2019-10-10 13:31:38 +03:00
|
|
|
const crypto = require('crypto');
|
2019-09-03 07:39:00 +03:00
|
|
|
const {URL} = require('url');
|
2018-12-11 10:57:01 +03:00
|
|
|
const settingsCache = require('../settings/cache');
|
2019-06-18 16:13:55 +03:00
|
|
|
const urlUtils = require('../../lib/url-utils');
|
2019-05-08 15:08:25 +03:00
|
|
|
const MembersApi = require('@tryghost/members-api');
|
2019-02-26 06:09:16 +03:00
|
|
|
const common = require('../../lib/common');
|
2019-09-25 07:42:30 +03:00
|
|
|
const ghostVersion = require('../../lib/ghost-version');
|
2018-12-11 10:57:01 +03:00
|
|
|
const mail = require('../mail');
|
2019-09-03 07:39:00 +03:00
|
|
|
const models = require('../../models');
|
2019-10-10 16:28:20 +03:00
|
|
|
const signinEmail = require('./emails/signin');
|
|
|
|
const signupEmail = require('./emails/signup');
|
|
|
|
const subscribeEmail = require('./emails/subscribe');
|
2018-12-11 10:57:01 +03:00
|
|
|
|
2019-10-10 09:45:43 +03:00
|
|
|
async function createMember({email, name, note}, options = {}) {
|
|
|
|
const model = await models.Member.add({
|
2019-09-26 11:39:24 +03:00
|
|
|
email,
|
2019-10-10 09:45:43 +03:00
|
|
|
name: name || null,
|
|
|
|
note: note || null
|
2018-12-11 10:57:01 +03:00
|
|
|
});
|
2019-10-10 09:45:43 +03:00
|
|
|
const member = model.toJSON(options);
|
|
|
|
return member;
|
2018-12-11 10:57:01 +03:00
|
|
|
}
|
|
|
|
|
2019-10-10 09:45:43 +03:00
|
|
|
async function getMember(data, options = {}) {
|
2019-09-03 07:39:00 +03:00
|
|
|
if (!data.email && !data.id) {
|
|
|
|
return Promise.resolve(null);
|
|
|
|
}
|
2019-10-10 09:45:43 +03:00
|
|
|
const model = await models.Member.findOne(data, options);
|
|
|
|
if (!model) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
const member = model.toJSON(options);
|
|
|
|
return member;
|
2019-01-30 14:36:09 +03:00
|
|
|
}
|
|
|
|
|
2019-10-08 12:32:26 +03:00
|
|
|
async function setMetadata(module, metadata) {
|
2019-09-25 12:26:52 +03:00
|
|
|
if (module !== 'stripe') {
|
|
|
|
return;
|
|
|
|
}
|
2019-10-08 07:16:51 +03:00
|
|
|
|
|
|
|
if (metadata.customer) {
|
2019-10-08 09:11:30 +03:00
|
|
|
await models.MemberStripeCustomer.upsert(metadata.customer, {
|
2019-10-08 07:16:51 +03:00
|
|
|
customer_id: metadata.customer.customer_id
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
|
|
|
if (metadata.subscription) {
|
2019-10-08 09:11:30 +03:00
|
|
|
await models.StripeCustomerSubscription.upsert(metadata.subscription, {
|
2019-10-08 07:16:51 +03:00
|
|
|
subscription_id: metadata.subscription.subscription_id
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2019-09-25 12:26:52 +03:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2019-10-08 12:32:26 +03:00
|
|
|
async function getMetadata(module, member) {
|
2019-09-25 12:26:52 +03:00
|
|
|
if (module !== 'stripe') {
|
|
|
|
return;
|
|
|
|
}
|
2019-10-08 07:16:51 +03:00
|
|
|
|
2019-10-08 09:12:01 +03:00
|
|
|
const customers = (await models.MemberStripeCustomer.findAll({
|
|
|
|
filter: `member_id:${member.id}`
|
|
|
|
})).toJSON();
|
2019-10-08 07:16:51 +03:00
|
|
|
|
|
|
|
const subscriptions = await customers.reduce(async (subscriptionsPromise, customer) => {
|
2019-10-08 09:12:01 +03:00
|
|
|
const customerSubscriptions = await models.StripeCustomerSubscription.findAll({
|
|
|
|
filter: `customer_id:${customer.customer_id}`
|
|
|
|
});
|
2019-10-08 07:16:51 +03:00
|
|
|
return (await subscriptionsPromise).concat(customerSubscriptions.toJSON());
|
|
|
|
}, []);
|
|
|
|
|
|
|
|
return {
|
|
|
|
customers: customers,
|
|
|
|
subscriptions: subscriptions
|
|
|
|
};
|
2019-09-25 12:26:52 +03:00
|
|
|
}
|
|
|
|
|
2019-11-05 14:03:19 +03:00
|
|
|
async function updateMember({name, note, subscribed}, options = {}) {
|
|
|
|
