ghost 6.62.0 → 6.64.0

package/core/server/services/tier-checkout-config/queries.js

@@ -4,13 +4,13 @@ exports.FIELDS_TABLE = exports.BINDINGS_TABLE = exports.CONFIG_TABLE = exports.Q
 exports.collectionRowsForTier = collectionRowsForTier;
 exports.configuredCollectionRows = configuredCollectionRows;
 exports.questionRows = questionRows;
-const schema_1 = require("../members-custom-fields/schema");
+const schema_1 = require("../members-metafields/schema");
 const checkout_1 = require("@tryghost/checkout");
 const schema_2 = require("./schema");
 exports.QUESTIONS_TABLE = 'products_checkout_fields';
 exports.CONFIG_TABLE = 'products_checkout_config';
-exports.BINDINGS_TABLE = 'members_custom_field_bindings';
-exports.FIELDS_TABLE = 'members_custom_fields';
+exports.BINDINGS_TABLE = 'members_metafield_bindings';
+exports.FIELDS_TABLE = 'members_metafields';
 const ACTIVE = schema_1.FIELD_STATUS.active;
 const optionColumns = Object.keys(schema_2.DbCheckoutOptions.shape).map((column) => `${exports.CONFIG_TABLE}.${column}`);
 function collectionQuery(db) {
@@ -18,7 +18,7 @@ function collectionQuery(db) {
         this.on(`${alias}.product_id`, 'products.id').andOn(db.raw(`${alias}.port = ?`, [port]));
     };
     const landsIn = (alias, binding) => function () {
-        this.on(`${alias}.key`, `${binding}.custom_field_key`).andOn(db.raw(`${alias}.status = ?`, [ACTIVE]));
+        this.on(`${alias}.key`, `${binding}.metafield_key`).andOn(db.raw(`${alias}.status = ?`, [ACTIVE]));
     };
     const query = db('products')
         .leftJoin(exports.CONFIG_TABLE, `${exports.CONFIG_TABLE}.product_id`, 'products.id')
@@ -33,11 +33,11 @@ function collectionQuery(db) {
         'products.id as product_id',
         `${exports.CONFIG_TABLE}.id as config_id`,
         ...optionColumns,
-        'name_binding.custom_field_key as shipping_name_key',
+        'name_binding.metafield_key as shipping_name_key',
         'name_field.key as shipping_name_collectable',
-        'shipping_binding.custom_field_key as shipping_address_key',
+        'shipping_binding.metafield_key as shipping_address_key',
         'shipping_field.key as shipping_address_collectable',
-        'phone_binding.custom_field_key as phone_key',
+        'phone_binding.metafield_key as phone_key',
         'phone_field.key as phone_collectable',
     ]);
     return query;
@@ -60,7 +60,7 @@ function questionRows(db, productId) {
     const query = db(exports.QUESTIONS_TABLE)
         .join(exports.BINDINGS_TABLE, `${exports.BINDINGS_TABLE}.id`, `${exports.QUESTIONS_TABLE}.binding_id`)
         .leftJoin({ question_field: exports.FIELDS_TABLE }, function () {
-        this.on('question_field.key', `${exports.BINDINGS_TABLE}.custom_field_key`).andOn(db.raw('question_field.status = ?', [ACTIVE]));
+        this.on('question_field.key', `${exports.BINDINGS_TABLE}.metafield_key`).andOn(db.raw('question_field.status = ?', [ACTIVE]));
     })
         .orderBy(`${exports.BINDINGS_TABLE}.product_id`, 'asc')
         .orderBy(`${exports.QUESTIONS_TABLE}.sort_order`, 'asc')

