From ba1a92a2b0b430cbd1572155b1b70d55dd79928a Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 12:25:09 +0300
Subject: [PATCH 01/11] =?UTF-8?q?=E2=9C=A8=20Added=20editor=20presence=20i?=
 =?UTF-8?q?ndicator=20behind=20editorPresence=20labs=20flag?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Shows avatars of staff currently editing a post in the editor header
and on each post-list row. SSE-based, gated by the editorPresence
labs flag. State and event bus live in-process on PostPresenceService
— Ghost(Pro) is single-tenant per site so no Redis or cross-process
plumbing is needed.

Avatars fade (idle) at 90s of API silence and are removed at 180s.
Explicit enter/leave POSTs handle in-app navigation; a pagehide
beacon (with fetch keepalive fallback) handles tab close. TTL is
the safety net.

The cleanup timer starts lazily on the first mark, so a process
with no active editors does no presence work.
---
 .../advanced/labs/private-features.tsx        |   4 +
 .../app/components/gh-presence-avatars.hbs    |  27 ++
 .../app/components/gh-presence-avatars.js     |  50 ++++
 .../posts-list/list-item-analytics.hbs        |   5 +
 ghost/admin/app/routes/lexical-editor/edit.js |  19 ++
 ghost/admin/app/services/feature.js           |   1 +
 ghost/admin/app/services/presence.js          | 167 ++++++++++++
 ghost/admin/app/services/session.js           |   9 +
 ghost/admin/app/styles/app.css                |   1 +
 .../styles/components/presence-avatars.css    | 101 ++++++++
 ghost/admin/app/styles/layouts/editor.css     |   2 +-
 ghost/admin/app/templates/lexical-editor.hbs  |  19 +-
 ghost/core/core/server/api/endpoints/posts.js |  30 ++-
 .../server/services/post-presence/index.js    |   6 +
 .../post-presence/post-presence-service.js    | 245 ++++++++++++++++++
 .../api/endpoints/admin/lib/presence-enter.js |  29 +++
 .../api/endpoints/admin/lib/presence-leave.js |  24 ++
 .../endpoints/admin/lib/presence-stream.js    |  90 +++++++
 .../server/web/api/endpoints/admin/routes.js  |   8 +
 ghost/core/core/shared/labs.js                |   3 +-
 20 files changed, 830 insertions(+), 10 deletions(-)
 create mode 100644 ghost/admin/app/components/gh-presence-avatars.hbs
 create mode 100644 ghost/admin/app/components/gh-presence-avatars.js
 create mode 100644 ghost/admin/app/services/presence.js
 create mode 100644 ghost/admin/app/styles/components/presence-avatars.css
 create mode 100644 ghost/core/core/server/services/post-presence/index.js
 create mode 100644 ghost/core/core/server/services/post-presence/post-presence-service.js
 create mode 100644 ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
 create mode 100644 ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js
 create mode 100644 ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js

diff --git a/apps/admin-x-settings/src/components/settings/advanced/labs/private-features.tsx b/apps/admin-x-settings/src/components/settings/advanced/labs/private-features.tsx
index 321f382936d..c8c45a8c715 100644
--- a/apps/admin-x-settings/src/components/settings/advanced/labs/private-features.tsx
+++ b/apps/admin-x-settings/src/components/settings/advanced/labs/private-features.tsx
@@ -67,6 +67,10 @@ const features: Feature[] = [{
     title: 'LLMs.txt',
     description: 'Serve llms.txt, per-entry markdown exports, and Accept: text/markdown content negotiation for AI and LLM tooling',
     flag: 'llmsTxt'
+}, {
+    title: 'Editor presence',
+    description: 'Show avatars in the editor header and the post list for staff currently editing a post.',
+    flag: 'editorPresence'
 }];
 
 const AlphaFeatures: React.FC = () => {
diff --git a/ghost/admin/app/components/gh-presence-avatars.hbs b/ghost/admin/app/components/gh-presence-avatars.hbs
new file mode 100644
index 00000000000..fe635a1ee61
--- /dev/null
+++ b/ghost/admin/app/components/gh-presence-avatars.hbs
@@ -0,0 +1,27 @@
+{{#if this.users.length}}
+    <div class="gh-presence-avatars {{this.sizeClass}}" data-test-presence-avatars={{@postId}}>
+        {{#each this.users as |user|}}
+            <div
+                class="gh-presence-avatar gh-tooltip-trigger tooltip-bottom no-shortcut {{if user.isIdle "gh-presence-avatar--idle"}}"
+                data-test-presence-avatar={{user.id}}
+                data-test-presence-idle={{if user.isIdle "true" "false"}}
+            >
+                {{#if user.profileImage}}
+                    <img src={{user.profileImage}} alt={{user.name}} />
+                {{else}}
+                    <span class="gh-presence-avatar-initials">{{user.initials}}</span>
+                {{/if}}
+                <GhTooltip @text={{user.tooltipText}} />
+            </div>
+        {{/each}}
+        {{#if this.overflowCount}}
+            <span
+                class="gh-presence-avatars-overflow gh-tooltip-trigger tooltip-bottom no-shortcut"
+                data-test-presence-overflow={{this.overflowCount}}
+            >
+                +{{this.overflowCount}}
+                <GhTooltip @text={{this.overflowTooltip}} />
+            </span>
+        {{/if}}
+    </div>
+{{/if}}
diff --git a/ghost/admin/app/components/gh-presence-avatars.js b/ghost/admin/app/components/gh-presence-avatars.js
new file mode 100644
index 00000000000..492958b4790
--- /dev/null
+++ b/ghost/admin/app/components/gh-presence-avatars.js
@@ -0,0 +1,50 @@
+import Component from '@glimmer/component';
+import {inject as service} from '@ember/service';
+
+// Smaller cap in the editor header — that row uses flex-wrap and a
+// fixed height, so a stack wider than the available space wraps and
+// overlaps page content. Post-list rows have a dedicated row of width
+// per item and can comfortably hold one more.
+const CAP_BY_SIZE = {md: 2, sm: 3};
+
+export default class GhPresenceAvatars extends Component {
+    @service presence;
+
+    get _allUsers() {
+        return this.presence.usersForPost(this.args.postId).map((user) => {
+            const name = user.name || 'Someone';
+            const parts = name.split(/\s+/).filter(Boolean);
+            const firstName = parts[0] || name;
+            const tooltip = firstName.length > 20 ? `${firstName.slice(0, 20)}…` : firstName;
+            return {
+                id: user.id,
+                name,
+                firstName,
+                tooltipText: user.isIdle ? `${tooltip} (idle)` : tooltip,
+                profileImage: user.profileImage || null,
+                isIdle: Boolean(user.isIdle),
+                initials: parts.slice(0, 2).map(part => part[0]).join('').toUpperCase()
+            };
+        });
+    }
+
+    get _cap() {
+        return CAP_BY_SIZE[this.args.size === 'sm' ? 'sm' : 'md'];
+    }
+
+    get users() {
+        return this._allUsers.slice(0, this._cap);
+    }
+
+    get overflowCount() {
+        return Math.max(0, this._allUsers.length - this._cap);
+    }
+
+    get overflowTooltip() {
+        return this._allUsers.slice(this._cap).map(u => u.firstName).join(', ');
+    }
+
+    get sizeClass() {
+        return this.args.size === 'sm' ? 'gh-presence-avatars--sm' : 'gh-presence-avatars--md';
+    }
+}
diff --git a/ghost/admin/app/components/posts-list/list-item-analytics.hbs b/ghost/admin/app/components/posts-list/list-item-analytics.hbs
index d407579512d..96b9b841c3c 100644
--- a/ghost/admin/app/components/posts-list/list-item-analytics.hbs
+++ b/ghost/admin/app/components/posts-list/list-item-analytics.hbs
@@ -330,6 +330,11 @@
             {{/if}}
         </div>
 
+        {{!-- Presence column --}}
+        {{#if (feature 'editorPresence')}}
+            <GhPresenceAvatars @postId={{@post.id}} @size="sm" />
+        {{/if}}
+
         {{!-- Button column --}}
         {{#if @post.hasAnalyticsPage }}
             <a href="#/posts/analytics/{{@post.id}}" class="permalink gh-list-data gh-post-list-button" title="">
diff --git a/ghost/admin/app/routes/lexical-editor/edit.js b/ghost/admin/app/routes/lexical-editor/edit.js
index ee84312433c..9a04641fe01 100644
--- a/ghost/admin/app/routes/lexical-editor/edit.js
+++ b/ghost/admin/app/routes/lexical-editor/edit.js
@@ -5,6 +5,9 @@ import {pluralize} from 'ember-inflector';
 import {inject as service} from '@ember/service';
 export default class EditRoute extends AuthenticatedRoute {
     @service feature;
+    @service presence;
+
+    _activePostId = null;
 
     beforeModel(transition) {
         super.beforeModel(...arguments);
@@ -76,5 +79,21 @@ export default class EditRoute extends AuthenticatedRoute {
     setupController(controller, post) {
         let editor = this.controllerFor('lexical-editor');
         editor.setPost(post);
+        // editor → editor navigation reuses this route instance and does
+        // not fire deactivate. The presence service's enterPost detects
+        // the post id change and sends a leave for the previous post
+        // before entering the new one.
+        this._activePostId = post?.id || null;
+        if (this._activePostId) {
+            this.presence.enterPost(this._activePostId);
+        }
+    }
+
+    deactivate() {
+        super.deactivate(...arguments);
+        if (this._activePostId) {
+            this.presence.leavePost(this._activePostId);
+            this._activePostId = null;
+        }
     }
 }
diff --git a/ghost/admin/app/services/feature.js b/ghost/admin/app/services/feature.js
index a4ebd54af89..f09fcdeff23 100644
--- a/ghost/admin/app/services/feature.js
+++ b/ghost/admin/app/services/feature.js
@@ -69,6 +69,7 @@ export default class FeatureService extends Service {
     @feature('tagsX') tagsX;
     @feature('commentModeration') commentModeration;
     @feature('giftSubscriptions') giftSubscriptions;
+    @feature('editorPresence') editorPresence;
     _user = null;
 
