ghost 6.62.0 → 6.63.0

package/core/server/services/{members-custom-fields → members-metafields}/actions.js

@@ -4,12 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.actingContext = actingContext;
-exports.recordCustomFieldAction = recordCustomFieldAction;
+exports.recordMetafieldAction = recordMetafieldAction;
 const logging_1 = __importDefault(require("@tryghost/logging"));
 /**
  * Who is acting, read off an API frame's context.
  *
- * Here rather than in each endpoint, because two resources now record custom field history
+ * Here rather than in each endpoint, because two resources now record metafield history
  * and a second reading of the same shape is a second chance to disagree about it. An
  * integration and a user are both actors; a request that is neither — a webhook, a job —
  * has none, and the history says so rather than guessing.
@@ -36,7 +36,7 @@ const COMMANDS = {
     delete: 'deleted',
 };
 // Best-effort action-log write: a failed action must never fail the command that triggered it.
-async function recordCustomFieldAction({ Action, context, verb, subject, details, }) {
+async function recordMetafieldAction({ Action, context, verb, subject, details, }) {
     if (!context.actor) {
         return;
     }
@@ -55,12 +55,12 @@ async function recordCustomFieldAction({ Action, context, verb, subject, details
     }
     catch (err) {
         logging_1.default.error({
-            event: { name: 'members.custom_fields.action_log_failed' },
+            event: { name: 'members.metafields.action_log_failed' },
             err,
             verb,
             subject,
             actorType: context.actor.type,
             actorId: context.actor.id,
-        }, 'Failed to record a member custom field action');
+        }, 'Failed to record a member metafield action');
     }
 }

