Commit Graph

611 Commits

Author SHA1 Message Date
Naz
6ed5f64f4b Moved backup path calculation outside redirects module
refs https://github.com/TryGhost/Toolbox/issues/139

- Having tight coupling with backup file path calculation for redirects makes it extremely hard to test. In addition, having it injected will make it easier to swap this dependency to the mechanism similar to one used for routes files
2021-11-26 06:18:36 +13:00
Hannah Wolfe
621cfd9866
Moved admin redirect middleware to named file
- moving this middleware because we're about to add a second piece of middleware
- it's easier to see what we have when each middleware is in its own file rather than in one big middleware.js file
2021-11-25 14:29:17 +00:00
Naz
6ee94f66b4 Fixed invalid settings file path configuration
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings
refs e457fd5fe0 (diff-b292e8480eee007786cc602f55ed05006a06b8da9fe6934d51fbef8328013278R36)

- There were two separate instances of the SettingsPathManager in route-settings and settings-loader causing the configured paths missmatching on test environment. Because of this missmatch, uploading and resetting the routes.yaml file didn't work!
2021-11-24 05:32:20 +13:00
Naz
2fed8dbbd5 Moved all settings module bootstrap logic into init method
refs refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- The initialization outside the init method is causing problems when the configs are mocked during the test setup
2021-11-24 05:32:20 +13:00
Naz
6d6aa12afe Extracted routes.yaml path calculation into external package
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings
refs e457fd5fe0 (diff-b292e8480eee007786cc602f55ed05006a06b8da9fe6934d51fbef8328013278R36)

- The full logic for  file path calculation for routes.yaml has been duplicated in couple modules. It is aslo following similar pattern used in redirects services and should be reused there once those modules are touched
2021-11-24 05:32:20 +13:00
Hannah Wolfe
0ede559d5b
🐛 Fixed card asset init/reload behaviour
- Card asset reloading was incorrectly only happening if the API version changed 🙈
- In addition, having an init function was redundant, as theme activation happens on boot
- This meant that the card assets were being generated twice on boot
- Instead, we now only generate them on theme activation, which covers the boot case and simplifies all the logic
2021-11-23 12:53:58 +00:00
Hannah Wolfe
6e6a4822f2
Updated servePublicFile to honor v= cache keys
- Currently it's assumed that public files are 100% static
- With card assets, we're using it for files that are partially static, but can change between reboots and theme changes
- We already have a system for managing cache busting across theme changes and restarts - the ?v= key that is added via the asset helper
- This was already in place and used, but servePublicFile's internal cache didn't honor this key, and cached for the lifetime of boot
- This small change means that if a ?v= query param is present on a request for a public file, that we pay attention to it. Else we cache as before
2021-11-23 12:49:53 +00:00
Naz
34b0196c0f Added writeDisabled flag to URL file cache
refs https://github.com/TryGhost/Toolbox/issues/135

- Allows to turn off overwriting urls/resources JSON file caches on testing environment. This is needed to have predictable state when running multiple test suites that stop the Ghost process and try to persiste URL cache.
2021-11-22 21:56:32 +13:00
Naz
ee4d2dd1a8 Extracted a local file cache class for URLs
refs https://github.com/TryGhost/Toolbox/issues/135

- This extracts the file storage knowledge out of the URL Service an allows to have optional features based on the environment - for example turning off writing cache for when running tests
2021-11-22 21:56:32 +13:00
Naz
3b390639c4 Introduced booting from fixture url cache in test environment
refs https://github.com/TryGhost/Toolbox/issues/135

- To be able to reliably start ghost instance without a frontend the process needs access to urls/resources caches
- Storing the configuration in "paths" for now as there's no better place for it untill we are able to mock the content folder in pre-boot
2021-11-22 21:56:32 +13:00
Hannah Wolfe
592d02fd23 🐛 Fixed perms error when building public assets
closes: https://github.com/TryGhost/Ghost/issues/13739

- Ghost cannot write to the core folder in correctly configured production installations
- Built assets therefore need to be written to the content directory
- Ghost does not overwrite anything in the content folder as part of an upgrade, therefore static files that are provided by Ghost
  must still live inside /core
- So as a result, we now have core/frontend/public and content/public
2021-11-19 11:36:45 +00:00
Sam Lord
0692ddf57d Revert "Replace update user last seen middleware with package version"
This reverts commit 07f8c6efbb.

Revert "Remove unused unit test file"

This reverts commit f1798119d3.
2021-11-17 11:00:55 +00:00
Hannah Wolfe
332beaaf90
Moved "vhost-utils" to config helpers
- These are simple functions that get data from config in a specific format
- They are also used by the topmost part of the application
- Config helpers seems like a reasonable fit to get them out of the web folder
- Functions have also been renamed to try to get them to make more sense
2021-11-17 08:37:08 +00:00
Sam Lord
f1798119d3 Remove unused unit test file
no issue

Relates to previous commit
2021-11-16 16:05:50 +00:00
Hannah Wolfe
4f9b72ff43
Renamed middlewares to middleware consistently
- This is a minor bugbare, but it will affect some configuration I'm about to do for c8
- I've been wanting to do it for ages, middleware is plural all on it's own so it's an odd affectation in our codebase
- This also only exists in 2 places, everywhere else we use "middleware"
- Sadly it did result in a lot of churn as I did a full find and replace, but consistency is king!
2021-11-16 15:51:47 +00:00
Hannah Wolfe
b781e47cb9
Changed to use different fixtures during testing
- this keeps production and test fixtures separate, so that changing the prod fixtures doesn't change the shape of our tests.
- we may still want to test that the production fixtures do what we expect, but that can be handled in a separate integration test, by specifically setting the fixture path
2021-11-16 14:03:42 +00:00
Hannah Wolfe
426c8bf918
Refactored fixtures to be loaded by fixture manager
refs: https://github.com/TryGhost/Toolbox/issues/133

- instead of just a collection of utils, we now have a class that manages fixtures
- this should allow us to change the path to fixtures, e.g. between prod/dev and test, so that different fixtures can be loaded by default
- also makes it easier to test the fixture manager code itself
2021-11-16 11:17:03 +00:00
Naz
0681953e1f Fixed test mocks for Url Service test suite
refs 042618fe93

- There's no longer "getValue" method passed around in UrlService, so the were unnecessary and did a wrong thing here :) Yey, less code!
2021-11-15 20:11:05 +04:00
Naz
6e205a3f05 Extracted an explicit "permalink" parameter in UrlGenerator constructor
refs https://github.com/TryGhost/Toolbox/issues/127

- This is an effor t to define a precise set of data needed for the UrlGenerator to function, which should help with decoupling it from the frontend routes
- This is almost the last piece to free us up from the massive "router" object that has been passed around
2021-11-15 18:32:34 +04:00
Naz
677ea1073d Extracted an explicit "resourceType" parameter in UrlGenerator constructor
refs https://github.com/TryGhost/Toolbox/issues/127

- This is an effor t to define a precise set of data needed for the UrlGenerator to function, which should help with decoupling it from the frontend routes
2021-11-15 18:32:34 +04:00
Naz
ca2809d432 Extracted an explicit "filter" parameter in UrlGenerator constructor
refs https://github.com/TryGhost/Toolbox/issues/127

