ghost 6.63.0 → 6.65.0

package/core/server/services/members/members-api/services/member-bread-service.js

@@ -1,5 +1,5 @@
 const errors = require('@tryghost/errors');
-const { ADMIN } = require('../../../members-metafields');
+const { ADMIN, adminWriteOrigin } = require('../../../members-metafields');
 const logging = require('@tryghost/logging');
 const tpl = require('@tryghost/tpl');
 const moment = require('moment');
@@ -95,16 +95,17 @@ module.exports = class MemberBREADService {
    * size or a delivery address. Their values live in their own table, so they are fetched
    * here rather than loaded alongside the member.
    *
-   * Returns null when the site has defined no fields, which tells the caller to leave the
-   * `metafields` key off the member payload rather than send an empty object: a key added to
-   * an API response cannot be withdrawn without breaking whoever started reading it, and
-   * most sites have never defined a field, so those sites keep the payload they had before
-   * this feature existed.
+   * Returns null when this audience has no field to be told about, which tells the caller to
+   * leave the `metafields` key off the member payload rather than send an empty object: a key
+   * added to an API response cannot be withdrawn without breaking whoever started reading it,
+   * and most sites have never defined a field, so those sites keep the payload they had
+   * before this feature existed.
    * @param {string[]} memberIds
+   * @param {import('../../../members-metafields').Audience} audience
    * @returns {Promise<Map<string, Record<string, unknown>> | null>}
    */
   async fetchMetafieldValues(memberIds, audience) {
-    if (!(await this.metafieldDefinitions.hasAnyActive())) {
+    if (!(await this.metafieldDefinitions.hasAnyReadable(audience))) {
       return null;
     }
 
@@ -385,15 +386,17 @@ module.exports = class MemberBREADService {
   /**
    * @param {object} data
    * @param {object} [options]
-   * @param {import('../../../members-metafields').Audience | null} [options.metafieldsFor]
+   * @param {import('../../../members-metafields').Audience | null} options.metafieldsFor
    *   Who the extra fields a publisher defined are being read for, or null to leave them
    *   off entirely. Null is not the same as "nobody may see them": it means this caller
    *   never shows them, so fetching them is two database queries whose results are thrown
    *   away. Ghost identifies a signed-in reader on every page view of a themed site
    *   through this method, and that caller renders a member through a fixed list of
    *   fields which has never included these.
+   *
+   *   Defaults to null, so a caller that does not ask gets none of them.
    */
-  async read(data, { metafieldsFor = ADMIN, ...options } = {}) {
+  async read(data, { metafieldsFor = null, ...options } = {}) {
     const defaultWithRelated = [
       'labels',
       'stripeSubscriptions',
@@ -562,7 +565,7 @@ module.exports = class MemberBREADService {
       await this.memberRepository.setComplimentarySubscription(model, sharedOptions);
     }
 
-    return this.read({ id: model.id }, options);
+    return this.read({ id: model.id }, { ...options, metafieldsFor: ADMIN });
   }
 
   async edit(data, options) {
@@ -638,16 +641,13 @@ module.exports = class MemberBREADService {
       // The only route to this branch is the authenticated Admin API, so an anonymous
       // request is a mistake somewhere upstream rather than a writer to invent a name
       // for. Refusing keeps every stored writer resolvable.
-      const context = options.context || {};
-      if (!context.integration && !context.user) {
+      const origin = adminWriteOrigin(options.context);
+      if (!origin) {
         throw new errors.IncorrectUsageError({
           message: tpl(messages.metafieldsWithoutWriter),
         });
       }
-      const writtenBy = context.integration
-        ? { type: 'integration', id: context.integration.id }
-        : { type: 'user', id: context.user };
-      await this.metafieldValues.applyWrite(model.id, plannedMetafields, { writtenBy });
+      await this.metafieldValues.applyWrite(model.id, plannedMetafields, origin);
 
       // Metafields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.
@@ -678,7 +678,7 @@ module.exports = class MemberBREADService {
       }
     }
 
