ghost 6.62.0 → 6.63.0

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -1,4 +1,5 @@
 const errors = require('@tryghost/errors');
+const { ADMIN } = require('../../../members-metafields');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
 const moment = require('moment');
@@ -7,9 +8,9 @@ const messages = {
   stripeNotConnected: 'Missing Stripe connection.',
   memberAlreadyExists: 'Member already exists.',
   memberNotFound: 'Member not found.',
-  customFieldsOnAdd:
+  metafieldsOnAdd:
     'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.',
-  customFieldsWithoutWriter:
+  metafieldsWithoutWriter:
     'Custom field values cannot be set by a request with no authenticated user or integration.',
 };
 
@@ -47,8 +48,8 @@ module.exports = class MemberBREADService {
    * @param {import('../../../settings-helpers/settings-helpers')} deps.settingsHelpers
    * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
    * @param {IGiftsModule} deps.giftService
-   * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
-   * @param {import('../../../members-custom-fields/definitions-service').CustomFieldDefinitionsService} deps.customFieldDefinitions Required: boot builds it before the members service
+   * @param {import('../../../members-metafields/values-service').MetafieldValuesService} deps.metafieldValues Required: boot builds it before the members service
+   * @param {import('../../../members-metafields/definitions-service').MetafieldDefinitionsService} deps.metafieldDefinitions Required: boot builds it before the members service
    */
   constructor({
     memberRepository,
@@ -61,8 +62,8 @@ module.exports = class MemberBREADService {
     nextPaymentCalculator,
     commentsService,
     giftService,
-    customFieldValues,
-    customFieldDefinitions,
+    metafieldValues,
+    metafieldDefinitions,
   }) {
     this.offersAPI = offersAPI;
     /** @private */
@@ -84,9 +85,9 @@ module.exports = class MemberBREADService {
     /** @private */
     this.giftService = giftService;
     /** @private */
-    this.customFieldValues = customFieldValues;
+    this.metafieldValues = metafieldValues;
     /** @private */
-    this.customFieldDefinitions = customFieldDefinitions;
+    this.metafieldDefinitions = metafieldDefinitions;
   }
 
   /**
@@ -102,12 +103,12 @@ module.exports = class MemberBREADService {
    * @param {string[]} memberIds
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
-  async fetchCustomFieldValues(memberIds) {
-    if (!(await this.customFieldDefinitions.hasAnyActive())) {
+  async fetchMetafieldValues(memberIds, audience) {
+    if (!(await this.metafieldDefinitions.hasAnyActive())) {
       return null;
     }
 
-    return this.customFieldValues.getValuesForMembers(memberIds);
+    return this.metafieldValues.getValuesForMembers(memberIds, audience);
   }
 
   /**
@@ -384,13 +385,15 @@ module.exports = class MemberBREADService {
   /**
    * @param {object} data
    * @param {object} [options]
-   * @param {boolean} [options.withCustomFields] Pass false to leave custom field values
-   *   off the result. Ghost calls this method to identify a signed-in reader on every page
-   *   view of a themed site, and that caller renders the member through a fixed list of
-   *   fields that has never included custom ones. Fetching them there costs two database
-   *   queries per page view whose results are then thrown away.
+   * @param {import('../../../members-metafields').Audience | null} [options.metafieldsFor]
+   *   Who the extra fields a publisher defined are being read for, or null to leave them
+   *   off entirely. Null is not the same as "nobody may see them": it means this caller
+   *   never shows them, so fetching them is two database queries whose results are thrown
+   *   away. Ghost identifies a signed-in reader on every page view of a themed site
+   *   through this method, and that caller renders a member through a fixed list of
+   *   fields which has never included these.
    */
-  async read(data, { withCustomFields = true, ...options } = {}) {
+  async read(data, { metafieldsFor = ADMIN, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -451,10 +454,10 @@ module.exports = class MemberBREADService {
     const unsubscribeUrl = this.settingsHelpers.createUnsubscribeUrl(member.uuid);
     member.unsubscribe_url = unsubscribeUrl;
 