     @computed('settings.labs')
diff --git a/ghost/admin/app/services/presence.js b/ghost/admin/app/services/presence.js
new file mode 100644
index 00000000000..78d1096a364
--- /dev/null
+++ b/ghost/admin/app/services/presence.js
@@ -0,0 +1,167 @@
+import Service, {inject as service} from '@ember/service';
+import fetch from 'fetch';
+import {tracked} from '@glimmer/tracking';
+
+const EVENT_TYPE_SNAPSHOT = 'snapshot';
+const EVENT_TYPE_POST = 'post';
+
+/**
+ * Subscribes to a long-lived SSE stream that pushes presence (who is
+ * editing what) changes to all admin tabs. Holds a tracked map of
+ * postId → users[]; components read via usersForPost(postId) and
+ * re-render automatically.
+ */
+export default class PresenceService extends Service {
+    @service feature;
+    @service ghostPaths;
+    @service session;
+
+    @tracked _byPostId = new Map();
+
+    _source = null;
+    _currentPostId = null;
+    _beforeUnloadHandler = null;
+
+    start() {
+        if (this._source || typeof window === 'undefined' || !window.EventSource) {
+            return;
+        }
+        if (!this.feature.get('editorPresence')) {
+            return;
+        }
+        const streamUrl = this.ghostPaths.url.api('presence', 'stream');
+        try {
+            this._source = new EventSource(streamUrl, {withCredentials: true});
+        } catch (e) {
+            console.warn('[presence] EventSource construction failed', e); // eslint-disable-line no-console
+            return;
+        }
+        this._source.onmessage = event => this._handleMessage(event);
+        this._source.onerror = () => {
+            // EventSource auto-reconnects on transient errors. Terminal
+            // closures (401/403/404) leave readyState === CLOSED; log
+            // those so silent presence failures are debuggable.
+            if (this._source && this._source.readyState === EventSource.CLOSED) {
+                console.warn('[presence] SSE stream closed; not reconnecting'); // eslint-disable-line no-console
+            }
+        };
+
+        // Pagehide covers tab/window close, where the Ember route's
+        // deactivate hook does not fire. TTL is the safety net if the
+        // beacon does not arrive.
+        this._beforeUnloadHandler = () => {
+            const postId = this._currentPostId;
+            if (!postId) {
+                return;
+            }
+            this._sendLeave(postId);
+        };
+        window.addEventListener('pagehide', this._beforeUnloadHandler);
+    }
+
+    stop() {
+        if (this._source) {
+            this._source.close();
+            this._source = null;
+        }
+        if (this._beforeUnloadHandler) {
+            window.removeEventListener('pagehide', this._beforeUnloadHandler);
+            this._beforeUnloadHandler = null;
+        }
+        this._currentPostId = null;
+        this._byPostId = new Map();
+    }
+
+    /**
+     * The user opened a post in the editor. Sends an explicit enter so
+     * peers see the avatar within ~50ms (the read endpoint no longer
+     * marks presence — that would have lit up analytics views too).
+     * If the user was on a different post, leave that one first.
+     */
+    enterPost(postId) {
+        if (!postId) {
+            return;
+        }
+        if (this._currentPostId && this._currentPostId !== postId) {
+            this.leavePost(this._currentPostId);
+        }
+        this._currentPostId = postId;
+        const enterUrl = this.ghostPaths.url.api('presence', 'posts', postId, 'enter');
+        fetch(enterUrl, {method: 'POST', credentials: 'include', keepalive: true})
+            .catch(err => console.warn('[presence] enter failed', err)); // eslint-disable-line no-console
+    }
+
+    leavePost(postId) {
+        if (!postId) {
+            return;
+        }
+        if (this._currentPostId === postId) {
+            this._currentPostId = null;
+        }
+        this._sendLeave(postId);
+    }
+
+    usersForPost(postId) {
+        if (!postId) {
+            return [];
+        }
+        const users = this._byPostId.get(postId) || [];
+        const currentUserId = this.session.user?.id;
+        if (!currentUserId) {
+            return users;
+        }
+        return users.filter(user => user && user.id !== currentUserId);
+    }
+
+    _sendLeave(postId) {
+        const leaveUrl = this.ghostPaths.url.api('presence', 'posts', postId, 'leave');
+        // sendBeacon returns false when the UA's beacon queue is full
+        // (Firefox enforces this); fall through to fetch so the leave
+        // doesn't silently drop.
+        const queued = typeof navigator !== 'undefined'
+            && typeof navigator.sendBeacon === 'function'
+            && navigator.sendBeacon(leaveUrl);
+        if (queued) {
+            return;
+        }
+        fetch(leaveUrl, {method: 'POST', credentials: 'include', keepalive: true})
+            .catch(err => console.warn('[presence] leave failed', err)); // eslint-disable-line no-console
+    }
+
+    _handleMessage(event) {
+        let payload;
+        try {
+            payload = JSON.parse(event.data);
+        } catch (e) {
+            console.warn('[presence] malformed event payload, dropping', event.data); // eslint-disable-line no-console
+            return;
+        }
+
+        if (payload?.type === EVENT_TYPE_SNAPSHOT && Array.isArray(payload.posts)) {
+            const next = new Map();
+            for (const entry of payload.posts) {
+                if (entry?.postId && Array.isArray(entry.users)) {
+                    next.set(entry.postId, entry.users);
+                }
+            }
+            this._byPostId = next;
+            return;
+        }
+
+        if (payload?.type === EVENT_TYPE_POST && payload.postId) {
+            const next = new Map(this._byPostId);
+            const users = Array.isArray(payload.users) ? payload.users : [];
+            if (users.length === 0) {
+                next.delete(payload.postId);
+            } else {
+                next.set(payload.postId, users);
+            }
+            this._byPostId = next;
+        }
+    }
+
+    willDestroy() {
+        super.willDestroy();
+        this.stop();
+    }
+}
diff --git a/ghost/admin/app/services/session.js b/ghost/admin/app/services/session.js
index 6939cc26612..21dabf76e9c 100644
--- a/ghost/admin/app/services/session.js
+++ b/ghost/admin/app/services/session.js
@@ -12,6 +12,7 @@ import {tracked} from '@glimmer/tracking';
 
 export default class SessionService extends ESASessionService {
     @service configManager;
+    @service presence;
     @service('store') dataStore;
     @service feature;
     @service koenig;
@@ -73,6 +74,11 @@ export default class SessionService extends ESASessionService {
 
         this.loadServerNotifications();
 
+        // Open the presence stream once features are loaded so the
+        // service can check the editorPresence flag. No-op when the
+        // flag is off or the browser lacks EventSource.
+        this.presence.start();
+
         // pre-emptively load editor code in the background to avoid loading state when opening editor
         this.koenig.fetch();
     }
@@ -129,6 +135,9 @@ export default class SessionService extends ESASessionService {
     }
 
     handleInvalidation() {
+        // Close the presence SSE stream alongside the session.
+        this.presence.stop();
+
         let transition = this.appLoadTransition;
 
         if (transition) {
diff --git a/ghost/admin/app/styles/app.css b/ghost/admin/app/styles/app.css
index bd5c7bcb5b7..7598fc35aa4 100644
--- a/ghost/admin/app/styles/app.css
+++ b/ghost/admin/app/styles/app.css
@@ -33,6 +33,7 @@
 @import "components/power-select.css";
 @import "components/power-calendar.css";
 @import "components/koenig.css";
+@import "components/presence-avatars.css";
 @import "components/publishmenu.css";
 @import "components/popovers.css";
 @import "components/unsplash.css";
diff --git a/ghost/admin/app/styles/components/presence-avatars.css b/ghost/admin/app/styles/components/presence-avatars.css
new file mode 100644
index 00000000000..79af111a0f6
--- /dev/null
+++ b/ghost/admin/app/styles/components/presence-avatars.css
@@ -0,0 +1,101 @@
+/* Presence avatars — editor header (md) and post-list rows (sm). */
+
+.gh-presence-avatars {
+    display: inline-flex;
+    align-items: center;
+}
+
+.gh-presence-avatars--md {
+    align-self: center;
+    pointer-events: auto;
+}
+
+/* Right-hand cluster of the editor header: avatars + publish buttons
+   share a flex container so they wrap together. The small-screen
+   margin clears the absolutely-positioned settings menu toggle. */
+.gh-editor-header-right {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    pointer-events: auto;
+}
+
+@media (max-width: 500px) {
+    .gh-editor-header-right {
+        margin-right: 76px;
+    }
+}
+
+.gh-presence-avatars--sm {
+    margin-right: 12px;
+    align-self: center;
+}
+
+.gh-presence-avatar {
+    position: relative;
+    border-radius: 50%;
+    background: #738a94;
+    color: #fff;
+    border: 2px solid #fff;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    font-weight: 600;
+    margin-left: -8px;
+    cursor: default;
+}
+
+.gh-presence-avatar:first-child {
+    margin-left: 0;
+}
+
+.gh-presence-avatars--md .gh-presence-avatar {
+    width: 32px;
+    height: 32px;
+    font-size: 12px;
+}
+
+.gh-presence-avatars--sm .gh-presence-avatar {
+    width: 26px;
+    height: 26px;
+    font-size: 10px;
+}
+
+/* Idle: peer connected but not active. Dim the visual content only
+   (img/initials), not the whole avatar — CSS opacity propagates to
+   the subtree and would also dim the GhTooltip child. */
+.gh-presence-avatar--idle img,
+.gh-presence-avatar--idle .gh-presence-avatar-initials {
+    opacity: 0.45;
+    transition: opacity 200ms ease;
+}
+
+.gh-presence-avatar img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    border-radius: 50%;
+}
+
+.gh-presence-avatar-initials {
+    line-height: 1;
+}
+
+/* Overflow chip — Notion-style "+N" after the visible stack. Plain
+   text rather than another circle so it doesn't compete with the
+   avatars visually. */
+.gh-presence-avatars-overflow {
+    position: relative;
+    margin-left: 6px;
+    color: var(--midgrey);
+    font-weight: 500;
+    cursor: default;
+}
+
+.gh-presence-avatars--md .gh-presence-avatars-overflow {
+    font-size: 13px;
+}
+
+.gh-presence-avatars--sm .gh-presence-avatars-overflow {
+    font-size: 11px;
+}
diff --git a/ghost/admin/app/styles/layouts/editor.css b/ghost/admin/app/styles/layouts/editor.css
index 966bbbd8cc2..d8f033d1371 100644
--- a/ghost/admin/app/styles/layouts/editor.css
+++ b/ghost/admin/app/styles/layouts/editor.css
@@ -997,7 +997,7 @@ body[data-user-is-dragging] .gh-editor-feature-image-dropzone {
     fill: var(--darkgrey);
 }
 