package/core/server/services/tier-checkout-config/serializers.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toCheckoutConfigResponse = exports.CheckoutConfigInput = void 0;
+exports.requirementsByTier = requirementsByTier;
 const zod_1 = require("zod");
 const checkout_1 = require("@tryghost/checkout");
 const models_1 = require("./models");
@@ -126,3 +127,59 @@ exports.toCheckoutConfigResponse = zod_1.z
     })),
 }))
     .pipe(CheckoutConfigResponse);
+/**
+ * What a tier asks a member for, as the tier payload carries it.
+ *
+ * The same rows as the publisher's resource above, minus everything about where a value
+ * lands. A member supplies a delivery address rather than a value for a named field, and
+ * which field holds it is the publisher's business; naming it here would invite a client
+ * to write there directly. The tax number goes too, because the processor keeps one
+ * against the customer it invoices and Ghost never stores it. So do the checkout
+ * questions, which a tier change does not draw.
+ *
+ * Not named for the collection, deliberately: a collection in this domain is a collected
+ * thing together with the field it lands in, and that second half is exactly the part
+ * this drops.
+ */
+const TierRequirements = zod_1.z.object({
+    /**
+     * A block appears only when the tier asks for that thing, and says so as well, the same
+     * way the publisher's resource does. Presence and the flag agree, so a client may read
+     * whichever it finds clearer.
+     *
+     * Neither says whether a thing may be skipped, because nothing here may be: everything
+     * a tier requires is required. Collection a member could decline is the change that
+     * would need a field of its own rather than a new reading of these two.
+     */
+    shipping: zod_1.z
+        .object({
+        collect: zod_1.z.literal(true),
+        /** Absent means everywhere the processor ships, the same as for a publisher. */
+        allowed_countries: zod_1.z.array(zod_1.z.string()).optional(),
+    })
+        .optional(),
+    phone: zod_1.z.object({ collect: zod_1.z.literal(true) }).optional(),
+});
+/**
+ * Keyed by tier, because the payload this joins onto is a list of tiers and a lookup is
+ * the only thing it needs. Tiers a publisher has never set up are absent, and a tier that
+ * collects only a tax number resolves to nothing asked.
+ */
+function requirementsByTier(configs) {
+    return new Map(configs.map((config) => [
+        config.tierId,
+        TierRequirements.parse({
+            ...(config.shipping
+                ? {
+                    shipping: {
+                        collect: true,
+                        ...(config.shipping.allowedCountries
+                            ? { allowed_countries: config.shipping.allowedCountries }
+                            : {}),
+                    },
+                }
+                : {}),
+            ...(config.phone ? { phone: { collect: true } } : {}),
+        }),
+    ]));
+}

package/core/server/services/tier-checkout-config/service.js

@@ -7,12 +7,23 @@ exports.TierCheckoutConfigService = void 0;
 const bson_objectid_1 = __importDefault(require("bson-objectid"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
 const zod_1 = require("zod");
-const schema_1 = require("../members-custom-fields/schema");
+const schema_1 = require("../members-metafields/schema");
+const members_metafields_1 = require("../members-metafields");
 const checkout_1 = require("@tryghost/checkout");
 const codec_1 = require("./codec");
 const queries_1 = require("./queries");
 const models_1 = require("./models");
 const serializers_1 = require("./serializers");
+/**
+ * What a member may do with a field this service creates for them.
+ *
+ * The opposite of the default a publisher-made field gets. These hold what the member
+ * themselves gave at checkout, and collection can be switched on while the screen for
+ * opening a field to members is not, since the two sit behind different flags. A closed
+ * default would then leave a member unable to correct their own address and nobody able
+ * to open it for them.
+ */
+const COLLECTED_FIELD_ACCESS = { member: members_metafields_1.MEMBER_ACCESS.write };
 /**
  * A request states its settings in named sections: one for shipping, one for phone. Each
  * section stands for one or more of the values Stripe hands back when a checkout is
@@ -142,7 +153,12 @@ class TierCheckoutConfigService {
                 });
             }
             if (!alreadyPlanned) {
-                create.set(key, { key, name: wants.name, type: wants.type });
+                create.set(key, {
+                    key,
+                    name: wants.name,
+                    type: wants.type,
+                    access: COLLECTED_FIELD_ACCESS,
+                });
             }
         }
         return { clear, create: [...create.values()], bind: wanted };

package/core/server/services/tiers/service.js

@@ -32,14 +32,14 @@ class TiersServiceWrapper {
     });
 
