ghost 6.62.0 → 6.64.0

package/core/server/services/{members-custom-fields → members-metafields}/definitions-service.js

@@ -3,14 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomFieldDefinitionsService = void 0;
+exports.MetafieldDefinitionsService = void 0;
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const metafield_types_1 = require("@tryghost/metafield-types");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const codec_1 = require("./codec");
+const namespaces_1 = require("./namespaces");
 const schema_1 = require("./schema");
+const access_1 = require("./access");
 const queries_1 = require("./queries");
 const key_1 = require("./key");
 // The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to
@@ -18,7 +20,7 @@ const key_1 = require("./key");
 // turns that into parametrised WHERE clauses. Neither needs a Bookshelf model.
 const nql = require('@tryghost/nql');
 const knexify = require('@tryghost/mongo-knex');
-const TABLE = 'members_custom_fields';
+const TABLE = 'members_metafields';
 // Column limits come from the canonical schema — the same source the migration and
 // Bookshelf models read — so the service can never drift from the database. The
 // name cap turns an over-long input into a clean 422 (not a DB error), and the key
@@ -45,10 +47,12 @@ const FieldName = zod_1.z
     .trim()
     .min(1, { message: 'Custom field name is required.' })
     .max(MAX_NAME_LENGTH, { message: 'Custom field name is too long.' });
-// The backend mints the key from the name, so create takes just a name and type.
+const FieldAccess = zod_1.z.object({ member: access_1.MemberAccessSchema });
+// No key: the backend mints it from the name.
 const AddFieldInput = zod_1.z.object({
     name: FieldName,
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
+    access: FieldAccess.optional(),
 });
 // A bound on the work one request can ask for, separate from how many definitions
 // a site may hold in total. Every definition in a batch costs several queries
@@ -71,15 +75,16 @@ const ReorderInput = zod_1.z
     key: zod_1.z.string().min(1, { message: 'Every custom field in the order needs a key.' }),
 }))
     .min(1, { message: 'The order must name every custom field.' });
-// Name and status are mutable. `key` and `type` are accepted so the immutability
-// rules can reject a change loudly; they are never persisted.
+// Name, status and access are mutable. `key` and `type` are accepted so the
+// immutability rules can reject a change loudly; they are never persisted.
 const EditFieldInput = zod_1.z.object({
     name: FieldName.optional(),
     status: schema_1.FieldStatusSchema.optional(),
+    access: FieldAccess.optional(),
     key: zod_1.z.string().optional(),
-    type: custom_field_types_1.FieldTypeSchema.optional(),
+    type: metafield_types_1.FieldTypeSchema.optional(),
 });
-class CustomFieldDefinitionsService {
+class MetafieldDefinitionsService {
     knex;
     recordAction;
     getMaxDefinitions;
@@ -93,8 +98,8 @@ class CustomFieldDefinitionsService {
         // restart. Where the number comes from is the caller's business.
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async hasAnyActive() {
-        const [field] = await this.list((0, queries_1.activeFields)(this.knex).limit(1));
+    async hasAnyReadable(audience) {
+        const [field] = await this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY, limit: 1 }));
         return Boolean(field);
     }
     /**
@@ -104,42 +109,35 @@ class CustomFieldDefinitionsService {
     isStored(namespace) {
         return namespace === identity_1.CUSTOM_NAMESPACE;
     }
-    assertDefinable(namespace) {
-        if (!this.isStored(namespace)) {
-            throw new errors_1.default.ValidationError({
-                message: `Fields cannot be defined in the "${namespace}" namespace.`,
-                property: 'namespace',
-            });
-        }
-    }
-    async browse(options = {}) {
+    async browse(options, audience) {
         if (options.namespace !== undefined && !this.isStored(options.namespace)) {
             return [];
         }
-        // Archived fields are hidden by default: most surfaces (member details, the
-        // filter picker, the importer) only ever want active fields. A caller-
-        // supplied `filter` can widen that — Settings pulls active and archived
-        // together in one request (`filter=status:[active,archived]`).
-        //
         // Whichever set comes back, it comes back in the publisher's order: filtering
         // narrows the list, it never reorders it.
-        const query = options.filter
-            ? applyFilter(this.knex(TABLE), options.filter)
