ghost 6.62.0 → 6.64.0

package/core/server/services/members/service.js

@@ -49,9 +49,9 @@ let membersApi;
 let verificationTrigger;
 
 const buildImporterDeps = ({ stripeAPIService }) => {
-  // Required here, not statically: boot builds the custom fields services before this
+  // Required here, not statically: boot builds the metafields services before this
   // one (the exporter below relies on the same).
-  const customFields = require('../members-custom-fields');
+  const metafields = require('../members-metafields');
   return {
     getTimezone: () => settingsCache.get('timezone'),
     // A getter rather than a value because the threshold is an operator
@@ -88,9 +88,9 @@ const buildImporterDeps = ({ stripeAPIService }) => {
     urlFor: urlUtils.urlFor.bind(urlUtils),
     stripeAPIService,
     productRepository: membersApi.productRepository,
-    customFields: {
-      definitions: customFields.definitions,
-      values: customFields.values,
+    metafields: {
+      definitions: metafields.definitions,
+      values: metafields.values,
     },
   };
 };
@@ -115,6 +115,66 @@ const initVerificationTrigger = () => {
   });
 };
 
+const membersMigrationJobName = 'members-migrations';
+
+/**
+ * Runs the historical Stripe backfills once per site, retried only after a
+ * failed run.
+ *
+ * The `jobs` row named `members-migrations` is the only guard: any status other
+ * than `failed` means the run was already attempted and is skipped forever. The
+ * row is written after the run, so a boot that dies mid-way retries next time.
+ * The row is written even when Stripe is not configured, matching the job-based
+ * version: a site that connects Stripe later never runs these 2021-era backfills.
+ * Two processes booting a site with no row will both run the backfills, where the
+ * job-based version claimed the row first. Accepted: every site that has booted
+ * since Ghost 5.6 has the row, and the backfills do nothing without Stripe.
+ *
+ * @TODO: Delete the backfills, this runner and the `jobs` rows in the next major
+ *
+ * @param {import('../stripe')} stripeService
+ */
+async function runStripeMigrations(stripeService) {
+  const existingJob = await models.Job.findOne({ name: membersMigrationJobName });
+
+  if (existingJob && existingJob.get('status') !== 'failed') {
+    logging.info(`Stripe ${membersMigrationJobName} skipped because it has already run`);
+    return;
+  }
+
+  const startedAt = Date.now();
+  logging.info(`Stripe ${membersMigrationJobName} started`);
+
+  let status = 'finished';
+  try {
+    await stripeService.migrations.execute();
+    logging.info(`Stripe ${membersMigrationJobName} completed in ${Date.now() - startedAt}ms`);
+  } catch (err) {
+    status = 'failed';
+    logging.error(
+      err,
+      `Stripe ${membersMigrationJobName} failed after ${Date.now() - startedAt}ms`,
+    );
+  }
+
+  const attrs = { status, started_at: new Date(startedAt), finished_at: new Date() };
+  if (existingJob) {
+    await models.Job.edit(attrs, { id: existingJob.id });
+    return;
+  }
+
+  try {
+    await models.Job.add({ name: membersMigrationJobName, ...attrs });
+  } catch (err) {
+    // Two processes booting a site with no row yet both get here, and the unique
+    // index on jobs.name rejects the second insert. The row exists, so move on.
+    if (!(await models.Job.findOne({ name: membersMigrationJobName }))) {
+      throw err;
+    }
+    logging.warn(`Stripe ${membersMigrationJobName} row was already written by another process`);
+  }
+}
+
 module.exports = {
   async init() {
     const stripeService = require('../stripe');
@@ -175,46 +235,14 @@ module.exports = {
       membersCSVImporter.importInline(request, verificationTrigger);
 
     // Constructed here rather than required statically: the exporter needs the
-    // custom fields services, which boot builds before this one.
-    const customFields = require('../members-custom-fields');
+    // metafields services, which boot builds before this one.
+    const metafields = require('../members-metafields');
     module.exports.export = makeExporter({
-      definitions: customFields.definitions,
-      values: customFields.values,
+      definitions: metafields.definitions,
+      values: metafields.values,
     });
 