-@media (max-width: 500px) {
+@media (max-width: 768px) {
     .gh-editor-back-button span {
         display: none;
     }
diff --git a/ghost/admin/app/templates/lexical-editor.hbs b/ghost/admin/app/templates/lexical-editor.hbs
index fc6dc8be825..a4d969fa58c 100644
--- a/ghost/admin/app/templates/lexical-editor.hbs
+++ b/ghost/admin/app/templates/lexical-editor.hbs
@@ -45,14 +45,19 @@
                         {{/if}}
                     </div>
 
-                    <section class="gh-editor-publish-buttons">
-                        {{#unless this.post.isNew}}
-                            <Editor::PublishButtons @publishManagement={{publishManagement}} />
-                            {{#unless this.showSettingsMenu}}
-                                <div class="settings-menu-toggle-spacer"></div>
+                    <div class="gh-editor-header-right">
+                        {{#if (feature 'editorPresence')}}
+                            <GhPresenceAvatars @postId={{this.post.id}} />
+                        {{/if}}
+                        <section class="gh-editor-publish-buttons">
+                            {{#unless this.post.isNew}}
+                                <Editor::PublishButtons @publishManagement={{publishManagement}} />
+                                {{#unless this.showSettingsMenu}}
+                                    <div class="settings-menu-toggle-spacer"></div>
+                                {{/unless}}
                             {{/unless}}
-                        {{/unless}}
-                    </section>
+                        </section>
+                    </div>
                 </Editor::PublishManagement>
             </header>
 
diff --git a/ghost/core/core/server/api/endpoints/posts.js b/ghost/core/core/server/api/endpoints/posts.js
index 18b6838c3b5..d5953ea170f 100644
--- a/ghost/core/core/server/api/endpoints/posts.js
+++ b/ghost/core/core/server/api/endpoints/posts.js
@@ -1,5 +1,8 @@
 const urlUtils = require('../../../shared/url-utils');
+const labs = require('../../../shared/labs');
+const logging = require('@tryghost/logging');
 const models = require('../../models');
+const postPresence = require('../../services/post-presence');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const allowedIncludes = [
     'tags',
@@ -22,6 +25,29 @@ const unsafeAttrs = ['status', 'authors', 'visibility'];
 
 const postsService = getPostServiceInstance();
 
+/**
+ * Best-effort presence heartbeat fired from edit autosaves. Wrapped
+ * so a failure in labs lookup, the user model, or the presence cache
+ * never breaks the post API response.
+ */
+function markPostPresence(frame, model) {
+    try {
+        if (!labs.isSet('editorPresence')) {
+            return;
+        }
+        if (!frame || !frame.user || !model || !model.id) {
+            return;
+        }
+        postPresence.mark(model.id, {
+            id: frame.user.id,
+            name: frame.user.get('name'),
+            profileImage: frame.user.get('profile_image')
+        });
+    } catch (err) {
+        logging.warn({err}, 'Failed to record post presence');
+    }
+}
+
 /**
  * @param {string} event
  */
@@ -144,7 +170,7 @@ const controller = {
         permissions: {
             unsafeAttrs: unsafeAttrs
         },
-        query(frame) {
+        async query(frame) {
             return postsService.readPost(frame);
         }
     },
@@ -229,6 +255,8 @@ const controller = {
                 }
             });
 
+            markPostPresence(frame, model);
+
             return model;
         }
     },
diff --git a/ghost/core/core/server/services/post-presence/index.js b/ghost/core/core/server/services/post-presence/index.js
new file mode 100644
index 00000000000..781cde030fa
--- /dev/null
+++ b/ghost/core/core/server/services/post-presence/index.js
@@ -0,0 +1,6 @@
+const PostPresenceService = require('./post-presence-service');
+
+const service = new PostPresenceService();
+service.PRESENCE_EVENT_TYPES = PostPresenceService.PRESENCE_EVENT_TYPES;
+
+module.exports = service;
diff --git a/ghost/core/core/server/services/post-presence/post-presence-service.js b/ghost/core/core/server/services/post-presence/post-presence-service.js
new file mode 100644
index 00000000000..d20e858dfba
--- /dev/null
+++ b/ghost/core/core/server/services/post-presence/post-presence-service.js
@@ -0,0 +1,245 @@
+const {EventEmitter} = require('events');
+const errors = require('@tryghost/errors');
+const logging = require('@tryghost/logging');
+
+const PRESENCE_EVENT_TYPES = Object.freeze({
+    POST: 'post',
+    SNAPSHOT: 'snapshot'
+});
+
+/**
+ * @typedef {Object} PresenceUser
+ * @property {string} id
+ * @property {string} [name]
+ * @property {string} [profileImage]
+ */
+
+/**
+ * @typedef {Object} PresenceEntry
+ * @property {string} id
+ * @property {string} name
+ * @property {string | null} profileImage
+ * @property {number} lastSeen
+ * @property {boolean} isIdle
+ */
+
+/**
+ * @typedef {Object} PresencePostEvent
+ * @property {'post'} type
+ * @property {string} postId
+ * @property {PresenceEntry[]} users
+ */
+
+/**
+ * Tracks which staff users currently have a given post open in the
+ * editor. The post API marks the active user as a side effect of edit
+ * heartbeats; an explicit POST signals editor entry; an explicit POST
+ * (or pagehide beacon) signals leave. A periodic sweep transitions
+ * entries through active → idle → removed so peers see stale tabs
+ * fade and then disappear without polling.
+ *
+ * State is in-process. Ghost(Pro) runs one Node process per site;
+ * see EDITOR-PRESENCE.md for the deployment context that makes this
+ * sufficient.
+ */
+class PostPresenceService {
+    /**
+     * @param {Object} [opts]
+     * @param {number} [opts.idleMs] entries older than this without
+     *     activity are marked idle. Defaults to 90s — slightly above
+     *     Ghost's 60s force-save cadence so an actively-open editor
+     *     never flickers.
+     * @param {number} [opts.ttlMs] entries older than this are removed.
+     *     Must be greater than idleMs. Defaults to 180s.
+     * @param {number} [opts.cleanupIntervalMs] sweep cadence. Defaults
+     *     to ttlMs / 6 so transitions land within one sweep window.
+     */
+    constructor({idleMs = 90 * 1000, ttlMs = 180 * 1000, cleanupIntervalMs} = {}) {
+        if (idleMs >= ttlMs) {
+            throw new errors.IncorrectUsageError({
+                message: 'PostPresenceService requires idleMs < ttlMs'
+            });
+        }
+        this.idleMs = idleMs;
+        this.ttlMs = ttlMs;
+        this.cleanupIntervalMs = cleanupIntervalMs || Math.max(1000, Math.floor(ttlMs / 6));
+        /** @type {Map<string, Map<string, PresenceEntry>>} */
+        this._byPostId = new Map();
+        this._emitter = new EventEmitter();
+        this._emitter.setMaxListeners(1000);
+        this._cleanupTimer = null;
+    }
+
+    /**
+     * Subscribe to presence events. Returns an unsubscribe function.
+     * @param {(event: PresencePostEvent) => void} handler
+     */
+    subscribe(handler) {
+        this._emitter.on('presence', handler);
+        return () => this._emitter.off('presence', handler);
+    }
+
+    start() {
+        if (this._cleanupTimer) {
+            return;
+        }
+        this._cleanupTimer = setInterval(() => this._cleanupAll(), this.cleanupIntervalMs);
+        if (this._cleanupTimer.unref) {
+            this._cleanupTimer.unref();
+        }
+    }
+
+    stop() {
+        if (this._cleanupTimer) {
+            clearInterval(this._cleanupTimer);
+            this._cleanupTimer = null;
+        }
+    }
+
+    /**
+     * Record that a user is active on a post. Publishes only when the
+     * entry is new or transitioning from idle — already-active
+     * heartbeats are silent on the bus so autosaves don't fan out N×M
+     * events to every connected admin tab.
+     *
+     * @param {string} postId
+     * @param {PresenceUser} user
+     */
+    mark(postId, user) {
+        if (!postId || !user || !user.id) {
+            return;
+        }
+        if (!this._cleanupTimer) {
+            this.start();
+        }
+
+        const now = Date.now();
+        const entries = this._byPostId.get(postId) || new Map();
+        const prev = entries.get(user.id);
+        const wasActive = prev && !prev.isIdle && (now - prev.lastSeen) < this.ttlMs;
+
+        entries.set(user.id, {
+            id: user.id,
+            name: user.name || '',
+            profileImage: user.profileImage || null,
+            lastSeen: now,
+            isIdle: false
+        });
+        this._byPostId.set(postId, entries);
+
+        if (!wasActive) {
+            this._publish(postId, entries);
+        }
+    }
+
+    /**
+     * Remove a user from a post and publish the new list. No-op if the
+     * user wasn't tracked, which keeps spurious beacons from triggering
+     * fan-out.
+     */
+    leave(postId, userId) {
+        if (!postId || !userId) {
+            return;
+        }
+        const entries = this._byPostId.get(postId);
+        if (!entries || !entries.has(userId)) {
+            return;
+        }
+        entries.delete(userId);
+        if (entries.size === 0) {
+            this._byPostId.delete(postId);
+        }
+        this._publish(postId, entries);
+    }
+
+    /**
+     * Active posts and their users. Used by the SSE handler to send
+     * initial state to a freshly-connected admin tab. Filters stale
+     * entries on the way out.
+     *
+     * @returns {Array<{postId: string, users: PresenceEntry[]}>}
+     */
+    snapshot() {
+        const now = Date.now();
+        const out = [];
+        for (const [postId, entries] of this._byPostId.entries()) {
+            const users = [];
+            for (const entry of entries.values()) {
+                if ((now - entry.lastSeen) < this.ttlMs) {
+                    users.push(entry);
+                }
+            }
+            if (users.length > 0) {
+                out.push({postId, users});
+            }
+        }
+        return out;
+    }
+
+    _publish(postId, entries) {
+        const event = {
+            type: PRESENCE_EVENT_TYPES.POST,
+            postId,
+            users: entries ? Array.from(entries.values()) : []
+        };
+        try {
+            this._emitter.emit('presence', event);
+        } catch (err) {
+            logging.warn({err}, 'Presence subscriber threw during emit');
+        }
+    }
+
+    /**
+     * Sweep all posts: transition entries past idleMs to isIdle, drop
+     * entries past ttlMs, and publish per-post when state changed.
+     * Each post is wrapped in try/catch so a single bad subscriber
+     * doesn't abort the whole sweep.
+     */
+    _cleanupAll() {
+        const now = Date.now();
+        for (const [postId, entries] of this._byPostId.entries()) {
+            try {
+                const changed = this._sweep(entries, now);
+                if (!changed) {
+                    continue;
+                }
+                if (entries.size === 0) {
+                    this._byPostId.delete(postId);
+                }
+                this._publish(postId, entries);
+            } catch (err) {
+                logging.warn({err, postId}, 'Presence cleanup iteration failed');
+            }
+        }
+    }
+
+    /**
+     * Mutates the entries map in place. Returns true if anything
+     * changed.
+     */
+    _sweep(entries, now) {
+        let changed = false;
+        for (const [id, entry] of entries) {
+            if (!entry || typeof entry.lastSeen !== 'number') {
+                entries.delete(id);
+                changed = true;
+                continue;
+            }
+            const age = now - entry.lastSeen;
+            if (age >= this.ttlMs) {
+                entries.delete(id);
+                changed = true;
+                continue;
+            }
+            const shouldBeIdle = age >= this.idleMs;
+            if (Boolean(entry.isIdle) !== shouldBeIdle) {
+                entries.set(id, {...entry, isIdle: shouldBeIdle});
+                changed = true;
+            }
+        }
+        return changed;
+    }
+}
+
+module.exports = PostPresenceService;
+module.exports.PRESENCE_EVENT_TYPES = PRESENCE_EVENT_TYPES;
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
new file mode 100644
index 00000000000..49a56bd4bd6
--- /dev/null
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
@@ -0,0 +1,29 @@
+const logging = require('@tryghost/logging');
+const labs = require('../../../../../../shared/labs');
+const postPresence = require('../../../../../services/post-presence');
+
+/**
+ * Explicit "I just opened this post in the editor" handler. Called by
+ * the editor route on activation so opening a post in the editor (and
+ * not, say, viewing analytics) is what registers presence. Best-effort.
+ */
+module.exports = function presenceEnter(req, res) {
+    try {
+        if (!labs.isSet('editorPresence')) {
+            res.status(404).end();
+            return;
+        }
+        const postId = req.params && req.params.id;
+        const user = req.user;
+        if (postId && user && user.id) {
+            postPresence.mark(postId, {
+                id: user.id,
+                name: user.get('name'),
+                profileImage: user.get('profile_image')
+            });
+        }
+    } catch (err) {
+        logging.warn({err}, 'Failed to record presence enter');
+    }
+    res.status(204).end();
+};
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js
new file mode 100644
index 00000000000..224aceb60b5
--- /dev/null
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js
@@ -0,0 +1,24 @@
+const logging = require('@tryghost/logging');
+const labs = require('../../../../../../shared/labs');
+const postPresence = require('../../../../../services/post-presence');
+
+/**
+ * Explicit "I'm leaving this post" handler. Best-effort; failures never
+ * error to the client. Auth is handled upstream by mw.authAdminApi.
+ */
+module.exports = function presenceLeave(req, res) {
+    try {
+        if (!labs.isSet('editorPresence')) {
+            res.status(404).end();
+            return;
+        }
+        const postId = req.params && req.params.id;
+        const user = req.user;
+        if (postId && user && user.id) {
+            postPresence.leave(postId, user.id);
+        }
+    } catch (err) {
+        logging.warn({err}, 'Failed to record presence leave');
+    }
+    res.status(204).end();
+};
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
new file mode 100644
index 00000000000..594e4d2732c
--- /dev/null
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
@@ -0,0 +1,90 @@
+const logging = require('@tryghost/logging');
+const labs = require('../../../../../../shared/labs');
+const postPresence = require('../../../../../services/post-presence');
+const {PRESENCE_EVENT_TYPES} = require('../../../../../services/post-presence/post-presence-service');
+
+const KEEPALIVE_MS = 30 * 1000;
+
+/**
+ * SSE handler for live presence updates. Holds a long-lived HTTP
+ * response open, writes the current snapshot, then forwards every
+ * presence event to the client. Auth handled upstream by mw.authAdminApi.
+ */
+module.exports = function presenceStream(req, res) {
+    if (!labs.isSet('editorPresence')) {
+        res.status(404).end();
+        return;
+    }
+
+    try {
+        res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive',
+            // Disable response buffering on nginx; SSE needs to stream.
+            'X-Accel-Buffering': 'no'
+        });
+        if (typeof res.flushHeaders === 'function') {
+            res.flushHeaders();
+        }
+    } catch (err) {
+        logging.warn({err}, 'presence-stream: failed to write headers; client likely disconnected');
+        return;
+    }
+
+    let closed = false;
+
+    const sendComment = (text) => {
+        if (closed) {
+            return;
+        }
+        try {
+            res.write(`: ${text}\n\n`);
+        } catch (err) {
+            // Stream closed mid-write; the close handler will clean up.
+        }
+    };
+
+    const sendEvent = (event) => {
+        if (closed) {
+            return;
+        }
+        try {
+            res.write(`data: ${JSON.stringify(event)}\n\n`);
+        } catch (err) {
+            logging.warn({err, code: err && err.code}, 'presence-stream: write failed');
+        }
+    };
+
+    try {
+        sendEvent({type: PRESENCE_EVENT_TYPES.SNAPSHOT, posts: postPresence.snapshot()});
+    } catch (err) {
+        logging.warn({err}, 'presence-stream: failed to send initial snapshot');
+    }
+
+    const unsubscribe = postPresence.subscribe(sendEvent);
+
+    // Comment frames keep idle proxies from dropping the connection.
+    // EventSource ignores them on the client side.
+    const keepalive = setInterval(() => sendComment('ping'), KEEPALIVE_MS);
+    if (keepalive.unref) {
+        keepalive.unref();
+    }
+
+    const cleanup = () => {
+        if (closed) {
+            return;
+        }
+        closed = true;
+        clearInterval(keepalive);
+        try {
+            unsubscribe();
+        } catch (err) {
+            logging.warn({err}, 'presence-stream: unsubscribe failed');
+        }
+    };
+
+    req.on('close', cleanup);
+    req.on('error', cleanup);
+    res.on('error', cleanup);
+};
diff --git a/ghost/core/core/server/web/api/endpoints/admin/routes.js b/ghost/core/core/server/web/api/endpoints/admin/routes.js
index a8e4878ae2e..b93b13292f2 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/routes.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/routes.js
@@ -4,6 +4,9 @@ const {http} = require('@tryghost/api-framework');
 const auth = require('../../../../services/auth');
 const apiMw = require('../../middleware');
 const mw = require('./middleware');
+const presenceStream = require('./lib/presence-stream');
+const presenceEnter = require('./lib/presence-enter');
+const presenceLeave = require('./lib/presence-leave');
 