     // What a tier's checkout asks, kept beside the tier rather than inside it: these
-    // rows are read live on every request, because deleting a custom field cascades a
+    // rows are read live on every request, because deleting a metafield cascades a
     // question away without the repository above ever seeing it, and a cached copy
     // would go on naming a field the site no longer has.
     //
-    // Boot builds the custom fields services before this one, so both collaborators
+    // Boot builds the metafields services before this one, so both collaborators
     // are ready by the time this runs.
     const { TierCheckoutConfigService } = require('../tier-checkout-config');
-    const { bindings, definitions } = require('../members-custom-fields');
+    const { bindings, definitions } = require('../members-metafields');
     this.checkout = new TierCheckoutConfigService({
       knex: models.Base.knex,
       // A binding is where a collected value lands, and the same rows are what a completed

package/core/server/services/tinybird/tinybird-service.js

@@ -58,6 +58,7 @@ const TINYBIRD_PIPES = [
   'api_top_utm_terms',
   'api_top_devices',
   'api_gift_link_visits',
+  'api_automation_browse_stats',
   // v2 pipes (materialized view optimization)
   'api_kpis_v2',
   'api_active_visitors_v2',

package/core/server/services/tinybird-sync/get-ingest-config.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getIngestConfig = getIngestConfig;
+const zod_1 = require("zod");
+const StatsConfigSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1).optional(),
+});
+const SiteUuidSchema = zod_1.z.string().min(1);
+const SyncAuthKeySchema = zod_1.z.string().min(1);
+const TrackerEndpointSchema = zod_1.z.url();
+const ANALYTICS_PATH_PREFIX = '/.ghost/analytics/';
+function getIngestConfig({ config, settingsCache, }) {
+    const trackerEndpointResult = TrackerEndpointSchema.safeParse(config.get('tinybird:tracker:endpoint'));
+    const syncAuthKeyResult = SyncAuthKeySchema.safeParse(config.get('tinybird:sync_auth_key'));
+    if (!trackerEndpointResult.success || !syncAuthKeyResult.success) {
+        return null;
+    }
+    const endpoint = new URL(trackerEndpointResult.data);
+    const analyticsPathIndex = endpoint.pathname.indexOf(ANALYTICS_PATH_PREFIX);
+    if (analyticsPathIndex === -1) {
+        return null;
+    }
+    endpoint.pathname = `${endpoint.pathname.slice(0, analyticsPathIndex + ANALYTICS_PATH_PREFIX.length)}api/v1/tinybird-sync`;
+    const statsResult = StatsConfigSchema.safeParse(config.get('tinybird:stats'));
+    const settingsSiteUuidResult = SiteUuidSchema.safeParse(settingsCache.get('site_uuid'));
+    let siteUuid = statsResult.success ? statsResult.data.id : undefined;
+    if (!siteUuid && settingsSiteUuidResult.success) {
+        siteUuid = settingsSiteUuidResult.data;
+    }
+    if (!siteUuid) {
+        return null;
+    }
+    return {
+        endpoint,
+        // secretlint-disable-next-line @secretlint/secretlint-rule-pattern
+        trafficAnalyticsAuth: syncAuthKeyResult.data,
+        siteUuid,
+    };
+}

package/core/server/services/tinybird-sync/index.js

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.start = void 0;
+const promises_1 = require("node:timers/promises");
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const config_1 = __importDefault(require("../../../shared/config"));
+// @ts-expect-error This module lacks type definitions.
+const settings_cache_1 = __importDefault(require("../../../shared/settings-cache"));
+const db_1 = require("../../data/db");
+const tinybird_sync_service_1 = require("./tinybird-sync-service");
+const service = (0, tinybird_sync_service_1.createTinybirdSyncService)({
+    config: config_1.default,
+    settingsCache: settings_cache_1.default,
+    knex: db_1.knex,
+    logging: logging_1.default,
+    sleep: async (ms) => {
+        await (0, promises_1.setTimeout)(ms, undefined, { ref: false });
+    },
+    random: Math.random,
+    now: () => new Date(),
+    fetch: globalThis.fetch,
+    createId: () => (0, bson_objectid_1.default)().toHexString(),
+});
+exports.start = service.start;

