Updated var declarations to const/let and no lists

- All var declarations are now const or let as per ES6
- All comma-separated lists / chained declarations are now one declaration per line
- This is for clarity/readability but also made running the var-to-const/let switch smoother
- ESLint rules updated to match

How this was done:

- npm install -g jscodeshift
- git clone https://github.com/cpojer/js-codemod.git
- git clone git@github.com:TryGhost/Ghost.git shallow-ghost
- cd shallow-ghost
- jscodeshift -t ../js-codemod/transforms/unchain-variables.js . -v=2
- jscodeshift -t ../js-codemod/transforms/no-vars.js . -v=2
- yarn
- yarn test
- yarn lint / fix various lint errors (almost all indent) by opening files and saving in vscode
- grunt test-regression
- sorted!

ghost/security/lib/identifier.js

@@ -13,10 +13,10 @@ _private.getRandomInt = function (min, max) {
  * @api private
  */
 module.exports.uid = function uid(maxLength) {
-    var buf = [],
+    const buf = [];
-        chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-        charLength = chars.length,
+    const charLength = chars.length;
-        i;
+    let i;
 
     for (i = 0; i < maxLength; i = i + 1) {
         buf.push(chars[_private.getRandomInt(0, charLength - 1)]);

ghost/security/lib/password.js

@@ -1,9 +1,9 @@
 const Promise = require('bluebird');
 
 module.exports.hash = function hash(plainPassword) {
-    const bcrypt = require('bcryptjs'),
+    const bcrypt = require('bcryptjs');
-        bcryptGenSalt = Promise.promisify(bcrypt.genSalt),
+    const bcryptGenSalt = Promise.promisify(bcrypt.genSalt);
-        bcryptHash = Promise.promisify(bcrypt.hash);
+    const bcryptHash = Promise.promisify(bcrypt.hash);
 
     return bcryptGenSalt().then(function (salt) {
         return bcryptHash(plainPassword, salt);
@@ -11,8 +11,8 @@ module.exports.hash = function hash(plainPassword) {
 };
 
 module.exports.compare = function compare(plainPassword, hashedPassword) {
-    const bcrypt = require('bcryptjs'),
+    const bcrypt = require('bcryptjs');
-        bcryptCompare = Promise.promisify(bcrypt.compare);
+    const bcryptCompare = Promise.promisify(bcrypt.compare);
 
     return bcryptCompare(plainPassword, hashedPassword);
 };

ghost/security/lib/tokens.js

@@ -3,8 +3,8 @@ const crypto = require('crypto');
 module.exports.generateFromContent = function generateFromContent(options) {
     options = options || {};
 
-    const hash = crypto.createHash('sha256'),
+    const hash = crypto.createHash('sha256');
-        content = options.content;
+    const content = options.content;
 
     let text = '';
 
@@ -17,10 +17,10 @@ module.exports.generateFromContent = function generateFromContent(options) {
 module.exports.generateFromEmail = function generateFromEmail(options) {
     options = options || {};
 
-    const hash = crypto.createHash('sha256'),
+    const hash = crypto.createHash('sha256');
-        expires = options.expires,
+    const expires = options.expires;
-        email = options.email,
+    const email = options.email;
-        secret = options.secret;
+    const secret = options.secret;
 
     let text = '';
 
@@ -36,12 +36,12 @@ module.exports.resetToken = {
     generateHash: function generateHash(options) {
         options = options || {};
 
-        var hash = crypto.createHash('sha256'),
+        const hash = crypto.createHash('sha256');
-            expires = options.expires,
+        const expires = options.expires;
-            email = options.email,
+        const email = options.email;
-            dbHash = options.dbHash,
+        const dbHash = options.dbHash;
-            password = options.password,
+        const password = options.password;
-            text = '';
+        let text = '';
 
         hash.update(String(expires));
         hash.update(email.toLocaleLowerCase());
@@ -54,11 +54,11 @@ module.exports.resetToken = {
     extract: function extract(options) {
         options = options || {};
 
-        var token = options.token,
+        const token = options.token;
-            tokenText = Buffer.from(token, 'base64').toString('ascii'),
+        const tokenText = Buffer.from(token, 'base64').toString('ascii');
-            parts,
+        let parts;
-            expires,
+        let expires;
-            email;
+        let email;
 
         parts = tokenText.split('|');
 
@@ -78,13 +78,13 @@ module.exports.resetToken = {
     compare: function compare(options) {
         options = options || {};
 