 const shared = require('../../../shared');
 
@@ -25,6 +28,11 @@ module.exports = function apiRoutes() {
     // ## Ghost Explore
     router.get('/explore', mw.authAdminApi, http(api.explore.read));
 
+    // ## Presence (editorPresence labs flag; handlers 404 when off)
+    router.get('/presence/stream', mw.authAdminApi, presenceStream);
+    router.post('/presence/posts/:id/enter', mw.authAdminApi, presenceEnter);
+    router.post('/presence/posts/:id/leave', mw.authAdminApi, presenceLeave);
+
     // ## Posts
     router.get('/posts', mw.authAdminApi, http(api.posts.browse));
     router.get('/posts/export', mw.authAdminApi, http(api.posts.exportCSV));
diff --git a/ghost/core/core/shared/labs.js b/ghost/core/core/shared/labs.js
index 7f4f67adc3d..c446ca5ff6c 100644
--- a/ghost/core/core/shared/labs.js
+++ b/ghost/core/core/shared/labs.js
@@ -54,7 +54,8 @@ const PRIVATE_FEATURES = [
     'indexnow',
     'pictureImageFormats',
     'smarterCounts',
-    'llmsTxt'
+    'llmsTxt',
+    'editorPresence'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

From 1346da0e8fd71c137f6944d4d711f5fb1aa24145 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 12:46:40 +0300
Subject: [PATCH 02/11] =?UTF-8?q?=F0=9F=8E=A8=20Polished=20editor=20presen?=
 =?UTF-8?q?ce=20observability=20and=20contract?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up on 1d05183e73 based on a multi-agent code review pass.
No behavior change; tests come in a separate commit.

Observability:
- presence-stream: sendComment logs on write failure (parity with sendEvent)
- presence-stream: listen for res 'close' alongside req close/error
- service (server): _publish warn includes postId
- service (admin): EventSource init failure sets _initFailed; enterPost
  skips the POST instead of writing to a server we can't render from
- service (admin): onerror counts consecutive CONNECTING failures and
  logs once after three so reconnect storms are debuggable
- service (admin): malformed-payload warn includes the caught exception

Wire contract:
- _toWireUser strips lastSeen from snapshot + post events (internal
  sweep timestamp no longer leaks)
- new PresenceUserView + PresenceSnapshotEvent typedefs document the
  full wire shape
- cross-reference comments between server PRESENCE_EVENT_TYPES and
  admin EVENT_TYPE_* so the contract cannot drift silently

Misc:
- markPostPresence param renamed model → postDto (editPost returns
  the JSON dto, not a Bookshelf model)
- trimmed restate-the-method JSDoc on subscribe, leave, snapshot,
  _cleanupAll, _sweep, presence-enter/leave headers, admin service
- dropped EDITOR-PRESENCE.md reference from in-file comment (doc is
  intentionally untracked)
---
 ghost/admin/app/services/presence.js          | 42 ++++++++---
 ghost/core/core/server/api/endpoints/posts.js | 10 ++-
 .../post-presence/post-presence-service.js    | 69 +++++++++++++------
 .../api/endpoints/admin/lib/presence-enter.js |  6 +-
 .../api/endpoints/admin/lib/presence-leave.js |  2 +-
 .../endpoints/admin/lib/presence-stream.js    |  7 +-
 6 files changed, 95 insertions(+), 41 deletions(-)

diff --git a/ghost/admin/app/services/presence.js b/ghost/admin/app/services/presence.js
index 78d1096a364..2f187c69876 100644
--- a/ghost/admin/app/services/presence.js
+++ b/ghost/admin/app/services/presence.js
@@ -2,14 +2,17 @@ import Service, {inject as service} from '@ember/service';
 import fetch from 'fetch';
 import {tracked} from '@glimmer/tracking';
 
+// Wire-format event types. Must match PRESENCE_EVENT_TYPES in
+// ghost/core/core/server/services/post-presence/post-presence-service.js
+// (no shared module across the Node/Ember boundary).
 const EVENT_TYPE_SNAPSHOT = 'snapshot';
 const EVENT_TYPE_POST = 'post';
 
