Commit Graph

1469 Commits

Author SHA1 Message Date
Kevin Ansfield
3da839e80e Fixed unit tests failing on unknown helper
refs dc49871837

- added the `comments` helper to the experimental helpers list
2022-07-04 15:42:18 +02:00
Kevin Ansfield
8b2ba86909 Updated labs API snapshot
refs 46669c7036

- API output changes when labs flags are changed so snapshot needs updating to match
2022-07-04 14:13:43 +02:00
Naz
4e539137be Fixed broket test
refs 911ce4f29e

- Fixed the settings snapshot for a news labs flag
- Long term we should look into making the labs property match dynamically as it is updated quite often. We'll forget to update this snapshot!
2022-07-04 17:23:27 +08:00
Daniel Lockyer
c50658953c Renamed API canary/ folder to endpoints/
- now we only have one API version, it doesn't make sense to keep
  "canary" around
- renaming it to `endpoints/` makes more sense for this
- this commit renames the `core/server/api/canary/` folder to
  `core/server/api/endpoints/`
- it also fixes the naming in test titles and the various other places
  we relied on this
2022-07-04 11:14:37 +02:00
Fabien "egg" O'Carroll
b82dc7ae7c 🔒 Fixed RCE exploit with date helper & locale setting
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-7v28-g2pq-ggg8

A vulnerability in an upstream library means an attacker can abuse locale input
to execute arbitrary commands from a file that has previously been uploaded
using the file upload functionality in the post editor.
2022-06-14 22:50:22 -04:00
Matt Hanley
859d49626c
Updated mapping for stripe_products when product import is skipped (#14965)
refs d63e9256ea

- Following the ref'd commit, when migrating a site the default and free tiers would be skipped because they exist by default in the new site
- As the product is skipped, we don't have the ID available in the imported data to map the stripe_product to
- If the stripe_product isn't mapped, imported members won't be mapped to the correct tier
- This commit adds a lookup for the product by name and slug to restore the correct stripe_product mapping

Co-authored-by: Simon Backx <simon@ghost.org>
2022-06-03 17:31:53 +01:00
Matt Hanley
d63e9256ea
🐛 Fixed duplicate tiers being created on import (#14964)
- When importing tiers, duplicate tiers were being created with different slugs
2022-06-03 15:02:44 +01:00
Naz
b536cf5d9c Added e2e test coverage for post.added event
refs https://github.com/TryGhost/Toolbox/issues/320

- Wanted to verify if multiple webhook snapshot tests would play nicely together. They did!
- Also having few tests of the same type allows to detect patterns that could be extracted and reused later :)
2022-06-03 14:56:55 +08:00
Naz
9c3ed1a1f5 Added a hacky matcher to overcome 404 URL problem
refs https://github.com/TryGhost/Toolbox/issues/341
refs https://github.com/TryGhost/Toolbox/issues/320

- The snapshot for post's url property is causing test flakyness. The reason is due to the async nature of url processing in the URL Service (https://github.com/TryGhost/Ghost/issues/10360). Once the underlying issue is solved this hack could be removed.
- Having a snapshot tes even in this form is better than having none!
2022-06-03 11:57:39 +08:00
Naz
3c7271ab76 Fixed post.published event test suite
refs https://github.com/TryGhost/Toolbox/issues/320

- Updated the test suite to use updated webhookMockReceiver.mock method and corrected previously incorrect snapshot
2022-06-03 11:57:39 +08:00
Naz
041a32934a Added webhook fixute utils
refs https://github.com/TryGhost/Toolbox/issues/320

- There will be more webhook e2e tests coming which require easy webhook fixture creation
2022-06-03 11:57:39 +08:00
Naz
c7e833545b Extracted webhook mock receiver into a package
refs https://github.com/TryGhost/Toolbox/issues/320

