Commit Graph

20227 Commits

Author SHA1 Message Date
Kevin Ansfield
2fd9116499
🐛 Fixed unwanted extra blank paragraphs when copy/pasting from Google Docs (#20505)
closes https://linear.app/tryghost/issue/ENG-1255

- updated Koenig packages including:
  - addition of `/preview` for public preview card
  - fix for HTML import from Google Docs
  - fix for embed thumbnails being cut off in email
  - fix for wide image card width on medium screens
- multiple fixes for unhandled (but non user-visible) errors causing noise in console and error logging
2024-07-01 21:14:07 +01:00
Steve Larson
3d9d552271
Improved performance in Admin Posts view (#20503)
ref https://linear.app/tryghost/issue/ONC-111
- changed posts fetching/display behavior to be client-side instead of server-side
- admin will issue (potentially multiple) requests based on the desired status(es)
- updated admin acceptance test for missing coverage

I've pulled the sort from the database query as this triple sort
performs very poorly at scale (taking ~4s+ past ~20k posts sometimes).
Instead, we now split up the fetch to grab only one status at a time and
use the front-end logic to handle displaying scheduled, then drafts,
then published. This should result in a much more responsive view.

We will separately change the default sort on the Admin API as that was the ultimate intent for this change.
2024-07-01 19:43:41 +00:00
Sag
7f963e9c2a
🎨 Added 'Changed email address' event to Member Activity (#20493)
fixes https://linear.app/tryghost/issue/ENG-1256

- when a member changes their email address, surface it in Member
Activity
2024-07-01 15:33:33 +00:00
Michael Barrett
c285b0a0f1
🔒 Added timestamp to webhook signature hash (#20500)
refs
[ENG-1238](https://linear.app/tryghost/issue/ENG-1238/🔒-webhook-signatures-dont-include-timestamp-in-the-signature)

Added timestamp to the webhook signature hash to prevent replay attacks.
This is
a breaking change for webhook consumers as signature verification logic
will need to be updated to account for the timestamp in the hash, for
example:

```js
const crypto = require('crypto');

// Webhook secret from Ghost Admin
const WEBHOOK_SECRET = 'FOOBARBAZ'

// Sample incoming webhook request object
const req = {
    headers: {
        'x-ghost-signature': 'sha256=fc9749d5b3333109bd779f65d4b1b891576bc5c92febea3b1d186a7f946d0745, t=1719842984367'
    },
    body: {
        tag: {
            current: {
                id: '6682b8a8e10cc04306284330',
                name: 'test',
                slug: 'test',
                description: null,
                feature_image: null,
                visibility: 'public',
                og_image: null,
                og_title: null,
                og_description: null,
                twitter_image: null,
                twitter_title: null,
                twitter_description: null,
                meta_title: null,
                meta_description: null,
                codeinjection_head: null,
                codeinjection_foot: null,
                canonical_url: null,
                accent_color: null,
                created_at: '2024-07-01T14:09:44.000Z',
                updated_at: '2024-07-01T14:09:44.000Z',
                url: 'http://localhost:2368/404/'
            },
            previous: {}
        }
    }
};

// Get the request body as a JSON string
const reqBodyJSON = JSON.stringify(req.body);

// Extract the hash and timestamp from the x-ghost-signature header
const {sha256: hash, t: timestamp} = req.headers['x-ghost-signature']
    .split(', ')
    .map((x) => x.split('='))
    .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})

// Recreate the hash using the secret, request body, and timestamp and compare it to the hash from the header
const isValid = crypto.createHmac('sha256', WEBHOOK_SECRET).update(`${reqBodyJSON}${timestamp}`).digest('hex') === hash

if (isValid) {
    console.log('Valid signature!')
}
```
2024-07-01 15:59:04 +01:00
Daniel Lockyer
fcb95ecc1a Switched faker to @faker-js/faker
- `faker` was the original dependency but the maintainer ended up
  deleting the repo, so development continued in `@faker-js/faker`
- we're already using that dependency, so we can make a few simple
  changes and remove the old dependency from our repo
2024-07-01 14:49:42 +02:00
Daniel Lockyer
60f37ed118 Fixed browser tests
refs 6378d7d66f

