ghost 6.62.0 → 6.64.0

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -1,4 +1,5 @@
 const errors = require('@tryghost/errors');
+const { ADMIN } = require('../../../members-metafields');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
 const moment = require('moment');
@@ -7,9 +8,9 @@ const messages = {
   stripeNotConnected: 'Missing Stripe connection.',
   memberAlreadyExists: 'Member already exists.',
   memberNotFound: 'Member not found.',
-  customFieldsOnAdd:
+  metafieldsOnAdd:
     'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.',
-  customFieldsWithoutWriter:
+  metafieldsWithoutWriter:
     'Custom field values cannot be set by a request with no authenticated user or integration.',
 };
 
@@ -47,8 +48,8 @@ module.exports = class MemberBREADService {
    * @param {import('../../../settings-helpers/settings-helpers')} deps.settingsHelpers
    * @param {import('./next-payment-calculator')} deps.nextPaymentCalculator
    * @param {IGiftsModule} deps.giftService
-   * @param {import('../../../members-custom-fields/values-service').CustomFieldValuesService} deps.customFieldValues Required: boot builds it before the members service
-   * @param {import('../../../members-custom-fields/definitions-service').CustomFieldDefinitionsService} deps.customFieldDefinitions Required: boot builds it before the members service
+   * @param {import('../../../members-metafields/values-service').MetafieldValuesService} deps.metafieldValues Required: boot builds it before the members service
+   * @param {import('../../../members-metafields/definitions-service').MetafieldDefinitionsService} deps.metafieldDefinitions Required: boot builds it before the members service
    */
   constructor({
     memberRepository,
@@ -61,8 +62,8 @@ module.exports = class MemberBREADService {
     nextPaymentCalculator,
     commentsService,
     giftService,
-    customFieldValues,
-    customFieldDefinitions,
+    metafieldValues,
+    metafieldDefinitions,
   }) {
     this.offersAPI = offersAPI;
     /** @private */
@@ -84,9 +85,9 @@ module.exports = class MemberBREADService {
     /** @private */
     this.giftService = giftService;
     /** @private */
-    this.customFieldValues = customFieldValues;
+    this.metafieldValues = metafieldValues;
     /** @private */
-    this.customFieldDefinitions = customFieldDefinitions;
+    this.metafieldDefinitions = metafieldDefinitions;
   }
 
   /**
@@ -94,20 +95,21 @@ module.exports = class MemberBREADService {
    * size or a delivery address. Their values live in their own table, so they are fetched
    * here rather than loaded alongside the member.
    *
-   * Returns null when the site has defined no fields, which tells the caller to leave the
-   * `metafields` key off the member payload rather than send an empty object: a key added to
-   * an API response cannot be withdrawn without breaking whoever started reading it, and
-   * most sites have never defined a field, so those sites keep the payload they had before
-   * this feature existed.
+   * Returns null when this audience has no field to be told about, which tells the caller to
+   * leave the `metafields` key off the member payload rather than send an empty object: a key
+   * added to an API response cannot be withdrawn without breaking whoever started reading it,
+   * and most sites have never defined a field, so those sites keep the payload they had
+   * before this feature existed.
    * @param {string[]} memberIds
+   * @param {import('../../../members-metafields').Audience} audience
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
-  async fetchCustomFieldValues(memberIds) {
-    if (!(await this.customFieldDefinitions.hasAnyActive())) {
+  async fetchMetafieldValues(memberIds, audience) {
+    if (!(await this.metafieldDefinitions.hasAnyReadable(audience))) {
       return null;
     }
 
-    return this.customFieldValues.getValuesForMembers(memberIds);
+    return this.metafieldValues.getValuesForMembers(memberIds, audience);
   }
 
