ghost 6.62.0 → 6.63.0

package/core/server/web/api/endpoints/admin/routes.js

@@ -521,6 +521,7 @@ module.exports = function apiRoutes() {
   // ## Emails
   router.get('/emails', mw.authAdminApi, http(api.emails.browse));
   router.get('/emails/:id', mw.authAdminApi, http(api.emails.read));
+  router.get('/emails/:id/status', mw.authAdminApi, http(api.emails.sendingStatus));
   router.put('/emails/:id/retry', mw.authAdminApi, http(api.emails.retry));
   router.get('/emails/:id/batches', mw.authAdminApi, http(api.emails.browseBatches));
   router.get('/emails/:id/recipient-failures', mw.authAdminApi, http(api.emails.browseFailures));

package/core/server/web/members/account/index.js

@@ -0,0 +1,2 @@
+"use strict";
+module.exports = require('./routes');

package/core/server/web/members/account/routes.js

@@ -0,0 +1,46 @@
+"use strict";
+const express = require('../../../../shared/express');
+const bodyParser = require('body-parser');
+const config = require('../../../../shared/config');
+const { http } = require('@tryghost/api-framework');
+const api = require('../../../api').endpoints;
+const middleware = require('../../../services/members/middleware');
+/**
+ * A member's own account, over HTTP.
+ *
+ * Everything reached by a signed-in member acting on their own record lives here,
+ * so how these routes authenticate is a property of the module rather than a line
+ * each one repeats. Establishing who is asking happens once; each route then says
+ * what it wants done when there is nobody.
+ *
+ * Endpoints reached by someone who is not signed in stay outside this: the
+ * unsubscribe links identify a member by a signed link, and changing an email
+ * address by a token in the body, because in both cases the person following them
+ * has no session.
+ */
+module.exports = function accountRoutes() {
+    const router = express.Router('member-account');
+    router.use(middleware.loadMemberIdentity);
+    // Reading who you are. Answering with nothing when there is no member is the
+    // right answer rather than a failure: a themed page asks this on every view.
+    if (config.get('cacheMembersContent:enabled')) {
+        router.get('/', 
+        // Not for this route's benefit. This configuration stamps a cookie saying
+        // what the reader is entitled to, so a cache can vary on it, and that needs
+        // the member's subscriptions rather than only their identity. It rides here
+        // because Portal asks this endpoint on every page load.
+        middleware.loadMemberSession, middleware.accessInfoSession, middleware.emptyWhenAnonymous, http(api.membersAccount.read));
+    }
+    else {
+        router.get('/', middleware.emptyWhenAnonymous, http(api.membersAccount.read));
+    }
+    router.put('/', bodyParser.json({ limit: '50mb' }), middleware.rejectWhenAnonymous, http(api.membersAccount.update));
+    // The fields a publisher has defined, which a member's client renders inputs
+    // from. Under the account because a member reads them to fill in their own, and
+    // refused to an unknown caller because what a publisher collects is their
+    // configuration rather than something the site announces.
+    router.get('/metafields/:namespace', middleware.rejectWhenAnonymous, http(api.memberMetafieldsMembers.browse));
+    // Letting Ghost email this member again after it stopped.
+    router.delete('/suppression', middleware.rejectWhenAnonymous, http(api.membersAccount.destroySuppression));
+    return router;
+};

package/core/server/web/members/app.js

@@ -8,10 +8,10 @@ const audienceFeedbackService = require('../../services/audience-feedback');
 const middleware = membersService.middleware;
 const shared = require('../shared');
 const errorHandler = require('@tryghost/mw-error-handler');
-const config = require('../../../shared/config');
 const { http } = require('@tryghost/api-framework');
 const api = require('../../api').endpoints;
 
+const accountRoutes = require('./account');
 const commentRouter = require('../comments');
 const announcementRouter = require('../announcement');
 const corsMiddleware = require('./middleware/cors');
@@ -57,21 +57,9 @@ module.exports = function setupMembersApp() {
     middleware.updateMemberNewsletters,
   );
 
-  // Get and update member data
-  // Caching members content is an experimental feature
-  const shouldCacheMembersContent = config.get('cacheMembersContent:enabled');
-  if (shouldCacheMembersContent) {
-    membersApp.get(
-      '/api/member',
-      middleware.loadMemberSession,
-      middleware.accessInfoSession,
-      middleware.getMemberData,
-    );
-  } else {
-    membersApp.get('/api/member', middleware.getMemberData);
-  }
-
-  membersApp.put('/api/member', bodyParser.json({ limit: '50mb' }), middleware.updateMemberData);
+  // A member's own account. Its routes and how they authenticate live together.
+  membersApp.use('/api/member', accountRoutes());
+
   membersApp.post('/api/member/email', bodyParser.json({ limit: '50mb' }), (req, res, next) =>
     membersService.api.middleware.updateEmailAddress(req, res, next),
   );
@@ -86,8 +74,6 @@ module.exports = function setupMembersApp() {
   );
 
   // Remove email from suppression list
-  membersApp.delete('/api/member/suppression', middleware.deleteSuppression);
-
   // Manage session
   membersApp.get('/api/session', middleware.getIdentityToken);
   membersApp.delete('/api/session', bodyParser.json({ limit: '5mb' }), middleware.deleteSession);

package/core/shared/config/defaults.json

@@ -80,7 +80,7 @@
   "members": {
     "contentApiAccess": [],
     "paymentProcessors": [],
-    "customFields": {
+    "metafields": {
       "maxDefinitions": 100
     },
     "importer": {

package/core/shared/labs.js

@@ -27,7 +27,7 @@ const messages = {
 };
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
-const GA_FEATURES = ['automationAnalytics', 'giftSubCustomization', 'tagDetailsReact'];
+const GA_FEATURES = ['automationAnalytics', 'tagDetailsReact'];
 