const attrs = {
|
2019-10-10 09:45:43 +03:00
|
|
|
name: name || null,
|
|
|
|
note: note || null
|
2019-11-05 14:03:19 +03:00
|
|
|
};
|
|
|
|
|
|
|
|
if (subscribed !== undefined) {
|
|
|
|
attrs.subscribed = subscribed;
|
|
|
|
}
|
|
|
|
|
|
|
|
const model = await models.Member.edit(attrs, options);
|
2019-10-10 09:45:43 +03:00
|
|
|
|
|
|
|
const member = model.toJSON(options);
|
|
|
|
return member;
|
2019-10-02 11:19:11 +03:00
|
|
|
}
|
|
|
|
|
2019-04-13 08:08:56 +03:00
|
|
|
function deleteMember(options) {
|
|
|
|
options = options || {};
|
|
|
|
return models.Member.destroy(options).catch(models.Member.NotFoundError, () => {
|
|
|
|
throw new common.errors.NotFoundError({
|
|
|
|
message: common.i18n.t('errors.api.resource.resourceNotFound', {
|
|
|
|
resource: 'Member'
|
|
|
|
})
|
|
|
|
});
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2019-01-30 14:36:09 +03:00
|
|
|
function listMembers(options) {
|
|
|
|
return models.Member.findPage(options).then((models) => {
|
|
|
|
return {
|
|
|
|
members: models.data.map(model => model.toJSON(options)),
|
|
|
|
meta: models.meta
|
|
|
|
};
|
2018-12-11 10:57:01 +03:00
|
|
|
});
|
|
|
|
}
|
|
|
|
|
2019-07-04 08:05:56 +03:00
|
|
|
const getApiUrl = ({version, type}) => {
|
2019-09-03 07:39:00 +03:00
|
|
|
const {href} = new URL(
|
2019-07-04 08:05:56 +03:00
|
|
|
urlUtils.getApiPath({version, type}),
|
|
|
|
urlUtils.urlFor('admin', true)
|
|
|
|
);
|
|
|
|
return href;
|
|
|
|
};
|
|
|
|
|
2019-09-03 07:39:00 +03:00
|
|
|
const siteUrl = urlUtils.getSiteUrl();
|
2019-09-17 11:15:39 +03:00
|
|
|
const membersApiUrl = getApiUrl({version: 'v3', type: 'members'});
|
Updated theme layer to use members-ssr (#10676)
* Removed support for cookies in members auth middleware
no-issue
The members middleware will no longer be supporting cookies, the cookie
will be handled by a new middleware specific for serverside rendering,
more informations can be found here:
https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5
* Removed members auth middleware from site app
no-issue
The site app no longer needs the members auth middleware as it doesn't
support cookies, and will be replaced by ssr specific middleware.
https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5
* Added comment for session_secret setting
no-issue
We are going to have multiple concepts of sessions, so adding a comment
here to be specific that this is for the Ghost Admin client
* Added theme_session_secret setting dynamic default
no-issue
Sessions for the theme layer will be signed, so we generate a random hex
string to use as a signing key
* Added getPublicConfig method
* Replaced export of httpHandler with POJO apiInstance
no-issue
This is mainly to reduce the public api, so it's easier to document.
* Renamed memberUserObject -> members
no-issue
Simplifies the interface, and is more inline with what we would want to export as an api library.
* Removed use of require options inside members
no-issue
This was too tight of a coupling between Ghost and Members
* Simplified apiInstance definition
no-issue
* Added getMember method to members api
* Added MembersSSR instance to members service
* Wired up routes for members ssr
* Updated members auth middleware to use getPublicConfig
* Removed publicKey static export from members service
* Used real session secret
no-issue
* Added DELETE /members/ssr handler
no-issue
This allows users to log out of the theme layer
* Fixed missing code property
no-issue
Ignition uses the statusCode property to forward status codes to call sites
* Removed superfluous error middleware
no-issue
Before we used generic JWT middleware which would reject, now the
middleware catches it's own error and doesn't error, thus this
middleware is unecessary.
