ghost 6.63.0 → 6.65.0

package/core/server/services/member-welcome-emails/service.js

@@ -898,7 +898,7 @@ class MemberWelcomeEmailServiceWrapper {
     }
 
     if (!this.i18n) {
-      const i18nLib = require('@tryghost/i18n');
+      const i18nLib = require('@tryghost/i18n').default;
       const events = require('../../lib/common/events');
 
       this.i18n = i18nLib(settingsCache.get('locale') || 'en', 'ghost');

package/core/server/services/members/account-service.js

@@ -71,11 +71,11 @@ class MemberAccountService {
             withRelated: WRITE_RELATIONS,
         });
         if (plannedMetafields) {
-            // A member is recorded as the author of their own answers, and is the one
-            // writer whose changes leave nothing in the staff action log: that log
-            // records what staff did.
+            // A member is recorded as the author of their own answers, made from their
+            // account, which is Portal's.
             await this.#metafieldValues.applyWrite(memberId, plannedMetafields, {
                 writtenBy: { type: 'member', id: memberId },
+                source: 'portal',
             });
         }
         // Read back rather than returning what was written: a member is told what

package/core/server/services/members/api.js

@@ -76,7 +76,7 @@ function createApiInstance(config) {
           if (process.env.NODE_ENV !== 'production') {
             logging.warn(message.text);
           }
-          let msg = Object.assign(
+          const msg = Object.assign(
             {
               from: config.getEmailSupportAddress(),
               subject: 'Signin',

package/core/server/services/members/import-export/import/importer.js

@@ -7,6 +7,7 @@ const moment_timezone_1 = __importDefault(require("moment-timezone"));
 const completion_email_1 = __importDefault(require("./completion-email"));
 const csv_1 = require("../csv");
 const csv_2 = require("@tryghost/metafield-types/csv");
+const members_import_job_1 = __importDefault(require("../../jobs/members-import-job"));
 const metrics = require('@tryghost/metrics');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
@@ -53,10 +54,10 @@ class MembersCSVImporter {
     _metafields;
     _email;
     _report;
-    _addJob;
+    _dispatchJob;
     _getTimezone;
     _getInlineThreshold;
-    constructor({ knex, readRows, spool, members, tiers, stripe, gifts, metafields, email, report, addJob, getTimezone, getInlineThreshold, }) {
+    constructor({ knex, readRows, spool, members, tiers, stripe, gifts, metafields, email, report, dispatchJob, getTimezone, getInlineThreshold, }) {
         this._knex = knex;
         this._readRows = readRows;
         this._spool = spool;
@@ -67,7 +68,7 @@ class MembersCSVImporter {
         this._metafields = metafields;
         this._email = email;
         this._report = report;
-        this._addJob = addJob;
+        this._dispatchJob = dispatchJob;
         this._getTimezone = getTimezone;
         this._getInlineThreshold = getInlineThreshold;
     }
@@ -79,35 +80,43 @@ class MembersCSVImporter {
             const result = await this.importRows(rows, labelName, extraLabels, verificationTrigger);
             return { deferred: false, originalImportSize: rows.length, result };
         }
-        await this.deferImport(rows, { labelName, extraLabels, requestUserEmail: request.requestUserEmail }, verificationTrigger);
+        await this.deferImport(rows, {
+            labelName,
+            extraLabels,
+            requestUserEmail: request.requestUserEmail,
+        });
         return { deferred: true, originalImportSize: rows.length };
     }
     async importInline(request, verificationTrigger) {
         const rows = await this._readRows(request.filePath, request.mapping);
         return this.importRows(rows, buildImportLabelName(this._getTimezone()), request.extraLabels ?? [], verificationTrigger);
     }
-    async deferImport(rows, { labelName, extraLabels, requestUserEmail, }, verificationTrigger) {
+    async deferImport(rows, { labelName, extraLabels, requestUserEmail, }) {
         // Resolved here, not at the API boundary, so the owner lookup only runs when
         // a request without a user actually reaches the deferred path.
         const emailRecipient = requestUserEmail ?? (await this._email.getDefaultRecipient());
-        const spooled = await this._spool.write(rows);
+        const spoolKey = await this._spool.write(rows);
         logging.info({ event: { name: 'members.import.queued' }, rows: rows.length }, 'Members import queued');
-        this._addJob({
-            job: () => this.runImportJob(spooled, { labelName, extraLabels, emailRecipient }, verificationTrigger),
-            offloaded: false,
-            name: 'members-import',
-        });
+        try {
+            await this._dispatchJob(new members_import_job_1.default({ spoolKey, labelName, extraLabels, emailRecipient }));
+        }
+        catch (error) {
+            // No job will ever read the rows, so they are not left behind for one.
+            await this.settle(() => this._spool.remove(spoolKey));
+            throw error;
+        }
     }
-    // Must resolve in every case: the job manager reads a rejected inline job as a defect
-    // in the job itself, and there is no retry behind it.
-    async runImportJob(spooled, { labelName, extraLabels, emailRecipient, }, verificationTrigger) {
+    // The members-import job handler. Resolves in every case, as the legacy inline job did:
+    // everything that can fail is already reported here, so a rejection would only make the
+    // jobs service report it again, and there is no retry behind it.
+    async handle({ spoolKey, labelName, extraLabels, emailRecipient }, verificationTrigger) {
         const startedAt = Date.now();
         logging.info({ event: { name: 'members.import.started' } }, 'Members import started');
         // Null until the import produces one: parsing and mapping already happened inside
         // the request, so anything failing from here is ours rather than the file's.
         let result = null;
         try {
-            const spooledRows = await spooled.read();
+            const spooledRows = await this._spool.read(spoolKey);
             result = await this.importRows(spooledRows, labelName, extraLabels, verificationTrigger);
         }
         catch (error) {
@@ -115,7 +124,7 @@ class MembersCSVImporter {
             this._report(error);
         }
         finally {
-            await this.settle(() => spooled.remove());
+            await this.settle(() => this._spool.remove(spoolKey));
         }
         // Whatever became of it, the publisher hears exactly once. If this is what fails,
         // there is nobody left to tell but us.