-            : (0, queries_1.activeFields)(this.knex);
-        return this.list(query);
+        const { filter } = options;
+        if (filter) {
+            // A filter naming `status` decides the statuses itself, which is how Settings
+            // pulls active and archived together in one request
+            // (`filter=status:[active,archived]`). One that does not gets the same active-only
+            // scope as an unfiltered read.
+            const parsed = parseFilter(filter);
+            return this.list((0, queries_1.definitions)(this.knex, {
+                audience,
+                status: filterReferencesStatus(parsed) ? queries_1.ANY_STATUS : queries_1.ACTIVE_ONLY,
+                filter: (query) => knexify(query, parsed, { tableName: TABLE }),
+            }));
+        }
+        return this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY }));
     }
-    /**
-     * Decode a definition query into the domain, in the publisher's order.
-     *
-     * Typed off `activeFields` so the builder keeps the table's row type: every caller
-     * hands over a query against the definitions table, whatever it has narrowed.
-     */
     async list(query) {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
-        return rows.map((row) => zod_1.z.decode(codec_1.customFieldCodec, row));
+        return rows.map((row) => zod_1.z.decode(codec_1.metafieldCodec, row));
     }
-    async read(namespace, key) {
-        const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
+    async read(namespace, key, audience) {
+        const [field] = this.isStored(namespace)
+            ? await this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ANY_STATUS, key }))
+            : [];
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
@@ -156,7 +154,7 @@ class CustomFieldDefinitionsService {
      * key get distinct ones, exactly as if they had arrived as separate requests.
      */
     async add(context, namespace, input) {
-        this.assertDefinable(namespace);
+        (0, namespaces_1.assertDefinable)(namespace);
         const requestedCount = Array.isArray(input) ? input.length : 0;
         const parsed = AddFieldsInput.safeParse(input);
         if (!parsed.success) {
@@ -197,6 +195,7 @@ class CustomFieldDefinitionsService {
                         key,
                         name: field.name,
                         type: field.type,
+                        memberAccess: field.access?.member ?? access_1.MEMBER_ACCESS.none,
                         sortOrder: firstSortOrder + index,
                     });
                     keys.push(key);
@@ -242,6 +241,7 @@ class CustomFieldDefinitionsService {
                 key: wanted.key,
                 name: wanted.name,
                 type: wanted.type,
+                memberAccess: wanted.access.member,
                 sortOrder: await this.nextSortOrder(db),
             });
             const [created] = await this.readMany(db, [wanted.key]);
@@ -269,6 +269,7 @@ class CustomFieldDefinitionsService {
             key: field.key,
             name: field.name,
             type: field.type,
+            member_access: field.memberAccess,
             sort_order: field.sortOrder,
             created_at: new Date(),
         });
@@ -276,7 +277,7 @@ class CustomFieldDefinitionsService {
     /** `read` for a caller that is deciding rather than serving: absent is an answer. */
     async findByKey(key, { executor = this.knex } = {}) {
         const row = await executor(TABLE).where('key', key).first();
-        return row ? zod_1.z.decode(codec_1.customFieldCodec, row) : null;
+        return row ? zod_1.z.decode(codec_1.metafieldCodec, row) : null;
     }
     /** The same entry `add` writes. Only the caller knows its transaction committed. */
     async recordCreated(context, fields) {
@@ -335,7 +336,7 @@ class CustomFieldDefinitionsService {
      * Returns every definition, archived included, matching what the request named.
      */
     async reorder(context, namespace, input) {
-        this.assertDefinable(namespace);
+        (0, namespaces_1.assertDefinable)(namespace);
         const parsed = ReorderInput.safeParse(input);
         if (!parsed.success) {
             const issue = parsed.error.issues[0];
@@ -357,7 +358,8 @@ class CustomFieldDefinitionsService {
                     .where('key', key)
                     .update({ sort_order: ranks.get(key) });
             }
-            return this.list(trx(TABLE));
+            // An order covers the whole list, archived definitions included.
+            return this.list((0, queries_1.definitions)(trx, { audience: access_1.ADMIN, status: queries_1.ANY_STATUS }));
         });
         await this.recordAction({
