paywallImprovements',
-  'tagDetailsReact',
   'selfServeArchives',
   'machinePayments',
+  'postsListReact',
+  'editorReact',
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];