* Removed console.logs
no-issue
* Updated token expirty to hardcoded 20 minutes
no-issue
This returns to our previous state of using short lived tokens, both for
security and simplicity.
* Removed hardcoded default member settings
no-issue
This is no longer needed, as defaults are in default-settings.json
* Removed stripe from default payment processor
no-issue
* Exported `getSiteUrl` method from url utils
no-issue
This keeps inline with newer naming conventions
* Updated how audience access control works
no-issue
Rather than being passed a function, members api now receives an object
which describes which origins have access to which audiences, and how
long those tokens should be allowed to work for. It also allows syntax
for default tokens where audience === origin requesting it. This can be
set to undefined or null to disable this functionality.
{
"http://site.com": {
"http://site.com": {
tokenLength: '5m'
},
"http://othersite.com": {
tokenLength: '1h'
}
},
"*": {
tokenLength: '30m'
}
}
* Updated members service to use access control feature
no-issue
This also cleans up a lot of unecessary variable definitions, and some
other minor cleanups.
* Added status code to auth pages html response
no-issue
This was missing, probably default but better to be explicit
* Updated gateway to have membersApiUrl from config
no-issue
Previously we were parsing the url, this was not very safe as we can
have Ghost hosted on a subdomain, and this would have failed.
* Added issuer to public config for members
no-issue
This can be used to request SSR tokens in the client
* Fixed path for gateway bundle
no-issue
* Updated settings model tests
no-issue
* Revert "Removed stripe from default payment processor"
This reverts commit 1d88d9b6d73a10091070bcc1b7f5779d071c7845.
* Revert "Removed hardcoded default member settings"
This reverts commit 9d899048ba7d4b272b9ac65a95a52af66b30914a.
* Installed @tryghost/members-ssr
* Fixed tests for settings model
2019-04-16 17:50:25 +03:00
|
|
|
|
2019-09-03 07:39:00 +03:00
|
|
|
const ghostMailer = new mail.GhostMailer();
|
2018-12-11 10:57:01 +03:00
|
|
|
|
2019-09-06 10:14:21 +03:00
|
|
|
function getStripePaymentConfig() {
|
|
|
|
const subscriptionSettings = settingsCache.get('members_subscription_settings');
|
|
|
|
|
|
|
|
const stripePaymentProcessor = subscriptionSettings.paymentProcessors.find(
|
|
|
|
paymentProcessor => paymentProcessor.adapter === 'stripe'
|
|
|
|
);
|
|
|
|
|
|
|
|
if (!stripePaymentProcessor || !stripePaymentProcessor.config) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
2019-10-09 07:53:58 +03:00
|
|
|
if (!stripePaymentProcessor.config.public_token || !stripePaymentProcessor.config.secret_token) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
2019-09-25 10:21:38 +03:00
|
|
|
const webhookHandlerUrl = new URL('/members/webhooks/stripe', siteUrl);
|
|
|
|
|
2019-10-03 11:34:47 +03:00
|
|
|
const checkoutSuccessUrl = new URL(siteUrl);
|
|
|
|
checkoutSuccessUrl.searchParams.set('stripe', 'success');
|
|
|
|
const checkoutCancelUrl = new URL(siteUrl);
|
|
|
|
checkoutCancelUrl.searchParams.set('stripe', 'cancel');
|
|
|
|
|
2019-09-06 10:14:21 +03:00
|
|
|
return {
|
|
|
|