- the buttons have been renamed and split apart into separate ones
2024-07-01 14:49:20 +02:00
Daniel Lockyer
a146709c16 Cleaned up unused core dependencies
- analytics-node usage was removed a while back
- juice is used by a different package now
2024-07-01 13:56:31 +02:00
Sanne de Vries
95a4895e8f
Center aligned feature image in email template (#20491)
REF DES-380
- Center aligned feature image in email template
- Updated feature image css in editor to better display image overlay
and improve caption spacing
2024-07-01 08:43:26 +00:00
Daniel Lockyer
5f36bef451 Changed "commented" link in member feed to redirect to post
fix https://linear.app/tryghost/issue/ENG-1217/activity-log-link-for-comments-goes-to-wrong-place

- the post analytics page does not contain any comments, so it's not the
  most intuitive location to point the user. Instead, we can send them
  to the frontend of the post, where they can view comments
2024-07-01 10:15:46 +02:00
renovate[bot]
f561f362f4 Update dependency postcss to v8.4.39 2024-07-01 07:28:24 +02:00
renovate[bot]
41d8240d50 Update dependency mysql2 to v3.10.2 2024-07-01 02:07:18 +00:00
Ghost CI
0d60c74957 v5.87.0 2024-06-28 16:27:27 +00:00
Daniel Lockyer
34b903a12b Added browser autoplay error to Sentry ignore list
fix https://linear.app/tryghost/issue/SLO-179/notallowederror-the-request-is-not-allowed-by-the-user-agent-or-the

- this adds another browser error to the Sentry ignore list, as we don't
  have control over it, and it doesn't affect the user
2024-06-27 15:33:35 +02:00
renovate[bot]
430a2ca383 Update dependency testem to v3.15.0 2024-06-27 14:06:48 +02:00
Princi Vershwal
7bffe5b79a
Added option param to skip distinct from count query for members API
ref https://linear.app/tryghost/issue/SLO-173/removed-distinct-from-member-count-query

Performance of GET /members API can be improved by dropping the distinct from the total members count query.

select count(distinct members.id) as aggregate from `members`; // 275ms
select count(*) as aggregate from `members`; // 30ms

In this case we know that the result set will always be unique.
2024-06-27 17:35:19 +05:30
Daniel Lockyer
f9a6610823 Added AbortError to list of excluded errors
fix https://linear.app/tryghost/issue/SLO-175/error-aborterror-the-operation-was-aborted

- this error can occur when a user's browser navigates away mid-request,
  which causes the request to be aborted. However, we don't control
  this, nor do we particularly care, so we can just ignore it
2024-06-27 11:58:02 +02:00
Michael Barrett
ecf52d4685
Removed request queue enablement flag (#20466)
refs
[CFR-26](https://linear.app/tryghost/issue/CFR-26/remove-request-queue-config-flag)

Removed request queue enablement flag and updated the logic so that the
request queue is enabled when there is explicit configuration for it.
2024-06-27 09:30:07 +01:00
Daniel Lockyer
aa0110c842 Adjusted Sentry ignore list to cover more browser play errors
fix https://linear.app/tryghost/issue/SLO-172/error-aborterror-the-play-request-was-interrupted-because-the-media

- there are a few error messages we can ignore here, as browsers output
  slightly different messages for various types of these errors, which
  don't affect the user
2024-06-27 08:59:58 +02:00
Steve Larson
2e593ebcee
Improved performance fetching posts (#20460)
ref https://linear.app/tryghost/issue/ONC-111
- added composite index to posts_tags for post_id,tag_id for faster
lookup
- added composite index to posts for updated_at; this is commonly used
by get helpers on the front end to display data like the latest posts

In testing, this provided a very dramatic improvement for simple get
helper requests like 'filter="id:-{{post.id}}+tag:sampleTag" limit="3"'
which are by default sorted by updated_at desc. I'm not entirely clear
why when sorting by published_at we do not need a composite index - so
far it doesn't seem to be necessary. This should cover the primary cases
for get helpers - the latest posts with a given tag or set of tags.
2024-06-26 16:29:02 -05:00
renovate[bot]
dfc27b02c8
Update Koenig packages (#20453)
closes https://linear.app/tryghost/issue/MOM-247

- includes a few fixes for errors we've seen in our reporting
2024-06-26 14:48:17 +01:00
Daniel Lockyer
f250898a3b Optimized stats aggregation code for Admin dashboard
fix https://linear.app/tryghost/issue/SLO-168/rangeerror-maximum-call-stack-size-exceeded

