Trimmed down Members Admin API response data

refs https://github.com/TryGhost/Arch/issues/87

- The Members Admin API and members.* webhooks were returning too many fields in the nested `newsletters` objects. There was no "allowlist" serializer for the newsletter object, which meant every time we add a new field to the database we would unintentionally return extra fields without a second thought.
- With this change only following fields will be returned with `members[x].newsletters[x]`:
'id',
'name',
'description',
'status'

ghost/core/core/server/api/endpoints/utils/serializers/output/members.js

@@ -1,4 +1,5 @@
 //@ts-check
+const _ = require('lodash');
 const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:members');
 const {unparse} = require('@tryghost/members-csv');
 const mappers = require('./mappers');
@@ -113,6 +114,26 @@ function serializeAttribution(attribution) {
     };
 }
 
+function serializeNewsletter(newsletter) {
+    const newsletterFields = [
+        'id',
+        'name',
+        'description',
+        'status'
+    ];
+
+    return _.pick(newsletter, newsletterFields);
+}
+
+function serializeNewsletters(newsletters) {
+    return newsletters
+        .filter(newsletter => newsletter.status === 'active')
+        .sort((a, b) => {
+            return a.sort_order - b.sort_order;
+        })
+        .map(newsletter => serializeNewsletter(newsletter));
+}
+
 /**
  * @param {import('bookshelf').Model} member
  * @param {object} options
@@ -174,11 +195,7 @@ function serializeMember(member, options) {
     serialized.email_suppression = json.email_suppression;
 
     if (json.newsletters) {
-        serialized.newsletters = json.newsletters
+        serialized.newsletters = serializeNewsletters(json.newsletters);
-            .filter(newsletter => newsletter.status === 'active')
-            .sort((a, b) => {
-                return a.sort_order - b.sort_order;
-            });
     }
     // override the `subscribed` param to mean "subscribed to any active newsletter"
     serialized.subscribed = false;

ghost/core/test/e2e-api/admin/__snapshots__/members-edit-subscriptions.test.js.snap

@@ -385,7 +385,7 @@ exports[`Members API: edit subscriptions Can cancel a subscription for a member
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "4175",
+  "content-length": "3425",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -440,7 +440,7 @@ exports[`Members API: edit subscriptions Can cancel a subscription for a member
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3275",
+  "content-length": "2525",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -495,7 +495,7 @@ exports[`Members API: edit subscriptions Can cancel a subscription for a member
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "4184",
+  "content-length": "3434",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -550,7 +550,7 @@ exports[`Members API: edit subscriptions Can cancel a subscription for a member
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3284",
+  "content-length": "2534",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -850,7 +850,7 @@ exports[`Members API: edit subscriptions Can recover member products when we can
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "4217",
+  "content-length": "3467",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -905,7 +905,7 @@ exports[`Members API: edit subscriptions Can recover member products when we can
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3317",
+  "content-length": "2567",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -960,7 +960,7 @@ exports[`Members API: edit subscriptions Can recover member products when we upd
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "4972",
+  "content-length": "4222",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -1015,7 +1015,7 @@ exports[`Members API: edit subscriptions Can update a subscription for a member
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "4951",
+  "content-length": "4201",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -1070,7 +1070,7 @@ exports[`Members API: edit subscriptions Can update a subscription for a member
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "4950",
+  "content-length": "4200",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,

ghost/core/test/e2e-api/admin/__snapshots__/members-newsletters.test.js.snap

@@ -251,7 +251,7 @@ exports[`Members API - With Newsletters - compat mode Can fetch members who are
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "13628",
+  "content-length": "7972",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -511,7 +511,7 @@ exports[`Members API - With Newsletters Can fetch members who are subscribed 2:
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "13628",
+  "content-length": "7972",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,

ghost/core/test/e2e-api/admin/members.test.js

@@ -67,10 +67,7 @@ async function getNewsletters() {
 }
 
 const newsletterSnapshot = {
-    id: anyObjectId,
+    id: anyObjectId
-    uuid: anyUuid,
-    created_at: anyISODateTime,
-    updated_at: anyISODateTime
 };
 
 const attributionSnapshot = {

ghost/core/test/e2e-api/members/__snapshots__/webhooks.test.js.snap

@@ -38,7 +38,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3300",
+  "content-length": "2550",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -85,7 +85,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3314",
+  "content-length": "2564",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -132,7 +132,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3202",
+  "content-length": "2452",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -179,7 +179,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3362",
+  "content-length": "2612",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -226,7 +226,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3328",
+  "content-length": "2578",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -273,7 +273,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3342",
+  "content-length": "2592",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -320,7 +320,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent with
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3256",
+  "content-length": "2506",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -367,7 +367,7 @@ exports[`Members API Member attribution Creates a SubscriptionCreatedEvent witho
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "3202",
+  "content-length": "2452",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,

