[pull] main from TryGhost:main

apps/admin-x-framework/src/api/config.ts

@@ -74,6 +74,10 @@ export type Config = {
         disabled: boolean;
         error?: string;
       };
+      limitCustomFields?: {
+        disabled: boolean;
+        error?: string;
+      };
       publicSiteAccess?: {
         disabled: boolean;
         // Copy shown in the pre-launch banner when public site access is disabled.

apps/admin-x-framework/src/api/images.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { createMutation } from '../utils/api/hooks';
 
 export interface ImagesResponseType {
@@ -18,4 +19,10 @@ export const useUploadImage = createMutation<ImagesResponseType, { file: File }>
   },
 });
 
-export const getImageUrl = (response: ImagesResponseType) => response.images[0].url;
+const UploadedImageResponseSchema = z.object({
+  // Storage adapters may return relative paths as well as absolute URLs.
+  images: z.array(z.object({ url: z.string().min(1) })).min(1),
+});
+
+export const getImageUrl = (response: unknown): string =>
+  UploadedImageResponseSchema.parse(response).images[0].url;

apps/admin-x-framework/src/api/member-custom-fields.ts

@@ -1,6 +1,7 @@
 import {
   FIELD_TYPES,
   FIELD_TYPE_IDS,
+  type MemberAccess,
   partTypesOf,
   subFieldsOf,
   type FieldKind,
@@ -37,10 +38,48 @@ export type MemberCustomField = {
   // Browse hides archived fields by default (most surfaces only want active
   // ones); Settings opts in via filter and splits on this.
   status: 'active' | 'archived';
+  access: { member: MemberCustomFieldAccess };
   created_at: string;
   updated_at: string | null;
 };
 
+// The levels themselves are the shared vocabulary; what a publisher is told they mean
+// is presentation, and stays below.
+export type MemberCustomFieldAccess = MemberAccess;
+
+export const MEMBER_CUSTOM_FIELD_ACCESS_OPTIONS: {
+  value: MemberCustomFieldAccess;
+  label: string;
+  description: string;
+}[] = [
+  {
+    value: 'none',
+    label: 'Only staff',
+    description: 'Members never see this field or what you record in it',
+  },
+  {
+    value: 'read',
+    label: 'Members can view',
+    description: 'Shown in their account, but only staff can change it',
+  },
+  {
+    value: 'write',
+    label: 'Members can edit',
+    description: 'Members fill this in and keep it up to date themselves',
+  },
+];
+
+/**
+ * The words a publisher reads for a level.
+ *
+ * A level this build does not know shows as itself rather than falling back to the
+ * closed label: the fallback would tell a publisher a field is staff-only when the
+ * server may be treating it as open, and a label that reassures is worse than one
+ * that reads oddly. Reachable only from a Core newer than this Admin.
+ */
+export const memberAccessLabel = (access: MemberCustomFieldAccess): string =>
+  MEMBER_CUSTOM_FIELD_ACCESS_OPTIONS.find((option) => option.value === access)?.label ?? access;
+
 /**
  * The user-type catalog: the presentation layer over the shared field types.
  *
@@ -323,10 +362,16 @@ export const useBrowseMemberCustomFieldsIncludingArchived = (
 ) =>
   useBrowseMemberCustomFields({ ...options, searchParams: { filter: 'status:[active,archived]' } });
 
-// The backend mints the key from the name, so create takes just a name and a type.
+/** Everything a new field is created from. The backend mints the key from the name. */
+export type NewMemberCustomField = Pick<MemberCustomField, 'name' | 'type' | 'access'>;
+
+/** A change to one field, addressed by key. Anything omitted is left as it is. */
+export type MemberCustomFieldEdit = Pick<MemberCustomField, 'key'> &
+  Partial<Pick<MemberCustomField, 'name' | 'status' | 'access'>>;
+
 export const useCreateMemberCustomField = createMutation<
   MemberCustomFieldsResponseType,
-  Pick<MemberCustomField, 'name' | 'type'>
+  NewMemberCustomField
 >({
   method: 'POST',
   path: () => '/members/metafields/custom/',
@@ -357,12 +402,12 @@ export const useCreateMemberCustomField = createMutation<
   },
 });
 