+const CONNECTING_ERROR_LOG_THRESHOLD = 3;
+
 /**
- * Subscribes to a long-lived SSE stream that pushes presence (who is
- * editing what) changes to all admin tabs. Holds a tracked map of
- * postId → users[]; components read via usersForPost(postId) and
- * re-render automatically.
+ * Subscribes to a long-lived SSE stream that pushes editor presence
+ * updates to the admin.
  */
 export default class PresenceService extends Service {
     @service feature;
@@ -21,6 +24,9 @@ export default class PresenceService extends Service {
     _source = null;
     _currentPostId = null;
     _beforeUnloadHandler = null;
+    _initFailed = false;
+    _connectingErrorCount = 0;
+    _connectingErrorLogged = false;
 
     start() {
         if (this._source || typeof window === 'undefined' || !window.EventSource) {
@@ -33,6 +39,7 @@ export default class PresenceService extends Service {
         try {
             this._source = new EventSource(streamUrl, {withCredentials: true});
         } catch (e) {
+            this._initFailed = true;
             console.warn('[presence] EventSource construction failed', e); // eslint-disable-line no-console
             return;
         }
@@ -41,8 +48,19 @@ export default class PresenceService extends Service {
             // EventSource auto-reconnects on transient errors. Terminal
             // closures (401/403/404) leave readyState === CLOSED; log
             // those so silent presence failures are debuggable.
-            if (this._source && this._source.readyState === EventSource.CLOSED) {
+            if (!this._source) {
+                return;
+            }
+            if (this._source.readyState === EventSource.CLOSED) {
                 console.warn('[presence] SSE stream closed; not reconnecting'); // eslint-disable-line no-console
+                return;
+            }
+            if (this._source.readyState === EventSource.CONNECTING) {
+                this._connectingErrorCount += 1;
+                if (this._connectingErrorCount >= CONNECTING_ERROR_LOG_THRESHOLD && !this._connectingErrorLogged) {
+                    this._connectingErrorLogged = true;
+                    console.warn('[presence] SSE reconnects are failing'); // eslint-disable-line no-console
+                }
             }
         };
 
@@ -74,14 +92,17 @@ export default class PresenceService extends Service {
 
     /**
      * The user opened a post in the editor. Sends an explicit enter so
-     * peers see the avatar within ~50ms (the read endpoint no longer
-     * marks presence — that would have lit up analytics views too).
-     * If the user was on a different post, leave that one first.
+     * peers see the avatar (the read endpoint deliberately does not mark
+     * presence — that would have lit up analytics views too).
      */
     enterPost(postId) {
         if (!postId) {
             return;
         }
+        if (this._initFailed) {
+            console.warn('[presence] skipping enter; SSE init failed earlier'); // eslint-disable-line no-console
+            return;
+        }
         if (this._currentPostId && this._currentPostId !== postId) {
             this.leavePost(this._currentPostId);
         }
@@ -129,11 +150,14 @@ export default class PresenceService extends Service {
     }
 
     _handleMessage(event) {
+        this._connectingErrorCount = 0;
+        this._connectingErrorLogged = false;
+
         let payload;
         try {
             payload = JSON.parse(event.data);
         } catch (e) {
-            console.warn('[presence] malformed event payload, dropping', event.data); // eslint-disable-line no-console
+            console.warn('[presence] malformed event payload, dropping', {err: e, data: event.data}); // eslint-disable-line no-console
             return;
         }
 
diff --git a/ghost/core/core/server/api/endpoints/posts.js b/ghost/core/core/server/api/endpoints/posts.js
index d5953ea170f..c5905c16e8c 100644
--- a/ghost/core/core/server/api/endpoints/posts.js
+++ b/ghost/core/core/server/api/endpoints/posts.js
@@ -29,16 +29,20 @@ const postsService = getPostServiceInstance();
  * Best-effort presence heartbeat fired from edit autosaves. Wrapped
  * so a failure in labs lookup, the user model, or the presence cache
  * never breaks the post API response.
+ *
+ * @param {Object} frame API framework frame
+ * @param {{id: string}} postDto DTO returned by postsService.editPost
+ *     (model.toJSON output, not the Bookshelf model)
  */
-function markPostPresence(frame, model) {
+function markPostPresence(frame, postDto) {
     try {
         if (!labs.isSet('editorPresence')) {
             return;
         }
-        if (!frame || !frame.user || !model || !model.id) {
+        if (!frame || !frame.user || !postDto || !postDto.id) {
             return;
         }
-        postPresence.mark(model.id, {
+        postPresence.mark(postDto.id, {
             id: frame.user.id,
             name: frame.user.get('name'),
             profileImage: frame.user.get('profile_image')
diff --git a/ghost/core/core/server/services/post-presence/post-presence-service.js b/ghost/core/core/server/services/post-presence/post-presence-service.js
index d20e858dfba..4fb5766bb42 100644
--- a/ghost/core/core/server/services/post-presence/post-presence-service.js
+++ b/ghost/core/core/server/services/post-presence/post-presence-service.js
@@ -2,6 +2,9 @@ const {EventEmitter} = require('events');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 
+// Wire-format event types. Must match EVENT_TYPE_* in
+// ghost/admin/app/services/presence.js (no shared module across the
+// Node/Ember boundary).
 const PRESENCE_EVENT_TYPES = Object.freeze({
     POST: 'post',
     SNAPSHOT: 'snapshot'
@@ -15,6 +18,9 @@ const PRESENCE_EVENT_TYPES = Object.freeze({
  */
 
 /**
+ * Internal record stored in `_byPostId`. `lastSeen` drives idle/TTL
+ * sweeps and is not sent over the wire (see PresenceUserView).
+ *
  * @typedef {Object} PresenceEntry
  * @property {string} id
  * @property {string} name
@@ -23,11 +29,28 @@ const PRESENCE_EVENT_TYPES = Object.freeze({
  * @property {boolean} isIdle
  */
 
+/**
+ * Shape sent to clients (snapshot + post events). Mirrors PresenceEntry
+ * without `lastSeen`.
+ *
+ * @typedef {Object} PresenceUserView
+ * @property {string} id
+ * @property {string} name
+ * @property {string | null} profileImage
+ * @property {boolean} isIdle
+ */
+
 /**
  * @typedef {Object} PresencePostEvent
  * @property {'post'} type
  * @property {string} postId
- * @property {PresenceEntry[]} users
+ * @property {PresenceUserView[]} users
+ */
+
+/**
+ * @typedef {Object} PresenceSnapshotEvent
+ * @property {'snapshot'} type
+ * @property {Array<{postId: string, users: PresenceUserView[]}>} posts
  */
 
 /**
@@ -38,9 +61,7 @@ const PRESENCE_EVENT_TYPES = Object.freeze({
  * entries through active → idle → removed so peers see stale tabs
  * fade and then disappear without polling.
  *
- * State is in-process. Ghost(Pro) runs one Node process per site;
- * see EDITOR-PRESENCE.md for the deployment context that makes this
- * sufficient.
+ * State is in-process. Ghost(Pro) runs one Node process per site.
  */
 class PostPresenceService {
     /**
@@ -71,7 +92,6 @@ class PostPresenceService {
     }
 
     /**
-     * Subscribe to presence events. Returns an unsubscribe function.
      * @param {(event: PresencePostEvent) => void} handler
      */
     subscribe(handler) {
@@ -133,9 +153,8 @@ class PostPresenceService {
     }
 
     /**
-     * Remove a user from a post and publish the new list. No-op if the
-     * user wasn't tracked, which keeps spurious beacons from triggering
-     * fan-out.
+     * No-op if the user wasn't tracked, which keeps spurious beacons
+     * from triggering fan-out.
      */
     leave(postId, userId) {
         if (!postId || !userId) {
@@ -153,11 +172,9 @@ class PostPresenceService {
     }
 
     /**
-     * Active posts and their users. Used by the SSE handler to send
-     * initial state to a freshly-connected admin tab. Filters stale
-     * entries on the way out.
+     * Filters stale entries on the way out.
      *
-     * @returns {Array<{postId: string, users: PresenceEntry[]}>}
+     * @returns {Array<{postId: string, users: PresenceUserView[]}>}
      */
     snapshot() {
         const now = Date.now();
@@ -166,7 +183,7 @@ class PostPresenceService {
             const users = [];
             for (const entry of entries.values()) {
                 if ((now - entry.lastSeen) < this.ttlMs) {
-                    users.push(entry);
+                    users.push(this._toWireUser(entry));
                 }
             }
             if (users.length > 0) {
@@ -176,22 +193,36 @@ class PostPresenceService {
         return out;
     }
 
+    /**
+     * Strips `lastSeen` (internal sweep timestamp) from an entry before
+     * it goes over the wire.
+     *
+     * @param {PresenceEntry} entry
+     * @returns {PresenceUserView}
+     */
+    _toWireUser(entry) {
+        return {
+            id: entry.id,
+            name: entry.name,
+            profileImage: entry.profileImage,
+            isIdle: Boolean(entry.isIdle)
+        };
+    }
+
     _publish(postId, entries) {
         const event = {
             type: PRESENCE_EVENT_TYPES.POST,
             postId,
-            users: entries ? Array.from(entries.values()) : []
+            users: entries ? Array.from(entries.values()).map(entry => this._toWireUser(entry)) : []
         };
         try {
             this._emitter.emit('presence', event);
         } catch (err) {
-            logging.warn({err}, 'Presence subscriber threw during emit');
+            logging.warn({err, postId}, 'Presence subscriber threw during emit');
         }
     }
 
     /**
-     * Sweep all posts: transition entries past idleMs to isIdle, drop
-     * entries past ttlMs, and publish per-post when state changed.
      * Each post is wrapped in try/catch so a single bad subscriber
      * doesn't abort the whole sweep.
      */
@@ -213,10 +244,6 @@ class PostPresenceService {
         }
     }
 
-    /**
-     * Mutates the entries map in place. Returns true if anything
-     * changed.
-     */
     _sweep(entries, now) {
         let changed = false;
         for (const [id, entry] of entries) {
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
index 49a56bd4bd6..c151e25d285 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
@@ -3,9 +3,9 @@ const labs = require('../../../../../../shared/labs');
 const postPresence = require('../../../../../services/post-presence');
 
 /**
- * Explicit "I just opened this post in the editor" handler. Called by
- * the editor route on activation so opening a post in the editor (and
- * not, say, viewing analytics) is what registers presence. Best-effort.
+ * Explicit "I just opened this post in the editor" handler. Explicit
+ * enter so opening the editor (not, say, viewing analytics) is what
+ * registers presence. Best-effort.
  */
 module.exports = function presenceEnter(req, res) {
     try {
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js
index 224aceb60b5..e3867c76dd3 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-leave.js
@@ -4,7 +4,7 @@ const postPresence = require('../../../../../services/post-presence');
 
