ghost 6.62.0 → 6.63.0

package/core/server/api/endpoints/utils/serializers/output/member-metafields.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const serializers_1 = require("../../../../../services/members-custom-fields/serializers");
+const serializers_1 = require("../../../../../services/members-metafields/serializers");
 const serializeOne = (field, _apiConfig, frame) => {
-    frame.response = serializers_1.toCustomFieldsResponse.parse([field]);
+    frame.response = serializers_1.toMetafieldsResponse.parse([field]);
 };
 const serializeMany = (fields, _apiConfig, frame) => {
-    frame.response = serializers_1.toCustomFieldsResponse.parse(fields);
+    frame.response = serializers_1.toMetafieldsResponse.parse(fields);
 };
 // The API framework loads this file with `require()`, so it exports CommonJS-style;
 // `export default` would not be picked up.

package/core/server/api/endpoints/utils/serializers/output/members-account.js

@@ -0,0 +1,19 @@
+"use strict";
+const { formattedMemberResponse } = require('../../../../../services/members/utils');
+/**
+ * A member's own record, as this API has always written one down.
+ *
+ * The projection itself is unchanged and still lives beside the other member
+ * formatting; what changes is that it is now reached the way every other
+ * serializer is, by this endpoint's `docName`, rather than being called by hand
+ * from a request handler.
+ */
+const serialize = (member, _apiConfig, frame) => {
+    frame.response = formattedMemberResponse(member);
+};
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
+module.exports = {
+    read: serialize,
+    update: serialize,
+};

package/core/server/api/endpoints/utils/serializers/output/members-csv-transform.js

@@ -14,7 +14,7 @@ const { toExportCsvRow } = require('../../../../../services/members/import-expor
  * @returns {Transform} Transform stream that converts objects to CSV
  */
 function createCSVTransform() {
-  // Locked in from the first row rather than declared up front: custom fields
+  // Locked in from the first row rather than declared up front: metafields
   // add a column per site, so the column set isn't known until a row arrives.
   // Every row carries the same keys, so the first is representative.
   let fields = null;

package/core/server/api/endpoints/utils/serializers/output/tiers.js

@@ -20,7 +20,7 @@ module.exports = {
 function paginatedTiers(page, _apiConfig, frame) {
   return {
     tiers: page.data.map((model) => {
-      return serializeTier(model, frame.options);
+      return serializeTier(model, frame.options, page.requirements);
     }),
     meta: page.meta,
   };
@@ -45,7 +45,7 @@ function singleTier(model, _apiConfig, frame) {
  *
  * @returns {SerializedTier}
  */
-function serializeTier(tier, options) {
+function serializeTier(tier, options, requirements = null) {
   const json = tier.toJSON(options);
 
   const serialized = {
@@ -70,6 +70,14 @@ function serializeTier(tier, options) {
     serialized.benefits = null;
   }
 
+  // Only the payload that was asked for these carries them, so a response that did not
+  // look them up says nothing rather than saying every tier asks for nothing. Where they
+  // were looked up, every tier carries the key and an empty one means it asks for
+  // nothing.
+  if (requirements) {
+    serialized.requirements = requirements.get(json.id) ?? {};
+  }
+
   if (serialized.type === 'free') {
     delete serialized.currency;
     delete serialized.monthly_price;

package/core/server/api/endpoints/utils/serializers/output/users.js

@@ -6,16 +6,6 @@ const messages = {
 };
 
 module.exports = {
-  destroy(filename, apiConfig, frame) {
-    debug('destroy');
-
-    frame.response = {
-      meta: {
-        filename: filename,
-      },
-    };
-  },
-
   changePassword(models, apiConfig, frame) {
     debug('changePassword');
 

package/core/server/data/exporter/table-lists.js

@@ -42,9 +42,9 @@ const BACKUP_TABLES = [
   'members_current_subscription',
   'members_subscription_created_events',
   'members_newsletters',
-  'members_custom_fields',
-  'members_custom_field_values',
-  'members_custom_field_bindings',
+  'members_metafields',
+  'members_metafield_values',
+  'members_metafield_bindings',
   'products_checkout_fields',
   'products_checkout_config',
   'mentions',

package/core/server/data/migrations/versions/6.53/2026-07-15-20-22-53-add-members-custom-field-values.js

@@ -28,7 +28,7 @@ module.exports = addTable('members_custom_field_values', {
     cascadeDelete: true,
   },
   // Exactly one value column is populated per row, chosen by the field type's
-  // storage type in @tryghost/custom-field-types. Splitting text from json
+  // storage type in @tryghost/metafield-types. Splitting text from json
   // keeps text-backed values directly queryable rather than behind a JSON
   // extraction, which is what filtering will need.
   //

package/core/server/data/migrations/versions/6.57/2026-08-04-18-00-00-store-custom-field-values-as-leaf-rows.js