- This is an effor t to define a precise set of data needed for the UrlGenerator to function, which should help with decoupling it from the frontend routes
2021-11-15 18:32:34 +04:00
Naz
176c369620 Refactored UrlGenerator to use DI constructor pattern
refs https://github.com/TryGhost/Toolbox/issues/127

- This is a standard across the codebase which is good to follow for better testability
2021-11-15 18:32:34 +04:00
Naz
2a7ef77a7b Added ability to delete existing files through storage adapters
refs https://github.com/TryGhost/Toolbox/issues/120

- When editing an uploaded media thumbnail  file there'a need to remove existing thumbnail to keep media files:thumbnails 1:1. - Because the API client only has a public URL under which the resource is served it can only provide that as an API input, the `urlToPath` was also added to the base class of LocalStorageAdapter (it might be moved up to the BaseAdapter in the future if we see a need)
2021-11-09 16:07:23 +04:00
Naz
65d79f4a74 Fixed failing test
no issue

- Not sure what the purpose of this test is. Seems like it's kind of like an db integrity check where it makes sure the change is double checked before commiting
2021-11-05 17:17:18 +04:00
Naz
ad2583530a Renamed getLocalFileStoragePath
refs https://github.com/TryGhost/Toolbox/issues/95

- getLocalImagesStoragePath makes a lot more sense in context of what the method really does
2021-11-05 17:17:18 +04:00
Naz
c802097b72 Renamed LocalFileStorage to LocalImages store
refs https://github.com/TryGhost/Toolbox/issues/95

- This naming corresponds way better to what the actual adapter does
2021-11-05 17:17:18 +04:00
Hannah Wolfe
e25f1df0ae
Added card-asset config with sensible default
- This comment removes the block on themes controlling card assets via config
- It also changes the default behaviour from "false" config (doing nothing) to excluding bookmark and gallery card assets
- This is essentially the same thing, as only bookmark and gallery card assets exist at the moment, but it's being done because it makes this feature future-proof for all theme developers.
- As we add new cards, all themes will automatically get the assets to make them work
- As theme developers want to, they can create their own custom assets and disble assets for any cards they support by adding them to the exclude list
- They can also remove any custom code they currently have to support bookmark and gallery cards, and set card_assets: true in package.json to use the defaults instead
2021-11-05 12:20:02 +00:00
Hannah Wolfe
d9bdc444a3
Ensured nonexistant public files fallback to 404
- If we register the serve public file middleware for a file that doesn't exist, this will currently throw an ENOENT error
- Instead, we want to fall back to a standard 404 so that this behaves normally
- This will be useful for the card asset service, where the cards.min.css and cards.min.js files may or may not exist
2021-11-05 09:13:23 +00:00
Rishabh Garg
3b90b1f335
Moved launchComplete user setting as global editor setting (#13703)
refs https://github.com/TryGhost/Team/issues/807

The launch wizard completed flag was previously stored at per user level in accessibility column of user table, so an administrator still got the option to complete the launch wizard even if the owner had completed it previously, which is not expected pattern. This change moves the launch complete flag for Admin to common settings from per user level so a site only needs to complete the launch wizard once irrespective of which user completes it

- adds new `editor_is_launch_complete` setting to track if a site launch steps are completed in Admin
- adds new migration util to easily allow adding new setting 
- adds migration to introduce new `editor_is_launch_complete` setting
- adds migration to update launch complete flag for a site if any of the users have already completed the launch steps
2021-11-04 18:03:51 +05:30
Hannah Wolfe
fdf38ba8c6
Initial card asset service implementation
- Requires the new @tryghost/minifier package
- Adds a new service that will handle taking config from the theme and optionally including assets for Koenig editor cards
- It supports both css and js as cards may need one or both
- For any given config, the tool can find the matching files to include and concat and minify them into one file per type
- Currently has an override in place so that this is not yet customisable in the theme - will remove this override when we're ready for the feature
2021-11-04 11:34:40 +00:00
Naz
df5c87fae3 🐛 Fixed a 500 error when uploading invalid routes.yaml
closes https://github.com/TryGhost/Toolbox/issues/111

- Just like with invalid JSON redirects files we should return a BadRequestError instead of throwing a generic 500 when the redirects.yaml file fails parsing
2021-11-04 11:52:52 +04:00
Thibaut Patel
c32cc3e48b 🐛 Fixed broken assets for theme/design preview
refs https://github.com/TryGhost/Team/issues/1190

- The assets were broken in Admin when the frontend and admin urls were different
- Fixed the issue by changing the `asset` helper to output absolute URLs when the frontend/admin urls are differents
2021-11-03 11:20:04 +01:00
Naz
0ccf31cdb5 Fixed error message when booting with no redirects
refs 91efa4605c

- When the instance is booted without any redirects files configured it's not supposed to error but rather default to an "empty" [] redirects configuration.
- Ideally the logic shoudl not contain try/catch block at all and fail as soon as there's any error during the initialization. This wasn't changed at this time due to possible break of existing Ghost instances
2021-11-03 13:50:24 +04:00
Naz
a9952b2437 Rewrote validation regression tests to be unit tests
refs refs https://linear.app/tryghost/issue/CORE-84/have-a-look-at-the-eggs-redirects-refactor-branch

- These regression tests are slow and should have been unit tests to start with
2021-11-03 07:41:55 +13:00
Naz
d101ef5293 Rewrote validation regression tests to be unit tests
refs refs https://linear.app/tryghost/issue/CORE-84/have-a-look-at-the-eggs-redirects-refactor-branch

- These regression tests are slow and should have been unit tests to start with
2021-11-03 07:41:55 +13:00
Naz
f4e725a7ef Removed redirects regression tests in favor of unit test
refs https://linear.app/tryghost/issue/CORE-84/have-a-look-at-the-eggs-redirects-refactor-branch

- Removed "download" regression tests as those cases were ported over to much faster unit tests
2021-11-03 07:41:55 +13:00
Naz
1c4dea00b9 Removed redirects regression tests in favor of unit test
refs https://linear.app/tryghost/issue/CORE-84/have-a-look-at-the-eggs-redirects-refactor-branch

- The regression test should not be testing edge cases like this and it's far more flexible and performant to test the service on the unit test level
2021-11-03 07:41:55 +13:00
Fabien O'Carroll
91efa4605c Used DynamicRedirectManager for Custom Redirects
refs https://github.com/TryGhost/Members/commit/9e59f5a9

Since we have a DynamicRedirectManager for handling adding/removing
redirects at runtime, we no longer need the custom-redirects middleware.
The redirects service does however need an init method now to add the
custom redirects at Ghost boot, so it's been refactored into our Class &
DI pattern.
2021-11-03 07:41:55 +13:00
Naz
5242566252 Added local media storage adapter
refs https://linear.app/tryghost/issue/CORE-121/create-a-video-storage-adapter

- This is an experimental implementation of video file upload support (audio is yet to follow)
- The storage adapter still needs more thinking as it's almost the same as the "LocalStorgeAdapter" that stores images.
- Also the output serializer skipped use of url utils in favor of inline implementatoin - this should almost certainly be it's own package
2021-11-03 00:33:28 +13:00
Fabien 'egg' O'Carroll
b36d0cc1c4
🐛 Fixed idempotentcy of addPermissionToRole util (#13685)
refs https://github.com/TryGhost/Team/issues/1178

The "up" migration that this util generates correctly throws if the
pre-requisite data cannot be found in the database. The "down" migration
however was incorrectly mirroring this behaviour of throwing - which
meant that it wasn't idempotent, as it does not require a permission or
role to existing if it wants to move relations between them.
2021-11-01 09:27:50 +00:00
Thibaut Patel
6e0bd7e7b5 Added fallbacks when the site title is undefined
refs https://github.com/TryGhost/Team/issues/1180

- An undefined site title was causing the `null` string to show in the html title tag on tag and author pages
2021-10-27 12:18:57 +02:00
Fabien O'Carroll
f3bb6b43a5 Added Offers feature to Ghost
refs https://github.com/TryGhost/Team/issues/1115

This allows users to create Offers for Tier/Cadence pairs in order to
provide discounted subscriptions to Members! We have support for
percentage based discounts & fixed price discounts, either for the first
payment, all payments, or a number of monthly payments.

