ghost 6.63.0 → 6.65.0

package/core/server/services/tinybird-sync/index.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.start = void 0;
+const promises_1 = require("node:timers/promises");
+const bson_objectid_1 = __importDefault(require("bson-objectid"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const config_1 = __importDefault(require("../../../shared/config"));
+// @ts-expect-error This module lacks type definitions.
+const labs_1 = __importDefault(require("../../../shared/labs"));
+// @ts-expect-error This module lacks type definitions.
+const settings_cache_1 = __importDefault(require("../../../shared/settings-cache"));
+const db_1 = require("../../data/db");
+const tinybird_sync_service_1 = require("./tinybird-sync-service");
+const service = (0, tinybird_sync_service_1.createTinybirdSyncService)({
+    config: config_1.default,
+    settingsCache: settings_cache_1.default,
+    labs: labs_1.default,
+    knex: db_1.knex,
+    logging: logging_1.default,
+    sleep: async (ms) => {
+        await (0, promises_1.setTimeout)(ms, undefined, { ref: false });
+    },
+    random: Math.random,
+    now: () => new Date(),
+    fetch: globalThis.fetch,
+    createId: () => (0, bson_objectid_1.default)().toHexString(),
+});
+exports.start = service.start;

package/core/server/services/tinybird-sync/sync-table-to-tinybird.js

@@ -0,0 +1,149 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFETY_LAG_MS = exports.AUTOMATION_SYNC_TARGETS = void 0;
+exports.syncTableToTinybird = syncTableToTinybird;
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const date_1 = require("../../lib/db-types/date");
+// Only what the Tinybird materialized views read. Member identity and lock bookkeeping
+// stay in MySQL.
+exports.AUTOMATION_SYNC_TARGETS = [
+    {
+        table: 'automation_runs',
+        columns: ['id', 'automation_id', 'created_at', 'updated_at'],
+    },
+    {
+        table: 'automation_run_steps',
+        columns: [
+            'id',
+            'automation_run_id',
+            'automation_action_revision_id',
+            'status',
+            'step_attempts',
+            'ready_at',
+            'started_at',
+            'finished_at',
+            'created_at',
+            'updated_at',
+        ],
+    },
+];
+// A row's updated_at is assigned before its transaction commits, so a row can become
+// visible after rows with later timestamps. Holding back the newest rows keeps the
+// watermark from moving past a row whose transaction is still open.
+exports.SAFETY_LAG_MS = 60 * 1000;
+const serializeValue = (key, value) => key.endsWith('_at') && value !== null && value !== undefined
+    ? (0, date_1.fromDatabaseDate)(value).toISOString()
+    : value;
+const toEventLine = (row, siteUuid, type) => {
+    const payload = Object.fromEntries(Object.entries(row).map(([key, value]) => [key, serializeValue(key, value)]));
+    return JSON.stringify({
+        type,
+        site_uuid: siteUuid,
+        id: row.id,
+        updated_at: (0, date_1.fromDatabaseDate)(row.updated_at).toISOString(),
+        payload: { ...payload, site_uuid: siteUuid },
+    });
+};
+function* chunkByPayloadLimits(lines, maxBytes, maxMessages) {
+    let current = [];
+    let currentBytes = 0;
+    for (const line of lines) {
+        const bytes = Buffer.byteLength(line) + '\n'.length;
+        if (current.length && (currentBytes + bytes > maxBytes || current.length === maxMessages)) {
+            yield current;
+            current = [];