package/core/server/services/members-metafields/bindings-service.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MetafieldBindingsService = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const access_1 = require("./access");
+const schema_1 = require("./schema");
+const FIELDS_TABLE = 'members_metafields';
+const { CUSTOM_NAMESPACE } = require('@tryghost/metafield-types/identity');
+const BINDINGS_TABLE = 'members_metafield_bindings';
+/**
+ * Where a source sends what it collected: a `port` is the name that source uses for a
+ * thing, and the binding resolves it to one of the publisher's fields.
+ */
+class MetafieldBindingsService {
+    knex;
+    values;
+    constructor({ knex, values }) {
+        this.knex = knex;
+        this.values = values;
+    }
+    async bind(db, productId, port, metafieldKey, now) {
+        const existing = await db(BINDINGS_TABLE).where({ product_id: productId, port }).first();
+        if (existing?.metafield_key === metafieldKey) {
+            await db(BINDINGS_TABLE).where('id', existing.id).update({ updated_at: now });
+            return existing.id;
+        }
+        if (existing) {
+            await db(BINDINGS_TABLE).where('id', existing.id).del();
+        }
+        const bindingId = new bson_objectid_1.default().toHexString();
+        await db(BINDINGS_TABLE).insert({
+            id: bindingId,
+            product_id: productId,
+            port,
+            metafield_key: metafieldKey,
+            created_at: now,
+            updated_at: now,
+        });
+        return bindingId;
+    }
+    /** Stops the writing. Whatever hangs off the binding cascades with it. */
+    async remove(db, productId, port) {
+        await db(BINDINGS_TABLE).where({ product_id: productId, port }).del();
+    }
+    /**
+     * Values a processor collected on Ghost's behalf and sent back.
+     *
+     * Nobody supplied these in a sense the site can name — a payment page asked, and a
+     * machine reported the answers — so what is recorded against them is the binding that
+     * routed each one. That resolves back to the tier that asked, what it was collected
+     * as, and the field it landed in, which is everything worth knowing about how the
+     * value arrived.
+     */
+    async writeCollected(memberId, productId, collected) {
+        return this.writeThrough(memberId, productId, collected, (binding) => ({
+            type: 'binding',
+            id: binding.bindingId,
+        }));
+    }
+    /**
+     * Values a member supplied about themselves, through the same ports a checkout uses.
+     *
+     * A member typing their own address into a form is answerable for it in a way no
+     * routing is, and a record saying a binding wrote it would be wrong. The member is the
+     * one whose record this is, so there is nobody else it could be.
+     */
+    async writeSuppliedByMember(memberId, productId, supplied) {
+        return this.writeThrough(memberId, productId, supplied, () => ({
+            type: 'member',
+            id: memberId,
+        }));
+    }
+    /**
+     * Values arrive in the order they are to be applied: where two land in one field, the
+     * last of them is what the field holds.
+     *
+     * Every value is attempted, and then the first failure is raised. Attempting them all
+     * is this method's business: one refused answer must not cost a publisher the address
+     * a courier needs, and the values have nothing to do with each other beyond arriving
+     * together. Whether the failure is worth acting on is the caller's, which is why it
+     * leaves here rather than being logged and forgotten — a checkout webhook has already
+     * taken the money and must never fail, while a member filling in a form is owed the
+     * news.
+     */
+    async writeThrough(memberId, productId, values, attribute) {
+        let failure;
+        for (const { port, value } of values) {
+            try {
+                // Inside, because working out where a value goes can fail the same way storing
+                // it can, and a value nobody could place is no more reason to abandon the rest
+                // than one nobody could store.
+                const destination = await this.resolve(productId, port);
+                if (!destination) {
+                    continue;
+                }
+                await this.writeOne(memberId, destination, value, attribute);
+            }
+            catch (err) {
+                failure = failure ?? err;
+            }
+        }
+        if (failure) {
+            throw failure;
+        }
+    }
+    async writeOne(memberId, into, value, attribute) {
+        // Internal: what may be set is bounded by the binding rather than by who is
+        // looking. A port exists because a publisher pointed it at a field, and that
+        // decision is what admits the value, whoever supplied it.
+        const planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value }, access_1.INTERNAL);
+        await this.values.applyWrite(memberId, planned, { writtenBy: attribute(into) });
+    }
+    async resolve(productId, port) {
+        const row = await this.knex(BINDINGS_TABLE)
+            .join(FIELDS_TABLE, `${BINDINGS_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`)
+            .where(`${BINDINGS_TABLE}.product_id`, productId)
+            .where(`${BINDINGS_TABLE}.port`, port)
+            // An archived destination is still where this goes, and still not somewhere a value
+            // can land, so the write drops rather than waiting.
+            .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
+            .select(`${BINDINGS_TABLE}.id as binding_id`, `${FIELDS_TABLE}.key`, `${FIELDS_TABLE}.type`)
+            .first();
+        if (!row) {
+            return null;
+        }
+        // Decoded rather than trusted: a join is a read boundary, and `type` is what decides
+        // how the collected value is read. Unreadable counts as unresolved rather than
+        // throwing, so one bad row skips its value the way an unbound port does instead of
+        // failing everything else the same checkout collected.
+        const bound = schema_1.DbBoundField.safeParse(row);
+        if (!bound.success) {
+            logging_1.default.warn({
+                event: { name: 'members.metafields.binding_unreadable' },
+                err: bound.error,
+                productId,
+                port,
+            }, 'A binding could not be read');
+            return null;
+        }
+        return { bindingId: bound.data.binding_id, key: bound.data.key, type: bound.data.type };
+    }
+}
+exports.MetafieldBindingsService = MetafieldBindingsService;

package/core/server/services/{members-custom-fields → members-metafields}/codec.js