-    if (withCustomFields) {
-      const customFields = await this.fetchCustomFieldValues([member.id]);
-      if (customFields) {
-        member.metafields = customFields.get(member.id) ?? {};
+    if (metafieldsFor) {
+      const metafields = await this.fetchMetafieldValues([member.id], metafieldsFor);
+      if (metafields) {
+        member.metafields = metafields.get(member.id) ?? {};
       }
     }
 
@@ -462,9 +465,9 @@ module.exports = class MemberBREADService {
   }
 
   async add(data, options) {
-    if (this.customFieldValues.namesValues(this.customFieldValues.unwrapWire(data.metafields))) {
+    if (this.metafieldValues.namesValues(this.metafieldValues.unwrapWire(data.metafields))) {
       throw new errors.ValidationError({
-        message: tpl(messages.customFieldsOnAdd),
+        message: tpl(messages.metafieldsOnAdd),
         property: 'metafields',
       });
     }
@@ -565,16 +568,16 @@ module.exports = class MemberBREADService {
   async edit(data, options) {
     delete data.last_seen_at;
 
-    const customFields = this.customFieldValues.unwrapWire(data.metafields);
-    const writeCustomFields = customFields !== undefined;
+    const metafields = this.metafieldValues.unwrapWire(data.metafields);
+    const writeMetafields = metafields !== undefined;
     delete data.metafields;
 
     // Plan (which validates) before the member is touched, so a bad value 422s
     // here rather than after the member edit has been applied — and keep the
     // plan to apply once below, so the values aren't resolved and validated
     // twice.
-    const plannedCustomFields = writeCustomFields
-      ? await this.customFieldValues.planWrite(customFields)
+    const plannedMetafields = writeMetafields
+      ? await this.metafieldValues.planWrite(metafields, ADMIN)
       : null;
 
     let model;
@@ -627,7 +630,7 @@ module.exports = class MemberBREADService {
       }
     }
 
-    if (plannedCustomFields) {
+    if (plannedMetafields) {
       // Every value reaching here was typed into the Admin API, so the writer is
       // whoever made the request — the same pair the action log records, so the two
       // agree about who did it rather than one saying only that it was "admin".
@@ -638,15 +641,15 @@ module.exports = class MemberBREADService {
       const context = options.context || {};
       if (!context.integration && !context.user) {
         throw new errors.IncorrectUsageError({
-          message: tpl(messages.customFieldsWithoutWriter),
+          message: tpl(messages.metafieldsWithoutWriter),
         });
       }
       const writtenBy = context.integration
         ? { type: 'integration', id: context.integration.id }
         : { type: 'user', id: context.user };
-      await this.customFieldValues.applyWrite(model.id, plannedCustomFields, { writtenBy });
+      await this.metafieldValues.applyWrite(model.id, plannedMetafields, { writtenBy });
 
-      // Custom fields aren't a member column or relation, so an edit touching
+      // Metafields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.
       // Declare the change into `_changed` — as bookshelf-relations does for a
       // labels change — so the member's edited lifecycle fires its usual signals
@@ -656,13 +659,13 @@ module.exports = class MemberBREADService {
       // populated `_changed` and fired the edited event during update(), so
       // re-firing would duplicate it (this also covers a full PUT that resends
       // unchanged member fields — `_changed` stays empty there too). That
-      // combined event omits `custom_fields` from `_changed`, which nothing
-      // reads: custom fields aren't in the webhook payload (they're injected
+      // combined event omits `metafields` from `_changed`, which nothing
+      // reads: metafields aren't in the webhook payload (they're injected
       // into read/browse responses, not the model), and `_changed` only gates
       // whether the event fires.
       const memberUnchanged = !model._changed || Object.keys(model._changed).length === 0;
-      if (memberUnchanged && plannedCustomFields.length > 0) {
-        model._changed = { custom_fields: true };
+      if (memberUnchanged && plannedMetafields.length > 0) {
+        model._changed = { metafields: true };
         // A mixed edit keeps the generic label on purpose: relabelling the
         // one action a member change already fired would bury that change
         // behind this one.
@@ -791,8 +794,11 @@ module.exports = class MemberBREADService {
 