-// Keys are immutable after creation (the API rejects changes); `name` and
-// `status` are the editable surface — a status flip to 'active' is how an
-// archived field is reactivated.
+// Keys are immutable after creation (the API rejects changes); `name`, `status` and
+// `access` are the editable surface — a status flip to 'active' is how an archived
+// field is reactivated, and an access change is what opens a field to members.
 export const useEditMemberCustomField = createMutation<
   MemberCustomFieldsResponseType,
-  Pick<MemberCustomField, 'key'> & Partial<Pick<MemberCustomField, 'name' | 'status'>>
+  MemberCustomFieldEdit
 >({
   method: 'PUT',
   path: (field) => `/members/metafields/custom/${field.key}/`,

apps/admin-x-framework/test/unit/api/images.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest';
+import { getImageUrl } from '../../../src/api/images';
+
+describe('getImageUrl', () => {
+  it.each(['https://example.com/image.png', '/content/images/image.png'])(
+    'accepts an uploaded image URL (%s)',
+    (url) => {
+      expect(getImageUrl({ images: [{ url, ref: null }] })).toBe(url);
+    },
+  );
+
+  it.each([
+    null,
+    {},
+    { images: [] },
+    { images: [{}] },
+    { images: [{ url: 123 }] },
+    { images: [{ url: true }] },
+    { images: [{ url: '' }] },
+  ])('rejects a malformed upload response (%j)', (response) => {
+    expect(() => getImageUrl(response)).toThrow();
+  });
+});

apps/admin/src/editor/card-config.test.ts

@@ -119,6 +119,56 @@ describe('buildPostCardConfig', () => {
     expect(cardConfig.deleteSnippet).toBe(ports.deleteSnippet);
   });
 
+  it('carries the site images the social cards fall back to', () => {
+    const cardConfig = buildPostCardConfig(
+      sources({
+        settings: settingsFrom({
+          ...baseSettings,
+          og_image: 'site-og.png',
+          twitter_image: 'site-twitter.png',
+          cover_image: 'cover.png',
+        }),
+      }),
+      ports,
+    );
+
+    expect(cardConfig).toMatchObject({
+      siteOgImage: 'site-og.png',
+      siteTwitterImage: 'site-twitter.png',
+      siteCoverImage: 'cover.png',
+    });
+  });
+
+  it('reports a site image the settings do not carry as none', () => {
+    const cardConfig = buildPostCardConfig(sources(), ports);
+
+    expect(cardConfig).toMatchObject({
+      siteOgImage: null,
+      siteTwitterImage: null,
+      siteCoverImage: null,
+    });
+  });
+
+  it.each([123, true])('ignores non-string site images (%s)', (value) => {
+    const cardConfig = buildPostCardConfig(
+      sources({
+        settings: settingsFrom({
+          ...baseSettings,
+          og_image: value,
+          twitter_image: value,
+          cover_image: value,
+        }),
+      }),
+      ports,
+    );
+
+    expect(cardConfig).toMatchObject({
+      siteOgImage: null,
+      siteTwitterImage: null,
+      siteCoverImage: null,
+    });
+  });
+
   it('drops Unsplash when the integration is off', () => {
     const cardConfig = buildPostCardConfig(
       sources({ settings: settingsFrom({ ...baseSettings, unsplash: false }) }),

apps/admin/src/editor/card-config.ts

@@ -66,6 +66,9 @@ export interface PostCardConfig extends PostCardConfigPorts {
   membersEnabled: boolean;
   siteTitle: string;
   siteDescription: string;
+  siteOgImage: string | null;
+  siteTwitterImage: string | null;
+  siteCoverImage: string | null;
   siteUrl: string;
   siteUuid: string;
   stripeEnabled: boolean;
@@ -99,6 +102,11 @@ export function getCardVisibilitySettings(
   return isPage ? 'web only' : 'web and email';
 }
 
+function imageSetting(settings: Setting[], key: string): string | null {
+  const value = getSettingValue(settings, key);
+  return typeof value === 'string' ? value : null;
+}
+
 export function buildPostCardConfig(
   sources: PostCardConfigSources,
   ports: PostCardConfigPorts,
@@ -124,6 +132,9 @@ export function buildPostCardConfig(
     searchLinks: ports.searchLinks,
     siteTitle: getSettingValue<string>(settings, 'title') ?? '',
     siteDescription: getSettingValue<string>(settings, 'description') ?? '',
+    siteOgImage: imageSetting(settings, 'og_image'),
+    siteTwitterImage: imageSetting(settings, 'twitter_image'),
+    siteCoverImage: imageSetting(settings, 'cover_image'),
     siteUrl: getHomepageUrl(site),
     siteUuid: site.site_uuid,
     stripeEnabled: checkStripeEnabled(settings, config),

apps/admin/src/editor/editor-screen.tsx

@@ -214,6 +214,7 @@ function EditorContent({
           <PostSettingsSidebar
             cardConfig={currentCardConfig}
             currentUser={currentUser}
+            featureImage={featureImage.featureImage}
             hasInlineExcerpt={showExcerpt}
             postType={postType}
             session={session}