@@ -1,13 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.customFieldCodec = void 0;
+exports.metafieldCodec = void 0;
 const zod_1 = require("zod");
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const case_keys_1 = require("../../lib/case-keys");
 const schema_1 = require("./schema");
 const models_1 = require("./models");
-exports.customFieldCodec = zod_1.z.codec(schema_1.DbCustomField, models_1.CustomField, {
-    // DbCustomField validates `type` as the field-type enum, so the decoded row
+exports.metafieldCodec = zod_1.z.codec(schema_1.DbMetafield, models_1.Metafield, {
+    // DbMetafield validates `type` as the field-type enum, so the decoded row
     // already carries a FieldType and camelKeys preserves it — no cast needed.
     decode: (row) => ({ ...(0, case_keys_1.camelKeys)(row), namespace: identity_1.CUSTOM_NAMESPACE }),
     encode: ({ namespace: _namespace, ...field }) => (0, case_keys_1.snakeKeys)(field),

package/core/server/services/{members-custom-fields → members-metafields}/config.js

@@ -22,7 +22,7 @@ const Ceiling = zod_1.z
 // rather than restated. Parsed eagerly because a missing or malformed value
 // there is our bug rather than an operator's, and should fail loudly at boot
 // instead of quietly becoming the fallback for everything below.
-const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.customFields.maxDefinitions);
+const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.metafields.maxDefinitions);
 // A higher layer can override the shipped value with anything. Something
 // unreadable falls back to the shipped ceiling rather than throwing, because an
 // operator can correct this live and a bad value must not take the feature down

package/core/server/services/{members-custom-fields → members-metafields}/definitions-service.js

