Commit Graph

966 Commits

Author SHA1 Message Date
Fabien O'Carroll
1962591c2e 🔒 Fixed permissible method for Integration Model
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c

The permissible method of models overrides all permission logic, which
means we must manually check the user & api key permissions before
continuing.
2021-07-20 13:43:29 +01:00
Rishabh
07dd783a40 🐛 Fixed error on saving member with existing label
closes https://github.com/TryGhost/Team/issues/743

Unlike tags, a label has a unique constraint on its `name`. So saving a new label on member with the same name as existing label fails with error due to unique constraint error.

- adds id for new label to match existing label if they are the same name, which avoids creating a new label
2021-07-16 14:01:47 +05:30
Fabien 'egg' O'Carroll
71ba9f3d17
Readded support for comped status in event aggregate (#13142)
refs https://github.com/TryGhost/Team/issues/880

The aggregate for `paid_delta` was incorrect as it did not handle the
case where an event went from paid->comped or from comped->paid. This
resulted in an overcount for paid members.
2021-07-15 15:17:51 +01:00
Hannah Wolfe
c29c118fcf
Moved labs utlity to shared
- This isn't really a "service" - it's a set of utilities for working with labs flags
- It's also required all over the place, and doesn't require anything that isn't shared
- Therefore, it should live in shared
2021-07-08 09:05:41 +01:00
Hannah Wolfe
8d38957bd7
Revert "Moved labs utlity to shared"
This reverts commit 782de52678.
2021-07-08 07:09:13 +01:00
Hannah Wolfe
782de52678
Moved labs utlity to shared
- This isn't really a "service" - it's a set of utilities for working with labs flags
- It's also required all over the place, and doesn't require anything that isn't shared
- Therefore, it should live in shared
2021-07-07 21:41:34 +01:00
Hannah Wolfe
61e1b19d46
Added comments to all usages of lib/common/events
- This is a precursor to trying to split apart into:
   - model events + webhooks system which makes sense
   - frontend events which should be independent or removed
   - maybe some concept of a settings manager that we can use in various places to bind logic 🤔
   - other usages of events that should be refactored to not use events
2021-07-07 16:02:44 +01:00
Naz
2c1ae2e9af 🐛 Fixed a 500 error for incorrect fields parameter in API
refs 8a1fd1f57f
refs 5584430ddc

- The change to async/await in the original commit 558443 was causing problems in downstream dependencies (create-error package) where it was loosing a context of "this". It's not a direct dependency so I didn't go yak shaving into where exacly the context is lost.
- The fix to keep a correct context of "this" was sticking to an existing pattern using regular function returning promises. Once we need to redo them into async/await we can investigate if there's a way around create-error's context prolbem
2021-07-06 11:58:37 +04:00
Daniel Lockyer
8a1fd1f57f
Revert "🐛 Fixed a 500 error for incorrect fields parameter in API"
- this reverts commit 5584430ddc until we
  can investigate why tests are failing
2021-07-05 17:36:44 +01:00
Naz
5584430ddc 🐛 Fixed a 500 error for incorrect fields parameter in API
closes https://github.com/TryGhost/Team/issues/817
refs 6d083ee00e/packages/bookshelf-pagination/lib/bookshelf-pagination.js (L256)

- The 500 error is not the best we can do in this situation and throwing a 400 just like we doo in a referenced commit would keep the convention
- The underlying problem of the bug is bigger - we allow the fields named the same way as relations to leak into the db query and that causes an incorrect SQL syntax. It's a bigger problem which would need a separate, holistic approach
2021-07-05 18:46:02 +04:00
Hannah Wolfe
bd597db829
Moved settings/cache to shared/settings-cache
- This is part of the quest to separate the frontend and server & get rid of all the places where there are cross-requires
- At the moment the settings cache is one big shared cache used by the frontend and server liberally
- This change doesn't really solve the fundamental problems, as we still depend on events, and requires from inside frontend
- However it allows us to control the misuse slightly better by getting rid of restricted requires and turning on that eslint ruleset
2021-06-30 15:49:10 +01:00
Fabien O'Carroll
c57e612286 Added benefits relation to Product model
refs https://github.com/TryGhost/Team/issues/806

This relation sets up the ability to both read and write relations via
the Product model, allowing us to expose benefits via the Admin Product
API.
2021-06-29 16:53:15 +01:00
Fabien O'Carroll
cbac3d1eb0 Added Benefit model
refs https://github.com/TryGhost/Team/issues/806