@@ -45,7 +45,16 @@ module.exports = createNonTransactionalMigration(
     await discardStoredValues(knex);
 
     if (!(await knex.schema.hasColumn(TABLE, 'path'))) {
-      await addColumn(TABLE, 'path', knex, undefined, { algorithm: 'auto' });
+      // Spec pinned rather than read from schema.js, the way `down` already pins its own:
+      // a later migration renames this table, and an unpinned spec resolves against a
+      // schema that no longer names it.
+      await addColumn(
+        TABLE,
+        'path',
+        knex,
+        { type: 'string', maxlength: 191, nullable: false, defaultTo: '' },
+        { algorithm: 'auto' },
+      );
     }
 
     // A later 6.58 migration re-keys this table onto `custom_field_key`, dropping

package/core/server/data/migrations/versions/6.63/2026-09-03-10-07-03-rename-custom-field-tables-to-metafields.js

@@ -0,0 +1,169 @@
+const logging = require('@tryghost/logging');
+const { commands } = require('../../../schema');
+const { createNonTransactionalMigration } = require('../../utils');
+
+// The tables that held member custom fields are renamed to metafields, the name the API
+// and the rest of the domain already use. Dropped and recreated rather than renamed in
+// place: the feature is behind the `membersCustomFields` flag with no released data, so
+// there is nothing to carry across, and rebuilding gives every foreign key and index the
+// new name without a per-dialect rename dance.
+//
+// `products_checkout_fields` keeps its name but is rebuilt too, because its foreign key
+// points at the bindings table and would otherwise reference a table that no longer
+// exists.
+const DROP_ORDER = [
+  'products_checkout_fields',
+  'members_custom_field_bindings',
+  'members_custom_field_values',
+  'members_custom_fields',
+];
+
+// Specs pinned as they stand in schema.js at the time of writing, per the migration rules:
+// this file must keep building the same shape however schema.js moves on.
+const CREATE_ORDER = [
+  [
+    'members_metafields',
+    {
+      id: { type: 'string', maxlength: 24, nullable: false, primary: true },
+      key: { type: 'string', maxlength: 191, nullable: false, unique: true },
+      name: { type: 'string', maxlength: 191, nullable: false, unique: true },
+      type: {
+        type: 'string',
+        maxlength: 50,
+        nullable: false,
+        validations: { isIn: [['short_text', 'long_text', 'address']] },
+      },
+      status: {
+        type: 'string',
+        maxlength: 50,
+        nullable: false,
+        defaultTo: 'active',
+        validations: { isIn: [['active', 'archived']] },
+      },
+      sort_order: { type: 'integer', nullable: false, unsigned: true, defaultTo: 0 },
+      created_at: { type: 'dateTime', nullable: false },
+      updated_at: { type: 'dateTime', nullable: true },
+    },
+  ],
+  [
+    'members_metafield_values',
+    {
+      id: { type: 'string', maxlength: 24, nullable: false, primary: true },
+      metafield_key: {
+        type: 'string',
+        maxlength: 191,
+        nullable: false,
+        references: 'members_metafields.key',
+        cascadeDelete: true,
+      },
+      member_id: {
+        type: 'string',
+        maxlength: 24,
+        nullable: false,
+        references: 'members.id',
+        cascadeDelete: true,
+      },
+      path: { type: 'string', maxlength: 191, nullable: false, defaultTo: '' },
+      value_text: { type: 'text', maxlength: 65535, nullable: true },
+      written_by_type: { type: 'string', maxlength: 50, nullable: false },
+      written_by_id: { type: 'string', maxlength: 24, nullable: true },
+      created_at: { type: 'dateTime', nullable: false },
+      updated_at: { type: 'dateTime', nullable: true },
+      '@@UNIQUE_CONSTRAINTS@@': [
+        {
+          columns: ['member_id', 'metafield_key', 'path'],
+          indexName: 'members_metafield_values_leaf_unique',
+        },
+      ],
+      '@@INDEXES@@': [['metafield_key', 'path']],
+    },
+  ],
+  [
+    'members_metafield_bindings',
+    {
+      id: { type: 'string', maxlength: 24, nullable: false, primary: true },
+      product_id: {
+        type: 'string',
+        maxlength: 24,
+        nullable: false,
+        references: 'products.id',
+        cascadeDelete: true,
+      },
+      port: { type: 'string', maxlength: 191, nullable: false },
+      metafield_key: {
+        type: 'string',
+        maxlength: 191,
+        nullable: false,
+        references: 'members_metafields.key',
+        cascadeDelete: true,
+      },
+      created_at: { type: 'dateTime', nullable: false },
+      updated_at: { type: 'dateTime', nullable: true },
+      '@@UNIQUE_CONSTRAINTS@@': [
+        { columns: ['product_id', 'port'], indexName: 'members_metafield_bindings_unique' },
+      ],
+      '@@INDEXES@@': [['metafield_key']],
+    },
+  ],
+  [
+    'products_checkout_fields',
+    {
+      id: { type: 'string', maxlength: 24, nullable: false, primary: true },
+      binding_id: {
+        type: 'string',
+        maxlength: 24,
+        nullable: false,
+        unique: true,
+        references: 'members_metafield_bindings.id',
+        cascadeDelete: true,
+      },
+      sort_order: { type: 'integer', nullable: false, unsigned: true, defaultTo: 0 },
+      label: { type: 'string', maxlength: 191, nullable: true },
+      optional: { type: 'boolean', nullable: false, defaultTo: true },
+      created_at: { type: 'dateTime', nullable: false },
+      updated_at: { type: 'dateTime', nullable: true },
+    },
+  ],
+];
+
+module.exports = createNonTransactionalMigration(
+  async function up(connection) {
+    // The whole migration hangs on the old definitions table being there. A fresh install
+    // builds the new names straight from schema.js, and the replay suite runs this against
+    // that same final schema, so both reach here with nothing to rename — and must not
+    // drop `products_checkout_fields`, which by then is already pointing at the new
+    // bindings table.
+    if (!(await connection.schema.hasTable('members_custom_fields'))) {
+      logging.warn('Skipping the metafield table rename - members_custom_fields does not exist');
+      return;
+    }
+
+    // Both loops walk a fixed list of four tables, in an order foreign keys dictate, so
+    // the usual objection to looping in a migration — that it scales with the rows a site
+    // happens to hold — does not apply.
+    /* eslint-disable no-restricted-syntax */
+    for (const name of DROP_ORDER) {
+      if (await connection.schema.hasTable(name)) {
+        logging.info(`Dropping table: ${name}`);
+        await commands.deleteTable(name, connection);
+      } else {
+        logging.warn(`Skipping dropping table: ${name} - table does not exist`);
+      }
+    }
+
+    for (const [name, spec] of CREATE_ORDER) {
+      if (await connection.schema.hasTable(name)) {
+        logging.warn(`Skipping adding table: ${name} - table already exists`);
+      } else {
+        logging.info(`Adding table: ${name}`);
+        await commands.createTable(name, connection, spec);
+      }
+    }
+    /* eslint-enable no-restricted-syntax */
+  },
+  async function down() {
+    // Irreversible in the only sense that matters: the old tables can be rebuilt, but
+    // whatever they held cannot, and nothing on a released site holds anything.
+    logging.warn('Ignoring rollback for the custom field to metafield table rename');
+  },
+);