package/core/server/services/tinybird-sync/sync-table-to-tinybird.js

@@ -0,0 +1,149 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFETY_LAG_MS = exports.AUTOMATION_SYNC_TARGETS = void 0;
+exports.syncTableToTinybird = syncTableToTinybird;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const date_1 = require("../../lib/db-types/date");
+// Only what the Tinybird materialized views read. Member identity and lock bookkeeping
+// stay in MySQL.
+exports.AUTOMATION_SYNC_TARGETS = [
+    {
+        table: 'automation_runs',
+        columns: ['id', 'automation_id', 'created_at', 'updated_at'],
+    },
+    {
+        table: 'automation_run_steps',
+        columns: [
+            'id',
+            'automation_run_id',
+            'automation_action_revision_id',
+            'status',
+            'step_attempts',
+            'ready_at',
+            'started_at',
+            'finished_at',
+            'created_at',
+            'updated_at',
+        ],
+    },
+];
+// A row's updated_at is assigned before its transaction commits, so a row can become
+// visible after rows with later timestamps. Holding back the newest rows keeps the
+// watermark from moving past a row whose transaction is still open.
+exports.SAFETY_LAG_MS = 60 * 1000;
+const serializeValue = (key, value) => key.endsWith('_at') && value !== null && value !== undefined
+    ? (0, date_1.fromDatabaseDate)(value).toISOString()
+    : value;
+const toEventLine = (row, siteUuid, type) => {
+    const payload = Object.fromEntries(Object.entries(row).map(([key, value]) => [key, serializeValue(key, value)]));
+    return JSON.stringify({
+        type,
+        site_uuid: siteUuid,
+        id: row.id,
+        updated_at: (0, date_1.fromDatabaseDate)(row.updated_at).toISOString(),
+        payload: { ...payload, site_uuid: siteUuid },
+    });
+};
+function* chunkByPayloadLimits(lines, maxBytes, maxMessages) {
+    let current = [];
+    let currentBytes = 0;
+    for (const line of lines) {
+        const bytes = Buffer.byteLength(line) + '\n'.length;
+        if (current.length && (currentBytes + bytes > maxBytes || current.length === maxMessages)) {
+            yield current;
+            current = [];
+            currentBytes = 0;
+        }
+        current.push(line);
+        currentBytes += bytes;
+    }
+    if (current.length) {
+        yield current;
+    }
+}
+async function postEvents(lines, { table }, { endpoint, trafficAnalyticsAuth, siteUuid, fetch, requestTimeoutMs }) {
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${trafficAnalyticsAuth}`,
+            'Content-Type': 'application/x-ndjson',
+            'x-site-uuid': siteUuid,
+        },
+        body: lines.join('\n'),
+        signal: AbortSignal.timeout(requestTimeoutMs),
+    });
+    if (!response.ok) {
+        throw new errors_1.default.InternalServerError({
+            message: `Traffic Analytics returned ${response.status} while syncing ${table}: ${await response.text()}`,
+        });
+    }
+}
+async function readWatermark(knex, table) {
+    const row = await knex('tinybird_syncs')
+        .select('last_synced_updated_at', 'last_synced_id')
+        .where({ table_name: table })
+        .first();
+    if (!row) {
+        return null;
+    }
+    return { updatedAt: (0, date_1.fromDatabaseDate)(row.last_synced_updated_at), id: row.last_synced_id };
+}
+async function writeWatermark(knex, table, cursor, now, createId) {
+    const timestamp = (0, date_1.toDatabaseDate)(now);
+    const values = {
+        last_synced_updated_at: (0, date_1.toDatabaseDate)(cursor.updatedAt),
+        last_synced_id: cursor.id,
+        updated_at: timestamp,
+    };
+    await knex('tinybird_syncs')
+        .insert({
+        id: createId(),
+        table_name: table,
+        ...values,
+        created_at: timestamp,
+    })
+        .onConflict('table_name')
+        .merge(values);
+}
+async function readBatch({ table, columns }, { knex, batchSize }, cursor, cutoff) {
+    const query = knex(table)
+        .select(columns)
+        .where('updated_at', '<', cutoff)
+        .orderBy([{ column: 'updated_at' }, { column: 'id' }])
+        .limit(batchSize);
+    if (cursor) {
+        const updatedAt = (0, date_1.toDatabaseDate)(cursor.updatedAt);
+        query.andWhere((builder) => builder
+            .where('updated_at', '>', updatedAt)
+            .orWhere((tie) => tie.where('updated_at', updatedAt).andWhere('id', '>', cursor.id)));
+    }
+    return await query;
+}
+async function syncTableToTinybird(target, options) {
+    const { knex, siteUuid, now, createId, batchSize, maxPayloadBytes, maxPayloadMessages } = options;
+    const cutoff = (0, date_1.toDatabaseDate)(new Date(now().getTime() - exports.SAFETY_LAG_MS));
+    let cursor = await readWatermark(knex, target.table);
+    let sent = 0;
+    while (true) {
+        const rows = await readBatch(target, options, cursor, cutoff);
+        if (!rows.length) {
+            return sent;
+        }
+        const lines = rows.map((row) => toEventLine(row, siteUuid, target.table));
+        for (const chunk of chunkByPayloadLimits(lines, maxPayloadBytes, maxPayloadMessages)) {
+            await postEvents(chunk, target, options);
+        }
+        const last = rows[rows.length - 1];
+        cursor = { updatedAt: (0, date_1.fromDatabaseDate)(last.updated_at), id: last.id };
+        await writeWatermark(knex, target.table, cursor, now(), createId);
+        sent += rows.length;
+        // This is a performance optimization to prevent one needless batch read.
+        // It is not required for correctness.
+        if (rows.length < batchSize) {
+            return sent;
+        }
+    }
+}