- this code takes the API output and reduces it down to collect together
  stats per date
- the current code is recursive, and we've seen errors with the
  recursion hitting a `RangeError: Maximum call stack size exceeded`
  error
- as well as that, we're doing a lot of array concat'ing and cloning,
  which burns memory and CPU time
- instead, we can just use `.reduce`
- the new implementation is much faster than the existing one (1ms vs
  85ms) and uses no recursion, so those errors should go away
- I've also verified that the output is the same between the two
  functions
2024-06-26 15:46:39 +02:00
Daniel Lockyer
43bb83f7bb Extracted stats aggregation function to util
ref https://linear.app/tryghost/issue/SLO-168/rangeerror-maximum-call-stack-size-exceeded

- this extracts a function to a util so we can unit test it
- this function is about to be optimized but having unit tests allows us
  to make the change with confidence
2024-06-26 15:46:39 +02:00
Daniel Lockyer
019f417c7d Moved error exclusion to correct place
- adding it to ignoreErrors is better than beforeSend because it's built
  for this purpose and we've just looking at the error message
2024-06-26 12:43:55 +02:00
Daniel Lockyer
dd39576de0 Added more errors to Sentry exclusion list
fix https://linear.app/tryghost/issue/SLO-165/add-more-errors-to-allowlist

- we don't want to capture Sentry errors for these because they are out
  of our control (like the user's internet connection dropping out)
2024-06-26 12:43:55 +02:00
Sanne de Vries
e34c36007e
Updated frontend styles for bookmark card (#20468)
REF DES-263
- Added default white background color and sans-serif font to bookmark
card
2024-06-26 12:02:25 +02:00
Daniel Lockyer
5f5293cf6d Excluded errors caused by browser power-saving settings
fix https://linear.app/tryghost/issue/SLO-164/error-aborterror-the-play-request-was-interrupted-because-video-only

- in the case that the browser has power-saving settings enabled, we get
  an error in Sentry
- this error does not affect the user experience, so it should be safe
  to ignore
- this adds an exclusion to Sentry to ignore these errors
2024-06-26 11:49:42 +02:00
Daniel Lockyer
6c07b1cff9 Fixed TypeError when editor is focussed when not loaded
fix https://linear.app/tryghost/issue/SLO-162/typeerror-thiseditorapi-is-null

- if the editor does not load for some reason (network issue), and the
  editor area is clicked, we throw an error because we don't protect
  against a null `editorAPI`
- this adds that check
2024-06-26 11:49:42 +02:00
Ronald Langeveld
6099a14082
Fixed flaky admin test in Publish+Send Flow (#20463)
ref ONC-109

- Attempt to fix flaky Admin test, "Publish flow members enabled can
schedule publish+send"
- Adjusted the time calculation to the nearest minute to avoid
off-by-one minute errors
- Added `waitFor` to ensure elements are present and stable before
making assertions.
- Rounded the new scheduled date and time to the nearest minute to
maintain consistency
- Included extra `waitFor` and `settled` calls to allow time for UI
elements to fully load and reflect changes before assertions.
2024-06-26 16:05:51 +07:00
Sanne de Vries
df16fe1cf4
Added contentVisibility feature flag to FeatureService (#20465)
REF MOM-221
2024-06-26 08:37:01 +00:00
Sanne de Vries
03113313ce
🎨 Updated editor toolbar and action button designs (#20405)
REF https://linear.app/tryghost/issue/MOM-238

- Updated feature image action button styles
- Aligned button and tooltip styles with the rest of the editor
- Updated `koenig-lexical` version to pull in new toolbar design
2024-06-25 10:26:30 +00:00
renovate[bot]
68dcec143e Update dependency ember-auto-import to v2.7.4 2024-06-25 11:39:52 +02:00
Sag
516a2e1ff6
Reduced Sentry replays sample rate to 50% (#20458)
fixes https://linear.app/tryghost/issue/SLO-156
- we have reached our 10k replays per month quota in 20 days, by using a
100% error sampling rate
- we would need a sampling rate < 0.64% to stay under the quota
- from now on, we will be using a 50% error sampling rate to have a bit
of margin, and have a rounder number that is easier to reason about (1
out of 2 error sessions are recorded in Sentry)
2024-06-25 10:52:34 +02:00
Kevin Ansfield
21a2a8236e Added analytic events to internal linking feature
closes https://linear.app/tryghost/issue/MOM-77
closes https://linear.app/tryghost/issue/MOM-78