             context,
@@ -399,7 +401,7 @@ class CustomFieldDefinitionsService {
     async readMany(db, keys) {
         const rows = await db(TABLE).whereIn('key', keys).select('*');
         const byKey = new Map(rows.map((row) => [row.key, row]));
-        return keys.map((key) => zod_1.z.decode(codec_1.customFieldCodec, byKey.get(key)));
+        return keys.map((key) => zod_1.z.decode(codec_1.metafieldCodec, byKey.get(key)));
     }
     /**
      * Pick a free key from the name's base: `base`, then `base_2`, `base_3`, ...
@@ -466,7 +468,7 @@ class CustomFieldDefinitionsService {
             });
         }
         const patch = parsed.data;
-        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key);
+        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key, access_1.ADMIN);
         // Key and type are immutable after creation: values are addressed by key
         // and interpreted by type, so changing either would silently orphan or
         // corrupt stored values. Reject a differing value rather than ignore it.
@@ -506,6 +508,22 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: patch.name, key, previous_name: existing.name },
             });
         }
+        if (patch.access !== undefined && patch.access.member !== existing.access.member) {
+            await this.knex(TABLE)
+                .where('key', key)
+                .update({ member_access: patch.access.member, updated_at: new Date() });
+            await this.recordAction({
+                context,
+                verb: 'changeAccess',
+                subject: existing.id,
+                details: {
+                    primary_name: patch.name ?? existing.name,
+                    key,
+                    member_access: patch.access.member,
+                    previous_member_access: existing.access.member,
+                },
+            });
+        }
         // A status change is the archive/restore transition. Only write (and log)
         // when it actually flips, so re-sending the current status is a no-op.
         if (patch.status !== undefined && patch.status !== existing.status) {
@@ -520,7 +538,7 @@ class CustomFieldDefinitionsService {
                 details: { primary_name: patch.name ?? existing.name, key },
             });
         }
-        return this.read(identity_1.CUSTOM_NAMESPACE, key);
+        return this.read(identity_1.CUSTOM_NAMESPACE, key, access_1.ADMIN);
     }
     /**
      * Permanently delete a field and every member value attached to it (the FK
@@ -551,7 +569,7 @@ class CustomFieldDefinitionsService {
         });
     }
 }
-exports.CustomFieldDefinitionsService = CustomFieldDefinitionsService;
+exports.MetafieldDefinitionsService = MetafieldDefinitionsService;
 /**
  * The shape a stated key has to have. Minting derives one that is usable by
  * construction, so this is the check that path never needed: a caller stating its own
@@ -603,12 +621,11 @@ function isUniqueConstraintViolation(error) {
     const code = error?.code;
     return code === 'ER_DUP_ENTRY' || code === 'SQLITE_CONSTRAINT';
 }
-// Apply a caller-supplied NQL filter to the definition query. A malformed filter
-// is a client error (400), not a 500. The active-only default is preserved unless
-// the filter itself constrains status, so a filter on another field (e.g. type)
-// can never surface archived fields — this is the invariant queries.ts centralises,
-// held here as the per-field default override Bookshelf's filter plugin does.
-function applyFilter(query, filter) {
+// Parse a caller-supplied NQL filter, without applying it. A malformed filter is a
+// client error (400), not a 500. Whether the result widens the statuses is decided by
+// the caller, which reads it with `filterReferencesStatus` and says so when building
+// the query; nothing here narrows anything.
+function parseFilter(filter) {
     let mongoQuery;
     try {
         mongoQuery = nql(filter).toJSON();
@@ -629,20 +646,7 @@ function applyFilter(query, filter) {
             property: 'filter',
         });
     }
-    try {
-        knexify(query, mongoQuery, { tableName: TABLE });
-    }
-    catch (err) {
-        throw new errors_1.default.BadRequestError({
-            message: 'Could not parse the filter parameter.',
-            property: 'filter',
-            err: err,
-        });
-    }
-    if (!filterReferencesStatus(mongoQuery)) {
-        query.where('status', schema_1.FIELD_STATUS.active);
-    }
-    return query;
+    return mongoQuery;
 }
 // Whether an NQL-parsed filter constrains `status` anywhere, including inside the
 // $and/$or/$nor combinators — so a status filter at any nesting counts as the