package/core/server/data/migrations/versions/6.63/2026-09-03-11-03-31-remove-member-custom-field-read-permissions.js

@@ -0,0 +1,30 @@
+const { combineTransactionalMigrations, createRemovePermissionMigration } = require('../../utils');
+
+const RESOURCE = 'member_custom_field';
+
+// Reading a field definition is no longer a permission. A definition says a site collects
+// a shoe size; every signed-in member already sees the whole list through Portal, so
+// gating staff behind a role protected nothing and inverted the two halves: an integration
+// holding `member: browse` received members' field values on the member payload, which
+// never consults this permission, while a request for the definitions describing those
+// values was refused.
+//
+// What remains on this resource is defining fields, which stays with the publisher.
+module.exports = combineTransactionalMigrations(
+  createRemovePermissionMigration(
+    {
+      name: 'Browse member custom fields',
+      action: 'browse',
+      object: RESOURCE,
+    },
+    ['Administrator', 'Admin Integration', 'Super Editor'],
+  ),
+  createRemovePermissionMigration(
+    {
+      name: 'Read member custom fields',
+      action: 'read',
+      object: RESOURCE,
+    },
+    ['Administrator', 'Admin Integration', 'Super Editor'],
+  ),
+);

package/core/server/data/schema/fixtures/fixtures.json

@@ -515,16 +515,6 @@
           "action_type": "destroy",
           "object_type": "label"
         },
-        {
-          "name": "Browse member custom fields",
-          "action_type": "browse",
-          "object_type": "member_custom_field"
-        },
-        {
-          "name": "Read member custom fields",
-          "action_type": "read",
-          "object_type": "member_custom_field"
-        },
         {
           "name": "Edit member custom fields",
           "action_type": "edit",
@@ -1069,7 +1059,6 @@
           "collection": "all",
           "recommendation": ["browse", "read"],
           "member": ["browse", "read", "add", "edit", "destroy"],
-          "member_custom_field": ["browse", "read"],
           "member_signin_url": "read",
           "offer": ["browse", "read"],
           "comment": "all",

package/core/server/data/schema/lib/default-index-name.js

@@ -1,20 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultIndexName = defaultIndexName;
 /**
  * Normally, we use Knex for index names. But in some cases, we need to derive
  * them because Knex won't get it right. We try to match [Knex's code][0] as
  * closely as possible.
  *
  * [0]: https://github.com/knex/knex/blob/e25d54bcb707714a17f5a5744eba5c4246bb4d1d/lib/schema/tablecompiler.js#L401-L415
- *
- * @param {string} tableName
- * @param {string|string[]} columns
- * @returns {string}
  */
 function defaultIndexName(tableName, columns) {
-  if (!Array.isArray(columns)) {
-    columns = columns ? [columns] : [];
-  }
-  const table = tableName.replace(/\.|-/g, '_');
-  return (table + '_' + columns.join('_') + '_index').toLowerCase();
+    if (!Array.isArray(columns)) {
+        columns = columns ? [columns] : [];
+    }
+    const table = tableName.replace(/\.|-/g, '_');
+    return (table + '_' + columns.join('_') + '_index').toLowerCase();
 }
-
-exports.defaultIndexName = defaultIndexName;

package/core/server/data/schema/schema.js

@@ -1033,7 +1033,7 @@ module.exports = {
     },
     sort_order: { type: 'integer', nullable: false, unsigned: true, defaultTo: 0 },
   },
-  members_custom_fields: {
+  members_metafields: {
     id: { type: 'string', maxlength: 24, nullable: false, primary: true },
     key: { type: 'string', maxlength: 191, nullable: false, unique: true },
     name: { type: 'string', maxlength: 191, nullable: false, unique: true },
@@ -1041,7 +1041,7 @@ module.exports = {
       type: 'string',
       maxlength: 50,
       nullable: false,
-      // Keep in sync with FIELD_TYPE_IDS in @tryghost/custom-field-types,
+      // Keep in sync with FIELD_TYPE_IDS in @tryghost/metafield-types,
       // the source of truth (this static schema can't import it).
       validations: {
         isIn: [['short_text', 'long_text', 'address']],
@@ -1071,7 +1071,7 @@ module.exports = {