-    return this.read({ id: model.id }, options);
+    return this.read({ id: model.id }, { ...options, metafieldsFor: ADMIN });
   }
 
   /**
@@ -710,7 +710,7 @@ module.exports = class MemberBREADService {
       );
     }
 
-    return this.read({ id: memberId });
+    return this.read({ id: memberId }, { metafieldsFor: ADMIN });
   }
 
   /**
@@ -732,7 +732,7 @@ module.exports = class MemberBREADService {
 
     await this.memberRepository.saveCommenting(memberId, updated, 'commenting_enabled', context);
 
-    return this.read({ id: memberId });
+    return this.read({ id: memberId }, { metafieldsFor: ADMIN });
   }
 
   async logout(options) {

package/core/server/services/members/members-api/services/token-service.js

@@ -1,6 +1,6 @@
-const jose = require('node-jose');
 const jwt = require('jsonwebtoken');
 const crypto = require('crypto');
+const { getPublicKeyInfo } = require('../../../../lib/public-jwk');
 
 // A token's `scope` declares its purpose. Only identity tokens may act as a
 // member; entitlement tokens are read-only and handed to integrations.
@@ -9,24 +9,23 @@ const ENTITLEMENT_TOKEN_SCOPE = 'members:entitlements:read';
 
 module.exports = class TokenService {
   constructor({ privateKey, publicKey, issuer }) {
-    this._keyStore = jose.JWK.createKeyStore();
-    this._keyStoreReady = this._keyStore.add(privateKey, 'pem');
+    this._keyReady = getPublicKeyInfo(privateKey);
     this._privateKey = privateKey;
     this._publicKey = publicKey;
     this._issuer = issuer;
   }
 
   async encodeIdentityToken({ sub }) {
-    const jwk = await this._keyStoreReady;
+    const { kid } = await this._keyReady;
     return jwt.sign(
       {
         sub,
-        kid: jwk.kid,
+        kid,
         scope: IDENTITY_TOKEN_SCOPE,
       },
       this._privateKey,
       {
-        keyid: jwk.kid,
+        keyid: kid,
         algorithm: 'RS512',
         audience: this._issuer,
         expiresIn: '10m',
@@ -36,12 +35,12 @@ module.exports = class TokenService {
   }
 
   async encodeEntitlementToken({ sub, memberUuid, paid, activeTierIds = [] }) {
-    const jwk = await this._keyStoreReady;
+    const { kid } = await this._keyReady;
 
     return jwt.sign(
       {
         sub,
-        kid: jwk.kid,
+        kid,
         scope: ENTITLEMENT_TOKEN_SCOPE,
         member_uuid: memberUuid,
         paid,
@@ -50,7 +49,7 @@ module.exports = class TokenService {
       },
       this._privateKey,
       {
-        keyid: jwk.kid,
+        keyid: kid,
         algorithm: 'RS512',
         audience: this._issuer,
         expiresIn: '5m',
@@ -73,7 +72,7 @@ module.exports = class TokenService {
    * @returns {Promise<jwt.JwtPayload>}
    */
   async decodeToken(token) {
-    await this._keyStoreReady;
+    await this._keyReady;
 
     const result = jwt.verify(token, this._publicKey, {
       algorithms: ['RS512'],
@@ -92,7 +91,7 @@ module.exports = class TokenService {
   }
 
   async getPublicKeys() {
-    await this._keyStoreReady;
-    return this._keyStore.toJSON();
+    const { kid, jwk } = await this._keyReady;
+    return { keys: [{ kty: jwk.kty, kid, n: jwk.n, e: jwk.e }] };
   }
 };

package/core/server/services/members/middleware.js

@@ -12,6 +12,7 @@ const onHeaders = require('on-headers');
 const tiersService = require('../tiers/service');
 const config = require('../../../shared/config');
 const settingsHelpers = require('../settings-helpers');
+const { timingSafeStringEqual } = require('../../../shared/timing-safe-string-equal');
 
 const messages = {
   missingUuid: 'Missing uuid.',
@@ -237,13 +238,19 @@ const authMemberByUuid = async function authMemberByUuid(req, res, next) {
       .createHmac('sha256', settingsHelpers.getMembersValidationKey())
       .update(uuid)
       .digest('hex');
-    if (memberHmac !== key) {
+    if (!timingSafeStringEqual(memberHmac, key)) {
       throw new errors.UnauthorizedError({
         message: tpl(messages.invalidKey),
       });
     }
 