+            currentBytes = 0;
+        }
+        current.push(line);
+        currentBytes += bytes;
+    }
+    if (current.length) {
+        yield current;
+    }
+}
+async function postEvents(lines, { table }, { endpoint, trafficAnalyticsAuth, siteUuid, fetch, requestTimeoutMs }) {
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${trafficAnalyticsAuth}`,
+            'Content-Type': 'application/x-ndjson',
+            'x-site-uuid': siteUuid,
+        },
+        body: lines.join('\n'),
+        signal: AbortSignal.timeout(requestTimeoutMs),
+    });
+    if (!response.ok) {
+        throw new errors_1.default.InternalServerError({
+            message: `Traffic Analytics returned ${response.status} while syncing ${table}: ${await response.text()}`,
+        });
+    }
+}
+async function readWatermark(knex, table) {
+    const row = await knex('tinybird_syncs')
+        .select('last_synced_updated_at', 'last_synced_id')
+        .where({ table_name: table })
+        .first();
+    if (!row) {
+        return null;
+    }
+    return { updatedAt: (0, date_1.fromDatabaseDate)(row.last_synced_updated_at), id: row.last_synced_id };
+}
+async function writeWatermark(knex, table, cursor, now, createId) {
+    const timestamp = (0, date_1.toDatabaseDate)(now);
+    const values = {
+        last_synced_updated_at: (0, date_1.toDatabaseDate)(cursor.updatedAt),
+        last_synced_id: cursor.id,
+        updated_at: timestamp,
+    };
+    await knex('tinybird_syncs')
+        .insert({
+        id: createId(),
+        table_name: table,
+        ...values,
+        created_at: timestamp,
+    })
+        .onConflict('table_name')
+        .merge(values);
+}
+async function readBatch({ table, columns }, { knex, batchSize }, cursor, cutoff) {
+    const query = knex(table)
+        .select(columns)
+        .where('updated_at', '<', cutoff)
+        .orderBy([{ column: 'updated_at' }, { column: 'id' }])
+        .limit(batchSize);
+    if (cursor) {
+        const updatedAt = (0, date_1.toDatabaseDate)(cursor.updatedAt);
+        query.andWhere((builder) => builder
+            .where('updated_at', '>', updatedAt)
+            .orWhere((tie) => tie.where('updated_at', updatedAt).andWhere('id', '>', cursor.id)));
+    }
+    return await query;
+}
+async function syncTableToTinybird(target, options) {
+    const { knex, siteUuid, now, createId, batchSize, maxPayloadBytes, maxPayloadMessages } = options;
+    const cutoff = (0, date_1.toDatabaseDate)(new Date(now().getTime() - exports.SAFETY_LAG_MS));
+    let cursor = await readWatermark(knex, target.table);
+    let sent = 0;
+    while (true) {
+        const rows = await readBatch(target, options, cursor, cutoff);
+        if (!rows.length) {
+            return sent;
+        }
+        const lines = rows.map((row) => toEventLine(row, siteUuid, target.table));
+        for (const chunk of chunkByPayloadLimits(lines, maxPayloadBytes, maxPayloadMessages)) {
+            await postEvents(chunk, target, options);
+        }
+        const last = rows[rows.length - 1];
+        cursor = { updatedAt: (0, date_1.fromDatabaseDate)(last.updated_at), id: last.id };
+        await writeWatermark(knex, target.table, cursor, now(), createId);
+        sent += rows.length;
+        // This is a performance optimization to prevent one needless batch read.
+        // It is not required for correctness.
+        if (rows.length < batchSize) {
+            return sent;
+        }
+    }
+}

