ghost 6.63.0 → 6.65.0

package/core/server/services/members-metafields/definitions-service.js

@@ -15,11 +15,6 @@ const schema_1 = require("./schema");
 const access_1 = require("./access");
 const queries_1 = require("./queries");
 const key_1 = require("./key");
-// The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to
-// our raw-knex query: nql parses the `filter` string to a Mongo query, mongo-knex
-// turns that into parametrised WHERE clauses. Neither needs a Bookshelf model.
-const nql = require('@tryghost/nql');
-const knexify = require('@tryghost/mongo-knex');
 const TABLE = 'members_metafields';
 // Column limits come from the canonical schema — the same source the migration and
 // Bookshelf models read — so the service can never drift from the database. The
@@ -47,10 +42,12 @@ const FieldName = zod_1.z
     .trim()
     .min(1, { message: 'Custom field name is required.' })
     .max(MAX_NAME_LENGTH, { message: 'Custom field name is too long.' });
-// The backend mints the key from the name, so create takes just a name and type.
+const FieldAccess = zod_1.z.object({ member: access_1.MemberAccessSchema });
+// No key: the backend mints it from the name.
 const AddFieldInput = zod_1.z.object({
     name: FieldName,
     type: metafield_types_1.FieldTypeSchema,
+    access: FieldAccess.optional(),
 });
 // A bound on the work one request can ask for, separate from how many definitions
 // a site may hold in total. Every definition in a batch costs several queries
@@ -73,11 +70,12 @@ const ReorderInput = zod_1.z
     key: zod_1.z.string().min(1, { message: 'Every custom field in the order needs a key.' }),
 }))
     .min(1, { message: 'The order must name every custom field.' });
-// Name and status are mutable. `key` and `type` are accepted so the immutability
-// rules can reject a change loudly; they are never persisted.
+// Name, status and access are mutable. `key` and `type` are accepted so the
+// immutability rules can reject a change loudly; they are never persisted.
 const EditFieldInput = zod_1.z.object({
     name: FieldName.optional(),
     status: schema_1.FieldStatusSchema.optional(),
+    access: FieldAccess.optional(),
     key: zod_1.z.string().optional(),
     type: metafield_types_1.FieldTypeSchema.optional(),
 });
@@ -95,8 +93,8 @@ class MetafieldDefinitionsService {
         // restart. Where the number comes from is the caller's business.
         this.getMaxDefinitions = getMaxDefinitions;
     }
-    async hasAnyActive() {
-        const [field] = await this.list((0, queries_1.activeFields)(this.knex).limit(1));
+    async hasAnyReadable(audience) {
+        const [field] = await this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY, limit: 1 }));
         return Boolean(field);
     }
     /**
@@ -106,34 +104,35 @@ class MetafieldDefinitionsService {
     isStored(namespace) {
         return namespace === identity_1.CUSTOM_NAMESPACE;
     }
-    async browse(options = {}, audience = access_1.ADMIN) {
+    async browse(options, audience) {
         if (options.namespace !== undefined && !this.isStored(options.namespace)) {
             return [];
         }
-        // Archived fields are hidden by default: most surfaces (member details, the
-        // filter picker, the importer) only ever want active fields. A caller-
-        // supplied `filter` can widen that — Settings pulls active and archived
-        // together in one request (`filter=status:[active,archived]`).
-        //
         // Whichever set comes back, it comes back in the publisher's order: filtering
         // narrows the list, it never reorders it.
-        const query = options.filter
-            ? applyFilter(this.knex(TABLE), options.filter)
-            : (0, queries_1.activeFields)(this.knex);
-        return (0, access_1.readableFields)(audience, await this.list(query));
+        const { filter } = options;
+        if (filter) {
+            // A filter naming `status` decides the statuses itself, which is how Settings
+            // pulls active and archived together in one request
+            // (`filter=status:[active,archived]`). One that does not gets the same active-only
+            // scope as an unfiltered read.
+            const parsed = parseFilter(filter);
+            return this.list((0, queries_1.definitions)(this.knex, {
+                audience,
+                status: filterReferencesStatus(parsed) ? queries_1.ANY_STATUS : queries_1.ACTIVE_ONLY,
+                filter: (query) => (0, queries_1.knexify)(query, parsed, { tableName: TABLE }),
+            }));
+        }
+        return this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ACTIVE_ONLY }));
     }
-    /**
-     * Decode a definition query into the domain, in the publisher's order.
-     *
-     * Typed off `activeFields` so the builder keeps the table's row type: every caller
-     * hands over a query against the definitions table, whatever it has narrowed.
-     */
     async list(query) {
         const rows = await (0, queries_1.inFieldOrder)(query).select('*');
         return rows.map((row) => zod_1.z.decode(codec_1.metafieldCodec, row));
     }
-    async read(namespace, key) {
-        const [field] = this.isStored(namespace) ? await this.list((0, queries_1.fieldByKey)(this.knex, key)) : [];
+    async read(namespace, key, audience) {
+        const [field] = this.isStored(namespace)
+            ? await this.list((0, queries_1.definitions)(this.knex, { audience, status: queries_1.ANY_STATUS, key }))
+            : [];
         if (!field) {