package/core/server/services/tinybird-sync/tinybird-sync-service.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTinybirdSyncService = createTinybirdSyncService;
+const get_ingest_config_1 = require("./get-ingest-config");
+const sync_table_to_tinybird_1 = require("./sync-table-to-tinybird");
+const INTERVAL_MS = 5 * 60 * 1000;
+const BATCH_SIZE = 5000;
+// This should be a little less than the maximum, because rows are chunked by
+// JSON line, not bytes strictly.
+const MAX_PAYLOAD_BYTES = 9 * 1024 * 1024;
+const MAX_PAYLOAD_MESSAGES = 1000;
+const REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
+function createTinybirdSyncService({ config, settingsCache, knex, logging, sleep, random, now, fetch, createId, }) {
+    let started = false;
+    const syncAll = async (ingest) => {
+        const results = await Promise.allSettled(sync_table_to_tinybird_1.AUTOMATION_SYNC_TARGETS.map(async (target) => {
+            const sent = await (0, sync_table_to_tinybird_1.syncTableToTinybird)(target, {
+                knex,
+                ...ingest,
+                now,
+                fetch,
+                createId,
+                batchSize: BATCH_SIZE,
+                maxPayloadBytes: MAX_PAYLOAD_BYTES,
+                maxPayloadMessages: MAX_PAYLOAD_MESSAGES,
+                requestTimeoutMs: REQUEST_TIMEOUT_MS,
+            });
+            logging.info({ system: { event: 'tinybird.sync.completed', table: target.table, sent } }, `[Tinybird sync] ${target.table}: sent ${sent} rows`);
+        }));
+        for (const result of results) {
+            if (result.status === 'rejected') {
+                logging.error(result.reason, '[Tinybird sync] Failed to sync table');
+            }
+        }
+    };
+    const runLoop = async (ingest) => {
+        await sleep(Math.floor(random() * INTERVAL_MS));
+        while (true) {
+            await syncAll(ingest);
+            await sleep(INTERVAL_MS);
+        }
+    };
+    const start = () => {
+        if (started) {
+            return;
+        }
+        const ingest = (0, get_ingest_config_1.getIngestConfig)({ config, settingsCache });
+        if (!ingest) {
+            logging.info('[Tinybird sync] Not started: Traffic Analytics service is not configured');
+            return;
+        }
+        started = true;
+        void runLoop(ingest)
+            .then(() => {
+            logging.error('[Tinybird sync] Loop stopped unexpectedly');
+        })
+            .catch((error) => {
+            logging.error(error, '[Tinybird sync] Loop stopped');
+        });
+    };
+    return { start };
+}

