ghost 6.63.0 → 6.64.0

package/core/server/services/email-service/email-service.js

@@ -29,12 +29,15 @@ const messages = {
   retryEmailNotFailed: 'Only failed emails can be retried',
 };
 
-// Resume scanner won't pick up `submitting` rows older than this. Rows beyond the cutoff
-// are flipped to `failed` on first boot so they surface in admin UI for operator review
-// rather than being silently resumed (and sending stale newsletters to current members).
+// Resume scanner won't pick up `pending` or `submitting` rows older than this. Rows beyond
+// the cutoff are flipped to `failed` on first boot so they surface in admin UI for operator
+// review rather than being silently resumed (and sending stale newsletters to current members).
 // Override via `bulkEmail:resumeMaxAgeMs` in config.
 const DEFAULT_RESUME_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 
+// Non-terminal email statuses, both of which the boot scanner recovers.
+const RESUMABLE_EMAIL_STATUSES = ['pending', 'submitting'];
+
 class EmailService {
   #batchSendingService;
   #sendingService;
@@ -223,28 +226,31 @@ class EmailService {
   }
 
   /**
-   * Boot-time scanner: resumes newsletter emails left in `submitting` after a
-   * previous container's interrupted send. Iterates sequentially; one failure
-   * does not skip others. Rows older than the configured max-age are flipped
-   * to `failed` (not resumed) so stale content does not get sent to current members.
+   * Boot-time scanner: recovers newsletter emails a previous container left without work.
+   * Two shapes, both resumed through the normal emailJob path:
+   *   - `submitting` — the send was cut off mid-flight.
+   *   - `pending` — dispatch was dropped from the in-memory job queue before the job ever
+   *     started, so no batch work exists and nothing else will ever pick the row up.
+   * Iterates sequentially; one failure does not skip others. Rows older than the configured
+   * max-age are flipped to `failed` (not resumed) so stale content does not get sent to
+   * current members.
    */
   async resumeInterruptedSends() {
     const maxAgeMs = this.#config?.get?.('bulkEmail:resumeMaxAgeMs') ?? DEFAULT_RESUME_MAX_AGE_MS;
     const cutoffIso = new Date(Date.now() - maxAgeMs).toISOString();
 
     // Stale rows: too old to safely resume. Flip to `failed` so they surface in admin UI
-    // for operator review instead of being silently left in `submitting` forever.
+    // for operator review instead of being silently stuck in their current status forever.
     const stale = await this.#models.Email.findAll({
-      filter: `status:submitting+created_at:<'${cutoffIso}'`,
+      filter: `status:[${RESUMABLE_EMAIL_STATUSES.join(',')}]+created_at:<'${cutoffIso}'`,
     });
-    const staleList = stale.models || stale;
-    for (const email of staleList) {
+    for (const email of stale.models) {
       try {
         const locked = await this.#batchSendingService.updateStatusLock(
           this.#models.Email,
           email.id,
           'failed',
-          ['submitting'],
+          [email.get('status')],
         );
         if (locked) {
           logging.warn(
@@ -257,20 +263,19 @@ class EmailService {
     }
 
     // Fresh rows: within the cutoff. Resume through the normal emailJob path.
-    const emails = await this.#models.Email.findAll({
-      filter: `status:submitting+created_at:>'${cutoffIso}'`,
+    const fresh = await this.#models.Email.findAll({
+      filter: `status:[${RESUMABLE_EMAIL_STATUSES.join(',')}]+created_at:>'${cutoffIso}'`,
     });
-    const list = emails.models || emails;
-    if (staleList.length === 0 && list.length === 0) {
+    if (stale.models.length === 0 && fresh.models.length === 0) {
       return;
     }
-    if (list.length > 0) {
+    if (fresh.models.length > 0) {
       logging.info(
-        `Email resume: found ${list.length} email(s) in submitting status within max age (${maxAgeMs}ms)`,
+        `Email resume: found ${fresh.models.length} pending or submitting email(s) within max age (${maxAgeMs}ms)`,
       );
     }
 
