ghost 6.63.0 → 6.65.0

package/core/server/api/endpoints/actions.js

@@ -1,4 +1,5 @@
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
@@ -11,7 +12,7 @@ const controller = {
     options: ['page', 'limit', 'fields', 'include', 'filter'],
     permissions: true,
     query(frame) {
-      return models.Action.findPage(frame.options);
+      return models.Action.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 };

package/core/server/api/endpoints/automated-emails.js

@@ -6,8 +6,10 @@ const memberWelcomeEmailService = require('../../services/member-welcome-emails/
 const emailAddressService = require('../../services/email-address');
 const {
   DEFAULT_EMAIL_DESIGN_SETTING_SLUG,
+  MEMBER_WELCOME_EMAIL_SLUGS,
 } = require('../../services/member-welcome-emails/constants');
 const { validateEmailSenderFields } = require('./utils/validate-email-sender-fields');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   automatedEmailNotFound: 'Automated email not found.',
@@ -22,6 +24,10 @@ const AUTOMATION_FIELDS = ['status', 'name', 'slug'];
 const EMAIL_FIELDS = ['subject', 'lexical', 'email_design_setting_id'];
 const SENDER_FIELDS = ['sender_name', 'sender_email', 'sender_reply_to'];
 
+const MEMBER_WELCOME_EMAIL_FILTER = Object.values(MEMBER_WELCOME_EMAIL_SLUGS)
+  .map((slug) => `slug:${slug}`)
+  .join(',');
+
 function flattenAutomation(
   automation,
   email = automation.related('welcomeEmailAutomatedEmail'),
@@ -93,11 +99,12 @@ const controller = {
     headers: {
       cacheInvalidate: false,
     },
-    options: ['filter', 'fields', 'limit', 'order', 'page'],
+    options: ['fields', 'limit', 'order', 'page'],
     permissions: true,
     async query(frame) {
       const result = await models.Automation.findPage({
-        ...frame.options,
+        ...restrictAdminApiQueryOptions(frame.options),
+        filter: MEMBER_WELCOME_EMAIL_FILTER,
         withRelated: [
           'welcomeEmailAutomatedEmail',
           'welcomeEmailAutomatedEmail.emailDesignSetting',
@@ -117,12 +124,12 @@ const controller = {
     headers: {
       cacheInvalidate: false,
     },
-    options: ['filter', 'fields'],
+    options: ['fields'],
     data: ['id'],
     permissions: true,
     async query(frame) {
       const model = await models.Automation.findOne(frame.data, {
-        ...frame.options,
+        ...restrictAdminApiQueryOptions(frame.options),
         withRelated: [
           'welcomeEmailAutomatedEmail',
           'welcomeEmailAutomatedEmail.emailDesignSetting',

package/core/server/api/endpoints/automations.js

@@ -1,54 +1,82 @@
-const automationsApi = require('../../services/automations/automations-api');
-
-/** @type {import('@tryghost/api-framework').Controller} */
-const controller = {
-  docName: 'automations',
-
-  browse: {
-    headers: {
-      cacheInvalidate: false,
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.controller = void 0;
+const automationsApi = __importStar(require("../../services/automations/automations-api"));
+exports.controller = {
+    docName: 'automations',
+    browse: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        permissions: true,
+        async query() {
+            return await automationsApi.browse();
+        },
     },
-    permissions: true,
-    async query() {
-      return await automationsApi.browse();
+    read: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        data: ['id'],
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.read(frame.data.id);
+        },
     },
-  },
-
-  read: {
-    headers: {
-      cacheInvalidate: false,
+    edit: {
+        headers: {
+            cacheInvalidate: false,
+        },
+        options: ['id'],
+        permissions: true,
+        async query(frame) {
+            return await automationsApi.edit(frame.options.id, frame.data?.automations?.[0]);
+        },
     },
-    data: ['id'],
-    permissions: true,
-    async query(frame) {
-      return await automationsApi.read(frame.data.id);
+    poll: {
+        statusCode: 204,
+        headers: {
+            cacheInvalidate: false,
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'poll',
+        },
+        query() {
+            automationsApi.requestPoll();
+        },
     },
-  },
-
-  edit: {
-    headers: {
-      cacheInvalidate: false,
-    },
-    options: ['id'],
-    permissions: true,
-    async query(frame) {
-      return await automationsApi.edit(frame.options.id, frame.data?.automations?.[0]);
-    },
-  },
-
-  poll: {
-    statusCode: 204,
-    headers: {
-      cacheInvalidate: false,
-    },
-    permissions: {
-      docName: 'automations',
-      method: 'poll',
-    },
-    query() {
-      automationsApi.requestPoll();
-    },
-  },
 };
-
-module.exports = controller;