     // One query for the whole page, not one per member. `null` when the flag
     // is off or the caller didn't ask — the same truthiness guard read uses.
-    const customFieldsByMember = options.includeCustomFields
-      ? await this.fetchCustomFieldValues(page.data.map((model) => model.id))
+    const metafieldsByMember = options.includeMetafields
+      ? await this.fetchMetafieldValues(
+          page.data.map((model) => model.id),
+          ADMIN,
+        )
       : null;
 
     const data = page.data.map((model, index) => {
@@ -804,8 +810,8 @@ module.exports = class MemberBREADService {
       if (!originalWithRelated.includes('products')) {
         delete member.products;
       }
-      if (customFieldsByMember) {
-        member.metafields = customFieldsByMember.get(model.id) ?? {};
+      if (metafieldsByMember) {
+        member.metafields = metafieldsByMember.get(model.id) ?? {};
       }
       member.email_suppression = {
         suppressed: bulkSuppressionData[index].suppressed || !!model.get('email_disabled'),

package/core/server/services/members/members-ssr.js

@@ -307,6 +307,24 @@ class MembersSSR {
    *
    * @returns {Promise<Member>}
    */
+  /**
+   * Who this session belongs to, without loading them.
+   *
+   * The counterpart to `getMemberDataFromSession`, for callers that need to know a
+   * member is there rather than what is on their record.
+   *
+   * @method getMemberIdentityFromSession
+   * @param {Request} req
+   * @param {Response} res
+   *
+   * @returns {Promise<{id: string, email: string} | null>}
+   */
+  async getMemberIdentityFromSession(req, res) {
+    const transientId = this._getSessionCookies(req, res);
+    const api = await this._getMembersApi();
+    return api.getMemberIdentity(transientId);
+  }
+
   async getMemberDataFromSession(req, res) {
     const transientId = this._getSessionCookies(req, res);
     const member = await this._getMemberIdentityDataFromTransientId(transientId);

package/core/server/services/members/middleware.js

@@ -2,11 +2,10 @@ const crypto = require('crypto');
 const _ = require('lodash');
 const logging = require('@tryghost/logging');
 const membersService = require('./service');
-const emailSuppressionList = require('../email-suppression-list');
 const models = require('../../models');
 const urlUtils = require('../../../shared/url-utils').default;
 const spamPrevention = require('../../web/shared/middleware/api/spam-prevention');
-const { formattedMemberResponse, formatNewsletterResponse } = require('./utils');
+const { formatNewsletterResponse } = require('./utils');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const onHeaders = require('on-headers');
@@ -18,6 +17,9 @@ const messages = {
   missingUuid: 'Missing uuid.',
   invalidUuid: 'Invalid uuid.',
   invalidKey: 'Invalid key.',
+  // Says that nobody is signed in, without naming the cookie that would have said
+  // so. Which cookie carries a session is Ghost's business, not the caller's.
+  noMemberSession: 'You must be signed in to do this.',
 };
 
 const getFreeTier = async function getFreeTier() {
@@ -116,6 +118,94 @@ const getRedirectUrl = function getRedirectUrl({ action, referrer, searchParams,
   return redirectUrl.href;
 };
 