 /**
  * Explicit "I'm leaving this post" handler. Best-effort; failures never
- * error to the client. Auth is handled upstream by mw.authAdminApi.
+ * error to the client.
  */
 module.exports = function presenceLeave(req, res) {
     try {
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
index 594e4d2732c..8e76ea6af12 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
@@ -6,9 +6,7 @@ const {PRESENCE_EVENT_TYPES} = require('../../../../../services/post-presence/po
 const KEEPALIVE_MS = 30 * 1000;
 
 /**
- * SSE handler for live presence updates. Holds a long-lived HTTP
- * response open, writes the current snapshot, then forwards every
- * presence event to the client. Auth handled upstream by mw.authAdminApi.
+ * SSE handler that streams presence events to a single admin tab.
  */
 module.exports = function presenceStream(req, res) {
     if (!labs.isSet('editorPresence')) {
@@ -41,7 +39,7 @@ module.exports = function presenceStream(req, res) {
         try {
             res.write(`: ${text}\n\n`);
         } catch (err) {
-            // Stream closed mid-write; the close handler will clean up.
+            logging.warn({err, code: err && err.code}, 'presence-stream: keepalive write failed');
         }
     };
 
@@ -86,5 +84,6 @@ module.exports = function presenceStream(req, res) {
 
     req.on('close', cleanup);
     req.on('error', cleanup);
+    res.on('close', cleanup);
     res.on('error', cleanup);
 };

From 4fe193f95f37425555d687187ea169ac4cdad621 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 12:49:30 +0300
Subject: [PATCH 03/11] Added unit tests for PostPresenceService
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Covers the algorithmically tricky paths where a regression would be
silent and hard to spot in manual testing:

- constructor idleMs < ttlMs invariant
- mark publishes on new entry; silent on already-active heartbeat;
  re-publishes on idle→active transition
- mark ignores invalid input without publishing
- cleanup timer starts lazily on first mark
- _sweep flips active→idle past idleMs and removes past ttlMs
- _cleanupAll keeps iterating past a throwing subscriber
- leave is a no-op for unknown post/user; emits empty users when
  removing the last user
- snapshot drops stale entries and strips lastSeen from the wire
  shape (consumer-visible contract)

UI surface, SSE handler, enter/leave endpoints, and the admin
service are intentionally not covered — those regressions surface
visually the first time the feature is exercised.
---
 .../post-presence-service.test.js             | 235 ++++++++++++++++++
 1 file changed, 235 insertions(+)
 create mode 100644 ghost/core/test/unit/server/services/post-presence/post-presence-service.test.js

diff --git a/ghost/core/test/unit/server/services/post-presence/post-presence-service.test.js b/ghost/core/test/unit/server/services/post-presence/post-presence-service.test.js
new file mode 100644
index 00000000000..5c57285386e
--- /dev/null
+++ b/ghost/core/test/unit/server/services/post-presence/post-presence-service.test.js
@@ -0,0 +1,235 @@
+const assert = require('node:assert/strict');
+const sinon = require('sinon');
+
+const PostPresenceService = require('../../../../../core/server/services/post-presence/post-presence-service');
+
+const POST_ID = 'post-1';
+const OTHER_POST_ID = 'post-2';
+const USER = {id: 'u1', name: 'Alice', profileImage: 'http://example/a.png'};
+const OTHER_USER = {id: 'u2', name: 'Bob', profileImage: null};
+
+function makeService(opts = {}) {
+    return new PostPresenceService({idleMs: 1000, ttlMs: 5000, cleanupIntervalMs: 500, ...opts});
+}
+
+describe('PostPresenceService', function () {
+    let clock;
+
+    beforeEach(function () {
+        clock = sinon.useFakeTimers();
+    });
+
+    afterEach(function () {
+        clock.restore();
+    });
+
+    describe('constructor', function () {
+        it('throws when idleMs is greater than or equal to ttlMs', function () {
+            assert.throws(() => new PostPresenceService({idleMs: 1000, ttlMs: 1000}), /idleMs < ttlMs/);
+            assert.throws(() => new PostPresenceService({idleMs: 2000, ttlMs: 1000}), /idleMs < ttlMs/);
+        });
+
+        it('accepts valid options and applies defaults', function () {
+            const service = new PostPresenceService();
+            assert.equal(service.idleMs, 90 * 1000);
+            assert.equal(service.ttlMs, 180 * 1000);
+            assert.equal(service.cleanupIntervalMs, 30 * 1000);
+        });
+    });
+
+    describe('mark', function () {
+        it('publishes a post event for a new entry', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark(POST_ID, USER);
+
+            assert.equal(handler.callCount, 1);
+            const event = handler.firstCall.args[0];
+            assert.equal(event.type, 'post');
+            assert.equal(event.postId, POST_ID);
+            assert.equal(event.users.length, 1);
+            assert.equal(event.users[0].id, USER.id);
+            assert.equal(event.users[0].isIdle, false);
+            service.stop();
+        });
+
+        it('is silent on an already-active heartbeat (autosave dedup)', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark(POST_ID, USER);
+            assert.equal(handler.callCount, 1);
+
+            clock.tick(500); // well within idleMs
+            service.mark(POST_ID, USER);
+            assert.equal(handler.callCount, 1, 'second mark should not re-publish');
+            service.stop();
+        });
+
+        it('publishes on idle→active transition', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark(POST_ID, USER);
+            // Advance past idleMs and run the sweep so the entry flips idle.
+            clock.tick(1500);
+            assert.equal(handler.callCount, 2, 'sweep publishes idle transition');
+
+            service.mark(POST_ID, USER);
+            assert.equal(handler.callCount, 3, 'idle→active re-publishes');
+            assert.equal(handler.lastCall.args[0].users[0].isIdle, false);
+            service.stop();
+        });
+
+        it('ignores invalid input without throwing or publishing', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            assert.doesNotThrow(() => service.mark(undefined, USER));
+            assert.doesNotThrow(() => service.mark(POST_ID, null));
+            assert.doesNotThrow(() => service.mark(POST_ID, {}));
+            assert.doesNotThrow(() => service.mark(POST_ID, {id: ''}));
+
+            assert.equal(handler.callCount, 0);
+            assert.equal(service.snapshot().length, 0);
+            service.stop();
+        });
+    });
+
+    describe('lazy start', function () {
+        it('does not schedule the cleanup interval until the first mark', function () {
+            const service = makeService();
+            assert.equal(service._cleanupTimer, null);
+
+            service.subscribe(() => {});
+            assert.equal(service._cleanupTimer, null, 'subscribe alone should not start the timer');
+
+            service.mark(POST_ID, USER);
+            assert.ok(service._cleanupTimer, 'first mark starts the timer');
+
+            const initialTimer = service._cleanupTimer;
+            service.mark(POST_ID, OTHER_USER);
+            assert.equal(service._cleanupTimer, initialTimer, 'subsequent marks reuse the timer');
+            service.stop();
+        });
+    });
+
+    describe('_sweep transitions', function () {
+        it('flips active entries to idle past idleMs and removes them past ttlMs', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark(POST_ID, USER);
+            assert.equal(handler.callCount, 1);
+
+            // Within idleMs: no transition.
+            clock.tick(500);
+            assert.equal(handler.callCount, 1);
+            assert.equal(service.snapshot()[0].users[0].isIdle, false);
+
+            // Past idleMs: flips idle and publishes.
+            clock.tick(700);
+            assert.equal(handler.callCount, 2);
+            assert.equal(handler.lastCall.args[0].users[0].isIdle, true);
+
+            // Past ttlMs: removed and publishes empty list.
+            clock.tick(5000);
+            const lastEvent = handler.lastCall.args[0];
+            assert.equal(lastEvent.users.length, 0);
+            assert.equal(service.snapshot().length, 0);
+            service.stop();
+        });
+    });
+
+    describe('_cleanupAll error boundary', function () {
+        it('continues iterating other posts when a subscriber throws for one post', function () {
+            const service = makeService();
+            const calls = [];
+            service.subscribe((event) => {
+                calls.push(event.postId);
+                if (event.postId === POST_ID && event.users.length === 0) {
+                    throw new Error('boom');
+                }
+            });
+
+            service.mark(POST_ID, USER);
+            service.mark(OTHER_POST_ID, OTHER_USER);
+            calls.length = 0;
+
+            // Advance past ttlMs so both posts get cleaned up in the same sweep.
+            clock.tick(6000);
+
+            // The post that threw still publishes (the throw happens inside
+            // the subscriber). The other post must also publish — the
+            // per-iteration try/catch in _cleanupAll guarantees this.
+            assert.ok(calls.includes(POST_ID));
+            assert.ok(calls.includes(OTHER_POST_ID), 'other post still swept after a throwing subscriber');
+            service.stop();
+        });
+    });
+
+    describe('leave', function () {
+        it('is a no-op for an unknown post or user', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.leave('unknown', 'u1');
+            service.mark(POST_ID, USER);
+            handler.resetHistory();
+            service.leave(POST_ID, 'never-marked');
+
+            assert.equal(handler.callCount, 0);
+            service.stop();
+        });
+
+        it('emits empty users and drops the post when removing the last user', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark(POST_ID, USER);
+            handler.resetHistory();
+
+            service.leave(POST_ID, USER.id);
+            assert.equal(handler.callCount, 1);
+            assert.equal(handler.firstCall.args[0].users.length, 0);
+            assert.equal(service.snapshot().length, 0);
+            service.stop();
+        });
+    });
+
+    describe('snapshot / wire shape', function () {
+        it('drops stale entries and posts with no fresh users', function () {
+            const service = makeService();
+            service.mark(POST_ID, USER);
+            service.mark(OTHER_POST_ID, OTHER_USER);
+
+            clock.tick(6000); // past ttlMs
+
+            assert.deepEqual(service.snapshot(), []);
+            service.stop();
+        });
+
+        it('strips lastSeen from snapshot and post-event payloads', function () {
+            const service = makeService();
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark(POST_ID, USER);
+
+            const snapUser = service.snapshot()[0].users[0];
+            assert.equal(snapUser.lastSeen, undefined, 'snapshot user should not include lastSeen');
+
+            const eventUser = handler.firstCall.args[0].users[0];
+            assert.equal(eventUser.lastSeen, undefined, 'published event user should not include lastSeen');
+            service.stop();
+        });
+    });
+});

From 25b6f2f5e1dc9b85f41a5dc0a06d3e148da20894 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 12:58:34 +0300
Subject: [PATCH 04/11] Added labs-flag gate tests for editor presence

Locks the editorPresence flag-off behaviour so the feature cannot
silently activate if a future refactor breaks one of the gates.

