ghost 6.62.0 → 6.64.0

package/core/server/api/endpoints/utils/api-filter-utils.js

@@ -3,27 +3,238 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiBulkFilterTransformer = exports.rejectAdminApiRestrictedFieldsTransformer = exports.rejectNewslettersContentApiRestrictedFieldsTransformer = exports.rejectPagesContentApiRestrictedFieldsTransformer = exports.rejectPostsContentApiRestrictedFieldsTransformer = exports.rejectTagsContentApiRestrictedFieldsTransformer = exports.rejectAuthorsContentApiRestrictedFieldsTransformer = exports.rejectContentApiRestrictedFieldsTransformer = void 0;
+exports.validateAdminApiRestrictedOrderFields = validateAdminApiRestrictedOrderFields;
+exports.restrictAdminApiQueryOptions = restrictAdminApiQueryOptions;
+exports.rejectAuthorsRestrictedOrderFields = rejectAuthorsRestrictedOrderFields;
+exports.rejectTagsRestrictedOrderFields = rejectTagsRestrictedOrderFields;
+exports.rejectPostsContentApiRestrictedOrderFields = rejectPostsContentApiRestrictedOrderFields;
+exports.rejectPagesContentApiRestrictedOrderFields = rejectPagesContentApiRestrictedOrderFields;
+exports.rejectNewslettersContentApiRestrictedOrderFields = rejectNewslettersContentApiRestrictedOrderFields;
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const mongo_utils_1 = require("@tryghost/mongo-utils");
-const CONTENT_API_RESTRICTED_FIELDS = new Set(['password', 'email']);
-const ADMIN_API_RESTRICTED_FIELDS = new Set(['password']);
+const schema = require('../../../data/schema').tables;
+// Never filterable or orderable through the Content API, on any resource or relation.
+const CONTENT_API_RESTRICTED_FIELDS = new Set([
+    'password',
+    'email',
+    'email_only',
+    'html',
+    'lexical',
+    'locale',
+    'mobiledoc',
+    'newsletter_id',
+    'plaintext',
+    'email_recipient_filter',
+    'published_by',
+]);
+const CONTENT_API_RESTRICTED_RELATIONS = new Set(['mobiledoc_revisions', 'post_revisions']);
+const CONTENT_API_PAGE_RESTRICTED_FIELDS = new Set(['email_subject']);
+const CONTENT_API_POST_RESTRICTED_FIELDS = new Set(['show_title_and_feature_image']);
+const CONTENT_API_NEWSLETTER_FIELDS = new Set([
+    'id',
+    'uuid',
+    'name',
+    'description',
+    'slug',
+    'sender_email',
+    'subscribe_on_signup',
+    'visibility',
+    'sort_order',
+    'created_at',
+    'updated_at',
+]);
+// User fields and relations the Content API does not expose: blocked as bare fields on authors and via author relations elsewhere.
+// Not blocked as bare fields on other resources, where visibility/status are legitimate filters.
+const CONTENT_API_USER_RESTRICTED_FIELDS = new Set([
+    'status',
+    'last_seen',
+    'created_at',
+    'updated_at',
+    'roles',
+    'roles_users',
+    'visibility',
+    'locale',
+    'accessibility',
+    'paid_subscription_started_notification',
+    'paid_subscription_canceled_notification',
+    'tour',
+    'comment_notifications',
+    'recommendation_notifications',
+    'gift_subscription_notifications',
+    'mention_notifications',
+    'donation_notifications',
+    'milestone_notifications',
+    'free_member_signup_notification',
+]);
+const CONTENT_API_AUTHOR_RELATIONS = new Set(['author', 'authors', 'primary_author']);
+const CONTENT_API_TAG_RESTRICTED_FIELDS = new Set([
+    'created_at',
+    'updated_at',
+    'parent_id',
+    'parent',
+]);
+const CONTENT_API_TAG_RELATIONS = new Set(['tag', 'tags', 'primary_tag']);
+// Columns Ghost deliberately withholds from every Admin API response. `filter` and
+// `order` are both compiled to SQL against the raw table, so a column hidden from
+// output is still usable as an oracle unless it is blocked on the way in.
+const ADMIN_API_RESTRICTED_FIELDS = new Set(['password', 'token', 'gift_link_token', 'secret']);
+function getOrderAttributes(tableName) {
+    return Object.keys(schema[tableName])
+        .map((field) => `${tableName}.${field}`)
+        .filter((field) => !field.includes('@@'));
+}
+const CONTENT_API_AUTHOR_ORDER_ATTRIBUTES = getOrderAttributes('users');
+const CONTENT_API_TAG_ORDER_ATTRIBUTES = getOrderAttributes('tags');
+const CONTENT_API_NEWSLETTER_ORDER_ATTRIBUTES = getOrderAttributes('newsletters');