-    if (!env?.startsWith('testing')) {
-      const membersMigrationJobName = 'members-migrations';
-      if (!(await jobsService.hasExecutedSuccessfully(membersMigrationJobName))) {
-        logging.info(`[Background Job] ${membersMigrationJobName} queued`);
-        jobsService.addOneOffJob({
-          name: membersMigrationJobName,
-          offloaded: false,
-          job: async () => {
-            const startedAt = Date.now();
-            logging.info(`[Background Job] ${membersMigrationJobName} started`);
-            try {
-              const result = await stripeService.migrations.execute();
-              logging.info(
-                `[Background Job] ${membersMigrationJobName} completed in ${Date.now() - startedAt}ms`,
-              );
-              return result;
-            } catch (err) {
-              logging.error(
-                err,
-                `[Background Job] ${membersMigrationJobName} failed after ${Date.now() - startedAt}ms`,
-              );
-              throw err;
-            }
-          },
-        });
-
-        await jobsService.awaitOneOffCompletion(membersMigrationJobName);
-      } else {
-        logging.info(
-          `[Background Job] ${membersMigrationJobName} skipped because it has already run`,
-        );
-      }
-    }
+    await runStripeMigrations(stripeService);
   },
   contentGating: require('./content-gating'),
 

package/core/server/services/members/utils.js

@@ -41,5 +41,14 @@ module.exports.formattedMemberResponse = function formattedMemberResponse(member
     data.email_suppression = member.email_suppression;
   }
 
+  // Absent rather than empty on a site that has defined no extra fields, which is
+  // most of them, so those members' accounts read exactly as they did before this
+  // existed. Present but empty means the publisher has defined fields and this
+  // member has answered none, which a client renders as blank inputs rather than
+  // as nothing to fill in.
+  if (member.metafields) {
+    data.metafields = member.metafields;
+  }
+
   return data;
 };

package/core/server/services/members-metafields/access.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL = exports.MEMBERS = exports.ADMIN = exports.MemberAccessSchema = exports.MEMBER_ACCESS = void 0;
+exports.readableLevels = readableLevels;
+exports.canWrite = canWrite;
+const metafield_types_1 = require("@tryghost/metafield-types");
+Object.defineProperty(exports, "MEMBER_ACCESS", { enumerable: true, get: function () { return metafield_types_1.MEMBER_ACCESS; } });
+Object.defineProperty(exports, "MemberAccessSchema", { enumerable: true, get: function () { return metafield_types_1.MemberAccessSchema; } });
+const EVERY_LEVEL = [...metafield_types_1.MEMBER_ACCESS_LEVELS];
+exports.ADMIN = { entry: 'admin' };
+exports.MEMBERS = { entry: 'members' };
+exports.INTERNAL = { entry: 'internal' };
+// Every audience is spelled out with the levels it may read, staff included, because
+// reads narrow on whatever this returns and an audience with no entry gets an empty
+// list, which matches no field. Giving staff a way to skip the check instead would
+// invert that: an unrecognised audience would then match everything.
+const READABLE = {
+    admin: EVERY_LEVEL,
+    internal: EVERY_LEVEL,
+    members: [metafield_types_1.MEMBER_ACCESS.read, metafield_types_1.MEMBER_ACCESS.write],
+};
+const WRITABLE = {
+    admin: EVERY_LEVEL,
+    internal: EVERY_LEVEL,
+    members: [metafield_types_1.MEMBER_ACCESS.write],
+};
+// `Object.hasOwn` rather than a plain lookup: an entry naming a property every object
+// inherits (`__proto__`, `constructor`, `toString`) would otherwise return that
+// inherited value instead of falling through to the empty list.
+function levelsFor(table, audience) {
+    const entry = audience?.entry;
+    return entry !== undefined && Object.hasOwn(table, entry) ? table[entry] : [];
+}
+function readableLevels(audience) {
+    return levelsFor(READABLE, audience);
+}
+function canWrite(audience, field) {
+    return levelsFor(WRITABLE, audience).includes(field.memberAccess);
+}

package/core/server/services/{members-custom-fields → members-metafields}/actions.js