Server (labs-gate.test.js):
- markPostPresence does not call postPresence.mark when flag is off
- markPostPresence calls postPresence.mark with the expected shape
  when flag is on
- presence-enter handler 404s and does not mark when flag is off
- presence-leave handler 404s and does not leave when flag is off
- presence-stream handler 404s and never subscribes when flag is off

Admin (presence-test.js):
- start() does not construct EventSource and does not register the
  pagehide handler when feature.editorPresence is false
- start() does construct EventSource when feature.editorPresence is true
---
 .../tests/unit/services/presence-test.js      |  54 +++++++++
 .../services/post-presence/labs-gate.test.js  | 104 ++++++++++++++++++
 2 files changed, 158 insertions(+)
 create mode 100644 ghost/admin/tests/unit/services/presence-test.js
 create mode 100644 ghost/core/test/unit/server/services/post-presence/labs-gate.test.js

diff --git a/ghost/admin/tests/unit/services/presence-test.js b/ghost/admin/tests/unit/services/presence-test.js
new file mode 100644
index 00000000000..78063217b2a
--- /dev/null
+++ b/ghost/admin/tests/unit/services/presence-test.js
@@ -0,0 +1,54 @@
+import sinon from 'sinon';
+import {describe, it} from 'mocha';
+import {expect} from 'chai';
+import {setupTest} from 'ember-mocha';
+
+describe('Unit: Service: presence', function () {
+    setupTest();
+
+    let service, feature, originalEventSource, eventSourceSpy;
+
+    beforeEach(function () {
+        service = this.owner.lookup('service:presence');
+        feature = this.owner.lookup('service:feature');
+
+        // Spy on the global EventSource constructor so we can assert it's
+        // never called when the flag is off.
+        originalEventSource = window.EventSource;
+        eventSourceSpy = sinon.stub().returns({
+            close: sinon.stub(),
+            onmessage: null,
+            onerror: null
+        });
+        window.EventSource = eventSourceSpy;
+        window.EventSource.CLOSED = originalEventSource ? originalEventSource.CLOSED : 2;
+        window.EventSource.CONNECTING = originalEventSource ? originalEventSource.CONNECTING : 0;
+    });
+
+    afterEach(function () {
+        service.stop();
+        window.EventSource = originalEventSource;
+        sinon.restore();
+    });
+
+    describe('start() labs gate', function () {
+        it('does not open an SSE connection when editorPresence is off', function () {
+            sinon.stub(feature, 'get').withArgs('editorPresence').returns(false);
+
+            service.start();
+
+            expect(eventSourceSpy.called, 'EventSource should not be constructed').to.be.false;
+            expect(service._source, '_source should remain null').to.be.null;
+            expect(service._beforeUnloadHandler, 'pagehide handler should not be registered').to.be.null;
+        });
+
+        it('opens the SSE connection when editorPresence is on', function () {
+            sinon.stub(feature, 'get').withArgs('editorPresence').returns(true);
+
+            service.start();
+
+            expect(eventSourceSpy.calledOnce, 'EventSource should be constructed once').to.be.true;
+            expect(service._source, '_source should be set').to.not.be.null;
+        });
+    });
+});
diff --git a/ghost/core/test/unit/server/services/post-presence/labs-gate.test.js b/ghost/core/test/unit/server/services/post-presence/labs-gate.test.js
new file mode 100644
index 00000000000..a7ff84cda29
--- /dev/null
+++ b/ghost/core/test/unit/server/services/post-presence/labs-gate.test.js
@@ -0,0 +1,104 @@
+const sinon = require('sinon');
+const rewire = require('rewire');
+
+const labs = require('../../../../../core/shared/labs');
+const postPresence = require('../../../../../core/server/services/post-presence');
+
+describe('PostPresence labs flag gate', function () {
+    let labsStub;
+
+    beforeEach(function () {
+        labsStub = sinon.stub(labs, 'isSet');
+    });
+
+    afterEach(function () {
+        sinon.restore();
+    });
+
+    describe('markPostPresence helper (posts.js)', function () {
+        // The helper isn't exported, so reach it via rewire.
+        const postsEndpoint = rewire('../../../../../core/server/api/endpoints/posts');
+        const markPostPresence = postsEndpoint.__get__('markPostPresence');
+
+        it('does not call postPresence.mark when editorPresence is off', function () {
+            labsStub.withArgs('editorPresence').returns(false);
+            const markSpy = sinon.spy(postPresence, 'mark');
+
+            markPostPresence(
+                {user: {id: 'u1', get: () => 'Alice'}},
+                {id: 'post-1'}
+            );
+
+            sinon.assert.notCalled(markSpy);
+        });
+
+        it('calls postPresence.mark when editorPresence is on', function () {
+            labsStub.withArgs('editorPresence').returns(true);
+            const markStub = sinon.stub(postPresence, 'mark');
+
+            markPostPresence(
+                {user: {id: 'u1', get: key => (key === 'name' ? 'Alice' : 'image.png')}},
+                {id: 'post-1'}
+            );
+
+            sinon.assert.calledOnce(markStub);
+            sinon.assert.calledWith(markStub, 'post-1', {
+                id: 'u1', name: 'Alice', profileImage: 'image.png'
+            });
+        });
+    });
+
+    describe('presence-enter handler', function () {
+        const handler = require('../../../../../core/server/web/api/endpoints/admin/lib/presence-enter');
+
+        it('returns 404 and does not mark when editorPresence is off', function () {
+            labsStub.withArgs('editorPresence').returns(false);
+            const markSpy = sinon.spy(postPresence, 'mark');
+            const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
+
+            handler({params: {id: 'p1'}, user: {id: 'u1', get: () => 'Alice'}}, res);
+
+            sinon.assert.calledWith(res.status, 404);
+            sinon.assert.notCalled(markSpy);
+        });
+    });
+
+    describe('presence-leave handler', function () {
+        const handler = require('../../../../../core/server/web/api/endpoints/admin/lib/presence-leave');
+
+        it('returns 404 and does not leave when editorPresence is off', function () {
+            labsStub.withArgs('editorPresence').returns(false);
+            const leaveSpy = sinon.spy(postPresence, 'leave');
+            const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
+
+            handler({params: {id: 'p1'}, user: {id: 'u1'}}, res);
+
+            sinon.assert.calledWith(res.status, 404);
+            sinon.assert.notCalled(leaveSpy);
+        });
+    });
+
+    describe('presence-stream handler', function () {
+        const handler = require('../../../../../core/server/web/api/endpoints/admin/lib/presence-stream');
+
+        it('returns 404 and never subscribes when editorPresence is off', function () {
+            labsStub.withArgs('editorPresence').returns(false);
+            const subscribeSpy = sinon.spy(postPresence, 'subscribe');
+            const res = {
+                status: sinon.stub().returnsThis(),
+                end: sinon.stub(),
+                writeHead: sinon.stub(),
+                flushHeaders: sinon.stub(),
+                write: sinon.stub(),
+                on: sinon.stub()
+            };
+            const req = {on: sinon.stub()};
+
+            handler(req, res);
+
+            sinon.assert.calledWith(res.status, 404);
+            sinon.assert.notCalled(res.writeHead);
+            sinon.assert.notCalled(subscribeSpy);
+        });
+    });
+});

From 8ad324c74a5abef0e8a96a0a8e181bcb16c5be1e Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 13:00:33 +0300
Subject: [PATCH 05/11] Added worst-case resilience tests for editor presence

Covers the two highest-severity failure modes flagged in review:

markPostPresence never breaks the parent /posts API call
- postPresence.mark throwing is swallowed
- labs.isSet throwing is swallowed
- frame.user.get throwing is swallowed

presence-stream cleans up listeners on every disconnect path
- req 'close' triggers unsubscribe
- res 'close' triggers unsubscribe
- cleanup is idempotent across req/res close+error
---
 .../post-presence/presence-resilience.test.js | 119 ++++++++++++++++++
 1 file changed, 119 insertions(+)
 create mode 100644 ghost/core/test/unit/server/services/post-presence/presence-resilience.test.js