   /**
@@ -384,13 +386,17 @@ module.exports = class MemberBREADService {
   /**
    * @param {object} data
    * @param {object} [options]
-   * @param {boolean} [options.withCustomFields] Pass false to leave custom field values
-   *   off the result. Ghost calls this method to identify a signed-in reader on every page
-   *   view of a themed site, and that caller renders the member through a fixed list of
-   *   fields that has never included custom ones. Fetching them there costs two database
-   *   queries per page view whose results are then thrown away.
+   * @param {import('../../../members-metafields').Audience | null} options.metafieldsFor
+   *   Who the extra fields a publisher defined are being read for, or null to leave them
+   *   off entirely. Null is not the same as "nobody may see them": it means this caller
+   *   never shows them, so fetching them is two database queries whose results are thrown
+   *   away. Ghost identifies a signed-in reader on every page view of a themed site
+   *   through this method, and that caller renders a member through a fixed list of
+   *   fields which has never included these.
+   *
+   *   Defaults to null, so a caller that does not ask gets none of them.
    */
-  async read(data, { withCustomFields = true, ...options } = {}) {
+  async read(data, { metafieldsFor = null, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -451,10 +457,10 @@ module.exports = class MemberBREADService {
     const unsubscribeUrl = this.settingsHelpers.createUnsubscribeUrl(member.uuid);
     member.unsubscribe_url = unsubscribeUrl;
 
-    if (withCustomFields) {
-      const customFields = await this.fetchCustomFieldValues([member.id]);
-      if (customFields) {
-        member.metafields = customFields.get(member.id) ?? {};
+    if (metafieldsFor) {
+      const metafields = await this.fetchMetafieldValues([member.id], metafieldsFor);
+      if (metafields) {
+        member.metafields = metafields.get(member.id) ?? {};
       }
     }
 
@@ -462,9 +468,9 @@ module.exports = class MemberBREADService {
   }
 
   async add(data, options) {
-    if (this.customFieldValues.namesValues(this.customFieldValues.unwrapWire(data.metafields))) {
+    if (this.metafieldValues.namesValues(this.metafieldValues.unwrapWire(data.metafields))) {
       throw new errors.ValidationError({
-        message: tpl(messages.customFieldsOnAdd),
+        message: tpl(messages.metafieldsOnAdd),
         property: 'metafields',
       });
     }
@@ -559,22 +565,22 @@ module.exports = class MemberBREADService {
       await this.memberRepository.setComplimentarySubscription(model, sharedOptions);
     }
 
-    return this.read({ id: model.id }, options);
+    return this.read({ id: model.id }, { ...options, metafieldsFor: ADMIN });
   }
 
   async edit(data, options) {
     delete data.last_seen_at;
 
-    const customFields = this.customFieldValues.unwrapWire(data.metafields);
-    const writeCustomFields = customFields !== undefined;
+    const metafields = this.metafieldValues.unwrapWire(data.metafields);
+    const writeMetafields = metafields !== undefined;
     delete data.metafields;
 
     // Plan (which validates) before the member is touched, so a bad value 422s
     // here rather than after the member edit has been applied — and keep the
     // plan to apply once below, so the values aren't resolved and validated
     // twice.
-    const plannedCustomFields = writeCustomFields
-      ? await this.customFieldValues.planWrite(customFields)
+    const plannedMetafields = writeMetafields
+      ? await this.metafieldValues.planWrite(metafields, ADMIN)
       : null;
 
     let model;
@@ -627,7 +633,7 @@ module.exports = class MemberBREADService {
       }
     }
 
-    if (plannedCustomFields) {
+    if (plannedMetafields) {
       // Every value reaching here was typed into the Admin API, so the writer is
       // whoever made the request — the same pair the action log records, so the two
       // agree about who did it rather than one saying only that it was "admin".
@@ -638,15 +644,15 @@ module.exports = class MemberBREADService {
       const context = options.context || {};
       if (!context.integration && !context.user) {
         throw new errors.IncorrectUsageError({
-          message: tpl(messages.customFieldsWithoutWriter),
+          message: tpl(messages.metafieldsWithoutWriter),
         });
       }
       const writtenBy = context.integration
         ? { type: 'integration', id: context.integration.id }
         : { type: 'user', id: context.user };
-      await this.customFieldValues.applyWrite(model.id, plannedCustomFields, { writtenBy });
+      await this.metafieldValues.applyWrite(model.id, plannedMetafields, { writtenBy });
 