package/core/server/services/members/import-export/import/spool.js

@@ -4,27 +4,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRowSpool = createRowSpool;
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
-const fs_extra_1 = __importDefault(require("fs-extra"));
-// Spools import rows to a private JSON file under the OS temp dir, so a deferred
+// Spools import rows to a JSON file in the imports storage adapter, so a deferred
 // import can hand them to a background job and read them back after the request has
 // already returned. The rows go in and come out as MemberImportRow, so nothing but
 // the import's own row shape crosses this boundary.
-function createRowSpool() {
+function createRowSpool(storage) {
     return {
         async write(rows) {
-            const spoolPath = node_path_1.default.join(node_os_1.default.tmpdir(), `members-import-${node_crypto_1.default.randomUUID()}.json`);
-            await fs_extra_1.default.writeFile(spoolPath, JSON.stringify(rows), { mode: 0o600 });
-            return {
-                async read() {
-                    return JSON.parse(await fs_extra_1.default.readFile(spoolPath, 'utf8'));
-                },
-                async remove() {
-                    await fs_extra_1.default.remove(spoolPath);
-                },
-            };
+            const key = `members-import-${node_crypto_1.default.randomUUID()}.json`;
+            await storage.saveRaw(Buffer.from(JSON.stringify(rows)), key);
+            return key;
+        },
+        async read(key) {
+            return JSON.parse((await storage.read({ path: key })).toString('utf8'));
+        },
+        async remove(key) {
+            await storage.delete(key);
         },
     };
 }