-    const member = await membersService.api.memberBREADService.read({ uuid });
+    // Nothing reached through this middleware renders a member's extra fields, so
+    // they are not fetched. It authenticates by a signed link rather than a session,
+    // which makes anything loaded here readable without being signed in.
+    const member = await membersService.api.memberBREADService.read(
+      { uuid },
+      { metafieldsFor: null },
+    );
     if (!member) {
       throw new errors.UnauthorizedError({
         message: tpl(messages.invalidUuid),

package/core/server/services/members/request-integrity-token-provider.js

@@ -1,4 +1,5 @@
 const crypto = require('crypto');
+const { timingSafeStringEqual } = require('../../../shared/timing-safe-string-equal');
 
 class RequestIntegrityTokenProvider {
   #themeSecret;
@@ -45,7 +46,7 @@ class RequestIntegrityTokenProvider {
     hmac.update(`${timestamp.toString()}:${nonce}`);
     const expectedHmac = hmac.digest('hex');
 
-    if (expectedHmac !== hmacDigest) {
+    if (!timingSafeStringEqual(expectedHmac, hmacDigest)) {
       // HMAC mismatch
       return false;
     }

package/core/server/services/members/service.js

@@ -13,7 +13,7 @@ const settingsCache = require('../../../shared/settings-cache');
 const config = require('../../../shared/config');
 const models = require('../../models');
 const { GhostMailer } = require('../mail');
-const jobsService = require('../jobs');
+const jobsService = require('../jobs-service');
 const tiersService = require('../tiers');
 const giftService = require('../gifts');
 const VerificationTrigger = require('../verification-trigger');
@@ -83,7 +83,9 @@ const buildImporterDeps = ({ stripeAPIService }) => {
     },
     getGiftService: () => giftService.service,
     sendEmail: ghostMailer.send.bind(ghostMailer),
-    addJob: jobsService.addJob.bind(jobsService),
+    // Resolved per dispatch rather than here: init() also runs where nothing has
+    // initialised the jobs service.
+    dispatchJob: (job) => jobsService.getInstance().dispatch(job),
     knex: db.knex,
     urlFor: urlUtils.urlFor.bind(urlUtils),
     stripeAPIService,
@@ -233,6 +235,8 @@ module.exports = {
       membersCSVImporter.importCSV(request, verificationTrigger);
     module.exports.importInline = (request) =>
       membersCSVImporter.importInline(request, verificationTrigger);
+    // The members-import job handler, registered by boot with the jobs service.
+    module.exports.handleImportJob = (job) => membersCSVImporter.handle(job, verificationTrigger);
 
     // Constructed here rather than required statically: the exporter needs the
     // metafields services, which boot builds before this one.
@@ -265,6 +269,7 @@ module.exports = {
 
   importCSV: null,
   importInline: null,
+  handleImportJob: null,
 
   stats: membersStats,
   export: null,

package/core/server/services/members/stats/members-stats.js

@@ -135,11 +135,11 @@ class MembersStats {
       currentRangeDate = moment.tz(siteTimezone).subtract(days - 1, 'days');
     }
 