publicKey: stripePaymentProcessor.config.public_token,
|
|
|
|
secretKey: stripePaymentProcessor.config.secret_token,
|
2019-10-03 11:34:47 +03:00
|
|
|
checkoutSuccessUrl: checkoutSuccessUrl.href,
|
|
|
|
checkoutCancelUrl: checkoutCancelUrl.href,
|
2019-09-25 10:21:38 +03:00
|
|
|
webhookHandlerUrl: webhookHandlerUrl.href,
|
2019-09-06 10:14:21 +03:00
|
|
|
product: stripePaymentProcessor.config.product,
|
2019-09-25 07:42:30 +03:00
|
|
|
plans: stripePaymentProcessor.config.plans,
|
|
|
|
appInfo: {
|
|
|
|
name: 'Ghost',
|
2019-10-01 07:01:16 +03:00
|
|
|
partner_id: 'pp_partner_DKmRVtTs4j9pwZ',
|
2019-09-25 07:42:30 +03:00
|
|
|
version: ghostVersion.original,
|
|
|
|
url: 'https://ghost.org/'
|
|
|
|
}
|
2019-09-06 10:14:21 +03:00
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2019-10-10 13:31:38 +03:00
|
|
|
function getAuthSecret() {
|
|
|
|
const hexSecret = settingsCache.get('members_email_auth_secret');
|
|
|
|
if (!hexSecret) {
|
|
|
|
common.logging.warn('Could not find members_email_auth_secret, using dynamically generated secret');
|
|
|
|
return crypto.randomBytes(64);
|
|
|
|
}
|
|
|
|
const secret = Buffer.from(hexSecret, 'hex');
|
|
|
|
if (secret.length < 64) {
|
|
|
|
common.logging.warn('members_email_auth_secret not large enough (64 bytes), using dynamically generated secret');
|
|
|
|
return crypto.randomBytes(64);
|
|
|
|
}
|
|
|
|
return secret;
|
|
|
|
}
|
|
|
|
|
2019-10-11 08:16:57 +03:00
|
|
|
function getAllowSelfSignup() {
|
2019-10-08 19:30:46 +03:00
|
|
|
const subscriptionSettings = settingsCache.get('members_subscription_settings');
|
2019-10-11 11:38:31 +03:00
|
|
|
return subscriptionSettings.allowSelfSignup;
|
2019-10-08 19:30:46 +03:00
|
|
|
}
|
|
|
|
|
2019-10-11 07:21:53 +03:00
|
|
|
// NOTE: the function is an exact duplicate of one in GhostMailer should be extracted
|
|
|
|
// into a common lib once it needs to be reused anywhere else again
|
|
|
|
function getDomain() {
|
|
|
|
const domain = urlUtils.urlFor('home', true).match(new RegExp('^https?://([^/:?#]+)(?:[/:?#]|$)', 'i'));
|
|
|
|
return domain && domain[1];
|
2019-10-08 19:30:46 +03:00
|
|
|
}
|
|
|
|
|
2019-07-18 10:37:11 +03:00
|
|
|
module.exports = createApiInstance;
|
|
|
|
|
|
|
|
function createApiInstance() {
|
|
|
|
const membersApiInstance = MembersApi({
|
2019-09-03 07:39:00 +03:00
|
|
|
tokenConfig: {
|
2019-07-18 10:37:11 +03:00
|
|
|
issuer: membersApiUrl,
|
|
|
|
publicKey: settingsCache.get('members_public_key'),
|
2019-09-03 07:39:00 +03:00
|
|
|
privateKey: settingsCache.get('members_private_key')
|
|
|
|
},
|
|
|
|
auth: {
|
2019-10-01 10:53:23 +03:00
|
|
|
getSigninURL(token, type) {
|
2019-09-03 07:39:00 +03:00
|
|
|
const signinURL = new URL(siteUrl);
|
|
|
|
signinURL.searchParams.set('token', token);
|
2019-10-01 10:53:23 +03:00
|
|
|
signinURL.searchParams.set('action', type);
|
2019-09-03 07:39:00 +03:00
|
|
|
return signinURL.href;
|
2019-10-08 19:30:46 +03:00
|
|
|
},
|
2019-10-11 08:16:57 +03:00
|
|
|
allowSelfSignup: getAllowSelfSignup(),
|
2019-10-10 13:31:38 +03:00
|
|
|
secret: getAuthSecret()
|
2019-07-18 10:37:11 +03:00
|
|
|
},
|
2019-09-03 07:39:00 +03:00
|
|
|
mail: {
|
|
|
|
transporter: {
|
|
|
|
sendMail(message) {
