ghost 6.62.0 → 6.63.0

package/core/server/api/endpoints/newsletters-public.js

@@ -1,4 +1,8 @@
 const models = require('../../models');
+const {
+  rejectNewslettersContentApiRestrictedFieldsTransformer,
+  rejectNewslettersContentApiRestrictedOrderFields,
+} = require('./utils/api-filter-utils');
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,7 +15,12 @@ const controller = {
     options: ['filter', 'fields', 'limit', 'order', 'page'],
     permissions: true,
     query(frame) {
-      return models.Newsletter.findPage(frame.options);
+      const options = {
+        ...frame.options,
+        order: rejectNewslettersContentApiRestrictedOrderFields(frame.options.order),
+        mongoTransformer: rejectNewslettersContentApiRestrictedFieldsTransformer,
+      };
+      return models.Newsletter.findPage(options);
     },
   },
 };

package/core/server/api/endpoints/pages-public.js

@@ -1,14 +1,17 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const models = require('../../models');
-const { rejectContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { rejectPagesContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 const { generateGiftKeyData, applyGiftAccess } = require('./utils/gift-link-access');
 const { generateOptionsData, generateAuthData } = require('./utils/public-cache-keys');
 
 const ALLOWED_INCLUDES = ['tags', 'authors', 'tiers'];
+const ALLOWED_READ_FIELDS = ['id', 'slug', 'uuid'];
 
 const messages = {
   pageNotFound: 'Page not found.',
+  missingIdentifier: 'A page id, slug or uuid is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -44,7 +47,7 @@ const controller = {
     query(frame) {
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPagesContentApiRestrictedFieldsTransformer,
       };
       return models.Post.findPage(options);
     },
@@ -72,7 +75,7 @@ const controller = {
       };
     },
     options: ['include', 'fields', 'formats', 'debug', 'absolute_urls'],
-    data: ['id', 'slug', 'uuid'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -85,11 +88,18 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
+      // GET bodies bypass the framework's declared data fields. Restrict the
+      // actual lookup too, before the model turns it into SQL predicates.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (!Object.values(data).some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPagesContentApiRestrictedFieldsTransformer,
       };
-      const model = await models.Post.findOne(frame.data, options);
+      const model = await models.Post.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.pageNotFound),

package/core/server/api/endpoints/posts-public.js

@@ -1,17 +1,20 @@
 const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const postsPublicService = require('../../services/posts-public');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const postsService = getPostServiceInstance();
-const { rejectContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { rejectPostsContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 const { generateGiftKeyData, applyGiftAccess } = require('./utils/gift-link-access');
 const { generateOptionsData, generateAuthData } = require('./utils/public-cache-keys');
 
 const ALLOWED_INCLUDES = ['tags', 'authors', 'tiers', 'sentiment'];
+const ALLOWED_READ_FIELDS = ['id', 'slug', 'uuid'];
 
 const messages = {
   postNotFound: 'Post not found.',
+  missingIdentifier: 'A post id, slug or uuid is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -68,7 +71,7 @@ const controller = {
     query(frame) {
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPostsContentApiRestrictedFieldsTransformer,
       };
       return postsService.browsePosts(options);
     },
@@ -93,7 +96,7 @@ const controller = {
       };
     },
     options: ['include', 'fields', 'formats', 'debug', 'absolute_urls'],
-    data: ['id', 'slug', 'uuid'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -106,11 +109,18 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
+      // GET bodies bypass the framework's declared data fields. Restrict the
+      // actual lookup too, before the model turns it into SQL predicates.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (!Object.values(data).some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
       const options = {
         ...frame.options,
-        mongoTransformer: rejectContentApiRestrictedFieldsTransformer,
+        mongoTransformer: rejectPostsContentApiRestrictedFieldsTransformer,
       };
-      const model = await models.Post.findOne(frame.data, options);
+      const model = await models.Post.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.postNotFound),

package/core/server/api/endpoints/tags-public.js

@@ -1,12 +1,16 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
+const pick = require('lodash/pick');
 const models = require('../../models');
 const tagsPublicService = require('../../services/tags-public');
+const { rejectTagsContentApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 
 const ALLOWED_INCLUDES = ['count.posts'];
+const ALLOWED_READ_FIELDS = ['id', 'slug', 'visibility'];
 
 const messages = {
   tagNotFound: 'Tag not found.',
+  missingIdentifier: 'A tag id or slug is required.',
 };
 