-    let endDate = moment.tz(siteTimezone).add(1, 'hour');
+    const endDate = moment.tz(siteTimezone).add(1, 'hour');
     const output = {};
 
     while (currentRangeDate.isBefore(endDate)) {
-      let dateStr = currentRangeDate.format('YYYY-MM-DD');
+      const dateStr = currentRangeDate.format('YYYY-MM-DD');
       runningTotal += resultObject[dateStr] || 0;
       output[dateStr] = runningTotal;
 

package/core/server/services/members-events/event-storage.js

@@ -23,7 +23,7 @@ class EventStorage {
    */
   subscribe(domainEvents) {
     domainEvents.subscribe(MemberCreatedEvent, async (event) => {
-      let attribution = event.data.attribution;
+      const attribution = event.data.attribution;
 
       await this.models.MemberCreatedEvent.add({
         member_id: event.data.memberId,
@@ -45,7 +45,7 @@ class EventStorage {
     });
 
     domainEvents.subscribe(SubscriptionCreatedEvent, async (event) => {
-      let attribution = event.data.attribution;
+      const attribution = event.data.attribution;
 
       await this.models.SubscriptionCreatedEvent.add({
         member_id: event.data.memberId,

package/core/server/services/members-metafields/access.js

@@ -1,28 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INTERNAL = exports.MEMBERS = exports.ADMIN = void 0;
-exports.readableFields = readableFields;
+exports.INTERNAL = exports.MEMBERS = exports.ADMIN = exports.MemberAccessSchema = exports.MEMBER_ACCESS = void 0;
+exports.readableLevels = readableLevels;
 exports.canWrite = canWrite;
+const metafield_types_1 = require("@tryghost/metafield-types");
+Object.defineProperty(exports, "MEMBER_ACCESS", { enumerable: true, get: function () { return metafield_types_1.MEMBER_ACCESS; } });
+Object.defineProperty(exports, "MemberAccessSchema", { enumerable: true, get: function () { return metafield_types_1.MemberAccessSchema; } });
+const EVERY_LEVEL = [...metafield_types_1.MEMBER_ACCESS_LEVELS];
 exports.ADMIN = { entry: 'admin' };
 exports.MEMBERS = { entry: 'members' };
 exports.INTERNAL = { entry: 'internal' };
-/**
- * Which of the site's fields this audience may see.
- *
- * Every field, whichever door they came through. Written as a function rather than
- * left unwritten so that when a publisher can mark a field as staff only, one
- * function changes and every caller is already asking.
- */
-function readableFields(_audience, fields) {
-    return fields;
+// Every audience is spelled out with the levels it may read, staff included, because
+// reads narrow on whatever this returns and an audience with no entry gets an empty
+// list, which matches no field. Giving staff a way to skip the check instead would
+// invert that: an unrecognised audience would then match everything.
+const READABLE = {
+    admin: EVERY_LEVEL,
+    internal: EVERY_LEVEL,
+    members: [metafield_types_1.MEMBER_ACCESS.read, metafield_types_1.MEMBER_ACCESS.write],
+};
+const WRITABLE = {
+    admin: EVERY_LEVEL,
+    internal: EVERY_LEVEL,
+    members: [metafield_types_1.MEMBER_ACCESS.write],
+};
+// `Object.hasOwn` rather than a plain lookup: an entry naming a property every object
+// inherits (`__proto__`, `constructor`, `toString`) would otherwise return that
+// inherited value instead of falling through to the empty list.
+function levelsFor(table, audience) {
+    const entry = audience?.entry;
+    return entry !== undefined && Object.hasOwn(table, entry) ? table[entry] : [];
 }
-/**
- * Whether this audience may write this field.
- *
- * Also total today. Kept separate from `readableFields` because the asymmetry to
- * expect is a field a member may read but not change, which one combined
- * permission could not express.
- */
-function canWrite(_audience, _field) {
-    return true;
+function readableLevels(audience) {
+    return levelsFor(READABLE, audience);
+}
+function canWrite(audience, field) {
+    return levelsFor(WRITABLE, audience).includes(field.memberAccess);
 }