-      // Custom fields aren't a member column or relation, so an edit touching
+      // Metafields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.
       // Declare the change into `_changed` — as bookshelf-relations does for a
       // labels change — so the member's edited lifecycle fires its usual signals
@@ -656,13 +662,13 @@ module.exports = class MemberBREADService {
       // populated `_changed` and fired the edited event during update(), so
       // re-firing would duplicate it (this also covers a full PUT that resends
       // unchanged member fields — `_changed` stays empty there too). That
-      // combined event omits `custom_fields` from `_changed`, which nothing
-      // reads: custom fields aren't in the webhook payload (they're injected
+      // combined event omits `metafields` from `_changed`, which nothing
+      // reads: metafields aren't in the webhook payload (they're injected
       // into read/browse responses, not the model), and `_changed` only gates
       // whether the event fires.
       const memberUnchanged = !model._changed || Object.keys(model._changed).length === 0;
-      if (memberUnchanged && plannedCustomFields.length > 0) {
-        model._changed = { custom_fields: true };
+      if (memberUnchanged && plannedMetafields.length > 0) {
+        model._changed = { metafields: true };
         // A mixed edit keeps the generic label on purpose: relabelling the
         // one action a member change already fired would bury that change
         // behind this one.
@@ -675,7 +681,7 @@ module.exports = class MemberBREADService {
       }
     }
 
-    return this.read({ id: model.id }, options);
+    return this.read({ id: model.id }, { ...options, metafieldsFor: ADMIN });
   }
 
   /**
@@ -707,7 +713,7 @@ module.exports = class MemberBREADService {
       );
     }
 
-    return this.read({ id: memberId });
+    return this.read({ id: memberId }, { metafieldsFor: ADMIN });
   }
 
   /**
@@ -729,7 +735,7 @@ module.exports = class MemberBREADService {
 
     await this.memberRepository.saveCommenting(memberId, updated, 'commenting_enabled', context);
 
-    return this.read({ id: memberId });
+    return this.read({ id: memberId }, { metafieldsFor: ADMIN });
   }
 
   async logout(options) {
@@ -791,8 +797,11 @@ module.exports = class MemberBREADService {
 
     // One query for the whole page, not one per member. `null` when the flag
     // is off or the caller didn't ask — the same truthiness guard read uses.
-    const customFieldsByMember = options.includeCustomFields
-      ? await this.fetchCustomFieldValues(page.data.map((model) => model.id))
+    const metafieldsByMember = options.includeMetafields
+      ? await this.fetchMetafieldValues(
+          page.data.map((model) => model.id),
+          ADMIN,
+        )
       : null;
 
     const data = page.data.map((model, index) => {
@@ -804,8 +813,8 @@ module.exports = class MemberBREADService {
       if (!originalWithRelated.includes('products')) {
         delete member.products;
       }
-      if (customFieldsByMember) {
-        member.metafields = customFieldsByMember.get(model.id) ?? {};
+      if (metafieldsByMember) {
+        member.metafields = metafieldsByMember.get(model.id) ?? {};
       }
       member.email_suppression = {
         suppressed: bulkSuppressionData[index].suppressed || !!model.get('email_disabled'),

package/core/server/services/members/members-api/services/token-service.js

@@ -1,6 +1,6 @@
-const jose = require('node-jose');
 const jwt = require('jsonwebtoken');
 const crypto = require('crypto');
+const { getPublicKeyInfo } = require('../../../../lib/public-jwk');
 
 // A token's `scope` declares its purpose. Only identity tokens may act as a
 // member; entitlement tokens are read-only and handed to integrations.
@@ -9,24 +9,23 @@ const ENTITLEMENT_TOKEN_SCOPE = 'members:entitlements:read';
 
 module.exports = class TokenService {
   constructor({ privateKey, publicKey, issuer }) {
-    this._keyStore = jose.JWK.createKeyStore();
-    this._keyStoreReady = this._keyStore.add(privateKey, 'pem');
+    this._keyReady = getPublicKeyInfo(privateKey);
     this._privateKey = privateKey;
     this._publicKey = publicKey;
     this._issuer = issuer;
   }
 