 /** @type {import('@tryghost/api-framework').Controller} */
@@ -28,7 +32,11 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.TagPublic.findPage(frame.options);
+      const options = {
+        ...frame.options,
+        mongoTransformer: rejectTagsContentApiRestrictedFieldsTransformer,
+      };
+      return models.TagPublic.findPage(options);
     },
   },
 
@@ -37,7 +45,7 @@ const controller = {
       cacheInvalidate: false,
     },
     options: ['include', 'filter', 'fields', 'debug'],
-    data: ['id', 'slug', 'visibility'],
+    data: ALLOWED_READ_FIELDS,
     validation: {
       options: {
         include: {
@@ -47,7 +55,18 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.TagPublic.findOne(frame.data, frame.options);
+      // GET bodies bypass the framework's declared data fields. Preserve the
+      // public visibility constraint, but require an actual tag identifier.
+      const data = pick(frame.data, ALLOWED_READ_FIELDS);
+      if (![data.id, data.slug].some(Boolean)) {
+        throw new errors.BadRequestError({ message: tpl(messages.missingIdentifier) });
+      }
+
+      const options = {
+        ...frame.options,
+        mongoTransformer: rejectTagsContentApiRestrictedFieldsTransformer,
+      };
+      const model = await models.TagPublic.findOne(data, options);
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.tagNotFound),

package/core/server/api/endpoints/tiers-checkout-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const members_custom_fields_1 = require("../../services/members-custom-fields");
+const members_metafields_1 = require("../../services/members-metafields");
 const tier_checkout_config_1 = require("../../services/tier-checkout-config");
 const tiersService = require('../../services/tiers');
 /**
@@ -50,7 +50,7 @@ const controller = {
         validation: { options: { id: { required: true } } },
         permissions: { docName: 'products', method: 'edit' },
         async query(frame) {
-            await tiersService.checkout.edit((0, members_custom_fields_1.actingContext)(frame.options.context), frame.options.id, frame.data.tiers_checkout_config?.[0] ?? {});
+            await tiersService.checkout.edit((0, members_metafields_1.actingContext)(frame.options.context), frame.options.id, frame.data.tiers_checkout_config?.[0] ?? {});
             return [await forTier(frame.options.id)];
         },
     },

package/core/server/api/endpoints/tiers-public.js

@@ -1,4 +1,38 @@
+const logging = require('@tryghost/logging');
+const labs = require('../../../shared/labs');
 const tiersService = require('../../services/tiers');
+const { requirementsByTier } = require('../../services/tier-checkout-config');
+
+/**
+ * What each tier asks a member for, or nothing when the site does not do that.
+ *
+ * Looked up per request rather than kept with the tier, because a tier is loaded into
+ * memory once at boot and these rows change underneath it: deleting a custom field
+ * cascades a tier's binding away without that repository ever hearing about it, so a copy
+ * taken at boot would go on promising to ask for a field the site no longer has.
+ *
+ * One lookup per response, and only for this payload. Staff read these settings through a
+ * resource of their own that carries them in full, and the payloads carrying tiers in
+ * bulk each build their own reduced projection of a tier, so none of them pays for this.
+ *
+ * A failure costs the requirements and nothing else. A tier a reader cannot see the price
+ * of is worse than one whose delivery question they meet a moment later.
+ */
+async function requirements() {
+  if (!labs.isSet('stripeCheckoutCollection')) {
+    return undefined;
+  }
+
+  try {
+    return requirementsByTier(await tiersService.checkout.browse());
+  } catch (err) {
+    logging.error(
+      { event: { name: 'tiers.requirements.read_failed' }, err },
+      'Failed to read what tiers ask a member for',
+    );
+    return undefined;
+  }
+}
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -13,7 +47,10 @@ const controller = {
     async query(frame) {
       const page = await tiersService.api.browse(frame.options);
 