package/core/server/services/url/router-filter.js

@@ -1,11 +1,14 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EXPANSIONS = void 0;
 exports.routerTypeOf = routerTypeOf;
 exports.buildFilter = buildFilter;
 exports.filterMatches = filterMatches;
-const nql = require('@tryghost/nql');
-const logging = require('@tryghost/logging');
+const nql_1 = __importDefault(require("@tryghost/nql"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
 // NQL evaluation for routes.yaml collection filters, kept in one place so the
 // forward lookup, ownership check and reverse lookup all decide membership the
 // same way.
@@ -17,7 +20,7 @@ exports.EXPANSIONS = [
     { key: 'primary_tag', replacement: 'primary_tag.slug' },
     { key: 'primary_author', replacement: 'primary_author.slug' },
 ];
-const PAGE_TRANSFORMER = nql.utils.mapKeyValues({
+const PAGE_TRANSFORMER = nql_1.default.utils.mapKeyValues({
     key: { from: 'page', to: 'type' },
     values: [
         { from: false, to: 'post' },
@@ -45,7 +48,7 @@ function buildFilter(filter) {
     if (!filter) {
         return null;
     }
-    return nql(filter, { expansions: exports.EXPANSIONS, transformer: PAGE_TRANSFORMER });
+    return (0, nql_1.default)(filter, { expansions: exports.EXPANSIONS, transformer: PAGE_TRANSFORMER });
 }
 // A null filter always matches; anything that throws is a non-match, not an
 // error.
@@ -65,12 +68,7 @@ function filterMatches(compiledFilter, record) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        logging.warn('NQL match failed', message);
+        logging_1.default.warn('NQL match failed', message);
         return false;
     }
 }
-module.exports = { EXPANSIONS: exports.EXPANSIONS, routerTypeOf, buildFilter, filterMatches };
-module.exports.EXPANSIONS = exports.EXPANSIONS;
-module.exports.routerTypeOf = routerTypeOf;
-module.exports.buildFilter = buildFilter;
-module.exports.filterMatches = filterMatches;

package/core/server/services/users.js

@@ -1,5 +1,4 @@
 // @ts-check
-const path = require('path');
 const ObjectId = require('bson-objectid').default;
 
 /**
@@ -7,11 +6,6 @@ const ObjectId = require('bson-objectid').default;
  */
 const DomainEvents = require('@tryghost/domain-events/lib/DomainEvents');
 
-/**
- * @typedef {Object} IdbBackup
- * @prop {() => Promise<string>} backup
- */
-
 /**
  * @typedef {Object} IModels
  * @prop {Object} Base
@@ -40,14 +34,12 @@ const DomainEvents = require('@tryghost/domain-events/lib/DomainEvents');
 class Users {
   /**
    * @param {Object} dependencies
-   * @param {IdbBackup} dependencies.dbBackup
    * @param {IModels} dependencies.models
    * @param {IAuth} dependencies.auth
    * @param {Object} dependencies.apiMail
    * @param {Object} dependencies.apiSettings
    */
-  constructor({ dbBackup, models, auth, apiMail, apiSettings }) {
-    this.dbBackup = dbBackup;
+  constructor({ models, auth, apiMail, apiSettings }) {
     this.models = models;
     this.auth = auth;
     this.apiMail = apiMail;
@@ -183,14 +175,6 @@ class Users {
    * @returns
    */
   async destroyUser(frameOptions) {
-    let filename = null;
-    const backupPath = await this.dbBackup.backup();
-
-    if (backupPath) {
-      const parsedFileName = path.parse(backupPath);
-      filename = `${parsedFileName.name}${parsedFileName.ext}`;
-    }
-
     return this.models.Base.transaction(async (t) => {
       frameOptions.transacting = t;
 