package/core/server/api/endpoints/db.js

@@ -66,7 +66,7 @@ const controller = {
     // eslint-disable-next-line ghost/ghost-custom/max-api-complexity
     async query(frame) {
       if (frame.options.filename) {
-        let backup = await dbBackup.readBackup(frame.options.filename);
+        const backup = await dbBackup.readBackup(frame.options.filename);
 
         if (!backup) {
           throw new errors.NotFoundError();

package/core/server/api/endpoints/emails.js

@@ -3,6 +3,7 @@ const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const emailService = require('../../services/email-service');
 const emailAnalytics = require('../../services/email-analytics');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   emailNotFound: 'Email not found.',
@@ -23,7 +24,7 @@ const controller = {
     options: ['limit', 'fields', 'filter', 'order', 'page'],
     permissions: true,
     async query(frame) {
-      return await models.Email.findPage(frame.options);
+      return await models.Email.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -94,7 +95,9 @@ const controller = {
     async query(frame) {
       const filter =
         `email_id:'${frame.data.id}'` + (frame.options.filter ? `+(${frame.options.filter})` : '');
-      return await models.EmailBatch.findPage({ ...frame.options, filter });
+      return await models.EmailBatch.findPage(
+        restrictAdminApiQueryOptions({ ...frame.options, filter }),
+      );
     },
   },
 
@@ -117,7 +120,9 @@ const controller = {
     async query(frame) {
       const filter =
         `email_id:'${frame.data.id}'` + (frame.options.filter ? `+(${frame.options.filter})` : '');
-      return await models.EmailRecipientFailure.findPage({ ...frame.options, filter });
+      return await models.EmailRecipientFailure.findPage(
+        restrictAdminApiQueryOptions({ ...frame.options, filter }),
+      );
     },
   },
 
@@ -129,7 +134,7 @@ const controller = {
       method: 'browse',
     },
     async query() {
-      return emailAnalytics.newsletters.service.getStatus();
+      return emailAnalytics.getNewsletters().service.getStatus();
     },
   },
 
@@ -156,7 +161,7 @@ const controller = {
             ),
           );
 
-      return emailAnalytics.newsletters.service.schedule({ begin, end });
+      return emailAnalytics.getNewsletters().service.schedule({ begin, end });
     },
   },
 
@@ -168,7 +173,7 @@ const controller = {
       method: 'browse',
     },
     async query() {
-      return emailAnalytics.newsletters.service.cancelScheduled();
+      return emailAnalytics.getNewsletters().service.cancelScheduled();
     },
   },
 };

package/core/server/api/endpoints/index.js

@@ -8,7 +8,7 @@ const localUtils = require('./utils');
 
 module.exports = {
   get automations() {
-    return apiFramework.pipeline(require('./automations'), localUtils);
+    return apiFramework.pipeline(require('./automations').controller, localUtils);
   },
 
   get automationActionLinks() {

package/core/server/api/endpoints/invites.js

@@ -3,6 +3,7 @@ const errors = require('@tryghost/errors');
 const invites = require('../../services/invites');
 const models = require('../../models');
 const api = require('./index');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = [];
 const UNSAFE_ATTRS = ['role_id'];
 
@@ -26,7 +27,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Invite.findPage(frame.options);
+      return models.Invite.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/labels.js

@@ -1,6 +1,7 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   labelNotFound: 'Label not found.',
@@ -42,7 +43,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Label.findPage(frame.options);
+      return models.Label.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -61,7 +62,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.Label.findOne(frame.data, frame.options);
+      const model = await models.Label.findOne(
+        frame.data,
+        restrictAdminApiQueryOptions(frame.options),
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.labelNotFound),

package/core/server/api/endpoints/mail.js

@@ -2,7 +2,7 @@ const tpl = require('@tryghost/tpl');
 const mailService = require('../../services/mail');
 const api = require('./');
 let mailer;
-let _private = {};
+const _private = {};
 
 const messages = {
   unableToSendEmail: 'Ghost is currently unable to send email.',