             throw new errors_1.default.NotFoundError({ message: 'Custom field not found.' });
         }
@@ -191,6 +190,7 @@ class MetafieldDefinitionsService {
                         key,
                         name: field.name,
                         type: field.type,
+                        memberAccess: field.access?.member ?? access_1.MEMBER_ACCESS.none,
                         sortOrder: firstSortOrder + index,
                     });
                     keys.push(key);
@@ -236,6 +236,7 @@ class MetafieldDefinitionsService {
                 key: wanted.key,
                 name: wanted.name,
                 type: wanted.type,
+                memberAccess: wanted.access.member,
                 sortOrder: await this.nextSortOrder(db),
             });
             const [created] = await this.readMany(db, [wanted.key]);
@@ -263,6 +264,7 @@ class MetafieldDefinitionsService {
             key: field.key,
             name: field.name,
             type: field.type,
+            member_access: field.memberAccess,
             sort_order: field.sortOrder,
             created_at: new Date(),
         });
@@ -351,7 +353,8 @@ class MetafieldDefinitionsService {
                     .where('key', key)
                     .update({ sort_order: ranks.get(key) });
             }
-            return this.list(trx(TABLE));
+            // An order covers the whole list, archived definitions included.
+            return this.list((0, queries_1.definitions)(trx, { audience: access_1.ADMIN, status: queries_1.ANY_STATUS }));
         });
         await this.recordAction({
             context,
@@ -460,7 +463,7 @@ class MetafieldDefinitionsService {
             });
         }
         const patch = parsed.data;
-        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key);
+        const existing = await this.read(identity_1.CUSTOM_NAMESPACE, key, access_1.ADMIN);
         // Key and type are immutable after creation: values are addressed by key
         // and interpreted by type, so changing either would silently orphan or
         // corrupt stored values. Reject a differing value rather than ignore it.
@@ -500,6 +503,22 @@ class MetafieldDefinitionsService {
                 details: { primary_name: patch.name, key, previous_name: existing.name },
             });
         }
+        if (patch.access !== undefined && patch.access.member !== existing.access.member) {
+            await this.knex(TABLE)
+                .where('key', key)
+                .update({ member_access: patch.access.member, updated_at: new Date() });
+            await this.recordAction({
+                context,
+                verb: 'changeAccess',
+                subject: existing.id,
+                details: {
+                    primary_name: patch.name ?? existing.name,
+                    key,
+                    member_access: patch.access.member,
+                    previous_member_access: existing.access.member,
+                },
+            });
+        }
         // A status change is the archive/restore transition. Only write (and log)
         // when it actually flips, so re-sending the current status is a no-op.
         if (patch.status !== undefined && patch.status !== existing.status) {
@@ -514,7 +533,7 @@ class MetafieldDefinitionsService {
                 details: { primary_name: patch.name ?? existing.name, key },
             });
         }
-        return this.read(identity_1.CUSTOM_NAMESPACE, key);
+        return this.read(identity_1.CUSTOM_NAMESPACE, key, access_1.ADMIN);
     }
     /**
      * Permanently delete a field and every member value attached to it (the FK
@@ -597,15 +616,14 @@ function isUniqueConstraintViolation(error) {
     const code = error?.code;
     return code === 'ER_DUP_ENTRY' || code === 'SQLITE_CONSTRAINT';
 }
-// Apply a caller-supplied NQL filter to the definition query. A malformed filter
-// is a client error (400), not a 500. The active-only default is preserved unless
-// the filter itself constrains status, so a filter on another field (e.g. type)
-// can never surface archived fields — this is the invariant queries.ts centralises,
-// held here as the per-field default override Bookshelf's filter plugin does.
-function applyFilter(query, filter) {
+// Parse a caller-supplied NQL filter, without applying it. A malformed filter is a
+// client error (400), not a 500. Whether the result widens the statuses is decided by
+// the caller, which reads it with `filterReferencesStatus` and says so when building
+// the query; nothing here narrows anything.
+function parseFilter(filter) {
     let mongoQuery;
     try {
-        mongoQuery = nql(filter).toJSON();
+        mongoQuery = (0, queries_1.nql)(filter).toJSON();
     }
     catch (err) {
         throw new errors_1.default.BadRequestError({
@@ -623,20 +641,7 @@ function applyFilter(query, filter) {
             property: 'filter',
         });
     }
-    try {
-        knexify(query, mongoQuery, { tableName: TABLE });
-    }
-    catch (err) {
-        throw new errors_1.default.BadRequestError({
-            message: 'Could not parse the filter parameter.',
-            property: 'filter',
-            err: err,
-        });
-    }
-    if (!filterReferencesStatus(mongoQuery)) {
-        query.where('status', schema_1.FIELD_STATUS.active);
-    }
-    return query;
+    return mongoQuery;
 }
 // Whether an NQL-parsed filter constrains `status` anywhere, including inside the
 // $and/$or/$nor combinators — so a status filter at any nesting counts as the