-      return page;
+      // Carried on the page rather than fetched while serializing, so the serializer
+      // renders what it was handed. The admin controller looks none up, which is what
+      // keeps them off the admin payload — no serializer needs to ask who is calling.
+      return { ...page, requirements: await requirements() };
     },
   },
 };

package/core/server/api/endpoints/users.js

@@ -2,13 +2,12 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
 const permissionsService = require('../../services/permissions');
-const dbBackup = require('../../data/db/backup');
 const auth = require('../../services/auth');
 const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
 const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
 const UsersService = require('../../services/users');
-const userService = new UsersService({ dbBackup, models, auth, apiMail, apiSettings });
+const userService = new UsersService({ models, auth, apiMail, apiSettings });
 const ALLOWED_INCLUDES = ['count.posts', 'permissions', 'roles', 'roles.permissions'];
 const UNSAFE_ATTRS = ['status', 'roles'];
 
@@ -191,6 +190,7 @@ const controller = {
   },
 
   destroy: {
+    statusCode: 204,
     headers: {
       cacheInvalidate: true,
     },

package/core/server/api/endpoints/utils/api-filter-utils.js

@@ -3,21 +3,173 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectNewslettersContentApiRestrictedFieldsTransformer = exports.rejectPagesContentApiRestrictedFieldsTransformer = exports.rejectPostsContentApiRestrictedFieldsTransformer = exports.rejectTagsContentApiRestrictedFieldsTransformer = exports.rejectAuthorsContentApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.rejectAuthorsRestrictedOrderFields = rejectAuthorsRestrictedOrderFields;
+exports.rejectTagsRestrictedOrderFields = rejectTagsRestrictedOrderFields;
+exports.rejectPostsContentApiRestrictedOrderFields = rejectPostsContentApiRestrictedOrderFields;
+exports.rejectPagesContentApiRestrictedOrderFields = rejectPagesContentApiRestrictedOrderFields;
+exports.rejectNewslettersContentApiRestrictedOrderFields = rejectNewslettersContentApiRestrictedOrderFields;
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const mongo_utils_1 = require("@tryghost/mongo-utils");
-const CONTENT_API_RESTRICTED_FIELDS = new Set(['password', 'email']);
+const schema = require('../../../data/schema').tables;
+// Never filterable or orderable through the Content API, on any resource or relation.
+const CONTENT_API_RESTRICTED_FIELDS = new Set([
+    'password',
+    'email',
+    'email_only',
+    'html',
+    'lexical',
+    'locale',
+    'mobiledoc',
+    'newsletter_id',
+    'plaintext',
+    'email_recipient_filter',
+    'published_by',
+]);
+const CONTENT_API_RESTRICTED_RELATIONS = new Set(['mobiledoc_revisions', 'post_revisions']);
+const CONTENT_API_PAGE_RESTRICTED_FIELDS = new Set(['email_subject']);
+const CONTENT_API_POST_RESTRICTED_FIELDS = new Set(['show_title_and_feature_image']);
+const CONTENT_API_NEWSLETTER_FIELDS = new Set([
+    'id',
+    'uuid',
+    'name',
+    'description',
+    'slug',
+    'sender_email',
+    'subscribe_on_signup',
+    'visibility',
+    'sort_order',
+    'created_at',
+    'updated_at',
+]);
+// User fields and relations the Content API does not expose: blocked as bare fields on authors and via author relations elsewhere.
+// Not blocked as bare fields on other resources, where visibility/status are legitimate filters.
+const CONTENT_API_USER_RESTRICTED_FIELDS = new Set([
+    'status',
+    'last_seen',
+    'created_at',
+    'updated_at',
+    'roles',
+    'roles_users',
+    'visibility',
+    'locale',
+    'accessibility',
+    'paid_subscription_started_notification',
+    'paid_subscription_canceled_notification',
+    'tour',
+    'comment_notifications',
+    'recommendation_notifications',
+    'gift_subscription_notifications',
+    'mention_notifications',
+    'donation_notifications',
+    'milestone_notifications',
+    'free_member_signup_notification',
+]);
+const CONTENT_API_AUTHOR_RELATIONS = new Set(['author', 'authors', 'primary_author']);
+const CONTENT_API_TAG_RESTRICTED_FIELDS = new Set([
+    'created_at',
+    'updated_at',
+    'parent_id',
+    'parent',
+]);
+const CONTENT_API_TAG_RELATIONS = new Set(['tag', 'tags', 'primary_tag']);
 const ADMIN_API_RESTRICTED_FIELDS = new Set(['password']);
+function getOrderAttributes(tableName) {
+    return Object.keys(schema[tableName])
+        .map((field) => `${tableName}.${field}`)
+        .filter((field) => !field.includes('@@'));
+}
+const CONTENT_API_AUTHOR_ORDER_ATTRIBUTES = getOrderAttributes('users');
+const CONTENT_API_TAG_ORDER_ATTRIBUTES = getOrderAttributes('tags');
+const CONTENT_API_NEWSLETTER_ORDER_ATTRIBUTES = getOrderAttributes('newsletters');
+const CONTENT_API_POST_ORDER_ATTRIBUTES = [
+    ...getOrderAttributes('posts'),
+    ...getOrderAttributes('posts_meta').filter((field) => !['posts_meta.id', 'posts_meta.post_id'].includes(field)),