+/**
+ * Establish who is signed in, without loading them.
+ *
+ * Sets `req.identity` to an id and an email address, or to null when nobody is
+ * signed in. One lookup against an indexed column, with no relations attached and
+ * nothing fetched from outside Ghost.
+ *
+ * Deliberately not the member's record. Most endpoints that serve a member need to
+ * act on one rather than describe one, and the one that describes a member reads
+ * it again after writing anyway, because the response has to say what Ghost now
+ * holds rather than what was sent. What to load is the endpoint's own business.
+ *
+ * Distinct from `loadMemberSession`, which loads the whole member and is what a
+ * themed page renders from.
+ */
+const loadMemberIdentity = async function loadMemberIdentity(req, res, next) {
+  try {
+    Object.assign(req, {
+      identity: await membersService.ssr.getMemberIdentityFromSession(req, res),
+    });
+  } catch (err) {
+    // Only a missing or unreadable cookie means nobody is signed in. Establishing
+    // an identity also reaches the database, and answering "you are not signed in"
+    // to that failing would tell a signed-in member something false and leave the
+    // real fault unreported.
+    if (!errors.utils.isGhostError(err) || err.errorType !== 'BadRequestError') {
+      return next(err);
+    }
+    Object.assign(req, { identity: null });
+  }
+
+  return next();
+};
+
+/**
+ * Hand the identity to whatever comes next, in the place the API framework reads.
+ *
+ * The framework takes whoever is acting from `req.member` and nowhere else, so a
+ * controller behind either gate below finds the identity there.
+ */
+const carryIdentity = function carryIdentity(req, res) {
+  Object.assign(req, { member: req.identity });
+  res.locals.member = req.member;
+};
+
+/**
+ * Refuse a request that `loadMemberIdentity` could not put a name to.
+ *
+ * For endpoints where an unknown caller is asking for something they have no right
+ * to: changing a member's record, or reading what a publisher collects.
+ *
+ * Reads only `req.identity`, so a route using this must register
+ * `loadMemberIdentity` first. It looks nothing up itself: what a route needs is
+ * declared by the middleware it lists, rather than depending on what some earlier
+ * one happened to leave behind.
+ */
+const rejectWhenAnonymous = function rejectWhenAnonymous(req, res, next) {
+  if (!req.identity) {
+    return next(
+      new errors.UnauthorizedError({
+        message: tpl(messages.noMemberSession),
+      }),
+    );
+  }
+
+  carryIdentity(req, res);
+  return next();
+};
+
+/**
+ * Answer with nothing when `loadMemberIdentity` could not put a name to the request.
+ *
+ * For reading who you are, where not knowing is an ordinary answer rather than a
+ * failure: a themed page asks on every view and most of those views have no member.
+ *
+ * The counterpart to `rejectWhenAnonymous`, and separate from it because which of
+ * the two applies is a fact about the endpoint, not a setting on a shared one.
+ */
+const emptyWhenAnonymous = function emptyWhenAnonymous(req, res, next) {
+  if (!req.identity) {
+    res.writeHead(204);
+    return res.end();
+  }
+
+  carryIdentity(req, res);
+  return next();
+};
+
 /**
  * Require member authentication, and make it possible to authenticate via uuid + hashed key.
  * You can chain this after loadMemberSession to make it possible to authenticate via both the uuid and the session.
@@ -243,42 +333,6 @@ const deleteSession = async function deleteSession(req, res) {
   }
 };
 
-const getMemberData = async function getMemberData(req, res) {
-  try {
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    if (member) {
-      res.json(formattedMemberResponse(member));
-    } else {
-      res.json(null);
-    }
-  } catch (err) {
-    res.writeHead(204);
-    res.end();
-  }
-};
-
-const deleteSuppression = async function deleteSuppression(req, res) {
-  try {
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    const options = {
-      id: member.id,
-    };
-    await emailSuppressionList.removeEmail(member.email);
-    await membersService.api.members.update({ email_disabled: false }, options);
-
-    res.writeHead(204);
-    res.end();
-  } catch (err) {
-    if (!err.statusCode) {
-      logging.error(err);
-    }
-    res.writeHead(err.statusCode ?? 500, {
-      'Content-Type': 'text/plain;charset=UTF-8',
-    });
-    res.end(err.message);
-  }
-};
-
 const getMemberNewsletters = async function getMemberNewsletters(req, res) {
   try {
     const memberData = req.member; // validation assumed
@@ -351,46 +405,6 @@ const updateMemberNewsletters = async function updateMemberNewsletters(req, res)
   }
 };
 