 // These features are considered publicly available and can be enabled/disabled by users
 const PUBLIC_BETA_FEATURES = [
@@ -42,13 +42,14 @@ const PUBLIC_BETA_FEATURES = [
 const PRIVATE_FEATURES = [
   'automations',
   'automationRunAnalytics',
+  'automationsTinybirdSync',
   'stripeAutomaticTax',
   'importMemberTier',
   'csvContentImporter',
   'adminUIRefresh',
-  'admin7PageChrome',
   'tagsX',
   'emailUniqueid',
+  'improveSendingUI',
   'themeTranslation',
   'pictureImageFormats',
   'getHelperDeduplication',
@@ -59,6 +60,7 @@ const PRIVATE_FEATURES = [
   'selfServeArchives',
   'machinePayments',
   'postsListReact',
+  'editorReact',
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.62.0",
+  "version": "6.63.0",
   "description": "The professional publishing platform",
   "keywords": [
     "blog",
@@ -57,19 +57,18 @@
     "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.3.tgz",
     "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.3.tgz",
     "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
-    "@tryghost/api-framework": "3.3.9",
-    "@tryghost/bookshelf-plugins": "2.3.8",
+    "@tryghost/api-framework": "3.3.12",
+    "@tryghost/bookshelf-plugins": "2.3.12",
     "@tryghost/brute-knex": "3.2.2",
     "@tryghost/checkout": "file:components/tryghost-checkout-0.0.0.tgz",
     "@tryghost/color-utils": "0.2.20",
     "@tryghost/config-url-helpers": "1.0.27",
-    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
     "@tryghost/custom-fonts": "1.0.11",
-    "@tryghost/database-info": "2.3.2",
-    "@tryghost/debug": "2.3.9",
-    "@tryghost/domain-events": "3.3.10",
-    "@tryghost/email-mock-receiver": "2.1.0",
-    "@tryghost/errors": "3.3.9",
+    "@tryghost/database-info": "2.3.12",
+    "@tryghost/debug": "2.3.12",
+    "@tryghost/domain-events": "3.3.13",
+    "@tryghost/email-mock-receiver": "2.3.12",
+    "@tryghost/errors": "3.3.12",
     "@tryghost/helpers": "1.1.106",
     "@tryghost/html-to-plaintext": "1.0.11",
     "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
@@ -82,32 +81,33 @@
     "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.4.0.tgz",
     "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz",
     "@tryghost/kg-markdown-html-renderer": "file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz",
-    "@tryghost/limit-service": "1.5.6",
-    "@tryghost/logging": "5.4.0",
-    "@tryghost/metrics": "3.5.0",
+    "@tryghost/limit-service": "file:components/tryghost-limit-service-0.0.0.tgz",
+    "@tryghost/logging": "5.4.3",
+    "@tryghost/metafield-types": "file:components/tryghost-metafield-types-0.0.0.tgz",
+    "@tryghost/metrics": "3.5.3",
     "@tryghost/mg-clean-html": "0.12.6",
     "@tryghost/mongo-knex": "0.11.2",
     "@tryghost/mongo-utils": "0.6.5",
     "@tryghost/mw-error-handler": "1.0.13",
     "@tryghost/mw-vhost": "1.0.6",
-    "@tryghost/nodemailer": "2.3.1",
+    "@tryghost/nodemailer": "2.3.12",
     "@tryghost/nql": "0.13.4",
     "@tryghost/nql-lang": "0.7.0",
     "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
     "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
-    "@tryghost/pretty-cli": "3.3.2",
+    "@tryghost/pretty-cli": "3.3.12",
     "@tryghost/prometheus-metrics": "1.0.8",
     "@tryghost/referrer-parser": "0.1.21",
-    "@tryghost/request": "4.0.3",
-    "@tryghost/root-utils": "2.3.2",
+    "@tryghost/request": "4.0.5",
+    "@tryghost/root-utils": "2.3.12",
     "@tryghost/security": "1.0.6",
     "@tryghost/social-urls": "0.1.63",
     "@tryghost/string": "0.3.5",
-    "@tryghost/tpl": "2.3.9",
+    "@tryghost/tpl": "2.3.12",
     "@tryghost/url-utils": "5.2.6",
-    "@tryghost/validator": "3.2.10",
-    "@tryghost/version": "2.3.2",
-    "@tryghost/zip": "3.5.1",
+    "@tryghost/validator": "3.2.12",
+    "@tryghost/version": "2.3.12",
+    "@tryghost/zip": "3.5.11",
     "@x402/core": "2.12.0",
     "@x402/evm": "2.12.0",
     "@x402/hono": "2.12.0",
@@ -223,8 +223,8 @@
   },
   "engines": {
     "cli": "^1.29.1",
-    "node": "^22.23.1"
+    "node": "^22.23.1 || ^24.20.0"
   },
   "scripts": {},
-  "packageManager": "pnpm@12.2.1+sha512.f55ca68aacb9eb5ab69c66f828a98af89a32286703aef1f8da131ca7eab4d677f34bfa85e186467a919c0799df8b6f4aa240f7dc2919b33b3273190104162616"
+  "packageManager": "pnpm@12.4.0+sha512.37536c26ed40ab4134b6511e09f6b27f3ebb45687468f2406ca3805279a4e5ca158c1931350ad9774d6ab2108d71b3dbaeb39943159294375e4d053e8e05685c"
 }