package/core/server/services/tinybird-sync/tinybird-sync-service.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTinybirdSyncService = createTinybirdSyncService;
+const get_ingest_config_1 = require("./get-ingest-config");
+const sync_table_to_tinybird_1 = require("./sync-table-to-tinybird");
+const INTERVAL_MS = 5 * 60 * 1000;
+const BATCH_SIZE = 5000;
+// This should be a little less than the maximum, because rows are chunked by
+// JSON line, not bytes strictly.
+const MAX_PAYLOAD_BYTES = 9 * 1024 * 1024;
+const MAX_PAYLOAD_MESSAGES = 1000;
+const REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
+function createTinybirdSyncService({ config, settingsCache, labs, knex, logging, sleep, random, now, fetch, createId, }) {
+    let started = false;
+    const syncAll = async (ingest) => {
+        const results = await Promise.allSettled(sync_table_to_tinybird_1.AUTOMATION_SYNC_TARGETS.map(async (target) => {
+            const sent = await (0, sync_table_to_tinybird_1.syncTableToTinybird)(target, {
+                knex,
+                ...ingest,
+                now,
+                fetch,
+                createId,
+                batchSize: BATCH_SIZE,
+                maxPayloadBytes: MAX_PAYLOAD_BYTES,
+                maxPayloadMessages: MAX_PAYLOAD_MESSAGES,
+                requestTimeoutMs: REQUEST_TIMEOUT_MS,
+            });
+            logging.info({ system: { event: 'tinybird.sync.completed', table: target.table, sent } }, `[Tinybird sync] ${target.table}: sent ${sent} rows`);
+        }));
+        for (const result of results) {
+            if (result.status === 'rejected') {
+                logging.error(result.reason, '[Tinybird sync] Failed to sync table');
+            }
+        }
+    };
+    const runLoop = async (ingest) => {
+        // Randomize the first wait to avoid all instances syncing at the same time.
+        await sleep(Math.floor(random() * INTERVAL_MS));
+        while (true) {
+            if (labs.isSet('automationsTinybirdSync')) {
+                await syncAll(ingest);
+            }
+            await sleep(INTERVAL_MS);
+        }
+    };
+    const start = () => {
+        if (started) {
+            return;
+        }
+        const ingest = (0, get_ingest_config_1.getIngestConfig)({ config, settingsCache });
+        if (!ingest) {
+            logging.info('[Tinybird sync] Not started: Traffic Analytics service is not configured');
+            return;
+        }
+        started = true;
+        const isSyncEnabled = labs.isSet('automationsTinybirdSync');
+        logging.info({ system: { event: 'tinybird.sync.started' } }, `[Tinybird sync] Started: sync ${isSyncEnabled ? 'enabled' : 'disabled'} by labs flag (but may change)`);
+        void runLoop(ingest)
+            .then(() => {
+            logging.error('[Tinybird sync] Loop stopped unexpectedly');
+        })
+            .catch((error) => {
+            logging.error(error, '[Tinybird sync] Loop stopped');
+        });
+    };
+    return { start };
+}

package/core/server/services/update-check/update-check-service.js

@@ -19,10 +19,10 @@ function normalizeNotifications(response) {
   if (!response) {
     return [];
   }
-  if (_.isArray(response.notifications)) {
+  if (Array.isArray(response.notifications)) {
     return response.notifications;
   }
-  if (_.isArray(response)) {
+  if (Array.isArray(response)) {
     return response;
   }
   if (response.messages) {
@@ -230,7 +230,7 @@ class UpdateCheckService {
    * @return {Promise}
    */
   async updateCheckResponse(response) {
-    let notificationGroups = (this.config.notificationGroups || []).concat(['all']);
+    const notificationGroups = (this.config.notificationGroups || []).concat(['all']);
 
     debug('Notification Groups', notificationGroups);
     debug('Response Update Check Service', response);

package/core/server/services/webhooks/serialize.js

@@ -42,7 +42,7 @@ module.exports =
     const changed = model._changed ? Object.keys(model._changed) : [];
 
     if (Object.keys(model.attributes).length) {
-      let frame = { options: { previous: false, context: { user: true } } };
+      const frame = { options: { previous: false, context: { user: true } } };
 
       // @NOTE: below options are lost during event processing, a more holistic approach would be
       //       to pass them somehow along with the model

package/core/server/web/api/app.js

@@ -1,5 +1,4 @@
 const debug = require('@tryghost/debug')('web:api:default:app');
-const config = require('../../../shared/config');
 const express = require('../../../shared/express');
 const sentry = require('../../../shared/sentry');
 const middleware = require('../shared/middleware');
@@ -13,10 +12,6 @@ module.exports = function setupApiApp() {
   debug('Parent API setup start');
   const apiApp = express('api');
 
-  if (config.get('server:testmode')) {
-    apiApp.use(require('./testmode')());
-  }
-
   apiApp.use(APIVersionCompatibilityService.versionRewrites);
   apiApp.use(APIVersionCompatibilityService.contentVersion);
 

package/core/server/web/api/endpoints/admin/routes.js

@@ -5,6 +5,7 @@ const auth = require('../../../../services/auth');
 const apiMw = require('../../middleware');
 const mw = require('./middleware');
 const labs = require('../../../../../shared/labs');
+const limits = require('../../../../services/limits');
 
 const shared = require('../../../shared');
 