+const CONTENT_API_POST_ORDER_ATTRIBUTES = [
+    ...getOrderAttributes('posts'),
+    ...getOrderAttributes('posts_meta').filter((field) => !['posts_meta.id', 'posts_meta.post_id'].includes(field)),
+];
 function hasRestrictedSegment(key, fields) {
     return key
         .toLowerCase()
         .split('.')
         .some((segment) => fields.has(segment));
 }
+function hasRestrictedUserSegment(key) {
+    const segments = key.toLowerCase().split('.');
+    return segments.some((segment, index) => index > 0 &&
+        CONTENT_API_AUTHOR_RELATIONS.has(segments[index - 1]) &&
+        CONTENT_API_USER_RESTRICTED_FIELDS.has(segment));
+}
+function hasRestrictedTagSegment(key) {
+    const segments = key.toLowerCase().split('.');
+    return segments.some((segment, index) => index > 0 &&
+        CONTENT_API_TAG_RELATIONS.has(segments[index - 1]) &&
+        CONTENT_API_TAG_RESTRICTED_FIELDS.has(segment));
+}
+function isAdminApiRestrictedKey(key) {
+    return hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS);
+}
+function isContentApiRestrictedKey(key) {
+    return (hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS) ||
+        hasRestrictedSegment(key, CONTENT_API_RESTRICTED_RELATIONS) ||
+        hasRestrictedUserSegment(key) ||
+        hasRestrictedTagSegment(key));
+}
+function isAuthorsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_USER_RESTRICTED_FIELDS));
+}
+function isTagsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_TAG_RESTRICTED_FIELDS));
+}
+function isPostsContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_POST_RESTRICTED_FIELDS));
+}
+function isPagesContentApiRestrictedKey(key) {
+    return (isContentApiRestrictedKey(key) || hasRestrictedSegment(key, CONTENT_API_PAGE_RESTRICTED_FIELDS));
+}
+function isNewslettersContentApiRestrictedKey(key) {
+    const normalizedKey = key.toLowerCase();
+    const fieldKey = normalizedKey.startsWith('newsletters.')
+        ? normalizedKey.slice('newsletters.'.length)
+        : normalizedKey;
+    return !CONTENT_API_NEWSLETTER_FIELDS.has(fieldKey);
+}
+function rejectRestrictedOrderFields(order, orderAttributes, isRestricted) {
+    if (!order) {
+        return order;
+    }
+    const allowedClauses = (Array.isArray(order) ? order : [order])
+        .flatMap((value) => value.split(','))
+        .map((clause) => clause.trim())
+        .filter(Boolean)
+        .filter((clause) => {
+        const [field] = clause.split(/\s+/);
+        const normalizedField = field.toLowerCase();
+        const resolvedField = orderAttributes.find((orderAttribute) => orderAttribute.endsWith(normalizedField)) ||
+            normalizedField;
+        return !isRestricted(resolvedField);
+    });
+    return allowedClauses.length ? allowedClauses.join(',') : undefined;
+}
 const rejectContentApiRestrictedFieldsTransformer = (input) => {
-    return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, CONTENT_API_RESTRICTED_FIELDS));
+    return (0, mongo_utils_1.rejectStatements)(input, isContentApiRestrictedKey);
 };
 exports.rejectContentApiRestrictedFieldsTransformer = rejectContentApiRestrictedFieldsTransformer;
+const rejectAuthorsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isAuthorsContentApiRestrictedKey);
+};
+exports.rejectAuthorsContentApiRestrictedFieldsTransformer = rejectAuthorsContentApiRestrictedFieldsTransformer;
+const rejectTagsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isTagsContentApiRestrictedKey);
+};
+exports.rejectTagsContentApiRestrictedFieldsTransformer = rejectTagsContentApiRestrictedFieldsTransformer;
+const rejectPostsContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isPostsContentApiRestrictedKey);
+};
+exports.rejectPostsContentApiRestrictedFieldsTransformer = rejectPostsContentApiRestrictedFieldsTransformer;
+const rejectPagesContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isPagesContentApiRestrictedKey);
+};
+exports.rejectPagesContentApiRestrictedFieldsTransformer = rejectPagesContentApiRestrictedFieldsTransformer;
+const rejectNewslettersContentApiRestrictedFieldsTransformer = (input) => {
+    return (0, mongo_utils_1.rejectStatements)(input, isNewslettersContentApiRestrictedKey);
