Replaced offer serializer with mapper (#15028)

closes https://github.com/TryGhost/Team/issues/1623

The offers API endpoint had it's own custom serializer pattern, which didn't fit well with how the API is meant to work.

- refactored the offer data format returned by internal api controller to match other controllers
- removed custom serializer for offers, instead adds a mapper to follow consistent pattern for all apis
- adds explicit allowlist for offers content API data

core/server/api/endpoints/offers-public.js

@@ -20,8 +20,8 @@ module.exports = {
                 });
             }
 
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     }

core/server/api/endpoints/offers.js

@@ -16,8 +16,8 @@ module.exports = {
         permissions: true,
         async query(frame) {
             const offers = await offersService.api.listOffers(frame.options);
-            frame.response = {
-                offers
+            return {
+                data: offers
             };
         }
     },
@@ -33,8 +33,8 @@ module.exports = {
                 });
             }
 
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     },
@@ -57,8 +57,8 @@ module.exports = {
                 });
             }
 
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     },
@@ -70,8 +70,8 @@ module.exports = {
         },
         async query(frame) {
             const offer = await offersService.api.createOffer(frame.data.offers[0]);
-            frame.response = {
-                offers: [offer]
+            return {
+                data: [offer]
             };
         }
     }

core/server/api/endpoints/utils/serializers/output/index.js

@@ -125,10 +125,6 @@ module.exports = {
         return require('./session');
     },
 
-    get offers() {
-        return require('./offers');
-    },
-
     get members_stripe_connect() {
         return require('./members-stripe-connect');
     }

core/server/api/endpoints/utils/serializers/output/mappers/index.js

@@ -10,6 +10,7 @@ module.exports = {
     settings: require('./settings'),
     snippets: require('./snippets'),
     tags: require('./tags'),
+    offers: require('./offers'),
     newsletters: require('./newsletters'),
     users: require('./users')
 };

core/server/api/endpoints/utils/serializers/output/mappers/offers.js

@@ -0,0 +1,28 @@
+const utils = require('../../../index');
+
+module.exports = (model, frame) => {
+    // Offer data is already returned as json via members service
+    const jsonModel = model;
+
+    if (utils.isContentAPI(frame)) {
+        const serialized = {
+            id: jsonModel.id,
+            name: jsonModel.name,
+            display_title: jsonModel.display_title,
+            display_description: jsonModel.display_description,
+            type: jsonModel.type,
+            cadence: jsonModel.cadence,
+            amount: jsonModel.amount,
+            duration: jsonModel.duration,
+            duration_in_months: jsonModel.duration_in_months,
+            currency_restriction: jsonModel.currency_restriction,
+            currency: jsonModel.currency,
+            status: jsonModel.status,
+            tier: jsonModel.tier
+        };
+
+        return serialized;
+    }
+
+    return jsonModel;
+};

core/server/api/endpoints/utils/serializers/output/offers.js

@@ -1,16 +0,0 @@
-const debug = require('@tryghost/debug')('api:endpoints:utils:serializers:output:offers');
-const utils = require('../../index');
-
-module.exports = {
-    all(_models, _apiConfig, frame) {
-        debug('all');
-        // Offers has frame.response already set
-
-        // Cleanup response for content API
-        // TODO: remove and set explicit allowlist when moved to mapper
-        if (utils.isContentAPI(frame) && frame.response?.offers?.[0]) {
-            delete frame.response.offers[0].redemption_count;
-            delete frame.response.offers[0].code;
-        }
-    }
-};