@@ -3,14 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomFieldDefinitionsService = void 0;
+exports.MetafieldDefinitionsService = void 0;
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const metafield_types_1 = require("@tryghost/metafield-types");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const codec_1 = require("./codec");
+const namespaces_1 = require("./namespaces");
 const schema_1 = require("./schema");
+const access_1 = require("./access");
 const queries_1 = require("./queries");
 const key_1 = require("./key");
 // The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to
@@ -18,7 +20,7 @@ const key_1 = require("./key");
 // turns that into parametrised WHERE clauses. Neither needs a Bookshelf model.
 const nql = require('@tryghost/nql');
 const knexify = require('@tryghost/mongo-knex');
-const TABLE = 'members_custom_fields';
+const TABLE = 'members_metafields';
 // Column limits come from the canonical schema — the same source the migration and
 // Bookshelf models read — so the service can never drift from the database. The
 // name cap turns an over-long input into a clean 422 (not a DB error), and the key
@@ -48,7 +50,7 @@ const FieldName = zod_1.z
 // The backend mints the key from the name, so create takes just a name and type.
 const AddFieldInput = zod_1.z.object({
     name: FieldName,
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
 });
 // A bound on the work one request can ask for, separate from how many definitions
 // a site may hold in total. Every definition in a batch costs several queries
@@ -77,9 +79,9 @@ const EditFieldInput = zod_1.z.object({
     name: FieldName.optional(),
     status: schema_1.FieldStatusSchema.optional(),
     key: zod_1.z.string().optional(),
-    type: custom_field_types_1.FieldTypeSchema.optional(),
+    type: metafield_types_1.FieldTypeSchema.optional(),
 });
-class CustomFieldDefinitionsService {
+class MetafieldDefinitionsService {
     knex;
     recordAction;
     getMaxDefinitions;
@@ -104,15 +106,7 @@ class CustomFieldDefinitionsService {
     isStored(namespace) {
         return namespace === identity_1.CUSTOM_NAMESPACE;
     }
-    assertDefinable(namespace) {
-        if (!this.isStored(namespace)) {
-            throw new errors_1.default.ValidationError({
-                message: `Fields cannot be defined in the "${namespace}" namespace.`,
-                property: 'namespace',
-            });
-        }
-    }
-    async browse(options = {}) {
+    async browse(options = {}, audience = access_1.ADMIN) {
         if (options.namespace !== undefined && !this.isStored(options.namespace)) {
             return [];
         }
@@ -126,7 +120,7 @@ class CustomFieldDefinitionsService {
         const query = options.filter
             ? applyFilter(this.knex(TABLE), options.filter)
             : (0, queries_1.activeFields)(this.knex);
-        return this.list(query);
+        return (0, access_1.readableFields)(audience, await this.list(query));
     }
     /**
      * Decode a definition query into the domain, in the publisher's order.
@@ -136,7 +130,7 @@ class CustomFieldDefinitionsService {
      */
     async list(query) {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
-        return rows.map((row) => zod_1.z.decode(codec_1.customFieldCodec, row));
+        return rows.map((row) => zod_1.z.decode(codec_1.metafieldCodec, row));
     }
     async read(namespace, key) {
         const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
@@ -156,7 +150,7 @@ class CustomFieldDefinitionsService {
      * key get distinct ones, exactly as if they had arrived as separate requests.
      */
     async add(context, namespace, input) {
-        this.assertDefinable(namespace);
+        (0, namespaces_1.assertDefinable)(namespace);
         const requestedCount = Array.isArray(input) ? input.length : 0;
         const parsed = AddFieldsInput.safeParse(input);
         if (!parsed.success) {
@@ -276,7 +270,7 @@ class CustomFieldDefinitionsService {
     /** `read` for a caller that is deciding rather than serving: absent is an answer. */
     async findByKey(key, { executor = this.knex } = {}) {
         const row = await executor(TABLE).where('key', key).first();
-        return row ? zod_1.z.decode(codec_1.customFieldCodec, row) : null;
+        return row ? zod_1.z.decode(codec_1.metafieldCodec, row) : null;
     }
     /** The same entry `add` writes. Only the caller knows its transaction committed. */
     async recordCreated(context, fields) {
@@ -335,7 +329,7 @@ class CustomFieldDefinitionsService {
      * Returns every definition, archived included, matching what the request named.
      */
     async reorder(context, namespace, input) {
-        this.assertDefinable(namespace);
+        (0, namespaces_1.assertDefinable)(namespace);
         const parsed = ReorderInput.safeParse(input);
         if (!parsed.success) {
             const issue = parsed.error.issues[0];
@@ -399,7 +393,7 @@ class CustomFieldDefinitionsService {
     async readMany(db, keys) {
         const rows = await db(TABLE).whereIn('key', keys).select('*');
         const byKey = new Map(rows.map((row) => [row.key, row]));
-        return keys.map((key) => zod_1.z.decode(codec_1.customFieldCodec, byKey.get(key)));
+        return keys.map((key) => zod_1.z.decode(codec_1.metafieldCodec, byKey.get(key)));
     }
     /**
      * Pick a free key from the name's base: `base`, then `base_2`, `base_3`, ...
@@ -551,7 +545,7 @@ class CustomFieldDefinitionsService {
         });
     }
 }
-exports.CustomFieldDefinitionsService = CustomFieldDefinitionsService;
+exports.MetafieldDefinitionsService = MetafieldDefinitionsService;
 /**
  * The shape a stated key has to have. Minting derives one that is usable by
  * construction, so this is the check that path never needed: a caller stating its own

package/core/server/services/{members-custom-fields → members-metafields}/filter.js