+};
+exports.rejectNewslettersContentApiRestrictedFieldsTransformer = rejectNewslettersContentApiRestrictedFieldsTransformer;
 const rejectAdminApiRestrictedFieldsTransformer = (input) => {
-    return (0, mongo_utils_1.rejectStatements)(input, (key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    return (0, mongo_utils_1.rejectStatements)(input, isAdminApiRestrictedKey);
 };
 exports.rejectAdminApiRestrictedFieldsTransformer = rejectAdminApiRestrictedFieldsTransformer;
+/**
+ * `@tryghost/bookshelf-order` resolves an order field to the first order
+ * attribute that ends with it, so `word` sorts by `users.password` and `oken`
+ * by `invites.token`. An unqualified field is therefore restricted when it is a
+ * suffix of any restricted column name. A qualified field can only match a
+ * whole column name after the dot, so its segments are checked exactly.
+ */
+function isAdminApiRestrictedOrderField(field) {
+    const normalizedField = field.toLowerCase();
+    if (normalizedField.includes('.')) {
+        return isAdminApiRestrictedKey(normalizedField);
+    }
+    return [...ADMIN_API_RESTRICTED_FIELDS].some((restrictedField) => restrictedField.endsWith(normalizedField));
+}
+/**
+ * Every schema column is orderable by default (see the base model's
+ * `orderAttributes`), so `order` reaches the SQL `ORDER BY` clause untouched.
+ * Sorting by a withheld column leaks its relative byte ordering, which the
+ * `filter` guard alone does not prevent.
+ */
+function validateAdminApiRestrictedOrderFields(order) {
+    if (!order) {
+        return order;
+    }
+    const restrictedField = (Array.isArray(order) ? order : [order])
+        .flatMap((value) => String(value).split(','))
+        .map((clause) => clause.trim().split(/\s+/)[0])
+        .filter(Boolean)
+        .find(isAdminApiRestrictedOrderField);
+    if (restrictedField) {
+        throw new errors_1.default.BadRequestError({
+            message: 'Restricted fields cannot be used in order.',
+        });
+    }
+    return order;
+}
+/**
+ * Applies the Admin API restricted-field guard to the query options of a single
+ * endpoint. Both client-supplied query surfaces have to be covered: `filter`
+ * compiles to `WHERE` and `order` to `ORDER BY`, and each is an independent
+ * oracle over columns the serializers strip from the response.
+ */
+function restrictAdminApiQueryOptions(options) {
+    validateAdminApiRestrictedOrderFields(options.order);
+    return {
+        ...options,
+        mongoTransformer: options.mongoTransformer
+            ? (0, mongo_utils_1.chainTransformers)(options.mongoTransformer, exports.rejectAdminApiRestrictedFieldsTransformer)
+            : exports.rejectAdminApiRestrictedFieldsTransformer,
+    };
+}
 const validateAdminApiBulkFilterTransformer = (input) => {
-    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find((key) => hasRestrictedSegment(key, ADMIN_API_RESTRICTED_FIELDS));
+    const restrictedField = (0, mongo_utils_1.getUsedKeys)(input).find(isAdminApiRestrictedKey);
     if (restrictedField) {
         throw new errors_1.default.BadRequestError({
             message: 'Restricted fields cannot be used in bulk operation filters.',
@@ -32,3 +243,18 @@ const validateAdminApiBulkFilterTransformer = (input) => {
     return input;
 };
 exports.validateAdminApiBulkFilterTransformer = validateAdminApiBulkFilterTransformer;
+function rejectAuthorsRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_AUTHOR_ORDER_ATTRIBUTES, isAuthorsContentApiRestrictedKey);
+}
+function rejectTagsRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_TAG_ORDER_ATTRIBUTES, isTagsContentApiRestrictedKey);
+}
+function rejectPostsContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_POST_ORDER_ATTRIBUTES, isPostsContentApiRestrictedKey);
+}
+function rejectPagesContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_POST_ORDER_ATTRIBUTES, isPagesContentApiRestrictedKey);
+}
+function rejectNewslettersContentApiRestrictedOrderFields(order) {
+    return rejectRestrictedOrderFields(order, CONTENT_API_NEWSLETTER_ORDER_ATTRIBUTES, isNewslettersContentApiRestrictedKey);
+}