+];
 function hasRestrictedSegment(key, fields) {
     return key
         .toLowerCase()
         .split('.')
         .some((segment) => fields.has(segment));
 }
+function hasRestrictedUserSegment(key) {
+    const segments = key.toLowerCase().split('.');
+    return segments.some((segment, index) => index > 0 &&
+        CONTENT_API_AUTHOR_RELATIONS.has(segments[index - 1]) &&
+        CONTENT_API_USER_RESTRICTED_FIELDS.has(segment));
+}
+function hasRestrictedTagSegment(key) {
+    const segments = key.toLowerCase().split('.');
+    return segments.some((segment, index) => index > 0 &&
+        CONTENT_API_TAG_RELATIONS.has(segments[index - 1]) &&
+        CONTENT_API_TAG_RESTRICTED_FIELDS.has(segment));
+}
+function isContentApiRestrictedKey(key) {
+    return (hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS) ||
+        hasRestrictedSegment(key, CONTENT_API_RESTRICTED_RELATIONS) ||
+        hasRestrictedUserSegment(key) ||
+        hasRestrictedTagSegment(key));
+}
+function isAuthorsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_USER_RESTRICTED_FIELDS));
+}
+function isTagsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_TAG_RESTRICTED_FIELDS));
+}
+function isPostsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_POST_RESTRICTED_FIELDS));
+}
+function isPagesContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_PAGE_RESTRICTED_FIELDS));
+}
+function isNewslettersContentApiRestrictedKey(key) {
+    const normalizedKey = key.toLowerCase();
+    const fieldKey = normalizedKey.startsWith('newsletters.')
+        ? normalizedKey.slice('newsletters.'.length)
+        : normalizedKey;
+    return !CONTENT_API_NEWSLETTER_FIELDS.has(fieldKey);
+}
+function rejectRestrictedOrderFields(order, orderAttributes, isRestricted) {
+    if (!order) {
+        return order;
+    }
+    const allowedClauses = (Array.isArray(order) ? order : [order])
+        .flatMap((value) => value.split(','))
+        .map((clause) => clause.trim())
+        .filter(Boolean)
+        .filter((clause) => {
+        const [field] = clause.split(/\s+/);
+        const normalizedField = field.toLowerCase();
+        const resolvedField = orderAttributes.find((orderAttribute) => orderAttribute.endsWith(normalizedField)) ||
+            normalizedField;
+        return !isRestricted(resolvedField);
+    });
+    return allowedClauses.length ? allowedClauses.join(',') : undefined;
+}
 const rejectContentApiRestrictedFieldsTransformer = (input) => {
-    return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS));
+    return (0, mongo_utils_1.rejectStatements)(input, isContentApiRestrictedKey);
 };
 exports.rejectContentApiRestrictedFieldsTransformer = rejectContentApiRestrictedFieldsTransformer;
+const rejectAuthorsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isAuthorsContentApiRestrictedKey);
+};
+exports.rejectAuthorsContentApiRestrictedFieldsTransformer = rejectAuthorsContentApiRestrictedFieldsTransformer;
+const rejectTagsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isTagsContentApiRestrictedKey);
+};
+exports.rejectTagsContentApiRestrictedFieldsTransformer = rejectTagsContentApiRestrictedFieldsTransformer;
+const rejectPostsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isPostsContentApiRestrictedKey);
+};
+exports.rejectPostsContentApiRestrictedFieldsTransformer = rejectPostsContentApiRestrictedFieldsTransformer;
+const rejectPagesContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isPagesContentApiRestrictedKey);
+};
+exports.rejectPagesContentApiRestrictedFieldsTransformer = rejectPagesContentApiRestrictedFieldsTransformer;
+const rejectNewslettersContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isNewslettersContentApiRestrictedKey);
+};
+exports.rejectNewslettersContentApiRestrictedFieldsTransformer = rejectNewslettersContentApiRestrictedFieldsTransformer;
 const rejectAdminApiRestrictedFieldsTransformer = (input) => {
     return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
 };
@@ -32,3 +184,18 @@ const validateAdminApiBulkFilterTransformer = (input) => {
     return input;
 };
 exports.validateAdminApiBulkFilterTransformer = validateAdminApiBulkFilterTransformer;
+function rejectAuthorsRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_AUTHOR_ORDER_ATTRIBUTES, isAuthorsContentApiRestrictedKey);
+}
+function rejectTagsRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_TAG_ORDER_ATTRIBUTES, isTagsContentApiRestrictedKey);
+}
+function rejectPostsContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_POST_ORDER_ATTRIBUTES, isPostsContentApiRestrictedKey);
+}
+function rejectPagesContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_POST_ORDER_ATTRIBUTES, isPagesContentApiRestrictedKey);
+}
+function rejectNewslettersContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_NEWSLETTER_ORDER_ATTRIBUTES, isNewslettersContentApiRestrictedKey);
+}