   //
   // A second kind of source becomes a `source_type` beside a widened id. What it must not
   // become is a second table holding destinations.
-  members_custom_field_bindings: {
+  members_metafield_bindings: {
     id: { type: 'string', maxlength: 24, nullable: false, primary: true },
     product_id: {
       type: 'string',
@@ -1082,19 +1082,19 @@ module.exports = {
     },
     port: { type: 'string', maxlength: 191, nullable: false },
     // Indexed rather than unique: several sources landing in one field is expected.
-    custom_field_key: {
+    metafield_key: {
       type: 'string',
       maxlength: 191,
       nullable: false,
-      references: 'members_custom_fields.key',
+      references: 'members_metafields.key',
       cascadeDelete: true,
     },
     created_at: { type: 'dateTime', nullable: false },
     updated_at: { type: 'dateTime', nullable: true },
     '@@UNIQUE_CONSTRAINTS@@': [
-      { columns: ['product_id', 'port'], indexName: 'members_custom_field_bindings_unique' },
+      { columns: ['product_id', 'port'], indexName: 'members_metafield_bindings_unique' },
     ],
-    '@@INDEXES@@': [['custom_field_key']],
+    '@@INDEXES@@': [['metafield_key']],
   },
   // How a tier's checkout question is asked. Where the answer lands is the binding it
   // hangs off.
@@ -1105,7 +1105,7 @@ module.exports = {
       maxlength: 24,
       nullable: false,
       unique: true,
-      references: 'members_custom_field_bindings.id',
+      references: 'members_metafield_bindings.id',
       cascadeDelete: true,
     },
     sort_order: { type: 'integer', nullable: false, unsigned: true, defaultTo: 0 },
@@ -1137,17 +1137,17 @@ module.exports = {
     created_at: { type: 'dateTime', nullable: false },
     updated_at: { type: 'dateTime', nullable: true },
   },
-  members_custom_field_values: {
+  members_metafield_values: {
     id: { type: 'string', maxlength: 24, nullable: false, primary: true },
     // The field's stable key, not its id: a value is addressed by key everywhere it
     // matters (the write names it, a filter names it, the key is immutable), so the row
     // carries it directly and the read and filter paths skip an id-to-key join. Matches
     // the referenced column's 191, as a foreign key must.
-    custom_field_key: {
+    metafield_key: {
       type: 'string',
       maxlength: 191,
       nullable: false,
-      references: 'members_custom_fields.key',
+      references: 'members_metafields.key',
       cascadeDelete: true,
     },
     member_id: {
@@ -1188,14 +1188,14 @@ module.exports = {
     written_by_id: { type: 'string', maxlength: 24, nullable: true },
     created_at: { type: 'dateTime', nullable: false },
     updated_at: { type: 'dateTime', nullable: true },
-    // Named, because the name knex derives from the table and all three columns
-    // overruns MySQL's 64-character identifier limit. The migration that first
-    // created this table already shortened a column for the same reason; a third
-    // column spends what headroom that bought.
+    // Named rather than derived. The name knex builds from the table and all three
+    // columns used to overrun MySQL's 64-character identifier limit; the shorter table
+    // name now fits, but the index is named in a migration either way, so pinning it
+    // here keeps the two statements of it identical.
     '@@UNIQUE_CONSTRAINTS@@': [
       {
-        columns: ['member_id', 'custom_field_key', 'path'],
-        indexName: 'members_custom_field_values_leaf_unique',
+        columns: ['member_id', 'metafield_key', 'path'],
+        indexName: 'members_metafield_values_leaf_unique',
       },
     ],
     // What a segment filter looks up: every member holding a given value for a
@@ -1203,7 +1203,7 @@ module.exports = {
     // TEXT, so MySQL would need a prefix length, and the schema's index builder
     // applies one length to every column in a composite index rather than to a
     // single chosen one.
-    '@@INDEXES@@': [['custom_field_key', 'path']],
+    '@@INDEXES@@': [['metafield_key', 'path']],
   },
   members_stripe_customers: {
     id: { type: 'string', maxlength: 24, nullable: false, primary: true },