package/core/server/services/members/import-export/index.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeImporter = makeImporter;
 exports.makeExporter = makeExporter;
+const members_metafields_1 = require("../../members-metafields");
 const importer_1 = __importDefault(require("./import/importer"));
 const reader_1 = __importDefault(require("./import/reader"));
 const spool_1 = require("./import/spool");
@@ -57,17 +58,19 @@ function makeImporter(deps) {
         }),
     };
     const metafields = {
-        activeFields: async () => deps.metafields.definitions.browse(),
-        planWrite: (values) => deps.metafields.values.planWrite(values),
+        activeFields: async () => deps.metafields.definitions.browse({}, members_metafields_1.INTERNAL),
+        planWrite: (values) => deps.metafields.values.planWrite(values, members_metafields_1.INTERNAL),
         // Every value the import writes came out of the file, whichever column carried it.
         // An import has no id to give until runs are tracked, so it names its kind only.
         applyWrite: (memberId, plan, executor) => deps.metafields.values.applyWrite(memberId, plan, {
             writtenBy: { type: 'import', id: null },
+            source: 'import',
             executor,
         }),
     };
-    // Inline jobs never reach the job manager's Sentry handler, which is wired to the
-    // offloaded worker path only, so a throw here would be seen by nobody.
+    // The import job never rejects, so the jobs service never sees its failures, and the
+    // inline path's bookkeeping failures never reach the request: a throw here would be
+    // seen by nobody.
     const report = (error) => {
         try {
             logging.error({ event: { name: 'members.import.error' }, err: error }, '[Background Job] members-import error');
@@ -80,7 +83,7 @@ function makeImporter(deps) {
     return new importer_1.default({
         knex: deps.knex,
         readRows: reader_1.default,
-        spool: (0, spool_1.createRowSpool)(),
+        spool: (0, spool_1.createRowSpool)(require('../../adapter-manager').default.getAdapter('storage:imports')),
         members,
         tiers: {
             getDefault: deps.getDefaultTier,
@@ -94,7 +97,7 @@ function makeImporter(deps) {
         metafields,
         email,
         report,
-        addJob: deps.addJob,
+        dispatchJob: deps.dispatchJob,
         getTimezone: deps.getTimezone,
         getInlineThreshold: deps.getInlineThreshold,
     });
@@ -121,8 +124,8 @@ function makeExporter({ definitions, values, }) {
         metafields: {
             // Boot builds the definitions and values services before this one, so they
             // are always present -- no not-initialised state to guard.
-            activeDefinitions: async () => definitions.browse(),
-            valuesForMembers: (memberIds) => values.getValuesForMembers(memberIds),
+            activeDefinitions: async () => definitions.browse({}, members_metafields_1.INTERNAL),
+            valuesForMembers: (memberIds) => values.getValuesForMembers(memberIds, members_metafields_1.INTERNAL),
         },
     });
     return (options = {}) => exporter.export(options);

package/core/server/services/members/jobs/index.js

@@ -5,7 +5,7 @@ const CleanExpiredCompedJob = require('./clean-expired-comped-job').default;
 const cleanTokensTask = require('./clean-tokens-task').default;
 const cleanExpiredCompedTask = require('./clean-expired-comped-task').default;
 
-let hasScheduled = {
+const hasScheduled = {
   expiredComped: false,
   tokens: false,
 };

package/core/server/services/members/jobs/members-import-job.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const job_1 = require("../../jobs-service/job");
+class MembersImportJob extends job_1.Job {
+    static type = 'members-import';
+    spoolKey;
+    labelName;
+    extraLabels;
+    emailRecipient;
+    constructor(data) {
+        super();
+        this.spoolKey = data.spoolKey;
+        this.labelName = data.labelName;
+        this.extraLabels = data.extraLabels;
+        this.emailRecipient = data.emailRecipient;
+    }
+}
+exports.default = MembersImportJob;