This is the model to represent the Benefit resource stored in the
`benefits` table. The `onSaving` method has been copied from the Tag
model and ensures that we have a unique slug.
2021-06-29 16:53:15 +01:00
Daniel Lockyer
53b7eb227b v4.8.3
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNSBfAAKCRDSEYbwtHKV
 rdNyAP9sT2e/01PE1p8l0PoTbq6nOL08BIA8ZKDiX/tFDeJ7owD9EikupgI6snND
 VrvRyA3AIZf3+hooAfjxIogX7NhUrQU=
 =Aqm+
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNSCAwAKCRDSEYbwtHKV
 rWOLAQDCheD486UqjssUUaEAjNxjoSzwvqnHSpnfRJB809eOmAEAv0UzVYM+vcJ6
 7vJdRXK2ke/dIc50n0mgRR8ktue6XAs=
 =TQTw
 -----END PGP SIGNATURE-----

Merged v4.8.3 into main

v4.8.3
2021-06-24 14:00:41 +01:00
Daniel Lockyer
f2ab12bb91
🐛 Fixed incorrect data returned when using API fields
refs 188de00489

- this fix was incorrect - the function should have been on the
  prototype but I'd moved it over incorrectly into the static class functions
- this commit moves `defaultColumnsToFetch` to the prototype functions
  and reverts the referenced commit back to `this.prototype` as expected
- this wasn't including the custom columns from the `post` model, which
  was causing tests to fail
- pro tip: run tests!
2021-06-24 13:47:15 +01:00
Daniel Lockyer
e389a6d991 v4.8.2
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNR3tAAKCRDSEYbwtHKV
 rXcMAQDQd7EcEmIx3sHlA5wjMz9SMZaybaOqLMzgCdUft2KOagD/dFtZBYpK4DLB
 Kr42XrNMVvORHNPso5lL35s9KNbTlwM=
 =OqBv
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNR4ygAKCRDSEYbwtHKV
 rXtsAQDNUqm3qK0b8/hET9h7cIG5J5RpAo0WYJWxv01DwcTscAEAjlfK3vgUo3wD
 uHeeXH+DXOIhAqSxsXoJr7X+N/s+WQw=
 =BJTH
 -----END PGP SIGNATURE-----

Merged v4.8.2 into main

v4.8.2
2021-06-24 13:21:23 +01:00
Daniel Lockyer
188de00489
🐛 Fixed error when using API to search for tags
refs a457631a20

- `defaultColumnsToFetch` was moved to the CRUD plugin in the referenced
  commit, which makes it a function on `this` instead of `this.prototype`
- this means the function doesn't exist and Admin throws an error when
  you start typing in the search bar because the API 500s
- this commit switches it to `this.defaultColumnsToFetch()`
2021-06-24 13:08:05 +01:00
Daniel Lockyer
ac8029680c v4.8.1
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNRcHQAKCRDSEYbwtHKV
 rQJeAP9ufmgIztn1oj8kF7tZMZk4xaVCakqIgyQBlPvFKc+aawD8Dv44mmZ4Ntar
 7FQ52i07TCwk/b8lCUwxD4maYBuZNAE=
 =fgVN
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYNRciwAKCRDSEYbwtHKV
 rRatAQCJ27vyVeGYlnXVWF0XSgj3+QEwl2eEgh4GoVp4BPzHAwD/WrGvKRvddDtA
 kiqv93vRTda3GV1R4FGYVl34MwbGFAA=
 =+Yci
 -----END PGP SIGNATURE-----

Merged v4.8.1 into main

v4.8.1
2021-06-24 11:20:53 +01:00
Daniel Lockyer
ce68b2e4a9
Reverted destroy function of CRUD plugin to chained promises
refs https://github.com/TryGhost/Team/issues/808

- see referenced issue for context, but turning this function into
  async-await seems to have broken error handling when deleting things
  that don't exist
- i'm really not sure why - but my running theory is that it's something
  to do with Bluebird Promises vs native Promises
- this should keep the same functionality until I can investigate what
  is going on
2021-06-24 10:17:40 +01:00
Thibaut Patel
f12f64e87b
🔒 Added a "reset all passwords" feature (#13005)
issue https://github.com/TryGhost/Team/issues/750

- Only accessible by admins
- Resets all staff users' passwords and prevents them to log-in
- Sends them a reset email password to give them back access to their account
- Closes all existing staff user sessions
2021-06-23 14:54:28 +02:00
Daniel Lockyer
a457631a20
Moved defaultColumnsToFetch to Bookshelf CRUD plugin
no issue