package/core/server/api/endpoints/utils/public-cache-keys.js

@@ -27,6 +27,9 @@ function generateAuthData(frame) {
     const member = frame.options?.context?.member;
     if (member) {
         return {
+            // Transistor embeds contain the individual member UUID. Use null for
+            // UUID-less shims so they also avoid old entitlement-only cache entries.
+            uuid: member.uuid ?? null,
             free: member.status === 'free',
             tiers: member.products?.map((product) => product.slug).sort(),
         };

package/core/server/api/endpoints/utils/serializers/input/authors.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:
 const url = require('./utils/url');
 const slugFilterOrder = require('./utils/slug-filter-order');
 const utils = require('../../index');
+const { rejectAuthorsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
   if (!frame.options.order && frame.options.filter) {
@@ -20,6 +21,7 @@ module.exports = {
     url.forceUrlColumns(frame, 'authors');
 
     if (utils.isContentAPI(frame)) {
+      frame.options.order = rejectAuthorsRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
     }
   },

package/core/server/api/endpoints/utils/serializers/input/members.js

@@ -1,6 +1,8 @@
 const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:members');
 const mapNQLKeyValues = require('@tryghost/nql').utils.mapKeyValues;
+const { chainTransformers } = require('@tryghost/mongo-utils');
+const { validateAdminApiBulkFilterTransformer } = require('../../api-filter-utils');
 
 function defaultRelations(frame) {
   if (frame.options.withRelated) {
@@ -16,7 +18,7 @@ function defaultRelations(frame) {
 
 // @TODO: move this into the member repository in members-api
 function mapSubscribedFlagToNewsletterRelation(frame) {
-  frame.options.mongoTransformer = mapNQLKeyValues({
+  const transformer = mapNQLKeyValues({
     key: {
       from: 'subscribed',
       to: 'newsletters.status',
@@ -32,6 +34,16 @@ function mapSubscribedFlagToNewsletterRelation(frame) {
       },
     ],
   });
+
+  frame.options.mongoTransformer = frame.options.mongoTransformer
+    ? chainTransformers(frame.options.mongoTransformer, transformer)
+    : transformer;
+}
+
+function validateBulkFilter(frame) {
+  frame.options.mongoTransformer = frame.options.mongoTransformer
+    ? chainTransformers(validateAdminApiBulkFilterTransformer, frame.options.mongoTransformer)
+    : validateAdminApiBulkFilterTransformer;
 }
 
 function liftMetafieldsInclude(frame) {
@@ -42,7 +54,7 @@ function liftMetafieldsInclude(frame) {
   frame.options.withRelated = frame.options.withRelated.filter(
     (relation) => relation !== 'metafields',
   );
-  frame.options.includeCustomFields = true;
+  frame.options.includeMetafields = true;
 }
 
 module.exports = {
@@ -125,11 +137,13 @@ module.exports = {
 
   bulkEdit(apiConfig, frame) {
     debug('bulkEdit');
+    validateBulkFilter(frame);
     mapSubscribedFlagToNewsletterRelation(frame);
   },
 
   bulkDestroy(apiConfig, frame) {
     debug('bulkDestroy');
+    validateBulkFilter(frame);
     mapSubscribedFlagToNewsletterRelation(frame);
   },
 };