- Following the rule of having minimum code changes in the Ghost core codebase. This module belongs to "framework" along with other testing tools anyway.
- The bump includes a noteworthy changes - the "snapshotManager" was extracted into a separate exposed property of express-test API (maybe should be even it's own separate concept eventually, for now exposing it was enough). "snapshotManager" had to be exposed to be able to pass it to the webhook mock receiver - to use same instance configured with mocha hooks. snapshotManager has to be a singleton in the system to configure snapshots correctly through mochaHooks.
2022-06-03 11:57:39 +08:00
Naz
0f4aeaaa80 Added basic framework for webhook e2e tests
refs https://github.com/TryGhost/Toolbox/issues/320

- This is an **MVP** to be able to intercept and match webhook request
snapshots. The concept is similar to the one used in API E2E tests using
same "matchBodySnapshot" and other "match*" methods to test the webhook
**request** data
- Next up here would be:
1. Header matcher
2. Mocking more than one webhook (and doing something nicer with the way
the fixture data is inserted, does this logic belong to the mock-receiver?
2022-06-03 11:57:39 +08:00
Naz
c9758112b3 🐛 Fixed an error when updating a user
closes https://github.com/TryGhost/Team/issues/1655
refs https://github.com/TryGhost/Ghost/commit/4bc14d2c4

- The API should always accept the input it returns. In this case it did not accept the input when it contained an unchanged roles property
- The problem here came from the referenced commit where we can now end up in the situation when the `roleToAssign` is just empty. It was an optimization to prevent a need to do ANY DB operation when none was needed.
2022-06-02 12:13:27 +01:00
Fabien 'egg' O'Carroll
6c455dc1f2
🐛 Fixed Stripe Checkout for Members w/ existing subscriptions (#14953)
refs https://github.com/TryGhost/Team/issues/1526

This adds a check for existing subscriptions for a member associated with the
email addressed used for Stripe Checkout, if any are found the Checkout Session
creation fails and responds with a 403.

We've also updated the error handling for the create-stripe-checkout-session
endpoint so that it follows the existing Ghost API patterns.
2022-06-01 15:53:05 +01:00
Simon Backx
c32b1baa9b
Added support for publishing email only posts by setting status to sent (#14950)
no issue

If you try to publish a draft email only post by setting the status to sent, you won't receive an error but the email won't get sent. This is because we don't support this behaviour. This is very counter-intuitive when writing the documentation, so I've patched this behaviour and added some more tests.
- When setting the status to `sent` for not email only posts, the post status will be set to `published` without warning
- Also published_by was not set correctly in the past. This is also fixed and has new tests.
2022-06-01 14:53:55 +02:00
Naz
4bc14d2c4b 🐛 Fixed invalid user role assignment
closes https://github.com/TryGhost/Toolbox/issues/351

- When an invalid value was passed in `roles` parameter when editing a user it resulted in incorrect database state (all roles appeared to be unassigned from the user).
- The fix includes ability to set user role by an allowed name, one of:  'Administrator', 'Editor', 'Author', 'Contributor'.
- Also added a validation in case a non-ObjectID value is passed in roles to the users edit method.
2022-06-01 17:48:08 +08:00
Naz
29e5d08210 Refactored Admin API test agent to use async/await
no issue

- Improves readability of what's going on in the code.
2022-06-01 17:48:08 +08:00
Simon Backx
a30e42404b
Added getLazyRelation model helper method (#14943)
closes https://github.com/TryGhost/Team/issues/1626

- getLazyRelation is a safer shorthand for `model.related('relationName').fetch()`
- prevents doing a `fetch` operation on a relation that is already loaded, which can cause issues when `formatOnWrite` has a custom implementation
- uses the already loaded relation if it exists, or loads the relation
- doesn't reload if already loaded
- reload is forceable using the forceRefresh option
2022-05-31 13:21:53 +02:00
Simon Backx
9d21a14b4b
Added integration test for MEGA.sendEmailJob (#14944)
closes https://github.com/TryGhost/Team/issues/1632
2022-05-30 15:41:02 +02:00
Simon Backx
da8cb5c078
Added possible fix for random test timeouts
no issue

Some tests timeout for an unknown reason. This commit adds some missing awaits for async test methods (that don't perform any async operation, but are marked as async).
2022-05-30 15:00:55 +02:00
Simon Backx
a051ab3b69
🎨 Reduced favicon requirements and added image formatting (#14918)
fixes https://github.com/TryGhost/Team/issues/1652
fixes https://github.com/TryGhost/Ghost/issues/13319

**Image formatting**
Added support for changing the format of images via the `handle-image-sizes` middleware (e.g. format SVG to png, jpeg, webp)

This change was required:
- Not all browsers support SVG favicons, so we need to convert them to PNGs
- We can't fit image resizing and formatting in the `serve-favicon` middleware: we need to store the resized image to avoid resizing on every request. This system was already present in the `handle-image-sizes` middleware.