package/core/server/services/members/member-avatar.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memberAvatarImage = memberAvatarImage;
+const config = require('../../../shared/config');
+/**
+ * The avatar shown for a member: their Gravatar, served blank when they have none, unless
+ * the site has turned Gravatar off. Nothing is stored, so every place that shows a member
+ * works it out from their email the same way.
+ */
+function memberAvatarImage(email) {
+    if (!email || config.isPrivacyDisabled('useGravatar')) {
+        return null;
+    }
+    // Required on first use, as the member model did. The image library is untyped JS, so
+    // `gravatar` is not checked here.
+    const { gravatar } = require('../../lib/image');
+    return gravatar.url(email, { size: 250, default: 'blank' });
+}

package/core/server/services/members/members-api/controllers/member-controller.js

@@ -57,7 +57,7 @@ module.exports = class MemberController {
       });
     }
 
-    let tokenData = {};
+    const tokenData = {};
     try {
       const member = await this._memberRepository.getByToken(identity);
       tokenData.oldEmail = member.get('email');
@@ -88,7 +88,7 @@ module.exports = class MemberController {
       const cancelAtPeriodEnd = req.body.cancel_at_period_end;
       const smartCancel = req.body.smart_cancel;
       const cancellationReason = req.body.cancellation_reason;
-      let ghostPriceId = req.body.priceId;
+      const ghostPriceId = req.body.priceId;
       const tierId = req.body.tierId;
       const cadence = req.body.cadence;
 

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -1097,7 +1097,7 @@ module.exports = class RouterController {
       labels: req.body.labels,
       name: req.body.name,
       reqIp: req.ip ?? undefined,
-      newsletters: await this._validateNewsletters(req.body?.newsletters ?? []),
+      newsletters: await this._validateNewsletters(req.body?.newsletters),
       attribution: await this._memberAttributionService.getAttribution(req.body.urlHistory),
       ...(giftToken ? { giftToken } : {}),
     };
@@ -1149,10 +1149,15 @@ module.exports = class RouterController {
    * @returns {Promise<object[] | undefined>} The validated newsletters
    */
   async _validateNewsletters(requestedNewsletters) {
-    if (!requestedNewsletters || requestedNewsletters.length === 0) {
+    if (!requestedNewsletters || !Array.isArray(requestedNewsletters)) {
       return undefined;
     }
 
+    // An explicit empty list means "no newsletters", not "the defaults"
+    if (requestedNewsletters.length === 0) {
+      return [];
+    }
+
     if (requestedNewsletters.some((newsletter) => !newsletter.name)) {
       return undefined;
     }

package/core/server/services/members/members-api/controllers/well-known-controller.js

@@ -7,7 +7,8 @@ const messages = {
 };
 
 /**
- * @typedef {import('node-jose').JWK[]} JWKS
+ * @typedef {import('../../../../lib/public-jwk').PublicRsaJwk & {kid: string}} PublicJWK
+ * @typedef {{keys: PublicJWK[]}} JWKS
  */
 
 /**

package/core/server/services/members/members-api/members-api.js

@@ -7,7 +7,6 @@ const PaymentsService = require('./services/payments-service');
 const TokenService = require('./services/token-service');
 const GeolocationService = require('./services/geolocation-service');
 const MemberBREADService = require('./services/member-bread-service');
-const metafields = require('../../members-metafields');
 const { MemberAccountService } = require('../account-service');
 const MemberRepository = require('./repositories/member-repository');
 const NextPaymentCalculator = require('./services/next-payment-calculator');
@@ -128,6 +127,7 @@ module.exports = function MembersAPI({
     labsService,
     memberAttributionService,
     MemberEmailChangeEvent,
+    metafieldValues,
     AutomatedEmailRecipient,
     giftSubscriptions: giftService,
   });
@@ -285,7 +285,7 @@ module.exports = function MembersAPI({
       return null;
     }
 
-    let member = oldEmail
+    const member = oldEmail
       ? await getMemberIdentityData(oldEmail)
       : await getMemberIdentityData(email);
 