|
2019-09-16 04:33:38 +03:00
|
|
|
if (process.env.NODE_ENV !== 'production') {
|
|
|
|
common.logging.warn(message.text);
|
|
|
|
}
|
2019-10-10 16:25:48 +03:00
|
|
|
let msg = Object.assign({
|
|
|
|
subject: 'Signin',
|
|
|
|
forceTextContent: true
|
|
|
|
}, message);
|
2019-10-11 07:21:53 +03:00
|
|
|
const subscriptionSettings = settingsCache.get('members_subscription_settings');
|
|
|
|
|
|
|
|
if (subscriptionSettings && subscriptionSettings.fromAddress) {
|
|
|
|
let from = `${subscriptionSettings.fromAddress}@${getDomain()}`;
|
|
|
|
msg = Object.assign({from: from}, msg);
|
|
|
|
}
|
|
|
|
|
|
|
|
return ghostMailer.send(msg);
|
2019-09-03 07:39:00 +03:00
|
|
|
}
|
2019-10-01 10:53:23 +03:00
|
|
|
},
|
2019-10-10 16:26:18 +03:00
|
|
|
getSubject(type) {
|
|
|
|
const siteTitle = settingsCache.get('title');
|
2019-10-01 10:53:23 +03:00
|
|
|
switch (type) {
|
|
|
|
case 'subscribe':
|
2019-10-10 16:26:18 +03:00
|
|
|
return `📫 Confirm your subscription to ${siteTitle}`;
|
2019-10-01 10:53:23 +03:00
|
|
|
case 'signup':
|
2019-10-10 16:26:18 +03:00
|
|
|
return `🙌 Complete your sign up to ${siteTitle}!`;
|
2019-10-01 10:53:23 +03:00
|
|
|
case 'signin':
|
|
|
|
default:
|
2019-10-10 16:26:18 +03:00
|
|
|
return `🔑 Secure sign in link for ${siteTitle}`;
|
|
|
|
}
|
|
|
|
},
|
2019-10-10 16:43:30 +03:00
|
|
|
getText(url, type, email) {
|
|
|
|
const siteTitle = settingsCache.get('title');
|
2019-10-01 10:53:23 +03:00
|
|
|
switch (type) {
|
|
|
|
case 'subscribe':
|
2019-10-10 16:43:30 +03:00
|
|
|
return `
|
|
|
|
Hey there,
|
|
|
|
|
|
|
|
You're one tap away from subscribing to ${siteTitle} — please confirm your email address with this link:
|
|
|
|
|
|
|
|
${url}
|
|
|
|
|
|
|
|
For your security, the link will expire in 10 minutes time.
|
|
|
|
|
|
|
|
All the best!
|
|
|
|
The team at ${siteTitle}
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
Sent to ${email}
|
|
|
|
If you did not make this request, you can simply delete this message. You will not be subscribed.
|
|
|
|
`;
|
2019-10-01 10:53:23 +03:00
|
|
|
case 'signup':
|
2019-10-10 16:43:30 +03:00
|
|
|
return `
|
|
|
|
Hey there!
|
|
|
|
|
|
|
|
Thanks for signing up for ${siteTitle} — use this link to complete the sign up process and be automatically signed in:
|
|
|
|
|
|
|
|
${url}
|
|
|
|
|
|
|
|
For your security, the link will expire in 10 minutes time.
|
|
|
|
|
|
|
|
See you soon!
|
|
|
|
The team at ${siteTitle}
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
Sent to ${email}
|
|
|
|
If you did not make this request, you can simply delete this message. You will not be signed up, and no account will be created for you.
|
|
|
|
`;
|
2019-10-01 10:53:23 +03:00
|
|
|
case 'signin':
|
|
|
|
default:
|
2019-10-10 16:43:30 +03:00
|
|
|
return `
|
|
|
|
Hey there,
|
|
|
|
|
|
|
|
Welcome back! Use this link to securely sign in to your ${siteTitle} account:
|
|
|
|
|
|
|
|
${url}
|
|
|
|
|
|
|
|
For your security, the link will expire in 10 minutes time.
|
|
|
|
|
|
|
|
See you soon!
|
|
|
|
The team at ${siteTitle}
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
Sent to ${email}
|
|
|
|
If you did not make this request, you can safely ignore this email.