To format an uploaded image:
- Original URL: https://localhost/blog/content/images/2022/05/giphy.gif
- To resize: https://localhost/blog/content/images/size/w256h256/2022/05/giphy.gif (already supported)
- To resize and format to webp: https://localhost/blog/content/images/size/w256h256/format/webp/2022/05/giphy.gif
- Animations are preserved when converting Gifs to Webp and in reverse, and also when only resizing (https://github.com/TryGhost/Ghost/issues/13319)

**Favicons**
- Custom favicons are no longer served via `/favicon.png` or `/favicon.ico` (only for default favicon), but use their full path
- Added support for uploading more image extensions in Ghost as a favicon: .jpg, .jpeg, .gif, .webp and .svg are now supported (already supported .png and .ico).
- File extensions other than jpg/jpeg, png, or ico will always get transformed to the image/png format to guarantee browser support (webp and svg images are not yet supported as favicons by all browsers).

For all image formats, other than .ico files:
- Allowed to upload images larger than 1000px in width and height, they will get cropped to 256x256px.
- Allowed uploading favicons that are not square. They will get cropped automatically.
- Allowed to upload larger files, up to 20MB (will get served at a lower file size after being resized)

For .svg files:
- The minimum size of 60x60px is no longer required.

For .ico files:
- The file size limit is increased to 200kb (coming from 100kb)
2022-05-27 16:36:53 +02:00
Hannah Wolfe
8177e36242
Cleaned snap files (#14921)
- This PR was created by deleting all .snap files & running the tests
- The result is that all tests that have been removed or renamed have had their now-unused snaps deleted
2022-05-26 17:11:32 +01:00
Simon Backx
ad349bb3a5
Removed GA feature flags (#14915)
refs https://github.com/TryGhost/Team/issues/1616

- Removed all GA feature flags
- Removed `tweetGridCard` alpha flag
- Changes to `members-api` and `members-importer` packages: https://github.com/TryGhost/Members/compare/%40tryghost/members-api%408.1.1...%40tryghost/members-api%408.1.2
2022-05-26 09:54:30 +02:00
Naz
939496487d Removed subscriber-related webhook fixtures
refs https://github.com/TryGhost/Toolbox/issues/308
refs 0f5c22a38d

- There is no concept of "subscriber" in the codebase any longer. Keeping removed webhooks around does not make sense
2022-05-26 14:45:36 +08:00
Fabien 'egg' O'Carroll
4217e2571f
Included monthly_price,yearly_price&benefits defaults for Content API (#14912)
We have to update the output serializer to only clean includes for the
Admin API, so that these includes aren't stripped for not being in the
original include query param.

This also rejigs the other Content API only logic to sit together in
the input serializer.
2022-05-24 16:38:25 +01:00
Simon Backx
c052652559
Updated settings API to return all settings in edit endpoint (#14889)
refs https://github.com/TryGhost/Team/issues/1650

Since we introduced calculated settings, we need to return all settings when editing a setting, because those calculated settings can change.