@@ -365,7 +365,7 @@ module.exports = function MembersAPI({
     memberBREADService,
     members: users,
     emailSuppressionList,
-    metafieldValues: metafields.values,
+    metafieldValues,
   });
 
   async function getMemberIdentity(transientId) {
@@ -434,7 +434,7 @@ module.exports = function MembersAPI({
     }
 
     // max request time is 500ms so shouldn't slow requests down too much
-    let geolocation = JSON.stringify(await geolocationService.getGeolocationFromIP(ip));
+    const geolocation = JSON.stringify(await geolocationService.getGeolocationFromIP(ip));
     if (geolocation) {
       await users.update({ geolocation }, { id: member.id });
     }

package/core/server/services/members/members-api/repositories/event-repository.js

@@ -12,6 +12,7 @@ const {
 } = require('@tryghost/mongo-utils');
 const { default: ObjectID } = require('bson-objectid');
 const db = require('../../../../data/db');
+const { memberAvatarImage } = require('../../member-avatar');
 
 /**
  * This mongo transformer ignores the provided filter option and replaces the filter with a custom filter that was provided to the transformer. Allowing us to set a mongo filter instead of a string based NQL filter.
@@ -42,6 +43,7 @@ module.exports = class EventRepository {
     memberAttributionService,
     urlService,
     MemberEmailChangeEvent,
+    metafieldValues,
     AutomatedEmailRecipient,
     giftSubscriptions,
   }) {
@@ -60,6 +62,7 @@ module.exports = class EventRepository {
     this._EmailSpamComplaintEvent = EmailSpamComplaintEvent;
     this._memberAttributionService = memberAttributionService;
     this._MemberEmailChangeEvent = MemberEmailChangeEvent;
+    this._metafieldValues = metafieldValues;
     this._AutomatedEmailRecipient = AutomatedEmailRecipient;
     this._giftSubscriptions = giftSubscriptions;
     this._knex = db.knex;
@@ -99,6 +102,7 @@ module.exports = class EventRepository {
         { type: 'login_event', action: 'getLoginEvents' },
         { type: 'payment_event', action: 'getPaymentEvents' },
         { type: 'email_change_event', action: 'getEmailChangeEvent' },
+        { type: 'metafield_change_event', action: 'getMetafieldChangeEvents' },
         { type: 'gift_purchase_event', action: 'getGiftPurchaseEvents' },
         { type: 'gift_redemption_event', action: 'getGiftRedemptionEvents' },
         { type: 'gift_ended_event', action: 'getGiftEndedEvents' },
@@ -428,6 +432,8 @@ module.exports = class EventRepository {
       delete json.postAttribution?.mobiledoc;
       delete json.postAttribution?.lexical;
       delete json.postAttribution?.plaintext;
+      delete json.postAttribution?.auto_excerpt;
+      delete json.postAttribution?.reading_time;
       const createdWithStatus = json.signupStatusEvent?.to_status ?? null;
       delete json.signupStatusEvent;
       return {
@@ -488,6 +494,8 @@ module.exports = class EventRepository {
       delete json.postAttribution?.mobiledoc;
       delete json.postAttribution?.lexical;
       delete json.postAttribution?.plaintext;
+      delete json.postAttribution?.auto_excerpt;
+      delete json.postAttribution?.reading_time;
       return {
         type: 'donation_event',
         data: {
@@ -648,7 +656,7 @@ module.exports = class EventRepository {
 
     filter = this.removePostIdFilter(otherFilter); //Remove post_id filter as we don't need it in the query
 
-    let postClicksQuery = postId
+    const postClicksQuery = postId
       ? `SELECT
                     mce.id,
                     mce.member_id,
@@ -1008,6 +1016,37 @@ module.exports = class EventRepository {
     };
   }
 