package/core/server/api/endpoints/member-metafields.js

@@ -37,7 +37,7 @@ const controller = {
             return members_metafields_1.definitions.browse({
                 namespace: frame.options.namespace,
                 filter: frame.options.filter,
-            });
+            }, members_metafields_1.ADMIN);
         },
     },
     read: {
@@ -46,7 +46,7 @@ const controller = {
         validation: { options: { namespace: { required: true }, key: { required: true } } },
         permissions: false,
         query(frame) {
-            return members_metafields_1.definitions.read(frame.options.namespace, frame.options.key);
+            return members_metafields_1.definitions.read(frame.options.namespace, frame.options.key, members_metafields_1.ADMIN);
         },
     },
     add: {

package/core/server/api/endpoints/member-signin-urls.js

@@ -17,7 +17,7 @@ const controller = {
     data: ['id'],
     permissions: true,
     async query(frame) {
-      let model = await membersService.api.members.get(frame.data, frame.options);
+      const model = await membersService.api.members.get(frame.data, frame.options);
 
       if (!model) {
         throw new errors.NotFoundError({

package/core/server/api/endpoints/members.js

@@ -8,6 +8,8 @@ const membersService = require('../../services/members');
 const tpl = require('@tryghost/tpl');
 const _ = require('lodash');
 const { getCSVExportFileName } = require('./utils/csv-export-filename');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
+const { ADMIN } = require('../../services/members-metafields');
 
 // Shape the import service's outcome into the API response envelope: an inline import
 // reports its stats and label, a deferred one only how much it accepted.
@@ -67,7 +69,9 @@ const controller = {
       },
     },
     async query(frame) {
-      const page = await membersService.api.memberBREADService.browse(frame.options);
+      const page = await membersService.api.memberBREADService.browse(
+        restrictAdminApiQueryOptions(frame.options),
+      );
 
       return page;
     },
@@ -88,7 +92,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const member = await membersService.api.memberBREADService.read(frame.data, frame.options);
+      const member = await membersService.api.memberBREADService.read(frame.data, {
+        ...frame.options,
+        metafieldsFor: ADMIN,
+      });
 
       if (!member) {
         throw new errors.NotFoundError({
@@ -223,7 +230,10 @@ const controller = {
           },
         });
       }
-      let model = await membersService.api.memberBREADService.read({ id: frame.options.id });
+      const model = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.memberNotFound),
@@ -263,7 +273,10 @@ const controller = {
           stripe_price_id: frame.data.stripe_price_id,
         },
       });
-      let model = await membersService.api.memberBREADService.read({ id: frame.options.id });
+      const model = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.memberNotFound),
@@ -373,7 +386,7 @@ const controller = {
     validation: {},
     async query(frame) {
       return {
-        data: await membersService.export(frame.options),
+        data: await membersService.export(restrictAdminApiQueryOptions(frame.options)),
         filename: getCSVExportFileName('members'),
       };
     },
@@ -418,7 +431,7 @@ const controller = {
     async query() {
       const memberStats = await membersService.api.events.getStatuses();
       const last = _.last(memberStats);
-      let totalMembers = last ? last.paid + last.free + last.comped + last.gift : 0;
+      const totalMembers = last ? last.paid + last.free + last.comped + last.gift : 0;
 
       return {
         resource: 'members',
@@ -500,7 +513,10 @@ const controller = {
       const emailSuppressionList = require('../../services/email-suppression-list');
 
       // Get the member first to retrieve their email
-      const member = await membersService.api.memberBREADService.read({ id: frame.options.id }, {});
+      const member = await membersService.api.memberBREADService.read(
+        { id: frame.options.id },
+        { metafieldsFor: ADMIN },
+      );
 
       if (!member) {
         throw new errors.NotFoundError({

package/core/server/api/endpoints/oembed.js

@@ -12,7 +12,7 @@ const controller = {
     data: ['url', 'type'],
     options: [],
     query({ data }) {
-      let { url, type } = data;
+      const { url, type } = data;
 
       return oembed.fetchOembedDataFromUrl(url, type);
     },

package/core/server/api/endpoints/pages.js

@@ -2,7 +2,7 @@ const models = require('../../models');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
-const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const ALLOWED_INCLUDES = [
   'tags',
   'authors',
@@ -54,11 +54,7 @@ const controller = {
       unsafeAttrs: UNSAFE_ATTRS,
     },
     query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
-      return models.Post.findPage(options);
+      return models.Post.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/posts.js