- the CRUD plugin uses this function so we want to keep similar things
  together to make it easier to test in the future
2021-06-17 17:07:10 +01:00
Daniel Lockyer
0830bcb74e
Moved setId function to Bookshelf events plugin
no issue

- `setId` is only used within the `events` plugin and it makes sense to
  keep code together
- we don't lose anything by putting it here, but it should make it
  easier to test in the future
2021-06-17 17:07:10 +01:00
Daniel Lockyer
c0baf5fdee
Moved formatOnWrite function to Bookshelf override plugin
no issue

- `formatOnWrite` doesn't override anything in Bookshelf but we use it
  within the `override` plugin and sub-models may override it, so it's
  easier to keep these things together
2021-06-17 16:47:47 +01:00
Daniel Lockyer
a635f3b68d
Updated JSDoc optional syntax in CRUD plugin
no issue

- optional parameters can be given in square brackets which makes
  editors understand it easier
2021-06-17 15:04:52 +01:00
Daniel Lockyer
a622f44564 Extracted Bookshelf method overrides to plugin
no issue

- all these functions override those within Bookshelf so this commit
  extracts them into a separate plugin from the Base model
2021-06-17 15:02:34 +01:00
Daniel Lockyer
5e9ab27a21
Refactored out local DB require in bulk-operations plugin
no issue

- we were only importing the `db` to access the `knex` instance, but
  we can get this through the Bookshelf instance
- switches to pulling out `knex` from Bookshelf so we can remove the
  remaining local require
2021-06-17 13:16:11 +01:00
Daniel Lockyer
a2b3568956
Fixed indenting for Bookshelf sanitize plugin JSDoc
no issue

- the indentation copied over incorrectly when I moved the code between
  files
2021-06-17 13:01:15 +01:00
Daniel Lockyer
76397f5aed Moved Bookshelf plugins to folder
no issue

- this moves all the plugins into a folder which but allows us to
  see which are still hanging around to be extracted out
2021-06-17 12:04:38 +01:00
Daniel Lockyer
67539a143b Extracted Bookshelf data manipulation code into plugins
no issue

- this commit extracts all code relating to manipulating/fixing data
  from the Base model into its own plugin
2021-06-17 12:04:38 +01:00
Daniel Lockyer
33d0f686be Extracted Bookshelf user type code into plugin
no issue

- this commit extracts the code relating to detecting if a user ID is
  internal/external from the Base model into a separate plugin
2021-06-17 12:04:38 +01:00
Daniel Lockyer
89ba4081b4 Extracted Bookshelf filtered collection code into plugin
no issue

- this commit extracts all code relating to filtering collections to a
  separate plugin to break down the Base model
2021-06-17 12:04:38 +01:00
Daniel Lockyer
930df4b7fb Extracted Bookshelf bulk operations to plugin
no issue

- this commit extracts code relating to bulk DB operations into a
  separate plugin
- it __could__ go into the CRUD one but these operations are a little
  more involved
2021-06-17 12:04:38 +01:00
Daniel Lockyer
e2b2a51d9b Extracted Bookshelf generateSlug function to plugin
no issue

- this commit extracts the niche `generateSlug` function into
  its own plugin so it can be extracted in the future
2021-06-17 12:04:38 +01:00
Daniel Lockyer
553e0932b2 Added missing Bookshelf JSDoc import
no issue

- this helps us with types across the model code
2021-06-17 12:04:38 +01:00
Daniel Lockyer
763d368c6e Extracted Bookshelf sanitization code to plugins
no issue

- this commit extracts all options + data sanitization code from the Base
  model into a plugin
2021-06-17 12:04:38 +01:00
Daniel Lockyer
f4f31027b7 Extracted Bookshelf raw_knex function to plugin
no issue

- this commit extracts the niche `raw_knex` function from the Base model
  into its own plugin
2021-06-17 12:04:38 +01:00
Daniel Lockyer
6ce1b11a15 Extracted Bookshelf events code to plugin
no issue

- this commit extracts event related code from the Base model into a plugin
- in particular:
    - events initialization
    - the `on*` events
    - `emitChange` - I'm not sure about this one but it __is__ event
      related
2021-06-17 12:04:38 +01:00
Daniel Lockyer
93c00b1ab7 Extracted Bookshelf actions code to plugin
no issue