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -9,6 +9,7 @@ const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
 const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
+const { rejectPagesContentApiRestrictedOrderFields } = require('../../api-filter-utils');
 
 const messages = {
   failedHtmlToLexical: 'Failed to convert HTML to Lexical',
@@ -137,6 +138,7 @@ module.exports = {
       removeSourceFormats(frame); // remove from the format field
       selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options
 
+      frame.options.order = rejectPagesContentApiRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
       forceVisibilityColumn(frame);
       url.forceUrlRelations(frame, 'pages');

package/core/server/api/endpoints/utils/serializers/input/posts.js

@@ -9,6 +9,7 @@ const postsMetaSchema = require('../../../../../data/schema').tables.posts_meta;
 const postsSchema = require('../../../../../data/schema').tables.posts;
 const clean = require('./utils/clean');
 const lexical = require('../../../../../lib/lexical');
+const { rejectPostsContentApiRestrictedOrderFields } = require('../../api-filter-utils');
 
 const messages = {
   failedHtmlToLexical: 'Failed to convert HTML to Lexical',
@@ -172,6 +173,7 @@ module.exports = {
       removeSourceFormats(frame); // remove from the format field
       selectAllAllowedColumns(frame); // remove from any specified column or selectRaw options
 
+      frame.options.order = rejectPostsContentApiRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
       forceVisibilityColumn(frame);
       mapWithRelated(frame);

package/core/server/api/endpoints/utils/serializers/input/tags.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:input:
 const url = require('./utils/url');
 const slugFilterOrder = require('./utils/slug-filter-order');
 const utils = require('../../index');
+const { rejectTagsRestrictedOrderFields } = require('../../api-filter-utils');
 
 function setDefaultOrder(frame) {
   let defaultOrder = 'name asc';
@@ -22,6 +23,7 @@ module.exports = {
     url.forceUrlColumns(frame, 'tags');
 
     if (utils.isContentAPI(frame)) {
+      frame.options.order = rejectTagsRestrictedOrderFields(frame.options.order);
       setDefaultOrder(frame);
     }
   },

package/core/server/api/endpoints/utils/serializers/output/emails.js

@@ -1,7 +1,14 @@
 const batchMapper = require('./mappers/email-batches');
 const failureMapper = require('./mappers/email-failures');
+const {
+  toEmailStatusesResponse,
+} = require('../../../../../services/email-service/sending-status-serializers');
 
 module.exports = {
+  sendingStatus(response, apiConfig, frame) {
+    frame.response = toEmailStatusesResponse.parse(response);
+  },
+
   browseBatches(response, apiConfig, frame) {
     frame.response = {};
 

package/core/server/api/endpoints/utils/serializers/output/index.js

@@ -20,6 +20,10 @@ module.exports = {
     return require('./member-commenting');
   },
 
+  get members_account() {
+    return require('./members-account');
+  },
+
   get authentication() {
     return require('./authentication');
   },

package/core/server/api/endpoints/utils/serializers/output/member-metafields.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const serializers_1 = require("../../../../../services/members-custom-fields/serializers");
+const serializers_1 = require("../../../../../services/members-metafields/serializers");
 const serializeOne = (field, _apiConfig, frame) => {
-    frame.response = serializers_1.toCustomFieldsResponse.parse([field]);
+    frame.response = serializers_1.toMetafieldsResponse.parse([field]);
 };
 const serializeMany = (fields, _apiConfig, frame) => {
-    frame.response = serializers_1.toCustomFieldsResponse.parse(fields);
+    frame.response = serializers_1.toMetafieldsResponse.parse(fields);
 };
 // The API framework loads this file with `require()`, so it exports CommonJS-style;
 // `export default` would not be picked up.