package/core/server/api/endpoints/utils/public-cache-keys.js

@@ -27,6 +27,9 @@ function generateAuthData(frame) {
     const member = frame.options?.context?.member;
     if (member) {
         return {
+            // Transistor embeds contain the individual member UUID. Use null for
+            // UUID-less shims so they also avoid old entitlement-only cache entries.
+            uuid: member.uuid ?? null,
             free: member.status === 'free',
             tiers: member.products?.map((product) => product.slug).sort(),
         };

package/core/server/api/endpoints/utils/serializers/input/authors.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:
 const url = require('./utils/url');
 const slugFilterOrder = require('./utils/slug-filter-order');
 const utils = require('../../index');
+const { rejectAuthorsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
   if (!frame.options.order && frame.options.filter) {
@@ -20,6 +21,7 @@ module.exports = {
     url.forceUrlColumns(frame, 'authors');
 
     if (utils.isContentAPI(frame)) {
+      frame.options.order = rejectAuthorsRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
     }
   },

package/core/server/api/endpoints/utils/serializers/input/members.js

@@ -1,6 +1,8 @@
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:members');
 const mapNQLKeyValues = require('@tryghost/nql').utils.mapKeyValues;
+const { chainTransformers } = require('@tryghost/mongo-utils');
+const { validateAdminApiBulkFilterTransformer } = require('../../api-filter-utils');
 
 function defaultRelations(frame) {
   if (frame.options.withRelated) {
@@ -16,7 +18,7 @@ function defaultRelations(frame) {
 