-        var tokenToCompare = options.token,
+        const tokenToCompare = options.token;
-            parts = exports.resetToken.extract({token: tokenToCompare}),
+        const parts = exports.resetToken.extract({token: tokenToCompare});
-            dbHash = options.dbHash,
+        const dbHash = options.dbHash;
-            password = options.password,
+        const password = options.password;
-            generatedToken,
+        let generatedToken;
-            diff = 0,
+        let diff = 0;
-            i;
+        let i;
 
         if (isNaN(parts.expires)) {
             return false;

ghost/security/test/password_spec.js

@@ -1,5 +1,5 @@
-const should = require('should'),
+const should = require('should');
-    security = require('../../../../core/server/lib/security');
+const security = require('../../../../core/server/lib/security');
 
 describe('Lib: Security - Password', function () {
     it('hash plain password', function () {

ghost/security/test/string_spec.js

@@ -1,92 +1,92 @@
-var should = require('should'),
+const should = require('should');
-    security = require('../../../../core/server/lib/security');
+const security = require('../../../../core/server/lib/security');
 
 describe('Lib: Security - String', function () {
     describe('Safe String', function () {
-        var options = {};
+        const options = {};
 
         it('should remove beginning and ending whitespace', function () {
-            var result = security.string.safe(' stringwithspace ', options);
+            const result = security.string.safe(' stringwithspace ', options);
             result.should.equal('stringwithspace');
         });
 
         it('can handle null strings', function () {
-            var result = security.string.safe(null);
+            const result = security.string.safe(null);
             result.should.equal('');
         });
 
         it('should remove non ascii characters', function () {
-            var result = security.string.safe('howtowin✓', options);
+            const result = security.string.safe('howtowin✓', options);
             result.should.equal('howtowin');
         });
 
         it('should replace spaces with dashes', function () {
-            var result = security.string.safe('how to win', options);
+            const result = security.string.safe('how to win', options);
             result.should.equal('how-to-win');
         });
 
         it('should replace most special characters with dashes', function () {
-            var result = security.string.safe('a:b/c?d#e[f]g!h$i&j(k)l*m+n,o;{p}=q\\r%s<t>u|v^w~x£y"z@1.2`3', options);
+            const result = security.string.safe('a:b/c?d#e[f]g!h$i&j(k)l*m+n,o;{p}=q\\r%s<t>u|v^w~x£y"z@1.2`3', options);
             result.should.equal('a-b-c-d-e-f-g-h-i-j-k-l-m-n-o-p-q-r-s-t-u-v-w-x-y-z-1-2-3');
         });
 
         it('should replace all of the html4 compat symbols in ascii except hyphen and underscore', function () {
             // note: This is missing the soft-hyphen char that isn't much-liked by linters/browsers/etc,
             // it passed the test before it was removed
-            var result = security.string.safe('!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿');
+            const result = security.string.safe('!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿');
             result.should.equal('_-c-y-ss-c-a-r-deg-23up-1o-1-41-23-4');
         });
 
         it('should replace all of the foreign chars in ascii', function () {
-            var result = security.string.safe('ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ');
+            const result = security.string.safe('ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ');
             result.should.equal('aaaaaaaeceeeeiiiidnoooooxouuuuuthssaaaaaaaeceeeeiiiidnooooo-ouuuuythy');
         });
 
         it('should remove special characters at the beginning of a string', function () {
-            var result = security.string.safe('.Not special', options);
+            const result = security.string.safe('.Not special', options);
             result.should.equal('not-special');
         });
 
         it('should remove apostrophes ', function () {
-            var result = security.string.safe('how we shouldn\'t be', options);
+            const result = security.string.safe('how we shouldn\'t be', options);
             result.should.equal('how-we-shouldnt-be');
         });
 
         it('should convert to lowercase', function () {
-            var result = security.string.safe('This has Upper Case', options);
+            const result = security.string.safe('This has Upper Case', options);
             result.should.equal('this-has-upper-case');
         });
 
         it('should convert multiple dashes into a single dash', function () {
-            var result = security.string.safe('This :) means everything', options);
+            const result = security.string.safe('This :) means everything', options);
             result.should.equal('this-means-everything');
         });
 
         it('should remove trailing dashes from the result', function () {
-            var result = security.string.safe('This.', options);
+            const result = security.string.safe('This.', options);
             result.should.equal('this');
         });
 