package/core/server/services/{members-custom-fields → members-metafields}/filter.js

@@ -3,8 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOM_FIELDS_RELATION = void 0;
-exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransformer;
+exports.METAFIELDS_RELATION = void 0;
+exports.createMetafieldsFilterTransformer = createMetafieldsFilterTransformer;
 // Translates the metafield clauses of a members filter into a query over the
 // values table. A metafield is a publisher-defined field on a member; it is
 // addressed as `namespace.key`, and a composite value such as an address names
@@ -15,13 +15,13 @@ exports.createCustomFieldsFilterTransformer = createCustomFieldsFilterTransforme
 //   metafields.key:'custom.company'                     // has a value
 //   metafields.key:-'custom.shipping_address.country'   // that part is not set
 //
-// The values table holds one row per stored value: `custom_field_key`, `path`
+// The values table holds one row per stored value: `metafield_key`, `path`
 // (empty for a plain field, the part's name for one part of a composite) and
 // `value_text`. A filter addresses those columns directly, so each one becomes a
 // single $elemMatch over them — positive asserts a matching row exists, $not
 // asserts none does — with no lookup against the field definitions.
 const errors_1 = __importDefault(require("@tryghost/errors"));
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const identity_1 = require("@tryghost/metafield-types/identity");
 const RELATION = 'metafields';
 const PREFIX = `${RELATION}.`;
 const KEY_ATTRIBUTE = `${PREFIX}key`;
@@ -78,11 +78,11 @@ function parseLeafAddress(raw) {
     }
     return { key: identity.key, path: identity.partPath };
 }
-function createCustomFieldsFilterTransformer() {
+function createMetafieldsFilterTransformer() {
     // One (maybe-negated) $elemMatch over the leaf columns: positive is "a leaf pinned
     // by these matches", `$not` is "no leaf does".
     function buildElemMatch(target, value, negate) {
-        const match = { custom_field_key: target.key };
+        const match = { metafield_key: target.key };
         if (value !== undefined) {
             match.path = target.path ?? ROOT_PATH;
             match.value_text = value;
@@ -167,14 +167,14 @@ function createCustomFieldsFilterTransformer() {
     return (query) => transform(query);
 }
 /**
- * The Member filter relation that exposes custom field values. A member has many leaf
+ * The Member filter relation that exposes metafield values. A member has many leaf
  * rows (one per field, or per part of a composite field), and a predicate asks whether
  * one of them matches, so this joins the values table on member_id and mongo-knex emits
  * it as a correlated `members.id IN (…)` subquery — composing with every other member
  * filter.
  */
-exports.CUSTOM_FIELDS_RELATION = {
-    tableName: 'members_custom_field_values',
+exports.METAFIELDS_RELATION = {
+    tableName: 'members_metafield_values',
     tableNameAs: RELATION,
     type: 'oneToOne',
     joinFrom: 'member_id',