- bumps Koenig to support events
- adds `siteUrl` pass-through to Koenig to allow differentiation between internal and external URLs
2024-06-24 21:46:15 +01:00
Sag
725ebc3e9f
Fixed invalid tierId handling during member paid checkout (#20455)
- fixes https://linear.app/tryghost/issue/SLO-90
2024-06-24 15:33:39 +00:00
Steve Larson
b10b81b7d7
Prevented pages content api queries from returning mobiledoc or lexical fields (#20454)
ref https://linear.app/tryghost/issue/CFR-43/
ref 9d9a421

We recently stopped `select *` from posts when making Content API
requests. This is now being applied to the pages endpoint to help
improve performance. These fields were already being stripped out in the
output serializer, and they will now no longer be returned from the db
at all, reducing the amount of data transferred.
2024-06-24 15:17:45 +00:00
Sag
b9240271fe
Added config to hide labels from the signup card for contributors (#20429)
ref https://linear.app/tryghost/issue/SLO-127

- problem: contributors see an empty list of labels in the Signup card,
even if some exist
- cause: contributors do not have permission to browse labels
- solution: hide the label input entirely for contributors in the Signup
card, based on the new `renderLabels` config parameter
2024-06-24 14:14:09 +00:00
Steve Larson
4f6842b99a
Added composite index to posts table for type,status (#20437)
ref https://linear.app/tryghost/issue/CFR-35
- performance improvement intended for the content api/get helpers

The posts table is shared by posts and pages and seldom is queried for
both. It makes sense to add an index on type, and from the perspective
of the content API, also on status as you're almost only ever querying
for published posts or published pages.
2024-06-24 09:13:20 -05:00
Michael Barrett
897481b3b4
Added time field to slow get helper logging (#20427)
refs
[CFR-36](https://linear.app/tryghost/issue/CFR-36/pull-out-response-time-from-ghost-logs-message-field-for-get-helper)

Added time field to slow get helper logging to make it easier to query
and filter on this value in elastic without having to parse the message
field
2024-06-24 14:28:42 +01:00
Daniel Lockyer
d5013199b3 Fixed handling objects as API input parameters
fix https://linear.app/tryghost/issue/SLO-155/paramsmap-is-not-a-function-an-unexpected-error-occurred-please-try

- in the case you provide an object to the API, this code will throw an
  error because it can't map over an object
- we can just assert that params should be an array and throw an error
  otherwise
2024-06-24 10:14:43 +02:00
renovate[bot]
c1df0c9d3d Update dependency @types/node to v20.14.8 2024-06-24 10:07:19 +02:00
Ghost CI
bfd7a26370 v5.86.2 2024-06-23 20:39:22 +00:00
Kevin Ansfield
1593fd87d2 🐛 Fixed YouTube bookmark creation
https://github.com/TryGhost/Ghost/issues/20445

- after switching to a browser-like user-agent, YouTube started responding with a "supported browsers" message rather than the actual video meaning bookmark creation failed
- when trying other user-agents it was discovered that nytimes.com (why the user-agent was originally changed) had a problem with the github.com address in the user-agent. By switching to using https://ghost.org instead the request was allowed through fixing both YouTube and NYTimes embeds
2024-06-23 21:09:25 +01:00
Ghost CI
7dcc82b951 v5.86.1 2024-06-21 21:27:33 +00:00
Kevin Ansfield
5b2eaec982 🐛 Fixed 500 errors when viewing posts in development mode
closes https://linear.app/tryghost/issue/ONC-115

- OpenTelemetry was throwing errors when viewing posts
- disabled the instrumentation in development mode so it requires explicit config to enable
2024-06-21 21:59:03 +01:00
Ghost CI
a837cf0247 v5.86.0 2024-06-21 16:04:16 +00:00
renovate[bot]
ccf2d22f4b Update sentry-javascript monorepo to v7.118.0 2024-06-21 13:07:47 +01:00
Daniel Lockyer
12cbb22b85 Lazyloaded OpenTelemetry packages to avoid boot time regression
- we don't want to load the Otel packages unless the instrumentation is
  enabled, because they dramatically increase the boot time (2x locally!)
2024-06-21 11:26:37 +01:00
renovate[bot]
bec000567d Update dependency @opentelemetry/auto-instrumentations-node to v0.47.1 2024-06-21 11:23:14 +01:00
renovate[bot]
4609b43ad7 Update dependency @opentelemetry/instrumentation-runtime-node to v0.5.0 2024-06-21 11:22:50 +01:00
renovate[bot]
63a215700b Update dependency @types/node to v20.14.7 2024-06-21 10:55:13 +01:00