Offers also have a code, which can be used as an easy way to share them,
as visiting https://site.com/offer-code will automatically open Portal
with the Offer prepopulated.
2021-10-22 17:55:34 +02:00
Kevin Ansfield
a6982d5606
Added ability for themes to define custom settings (#13661)
closes https://github.com/TryGhost/Team/issues/1164

Themes can now define custom settings via their `package.json` file, and use them in templates via `@custom.{setting}`. Values for custom settings can be changed by site owners through a redesigned "Design settings" area in the admin interface.

Full announcement, documentation, and examples will be made available soon.

Co-authored-by:
- Sanne de Vries (@sanne-san)
- Thibaut Patel (@tpatel)
2021-10-22 15:02:16 +01:00
Fabien 'egg' O'Carroll
d962f0e18e
Removed NOT NULL constraint from portal_title (#13659)
refs https://github.com/TryGhost/Team/issues/1163

We want to make the title for Offers optional, our nullable validation
means that we cannot store an empty string, so we must remove the NOT
NULL constraint from the column if we want to store either an empty
value or null.

There is a bug with editing columns in SQLite with `knex` which strips all
the indexes, so we have to manually add them afterwards.
2021-10-22 14:14:49 +02:00
Hannah Wolfe
faea2da596
Moved server/web/site to frontend/web
- we're slowly trying to draw the lines between the backend and the frontend correctly
- these files deal only with serving the frontend so they should live there
- there are lots of mixed requires in these files, so having them in the right place makes that clear
2021-10-21 19:28:18 +01:00
Naz
98c27b5555 Added multiple adapters capability to adapter manager
refs https://linear.app/tryghost/issue/CORE-1/multiple-adapters-per-type

- There's a need to support multiple adapter variations per given adapter type (storage, sso, etc.)
- With the introduced changes we can specify a version of an adapter that should be fetched based on `:feature` postfix. For example:

`adapterManager.getAdapter('storage')` -  would return the default adapter listed under "active" configuration
`adapterManager.getAdapter('storage:videos') - would return an adapter configured for videos *feature*

- Here's an example configuration for a custom video storage:
```
"storage": {
    "active": "LocalFileStorage",
    "videos": "ghost-storage-custom-video",
    "ghost-storage-custom-video": {
        "custom": "configHere"
    }
}
```
2021-10-21 20:22:45 +13:00
Hannah Wolfe
48e66d2dd6
Fixed DB version integrity test
- We were not requiring the full path to our fixture file, and therefore we were testing the fixtures + utility functions
- This updates the test to clearly require the exact files we are checking, except the routes.yaml where we can't
- Also updates the hash to be the correct hash for just the fixture content
2021-10-20 19:39:06 +01:00
Fabien 'egg' O'Carroll
4e326123d3
Updated Offers related tables (#13609)
no-issue

* Removed NOT_NULL constraint from stripe_coupon_id

When handling disconnecting from Stripe - we remove all Stripe data from
our database to ensure we do not have bad/invalid data stored. Removing
this constraint will allow us to set the value to NULL.

* Added created_at column to offer_redemptions

Offer Redemptions are not just a joining table, but an event. A created_at
date allows them to be ordered

Because this is in alpha it is simpler to just drop the tables and
re-add them, due to offer_redemptions depending on offers, we also drop
this table and re-add it.
2021-10-20 14:22:37 +02:00
Daniel Lockyer
1fd980ee9b Set global Luxon timezone override to UTC
refs https://linear.app/tryghost/issue/CORE-113/start-off-luxon-refactor

- we're planning on switching to Luxon for our date/timezone library,
  eventually replacing `moment` and `moment-timezone`
- the first step is to set the global timezone override to UTC, which is
  done in `core/server/overrides.js`
- also adds a test to ensure we're setting the timezone correctly
- this was mostly pulled from https://moment.github.io/luxon/#/zones?id=changing-the-default-zone
2021-10-20 09:19:29 +02:00
Naz
393280b6ae Reworked LocalFileStore methods to use async syntax
refs https://linear.app/tryghost/issue/CORE-1/multiple-adapters-per-type

- While digging around this area refactored the code to use more readable async/await syntax instead of chaining then's
- Dropped unneeded "catch" block in save method as all it was doing was rethrowing an error with out additional handling
2021-10-20 10:29:46 +04:00
Naz
51b78211c5 Renamed bootstrap to routerManager
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- A follow up rename after bootstrap module was transformed into class
2021-10-19 07:29:09 +13:00
Naz
979474a8cc Refactored bootstrap module into RouterManager class
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- The "bootstrap" didn't give enough credit to everything this module was doing - it's responsible for managing correct initialization and reinitialization of the frontend Routes as well as passing router creation information back to the frontend's URL service
- The refactor is done in two steps - the "bootstrap.js" will be renamed in the follow-up commit to have a clean history of how the file evolved
2021-10-19 07:29:09 +13:00
Naz
098891ee9a Removed bootstrap module dependency from frontend routers
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- "routerCreated" call was causing a need to create a dependency on the frontend Router level which didn't fit nicely with the refactor of the bootstrap into a class, it's also makes way more sense having it as an independent parameter instead of a call on a module (makes testing way more readable too!)
2021-10-19 07:29:09 +13:00
Naz
6e075c78bf Moved URL service to backend
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- URL module is part of the backend heavily dependent on the model and fits perfectly here. Frontend should get the data it needs by passing a URL manager instance to it
2021-10-19 07:29:09 +13:00
Naz
18344a16e2 Removed event chain caused by settings date update
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- The 'settings.timezone.edited' event triggers a roundtrip chain of calls in the frontend routing to the url services. It was all handled by event listeners and handler that clearly don't belong there.
- Extracted event realted listeners/handlers into methods and moved most of the logic to the "bootstrap" module, which soon is going to become a "RoutesManger"
- The result of this refactor - no more events going back and forth between frontend routing and the backend!
2021-10-19 07:29:09 +13:00
Naz
3bca65d868 Removed unnecessary checks in unit test suites
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- These modules have nothing to do with "events"! There's no reason to test for something that would not ever happen
2021-10-19 07:29:09 +13:00
Naz
597ec51afb Removed 'router.created' event emmision from forntend routers
refs https://linear.app/tryghost/issue/CORE-104/decouple-frontend-routing-events-from-urlserver-events