package/core/server/services/members-metafields/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bindings = exports.values = exports.definitions = exports.readableFields = exports.canWrite = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.actingContext = void 0;
+exports.bindings = exports.values = exports.definitions = exports.canWrite = exports.MEMBER_ACCESS = exports.MEMBERS = exports.INTERNAL = exports.ADMIN = exports.adminWriteOrigin = exports.actingContext = void 0;
 exports.init = init;
 const definitions_service_1 = require("./definitions-service");
 const values_service_1 = require("./values-service");
@@ -9,6 +9,7 @@ const actions_1 = require("./actions");
 const config_1 = require("./config");
 var actions_2 = require("./actions");
 Object.defineProperty(exports, "actingContext", { enumerable: true, get: function () { return actions_2.actingContext; } });
+Object.defineProperty(exports, "adminWriteOrigin", { enumerable: true, get: function () { return actions_2.adminWriteOrigin; } });
 // Which door a request came through, which is what decides how much of a member's
 // answers it may see or change. Required wherever that is asked, so a new caller
 // has to name itself rather than inherit an answer by default.
@@ -16,8 +17,8 @@ var access_1 = require("./access");
 Object.defineProperty(exports, "ADMIN", { enumerable: true, get: function () { return access_1.ADMIN; } });
 Object.defineProperty(exports, "INTERNAL", { enumerable: true, get: function () { return access_1.INTERNAL; } });
 Object.defineProperty(exports, "MEMBERS", { enumerable: true, get: function () { return access_1.MEMBERS; } });
+Object.defineProperty(exports, "MEMBER_ACCESS", { enumerable: true, get: function () { return access_1.MEMBER_ACCESS; } });
 Object.defineProperty(exports, "canWrite", { enumerable: true, get: function () { return access_1.canWrite; } });
-Object.defineProperty(exports, "readableFields", { enumerable: true, get: function () { return access_1.readableFields; } });
 function init() {
     // The three are constructed together below, so checking all of them keeps the "all or
     // none" invariant explicit rather than trusting one to stand in for the rest.