package/core/server/services/{members-custom-fields → members-metafields}/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bindings = exports.values = exports.definitions = exports.actingContext = void 0;
+exports.bindings = exports.values = exports.definitions = exports.canWrite = exports.MEMBER_ACCESS = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
@@ -9,6 +9,15 @@ const actions_1 = require("./actions");
 const config_1 = require("./config");
 var actions_2 = require("./actions");
 Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
+// Which door a request came through, which is what decides how much of a member's
+// answers it may see or change. Required wherever that is asked, so a new caller
+// has to name itself rather than inherit an answer by default.
+var access_1 = require("./access");
+Object.defineProperty(exports, "ADMIN", { enumerable: true, get: function () { return access_1.ADMIN; } });
+Object.defineProperty(exports, "INTERNAL", { enumerable: true, get: function () { return access_1.INTERNAL; } });
+Object.defineProperty(exports, "MEMBERS", { enumerable: true, get: function () { return access_1.MEMBERS; } });
+Object.defineProperty(exports, "MEMBER_ACCESS", { enumerable: true, get: function () { return access_1.MEMBER_ACCESS; } });
+Object.defineProperty(exports, "canWrite", { enumerable: true, get: function () { return access_1.canWrite; } });
 function init() {
     // The three are constructed together below, so checking all of them keeps the "all or
     // none" invariant explicit rather than trusting one to stand in for the rest.
@@ -17,25 +26,25 @@ function init() {
     }
     const { knex } = require('../../data/db');
     const models = require('../../models');
-    const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordCustomFieldAction)({ Action: models.Action, context, verb, subject, details });
+    const recordAction = ({ context, verb, subject, details }) => (0, actions_1.recordMetafieldAction)({ Action: models.Action, context, verb, subject, details });
     // Resolved here, not in the service: reading config is this module's job, and
     // the service is handed a number. A getter rather than a value because the
     // ceiling is an operator setting that can change between requests, and a Ghost
     // container holds no state across them.
     const config = require('../../../shared/config');
-    exports.definitions = new definitions_service_1.CustomFieldDefinitionsService({
+    exports.definitions = new definitions_service_1.MetafieldDefinitionsService({
         knex,
         recordAction,
-        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:metafields:maxDefinitions')),
     });
     // The values service reads the field definitions straight from the table, so
     // it needs knex and the same ceiling — no handle on the definitions service.
-    exports.values = new values_service_1.CustomFieldValuesService({
+    exports.values = new values_service_1.MetafieldValuesService({
         knex,
-        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:customFields:maxDefinitions')),
+        getMaxDefinitions: () => (0, config_1.resolveMaxDefinitions)(config.get('members:metafields:maxDefinitions')),
     });
     // Built after the values, which is what a binding routes into. It has no handle on the
     // definitions: making a field is not part of binding to one, so a caller that needs both
     // asks for both.
-    exports.bindings = new bindings_service_1.CustomFieldBindingsService({ knex, values: exports.values });
+    exports.bindings = new bindings_service_1.MetafieldBindingsService({ knex, values: exports.values });
 }

package/core/server/services/{members-custom-fields → members-metafields}/key.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KEY_CHARACTERS = void 0;
 exports.mintableKey = mintableKey;
-const identity_1 = require("@tryghost/custom-field-types/identity");
+const identity_1 = require("@tryghost/metafield-types/identity");
 // Neither package ships types.
 const { stripInvisibleChars } = require('@tryghost/string');
 const unidecode = require('unidecode');

package/core/server/services/{members-custom-fields → members-metafields}/models.js

@@ -1,16 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomField = void 0;
+exports.Metafield = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
+const access_1 = require("./access");
 const schema_1 = require("./schema");
-exports.CustomField = zod_1.z.object({
+exports.Metafield = zod_1.z.object({
     id: zod_1.z.string(),
     namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     status: schema_1.FieldStatusSchema,
+    access: zod_1.z.object({ member: access_1.MemberAccessSchema }),
     createdAt: zod_1.z.date(),
     updatedAt: zod_1.z.date().nullable(),
 });

package/core/server/services/members-metafields/namespaces.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.definableByPublisher = definableByPublisher;
+exports.assertDefinable = assertDefinable;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const identity_1 = require("@tryghost/metafield-types/identity");
+/**
+ * Who may define fields in a namespace.
+ *
+ * This is a property of the namespace, not of whoever is asking, so it is settled before
+ * any question about the caller. Asking the caller first gets the order wrong in a way
+ * that shows: a request to define a field in a namespace nobody owns would be refused for
+ * want of a permission, telling the caller to go and get one, when no permission would
+ * have helped.
+ *
+ * The publisher owns `custom` and nothing owns anything else yet. An app owning its own
+ * namespace resolves here too, and will not resolve to a permission at all: the caller
+ * has to *be* that app rather than hold a role, which is why the staff permission stays
+ * named after the publisher's fields rather than after metafields at large.
+ */
+function definableByPublisher(namespace) {
+    return namespace === identity_1.CUSTOM_NAMESPACE;
+}
+function assertDefinable(namespace) {
+    if (!definableByPublisher(namespace)) {
+        throw new errors_1.default.ValidationError({
+            message: `Fields cannot be defined in the "${namespace}" namespace.`,
+            property: 'namespace',
+        });
+    }
+}