- The 'router.created' event should eventually be killed. For now the aim is to create a clear communication pathway between frontend's routing module and the URL service (similar to the frontend bridge concept on the "server" side)
2021-10-19 07:29:09 +13:00
Hannah Wolfe
7280f82722
Moved core/shared/i18n to theme-engine/i18n
- core/shared/i18n is no longer used. Remove it to prevent temptation!
- this class needs merging with the one in themes, but for now just co-locate them as that's quicker and easier
2021-10-15 20:25:56 +01:00
Hannah Wolfe
67821a7bc7
Removed remaining usage of i18n & translation file
refs https://github.com/TryGhost/Ghost/issues/13380

- Now that i18n.t has been removed everywhere, we can cleanup the final usages
- Still TODO: merge the i18n logic into themeI18n, and get rid of shared/i18n entirely
2021-10-15 11:39:07 +01:00
Hannah Wolfe
48057ce7a8
Improved match helper tests
- Some of the implicit equals tests were wrong.
- Added some object and array tests whilst here.
2021-10-15 09:51:00 +01:00
Hannah Wolfe
981f11da95
Added basic {{match}} helper
refs: https://github.com/TryGhost/Team/issues/759

- The match helper allows for basic equals and not equals comparisons,
Example:
  {{match title "=" "Getting Started"}}
  {{match slug "!=" "welcome"}}
- There's a lot more functionality we want to add here, so that it ends up being a replacement for {{#has}}
- However, this first iteration is already useful, especially in the context of custom theme settings
- Therefore we are adding it early, and will document it along with custom theme settings when that goes GA very soon
2021-10-14 19:36:56 +01:00
Kevin Ansfield
d7ae6e0138 Added image as an allowed custom theme setting type
refs https://github.com/TryGhost/Team/issues/1107

- updated schema validation to allow `'image'` through as a known setting type now that Admin has support
- added transformation of setting values for `'image'` types because they will be URLs and should be stored with `__GHOST_URL__`
2021-10-14 18:41:54 +01:00
Hannah Wolfe
cd765e2393
Added implicit equals support to match helper
refs: https://github.com/TryGhost/Team/issues/759

- This allows for {{match x y}} to work without having to supply an "=" sign explicitly
2021-10-14 16:29:42 +01:00
Hannah Wolfe
fbc23459fc
Added full SafeString handling to match helper
refs: https://github.com/TryGhost/Team/issues/759

- No matter what, a handlebars helper outputs a string. So if you return true, you'll always get 'true'.
- SafeStrings are handlebars's way of passing around a string whilst also maintaining a record of the original value e.g. new SafeString(true) results in {string: true}
- We need this for the match helper, so that we know when doing a comparison that we're meant to be comparing against a boolean true, not a string true
- Therefore, we need to putput SafeStrings, but also process them when passed in

The logic
- Figuring out the correct logic here has been a little tricky but essentially:
  - {{match safestring}} with a single arg, will return true for any truthy value
  - {{match safestring "=" true}} does a direct comparison with the original value of the safe string, so if it was a boolean true, the match will be true else false
  - {{match (match something) "=" true}} will therefore work for any level of nesting
  - this can result in slightly inconsistent results, but feels correct and documentable

This is documented extensively through the test cases
2021-10-14 16:29:41 +01:00
Naz
fead0e3dcf Decoupled frontend rss service from the url service
refs https://linear.app/tryghost/issue/CORE-103/decouple-internal-frontend-code-from-url-module

- We need to decouple all frontend services from URL service as much as possible. "bootstrap" module is now a central point to substitute (proxy really) function previously done by the URL service and this move changes direct usage of URL service to "bootstraps" internal proxy function
2021-10-14 05:55:49 +13:00
Naz
add30f3d5b Decoupled frontend routing from url service
refs https://linear.app/tryghost/issue/CORE-103/decouple-internal-frontend-code-from-url-module

- By becoming a parameter in the routing bootstrap process URL is Service no longer a "require" inside the frontend controllers but rather becomes a part of the "internal API" of the bootstrapper. This is not the end form of it, rather a step closer to decouplint routing from the URL serivce.
- The bootstrap module needs a facelift to have cleaner distinction between init/start methods. This is left for another time
2021-10-14 05:55:49 +13:00
Kevin Ansfield
7cb93be60b Added boolean as allowed custom theme setting type
refs https://github.com/TryGhost/Team/issues/1106

- updated schema validation to add `'boolean'` as an allowed `type` value
- added `format()` and `parse()` methods to `CustomThemeSetting` model to match `Settings` model behaviour for boolean-type settings
2021-10-13 17:25:32 +01:00
Fabien O'Carroll
b93e7d7f7c Added offer_redemptions table to database
refs https://github.com/TryGhost/Team/issues/1132

This will be used to store Offer Redemptions, which will be used to list
the Offers which a Member has redeemed, as well as the number of times
an Offer has been redeemed.
2021-10-13 17:37:39 +02:00
Fabien 'egg' O'Carroll
b48c16c118
Added active column to offers table (#13592)
refs https://github.com/TryGhost/Team/issues/1131

This will be used as a flag to determine whether or not an Offer is
archived or active.
2021-10-12 15:20:45 +02:00
Hannah Wolfe
4ba372d813
Removed accidentally duplicated tests
- this was a result of a bad rebase, these tests should only exist once in their new form
2021-10-11 15:19:55 +01:00
Naz
1530cb28a5 Simplified Notification's service constructor
refs https://linear.app/tryghost/issue/CORE-64/resolve-undissmissable-update-notification-banners

- There's no need to pass a whole "version object" when all we need it a string in a full version format inside the module
2021-10-11 16:04:48 +02:00
Naz
c0d59db5be Added filtering of outdated custom notifications
refs https://linear.app/tryghost/issue/CORE-64/resolve-undissmissable-update-notification-banners
refs https://github.com/TryGhost/Team/issues/754
refs https://github.com/TryGhost/Team/issues/204
refs https://github.com/TryGhost/Ghost/issues/10236

- Custom notifications coming form the update check service should not be shown beyond instance's update. Once the notification is received it's marked with the current version number. With an instance upgrade all notification with older version should be hidden.
- This improvement should also resolve the problem of major version notifications with next major update (the code associated with https://github.com/TryGhost/Ghost/issues/10236 can then be removed after 5.0.1)
2021-10-11 16:04:48 +02:00
Naz
d948be5bcb Grouped "browse" unit tests together
refs https://linear.app/tryghost/issue/CORE-64/resolve-undissmissable-update-notification-banners

- Before making changes + adding more tests to the notifications test suite grouped related "browse" tests into a describe block. Housekeeping :)
2021-10-11 16:04:48 +02:00
Naz
8737ec8888 Added createdAtVersion property to newly created notifications
refs https://linear.app/tryghost/issue/CORE-64/resolve-undissmissable-update-notification-banners

- The property is meant to track Ghost instance version the notification was received and processed at.
- This information should be useful in the future to dismiss outdated notifications
2021-10-11 23:38:40 +13:00
Naz
53ae852a0e Added checks for notification properties
refs https://linear.app/tryghost/issue/CORE-64/resolve-undissmissable-update-notification-banners

- Before introducing new properties made sure existing ones were well understood and tested in a basic way
2021-10-11 23:38:40 +13:00
Aleksander Chromik
48ac52800b
Replaced i18n.t w/ tpl in core/server/lib/image (#13507)
refs: #13380

- The i18n package is deprecated. It is being replaced with the tpl package.