@@ -3,8 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOM_FIELDS_RELATION = void 0;
-exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransformer;
+exports.METAFIELDS_RELATION = void 0;
+exports.createMetafieldsFilterTransformer = createMetafieldsFilterTransformer;
 // Translates the metafield clauses of a members filter into a query over the
 // values table. A metafield is a publisher-defined field on a member; it is
 // addressed as `namespace.key`, and a composite value such as an address names
@@ -15,13 +15,13 @@ exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransforme
 //   metafields.key:'custom.company'                     // has a value
 //   metafields.key:-'custom.shipping_address.country'   // that part is not set
 //
-// The values table holds one row per stored value: `custom_field_key`, `path`
+// The values table holds one row per stored value: `metafield_key`, `path`
 // (empty for a plain field, the part's name for one part of a composite) and
 // `value_text`. A filter addresses those columns directly, so each one becomes a
 // single $elemMatch over them — positive asserts a matching row exists, $not
 // asserts none does — with no lookup against the field definitions.
 const errors_1 = __importDefault(require("@tryghost/errors"));
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const RELATION = 'metafields';
 const PREFIX = `${RELATION}.`;
 const KEY_ATTRIBUTE = `${PREFIX}key`;
@@ -78,11 +78,11 @@ function parseLeafAddress(raw) {
     }
     return { key: identity.key, path: identity.partPath };
 }
-function createCustomFieldsFilterTransformer() {
+function createMetafieldsFilterTransformer() {
     // One (maybe-negated) $elemMatch over the leaf columns: positive is "a leaf pinned
     // by these matches", `$not` is "no leaf does".
     function buildElemMatch(target, value, negate) {
-        const match = { custom_field_key: target.key };
+        const match = { metafield_key: target.key };
         if (value !== undefined) {
             match.path = target.path ?? ROOT_PATH;
             match.value_text = value;
@@ -167,14 +167,14 @@ function createCustomFieldsFilterTransformer() {
     return (query) => transform(query);
 }
 /**
- * The Member filter relation that exposes custom field values. A member has many leaf
+ * The Member filter relation that exposes metafield values. A member has many leaf
  * rows (one per field, or per part of a composite field), and a predicate asks whether
  * one of them matches, so this joins the values table on member_id and mongo-knex emits
  * it as a correlated `members.id IN (…)` subquery — composing with every other member
  * filter.
  */
-exports.CUSTOM_FIELDS_RELATION = {
-    tableName: 'members_custom_field_values',
+exports.METAFIELDS_RELATION = {
+    tableName: 'members_metafield_values',
     tableNameAs: RELATION,
     type: 'oneToOne',
     joinFrom: 'member_id',

package/core/server/services/{members-custom-fields → members-metafields}/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bindings = exports.values = exports.definitions = exports.actingContext = void 0;
+exports.bindings = exports.values = exports.definitions = exports.readableFields = exports.canWrite = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
@@ -9,6 +9,15 @@ const actions_1 = require("./actions");
 const config_1 = require("./config");
 var actions_2 = require("./actions");
 Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
+// Which door a request came through, which is what decides how much of a member's
+// answers it may see or change. Required wherever that is asked, so a new caller
+// has to name itself rather than inherit an answer by default.
+var access_1 = require("./access");
+Object.defineProperty(exports, "ADMIN", { enumerable: true, get: function () { return access_1.ADMIN; } });
+Object.defineProperty(exports, "INTERNAL", { enumerable: true, get: function () { return access_1.INTERNAL; } });
+Object.defineProperty(exports, "MEMBERS", { enumerable: true, get: function () { return access_1.MEMBERS; } });
+Object.defineProperty(exports, "canWrite", { enumerable: true, get: function () { return access_1.canWrite; } });
+Object.defineProperty(exports, "readableFields", { enumerable: true, get: function () { return access_1.readableFields; } });
 function init() {
     // The three are constructed together below, so checking all of them keeps the "all or
     // none" invariant explicit rather than trusting one to stand in for the rest.
@@ -17,25 +26,25 @@ function init() {
     }
     const { knex } = require('../../data/db');
     const models = require('../../models');
-    const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordCustomFieldAction)({ Action: models.Action, context, verb, subject, details });
+    const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordMetafieldAction)({ Action: models.Action, context, verb, subject, details });
     // Resolved here, not in the service: reading config is this module's job, and
     // the service is handed a number. A getter rather than a value because the
     // ceiling is an operator setting that can change between requests, and a Ghost
     // container holds no state across them.
     const config = require('../../../shared/config');
-    exports.definitions = new definitions_service_1.CustomFieldDefinitionsService({
+    exports.definitions = new definitions_service_1.MetafieldDefinitionsService({
         knex,
         recordAction,
-        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:metafields:maxDefinitions')),
     });
     // The values service reads the field definitions straight from the table, so
     // it needs knex and the same ceiling — no handle on the definitions service.
-    exports.values = new values_service_1.CustomFieldValuesService({
+    exports.values = new values_service_1.MetafieldValuesService({
         knex,
-        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:metafields:maxDefinitions')),
     });
     // Built after the values, which is what a binding routes into. It has no handle on the
     // definitions: making a field is not part of binding to one, so a caller that needs both
     // asks for both.
-    exports.bindings = new bindings_service_1.CustomFieldBindingsService({ knex, values: exports.values });
+    exports.bindings = new bindings_service_1.MetafieldBindingsService({ knex, values: exports.values });
 }