-const updateMemberData = async function updateMemberData(req, res) {
-  try {
-    const data = _.pick(
-      req.body,
-      'name',
-      'expertise',
-      'subscribed',
-      'newsletters',
-      'enable_comment_notifications',
-      'enable_updates_and_announcements',
-    );
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    if (member) {
-      const options = {
-        id: member.id,
-        withRelated: [
-          'stripeSubscriptions',
-          'stripeSubscriptions.customer',
-          'stripeSubscriptions.stripePrice',
-          'newsletters',
-        ],
-      };
-      await membersService.api.members.update(data, options);
-      const updatedMember = await membersService.ssr.getMemberDataFromSession(req, res);
-
-      res.json(formattedMemberResponse(updatedMember));
-    } else {
-      res.json(null);
-    }
-  } catch (err) {
-    if (!err.statusCode) {
-      logging.error(err);
-    }
-    res.writeHead(err.statusCode ?? 500, {
-      'Content-Type': 'text/plain;charset=UTF-8',
-    });
-    res.end(err.message);
-  }
-};
-
 const createSessionFromMagicLink = async function createSessionFromMagicLink(req, res, next) {
   if (!req.url.includes('token=')) {
     return next();
@@ -500,17 +514,17 @@ const createSessionFromMagicLink = async function createSessionFromMagicLink(req
 // Set req.member & res.locals.member if a cookie is set
 module.exports = {
   loadMemberSession,
+  loadMemberIdentity,
+  rejectWhenAnonymous,
+  emptyWhenAnonymous,
   authMemberByUuid,
   createSessionFromMagicLink,
   getIdentityToken,
   getEntitlementToken,
   getMemberNewsletters,
-  getMemberData,
-  updateMemberData,
   updateMemberNewsletters,
   deleteSession,
   accessInfoSession,
-  deleteSuppression,
   createIntegrityToken,
   verifyIntegrityToken,
 };

package/core/server/services/members/service.js

@@ -49,9 +49,9 @@ let membersApi;
 let verificationTrigger;
 
 const buildImporterDeps = ({ stripeAPIService }) => {
-  // Required here, not statically: boot builds the custom fields services before this
+  // Required here, not statically: boot builds the metafields services before this
   // one (the exporter below relies on the same).
-  const customFields = require('../members-custom-fields');
+  const metafields = require('../members-metafields');
   return {
     getTimezone: () => settingsCache.get('timezone'),
     // A getter rather than a value because the threshold is an operator
@@ -88,9 +88,9 @@ const buildImporterDeps = ({ stripeAPIService }) => {
     urlFor: urlUtils.urlFor.bind(urlUtils),
     stripeAPIService,
     productRepository: membersApi.productRepository,
-    customFields: {
-      definitions: customFields.definitions,
-      values: customFields.values,
+    metafields: {
+      definitions: metafields.definitions,
+      values: metafields.values,
     },
   };
 };
@@ -115,6 +115,66 @@ const initVerificationTrigger = () => {
   });
 };
 
+const membersMigrationJobName = 'members-migrations';
+
+/**
+ * Runs the historical Stripe backfills once per site, retried only after a
+ * failed run.
+ *
+ * The `jobs` row named `members-migrations` is the only guard: any status other
+ * than `failed` means the run was already attempted and is skipped forever. The
+ * row is written after the run, so a boot that dies mid-way retries next time.
+ * The row is written even when Stripe is not configured, matching the job-based
+ * version: a site that connects Stripe later never runs these 2021-era backfills.
+ * Two processes booting a site with no row will both run the backfills, where the
+ * job-based version claimed the row first. Accepted: every site that has booted
+ * since Ghost 5.6 has the row, and the backfills do nothing without Stripe.
+ *
+ * @TODO: Delete the backfills, this runner and the `jobs` rows in the next major
+ *
+ * @param {import('../stripe')} stripeService
+ */
+async function runStripeMigrations(stripeService) {
+  const existingJob = await models.Job.findOne({ name: membersMigrationJobName });
+
+  if (existingJob && existingJob.get('status') !== 'failed') {
+    logging.info(`Stripe ${membersMigrationJobName} skipped because it has already run`);
+    return;
+  }
+
+  const startedAt = Date.now();
+  logging.info(`Stripe ${membersMigrationJobName} started`);
+
+  let status = 'finished';
+  try {
+    await stripeService.migrations.execute();
+    logging.info(`Stripe ${membersMigrationJobName} completed in ${Date.now() - startedAt}ms`);
+  } catch (err) {
+    status = 'failed';
+    logging.error(
+      err,
+      `Stripe ${membersMigrationJobName} failed after ${Date.now() - startedAt}ms`,
+    );
+  }
+
+  const attrs = { status, started_at: new Date(startedAt), finished_at: new Date() };
+  if (existingJob) {
+    await models.Job.edit(attrs, { id: existingJob.id });
+    return;
+  }
+
+  try {
+    await models.Job.add({ name: membersMigrationJobName, ...attrs });
+  } catch (err) {
+    // Two processes booting a site with no row yet both get here, and the unique
+    // index on jobs.name rejects the second insert. The row exists, so move on.
+    if (!(await models.Job.findOne({ name: membersMigrationJobName }))) {
+      throw err;
+    }
+    logging.warn(`Stripe ${membersMigrationJobName} row was already written by another process`);
+  }
+}
+
 module.exports = {
   async init() {
     const stripeService = require('../stripe');
@@ -175,46 +235,14 @@ module.exports = {
       membersCSVImporter.importInline(request, verificationTrigger);
 