Co-authored-by: Aleksander Chromik <aleksander.chromik@footballco.com>
2021-10-08 15:44:13 +01:00
Naz
e69fa71584 Added basic unit test to cover notifications' service add method
refs https://linear.app/tryghost/issue/CORE-64/resolve-undissmissable-update-notification-banners

- We aim for full unit test coverage in our libraries and services. The very basic method coverage was missing so adding it!
2021-10-07 18:18:28 +02:00
Naz
c65e62b7df Promoted email-only feature to general availability
closes https://github.com/TryGhost/Team/issues/1125
refs 3c822e0457

- Email-only is not considered a general availability feature and can be used without special flags.
- It allows to publish a new post type "email only" that only goes out as an email newletter and is available through an undescoverable URL (does not appear anywhere publicly similarly to preview posts) on the site.
2021-10-07 12:08:56 +02:00
Hannah Wolfe
f5f24d9cbc
Removed 2 test files that weren't deleted when moved
refs: 95d27e7f5

- My IDE is messing me about today, I moved these two files into test/unit/frontend/services in 95d27e7f5
2021-10-06 12:17:26 +01:00
Hannah Wolfe
9e96b04542
Moved server unit tests into the server folder
- this is a small part of a bit of cleanup of our test files
- the goal is to make the existing tests clearer with a view to making it easier to write more tests
- this makes the test structure follow the codebase structure more closely
- eventually we will colocate the tests as we break the codebase down further
2021-10-06 12:01:09 +01:00
Hannah Wolfe
95d27e7f58
Moved frontend unit tests into their own folder
- this is a small part of a bit of cleanup of our test files
- the goal is to make the existing tests clearer with a view to making it easier to write more tests
- this makes the test structure follow the codebase structure more closely
- eventually we will colocate the frontend tests with the frontend code
2021-10-06 11:58:29 +01:00
Naz
e3b56dd99f 🐛 Fixed immediately sent email when scheduling email-only post
closes https://linear.app/tryghost/issue/CORE-78/email-only-scheduling-should-work-the-same-way-as-regular-posts

- The email was going out at the moment of scheduling an email-only post instead of respecting the scheduled time.
2021-10-05 16:42:29 +02:00
Hannah Wolfe
9d7049cd3f
Refactored helper registration code into a service
- The helper registration code is "framework" code and very specific
- At the moment the "theme engine" is full of lots of disparate theme related stuff
- I'm trying to make the frontend framework code clearer and also expand it to  make it more useful
- The helper system now also exposes 3 methods allowing you to register a directory, a helper or an alias
- I've updated the codebase to use these both for our core helpers and for "apps"
2021-10-05 10:04:02 +01:00
Daniel Lockyer
0ec6b425ee
Merged v4.17.1 into main
v4.17.1
2021-10-05 08:33:42 +01:00
Fabien O'Carroll
cda041d424 Moved StripeAPIService to its own service
refs https://github.com/TryGhost/Team/issues/1083

The Offers service is going to need access to the StripeAPIService too,
so we need to move it out of the @tryghost/members-api module and make
it accessible to both.
2021-10-04 19:28:19 +02:00
Naz
5066e65e03 Added validation to redirects config
refs https://linear.app/tryghost/issue/CORE-86/fix-failing-site-instance-when-redirects-file-is-invalid
refs 260a47da83

- Added validation logic to catch redirects files having invalid RegEx expressions when they are introduced into the system (on upload)
- This way the error happening in the refed commit would have not happened as the validator would not have passed it through
- Moved up the "Router" declaration in custom-redirects as it needs to happen before any other bit of logic has a chance to throw
2021-10-04 18:32:40 +02:00
Hannah Wolfe
1bbaf65a22
Removed need for index.js in frontend/helpers
- The index.js file was actually loader code
- It was mainly used by the unit tests, which needed to be rewritten to get each helper individually
2021-10-04 16:46:01 +01:00
Naz
8f5186995d Added unit test coverage for invalid redirects config
refs https://linear.app/tryghost/issue/CORE-86/fix-failing-site-instance-when-redirects-file-is-invalid
refs 260a47da83

- Refed commit was missing a unit test coverage.
- The approach here introduces a new pattern - using `supertest` in unit tests. I've found this to be the most expressive way to test an express app which receives certain middleware dynamically. Because there are very few moving parts the test is still extremely quick to run
2021-10-04 16:44:23 +02:00
Naz
260a47da83 🐛 Fixed 500 when instance has an invalid redirects config
refs https://linear.app/tryghost/issue/CORE-86/fix-failing-site-instance-when-redirects-file-is-invalid

- The site was returning a 500 for all routes whenever an invalid redirects file was uploaded.
- The cause of this issue surfacing was this change - 0962b3ed45 (diff-10784969d51d9abb9d620625a14b31661ff3f98dbfb0ea17186186a8151bacfaL35) . Previously an instance always had some sort of a working router and when the configuration failed it still functioned as an empty redirects router. After the change no router was mounted resulting in a 500
- Test cases fixing the problem will folllow
2021-10-04 15:25:37 +02:00
Hannah Wolfe
b10802f4c6
Updated fixture hash for integrity check
refs: fe2958eb73

Commit fe2958eb73 updated fixtures without updating the integrity hash - not sure how I missed this!
2021-10-04 13:47:12 +01:00
Rishabh Garg
c4cfd1839a
Added offers table (#13381)
refs https://github.com/TryGhost/Team/issues/1088

- adds schema for new offers table
- adds permission fixtures for new offers table
- adds migrations for new table and permissions

Co-authored-by: Fabien O'Carroll <fabien@allou.is>
2021-10-01 12:18:33 +02:00
Naz
99a2f12cb7 Simplified yaml parser to have fewer dependencies
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings
refs 5715aa2155 (diff-48644be82a9b957e5e627bf7b0f2f73cdb1d63851ffad68c7c178c5886495bb8R52-R57)

- Simplified the yaml parser implementation to take in a single parameter, this move will allove to simplify the logic in the route settings + opens a door to unify handling with redirects yaml parsing!
- We loose the "filename" from the error information but that was a generic "routes.yaml" anyway and would be thrown only when somebody uploaded a routes.yaml file (no real added value).
- The debug statement should be moved to contain related filepath+other info to the calling module instead
- An additional error handler was borrowed from the redirects yaml parsing logic that was introduced in a referenced commit - it still makes sense to keep it for routes.yaml configuration
2021-09-30 17:29:43 +02:00
Naz
1ac0ba07de Extracted yarml persed dep out of settings loader
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- Moving internal dependencies to be injected through constructor DI for better testability. This is first step of few more to follow. Not doing it all at once as there's too many thing failing when doing a bulk refactor
2021-09-30 17:29:42 +02:00
Naz
96d075c47d Refactored settings loader to class
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- It's a step to making the module follow class+DI pattern before fully extracting it into an external libarary
- Reminder, doing in Ghost repo instead of substituting big chunks all at once to have clear history of how the service evolved prior to the extraction into external lib!
2021-09-30 17:29:42 +02:00
Naz
a00b994e9e Renamed route loader module to settings-loader
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- The rename was needed to make it something more generic to later fit both routes and redirects setting purposes
2021-09-30 17:29:42 +02:00
Kevin Ansfield
b8e2bb7b6d Allowed custom theme settings to be passed through preview data
refs https://github.com/TryGhost/Team/issues/1097

- added `customThemeSettingKeys` as an argument to `preview.handle()` because we can't know which keys should be allowed through up-front
- added `custom` as a supported setting in the preview header data
  - `custom` should be a JSON object containing any custom theme settings
  - we parse the object but only set properties on `@custom` that are known custom theme setting keys
  - if parsing fails or it's not an object then no custom data is set
- updated `updateLocalTemplateOptions()` to pull `.custom` off of the preview data and pass it through so it's accessible on `@custom` as an override to the saved custom data
2021-09-30 13:23:39 +01:00
Kevin Ansfield
8a17e723a1 Moved usage of preview options from globalTemplateOptions to localTemplateOptions
refs https://github.com/TryGhost/Team/issues/1097

globalTemplateOptions are supposed to be static with localTemplateOptions being merged in per-request, however the per-request preview data was being extracted and set in the global options. Comments suggest that the global data should be static and eventually updated via other means, the usage of the request object to get per-request preview data is working against that.