|
|
|
|
`;
|
2019-10-01 10:53:23 +03:00
|
|
|
}
|
|
|
|
},
|
2019-10-10 16:28:20 +03:00
|
|
|
getHTML(url, type, email) {
|
|
|
|
const siteTitle = settingsCache.get('title');
|
2019-10-01 10:53:23 +03:00
|
|
|
switch (type) {
|
|
|
|
case 'subscribe':
|
2019-10-10 16:28:20 +03:00
|
|
|
return subscribeEmail({url, email, siteTitle});
|
2019-10-01 10:53:23 +03:00
|
|
|
case 'signup':
|
2019-10-10 16:28:20 +03:00
|
|
|
return signupEmail({url, email, siteTitle});
|
2019-10-01 10:53:23 +03:00
|
|
|
case 'signin':
|
|
|
|
default:
|
2019-10-10 16:28:20 +03:00
|
|
|
return signinEmail({url, email, siteTitle});
|
2019-10-01 10:53:23 +03:00
|
|
|
}
|
2019-09-03 07:39:00 +03:00
|
|
|
}
|
Updated theme layer to use members-ssr (#10676)
* Removed support for cookies in members auth middleware
no-issue
The members middleware will no longer be supporting cookies, the cookie
will be handled by a new middleware specific for serverside rendering,
more informations can be found here:
https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5
* Removed members auth middleware from site app
no-issue
The site app no longer needs the members auth middleware as it doesn't
support cookies, and will be replaced by ssr specific middleware.
https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5
* Added comment for session_secret setting
no-issue
We are going to have multiple concepts of sessions, so adding a comment
here to be specific that this is for the Ghost Admin client
* Added theme_session_secret setting dynamic default
no-issue
Sessions for the theme layer will be signed, so we generate a random hex
string to use as a signing key
* Added getPublicConfig method
* Replaced export of httpHandler with POJO apiInstance
no-issue
This is mainly to reduce the public api, so it's easier to document.
* Renamed memberUserObject -> members
no-issue
Simplifies the interface, and is more inline with what we would want to export as an api library.
* Removed use of require options inside members
no-issue
This was too tight of a coupling between Ghost and Members
* Simplified apiInstance definition
no-issue
* Added getMember method to members api
* Added MembersSSR instance to members service
* Wired up routes for members ssr
* Updated members auth middleware to use getPublicConfig
* Removed publicKey static export from members service
* Used real session secret
no-issue
* Added DELETE /members/ssr handler
no-issue
This allows users to log out of the theme layer
* Fixed missing code property
no-issue
Ignition uses the statusCode property to forward status codes to call sites
* Removed superfluous error middleware
no-issue
Before we used generic JWT middleware which would reject, now the
middleware catches it's own error and doesn't error, thus this
middleware is unecessary.
* Removed console.logs
no-issue
* Updated token expirty to hardcoded 20 minutes
no-issue
This returns to our previous state of using short lived tokens, both for
security and simplicity.
* Removed hardcoded default member settings
no-issue
This is no longer needed, as defaults are in default-settings.json
* Removed stripe from default payment processor
no-issue
* Exported `getSiteUrl` method from url utils
no-issue
This keeps inline with newer naming conventions
* Updated how audience access control works
no-issue
Rather than being passed a function, members api now receives an object
which describes which origins have access to which audiences, and how
long those tokens should be allowed to work for. It also allows syntax
for default tokens where audience === origin requesting it. This can be
set to undefined or null to disable this functionality.
{
"http://site.com": {
"http://site.com": {
tokenLength: '5m'
},
"http://othersite.com": {
tokenLength: '1h'
}
},
"*": {
tokenLength: '30m'
}
}
* Updated members service to use access control feature
no-issue
This also cleans up a lot of unecessary variable definitions, and some
other minor cleanups.
* Added status code to auth pages html response
no-issue
This was missing, probably default but better to be explicit
* Updated gateway to have membersApiUrl from config
no-issue
Previously we were parsing the url, this was not very safe as we can
have Ghost hosted on a subdomain, and this would have failed.
* Added issuer to public config for members
no-issue
This can be used to request SSR tokens in the client
* Fixed path for gateway bundle
no-issue
* Updated settings model tests
no-issue
* Revert "Removed stripe from default payment processor"
This reverts commit 1d88d9b6d73a10091070bcc1b7f5779d071c7845.
* Revert "Removed hardcoded default member settings"
This reverts commit 9d899048ba7d4b272b9ac65a95a52af66b30914a.