package/core/server/services/{members-custom-fields → members-metafields}/key.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KEY_CHARACTERS = void 0;
 exports.mintableKey = mintableKey;
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const identity_1 = require("@tryghost/metafield-types/identity");
 // Neither package ships types.
 const { stripInvisibleChars } = require('@tryghost/string');
 const unidecode = require('unidecode');

package/core/server/services/{members-custom-fields → members-metafields}/models.js

@@ -1,15 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomField = void 0;
+exports.Metafield = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 const schema_1 = require("./schema");
-exports.CustomField = zod_1.z.object({
+exports.Metafield = zod_1.z.object({
     id: zod_1.z.string(),
     namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     status: schema_1.FieldStatusSchema,
     createdAt: zod_1.z.date(),
     updatedAt: zod_1.z.date().nullable(),

package/core/server/services/members-metafields/namespaces.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.definableByPublisher = definableByPublisher;
+exports.assertDefinable = assertDefinable;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const identity_1 = require("@tryghost/metafield-types/identity");
+/**
+ * Who may define fields in a namespace.
+ *
+ * This is a property of the namespace, not of whoever is asking, so it is settled before
+ * any question about the caller. Asking the caller first gets the order wrong in a way
+ * that shows: a request to define a field in a namespace nobody owns would be refused for
+ * want of a permission, telling the caller to go and get one, when no permission would
+ * have helped.
+ *
+ * The publisher owns `custom` and nothing owns anything else yet. An app owning its own
+ * namespace resolves here too, and will not resolve to a permission at all: the caller
+ * has to *be* that app rather than hold a role, which is why the staff permission stays
+ * named after the publisher's fields rather than after metafields at large.
+ */
+function definableByPublisher(namespace) {
+    return namespace === identity_1.CUSTOM_NAMESPACE;
+}
+function assertDefinable(namespace) {
+    if (!definableByPublisher(namespace)) {
+        throw new errors_1.default.ValidationError({
+            message: `Fields cannot be defined in the "${namespace}" namespace.`,
+            property: 'namespace',
+        });
+    }
+}

package/core/server/services/{members-custom-fields → members-metafields}/queries.js

@@ -4,7 +4,7 @@ exports.activeFields = activeFields;
 exports.fieldByKey = fieldByKey;
 exports.inFieldOrder = inFieldOrder;
 const schema_1 = require("./schema");
-const FIELDS_TABLE = 'members_custom_fields';
+const FIELDS_TABLE = 'members_metafields';
 // Archived fields must stay out of every read and write, and nothing in the database
 // enforces that — no constraint stops a value row referencing an archived field. A query
 // that forgets the filter is a silent bug, so the filter lives in one place.