   async encodeIdentityToken({ sub }) {
-    const jwk = await this._keyStoreReady;
+    const { kid } = await this._keyReady;
     return jwt.sign(
       {
         sub,
-        kid: jwk.kid,
+        kid,
         scope: IDENTITY_TOKEN_SCOPE,
       },
       this._privateKey,
       {
-        keyid: jwk.kid,
+        keyid: kid,
         algorithm: 'RS512',
         audience: this._issuer,
         expiresIn: '10m',
@@ -36,12 +35,12 @@ module.exports = class TokenService {
   }
 
   async encodeEntitlementToken({ sub, memberUuid, paid, activeTierIds = [] }) {
-    const jwk = await this._keyStoreReady;
+    const { kid } = await this._keyReady;
 
     return jwt.sign(
       {
         sub,
-        kid: jwk.kid,
+        kid,
         scope: ENTITLEMENT_TOKEN_SCOPE,
         member_uuid: memberUuid,
         paid,
@@ -50,7 +49,7 @@ module.exports = class TokenService {
       },
       this._privateKey,
       {
-        keyid: jwk.kid,
+        keyid: kid,
         algorithm: 'RS512',
         audience: this._issuer,
         expiresIn: '5m',
@@ -73,7 +72,7 @@ module.exports = class TokenService {
    * @returns {Promise<jwt.JwtPayload>}
    */
   async decodeToken(token) {
-    await this._keyStoreReady;
+    await this._keyReady;
 
     const result = jwt.verify(token, this._publicKey, {
       algorithms: ['RS512'],
@@ -92,7 +91,7 @@ module.exports = class TokenService {
   }
 
   async getPublicKeys() {
-    await this._keyStoreReady;
-    return this._keyStore.toJSON();
+    const { kid, jwk } = await this._keyReady;
+    return { keys: [{ kty: jwk.kty, kid, n: jwk.n, e: jwk.e }] };
   }
 };

package/core/server/services/members/members-ssr.js

@@ -307,6 +307,24 @@ class MembersSSR {
    *
    * @returns {Promise<Member>}
    */
+  /**
+   * Who this session belongs to, without loading them.
+   *
+   * The counterpart to `getMemberDataFromSession`, for callers that need to know a
+   * member is there rather than what is on their record.
+   *
+   * @method getMemberIdentityFromSession
+   * @param {Request} req
+   * @param {Response} res
+   *
+   * @returns {Promise<{id: string, email: string} | null>}
+   */
+  async getMemberIdentityFromSession(req, res) {
+    const transientId = this._getSessionCookies(req, res);
+    const api = await this._getMembersApi();
+    return api.getMemberIdentity(transientId);
+  }
+
   async getMemberDataFromSession(req, res) {
     const transientId = this._getSessionCookies(req, res);
     const member = await this._getMemberIdentityDataFromTransientId(transientId);

package/core/server/services/members/middleware.js

@@ -2,22 +2,25 @@ const crypto = require('crypto');
 const _ = require('lodash');
 const logging = require('@tryghost/logging');
 const membersService = require('./service');
-const emailSuppressionList = require('../email-suppression-list');
 const models = require('../../models');
 const urlUtils = require('../../../shared/url-utils').default;
 const spamPrevention = require('../../web/shared/middleware/api/spam-prevention');
-const { formattedMemberResponse, formatNewsletterResponse } = require('./utils');
+const { formatNewsletterResponse } = require('./utils');
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const onHeaders = require('on-headers');
 const tiersService = require('../tiers/service');
 const config = require('../../../shared/config');
 const settingsHelpers = require('../settings-helpers');
+const { timingSafeStringEqual } = require('../../../shared/timing-safe-string-equal');
 
 const messages = {
   missingUuid: 'Missing uuid.',
   invalidUuid: 'Invalid uuid.',
   invalidKey: 'Invalid key.',
+  // Says that nobody is signed in, without naming the cookie that would have said
+  // so. Which cookie carries a session is Ghost's business, not the caller's.
+  noMemberSession: 'You must be signed in to do this.',
 };
 
 const getFreeTier = async function getFreeTier() {
@@ -116,6 +119,94 @@ const getRedirectUrl = function getRedirectUrl({ action, referrer, searchParams,
   return redirectUrl.href;
 };
 