     // Constructed here rather than required statically: the exporter needs the
-    // custom fields services, which boot builds before this one.
-    const customFields = require('../members-custom-fields');
+    // metafields services, which boot builds before this one.
+    const metafields = require('../members-metafields');
     module.exports.export = makeExporter({
-      definitions: customFields.definitions,
-      values: customFields.values,
+      definitions: metafields.definitions,
+      values: metafields.values,
     });
 
-    if (!env?.startsWith('testing')) {
-      const membersMigrationJobName = 'members-migrations';
-      if (!(await jobsService.hasExecutedSuccessfully(membersMigrationJobName))) {
-        logging.info(`[Background Job] ${membersMigrationJobName} queued`);
-        jobsService.addOneOffJob({
-          name: membersMigrationJobName,
-          offloaded: false,
-          job: async () => {
-            const startedAt = Date.now();
-            logging.info(`[Background Job] ${membersMigrationJobName} started`);
-            try {
-              const result = await stripeService.migrations.execute();
-              logging.info(
-                `[Background Job] ${membersMigrationJobName} completed in ${Date.now() - startedAt}ms`,
-              );
-              return result;
-            } catch (err) {
-              logging.error(
-                err,
-                `[Background Job] ${membersMigrationJobName} failed after ${Date.now() - startedAt}ms`,
-              );
-              throw err;
-            }
-          },
-        });
-
-        await jobsService.awaitOneOffCompletion(membersMigrationJobName);
-      } else {
-        logging.info(
-          `[Background Job] ${membersMigrationJobName} skipped because it has already run`,
-        );
-      }
-    }
+    await runStripeMigrations(stripeService);
   },
   contentGating: require('./content-gating'),
 

package/core/server/services/members/utils.js

@@ -41,5 +41,14 @@ module.exports.formattedMemberResponse = function formattedMemberResponse(member
     data.email_suppression = member.email_suppression;
   }
 
+  // Absent rather than empty on a site that has defined no extra fields, which is
+  // most of them, so those members' accounts read exactly as they did before this
+  // existed. Present but empty means the publisher has defined fields and this
+  // member has answered none, which a client renders as blank inputs rather than
+  // as nothing to fill in.
+  if (member.metafields) {
+    data.metafields = member.metafields;
+  }
+
   return data;
 };

package/core/server/services/members-metafields/access.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL = exports.MEMBERS = exports.ADMIN = void 0;
+exports.readableFields = readableFields;
+exports.canWrite = canWrite;
+exports.ADMIN = { entry: 'admin' };
+exports.MEMBERS = { entry: 'members' };
+exports.INTERNAL = { entry: 'internal' };
+/**
+ * Which of the site's fields this audience may see.
+ *
+ * Every field, whichever door they came through. Written as a function rather than
+ * left unwritten so that when a publisher can mark a field as staff only, one
+ * function changes and every caller is already asking.
+ */
+function readableFields(_audience, fields) {
+    return fields;
+}
+/**
+ * Whether this audience may write this field.
+ *
+ * Also total today. Kept separate from `readableFields` because the asymmetry to
+ * expect is a field a member may read but not change, which one combined
+ * permission could not express.
+ */
+function canWrite(_audience, _field) {
+    return true;
+}