package/core/server/services/members-metafields/models.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Metafield = void 0;
 const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
+const access_1 = require("./access");
 const schema_1 = require("./schema");
 exports.Metafield = zod_1.z.object({
     id: zod_1.z.string(),
@@ -11,6 +12,7 @@ exports.Metafield = zod_1.z.object({
     name: zod_1.z.string(),
     type: metafield_types_1.FieldTypeSchema,
     status: schema_1.FieldStatusSchema,
+    access: zod_1.z.object({ member: access_1.MemberAccessSchema }),
     createdAt: zod_1.z.date(),
     updatedAt: zod_1.z.date().nullable(),
 });

package/core/server/services/members-metafields/queries.js

@@ -1,20 +1,54 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.activeFields = activeFields;
-exports.fieldByKey = fieldByKey;
+exports.ANY_STATUS = exports.ACTIVE_ONLY = exports.knexify = exports.nql = void 0;
+exports.readableBy = readableBy;
+exports.definitions = definitions;
 exports.inFieldOrder = inFieldOrder;
+const access_1 = require("./access");
 const schema_1 = require("./schema");
 const FIELDS_TABLE = 'members_metafields';
-// Archived fields must stay out of every read and write, and nothing in the database
-// enforces that — no constraint stops a value row referencing an archived field. A query
-// that forgets the filter is a silent bug, so the filter lives in one place.
-/** Takes the executor so the same query runs standalone or inside a write's transaction. */
-function activeFields(db) {
-    return db(FIELDS_TABLE).where('status', schema_1.FIELD_STATUS.active);
+// The same NQL -> knex bridge Bookshelf's filter plugin uses, applied directly to our
+// raw-knex queries: nql parses a `filter` string to a Mongo query, mongo-knex turns that
+// into parametrised WHERE clauses. Neither needs a Bookshelf model. Typed once here, since
+// neither package ships types.
+exports.nql = require('@tryghost/nql');
+exports.knexify = require('@tryghost/mongo-knex');
+// Nothing in the database keeps an archived or hidden field out of a read: no
+// constraint stops a value row referencing one. Both filters are therefore applied in
+// code, and a query that forgets either is a silent bug.
+function readableBy(query, audience) {
+    query.whereIn(`${FIELDS_TABLE}.member_access`, (0, access_1.readableLevels)(audience));
+    return query;
+}
+/**
+ * Whether a read includes definitions the publisher has archived.
+ *
+ * A member is never offered an archived field. Staff managing the list are always
+ * shown one, since an archived field is still theirs to rename, restore or delete.
+ */
+exports.ACTIVE_ONLY = 'active-only';
+exports.ANY_STATUS = 'any-status';
+// Unannotated so the builder keeps the row type knex derives from the table
+// registration; naming a type here would both lose that and make the alias below
+// refer to itself.
+function metafieldsTable(db) {
+    return db(FIELDS_TABLE);
 }
-/** One field by key, as the same kind of query the rest of this reads through. */
-function fieldByKey(db, key) {
-    return db(FIELDS_TABLE).where(`${FIELDS_TABLE}.key`, key);
+function definitions(db, scope) {
+    let query = metafieldsTable(db);
+    if (scope.filter) {
+        query = scope.filter(query);
+    }
+    if (scope.key !== undefined) {
+        query = query.where(`${FIELDS_TABLE}.key`, scope.key);
+    }
+    if (scope.status === exports.ACTIVE_ONLY) {
+        query = query.where(`${FIELDS_TABLE}.status`, schema_1.FIELD_STATUS.active);
+    }
+    if (scope.limit !== undefined) {
+        query = query.limit(scope.limit);
+    }
+    return readableBy(query, scope.audience);
 }
 /**
  * The publisher's order, applied to every read of the list. Here for the same reason the