-    for (const email of list) {
+    for (const email of fresh.models) {
       try {
         await this.#resumeOneEmail(email);
       } catch (e) {
@@ -279,23 +284,24 @@ class EmailService {
     }
 
     logging.info(
-      `Email resume scan complete: ${staleList.length} stale email(s) flipped to failed, ${list.length} fresh email(s) rescheduled`,
+      `Email resume scan complete: ${stale.models.length} stale email(s) flipped to failed, ${fresh.models.length} fresh email(s) rescheduled`,
     );
   }
 
   async #resumeOneEmail(email) {
+    const status = email.get('status');
     const post = await email.getLazyRelation('post');
     const postStatus = post ? post.get('status') : null;
     const sendable = postStatus === 'published' || postStatus === 'sent';
 
     if (!sendable) {
       // Parent post was unpublished or deleted while the email was in flight.
-      // Can't resume — mark the email as failed so it stops showing as "submitting".
+      // Can't resume — mark the email as failed so it stops showing as unsent.
       const locked = await this.#batchSendingService.updateStatusLock(
         this.#models.Email,
         email.id,
         'failed',
-        ['submitting'],
+        [status],
       );
       if (locked) {
         logging.warn(
@@ -305,19 +311,22 @@ class EmailService {
       return;
     }
 
-    // Flip submitting -> pending so emailJob's status lock (['pending', 'failed']) admits it.
-    // If updateStatusLock returns undefined, another path raced us — just continue.
-    const locked = await this.#batchSendingService.updateStatusLock(
-      this.#models.Email,
-      email.id,
-      'pending',
-      ['submitting'],
-    );
-    if (!locked) {
-      logging.info(
-        `Email resume: ${email.id} status changed before lock could be taken — skipping`,
+    // `pending` is already what emailJob's status lock (['pending', 'failed']) admits, so
+    // only `submitting` needs flipping. If updateStatusLock returns undefined, another path
+    // raced us — leave it to whoever won.
+    if (status === 'submitting') {
+      const locked = await this.#batchSendingService.updateStatusLock(
+        this.#models.Email,
+        email.id,
+        'pending',
+        ['submitting'],
       );
-      return;
+      if (!locked) {
+        logging.info(
+          `Email resume: ${email.id} status changed before lock could be taken — skipping`,
+        );
+        return;
+      }
     }
 
     // Structured breadcrumb so post-incident timing/batch state is recoverable from logs.

package/core/server/services/email-service/sending-status.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmailSendingStatus = exports.SendingStatus = exports.SendingProgress = exports.SendingPhase = void 0;
 exports.buildSendingStatus = buildSendingStatus;
 const zod_1 = require("zod");
-const ETA_COMPLETION_WINDOW = 20;
+const ETA_WINDOW_MS = 60_000;
 const ETA_MIN_INTERVALS = 2;
 exports.SendingPhase = zod_1.z.enum(['preparing', 'submitting']);
 exports.SendingProgress = zod_1.z.object({
@@ -96,12 +96,18 @@ function estimateSecondsRemaining({ remaining, samples, attemptStartedAt, }) {
             completions.push({ ...sample });
         }
     }
-    // Limit usable timestamps, not rows: fast sends may finish many batches per timestamp.
-    const window = completions.slice(-ETA_COMPLETION_WINDOW);
     // Three distinct timestamps provide two measured intervals for an initial rate.
-    if (window.length < ETA_MIN_INTERVALS + 1) {
+    if (completions.length < ETA_MIN_INTERVALS + 1) {
         return null;
     }
+    // Include the baseline at or before the last minute so the first interval's
+    // recipients have their full elapsed time. Sparse sends still need two intervals.
+    const cutoff = completions[completions.length - 1].timestamp - ETA_WINDOW_MS;
+    let baseline = completions.length - 1;
+    while (baseline > 0 && completions[baseline].timestamp > cutoff) {
+        baseline -= 1;
+    }
+    const window = completions.slice(Math.max(0, Math.min(baseline, completions.length - ETA_MIN_INTERVALS - 1)));
     // Measure combined throughput across the window, including overlapping workers.
     // The first completion is only the baseline: its recipients were processed
     // before the measured time span.