package/core/server/services/{members-custom-fields → members-metafields}/schema.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbBoundField = exports.DbCustomFieldBinding = exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.WrittenBy = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 const date_1 = require("../../lib/db-types/date");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
@@ -11,11 +11,11 @@ exports.FIELD_STATUS = { active: 'active', archived: 'archived' };
 exports.FieldStatusSchema = zod_1.z.enum([exports.FIELD_STATUS.active, exports.FIELD_STATUS.archived]);
 // The single source for the read projection and the knex table type below. `type` parses
 // as the field-type enum, so the row carries the narrow type and no codec needs a cast.
-exports.DbCustomField = zod_1.z.object({
+exports.DbMetafield = zod_1.z.object({
     id: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
@@ -23,7 +23,7 @@ exports.DbCustomField = zod_1.z.object({
 /**
  * How a value arrived, not who caused it: who edited a member's fields is already an
  * action, and Stripe is not a person. `type` is the namespace that makes `id` resolvable —
- * `users`, `integrations`, `members_custom_field_bindings` — so the one writer that
+ * `users`, `integrations`, `members_metafield_bindings` — so the one writer that
  * resolves in no table is the one with no id to give.
  */
 exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
@@ -31,12 +31,16 @@ exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
     zod_1.z.object({ type: zod_1.z.literal('integration'), id: zod_1.z.string() }),
     zod_1.z.object({ type: zod_1.z.literal('binding'), id: zod_1.z.string() }),
     zod_1.z.object({ type: zod_1.z.literal('import'), id: zod_1.z.null() }),
+    // A member writing their own answers. Resolvable in `members`, like the others,
+    // and the only writer whose changes leave nothing in the staff action log: that
+    // log records what staff did.
+    zod_1.z.object({ type: zod_1.z.literal('member'), id: zod_1.z.string() }),
 ]);
 // One part of a member's value. What a `path` means is storage.ts's business, so the row
 // carries it as a plain string.
-exports.DbCustomFieldValue = zod_1.z.object({
+exports.DbMetafieldValue = zod_1.z.object({
     id: zod_1.z.string(),
-    custom_field_key: zod_1.z.string(),
+    metafield_key: zod_1.z.string(),
     member_id: zod_1.z.string(),
     path: zod_1.z.string(),
     // Nullable like the column, though nothing here writes a null: a part with no value
@@ -55,18 +59,18 @@ exports.DbCustomFieldValue = zod_1.z.object({
 // `type` takes no part in the assembly and is here as a gate: a value whose type has left
 // the catalog is one the definitions list no longer returns either, so failing to parse
 // is what drops it.
-exports.DbCustomFieldLeaf = zod_1.z.object({
+exports.DbMetafieldLeaf = zod_1.z.object({
     member_id: zod_1.z.string(),
     key: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     path: zod_1.z.string(),
     value_text: zod_1.z.string(),
 });
-exports.DbCustomFieldBinding = zod_1.z.object({
+exports.DbMetafieldBinding = zod_1.z.object({
     id: zod_1.z.string(),
     product_id: zod_1.z.string(),
     port: zod_1.z.string(),
-    custom_field_key: zod_1.z.string(),
+    metafield_key: zod_1.z.string(),
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
 });
@@ -74,5 +78,5 @@ exports.DbCustomFieldBinding = zod_1.z.object({
 exports.DbBoundField = zod_1.z.object({
     binding_id: zod_1.z.string(),
     key: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
 });

package/core/server/services/{members-custom-fields → members-metafields}/serializers.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toCustomFieldsResponse = void 0;
+exports.toMetafieldsResponse = void 0;
 const zod_1 = require("zod");
 const case_keys_1 = require("../../lib/case-keys");
 const models_1 = require("./models");
-const CustomFieldResource = zod_1.z.object({
+const MetafieldResource = zod_1.z.object({
     namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
@@ -13,10 +13,10 @@ const CustomFieldResource = zod_1.z.object({
     created_at: zod_1.z.date(),
     updated_at: zod_1.z.date().nullable(),
 });
-const CustomFieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(CustomFieldResource) });
-exports.toCustomFieldsResponse = zod_1.z
-    .array(models_1.CustomField)
+const MetafieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(MetafieldResource) });
+exports.toMetafieldsResponse = zod_1.z
+    .array(models_1.Metafield)
     .transform((fields) => ({
     members_metafields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
 }))
-    .pipe(CustomFieldsResponse);
+    .pipe(MetafieldsResponse);