@@ -234,8 +218,6 @@ class Users {
       }
 
       await this.models.User.destroy(Object.assign({ status: 'all' }, frameOptions));
-
-      return filename;
     });
   }
 }

package/core/server/web/api/endpoints/admin/routes.js

@@ -5,6 +5,7 @@ const auth = require('../../../../services/auth');
 const apiMw = require('../../middleware');
 const mw = require('./middleware');
 const labs = require('../../../../../shared/labs');
+const limits = require('../../../../services/limits');
 
 const shared = require('../../../shared');
 
@@ -195,40 +196,38 @@ module.exports = function apiRoutes() {
 
   router.get('/members/stripe_connect', mw.authAdminApi, http(api.membersStripeConnect.auth));
 
-  // Reading definitions is deliberately not behind the feature flag: Admin asks every site
-  // for them, and a site without the flag simply has none, so the answer is an empty list
-  // rather than a 404. Creating and changing them is flagged. Registered before /members/:id
-  // so the literal path is not captured as an id.
-  router.get('/members/metafields/:namespace', mw.authAdminApi, http(api.membersMetafields.browse));
-  router.post(
-    '/members/metafields/:namespace',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.add),
-  );
-  router.put(
-    '/members/metafields/:namespace',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.reorder),
-  );
-  router.get(
-    '/members/metafields/:namespace/:key',
-    mw.authAdminApi,
-    http(api.membersMetafields.read),
-  );
-  router.put(
-    '/members/metafields/:namespace/:key',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.edit),
-  );
-  router.delete(
-    '/members/metafields/:namespace/:key',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.destroy),
-  );
+  // Custom field definitions. Mounted rather than listed so every route under it is
+  // reached the same way, and so the guards are stated once each instead of on every
+  // route that needs them.
+  //
+  // Order carries the rule here, the way Express reads it: a request walks this stack
+  // from the top, so the reads below are answered before the guards are reached, and
+  // everything registered after them passes through both. A route added at the end is
+  // guarded by being there, which is the safer way round to forget.
+  //
+  // Mounted before /members/:id so the literal path is not captured as an id.
+  const metafieldsRouter = express.Router('admin api members metafields');
+  router.use('/members/metafields', metafieldsRouter);
+
+  metafieldsRouter.use(mw.authAdminApi);
+
+  // Reading is deliberately open: Admin asks every site for its definitions to draw
+  // screens it renders either way, and a site that has none simply answers with an empty
+  // list rather than a 404.
+  metafieldsRouter.get('/:namespace', http(api.membersMetafields.browse));
+  metafieldsRouter.get('/:namespace/:key', http(api.membersMetafields.read));
+
+  // Changing one needs the feature to exist in this build and the site's plan to include
+  // it. Two separate questions, asked once each: a 404 says the feature is not here, a 403
+  // says the plan does not cover it, and only the second is something a publisher can act
+  // on.
+  metafieldsRouter.use(labs.enabledMiddleware('membersCustomFields'));
+  metafieldsRouter.use(limits.requireFeature('limitCustomFields'));
+
+  metafieldsRouter.post('/:namespace', http(api.membersMetafields.add));
+  metafieldsRouter.put('/:namespace', http(api.membersMetafields.reorder));
+  metafieldsRouter.put('/:namespace/:key', http(api.membersMetafields.edit));
+  metafieldsRouter.delete('/:namespace/:key', http(api.membersMetafields.destroy));
 
   router.get('/members/:id', mw.authAdminApi, http(api.members.read));
   router.put('/members/:id', mw.authAdminApi, http(api.members.edit));
@@ -521,6 +520,7 @@ module.exports = function apiRoutes() {
   // ## Emails
   router.get('/emails', mw.authAdminApi, http(api.emails.browse));
   router.get('/emails/:id', mw.authAdminApi, http(api.emails.read));
+  router.get('/emails/:id/status', mw.authAdminApi, http(api.emails.sendingStatus));
   router.put('/emails/:id/retry', mw.authAdminApi, http(api.emails.retry));
   router.get('/emails/:id/batches', mw.authAdminApi, http(api.emails.browseBatches));
   router.get('/emails/:id/recipient-failures', mw.authAdminApi, http(api.emails.browseFailures));