* Installed @tryghost/members-ssr
* Fixed tests for settings model
2019-04-16 17:50:25 +03:00
|
|
|
},
|
2019-09-06 10:14:21 +03:00
|
|
|
paymentConfig: {
|
|
|
|
stripe: getStripePaymentConfig()
|
|
|
|
},
|
2019-10-08 12:32:26 +03:00
|
|
|
setMetadata,
|
|
|
|
getMetadata,
|
2019-07-18 10:37:11 +03:00
|
|
|
createMember,
|
2019-10-02 11:19:11 +03:00
|
|
|
updateMember,
|
2019-07-18 10:37:11 +03:00
|
|
|
getMember,
|
|
|
|
deleteMember,
|
2019-10-02 09:55:12 +03:00
|
|
|
listMembers,
|
|
|
|
logger: common.logging
|
Updated theme layer to use members-ssr (#10676)
* Removed support for cookies in members auth middleware
no-issue
The members middleware will no longer be supporting cookies, the cookie
will be handled by a new middleware specific for serverside rendering,
more informations can be found here:
https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5
* Removed members auth middleware from site app
no-issue
The site app no longer needs the members auth middleware as it doesn't
support cookies, and will be replaced by ssr specific middleware.
https://paper.dropbox.com/doc/Members-Auth-II-4WP4vF6coMqDYbSMIajo5
* Added comment for session_secret setting
no-issue
We are going to have multiple concepts of sessions, so adding a comment
here to be specific that this is for the Ghost Admin client
* Added theme_session_secret setting dynamic default
no-issue
Sessions for the theme layer will be signed, so we generate a random hex
string to use as a signing key
* Added getPublicConfig method
* Replaced export of httpHandler with POJO apiInstance
no-issue
This is mainly to reduce the public api, so it's easier to document.
* Renamed memberUserObject -> members
no-issue
Simplifies the interface, and is more inline with what we would want to export as an api library.
* Removed use of require options inside members
no-issue
This was too tight of a coupling between Ghost and Members
* Simplified apiInstance definition
no-issue
* Added getMember method to members api
* Added MembersSSR instance to members service
* Wired up routes for members ssr
* Updated members auth middleware to use getPublicConfig
* Removed publicKey static export from members service
* Used real session secret
no-issue
* Added DELETE /members/ssr handler
no-issue
This allows users to log out of the theme layer
* Fixed missing code property
no-issue
Ignition uses the statusCode property to forward status codes to call sites
* Removed superfluous error middleware
no-issue
Before we used generic JWT middleware which would reject, now the
middleware catches it's own error and doesn't error, thus this
middleware is unecessary.
* Removed console.logs
no-issue
* Updated token expirty to hardcoded 20 minutes
no-issue
This returns to our previous state of using short lived tokens, both for
security and simplicity.
* Removed hardcoded default member settings
no-issue
This is no longer needed, as defaults are in default-settings.json
* Removed stripe from default payment processor
no-issue
* Exported `getSiteUrl` method from url utils
no-issue
This keeps inline with newer naming conventions
* Updated how audience access control works
no-issue
Rather than being passed a function, members api now receives an object
which describes which origins have access to which audiences, and how
long those tokens should be allowed to work for. It also allows syntax
for default tokens where audience === origin requesting it. This can be
set to undefined or null to disable this functionality.
{
"http://site.com": {
"http://site.com": {
tokenLength: '5m'
},
"http://othersite.com": {
tokenLength: '1h'
}
},
"*": {
tokenLength: '30m'
}
}
* Updated members service to use access control feature
no-issue
This also cleans up a lot of unecessary variable definitions, and some
other minor cleanups.
* Added status code to auth pages html response
no-issue
This was missing, probably default but better to be explicit
* Updated gateway to have membersApiUrl from config
no-issue
Previously we were parsing the url, this was not very safe as we can
have Ghost hosted on a subdomain, and this would have failed.
* Added issuer to public config for members
no-issue
This can be used to request SSR tokens in the client
* Fixed path for gateway bundle
no-issue
* Updated settings model tests
no-issue
* Revert "Removed stripe from default payment processor"
This reverts commit 1d88d9b6d73a10091070bcc1b7f5779d071c7845.
* Revert "Removed hardcoded default member settings"
This reverts commit 9d899048ba7d4b272b9ac65a95a52af66b30914a.
* Installed @tryghost/members-ssr
* Fixed tests for settings model
2019-04-16 17:50:25 +03:00
|
|
|
});
|
2019-02-26 06:09:16 +03:00
|
|
|
|
2019-07-18 10:37:11 +03:00
|
|
|
return membersApiInstance;
|
|
|
|
}
|