- adjusted the preview handler to return an object rather than changing properties by reference on a passed in object
- moved preview data fetching out of `getSiteData()` used in `updateGlobalTemplateOptions()` and into `updateLocalTemplateOptions()` so that we're not relying on the request object in `updateGlobalTemplateOptions()`
2021-09-30 12:12:55 +01:00
Kevin Ansfield
4a6bedce7b Fixed theme-engine middleware tests timing out rather than showing failed assertions
no issue

- if any of the assertions in a test failed there was no handling, instead the test just timed out with a timeout error
- wrapping the assertions in a try/catch and calling `done()` with the error object aborts the test immediately and shows a useful assertion failure message
2021-09-30 12:12:55 +01:00
Naz
d4cd1bb865 Refactored ensure settings module into a class with DI
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- Ensure settings had only one method but would benefit from class+DI pattern before extracting it into an outside module.
- The logic is now also less coupled with "routes" and single source/destination paths. It's all configureable instead and might be reused if similar pattern is needed for example with redirect settings defaults.
2021-09-29 20:56:55 +02:00
Hannah Wolfe
fd20f90cca
Divided f/e proxy into true proxy + rendering service
- The original intention of the proxy was to collect up all the requires in our helpers into one place
- This has since been expanded and used in more places, in more ways
- In hindsight there are now multiple different types of requires in the proxy:
   - One: true frontend rendering framework requires (stuff from deep inside theme-engine)
   - Two: data manipulation/sdk stuff, belongs to the frontend, ways to process API data
   - Three: actual core stuff from Ghost, that we wish wasn't here / needs to be passed in a controlled way
- This commit pulls out One into a new rendering service, so at least that stuff is managed independently
- This draws the lines clearly between what's internal to the frontend and what isn't
- It also highlights that the theme-engine needs to be divided up / refactored so that we don't have these deep requires
2021-09-29 13:10:14 +01:00
Naz
0962b3ed45 Made custom-redirects middleware testable
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings
refs 7528ec8c3b

- The way the custom redirects middleware was organized made it extremely hard to unit test it (had to stub the redirects service methods etc). With a new organization it's possible to provide needed redirects configs to the method which makes the actual redirects Router logic testable and the code less coupled with redirects services
- This was meant to be an attempt to extract more of the slow redirects regression tests, which failed. Instead found this weak spot that could be improved and gained:
- shaved 4s of time as two slow regression test cases are now gone
- there's now a base to build upon when getting more coverage for the custom redirects middleware
2021-09-28 22:00:32 +02:00
Naz
dd042d69c9 Moved routing setting hash calculation to backend
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- These were the last bits that had to be moved out of the frontend doing route.yaml related operations
- Next steps will be refactoring a "bag of everything" into smaller modules and reducing dependencies where possible
2021-09-28 04:59:41 +13:00
Naz
95706aa37e Moved validate&yaml-parser modules to backend
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- These modules should be colocated along with the rest of routes.yaml related modules
- They will later be extracted into external modules
2021-09-28 04:59:41 +13:00
Naz
7a91917424 Removed use of 'routes' parameter in route settings loader
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- The only allowed route settings name is 'routes.yaml', which removes a need to parameterize the function as the location is permanent anyway
- Simplifying the function in any possible way before extracting the common bits into an external lib
2021-09-28 04:59:41 +13:00
Naz
ba964c549f Moved route settings "getter" to the backend
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- Frontend is not meant to know about the underlying source of the "routes" configuration, so any reads/edits/validations are being moved into a backend service. This should also simplify the coupling of the backend with the frontend where the latter will get a JSON blob with all needed configuration during the boot
- Nother problem the "get" method had was hiding an underlying function it was doing - reading the file from the filesystem SYNCRONOUSLY. It might be a thing we need to do during the "web" app initialization, but there's no clear need to do this in a sync fassion during the bootup for example. Also having a more explicit name should help :)
2021-09-28 04:59:41 +13:00
Naz
484bb2eea2 Moved default-routes.yaml file to backend
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings
refs c1c9bf0866

- Actions logic related to file system operations (like ensuring files exist) should be done on the backend. Now the route settings initialization logic lives on the backend it makes sense to keep the file closer to the source.
- The move is the opposite to the one refed in the commit with a
difference that the file now lives in "route-settings"
2021-09-28 04:59:41 +13:00
Naz
31e9434466 Moved route settings initialization to backend
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- Actions logic related to file system operations (like ensuring files exist) should be done on the backend. The frontend will be receiving a unified JSON blob config without needing to know about filesystem
2021-09-28 04:59:41 +13:00
Naz
4a47e8d0a8 Changed settings loader module API signature
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- It was not clear from the module signature/usages that the default method is executing synchronously. The change makes it explicit. Knowing if the method is synchronous is helpful to stop possible pefr bottlenecks!
2021-09-28 04:59:41 +13:00
Naz
748ea9540c Refactored routes hash to be a "single" value
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- It's a continuation of simplifying the concept of multiple frontend settings. If there's just one file we support there should be just one hash
2021-09-28 04:59:41 +13:00
Naz
93af11bdec Simplified knowSettings usage
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- 'knowSettings' was based on a "configurable" array of settings that might be configured in Ghost. The multitude never happened! The only setting the frontend takes care of is routes.yaml file (redirects is also kind of a setting but is a separate concept for now).
- Having just one type of file to deal with allows to simplify implementation significantly, which helps before a big refactor
2021-09-28 04:59:41 +13:00
Naz
010db90a51 Removed unused getAll settings method
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- The getAll function was never used. No need to keep it around!
2021-09-28 04:59:41 +13:00
Naz
71e2a06b25 Reworked ensure-settings module to take in singular file path
refs https://linear.app/tryghost/issue/CORE-35/refactor-route-and-redirect-settings

- This is a micro-step towards getting rid of multiple "knownSettings" concept. Since the introduction of an array of knowSettings there was never-ever a need to handle anything but a single `routes.yaml` file. Getting rid of this concept first to have a simpler module. Next step would be getting rid of filesystem reads/writes in the "frontend"
2021-09-28 04:59:41 +13:00
Kevin Ansfield
b6d9bad6dc
Added custom theme settings browse/edit permissions for Administrators (#13361)
refs https://github.com/TryGhost/Team/issues/1070TryGhost/Team#1070