package/core/server/api/endpoints/utils/serializers/output/members-account.js

@@ -0,0 +1,19 @@
+"use strict";
+const { formattedMemberResponse } = require('../../../../../services/members/utils');
+/**
+ * A member's own record, as this API has always written one down.
+ *
+ * The projection itself is unchanged and still lives beside the other member
+ * formatting; what changes is that it is now reached the way every other
+ * serializer is, by this endpoint's `docName`, rather than being called by hand
+ * from a request handler.
+ */
+const serialize = (member, _apiConfig, frame) => {
+    frame.response = formattedMemberResponse(member);
+};
+// The API framework loads this file with `require()`, so it exports CommonJS-style;
+// `export default` would not be picked up.
+module.exports = {
+    read: serialize,
+    update: serialize,
+};

package/core/server/api/endpoints/utils/serializers/output/members-csv-transform.js

@@ -14,7 +14,7 @@ const { toExportCsvRow } = require('../../../../../services/members/import-expor
  * @returns {Transform} Transform stream that converts objects to CSV
  */
 function createCSVTransform() {
-  // Locked in from the first row rather than declared up front: custom fields
+  // Locked in from the first row rather than declared up front: metafields
   // add a column per site, so the column set isn't known until a row arrives.
   // Every row carries the same keys, so the first is representative.
   let fields = null;

package/core/server/api/endpoints/utils/serializers/output/tiers.js

@@ -20,7 +20,7 @@ module.exports = {
 function paginatedTiers(page, _apiConfig, frame) {
   return {
     tiers: page.data.map((model) => {
-      return serializeTier(model, frame.options);
+      return serializeTier(model, frame.options, page.requirements);
     }),
     meta: page.meta,
   };
@@ -45,7 +45,7 @@ function singleTier(model, _apiConfig, frame) {
  *
  * @returns {SerializedTier}
  */
-function serializeTier(tier, options) {
+function serializeTier(tier, options, requirements = null) {
   const json = tier.toJSON(options);
 
   const serialized = {
@@ -70,6 +70,14 @@ function serializeTier(tier, options) {
     serialized.benefits = null;
   }
 
+  // Only the payload that was asked for these carries them, so a response that did not
+  // look them up says nothing rather than saying every tier asks for nothing. Where they
+  // were looked up, every tier carries the key and an empty one means it asks for
+  // nothing.
+  if (requirements) {
+    serialized.requirements = requirements.get(json.id) ?? {};
+  }
+
   if (serialized.type === 'free') {
     delete serialized.currency;
     delete serialized.monthly_price;

package/core/server/api/endpoints/utils/serializers/output/users.js

@@ -6,16 +6,6 @@ const messages = {
 };
 
 module.exports = {
-  destroy(filename, apiConfig, frame) {
-    debug('destroy');
-
-    frame.response = {
-      meta: {
-        filename: filename,
-      },
-    };
-  },
-
   changePassword(models, apiConfig, frame) {
     debug('changePassword');
 

package/core/server/api/endpoints/utils/serializers/output/utils/clean.js

@@ -140,6 +140,8 @@ const post = (attrs, frame) => {
   delete attrs.author;
   delete attrs.type;
   delete attrs.newsletter_id;
+  // Internal stored metadata — not part of the public Posts/Pages API yet
+  delete attrs.auto_excerpt;
 
   return attrs;
 };

package/core/server/api/endpoints/utils/serializers/output/utils/extra-attrs.js

@@ -64,6 +64,9 @@ module.exports.forPost = (options, model, attrs) => {
   }
 
   // 4. Add `reading_time` if no columns were requested, or if `reading_time` was requested via `columns`
+  // reading_time is also a DB column now; drop the raw value so we only expose it when
+  // computed below (avoids leaking `reading_time: null` into APIs/webhooks).
+  delete attrs.reading_time;
   if (noColumnsRequested || columnsIncludesReadingTime) {
     if (attrs.html) {
       let additionalImages = 0;

package/core/server/api/endpoints/utils/validators/input/settings.js

@@ -43,11 +43,25 @@ function isValidNavigationUrl(value) {
   );
 }
 
+// Local installs serve uploaded icons from http://localhost:2368, which has no TLD
+function isLocalhostIconUrl(value) {
+  try {
+    return (
+      new URL(value).hostname === 'localhost' &&
+      validator.isURL(value, { ...iconUrlOptions, require_tld: false })
+    );
+  } catch {
+    return false;
+  }
+}
+
 function isValidNavigationIcon(value) {
   return (
     _.isString(value) &&
     !value.match(/\s/) &&
-    (validator.isURL(value, iconUrlOptions) || value.match(iconUrlRegex))
+    (validator.isURL(value, iconUrlOptions) ||
+      value.match(iconUrlRegex) ||
+      isLocalhostIconUrl(value))
   );
 }
 