+/**
+ * Establish who is signed in, without loading them.
+ *
+ * Sets `req.identity` to an id and an email address, or to null when nobody is
+ * signed in. One lookup against an indexed column, with no relations attached and
+ * nothing fetched from outside Ghost.
+ *
+ * Deliberately not the member's record. Most endpoints that serve a member need to
+ * act on one rather than describe one, and the one that describes a member reads
+ * it again after writing anyway, because the response has to say what Ghost now
+ * holds rather than what was sent. What to load is the endpoint's own business.
+ *
+ * Distinct from `loadMemberSession`, which loads the whole member and is what a
+ * themed page renders from.
+ */
+const loadMemberIdentity = async function loadMemberIdentity(req, res, next) {
+  try {
+    Object.assign(req, {
+      identity: await membersService.ssr.getMemberIdentityFromSession(req, res),
+    });
+  } catch (err) {
+    // Only a missing or unreadable cookie means nobody is signed in. Establishing
+    // an identity also reaches the database, and answering "you are not signed in"
+    // to that failing would tell a signed-in member something false and leave the
+    // real fault unreported.
+    if (!errors.utils.isGhostError(err) || err.errorType !== 'BadRequestError') {
+      return next(err);
+    }
+    Object.assign(req, { identity: null });
+  }
+
+  return next();
+};
+
+/**
+ * Hand the identity to whatever comes next, in the place the API framework reads.
+ *
+ * The framework takes whoever is acting from `req.member` and nowhere else, so a
+ * controller behind either gate below finds the identity there.
+ */
+const carryIdentity = function carryIdentity(req, res) {
+  Object.assign(req, { member: req.identity });
+  res.locals.member = req.member;
+};
+
+/**
+ * Refuse a request that `loadMemberIdentity` could not put a name to.
+ *
+ * For endpoints where an unknown caller is asking for something they have no right
+ * to: changing a member's record, or reading what a publisher collects.
+ *
+ * Reads only `req.identity`, so a route using this must register
+ * `loadMemberIdentity` first. It looks nothing up itself: what a route needs is
+ * declared by the middleware it lists, rather than depending on what some earlier
+ * one happened to leave behind.
+ */
+const rejectWhenAnonymous = function rejectWhenAnonymous(req, res, next) {
+  if (!req.identity) {
+    return next(
+      new errors.UnauthorizedError({
+        message: tpl(messages.noMemberSession),
+      }),
+    );
+  }
+
+  carryIdentity(req, res);
+  return next();
+};
+
+/**
+ * Answer with nothing when `loadMemberIdentity` could not put a name to the request.
+ *
+ * For reading who you are, where not knowing is an ordinary answer rather than a
+ * failure: a themed page asks on every view and most of those views have no member.
+ *
+ * The counterpart to `rejectWhenAnonymous`, and separate from it because which of
+ * the two applies is a fact about the endpoint, not a setting on a shared one.
+ */
+const emptyWhenAnonymous = function emptyWhenAnonymous(req, res, next) {
+  if (!req.identity) {
+    res.writeHead(204);
+    return res.end();
+  }
+
+  carryIdentity(req, res);
+  return next();
+};
+
 /**
  * Require member authentication, and make it possible to authenticate via uuid + hashed key.
  * You can chain this after loadMemberSession to make it possible to authenticate via both the uuid and the session.
@@ -147,13 +238,19 @@ const authMemberByUuid = async function authMemberByUuid(req, res, next) {
       .createHmac('sha256', settingsHelpers.getMembersValidationKey())
       .update(uuid)
       .digest('hex');
-    if (memberHmac !== key) {
+    if (!timingSafeStringEqual(memberHmac, key)) {
       throw new errors.UnauthorizedError({
         message: tpl(messages.invalidKey),
       });
     }
 