- this commit extracts code related to Actions from the Base model into
  a separate plugin
- `api-key.js` contained the exact same helper function as the Base
  model so that has been de-duplicated
2021-06-17 12:04:38 +01:00
Daniel Lockyer
14ffd0b9d9 Extracted Bookshelf setup code into separate file
no issue

- I'm working on pulling apart the base index.js and this code is
  specific to setting up Bookshelf + the plugins, which is pretty
  contained and can stay in one file
- it only has one local require so it might be a good candidate for
  extracting out of Ghost in the future
2021-06-17 12:04:38 +01:00
Hannah Wolfe
526993965a
Switch to @trghost/validator, remove validator
- Part of the effort to split Ghost down into smaller, decoupled pieces
- Moved out our internal validator tooling to a separate library
- Replaced all usage of our own tooling and validatorjs directly with @tryghost/validator
- Removed the validatorjs dependency and removed the renovate pin
- This gives us a consistant, smaller, clearer public API for validations
- It will eventually be used on Ghost Admin too
- This way we can start getting up to date with validator whilst not increasing build size
2021-06-16 08:11:22 +01:00
Daniel Lockyer
97c0c93959 Refactored Bookshelf CRUD functions into plugin
no issue

- we're going to pull this out into the framework monorepo but
  refactoring it here first makes it a lot easier to extract without
  losing the history
2021-06-15 18:27:43 +01:00
Sam Lord
35e51e364b Switch to @tryghost/debug, remove ghost-ignition
no issue
The only pieces of Ghost-Ignition used in Ghost were debug and
logging. Both of these modules have been superceded by the Framework
monorepo, and all usages of Ignition have now been removed, replaced
with @tryghost/debug and @tryghost/logging.
2021-06-15 17:24:22 +01:00
Daniel Lockyer
f91daffdad
Revert "Refactored Bookshelf CRUD functions into plugin"
this reverts the following until tests have been fixed:
 - e51d505abb
 - c86ac27dcf
 - 3ffba967f2
2021-06-15 16:41:14 +01:00
Sam Lord
caea330647 Change to use @tryghost/logging
no issue

Logging is now controlled by a logginrc.js file in the root of the project - and now we can just import @tryghost/logging everywhere
2021-06-15 15:59:11 +01:00
Daniel Lockyer
3ffba967f2
Fixed path to CRUD plugin
no issue

- I renamed this just before pushing the previous commits but forgot to
  update it here
2021-06-15 15:50:22 +01:00
Daniel Lockyer
c86ac27dcf
Removed unused require
no issue

- we no longer need this as the code was extracted into a plugin
2021-06-15 15:49:21 +01:00
Daniel Lockyer
e51d505abb
Refactored Bookshelf CRUD functions into plugin
no issue

- we're going to pull this out into the `framework` monorepo but
  refactoring it here first makes it a lot easier to extract without
  losing the history
- note: this is very temporary and will be extracted soon
2021-06-15 15:46:33 +01:00
Hannah Wolfe
0fe8426f97
Renamed validation to validator + better public API
- renamed our internal validation library to "validator" - which is the same as the tool it wraps
- updated the public api so that validator methods are directly exposed
- this will make it a drop-in replacement for validator-js
- in turn, this allows us to pull this out into @tryghost/validator, and use our own wrapper instead of the 3rd party library
2021-06-15 15:32:36 +01:00
Daniel Lockyer
7cbe565f4f
Fixed JSDocs in base model
no issue

- Promise parameter types are given in diamond branches instead of
  parentheses, so switching to this makes editors happy
2021-06-15 13:28:59 +01:00
Daniel Lockyer
495ef867c2 Extracted Bookshelf plugins from Ghost to Framework repo
refs:
  - cf15f60085
  - dd20cc649b
  - ccf27f7009
  - abf146d61f
  - 2b54c92a14
  - bb029a53f6
  - 95bd7ee675
  - 9018b4df22
  - df01a6e5f4
  - d313726b34

- these plugins were in a state where they were independent enough to be
  pulled out into their own packages, which is what we did in the
  referenced commits above
- each package is named like `@tryghost/bookshelf-<plugin>`
- to avoid requiring multiple packages into Ghost, we've also created a
  wrapper package called `@tryghost/bookshelf-plugins` which re-exports
  all these plugins, so the changes in Ghost are very simple - dbebdd43b5
- this commit deletes the plugins + tests, and replaces with our new
  package with some minor code changes
2021-06-15 12:49:38 +01:00