@@ -3,7 +3,7 @@ const models = require('../../models');
 const { getCSVExportFileName } = require('./utils/csv-export-filename');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const contentImportService = require('../../services/content-import');
-const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const allowedIncludes = [
   'tags',
   'authors',
@@ -80,11 +80,7 @@ const controller = {
       unsafeAttrs: unsafeAttrs,
     },
     query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
-      return postsService.browsePosts(options);
+      return postsService.browsePosts(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -108,12 +104,8 @@ const controller = {
     },
     validation: {},
     async query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
       return {
-        data: await postsService.export(options),
+        data: await postsService.export(restrictAdminApiQueryOptions(frame.options)),
         filename: getCSVExportFileName('analytics'),
       };
     },
@@ -239,7 +231,7 @@ const controller = {
       unsafeAttrs: unsafeAttrs,
     },
     async query(frame) {
-      let model = await postsService.editPost(frame, {
+      const model = await postsService.editPost(frame, {
         eventHandler: (event, dto) => {
           const cacheInvalidate = getCacheHeaderFromEventString(event, dto);
           if (cacheInvalidate === true) {

package/core/server/api/endpoints/settings.js

@@ -146,9 +146,9 @@ const controller = {
       },
     },
     async query(frame) {
-      let stripeConnectData = await getStripeConnectData(frame);
+      const stripeConnectData = await getStripeConnectData(frame);
 
-      let result = await settingsBREADService.edit(
+      const result = await settingsBREADService.edit(
         frame.data.settings,
         frame.options,
         stripeConnectData,

package/core/server/api/endpoints/snippets.js

@@ -1,6 +1,7 @@
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const messages = {
   snippetNotFound: 'Snippet not found.',
@@ -25,7 +26,7 @@ const controller = {
       },
     },
     query(frame) {
-      return models.Snippet.findPage(frame.options);
+      return models.Snippet.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 

package/core/server/api/endpoints/tags.js

@@ -1,6 +1,7 @@
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const models = require('../../models');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 
 const ALLOWED_INCLUDES = ['count.posts'];
 
@@ -26,7 +27,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      return models.Tag.findPage(frame.options);
+      return models.Tag.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },
 
@@ -45,7 +46,10 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      const model = await models.Tag.findOne(frame.data, frame.options);
+      const model = await models.Tag.findOne(
+        frame.data,
+        restrictAdminApiQueryOptions(frame.options),
+      );
       if (!model) {
         throw new errors.NotFoundError({
           message: tpl(messages.tagNotFound),

package/core/server/api/endpoints/themes.js

@@ -26,7 +26,7 @@ const controller = {
     },
     permissions: true,
     async query() {
-      let themeName = settingsCache.get('active_theme');
+      const themeName = settingsCache.get('active_theme');
       const themeErrors = await themeService.api.getThemeErrors(themeName);
       return themeService.api.getJSON(themeName, themeErrors);
     },
@@ -46,7 +46,7 @@ const controller = {
     },
     permissions: true,
     async query(frame) {
-      let themeName = frame.options.name;
+      const themeName = frame.options.name;
 
       if (limitService.isLimited('customThemes')) {
         await limitService.errorIfWouldGoOverLimit('customThemes', { value: themeName });
@@ -118,7 +118,7 @@ const controller = {
       // @NOTE: consistent filename uploads
       frame.options.originalname = frame.file.originalname.toLowerCase();
 
-      let zip = {
+      const zip = {
         path: frame.file.path,
         name: frame.file.originalname,
       };
@@ -150,7 +150,7 @@ const controller = {
       method: 'read',
     },
     query(frame) {
-      let themeName = frame.options.name;
+      const themeName = frame.options.name;
 
       return themeService.api.getZip(themeName);
     },
@@ -171,7 +171,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      let themeName = frame.options.name;
+      const themeName = frame.options.name;
 
       return themeService.api.destroy(themeName);
     },

package/core/server/api/endpoints/users.js

@@ -5,7 +5,7 @@ const permissionsService = require('../../services/permissions');
 const auth = require('../../services/auth');
 const apiMail = require('./index').mail;
 const apiSettings = require('./index').settings;
-const { rejectAdminApiRestrictedFieldsTransformer } = require('./utils/api-filter-utils');
+const { restrictAdminApiQueryOptions } = require('./utils/api-filter-utils');
 const UsersService = require('../../services/users');
 const userService = new UsersService({ models, auth, apiMail, apiSettings });
 const ALLOWED_INCLUDES = ['count.posts', 'permissions', 'roles', 'roles.permissions'];
@@ -121,11 +121,7 @@ const controller = {
     },
     permissions: true,
     query(frame) {
-      const options = {
-        ...frame.options,
-        mongoTransformer: rejectAdminApiRestrictedFieldsTransformer,
-      };
-      return models.User.findPage(options);
+      return models.User.findPage(restrictAdminApiQueryOptions(frame.options));
     },
   },