package/core/server/services/gifts/gift-email-service.js

@@ -13,6 +13,7 @@ const gift_date_1 = require("./gift-date");
 const DEFAULT_ACCENT_COLOR = '#15212A';
 class GiftEmailService {
     transactionalMailer;
+    config;
     bulkMailer;
     settingsCache;
     urlUtils;
@@ -21,7 +22,8 @@ class GiftEmailService {
     blogIcon;
     renderer;
     t;
-    constructor({ transactionalMailer, bulkMailer, settingsCache, urlUtils, getFromAddress, getReplyToAddress, blogIcon, t, }) {
+    constructor({ config, transactionalMailer, bulkMailer, settingsCache, urlUtils, getFromAddress, getReplyToAddress, blogIcon, t, }) {
+        this.config = config;
         this.transactionalMailer = transactionalMailer;
         this.bulkMailer = bulkMailer;
         this.settingsCache = settingsCache;
@@ -205,6 +207,11 @@ class GiftEmailService {
             buyerName,
             interpolation: { escapeValue: false },
         });
+        const tags = [constants_1.GIFT_DELIVERY_EMAIL_TAG];
+        const mailgunTagFromConfig = this.config.get('bulkEmail:mailgun:tag');
+        if (typeof mailgunTagFromConfig === 'string' && mailgunTagFromConfig.length > 0) {
+            tags.push(mailgunTagFromConfig);
+        }
         if (!this.bulkMailer.isConfigured()) {
             await this.transactionalMailer.send({
                 to: recipientEmail,
@@ -214,7 +221,7 @@ class GiftEmailService {
                 from: this.getFromAddress(),
                 replyTo: this.getReplyToAddress(),
                 forceTextContent: true,
-                tags: [constants_1.GIFT_DELIVERY_EMAIL_TAG],
+                tags,
                 disableTracking: true,
             });
             return { providerMessageId: null };
@@ -225,7 +232,7 @@ class GiftEmailService {
             plaintext: text,
             from: this.getFromAddress(),
             replyTo: this.getReplyToAddress(),
-            tags: [constants_1.GIFT_DELIVERY_EMAIL_TAG],
+            tags,
             disable_tracking: true,
         }, { [recipientEmail]: {} }, []);
         const providerMessageId = (0, mailgun_message_id_1.getMailgunMessageId)(response) ?? null;

package/core/server/services/gifts/index.js

@@ -52,6 +52,7 @@ function init(options) {
         getStripeApi: () => require('../stripe').api,
     });
     const giftEmailService = new gift_email_service_1.GiftEmailService({
+        config,
         transactionalMailer: new GhostMailer(),
         bulkMailer: new MailgunClient({ config, settings: settingsCache }),
         settingsCache,

package/core/server/services/i18n.js

@@ -19,7 +19,7 @@ exports.t = (...args) => {
 };
 
 exports.init = () => {
-  const i18n = require('@tryghost/i18n');
+  const i18n = require('@tryghost/i18n').default;
   const events = require('../lib/common/events');
   const settingsCache = require('../../shared/settings-cache');
 

package/core/server/services/identity-tokens/identity-token-service-wrapper.js

@@ -13,12 +13,11 @@ module.exports = class IdentityTokenServiceWrapper {
     const issuer = urlUtils.urlFor('admin', true);
 
     const settings = require('../../../shared/settings-cache');
-    const jose = require('node-jose');
+    const { getPublicKeyInfo } = require('../../lib/public-jwk');
 
     const privateKey = settings.get('ghost_private_key');
-    const keyStore = jose.JWK.createKeyStore();
-    const key = await keyStore.add(privateKey, 'pem');
+    const { kid } = await getPublicKeyInfo(privateKey);
 
-    IdentityTokenServiceWrapper.instance = new IdentityTokenService(privateKey, issuer, key.kid);
+    IdentityTokenServiceWrapper.instance = new IdentityTokenService(privateKey, issuer, kid);
   }
 };

package/core/server/services/limits.js

@@ -2,7 +2,7 @@ const errors = require('@tryghost/errors');
 const config = require('../../shared/config');
 const db = require('../data/db');
 const logging = require('@tryghost/logging');
-const LimitService = require('@tryghost/limit-service');
+const { LimitService } = require('@tryghost/limit-service');
 let limitService = new LimitService();
 
 const init = () => {
@@ -47,6 +47,22 @@ const init = () => {
   }
 };
 