@@ -195,40 +196,38 @@ module.exports = function apiRoutes() {
 
   router.get('/members/stripe_connect', mw.authAdminApi, http(api.membersStripeConnect.auth));
 
-  // Reading definitions is deliberately not behind the feature flag: Admin asks every site
-  // for them, and a site without the flag simply has none, so the answer is an empty list
-  // rather than a 404. Creating and changing them is flagged. Registered before /members/:id
-  // so the literal path is not captured as an id.
-  router.get('/members/metafields/:namespace', mw.authAdminApi, http(api.membersMetafields.browse));
-  router.post(
-    '/members/metafields/:namespace',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.add),
-  );
-  router.put(
-    '/members/metafields/:namespace',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.reorder),
-  );
-  router.get(
-    '/members/metafields/:namespace/:key',
-    mw.authAdminApi,
-    http(api.membersMetafields.read),
-  );
-  router.put(
-    '/members/metafields/:namespace/:key',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.edit),
-  );
-  router.delete(
-    '/members/metafields/:namespace/:key',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersMetafields.destroy),
-  );
+  // Custom field definitions. Mounted rather than listed so every route under it is
+  // reached the same way, and so the guards are stated once each instead of on every
+  // route that needs them.
+  //
+  // Order carries the rule here, the way Express reads it: a request walks this stack
+  // from the top, so the reads below are answered before the guards are reached, and
+  // everything registered after them passes through both. A route added at the end is
+  // guarded by being there, which is the safer way round to forget.
+  //
+  // Mounted before /members/:id so the literal path is not captured as an id.
+  const metafieldsRouter = express.Router('admin api members metafields');
+  router.use('/members/metafields', metafieldsRouter);
+
+  metafieldsRouter.use(mw.authAdminApi);
+
+  // Reading is deliberately open: Admin asks every site for its definitions to draw
+  // screens it renders either way, and a site that has none simply answers with an empty
+  // list rather than a 404.
+  metafieldsRouter.get('/:namespace', http(api.membersMetafields.browse));
+  metafieldsRouter.get('/:namespace/:key', http(api.membersMetafields.read));
+
+  // Changing one needs the feature to exist in this build and the site's plan to include
+  // it. Two separate questions, asked once each: a 404 says the feature is not here, a 403
+  // says the plan does not cover it, and only the second is something a publisher can act
+  // on.
+  metafieldsRouter.use(labs.enabledMiddleware('membersCustomFields'));
+  metafieldsRouter.use(limits.requireFeature('limitCustomFields'));
+
+  metafieldsRouter.post('/:namespace', http(api.membersMetafields.add));
+  metafieldsRouter.put('/:namespace', http(api.membersMetafields.reorder));
+  metafieldsRouter.put('/:namespace/:key', http(api.membersMetafields.edit));
+  metafieldsRouter.delete('/:namespace/:key', http(api.membersMetafields.destroy));
 
   router.get('/members/:id', mw.authAdminApi, http(api.members.read));
   router.put('/members/:id', mw.authAdminApi, http(api.members.edit));

package/core/server/web/api/middleware/upload.js

@@ -324,6 +324,20 @@ const writeSvg = async (filepath, content, isZipped = false) => {
 
   return await fs.writeFile(filepath, content);
 };
+
+/**
+ *
+ * @param {{ext: string, type: string}} file
+ * @returns {boolean}
+ *
+ * Extension and content type are allowlisted separately, so a file counts as an SVG if either
+ * one says so. Storage adapters that use the content type (e.g. S3) would otherwise serve an
+ * unsanitized SVG uploaded with a non-SVG extension as image/svg+xml.
+ */
+const isSvgFile = (file) => {
+  return file.ext === '.svg' || file.ext === '.svgz' || file.type === 'image/svg+xml';
+};
+
 /**
  *
  * @param {Object} options
@@ -369,7 +383,7 @@ const validation = function ({ type }) {
     }
 