package/core/server/data/exporter/exporter.js

@@ -26,7 +26,8 @@ const getSettingsTableData = function getSettingsTableData(settingsData) {
   return (
     settingsData &&
     settingsData.filter((setting) => {
-      return !SETTING_KEYS_BLOCKLIST.includes(setting.key);
+      // core settings hold instance secrets and are never imported, so never export them
+      return setting.group !== 'core' && !SETTING_KEYS_BLOCKLIST.includes(setting.key);
     })
   );
 };

package/core/server/data/exporter/table-lists.js

@@ -42,9 +42,9 @@ const BACKUP_TABLES = [
   'members_current_subscription',
   'members_subscription_created_events',
   'members_newsletters',
-  'members_custom_fields',
-  'members_custom_field_values',
-  'members_custom_field_bindings',
+  'members_metafields',
+  'members_metafield_values',
+  'members_metafield_bindings',
   'products_checkout_fields',
   'products_checkout_config',
   'mentions',
@@ -76,6 +76,7 @@ const BACKUP_TABLES = [
   'automation_runs',
   'welcome_email_automation_runs',
   'welcome_email_automated_emails',
+  'tinybird_syncs',
 ];
 
 // NOTE: exposing only tables which are going to be included in a "default" export file
@@ -104,7 +105,8 @@ const TABLES_ALLOWLIST = [
   'snippets',
 ];
 
-// NOTE: these are settings keys which should never end up in the export file
+// NOTE: these are non-core settings keys which should never end up in the export file
+//       (the whole core group is always excluded)
 const SETTING_KEYS_BLOCKLIST = [
   'stripe_connect_publishable_key',
   'stripe_connect_secret_key',
@@ -112,12 +114,8 @@ const SETTING_KEYS_BLOCKLIST = [
   'stripe_secret_key',
   'stripe_publishable_key',
   'stripe_billing_portal_configuration_id',
-  'members_stripe_webhook_id',
-  'members_stripe_webhook_secret',
   'email_verification_required',
   'indexnow_api_key',
-  'machine_payments_secret',
-  'machine_payments_deposit_address',
 ];
 
 module.exports = {

package/core/server/data/importer/importers/data/settings-importer.js

@@ -9,6 +9,11 @@ const keyTypeMapper = require('../../../../api/endpoints/utils/serializers/input
 const { WRITABLE_KEYS_ALLOWLIST } = require('../../../../../shared/labs');
 
 const labsDefaults = JSON.parse(defaultSettings.labs.labs.defaultValue);
+const defaultSettingsGroups = Object.fromEntries(
+  Object.entries(defaultSettings).flatMap(([group, settings]) =>
+    Object.keys(settings).map((key) => [key, group]),
+  ),
+);
 const ignoredSettings = [
   'slack_url',
   'members_from_address',
@@ -183,9 +188,10 @@ class SettingsImporter extends BaseImporter {
       return data;
     });
 
-    // Remove core and theme data types
+    // Remove core and theme data types, using the schema's group rather than the file's
     this.dataToImport = _.filter(this.dataToImport, (data) => {
-      return ['core', 'theme'].indexOf(data.group) === -1;
+      const group = defaultSettingsGroups[data.key] ?? data.group;
+      return ['core', 'theme'].indexOf(group) === -1;
     });
 
     const newIsPrivate = _.find(this.dataToImport, { key: 'is_private' });

package/core/server/data/migrations/versions/6.53/2026-07-15-20-22-53-add-members-custom-field-values.js

@@ -28,7 +28,7 @@ module.exports = addTable('members_custom_field_values', {
     cascadeDelete: true,
   },
   // Exactly one value column is populated per row, chosen by the field type's
-  // storage type in @tryghost/custom-field-types. Splitting text from json
+  // storage type in @tryghost/metafield-types. Splitting text from json
   // keeps text-backed values directly queryable rather than behind a JSON
   // extraction, which is what filtering will need.
   //