+  async getMetafieldChangeEvents(options = {}, filter) {
+    // The entries belong to the metafields domain, which reads them without a model; the
+    // feed maps its own filter names onto the table's columns and adds each member's avatar.
+    const columnFilter = filter
+      ? chainTransformers(
+          ...mapKeys({
+            'data.created_at': 'created_at',
+            'data.member_id': 'member_id',
+          }),
+        )(filter)
+      : undefined;
+
+    const { events, total } = await this._metafieldValues.browseChangeEvents({
+      // The feed's limit arrives as the request sent it, which can be a numeric string
+      // or `all`; the service takes a number, or nothing for every entry.
+      limit: options.limit === 'all' ? undefined : Number(options.limit),
+      filter: columnFilter,
+    });
+
+    return {
+      data: events.map((event) => ({
+        type: 'metafield_change_event',
+        data: {
+          ...event,
+          member: { ...event.member, avatar_image: memberAvatarImage(event.member.email) },
+        },
+      })),
+      meta: { pagination: { total } },
+    };
+  }
+
   async getAutomatedEmailSentEvents(options = {}, filter) {
     options = {
       ...options,

package/core/server/services/members/members-api/repositories/member-repository.js

@@ -717,7 +717,7 @@ module.exports = class MemberRepository {
     }
 
     // Fetch the member
-    let initialMember = await this._Member.findOne(
+    const initialMember = await this._Member.findOne(
       {
         id: options.id,
       },
@@ -1335,7 +1335,7 @@ module.exports = class MemberRepository {
       logging.error(e);
     }
 
-    let stripeCouponId = stripeSubscriptionData.discount?.coupon?.id;
+    const stripeCouponId = stripeSubscriptionData.discount?.coupon?.id;
 
     // For trial offers, offer id is passed from metadata as there is no stripe coupon
     let offerId = data.offerId || null;
@@ -1432,7 +1432,11 @@ module.exports = class MemberRepository {
 
       return 'inactive';
     };
-    let eventData = {};
+    const eventData = {};
+    const isIncomplete = ['incomplete', 'incomplete_expired'].includes(
+      stripeSubscriptionData.status,
+    );
+    let subscriptionToRecord = null;
 
     // A cancellation (or reactivation) changes no `members` column, so the member
     // model event would be suppressed by `wasChanged()`. Remember the pre-update
@@ -1482,10 +1486,34 @@ module.exports = class MemberRepository {
         },
       );
 
+      if (
+        stripeCustomerSubscriptionModel.get('status') === 'incomplete' &&
+        this.isActiveSubscriptionStatus(stripeSubscriptionData.status)
+      ) {
+        // Older Ghost versions recorded incomplete subscriptions as conversions. Avoid
+        // recording them twice when a checkout already in progress completes.
+        const createdEvent = await this._MemberPaidSubscriptionEvent.findOne(
+          {
+            member_id: memberModel.id,
+            subscription_id: stripeCustomerSubscriptionModel.id,
+            type: 'created',
+          },
+          options,
+        );
+        if (!createdEvent) {
+          subscriptionToRecord = updatedStripeCustomerSubscriptionModel;
+        }
+      }
+
       // CASE: Record offer redemption when offer_id changes to a new non-null value
       // This covers: null→new (free member upgrade), old→new (retention offer replacing expired signup offer)
       // The OfferRedemptionEvent handler has a dedup check for repeated webhook deliveries
-      if (previousOfferId !== subscriptionData.offer_id && subscriptionData.offer_id) {
+      if (
+        !isIncomplete &&
+        !subscriptionToRecord &&
+        previousOfferId !== subscriptionData.offer_id &&
+        subscriptionData.offer_id
+      ) {
         const redemptionTimestamp =
           subscriptionData.discount_start ||
           updatedStripeCustomerSubscriptionModel.get('created_at');
@@ -1508,14 +1536,16 @@ module.exports = class MemberRepository {
       }
 