@@ -4,12 +4,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.actingContext = actingContext;
-exports.recordCustomFieldAction = recordCustomFieldAction;
+exports.recordMetafieldAction = recordMetafieldAction;
 const logging_1 = __importDefault(require("@tryghost/logging"));
 /**
  * Who is acting, read off an API frame's context.
  *
- * Here rather than in each endpoint, because two resources now record custom field history
+ * Here rather than in each endpoint, because two resources now record metafield history
  * and a second reading of the same shape is a second chance to disagree about it. An
  * integration and a user are both actors; a request that is neither — a webhook, a job —
  * has none, and the history says so rather than guessing.
@@ -31,12 +31,13 @@ const COMMANDS = {
     create: 'added',
     rename: 'edited',
     reorder: 'edited',
+    changeAccess: 'edited',
     archive: 'archived',
     restore: 'restored',
     delete: 'deleted',
 };
 // Best-effort action-log write: a failed action must never fail the command that triggered it.
-async function recordCustomFieldAction({ Action, context, verb, subject, details, }) {
+async function recordMetafieldAction({ Action, context, verb, subject, details, }) {
     if (!context.actor) {
         return;
     }
@@ -55,12 +56,12 @@ async function recordCustomFieldAction({ Action, context, verb, subject, details
     }
     catch (err) {
         logging_1.default.error({
-            event: { name: 'members.custom_fields.action_log_failed' },
+            event: { name: 'members.metafields.action_log_failed' },
             err,
             verb,
             subject,
             actorType: context.actor.type,
             actorId: context.actor.id,
-        }, 'Failed to record a member custom field action');
+        }, 'Failed to record a member metafield action');
     }
 }

package/core/server/services/members-metafields/bindings-service.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MetafieldBindingsService = void 0;
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const access_1 = require("./access");
+const schema_1 = require("./schema");
+const FIELDS_TABLE = 'members_metafields';
+const { CUSTOM_NAMESPACE } = require('@tryghost/metafield-types/identity');
+const BINDINGS_TABLE = 'members_metafield_bindings';
+/**
+ * Where a source sends what it collected: a `port` is the name that source uses for a
+ * thing, and the binding resolves it to one of the publisher's fields.
+ */
+class MetafieldBindingsService {
+    knex;
+    values;
+    constructor({ knex, values }) {
+        this.knex = knex;
+        this.values = values;
+    }
+    async bind(db, productId, port, metafieldKey, now) {
+        const existing = await db(BINDINGS_TABLE).where({ product_id: productId, port }).first();
+        if (existing?.metafield_key === metafieldKey) {
+            await db(BINDINGS_TABLE).where('id', existing.id).update({ updated_at: now });
+            return existing.id;
+        }
+        if (existing) {
+            await db(BINDINGS_TABLE).where('id', existing.id).del();
+        }
+        const bindingId = new bson_objectid_1.default().toHexString();
+        await db(BINDINGS_TABLE).insert({
+            id: bindingId,
+            product_id: productId,
+            port,
+            metafield_key: metafieldKey,
+            created_at: now,
+            updated_at: now,
+        });
+        return bindingId;
+    }
+    /** Stops the writing. Whatever hangs off the binding cascades with it. */
+    async remove(db, productId, port) {
+        await db(BINDINGS_TABLE).where({ product_id: productId, port }).del();
+    }
+    /**
+     * Values a processor collected on Ghost's behalf and sent back.
+     *
+     * Nobody supplied these in a sense the site can name — a payment page asked, and a
+     * machine reported the answers — so what is recorded against them is the binding that
+     * routed each one. That resolves back to the tier that asked, what it was collected
+     * as, and the field it landed in, which is everything worth knowing about how the
+     * value arrived.
+     */
+    async writeCollected(memberId, productId, collected) {
+        return this.writeThrough(memberId, productId, collected, (binding) => ({
+            type: 'binding',
+            id: binding.bindingId,
+        }));
+    }
+    /**
+     * Values a member supplied about themselves, through the same ports a checkout uses.
+     *
+     * A member typing their own address into a form is answerable for it in a way no
+     * routing is, and a record saying a binding wrote it would be wrong. The member is the
+     * one whose record this is, so there is nobody else it could be.
+     */
+    async writeSuppliedByMember(memberId, productId, supplied) {
+        return this.writeThrough(memberId, productId, supplied, () => ({
+            type: 'member',
+            id: memberId,
+        }));
+    }
+    /**
+     * Values arrive in the order they are to be applied: where two land in one field, the
+     * last of them is what the field holds.
+     *
+     * Every value is attempted, and then the first failure is raised. Attempting them all
+     * is this method's business: one refused answer must not cost a publisher the address
+     * a courier needs, and the values have nothing to do with each other beyond arriving
+     * together. Whether the failure is worth acting on is the caller's, which is why it
+     * leaves here rather than being logged and forgotten — a checkout webhook has already
+     * taken the money and must never fail, while a member filling in a form is owed the
+     * news.
+     */
+    async writeThrough(memberId, productId, values, attribute) {
+        let failure;
+        for (const { port, value } of values) {
+            try {
+                // Inside, because working out where a value goes can fail the same way storing
+                // it can, and a value nobody could place is no more reason to abandon the rest
+                // than one nobody could store.
+                const destination = await this.resolve(productId, port);
+                if (!destination) {
+                    continue;
+                }
+                await this.writeOne(memberId, destination, value, attribute);
+            }
+            catch (err) {
+                failure = failure ?? err;
+            }
+        }
+        if (failure) {
+            throw failure;
+        }
+    }
+    async writeOne(memberId, into, value, attribute) {
+        // Internal: what may be set is bounded by the binding rather than by who is
+        // looking. A port exists because a publisher pointed it at a field, and that
+        // decision is what admits the value, whoever supplied it.
+        const planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value }, access_1.INTERNAL);
+        await this.values.applyWrite(memberId, planned, { writtenBy: attribute(into) });
+    }
+    async resolve(productId, port) {
+        const row = await this.knex(BINDINGS_TABLE)
+            .join(FIELDS_TABLE, `${BINDINGS_TABLE}.metafield_key`, `${FIELDS_TABLE}.key`)
+            .where(`${BINDINGS_TABLE}.product_id`, productId)
+            .where(`${BINDINGS_TABLE}.port`, port)
+            // An archived destination is still where this goes, and still not somewhere a value
+            // can land, so the write drops rather than waiting.
+            .where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active)
+            .select(`${BINDINGS_TABLE}.id as binding_id`, `${FIELDS_TABLE}.key`, `${FIELDS_TABLE}.type`)
+            .first();
+        if (!row) {
+            return null;
+        }
+        // Decoded rather than trusted: a join is a read boundary, and `type` is what decides
+        // how the collected value is read. Unreadable counts as unresolved rather than
+        // throwing, so one bad row skips its value the way an unbound port does instead of
+        // failing everything else the same checkout collected.
+        const bound = schema_1.DbBoundField.safeParse(row);
+        if (!bound.success) {
+            logging_1.default.warn({
+                event: { name: 'members.metafields.binding_unreadable' },
+                err: bound.error,
+                productId,
+                port,
+            }, 'A binding could not be read');
+            return null;
+        }
+        return { bindingId: bound.data.binding_id, key: bound.data.key, type: bound.data.type };
+    }
+}
+exports.MetafieldBindingsService = MetafieldBindingsService;