- When editing settings, return all the settings. Previously we didn't include the calculated settings (which caused issues with admin not having up to date values for those)
- Updated Stripe <head> script to be injected based on the calculated settings

Required for https://github.com/TryGhost/Admin/pull/2405
2022-05-24 16:42:15 +02:00
Hannah Wolfe
cdb365c29d Fixed minor weirdnesses with excerpts
- remove HRs ---- and blockquote > symbols from excerpts
- we want the excerpt to not contain "markdown-like" symbols, but just be plaintext
2022-05-24 12:35:59 +01:00
naz
6cc0c2b76b
🐛 Fixed signing key identificaiton in JWKs
refs https://github.com/TryGhost/Team/issues/1640

- The signing key returned by `GET /ghost/.well-known/jwks.json` was missing an OPTIONAL `use: "sig"` attribute needed to identify it as a signing key in client libraries. E.g. pyton lib: "pyjwt" or node lib: "jwks-client"
- More about the "use" attribute at RFC7515 - https://www.rfc-editor.org/rfc/rfc7515#section-4.1.4
2022-05-24 12:20:30 +01:00
Naz
72479a152f Added basic e2e test for Members API .well-known endpoint
refs https://github.com/TryGhost/Team/issues/1640
refs https://github.com/TryGhost/Members/pull/401

- Adds basic test coverage for the `GET /members/.well-known/jwks.json` endpoint
- Next the test should be expanded with the JWT verification to check if the returned format is usable by mainstream client libraries
2022-05-24 10:27:46 +08:00
Hannah Wolfe
8dd009ffa0
🐛 Fixed member exports timing out for large sites (#14876) (#14878)
refs TryGhost/Team#1641

This commit adds a custom query for the members export, to improve the performance and to prevent any timeouts from happening when exporting large amounts of members.

Co-authored-by: Simon Backx <simon@ghost.org>
Co-authored-by: Matt Hanley <git@matthanley.co.uk>
2022-05-20 21:25:23 +01:00
Matt Hanley
eae0a6a3b9
Added products and Stripe data to exports and imports (#14873)
- The migration path from 4.x on SQLite to 5.0 on MySQL requires an export/import
- Exports don't include the Stripe info required to map members to tiers correctly on import. This change fixes that.

Co-authored-by: Simon Backx <simon@ghost.org>
Co-authored-by: Hannah Wolfe <github.erisds@gmail.com>
2022-05-20 21:13:58 +01:00
Hannah Wolfe
d6d6841186
Added benefits, offers and snippets to exporter
- These are more things that we should write an importer for
2022-05-20 20:30:55 +01:00
Matt Hanley
3471f6cca0
Updated tests 2022-05-20 20:30:55 +01:00
Simon Backx
419fa24f27
Fixed bulk unsubscribe counts (#14871)
refs https://ghost.slack.com/archives/C02G9E68C/p1652980792270029

- When bulk unsubscribing members, the number of deleted newsletter relations are returned instead of the number of members with newsletters that were cleared
- Updates members-api to 8.1.0, which uses this new option to delete newsletter relations by member_id instead of the id of the relation (which allows us to fetch the number of successfully/failed member deletes) Changes: https://github.com/TryGhost/Members/pull/400
- Added tests for bulk unsubscribe and bulk delete labels (because they both use the updated bulkDestroy method)
2022-05-20 13:40:55 +02:00
Naz
fd8ce6a5bf Covered well-known endpoint with e2e test
refs https://github.com/TryGhost/Team/issues/1640

- There was no coverage. Now there is :)
2022-05-20 13:18:26 +08:00
Naz
a18469a3be Added root Ghost server/API test agent
refs https://github.com/TryGhost/Team/issues/1640

- Some tests require making request to the root of the mounted server path like `GET /ghost/.well-known/jwks.json`. These are not stricly APIs like Admin, Content, and Members. They do need a separate agent to distinguish the configuration - for this agetn we can stop loading some parts like "server" in the future to speed things up (didn't work straight out of the box)
2022-05-20 13:17:00 +08:00
Simon Backx
def8f83894
Fixed missing products in members export (#14867)
refs https://github.com/TryGhost/Team/issues/1642

- Updated `members-csv` (dependency via `members-importer`, shouldn't this be a separate dependency too?)  package to use the `tiers` field instead of the (removed) products field.
- Added basic test to see if products and labels are returned in the csv.
2022-05-19 18:26:29 +02:00
Naz
c3d38a9144 Updated test suites to play nicely with 5.0
refs https://github.com/TryGhost/Toolbox/issues/335