+/**
+ * Route guard for a feature a host can switch off, for the routes that exist only to
+ * change it. Answers 403 with the host's own wording, which is a different thing to tell a
+ * caller than the 404 a labs flag gives: the feature exists, this plan does not include it.
+ */
+const requireFeature = (limitName) =>
+  async function requireFeatureMw(req, res, next) {
+    try {
+      await limitService.errorIfWouldGoOverLimit(limitName);
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+
 module.exports = limitService;
 
 module.exports.init = init;
+module.exports.requireFeature = requireFeature;

package/core/server/services/member-welcome-emails/service.js

@@ -898,7 +898,7 @@ class MemberWelcomeEmailServiceWrapper {
     }
 
     if (!this.i18n) {
-      const i18nLib = require('@tryghost/i18n');
+      const i18nLib = require('@tryghost/i18n').default;
       const events = require('../../lib/common/events');
 
       this.i18n = i18nLib(settingsCache.get('locale') || 'en', 'ghost');

package/core/server/services/members/import-export/index.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeImporter = makeImporter;
 exports.makeExporter = makeExporter;
+const members_metafields_1 = require("../../members-metafields");
 const importer_1 = __importDefault(require("./import/importer"));
 const reader_1 = __importDefault(require("./import/reader"));
 const spool_1 = require("./import/spool");
@@ -57,8 +58,8 @@ function makeImporter(deps) {
         }),
     };
     const metafields = {
-        activeFields: async () => deps.metafields.definitions.browse(),
-        planWrite: (values) => deps.metafields.values.planWrite(values),
+        activeFields: async () => deps.metafields.definitions.browse({}, members_metafields_1.INTERNAL),
+        planWrite: (values) => deps.metafields.values.planWrite(values, members_metafields_1.INTERNAL),
         // Every value the import writes came out of the file, whichever column carried it.
         // An import has no id to give until runs are tracked, so it names its kind only.
         applyWrite: (memberId, plan, executor) => deps.metafields.values.applyWrite(memberId, plan, {
@@ -121,8 +122,8 @@ function makeExporter({ definitions, values, }) {
         metafields: {
             // Boot builds the definitions and values services before this one, so they
             // are always present -- no not-initialised state to guard.
-            activeDefinitions: async () => definitions.browse(),
-            valuesForMembers: (memberIds) => values.getValuesForMembers(memberIds),
+            activeDefinitions: async () => definitions.browse({}, members_metafields_1.INTERNAL),
+            valuesForMembers: (memberIds) => values.getValuesForMembers(memberIds, members_metafields_1.INTERNAL),
         },
     });
     return (options = {}) => exporter.export(options);

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -1097,7 +1097,7 @@ module.exports = class RouterController {
       labels: req.body.labels,
       name: req.body.name,
       reqIp: req.ip ?? undefined,
-      newsletters: await this._validateNewsletters(req.body?.newsletters ?? []),
+      newsletters: await this._validateNewsletters(req.body?.newsletters),
       attribution: await this._memberAttributionService.getAttribution(req.body.urlHistory),
       ...(giftToken ? { giftToken } : {}),
     };
@@ -1149,10 +1149,15 @@ module.exports = class RouterController {
    * @returns {Promise<object[] | undefined>} The validated newsletters
    */
   async _validateNewsletters(requestedNewsletters) {
-    if (!requestedNewsletters || requestedNewsletters.length === 0) {
+    if (!requestedNewsletters || !Array.isArray(requestedNewsletters)) {
       return undefined;
     }
 
+    // An explicit empty list means "no newsletters", not "the defaults"
+    if (requestedNewsletters.length === 0) {
+      return [];
+    }
+
     if (requestedNewsletters.some((newsletter) => !newsletter.name)) {
       return undefined;
     }

package/core/server/services/members/members-api/controllers/well-known-controller.js

@@ -7,7 +7,8 @@ const messages = {
 };
 
 /**
- * @typedef {import('node-jose').JWK[]} JWKS
+ * @typedef {import('../../../../lib/public-jwk').PublicRsaJwk & {kid: string}} PublicJWK
+ * @typedef {{keys: PublicJWK[]}} JWKS
  */
 
 /**

package/core/server/services/members/members-api/repositories/event-repository.js