     // Sanitize SVG files
-    if (req.file.ext === '.svg' || req.file.ext === '.svgz') {
+    if (isSvgFile(req.file)) {
       const sanitized = await sanitizeSvg(req.file.path, req.file.ext === '.svgz');
 
       if (!sanitized) {
@@ -392,7 +406,7 @@ const validation = function ({ type }) {
  * @returns {import('express').RequestHandler}
  */
 const mediaValidation = function ({ type }) {
-  return function mediaUploadValidation(req, res, next) {
+  return async function mediaUploadValidation(req, res, next) {
     const extensions =
       (config.get('uploads')[type] && config.get('uploads')[type].extensions) || [];
     const contentTypes =
@@ -448,6 +462,19 @@ const mediaValidation = function ({ type }) {
           }),
         );
       }
+
+      // Sanitize SVG thumbnails
+      if (isSvgFile(req.thumbnail)) {
+        const sanitized = await sanitizeSvg(req.thumbnail.path, req.thumbnail.ext === '.svgz');
+
+        if (!sanitized) {
+          return next(
+            new errors.UnsupportedMediaTypeError({
+              message: tpl(messages.svg.invalidFile),
+            }),
+          );
+        }
+      }
     }
 
     next();

package/core/server/web/parent/middleware/index.js

@@ -3,6 +3,6 @@ module.exports = {
   filterQueryParameters: require('./filter-query-parameters').filterQueryParameters,
   ghostLocals: require('./ghost-locals').ghostLocals,
   logRequest: require('./log-request'),
-  queueRequest: require('./queue-request'),
+  queueRequest: require('./queue-request').queueRequest,
   requestId: require('./request-id').requestId,
 };

package/core/server/web/parent/middleware/log-request.js

@@ -12,6 +12,11 @@ module.exports = function logRequest(req, res, next) {
   const startTime = Date.now();
 
   function logResponse() {
+    // 'close' before 'finish' means the client went away before we responded
+    if (!res.writableFinished) {
+      res.statusCode = 499;
+    }
+
     res.responseTime = Date.now() - startTime + 'ms';
     req.userId = req.user ? (req.user.id ? req.user.id : req.user) : null;
 