package/core/server/services/members-metafields/schema.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbMetafieldChangeEventWithMember = exports.DbChangeEventMember = exports.DbMetafieldChangeEvent = exports.StoredFieldList = exports.MetafieldChangeEventFields = exports.DbBoundField = exports.DbMetafieldBinding = exports.DbMetafieldLeaf = exports.DbMetafieldValue = exports.WrittenBy = exports.DbMetafield = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
 const metafield_types_1 = require("@tryghost/metafield-types");
 const date_1 = require("../../lib/db-types/date");
+const access_1 = require("./access");
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
 // column, which is static config and cannot import this.
@@ -17,6 +18,7 @@ exports.DbMetafield = zod_1.z.object({
     name: zod_1.z.string(),
     type: metafield_types_1.FieldTypeSchema,
     status: exports.FieldStatusSchema,
+    member_access: access_1.MemberAccessSchema,
     created_at: date_1.DbDate,
     updated_at: date_1.DbDate.nullable(),
 });
@@ -80,3 +82,51 @@ exports.DbBoundField = zod_1.z.object({
     key: zod_1.z.string(),
     type: metafield_types_1.FieldTypeSchema,
 });
+/** The fields an entry names. */
+exports.MetafieldChangeEventFields = zod_1.z.array(metafield_types_1.MetafieldChangeEventFieldSchema);
+/**
+ * The field list as the table holds it, JSON text, against the list itself. A codec rather
+ * than a parse on the way out, so the write stores what the read accepts. Zod validates
+ * JSON-compatible values (`z.json()`) but has no built-in for parsing JSON text, so decoding
+ * the text is this codec's job.
+ */
+exports.StoredFieldList = zod_1.z.codec(zod_1.z.string(), exports.MetafieldChangeEventFields, {
+    decode: (text, ctx) => {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            ctx.issues.push({
+                code: 'custom',
+                message: 'The stored field list is not JSON.',
+                input: text,
+            });
+            return zod_1.z.NEVER;
+        }
+    },
+    encode: (fields) => JSON.stringify(fields),
+});
+/** An entry as the table holds it. Writer and source are plain strings, as on the values table. */
+exports.DbMetafieldChangeEvent = zod_1.z.object({
+    id: zod_1.z.string(),
+    member_id: zod_1.z.string(),
+    written_by_type: zod_1.z.string(),
+    written_by_id: zod_1.z.string().nullable(),
+    source: zod_1.z.string(),
+    metafields: exports.StoredFieldList,
+    created_at: date_1.DbDate,
+});
+/** The member columns an entry is shown with: only what a feed row needs. */
+exports.DbChangeEventMember = zod_1.z.object({
+    id: zod_1.z.string(),
+    uuid: zod_1.z.string(),
+    name: zod_1.z.string().nullable(),
+    email: zod_1.z.string(),
+});
+/**
+ * An entry and its member read back together. Parses and nothing else: what to do with an
+ * entry that doesn't parse is the reading service's decision.
+ */
+exports.DbMetafieldChangeEventWithMember = zod_1.z
+    .object({ event: exports.DbMetafieldChangeEvent, member: exports.DbChangeEventMember })
+    .transform(({ event, member }) => ({ ...event, member }));

package/core/server/services/members-metafields/serializers.js

@@ -10,6 +10,7 @@ const MetafieldResource = zod_1.z.object({
     name: zod_1.z.string(),
     type: zod_1.z.string(),
     status: zod_1.z.string(),
+    access: zod_1.z.object({ member: zod_1.z.string() }),
     created_at: zod_1.z.date(),
     updated_at: zod_1.z.date().nullable(),
 });