ghost/core/test/e2e-webhooks/__snapshots__/members.test.js.snap

@@ -27,38 +27,10 @@ Object {
       "name": "Test Member",
       "newsletters": Array [
         Object {
-          "background_color": "light",
-          "body_font_category": "sans_serif",
-          "border_color": null,
-          "created_at": StringMatching /\\\\d\\{4\\}-\\\\d\\{2\\}-\\\\d\\{2\\}T\\\\d\\{2\\}:\\\\d\\{2\\}:\\\\d\\{2\\}\\\\\\.000Z/,
           "description": null,
-          "feedback_enabled": false,
-          "footer_content": null,
-          "header_image": null,
           "id": StringMatching /\\[a-f0-9\\]\\{24\\}/,
           "name": "Default Newsletter",
-          "sender_email": null,
-          "sender_name": null,
-          "sender_reply_to": "newsletter",
-          "show_badge": true,
-          "show_comment_cta": true,
-          "show_feature_image": true,
-          "show_header_icon": true,
-          "show_header_name": true,
-          "show_header_title": true,
-          "show_latest_posts": false,
-          "show_post_title_section": true,
-          "show_subscription_details": false,
-          "slug": "default-newsletter",
-          "sort_order": 0,
           "status": "active",
-          "subscribe_on_signup": true,
-          "title_alignment": "center",
-          "title_color": null,
-          "title_font_category": "sans_serif",
-          "updated_at": StringMatching /\\\\d\\{4\\}-\\\\d\\{2\\}-\\\\d\\{2\\}T\\\\d\\{2\\}:\\\\d\\{2\\}:\\\\d\\{2\\}\\\\\\.000Z/,
-          "uuid": StringMatching /\\[a-f0-9\\]\\{8\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{12\\}/,
-          "visibility": "members",
         },
       ],
       "note": "test note",
@@ -100,38 +72,10 @@ Object {
       "name": "Test Member2",
       "newsletters": Array [
         Object {
-          "background_color": "light",
-          "body_font_category": "sans_serif",
-          "border_color": null,
-          "created_at": StringMatching /\\\\d\\{4\\}-\\\\d\\{2\\}-\\\\d\\{2\\}T\\\\d\\{2\\}:\\\\d\\{2\\}:\\\\d\\{2\\}\\\\\\.000Z/,
           "description": null,
-          "feedback_enabled": false,
-          "footer_content": null,
-          "header_image": null,
           "id": StringMatching /\\[a-f0-9\\]\\{24\\}/,
           "name": "Default Newsletter",
-          "sender_email": null,
-          "sender_name": null,
-          "sender_reply_to": "newsletter",
-          "show_badge": true,
-          "show_comment_cta": true,
-          "show_feature_image": true,
-          "show_header_icon": true,
-          "show_header_name": true,
-          "show_header_title": true,
-          "show_latest_posts": false,
-          "show_post_title_section": true,
-          "show_subscription_details": false,
-          "slug": "default-newsletter",
-          "sort_order": 0,
           "status": "active",
-          "subscribe_on_signup": true,
-          "title_alignment": "center",
-          "title_color": null,
-          "title_font_category": "sans_serif",
-          "updated_at": StringMatching /\\\\d\\{4\\}-\\\\d\\{2\\}-\\\\d\\{2\\}T\\\\d\\{2\\}:\\\\d\\{2\\}:\\\\d\\{2\\}\\\\\\.000Z/,
-          "uuid": StringMatching /\\[a-f0-9\\]\\{8\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{12\\}/,
-          "visibility": "members",
         },
       ],
       "note": "test note2",
@@ -171,38 +115,10 @@ Object {
       "name": "Ghost",
       "newsletters": Array [
         Object {
-          "background_color": "light",
-          "body_font_category": "sans_serif",
-          "border_color": null,
-          "created_at": StringMatching /\\\\d\\{4\\}-\\\\d\\{2\\}-\\\\d\\{2\\}T\\\\d\\{2\\}:\\\\d\\{2\\}:\\\\d\\{2\\}\\\\\\.000Z/,
           "description": null,
-          "feedback_enabled": false,
-          "footer_content": null,
-          "header_image": null,
           "id": StringMatching /\\[a-f0-9\\]\\{24\\}/,
           "name": "Default Newsletter",
-          "sender_email": null,
-          "sender_name": null,
-          "sender_reply_to": "newsletter",
-          "show_badge": true,
-          "show_comment_cta": true,
-          "show_feature_image": true,
-          "show_header_icon": true,
-          "show_header_name": true,
-          "show_header_title": true,
-          "show_latest_posts": false,
-          "show_post_title_section": true,
-          "show_subscription_details": false,
-          "slug": "default-newsletter",
-          "sort_order": 0,
           "status": "active",
-          "subscribe_on_signup": true,
-          "title_alignment": "center",
-          "title_color": null,
-          "title_font_category": "sans_serif",
-          "updated_at": StringMatching /\\\\d\\{4\\}-\\\\d\\{2\\}-\\\\d\\{2\\}T\\\\d\\{2\\}:\\\\d\\{2\\}:\\\\d\\{2\\}\\\\\\.000Z/,
-          "uuid": StringMatching /\\[a-f0-9\\]\\{8\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{4\\}-\\[a-f0-9\\]\\{12\\}/,
-          "visibility": "members",
         },
       ],
       "note": "test note3",

ghost/core/test/e2e-webhooks/members.test.js

@@ -3,10 +3,7 @@ const {anyGhostAgent, anyObjectId, anyISODateTime, anyUuid, anyContentVersion, a
 
 const buildNewsletterSnapshot = () => {
     const newsLetterSnapshot = {
-        id: anyObjectId,
+        id: anyObjectId
-        uuid: anyUuid,
-        created_at: anyISODateTime,
-        updated_at: anyISODateTime
     };
 
     return newsLetterSnapshot;