package/core/server/services/members-metafields/queries.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANY_STATUS = exports.ACTIVE_ONLY = void 0;
+exports.readableBy = readableBy;
+exports.definitions = definitions;
+exports.inFieldOrder = inFieldOrder;
+const access_1 = require("./access");
+const schema_1 = require("./schema");
+const FIELDS_TABLE = 'members_metafields';
+// Nothing in the database keeps an archived or hidden field out of a read: no
+// constraint stops a value row referencing one. Both filters are therefore applied in
+// code, and a query that forgets either is a silent bug.
+function readableBy(query, audience) {
+    query.whereIn(`${FIELDS_TABLE}.member_access`, (0, access_1.readableLevels)(audience));
+    return query;
+}
+/**
+ * Whether a read includes definitions the publisher has archived.
+ *
+ * A member is never offered an archived field. Staff managing the list are always
+ * shown one, since an archived field is still theirs to rename, restore or delete.
+ */
+exports.ACTIVE_ONLY = 'active-only';
+exports.ANY_STATUS = 'any-status';
+// Unannotated so the builder keeps the row type knex derives from the table
+// registration; naming a type here would both lose that and make the alias below
+// refer to itself.
+function metafieldsTable(db) {
+    return db(FIELDS_TABLE);
+}
+function definitions(db, scope) {
+    let query = metafieldsTable(db);
+    if (scope.filter) {
+        query = scope.filter(query);
+    }
+    if (scope.key !== undefined) {
+        query = query.where(`${FIELDS_TABLE}.key`, scope.key);
+    }
+    if (scope.status === exports.ACTIVE_ONLY) {
+        query = query.where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active);
+    }
+    if (scope.limit !== undefined) {
+        query = query.limit(scope.limit);
+    }
+    return readableBy(query, scope.audience);
+}
+/**
+ * The publisher's order, applied to every read of the list. Here for the same reason the
+ * status filter is: a read that forgets it comes back in whatever order the engine chose.
+ *
+ * `created_at` orders a site that has never reordered, where every row still holds the
+ * default rank; `id` settles the rest so the order is total.
+ */
+function inFieldOrder(query) {
+    query
+        .orderBy(`${FIELDS_TABLE}.sort_order`, 'asc')
+        .orderBy(`${FIELDS_TABLE}.created_at`, 'asc')
+        .orderBy(`${FIELDS_TABLE}.id`, 'asc');
+    return query;
+}