 // @TODO: move this into the member repository in members-api
 function mapSubscribedFlagToNewsletterRelation(frame) {
-  frame.options.mongoTransformer = mapNQLKeyValues({
+  const transformer = mapNQLKeyValues({
     key: {
       from: 'subscribed',
       to: 'newsletters.status',
@@ -32,6 +34,16 @@ function mapSubscribedFlagToNewsletterRelation(frame) {
       },
     ],
   });
+
+  frame.options.mongoTransformer = frame.options.mongoTransformer
+    ? chainTransformers(frame.options.mongoTransformer, transformer)
+    : transformer;
+}
+
+function validateBulkFilter(frame) {
+  frame.options.mongoTransformer = frame.options.mongoTransformer
+    ? chainTransformers(validateAdminApiBulkFilterTransformer, frame.options.mongoTransformer)
+    : validateAdminApiBulkFilterTransformer;
 }
 
 function liftMetafieldsInclude(frame) {
@@ -42,7 +54,7 @@ function liftMetafieldsInclude(frame) {
   frame.options.withRelated = frame.options.withRelated.filter(
     (relation) => relation !== 'metafields',
   );
-  frame.options.includeCustomFields = true;
+  frame.options.includeMetafields = true;
 }
 
 module.exports = {
@@ -125,11 +137,13 @@ module.exports = {
 
   bulkEdit(apiConfig, frame) {
     debug('bulkEdit');
+    validateBulkFilter(frame);
     mapSubscribedFlagToNewsletterRelation(frame);
   },
 
   bulkDestroy(apiConfig, frame) {
     debug('bulkDestroy');
+    validateBulkFilter(frame);
     mapSubscribedFlagToNewsletterRelation(frame);
   },
 };

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -9,6 +9,7 @@ const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
 const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
+const { rejectPagesContentApiRestrictedOrderFields } = require('../../api-filter-utils');
 
 const messages = {
   failedHtmlToLexical: 'Failed to convert HTML to Lexical',
@@ -137,6 +138,7 @@ module.exports = {
       removeSourceFormats(frame); // remove from the format field
       selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options
 
+      frame.options.order = rejectPagesContentApiRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
       forceVisibilityColumn(frame);
       url.forceUrlRelations(frame, 'pages');

package/core/server/api/endpoints/utils/serializers/input/posts.js

@@ -9,6 +9,7 @@ const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
 const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
+const { rejectPostsContentApiRestrictedOrderFields } = require('../../api-filter-utils');
 
 const messages = {
   failedHtmlToLexical: 'Failed to convert HTML to Lexical',
@@ -172,6 +173,7 @@ module.exports = {
       removeSourceFormats(frame); // remove from the format field
       selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options
 
+      frame.options.order = rejectPostsContentApiRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
       forceVisibilityColumn(frame);
       mapWithRelated(frame);

package/core/server/api/endpoints/utils/serializers/input/tags.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:
 const url = require('./utils/url');
 const slugFilterOrder = require('./utils/slug-filter-order');
 const utils = require('../../index');
+const { rejectTagsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
   let defaultOrder = 'name asc';
@@ -22,6 +23,7 @@ module.exports = {
     url.forceUrlColumns(frame, 'tags');
 
     if (utils.isContentAPI(frame)) {
+      frame.options.order = rejectTagsRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
     }
   },

package/core/server/api/endpoints/utils/serializers/output/emails.js

@@ -1,7 +1,14 @@
 const batchMapper = require('./mappers/email-batches');
 const failureMapper = require('./mappers/email-failures');
+const {
+  toEmailStatusesResponse,
+} = require('../../../../../services/email-service/sending-status-serializers');
 
 module.exports = {
+  sendingStatus(response, apiConfig, frame) {
+    frame.response = toEmailStatusesResponse.parse(response);
+  },
+
   browseBatches(response, apiConfig, frame) {
     frame.response = {};
 

package/core/server/api/endpoints/utils/serializers/output/index.js

@@ -20,6 +20,10 @@ module.exports = {
     return require('./member-commenting');
   },
 
+  get members_account() {
+    return require('./members-account');
+  },
+
   get authentication() {
     return require('./authentication');
   },