package/core/server/data/seeders/README.md

@@ -0,0 +1,48 @@
+# Data Generator
+
+The development data generator populates related Ghost tables in dependency
+order. Its CLI entry point is `node index.js generate-data`; contributors
+normally use the root `reset:data` scripts described in the
+[test-data guide](../../../../../../docs/contributing/test-data.md).
+
+## How It Works
+
+Importers live in `importers/` and each own one table. An importer declares its
+default quantity and any dependencies that are not represented by schema
+foreign keys. The generator adds schema and declared dependencies, sorts the
+tables, generates their records, and calls each importer's `finalise()` method.
+
+A numeric seed resets Faker for every table. This keeps Faker-generated values
+stable when another table is added or omitted. Time-dependent fields may still
+vary between runs. Use the provided Faker instances and random-data helpers
+rather than `Math.random()` so seeded values remain repeatable.
+
+## Add or Change an Importer
+
+- Extend `TableImporter` and register the importer in `importers/index.js`.
+- Set a modest `defaultQuantity`; callers can request larger datasets through
+  `--tables` or `--quantities`.
+- Declare dependencies that the database schema cannot supply. The generator
+  derives normal foreign-key dependencies itself.
+- Use `setReferencedModel()` and maps or indexes when records depend on another
+  generated table. Avoid repeatedly scanning large arrays during generation.
+- Generate IDs with `fastFakeObjectId()` rather than Faker's MongoDB ID helper.
+  The generated IDs are fast and safely earlier than the current time.
+- Put derived-table or summary work in `finalise()` so it runs after every
+  importer has completed.
+
+## Bulk Inserts
+
+`TableImporter.batchInsert()` uses Knex for small datasets. Above 5,000 records
+it writes CSV chunks and uses MySQL's `LOAD DATA LOCAL INFILE`, unless
+`DISABLE_FAST_IMPORT` is set.
+
+The CLI requires infile streaming. It is enabled automatically in development;
+other environments must explicitly set `ALLOW_INFILE_STREAM=1`. Do not broaden
+that permission in application configuration: it allows the database client to
+read a requested local file.
+
+The generator temporarily changes MySQL foreign-key, uniqueness, local-infile,
+and redo-log settings for fast imports. It re-enables redo logging at the end of
+a successful import. When changing this lifecycle, ensure failure paths also
+restore any persistent database setting they changed.