package/core/server/services/{members-custom-fields → members-metafields}/schema.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbBoundField = exports.DbCustomFieldBinding = exports.DbCustomFieldLeaf = exports.DbCustomFieldValue = exports.WrittenBy = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
-const custom_field_types_1 = require("@tryghost/custom-field-types");
+const metafield_types_1 = require("@tryghost/metafield-types");
 const date_1 = require("../../lib/db-types/date");
+const access_1 = require("./access");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
 // column, which is static config and cannot import this.
@@ -11,19 +12,20 @@ exports.FIELD_STATUS = { active: 'active', archived: 'archived' };
 exports.FieldStatusSchema = zod_1.z.enum([exports.FIELD_STATUS.active, exports.FIELD_STATUS.archived]);
 // The single source for the read projection and the knex table type below. `type` parses
 // as the field-type enum, so the row carries the narrow type and no codec needs a cast.
-exports.DbCustomField = zod_1.z.object({
+exports.DbMetafield = zod_1.z.object({
     id: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
+    member_access: access_1.MemberAccessSchema,
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
 });
 /**
  * How a value arrived, not who caused it: who edited a member's fields is already an
  * action, and Stripe is not a person. `type` is the namespace that makes `id` resolvable —
- * `users`, `integrations`, `members_custom_field_bindings` — so the one writer that
+ * `users`, `integrations`, `members_metafield_bindings` — so the one writer that
  * resolves in no table is the one with no id to give.
  */
 exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
@@ -31,12 +33,16 @@ exports.WrittenBy = zod_1.z.discriminatedUnion('type', [
     zod_1.z.object({ type: zod_1.z.literal('integration'), id: zod_1.z.string() }),
     zod_1.z.object({ type: zod_1.z.literal('binding'), id: zod_1.z.string() }),
     zod_1.z.object({ type: zod_1.z.literal('import'), id: zod_1.z.null() }),
+    // A member writing their own answers. Resolvable in `members`, like the others,
+    // and the only writer whose changes leave nothing in the staff action log: that
+    // log records what staff did.
+    zod_1.z.object({ type: zod_1.z.literal('member'), id: zod_1.z.string() }),
 ]);
 // One part of a member's value. What a `path` means is storage.ts's business, so the row
 // carries it as a plain string.
-exports.DbCustomFieldValue = zod_1.z.object({
+exports.DbMetafieldValue = zod_1.z.object({
     id: zod_1.z.string(),
-    custom_field_key: zod_1.z.string(),
+    metafield_key: zod_1.z.string(),
     member_id: zod_1.z.string(),
     path: zod_1.z.string(),
     // Nullable like the column, though nothing here writes a null: a part with no value
@@ -55,18 +61,18 @@ exports.DbCustomFieldValue = zod_1.z.object({
 // `type` takes no part in the assembly and is here as a gate: a value whose type has left
 // the catalog is one the definitions list no longer returns either, so failing to parse
 // is what drops it.
-exports.DbCustomFieldLeaf = zod_1.z.object({
+exports.DbMetafieldLeaf = zod_1.z.object({
     member_id: zod_1.z.string(),
     key: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
     path: zod_1.z.string(),
     value_text: zod_1.z.string(),
 });
-exports.DbCustomFieldBinding = zod_1.z.object({
+exports.DbMetafieldBinding = zod_1.z.object({
     id: zod_1.z.string(),
     product_id: zod_1.z.string(),
     port: zod_1.z.string(),
-    custom_field_key: zod_1.z.string(),
+    metafield_key: zod_1.z.string(),
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
 });
@@ -74,5 +80,5 @@ exports.DbCustomFieldBinding = zod_1.z.object({
 exports.DbBoundField = zod_1.z.object({
     binding_id: zod_1.z.string(),
     key: zod_1.z.string(),
-    type: custom_field_types_1.FieldTypeSchema,
+    type: metafield_types_1.FieldTypeSchema,
 });

package/core/server/services/{members-custom-fields → members-metafields}/serializers.js

@@ -1,22 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toCustomFieldsResponse = void 0;
+exports.toMetafieldsResponse = void 0;
 const zod_1 = require("zod");
 const case_keys_1 = require("../../lib/case-keys");
 const models_1 = require("./models");
-const CustomFieldResource = zod_1.z.object({
+const MetafieldResource = zod_1.z.object({
     namespace: zod_1.z.string(),
     key: zod_1.z.string(),
     name: zod_1.z.string(),
     type: zod_1.z.string(),
     status: zod_1.z.string(),
+    access: zod_1.z.object({ member: zod_1.z.string() }),
     created_at: zod_1.z.date(),
     updated_at: zod_1.z.date().nullable(),
 });
-const CustomFieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(CustomFieldResource) });
-exports.toCustomFieldsResponse = zod_1.z
-    .array(models_1.CustomField)
+const MetafieldsResponse = zod_1.z.object({ members_metafields: zod_1.z.array(MetafieldResource) });
+exports.toMetafieldsResponse = zod_1.z
+    .array(models_1.Metafield)
     .transform((fields) => ({
     members_metafields: fields.map((field) => (0, case_keys_1.snakeKeys)(field)),
 }))
-    .pipe(CustomFieldsResponse);
+    .pipe(MetafieldsResponse);