package/core/server/services/members-metafields/actions.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.actingContext = actingContext;
+exports.adminWriteOrigin = adminWriteOrigin;
 exports.recordMetafieldAction = recordMetafieldAction;
 const logging_1 = __importDefault(require("@tryghost/logging"));
 /**
@@ -16,14 +17,34 @@ const logging_1 = __importDefault(require("@tryghost/logging"));
  */
 function actingContext(context) {
     const frame = (context ?? {});
+    const viaApiKey = Boolean(frame.api_key);
     if (frame.integration) {
-        return { actor: { id: frame.integration.id, type: 'integration' } };
+        return { actor: { id: frame.integration.id, type: 'integration', viaApiKey } };
     }
     if (frame.user) {
-        return { actor: { id: frame.user, type: 'user' } };
+        return { actor: { id: frame.user, type: 'user', viaApiKey } };
     }
     return { actor: null };
 }
+/**
+ * Who made a write through the Admin API and where, read off the same context as
+ * `actingContext`, so the values a request writes and the history it records name the
+ * same writer. Null when nobody is acting, which no Admin API write should be.
+ */
+function adminWriteOrigin(context) {
+    const { actor } = actingContext(context);
+    if (!actor) {
+        return null;
+    }
+    if (actor.type === 'integration') {
+        return { writtenBy: { type: 'integration', id: actor.id }, source: 'admin_api' };
+    }
+    // A staff token authenticates as its user but is a call to the API, not a visit to Admin.
+    return {
+        writtenBy: { type: 'user', id: actor.id },
+        source: actor.viaApiKey ? 'admin_api' : 'admin',
+    };
+}
 // Field-definition changes map to activity-feed events. A field's timeline reads
 // added -> edited -> archived -> restored, and a permanent delete (only from the
 // archived state) ends it with deleted.
@@ -31,6 +52,7 @@ const COMMANDS = {
     create: 'added',
     rename: 'edited',
     reorder: 'edited',
+    changeAccess: 'edited',
     archive: 'archived',
     restore: 'restored',
     delete: 'deleted',

package/core/server/services/members-metafields/bindings-service.js

@@ -57,8 +57,8 @@ class MetafieldBindingsService {
      */
     async writeCollected(memberId, productId, collected) {
         return this.writeThrough(memberId, productId, collected, (binding) => ({
-            type: 'binding',
-            id: binding.bindingId,
+            writtenBy: { type: 'binding', id: binding.bindingId },
+            source: 'checkout',
         }));
     }
     /**
@@ -70,8 +70,8 @@ class MetafieldBindingsService {
      */
     async writeSuppliedByMember(memberId, productId, supplied) {
         return this.writeThrough(memberId, productId, supplied, () => ({
-            type: 'member',
-            id: memberId,
+            writtenBy: { type: 'member', id: memberId },
+            source: 'checkout',
         }));
     }
     /**
@@ -112,7 +112,7 @@ class MetafieldBindingsService {
         // looking. A port exists because a publisher pointed it at a field, and that
         // decision is what admits the value, whoever supplied it.
         const planned = await this.values.planWrite({ [`${CUSTOM_NAMESPACE}.${into.key}`]: value }, access_1.INTERNAL);
-        await this.values.applyWrite(memberId, planned, { writtenBy: attribute(into) });
+        await this.values.applyWrite(memberId, planned, attribute(into));
     }
     async resolve(productId, port) {
         const row = await this.knex(BINDINGS_TABLE)

package/core/server/services/members-metafields/codec.js

@@ -9,6 +9,13 @@ const models_1 = require("./models");
 exports.metafieldCodec = zod_1.z.codec(schema_1.DbMetafield, models_1.Metafield, {
     // DbMetafield validates `type` as the field-type enum, so the decoded row
     // already carries a FieldType and camelKeys preserves it — no cast needed.
-    decode: (row) => ({ ...(0, case_keys_1.camelKeys)(row), namespace: identity_1.CUSTOM_NAMESPACE }),
-    encode: ({ namespace: _namespace, ...field }) => (0, case_keys_1.snakeKeys)(field),
+    decode: ({ member_access: memberAccess, ...row }) => ({
+        ...(0, case_keys_1.camelKeys)(row),
+        namespace: identity_1.CUSTOM_NAMESPACE,
+        access: { member: memberAccess },
+    }),
+    encode: ({ namespace: _namespace, access, ...field }) => ({
+        ...(0, case_keys_1.snakeKeys)(field),
+        member_access: access.member,
+    }),
 });