package/core/server/web/parent/middleware/queue-request.js

@@ -1,62 +1,107 @@
-const errors = require('@tryghost/errors');
-const logging = require('@tryghost/logging');
-const path = require('node:path');
-const expressQueue = require('express-queue');
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queueRequest = queueRequest;
+const node_path_1 = __importDefault(require("node:path"));
+const errors_1 = __importDefault(require("@tryghost/errors"));
+const logging_1 = __importDefault(require("@tryghost/logging"));
 const debug = (message) => {
-  logging.debug(`[queue-request] ${message}`);
+    logging_1.default.debug(`[queue-request] ${message}`);
 };
-
-module.exports = function queueRequest(config, queueFactory = expressQueue) {
-  if (config.concurrencyLimit === undefined) {
-    throw new errors.IncorrectUsageError({
-      message: 'concurrencyLimit must be defined when using queueRequest middleware',
-    });
-  }
-
-  debug(`Initialising queueRequest middleware with config: ${JSON.stringify(config)}`);
-
-  // @see https://github.com/alykoshin/express-queue#usage
-  const queue = queueFactory({
-    activeLimit: config.concurrencyLimit,
-    queuedLimit: -1, // Do not limit the number of queued requests
-  });
-
-  /**
-   * Available events:
-   * - queue - when a request is queued
-   * - dequeue - when a request is dequeued
-   * - process - when a request is being processed
-   * - reject - when a request is rejected
-   * - cancel - when a request is cancelled
-   * - complete - when a request has completed
-   *
-   * @see https://github.com/search?q=repo:alykoshin/mini-queue%20job._toState&type=code
-   */
-  queue.queue.on('queue', (job) => {
-    debug(`Request queued: ${job.data.req.path}`);
-  });
-
-  queue.queue.on('complete', (job) => {
-    debug(`Request completed: ${job.data.req.path}`);
-  });
-
-  /**
-   * @param {import('express').Request} req
-   * @param {import('express').Response} res
-   * @param {import('express').NextFunction} next
-   */
-  return function queueRequestMw(req, res, next) {
-    req.queueDepth = queue.queue.getLength();
-
-    // Do not queue requests for static assets - We assume that any path
-    // with a file extension is a static asset
-    if (path.extname(req.path)) {
-      debug(`Request for assumed static asset skipping queue: ${req.path}`);
-
-      return next();
+/**
+ * Limits how many dynamic requests are processed at once, holding the rest in
+ * a FIFO queue.
+ *
+ * A slot is released when the response is ended or the connection closes,
+ * whichever happens first, so a handler that never ends its response cannot
+ * hold a slot forever. Work abandoned by a disconnected client may keep running
+ * after its slot has been handed on.
+ */
+function queueRequest(config) {
+    if (config.concurrencyLimit === undefined) {
+        throw new errors_1.default.IncorrectUsageError({
+            message: 'concurrencyLimit must be defined when using queueRequest middleware',
+        });
     }
-
-    return queue(req, res, next);
-  };
-};
+    const concurrencyLimit = config.concurrencyLimit;
+    if (!Number.isInteger(concurrencyLimit) || concurrencyLimit <= 0) {
+        throw new errors_1.default.IncorrectUsageError({
+            message: 'concurrencyLimit must be a positive integer',
+        });
+    }
+    // Set iterates in insertion order and deletes in O(1), so cancelling a deep queue stays cheap
+    const queue = new Set();
+    let activeCount = 0;
+    let drainScheduled = false;
+    function start({ req, res, next, queuedAt }) {
+        activeCount += 1;
+        req.extra = { ...req.extra, queueWaitMs: Date.now() - queuedAt };
+        let released = false;
+        const release = () => {
+            if (released) {
+                return;
+            }
+            released = true;
+            activeCount -= 1;
+            debug(`Request completed: ${req.path}`);
+            scheduleStartNext();
+        };
+        const end = res.end;
+        res.end = function (...args) {
+            res.end = end;
+            release();
+            return end.apply(this, args);
+        };
+        res.once('close', release);
+        next();
+    }
+    // Deferred and bounded so handlers that respond synchronously neither grow the
+    // stack per queued request nor drain a deep backlog without yielding to I/O
+    function scheduleStartNext() {
+        if (drainScheduled) {
+            return;
+        }
+        drainScheduled = true;
+        setImmediate(() => {
+            drainScheduled = false;
+            startNext();
+        });
+    }
+    function startNext() {
+        const availableSlots = concurrencyLimit - activeCount;
+        for (let started = 0; started < availableSlots && queue.size > 0; started += 1) {
+            const [entry] = queue;
+            queue.delete(entry);
+            entry.res.removeListener('close', entry.cancel);
+            start(entry);
+        }
+    }
+    return function queueRequestMw(req, res, next) {
+        req.queueDepth = queue.size;
+        // Do not queue requests for static assets - We assume that any path
+        // with a file extension is a static asset
+        if (node_path_1.default.extname(req.path)) {
+            debug(`Request for assumed static asset skipping queue: ${req.path}`);
+            return next();
+        }
+        const entry = {
+            req,
+            res,
+            next,
+            queuedAt: Date.now(),
+            cancel: () => {
+                queue.delete(entry);
+                debug(`Request cancelled while queued: ${req.path}`);
+            },
+        };
+        // an empty-queue check keeps arrivals behind requests awaiting a deferred start
+        if (activeCount < concurrencyLimit && queue.size === 0) {
+            return start(entry);
+        }
+        debug(`Request queued: ${req.path}`);
+        queue.add(entry);
+        res.once('close', entry.cancel);
+    };
+}

package/core/server/web/shared/middleware/api/spam-prevention.js

@@ -42,8 +42,8 @@ let spamMemberLogin = spam.member_login || {};
 let spamCheckoutSessionGlobal = spam.checkout_session_global || {};
 let spamCheckoutSessionEmail = spam.checkout_session_email || {};
 let spamContentApiKey = spam.content_api_key || {};
-let spamWebmentionsBlock = spam.webmentions_block || {};
-let spamEmailPreviewBlock = spam.email_preview_block || {};
+const spamWebmentionsBlock = spam.webmentions_block || {};
+const spamEmailPreviewBlock = spam.email_preview_block || {};
 let spamOtcVerificationEnumeration = spam.otc_verification_enumeration || {};
 let spamOtcVerification = spam.otc_verification || {};