-    const member = await membersService.api.memberBREADService.read({ uuid });
+    // Nothing reached through this middleware renders a member's extra fields, so
+    // they are not fetched. It authenticates by a signed link rather than a session,
+    // which makes anything loaded here readable without being signed in.
+    const member = await membersService.api.memberBREADService.read(
+      { uuid },
+      { metafieldsFor: null },
+    );
     if (!member) {
       throw new errors.UnauthorizedError({
         message: tpl(messages.invalidUuid),
@@ -243,42 +340,6 @@ const deleteSession = async function deleteSession(req, res) {
   }
 };
 
-const getMemberData = async function getMemberData(req, res) {
-  try {
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    if (member) {
-      res.json(formattedMemberResponse(member));
-    } else {
-      res.json(null);
-    }
-  } catch (err) {
-    res.writeHead(204);
-    res.end();
-  }
-};
-
-const deleteSuppression = async function deleteSuppression(req, res) {
-  try {
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    const options = {
-      id: member.id,
-    };
-    await emailSuppressionList.removeEmail(member.email);
-    await membersService.api.members.update({ email_disabled: false }, options);
-
-    res.writeHead(204);
-    res.end();
-  } catch (err) {
-    if (!err.statusCode) {
-      logging.error(err);
-    }
-    res.writeHead(err.statusCode ?? 500, {
-      'Content-Type': 'text/plain;charset=UTF-8',
-    });
-    res.end(err.message);
-  }
-};
-
 const getMemberNewsletters = async function getMemberNewsletters(req, res) {
   try {
     const memberData = req.member; // validation assumed
@@ -351,46 +412,6 @@ const updateMemberNewsletters = async function updateMemberNewsletters(req, res)
   }
 };
 
-const updateMemberData = async function updateMemberData(req, res) {
-  try {
-    const data = _.pick(
-      req.body,
-      'name',
-      'expertise',
-      'subscribed',
-      'newsletters',
-      'enable_comment_notifications',
-      'enable_updates_and_announcements',
-    );
-    const member = await membersService.ssr.getMemberDataFromSession(req, res);
-    if (member) {
-      const options = {
-        id: member.id,
-        withRelated: [
-          'stripeSubscriptions',
-          'stripeSubscriptions.customer',
-          'stripeSubscriptions.stripePrice',
-          'newsletters',
-        ],
-      };
-      await membersService.api.members.update(data, options);
-      const updatedMember = await membersService.ssr.getMemberDataFromSession(req, res);
-
-      res.json(formattedMemberResponse(updatedMember));
-    } else {
-      res.json(null);
-    }
-  } catch (err) {
-    if (!err.statusCode) {
-      logging.error(err);
-    }
-    res.writeHead(err.statusCode ?? 500, {
-      'Content-Type': 'text/plain;charset=UTF-8',
-    });
-    res.end(err.message);
-  }
-};
-
 const createSessionFromMagicLink = async function createSessionFromMagicLink(req, res, next) {
   if (!req.url.includes('token=')) {
     return next();
@@ -500,17 +521,17 @@ const createSessionFromMagicLink = async function createSessionFromMagicLink(req
 // Set req.member & res.locals.member if a cookie is set
 module.exports = {
   loadMemberSession,
+  loadMemberIdentity,
+  rejectWhenAnonymous,
+  emptyWhenAnonymous,
   authMemberByUuid,
   createSessionFromMagicLink,
   getIdentityToken,
   getEntitlementToken,
   getMemberNewsletters,
-  getMemberData,
-  updateMemberData,
   updateMemberNewsletters,
   deleteSession,
   accessInfoSession,
-  deleteSuppression,
   createIntegrityToken,
   verifyIntegrityToken,
 };

package/core/server/services/members/request-integrity-token-provider.js

@@ -1,4 +1,5 @@
 const crypto = require('crypto');
+const { timingSafeStringEqual } = require('../../../shared/timing-safe-string-equal');
 
 class RequestIntegrityTokenProvider {
   #themeSecret;
@@ -45,7 +46,7 @@ class RequestIntegrityTokenProvider {
     hmac.update(`${timestamp.toString()}:${nonce}`);
     const expectedHmac = hmac.digest('hex');
 
-    if (expectedHmac !== hmacDigest) {
+    if (!timingSafeStringEqual(expectedHmac, hmacDigest)) {
       // HMAC mismatch
       return false;
     }