         it('should handle pound signs', function () {
-            var result = security.string.safe('WHOOPS! I spent all my £ again!', options);
+            const result = security.string.safe('WHOOPS! I spent all my £ again!', options);
             result.should.equal('whoops-i-spent-all-my-again');
         });
 
         it('should properly handle unicode punctuation conversion', function () {
-            var result = security.string.safe('に間違いがないか、再度確認してください。再読み込みしてください。', options);
+            const result = security.string.safe('に間違いがないか、再度確認してください。再読み込みしてください。', options);
             result.should.equal('nijian-wei-iganaika-zai-du-que-ren-sitekudasai-zai-du-miip-misitekudasai');
         });
 
         it('should not lose or convert dashes if options are passed with truthy importing flag', function () {
-            var result,
+            let result;
-                options = {importing: true};
+            const options = {importing: true};
             result = security.string.safe('-slug-with-starting-ending-and---multiple-dashes-', options);
             result.should.equal('-slug-with-starting-ending-and---multiple-dashes-');
         });
 
         it('should still remove/convert invalid characters when passed options with truthy importing flag', function () {
-            var result,
+            let result;
-                options = {importing: true};
+            const options = {importing: true};
             result = security.string.safe('-slug-&with-✓-invalid-characters-に\'', options);
             result.should.equal('-slug--with--invalid-characters-ni');
         });

ghost/security/test/tokens_spec.js

@@ -1,11 +1,12 @@
-var should = require('should'),
+const should = require('should');
-    uuid = require('uuid'),
+const uuid = require('uuid');
-    security = require('../../../../core/server/lib/security');
+const security = require('../../../../core/server/lib/security');
 
 describe('Utils: tokens', function () {
     it('generate', function () {
-        var expires = Date.now() + 60 * 1000,
+        const expires = Date.now() + 60 * 1000;
-            dbHash = uuid.v4(), token;
+        const dbHash = uuid.v4();
+        let token;
 
         token = security.tokens.resetToken.generateHash({
             email: 'test1@ghost.org',
@@ -19,8 +20,10 @@ describe('Utils: tokens', function () {
     });
 
     it('compare: success', function () {
-        var expires = Date.now() + 60 * 1000,
+        const expires = Date.now() + 60 * 1000;
-            dbHash = uuid.v4(), token, tokenIsCorrect;
+        const dbHash = uuid.v4();
+        let token;
+        let tokenIsCorrect;
 
         token = security.tokens.resetToken.generateHash({
             email: 'test1@ghost.org',
@@ -39,8 +42,10 @@ describe('Utils: tokens', function () {
     });
 
     it('compare: error', function () {
-        var expires = Date.now() + 60 * 1000,
+        const expires = Date.now() + 60 * 1000;
-            dbHash = uuid.v4(), token, tokenIsCorrect;
+        const dbHash = uuid.v4();
+        let token;
+        let tokenIsCorrect;
 
         token = security.tokens.resetToken.generateHash({
             email: 'test1@ghost.org',
@@ -59,8 +64,11 @@ describe('Utils: tokens', function () {
     });
 
     it('extract', function () {
-        var expires = Date.now() + 60 * 1000,
+        const expires = Date.now() + 60 * 1000;
-            dbHash = uuid.v4(), token, parts, email = 'test1@ghost.org';
+        const dbHash = uuid.v4();
+        let token;
+        let parts;
+        const email = 'test1@ghost.org';
 
         token = security.tokens.resetToken.generateHash({
             email: email,
@@ -80,8 +88,11 @@ describe('Utils: tokens', function () {
     });
 
     it('extract', function () {
-        var expires = Date.now() + 60 * 1000,
+        const expires = Date.now() + 60 * 1000;
-            dbHash = uuid.v4(), token, parts, email = 'test3@ghost.org';
+        const dbHash = uuid.v4();
+        let token;
+        let parts;
+        const email = 'test3@ghost.org';
 
         token = security.tokens.resetToken.generateHash({
             email: email,
@@ -101,9 +112,12 @@ describe('Utils: tokens', function () {
     });
 
     it('can validate an URI encoded reset token', function () {
-        var expires = Date.now() + 60 * 1000,
+        const expires = Date.now() + 60 * 1000;
-            email = 'test1@ghost.org',
+        const email = 'test1@ghost.org';
-            dbHash = uuid.v4(), token, tokenIsCorrect, parts;
+        const dbHash = uuid.v4();
+        let token;
+        let tokenIsCorrect;
+        let parts;
 
         token = security.tokens.resetToken.generateHash({
             email: email,