- initial implementation will only allow browse+edit via the API
2021-09-27 09:59:09 +01:00
Kevin Ansfield
57effd9585
Added custom_theme_settings table/model (#13327)
refs https://github.com/TryGhost/Team/issues/1070

- stores values of custom theme settings
  - will be merged with full settings data parsed from themes for API output
  - will be cached and made available for lookup in themes to avoid db roundtrips
- stores type of custom theme settings so we can coerce values and know if the type has changed when syncing
- records will be synced with themes upon activation
2021-09-23 11:51:18 +01:00
Daniel Lockyer
93e4b2eafd 🔒 Fixed remote command injection when using sendmail email transport
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-wfrj-qqc2-83cm
refs https://github.com/advisories/GHSA-48ww-j4fc-435p

- a vulnerability in `nodemailer` means that the `sendmail` transport is
  vulnerable to command injection for flags passed to the `sendmail`
  binary
- updating to the latest version of Nodemailer required creating
  `@tryghost/nodemailer`, which is a wrapper around Nodemailer and
  several plugins that used to be in the core
- this commit switches to using that package, and fixes up some small
  code + test changes
2021-09-17 16:46:51 +01:00
Hannah Wolfe
7d1d6ec6eb
🐛 Fixed error in sitemap with >50k posts (#13317)
closes: CORE-34
refs: https://github.com/TryGhost/Team/issues/1044

- this is a super basic fix, it adds a max nodes concept and limits the node in each sub-sitemap to 50k by default
- this will prevent the error in google console
- a better fix is in progress, but we want to at least solve the errors ASAP
2021-09-17 11:13:42 +01:00
Fabien 'egg' O'Carroll
2dca63eae2
Added temporary database table for analytic events (#13312)
refs https://github.com/TryGhost/Team/issues/1053

This table is going to be completely deleted at some point in the
future. It serves as a persistent datastore for a spike into collection
analytic events for members. We've opted for a generic table, rather
than a table for each event, so that we can push the DB to the limit in
terms of the length of the table, and find out performance issues A$AP
2021-09-17 11:15:21 +02:00
Hannah Wolfe
ba587ba882
Fixed logic bugs in match helper (#13315)
closes: CORE-33

Two bugs:
- lodash isEmpty and handlebars util isEmpty are not the same
- I literally had the truthy and falsy cases the wrong way around 🙈

Notes:
- I have, for now, copied the isEmpty util from handlebars. It's so small it doesn't seem worth trying to require the util right now, although in future it'd be nice if that was easier to do
- Adding the management for the conditional being a SafeString allows the match helper to be a subexpression of itself, I can see this pattern being useful later in combo with the any and all helpers
2021-09-17 09:47:10 +01:00
Hannah Wolfe
38c7f42baf
Improved match helper tests (#13314)
closes: CORE-32

- The match helper is a very logical helper, designed to support many many type of comparison
- The existing test pattern had gotten long and unweildy already and I'd barely scratched the surface
- Introduce a new pattern, that allows for very quickly and easily describing template strings and what their evaluation should be
- This quickly highlights how many broken cases there are right now!

Notes:
- I could have condensed the pattern further with test groups and iterating over to create describe blocks
- I feel the current implementation is the right balance between condensed and legible to make this maintainable
- I could also have used the same pattern for the block helper, but at that point I felt it more important that the logic I was testing was clear, rather than condensed
2021-09-16 17:11:10 +01:00
Daniel Lockyer
d4adae775e v4.14.0
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYUB7mgAKCRDSEYbwtHKV
 rYTGAP9dggMBUTq6+2yLyYHChVMqLez2WS/XmgTdC4mc2tsZzgD+J2/zhRObGYX0
 d54Y39pAw7rPV8Z8md9nCm9olPpE4AM=
 =w206
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTqYa7kNs8D7Oo9dgLSEYbwtHKVrQUCYUB8kwAKCRDSEYbwtHKV
 rTGVAP4wqFwWwQUFUXX4tLbvcLKQalvHQI3soLFneAzZT1M3DQEAtWO+crkH2auN
 Agt8ND2ndlIzsyGxYywliajBfbQVZwM=
 =nFhH
 -----END PGP SIGNATURE-----

Merged v4.14.0 into main

v4.14.0
2021-09-14 11:42:21 +01:00
Kevin Ansfield
6875796417 Blocked 0.* IP addresses when making oembed requests
no issue

It was possible for authenticated/trusted admin users to make GET requests to localhost via the oembed service by crafting a redirect that used 0.0.0.0.

- added the 0.* default route/routing block to the private IP regex used to block requests when we're contacting external sites
- added an additional IP or localhost check in the oembed service when fetching bookmark card data
2021-09-14 11:35:14 +01:00
Kevin Ansfield
0294918eb9 Fixed labs service unit tests
refs d735e3a4f3
refs c7972c20a5

- the unit tests are currently tied to the labs service data rather than testing independent behaviour meaning that the test needs to be updated when the particular alpha flag they are tied to gets removed
2021-09-14 10:19:26 +01:00
Daniel Lockyer
2d639ad4a1 Replaced removed Bookshelf findWhere function
- as per https://github.com/bookshelf/bookshelf/wiki/Migrating-from-0.15.1-to-1.0.0#collectionfindwhere, the `findWhere` function was removed
- `find` can be used in combination with `matchFunc` and then checking
  the values against each other to keep the same functionality
- also updates the tests to reflect the change in number of function calls
2021-09-10 16:59:11 +01:00
Daniel Lockyer
7a3725fdbf Fixed settings tests due to Bookshelf update
- Bookshelf now seems to error out when the response is undefined and
  expects something
- this commit updates the test to the same empty response we use
  elsewhere
2021-09-10 16:59:11 +01:00
Rishabh Garg
2272f84cc9
Added beta {{products}} helper for tiers list on post (#13267)
refs https://github.com/TryGhost/Team/issues/1004

- adds new `{{products}}` helper behind `multipleProducts` flag
- `{{products}}` outputs a string with list of products that have access to specific post when used in a post context in theme
- outputs empty string when used out of a post context and without access to `visibility` property
- uses all available posts for a site via the global products data
- updates {{content}} helper cta to use this new helper to show list of tiers with access to post
2021-09-10 09:30:41 +05:30
Rishabh
c7972c20a5 Fixed alpha flag tests
refs 025eb8bd79

`mutipleProducts` has now been moved out of alpha to beta, though the alpha feature tests were still using it to verify alpha behavior. The tests are now updated to use `dashboardTwo` feature as base alpha feature instead.
2021-09-09 17:05:07 +05:30
Naz
4f78bf01a2 Moved default settings population test to regression suite
closes https://github.com/TryGhost/Team/issues/860
refs 5405b6ca7c

- The slow test was running slow because it's not a "unit test" it is testing much more. Moved it to a correct suite - regression which simplified the logic a lot (no need to mock db calls).
- Brought back the 2000ms limit as the bottleneck has been solved
2021-09-01 15:23:57 +04:00
Fabien 'egg' O'Carroll
c7a7828b57
Gave Administrators permission to connect to Stripe (#13228)
refs https://github.com/TryGhost/Team/issues/994

This adds the permission required to connect to Stripe to the
Administrator role, as required by the linked issue.
2021-08-26 11:00:40 +01:00
Fabien 'egg' O'Carroll
2f33292600
Added members_product_events table (#13236)
refs https://github.com/TryGhost/Team/issues/873