package/core/server/services/members-metafields/codec.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.metafieldCodec = void 0;
+const zod_1 = require("zod");
+const identity_1 = require("@tryghost/metafield-types/identity");
+const case_keys_1 = require("../../lib/case-keys");
+const schema_1 = require("./schema");
+const models_1 = require("./models");
+exports.metafieldCodec = zod_1.z.codec(schema_1.DbMetafield, models_1.Metafield, {
+    // DbMetafield validates `type` as the field-type enum, so the decoded row
+    // already carries a FieldType and camelKeys preserves it — no cast needed.
+    decode: ({ member_access: memberAccess, ...row }) => ({
+        ...(0, case_keys_1.camelKeys)(row),
+        namespace: identity_1.CUSTOM_NAMESPACE,
+        access: { member: memberAccess },
+    }),
+    encode: ({ namespace: _namespace, access, ...field }) => ({
+        ...(0, case_keys_1.snakeKeys)(field),
+        member_access: access.member,
+    }),
+});

package/core/server/services/{members-custom-fields → members-metafields}/config.js

@@ -22,7 +22,7 @@ const Ceiling = zod_1.z
 // rather than restated. Parsed eagerly because a missing or malformed value
 // there is our bug rather than an operator's, and should fail loudly at boot
 // instead of quietly becoming the fallback for everything below.
-const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.customFields.maxDefinitions);
+const shippedCeiling = Ceiling.parse(require('../../../shared/config/defaults.json').members.metafields.maxDefinitions);
 // A higher layer can override the shipped value with anything. Something
 // unreadable falls back to the shipped ceiling rather than throwing, because an
 // operator can correct this live and a bad value must not take the feature down