- When eventually the major will be bumped next week the returned version will become `5.0.0` which changes the `content-length` header in all of the responses using the version from package.json
- The version number is dynamic, so it's expected the content-length to float as minor and patch versions fluctuate in 1-2 digit numbers. For lon-term easy maintenance it's best to set the content-length to any number (or maybe some sort of floating range in the future?)
2022-05-19 14:19:48 +08:00
Naz
d2e9a98846 Updated version test suite to play nicely with 5.0
refs https://github.com/TryGhost/Toolbox/issues/335

- When eventually the major will be bumped next week the returned version will become `5.0.0` which changes the `content-length` header in all of the responses using the version from package.json
- The version number is dynamic, so it's expected the content-length to float as minor and patch versions fluctuate in 1-2 digit numbers. For lon-term easy maintenance it's best to set the content-length to any number (or maybe some sort of floating range in the future?)
2022-05-19 13:27:40 +08:00
Naz
f97b141a3a Added "anyContentVersion" and anyContentVersion matchers to e2e framework
refs https://github.com/TryGhost/Toolbox/issues/335

- Similarly to `anyEtag` pattern for `etag` headers there's a need to match dynamic content-length and content-version headers.
- The `anyContentLength` is the same as `anyStringNumber` matcher, created a separate one to show the intention over a function when reading the code (maybe we could introduce something like floating number range matcher in the future to be more precise in situations where we expect the content-length to float in +-2 length range)
2022-05-19 13:19:05 +08:00
Naz
9e7bea5bb3 Added "anyStringNumber" matcher to e2e framework
refs https://github.com/TryGhost/Toolbox/issues/335

- Existing `anyNumber` matcher does not do a job when the number is stringified, so introduced a new string matcher to match stringified numbers
2022-05-19 13:06:50 +08:00
Rishabh Garg
998584f6e1
Fixed members list filtering on tiers (#14859)
- filtering member list on `tier:tier-slug` was failing as it only accepted member.product column
- member table needed to expand the tier filter to use product naming for filtering to work
2022-05-18 20:58:00 +05:30
Fabien 'egg' O'Carroll
09a516a179
Fixed Stripe Connect (#14857)
refs https://github.com/TryGhost/Team/issues/1637

The `stripe_connect_integration_token` setting is required for the Stripe
Connect flow to work. The existing `stripe_connect_*` settings are also not able
to be edited. So we've updated the allow list to remove those, and add the one
required for the Stripe Connect flow.
2022-05-18 13:27:50 +01:00
Rishabh Garg
d90add9cd5
Fixed failing checkout session creation for offers (#14855)
- checkout session creation was failing when setup with `offerId` instead of `tierId` and `cadence`
- updates `members-api` to ignore cadence check to allow creation using `offerId` present in request
2022-05-18 15:10:07 +05:30
Kevin Ansfield
71aa1c58e6 Revert "Cleaned up membersActivityFeed labs flag"
This reverts commit ae3a0e93fc.

- flag is still used in the `@tryghost/members-api` package
- reverting for now pending a more complete commit with a bumped members-api package
2022-05-18 10:31:51 +01:00
Kevin Ansfield
ae3a0e93fc Cleaned up membersActivityFeed labs flag
refs https://github.com/TryGhost/Admin/pull/2309

- the flag was only used in Admin and was cleaned up there a while ago
2022-05-18 10:23:53 +01:00
Kevin Ansfield
227548f004 Cleaned up improvedOnboarding labs flag
closes https://github.com/TryGhost/Team/issues/1421
refs 28ead208b8

- all conditionals in Admin have been removed so the forced-GA flag is no longer required
2022-05-18 10:15:31 +01:00
Simon Backx
8b973dcfaa
Added subscription.price.tier mapping (#14849)
refs https://ghost.slack.com/archives/C02G9E68C/p1652781104970769
refs https://github.com/TryGhost/Team/issues/1145

- subscription.price.product was not mapped yet, but already used in the admin app.
- removes products property from members
2022-05-17 16:38:25 +02:00
Naz
0260ec5a64 Removed useless comment
no issue

- Engines in theme's package json have no effect whatsoever on how Ghost instance runs.
2022-05-17 17:21:38 +08:00