This table is to track events related to members be given or having
removed access to products. It will allow us to provide start dates for
access for complimentary members, as well as being able to track access
to products over time, either for individual members or for aggregates.
2021-08-23 16:29:15 +02:00
Naz
70b359923f Fixed failing unit test
refs 9bc5a279ca

- Adds a new post status introduced in the referenced commit.
2021-08-13 10:22:11 +04:00
Naz
755a3a320e Added email_only column to posts_meta table
closes https://github.com/TryGhost/Team/issues/893

- We need a place to store email-only flag and posts_meta is the best place for it
2021-08-05 19:44:35 +12:00
Naz
2fbc1af165 Added email disabling flag to settings records
refs https://github.com/TryGhost/Team/issues/912

- We need a place to persist the email freeze state between instance restarts - settings table record is the best place for it
2021-07-29 20:30:30 +12:00
Thibaut Patel
ba4f8cc857 Added OAuth user data
issue https://github.com/TryGhost/Team/issues/614

- This allows keeping each user oauth data, to compare on future logins
2021-07-27 17:56:07 +02:00
Kevin Ansfield
8d5e7ed695
🐛 Fixed unsubscribed members receiving email when a post is sent to all members (#13181)
refs https://github.com/TryGhost/Team/issues/935

The problem was incorrect operator precedence when multiple statements existed in the filter original filter when we transform it to enforce `subscribed:true` before sending.

- free only - subscribed:true+status:free - no issue
- paid only - subscribed:true+status:-free - no issue
- all - subscribed:true+status:-free,status:free - the ,status:free part is treated as a separate OR statement meaning the subscribed:true is not applied to it and free members that are unsubscribed will receive the email

- extracted the filter transform into a separate function so it can be unit tested
- updated the transform to use `()` for operator precedence, eg: `subscribed:true+(status:-free,status:free)`
- used transform function in `addEmail()` and `getEmailMemberRows()`
- fixed `sent/send` typo in error message
2021-07-26 12:47:03 +01:00
Naz
810b052e01 Removed use of deprecated new Error() syntax
refs 2f1123d6ca
refs 6f1a3e1774

- As per refed commits, we are removing deprecated use of `new Error()` in the codebase
- Exposed few internal from commands module methods for easier testing, otherwise it was turning into neverending mocking show
2021-07-19 21:31:31 +12:00
Naz
a266c64130 Removed use of deprecated new Error() syntax
refs 2f1123d6ca
refs 6f1a3e1774

- As per refed commits, we are removing deprecated use of `new Error()` in the codebase
2021-07-19 21:31:31 +12:00
Naz
648662af93 Reverted "Moved disguised unit tests into regression test suite"
refs bf587d4055

- The change broke regression tests and due to this change being out of
scope of the cycle dicided to rever it and increase the time limit on
unit tests instead
- We should focus on refactoring moving slow unit tests in the next
cleanup period
2021-07-19 13:22:31 +04:00
Naz
bf587d4055 Moved disguised unit tests into regression test suite
no issue

- Two affected unit tests were triggering the "slow unit test" error on CI which gave a clue they were either:
- written badly
OR
- were not unit tests at all

- The latter proved to be true and the tests were moved where they belong - into the regression test suite with much more forgiving running itme constraints.
- Unit tests should run quick ALWAYS as that's the first thing that gets triggered before pushing improvements to main. Faster - better.
2021-07-19 12:04:42 +04:00
Naz
8a219f4f72 Fixed slow-running external request test
refs https://github.com/TryGhost/Team/issues/860

- Slow unit tests cause longer waiting time to deliver code to main. Before this fix the test was taking a whooping 6s on average
- The main cause of the delay was a downstream's package (got) default retry logic that was taking up a lot of time. The test is meant to check a "500" response handling not a retry logic, so disabling it for this specific test makes sense
2021-07-15 15:21:33 +04:00
Naz
84d0815e47 Refactored scheduling default test to use nock
refs https://github.com/TryGhost/Team/issues/860

- `nock` has been used in other similar unit tests. It was proven to have easy to understand and use API. By not making up custom code through express/httpServer stuff we reduce the amount of boilerplate code significantly - makes tests a lot more readable
- Bonus, removes couplint dependency to "shared" express module
2021-07-15 14:07:11 +04:00
Naz
5ea8e9b926 Removed use of deprecated new Error() syntax
refs 2f1123d6ca
refs 6f1a3e1774

- As per refed commits, we are removing deprecated use of `new Error()` in the codebase
- This bit cleans up the rest of `new Error()` usage in MEGA service
2021-07-14 19:17:35 +04:00
Naz
b045112950 Renamed exposed _getEmailMemberRows in mega
no issue

- Exposing internal methods out of the module is a non-standard practice. Adding `_` prefix allows to signal that this method is not for general use.
- When mega is refactored into a proper class this method will become exposed anyways
2021-07-14 18:56:57 +04:00
Naz
f343e73c92 Removed use of deprecated new Error() syntax
refs 2f1123d6ca
refs 6f1a3e1774

- As per refed commits, we are removing deprecated use of `new Error()` in the codebase
- This bit cleans up `new Error()` usage in MEGA service
2021-07-14 18:44:25 +04:00
Naz
3b7042545a Fixed typo 2021-07-14 13:23:15 +04:00
Hannah Wolfe
c29c118fcf
Moved labs utlity to shared
- This isn't really a "service" - it's a set of utilities for working with labs flags
- It's also required all over the place, and doesn't require anything that isn't shared
- Therefore, it should live in shared
2021-07-08 09:05:41 +01:00
Hannah Wolfe
8d38957bd7
Revert "Moved labs utlity to shared"
This reverts commit 782de52678.
2021-07-08 07:09:13 +01:00
Hannah Wolfe
782de52678
Moved labs utlity to shared
- This isn't really a "service" - it's a set of utilities for working with labs flags
- It's also required all over the place, and doesn't require anything that isn't shared
- Therefore, it should live in shared
2021-07-07 21:41:34 +01:00
Kevin Ansfield
69bc5a9dfd Fixed error when requesting resize of a blank image
closes https://github.com/TryGhost/Team/issues/819

- adds guard for an empty buffer when reading file from storage for resizing, if a blank image is loaded then redirect to the original file
2021-07-07 19:11:24 +01:00
Naz
dfe1089ee2 Bumped default API version export to be canary/v4
refs https://github.com/TryGhost/Team/issues/856

- The default internal version of the API is expected to be the latest one available which is v4/canary at the moment.
- There will be more information posted in the referenced issue later around how to approach the "default version", for now it's just a change to make a small step into a right direction.
2021-07-07 18:44:21 +04:00
Hannah Wolfe
f08a55c21f
Renamed tests to .test.js & updated commands
refs: https://github.com/TryGhost/Team/issues/856
refs: https://github.com/TryGhost/Team/issues/756

- The .test.js extension is better than _spec.js as it's more obvious that it's an extension
- It also meaans we can use the --extension parameter in mocha, which should result in a better default behaviour for `yarn test`
- It also highlights that some of our tests were named incorrectly and were not (and still will not be) run (see https://github.com/TryGhost/Team/issues/856)
- Note: even with this change, `yarn test` is throwing errors, I believe because of this issue https://github.com/TryGhost/Team/issues/756
2021-07-06 20:45:01 +01:00