@@ -428,6 +428,8 @@ module.exports = class EventRepository {
       delete json.postAttribution?.mobiledoc;
       delete json.postAttribution?.lexical;
       delete json.postAttribution?.plaintext;
+      delete json.postAttribution?.auto_excerpt;
+      delete json.postAttribution?.reading_time;
       const createdWithStatus = json.signupStatusEvent?.to_status ?? null;
       delete json.signupStatusEvent;
       return {
@@ -488,6 +490,8 @@ module.exports = class EventRepository {
       delete json.postAttribution?.mobiledoc;
       delete json.postAttribution?.lexical;
       delete json.postAttribution?.plaintext;
+      delete json.postAttribution?.auto_excerpt;
+      delete json.postAttribution?.reading_time;
       return {
         type: 'donation_event',
         data: {

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -95,16 +95,17 @@ module.exports = class MemberBREADService {
    * size or a delivery address. Their values live in their own table, so they are fetched
    * here rather than loaded alongside the member.
    *
-   * Returns null when the site has defined no fields, which tells the caller to leave the
-   * `metafields` key off the member payload rather than send an empty object: a key added to
-   * an API response cannot be withdrawn without breaking whoever started reading it, and
-   * most sites have never defined a field, so those sites keep the payload they had before
-   * this feature existed.
+   * Returns null when this audience has no field to be told about, which tells the caller to
+   * leave the `metafields` key off the member payload rather than send an empty object: a key
+   * added to an API response cannot be withdrawn without breaking whoever started reading it,
+   * and most sites have never defined a field, so those sites keep the payload they had
+   * before this feature existed.
    * @param {string[]} memberIds
+   * @param {import('../../../members-metafields').Audience} audience
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
   async fetchMetafieldValues(memberIds, audience) {
-    if (!(await this.metafieldDefinitions.hasAnyActive())) {
+    if (!(await this.metafieldDefinitions.hasAnyReadable(audience))) {
       return null;
     }
 
@@ -385,15 +386,17 @@ module.exports = class MemberBREADService {
   /**
    * @param {object} data
    * @param {object} [options]
-   * @param {import('../../../members-metafields').Audience | null} [options.metafieldsFor]
+   * @param {import('../../../members-metafields').Audience | null} options.metafieldsFor
    *   Who the extra fields a publisher defined are being read for, or null to leave them
    *   off entirely. Null is not the same as "nobody may see them": it means this caller
    *   never shows them, so fetching them is two database queries whose results are thrown
    *   away. Ghost identifies a signed-in reader on every page view of a themed site
    *   through this method, and that caller renders a member through a fixed list of
    *   fields which has never included these.
+   *
+   *   Defaults to null, so a caller that does not ask gets none of them.
    */
-  async read(data, { metafieldsFor = ADMIN, ...options } = {}) {
+  async read(data, { metafieldsFor = null, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -562,7 +565,7 @@ module.exports = class MemberBREADService {
       await this.memberRepository.setComplimentarySubscription(model, sharedOptions);
     }
 
-    return this.read({ id: model.id }, options);
+    return this.read({ id: model.id }, { ...options, metafieldsFor: ADMIN });
   }
 
   async edit(data, options) {
@@ -678,7 +681,7 @@ module.exports = class MemberBREADService {
       }
     }
 
-    return this.read({ id: model.id }, options);
+    return this.read({ id: model.id }, { ...options, metafieldsFor: ADMIN });
   }
 
   /**
@@ -710,7 +713,7 @@ module.exports = class MemberBREADService {
       );
     }
 
-    return this.read({ id: memberId });
+    return this.read({ id: memberId }, { metafieldsFor: ADMIN });
   }
 
   /**
@@ -732,7 +735,7 @@ module.exports = class MemberBREADService {
 
     await this.memberRepository.saveCommenting(memberId, updated, 'commenting_enabled', context);
 
-    return this.read({ id: memberId });
+    return this.read({ id: memberId }, { metafieldsFor: ADMIN });
   }
 
   async logout(options) {

package/core/server/services/members/members-api/services/token-service.js

@@ -1,6 +1,6 @@
-const jose = require('node-jose');
 const jwt = require('jsonwebtoken');
 const crypto = require('crypto');
+const { getPublicKeyInfo } = require('../../../../lib/public-jwk');
 