       if (
-        stripeCustomerSubscriptionModel.get('mrr') !==
+        !isIncomplete &&
+        !subscriptionToRecord &&
+        (stripeCustomerSubscriptionModel.get('mrr') !==
           updatedStripeCustomerSubscriptionModel.get('mrr') ||
-        stripeCustomerSubscriptionModel.get('plan_id') !==
-          updatedStripeCustomerSubscriptionModel.get('plan_id') ||
-        stripeCustomerSubscriptionModel.get('status') !==
-          updatedStripeCustomerSubscriptionModel.get('status') ||
-        stripeCustomerSubscriptionModel.get('cancel_at_period_end') !==
-          updatedStripeCustomerSubscriptionModel.get('cancel_at_period_end')
+          stripeCustomerSubscriptionModel.get('plan_id') !==
+            updatedStripeCustomerSubscriptionModel.get('plan_id') ||
+          stripeCustomerSubscriptionModel.get('status') !==
+            updatedStripeCustomerSubscriptionModel.get('status') ||
+          stripeCustomerSubscriptionModel.get('cancel_at_period_end') !==
+            updatedStripeCustomerSubscriptionModel.get('cancel_at_period_end'))
       ) {
         const originalMrrDelta = stripeCustomerSubscriptionModel.get('mrr');
         const updatedMrrDelta = updatedStripeCustomerSubscriptionModel.get('mrr');
@@ -1607,16 +1637,24 @@ module.exports = class MemberRepository {
         subscriptionData,
         options,
       );
+      if (!isIncomplete) {
+        subscriptionToRecord = newStripeCustomerSubscriptionModel;
+      }
+    }
+
+    // A checkout attempt is not a paid conversion. Record the start only once
+    // the subscription leaves incomplete, retaining attribution from Stripe metadata.
+    if (subscriptionToRecord) {
       await this._MemberPaidSubscriptionEvent.add(
         {
           member_id: memberModel.id,
-          subscription_id: newStripeCustomerSubscriptionModel.id,
+          subscription_id: subscriptionToRecord.id,
           type: 'created',
           source: 'stripe',
           from_plan: null,
           to_plan: subscriptionPriceData.id,
           currency: subscriptionPriceData.currency,
-          mrr_delta: newStripeCustomerSubscriptionModel.get('mrr'),
+          mrr_delta: subscriptionToRecord.get('mrr'),
           ...eventData,
         },
         options,
@@ -1653,7 +1691,7 @@ module.exports = class MemberRepository {
         source,
         tierId: ghostProduct?.get('id'),
         memberId: memberModel.id,
-        subscriptionId: newStripeCustomerSubscriptionModel.get('id'),
+        subscriptionId: subscriptionToRecord.get('id'),
         offerId: offerId,
         attribution: attribution,
         batchId: options.batch_id,
@@ -1665,17 +1703,17 @@ module.exports = class MemberRepository {
         const offerRedemptionEvent = OfferRedemptionEvent.create({
           memberId: memberModel.id,
           offerId: offerId,
-          subscriptionId: newStripeCustomerSubscriptionModel.get('id'),
+          subscriptionId: subscriptionToRecord.get('id'),
         });
         this.dispatchEvent(offerRedemptionEvent, options);
       }
 
-      if (getStatus(newStripeCustomerSubscriptionModel) === 'active') {
+      if (getStatus(subscriptionToRecord) === 'active') {
         const subscriptionActivatedEvent = SubscriptionActivatedEvent.create({
           source,
           tierId: ghostProduct?.get('id'),
           memberId: memberModel.id,
-          subscriptionId: newStripeCustomerSubscriptionModel.get('id'),
+          subscriptionId: subscriptionToRecord.get('id'),
           offerId: offerId,
           attribution: attribution,
           batchId: options.batch_id,

package/core/server/services/members/members-api/repositories/product-repository.js

@@ -418,7 +418,7 @@ class ProductRepository {
 
     const existingProduct = await this._Product.findOne({ id: productId }, options);
 
-    let productData = {
+    const productData = {
       name: data.name,
       visibility: data.visibility,
       description: data.description,