 // A token's `scope` declares its purpose. Only identity tokens may act as a
 // member; entitlement tokens are read-only and handed to integrations.
@@ -9,24 +9,23 @@ const ENTITLEMENT_TOKEN_SCOPE = 'members:entitlements:read';
 
 module.exports = class TokenService {
   constructor({ privateKey, publicKey, issuer }) {
-    this._keyStore = jose.JWK.createKeyStore();
-    this._keyStoreReady = this._keyStore.add(privateKey, 'pem');
+    this._keyReady = getPublicKeyInfo(privateKey);
     this._privateKey = privateKey;
     this._publicKey = publicKey;
     this._issuer = issuer;
   }
 
   async encodeIdentityToken({ sub }) {
-    const jwk = await this._keyStoreReady;
+    const { kid } = await this._keyReady;
     return jwt.sign(
       {
         sub,
-        kid: jwk.kid,
+        kid,
         scope: IDENTITY_TOKEN_SCOPE,
       },
       this._privateKey,
       {
-        keyid: jwk.kid,
+        keyid: kid,
         algorithm: 'RS512',
         audience: this._issuer,
         expiresIn: '10m',
@@ -36,12 +35,12 @@ module.exports = class TokenService {
   }
 
   async encodeEntitlementToken({ sub, memberUuid, paid, activeTierIds = [] }) {
-    const jwk = await this._keyStoreReady;
+    const { kid } = await this._keyReady;
 
     return jwt.sign(
       {
         sub,
-        kid: jwk.kid,
+        kid,
         scope: ENTITLEMENT_TOKEN_SCOPE,
         member_uuid: memberUuid,
         paid,
@@ -50,7 +49,7 @@ module.exports = class TokenService {
       },
       this._privateKey,
       {
-        keyid: jwk.kid,
+        keyid: kid,
         algorithm: 'RS512',
         audience: this._issuer,
         expiresIn: '5m',
@@ -73,7 +72,7 @@ module.exports = class TokenService {
    * @returns {Promise<jwt.JwtPayload>}
    */
   async decodeToken(token) {
-    await this._keyStoreReady;
+    await this._keyReady;
 
     const result = jwt.verify(token, this._publicKey, {
       algorithms: ['RS512'],
@@ -92,7 +91,7 @@ module.exports = class TokenService {
   }
 
   async getPublicKeys() {
-    await this._keyStoreReady;
-    return this._keyStore.toJSON();
+    const { kid, jwk } = await this._keyReady;
+    return { keys: [{ kty: jwk.kty, kid, n: jwk.n, e: jwk.e }] };
   }
 };

package/core/server/services/members/middleware.js

@@ -12,6 +12,7 @@ const onHeaders = require('on-headers');
 const tiersService = require('../tiers/service');
 const config = require('../../../shared/config');
 const settingsHelpers = require('../settings-helpers');
+const { timingSafeStringEqual } = require('../../../shared/timing-safe-string-equal');
 
 const messages = {
   missingUuid: 'Missing uuid.',
@@ -237,13 +238,19 @@ const authMemberByUuid = async function authMemberByUuid(req, res, next) {
       .createHmac('sha256', settingsHelpers.getMembersValidationKey())
       .update(uuid)
       .digest('hex');
-    if (memberHmac !== key) {
+    if (!timingSafeStringEqual(memberHmac, key)) {
       throw new errors.UnauthorizedError({
         message: tpl(messages.invalidKey),
       });
     }
 
-    const member = await membersService.api.memberBREADService.read({ uuid });
+    // Nothing reached through this middleware renders a member's extra fields, so
+    // they are not fetched. It authenticates by a signed link rather than a session,
+    // which makes anything loaded here readable without being signed in.
+    const member = await membersService.api.memberBREADService.read(
+      { uuid },
+      { metafieldsFor: null },
+    );
     if (!member) {
       throw new errors.UnauthorizedError({
         message: tpl(messages.invalidUuid),

package/core/server/services/members/request-integrity-token-provider.js

@@ -1,4 +1,5 @@
 const crypto = require('crypto');
+const { timingSafeStringEqual } = require('../../../shared/timing-safe-string-equal');
 
 class RequestIntegrityTokenProvider {
   #themeSecret;
@@ -45,7 +46,7 @@ class RequestIntegrityTokenProvider {
     hmac.update(`${timestamp.toString()}:${nonce}`);
     const expectedHmac = hmac.digest('hex');
 
-    if (expectedHmac !== hmacDigest) {
+    if (!timingSafeStringEqual(expectedHmac, hmacDigest)) {
       // HMAC mismatch
       return false;
     }