diff --git a/ghost/core/test/unit/server/services/post-presence/presence-resilience.test.js b/ghost/core/test/unit/server/services/post-presence/presence-resilience.test.js
new file mode 100644
index 00000000000..6ee35c202b4
--- /dev/null
+++ b/ghost/core/test/unit/server/services/post-presence/presence-resilience.test.js
@@ -0,0 +1,119 @@
+const {EventEmitter} = require('events');
+const assert = require('node:assert/strict');
+const sinon = require('sinon');
+const rewire = require('rewire');
+
+const labs = require('../../../../../core/shared/labs');
+const postPresence = require('../../../../../core/server/services/post-presence');
+const presenceStream = require('../../../../../core/server/web/api/endpoints/admin/lib/presence-stream');
+
+describe('PostPresence resilience', function () {
+    let labsStub;
+
+    beforeEach(function () {
+        labsStub = sinon.stub(labs, 'isSet');
+    });
+
+    afterEach(function () {
+        sinon.restore();
+    });
+
+    describe('markPostPresence (posts.js) — never breaks the parent API call', function () {
+        const postsEndpoint = rewire('../../../../../core/server/api/endpoints/posts');
+        const markPostPresence = postsEndpoint.__get__('markPostPresence');
+
+        it('swallows errors from postPresence.mark', function () {
+            labsStub.withArgs('editorPresence').returns(true);
+            sinon.stub(postPresence, 'mark').throws(new Error('cache exploded'));
+
+            assert.doesNotThrow(() => markPostPresence(
+                {user: {id: 'u1', get: () => 'Alice'}},
+                {id: 'post-1'}
+            ));
+        });
+
+        it('swallows errors from labs.isSet itself', function () {
+            // Defensive: if the labs subsystem ever throws during isSet
+            // (boot order, stubbed labs, etc.) the post API must not crash.
+            labsStub.withArgs('editorPresence').throws(new Error('labs unavailable'));
+
+            assert.doesNotThrow(() => markPostPresence(
+                {user: {id: 'u1', get: () => 'Alice'}},
+                {id: 'post-1'}
+            ));
+        });
+
+        it('swallows errors from frame.user.get', function () {
+            labsStub.withArgs('editorPresence').returns(true);
+
+            assert.doesNotThrow(() => markPostPresence(
+                {user: {id: 'u1', get: () => {
+                    throw new Error('bookshelf getter blew up');
+                }}},
+                {id: 'post-1'}
+            ));
+        });
+    });
+
+    describe('presence-stream SSE handler — listener lifecycle', function () {
+        function makeReqRes() {
+            const req = new EventEmitter();
+            const res = new EventEmitter();
+            res.writeHead = sinon.stub();
+            res.flushHeaders = sinon.stub();
+            res.write = sinon.stub();
+            return {req, res};
+        }
+
+        it('unsubscribes from the bus when the request closes', function () {
+            labsStub.withArgs('editorPresence').returns(true);
+            const baseline = postPresence._emitter.listenerCount('presence');
+
+            const {req, res} = makeReqRes();
+            presenceStream(req, res);
+
+            assert.equal(
+                postPresence._emitter.listenerCount('presence'),
+                baseline + 1,
+                'handler should subscribe on open'
+            );
+
+            req.emit('close');
+
+            assert.equal(
+                postPresence._emitter.listenerCount('presence'),
+                baseline,
+                'handler should unsubscribe on req close'
+            );
+        });
+
+        it('also unsubscribes when the response emits close (proxy teardown path)', function () {
+            labsStub.withArgs('editorPresence').returns(true);
+            const baseline = postPresence._emitter.listenerCount('presence');
+
+            const {req, res} = makeReqRes();
+            presenceStream(req, res);
+            res.emit('close');
+
+            assert.equal(postPresence._emitter.listenerCount('presence'), baseline);
+        });
+
+        it('does not double-unsubscribe when multiple close/error events fire', function () {
+            labsStub.withArgs('editorPresence').returns(true);
+            const baseline = postPresence._emitter.listenerCount('presence');
+
+            const {req, res} = makeReqRes();
+            presenceStream(req, res);
+            req.emit('close');
+            req.emit('error', new Error('socket reset'));
+            res.emit('close');
+            res.emit('error', new Error('write after end'));
+
+            assert.equal(
+                postPresence._emitter.listenerCount('presence'),
+                baseline,
+                'cleanup should be idempotent across all four signals'
+            );
+        });
+    });
+});

From d483025d289a647bdf9776b8b0abe439802e7349 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 14:18:37 +0300
Subject: [PATCH 06/11] Hardened editor presence: per-subscriber filtering +
 auth fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses an adversarial review pass on the labs-flagged presence
feature. No user-visible change with the flag off.

Security (blockers):
- SSE per-subscriber filtering. The stream now carries authorIds
  per post; the SSE handler captures the subscriber's role and
  forwards events only when the subscriber is elevated (Owner /
  Administrator / Super Editor / Editor) OR appears in the post's
  authorIds. Author and Contributor no longer receive a feed of
  post IDs and activity for posts they cannot read.
- /presence/posts/:id/enter looks up the post through the user's
  context (Ghost's Post.permissible) so an unauthorized user
  cannot inject their avatar onto posts they have no permission
  for. The post's authorIds are passed through to the service.
- markPostPresence skips presence when the edit context is a
  staff API token (Zapier/Make/scripts) so automation runs no
  longer trigger phantom "currently editing" avatars.

Robustness:
- leave() and _cleanupAll() publish the empty-users event BEFORE
  clearing the postContext, so non-elevated subscribers in the
  authorIds list receive the clear and remove the stale avatar
  instead of waiting for TTL. Regression tests lock this in.
- Session middleware loads req.user without roles, so the SSE
  handler now force-loads them at connect (user.load(['roles']))
  before resolving elevated access.

UX:
- First-name tooltip collisions (two "Alex"es) now disambiguate
  with the last initial — "Alex S." / "Alex J."
- Admin presence service re-sends the current enter on SSE
  reconnect (EventSource onopen) so peers don't wait for the
  next autosave heartbeat to see the user reappear.

Cleanup:
- Dropped the dead service.PRESENCE_EVENT_TYPES assignment on the
  singleton — nobody read it.
- Fixed dangling refs in EDITOR-PRESENCE.md to docs that live on
  the poc/editor-multiplayer spike branch.

Tests (44 total, +18 in this commit):
- presence-security.test.js: per-subscriber filter; authorIds
  emitted on every event and in snapshot; SSE handler filters the
  snapshot AND per-event forwarding; enter handler authorizes via
  Post.findOne; markPostPresence skips api_key contexts and
  passes authorIds through; publish-before-delete ordering for
  both leave() and _cleanupAll() (the asymmetric-leave bug).
---
 .../app/components/gh-presence-avatars.js     |  20 +-
 ghost/admin/app/services/presence.js          |  16 +
 ghost/core/core/server/api/endpoints/posts.js |  28 +-
 .../server/services/post-presence/index.js    |   5 +-
 .../post-presence/post-presence-service.js    |  47 ++-
 .../post-presence/presence-permissions.js     |  40 ++
 .../api/endpoints/admin/lib/presence-enter.js |  50 ++-
 .../endpoints/admin/lib/presence-stream.js    |  43 ++-
 .../post-presence/presence-security.test.js   | 346 ++++++++++++++++++
 9 files changed, 564 insertions(+), 31 deletions(-)
 create mode 100644 ghost/core/core/server/services/post-presence/presence-permissions.js
 create mode 100644 ghost/core/test/unit/server/services/post-presence/presence-security.test.js

diff --git a/ghost/admin/app/components/gh-presence-avatars.js b/ghost/admin/app/components/gh-presence-avatars.js
index 492958b4790..47aa8dd5549 100644
--- a/ghost/admin/app/components/gh-presence-avatars.js
+++ b/ghost/admin/app/components/gh-presence-avatars.js
@@ -11,15 +11,29 @@ export default class GhPresenceAvatars extends Component {
     @service presence;
 
     get _allUsers() {
-        return this.presence.usersForPost(this.args.postId).map((user) => {
+        const raw = this.presence.usersForPost(this.args.postId);
+
+        // Detect first-name collisions so we can disambiguate ("Alex S."
+        // / "Alex J.") rather than rendering two identical tooltips.
+        const firstNameCounts = new Map();
+        const parsed = raw.map((user) => {
             const name = user.name || 'Someone';
             const parts = name.split(/\s+/).filter(Boolean);
             const firstName = parts[0] || name;
-            const tooltip = firstName.length > 20 ? `${firstName.slice(0, 20)}…` : firstName;
+            firstNameCounts.set(firstName, (firstNameCounts.get(firstName) || 0) + 1);
+            return {user, name, parts, firstName};
+        });
+
+        return parsed.map(({user, name, parts, firstName}) => {
+            let display = firstName;
+            if (firstNameCounts.get(firstName) > 1 && parts.length > 1) {
+                display = `${firstName} ${parts[parts.length - 1][0].toUpperCase()}.`;
+            }
+            const tooltip = display.length > 20 ? `${display.slice(0, 20)}…` : display;
             return {
                 id: user.id,
                 name,
-                firstName,
+                firstName: display,
                 tooltipText: user.isIdle ? `${tooltip} (idle)` : tooltip,
                 profileImage: user.profileImage || null,
                 isIdle: Boolean(user.isIdle),
diff --git a/ghost/admin/app/services/presence.js b/ghost/admin/app/services/presence.js
index 2f187c69876..6ed8b6e4e1c 100644
--- a/ghost/admin/app/services/presence.js
+++ b/ghost/admin/app/services/presence.js
@@ -44,6 +44,18 @@ export default class PresenceService extends Service {
             return;
         }
         this._source.onmessage = event => this._handleMessage(event);
+        this._source.onopen = () => {
+            // Fires on initial connect AND after EventSource auto-reconnect.
+            // Re-send the current enter so peers see the user without
+            // waiting for the next autosave heartbeat.
+            if (this._connectingErrorLogged) {
+                this._connectingErrorLogged = false;
+            }
+            this._connectingErrorCount = 0;
+            if (this._currentPostId) {
+                this._sendEnter(this._currentPostId);
+            }
+        };
         this._source.onerror = () => {
             // EventSource auto-reconnects on transient errors. Terminal
             // closures (401/403/404) leave readyState === CLOSED; log
@@ -107,6 +119,10 @@ export default class PresenceService extends Service {
             this.leavePost(this._currentPostId);
         }
         this._currentPostId = postId;
+        this._sendEnter(postId);
+    }
+
+    _sendEnter(postId) {
         const enterUrl = this.ghostPaths.url.api('presence', 'posts', postId, 'enter');
         fetch(enterUrl, {method: 'POST', credentials: 'include', keepalive: true})
             .catch(err => console.warn('[presence] enter failed', err)); // eslint-disable-line no-console
diff --git a/ghost/core/core/server/api/endpoints/posts.js b/ghost/core/core/server/api/endpoints/posts.js
index c5905c16e8c..fc7d0a6b5a6 100644
--- a/ghost/core/core/server/api/endpoints/posts.js
+++ b/ghost/core/core/server/api/endpoints/posts.js
@@ -30,9 +30,13 @@ const postsService = getPostServiceInstance();
  * so a failure in labs lookup, the user model, or the presence cache
  * never breaks the post API response.
  *
+ * Skipped for staff API token contexts — automation (Zapier, Make,
+ * scripts) updating posts in bulk would otherwise show phantom
+ * "currently editing" avatars across the org.
+ *
  * @param {Object} frame API framework frame
- * @param {{id: string}} postDto DTO returned by postsService.editPost
- *     (model.toJSON output, not the Bookshelf model)
+ * @param {{id: string, authors?: Array<{id: string}>}} postDto
+ *     DTO returned by postsService.editPost (model.toJSON output)
  */
 function markPostPresence(frame, postDto) {
     try {
@@ -42,11 +46,21 @@ function markPostPresence(frame, postDto) {
         if (!frame || !frame.user || !postDto || !postDto.id) {
             return;
         }
-        postPresence.mark(postDto.id, {
-            id: frame.user.id,
-            name: frame.user.get('name'),
-            profileImage: frame.user.get('profile_image')
-        });
+        if (frame.options && frame.options.context && frame.options.context.api_key) {
+            return;
+        }
+        const authorIds = Array.isArray(postDto.authors)
+            ? postDto.authors.map(author => author && author.id).filter(Boolean)
+            : [];
+        postPresence.mark(
+            postDto.id,
+            {
+                id: frame.user.id,
+                name: frame.user.get('name'),
+                profileImage: frame.user.get('profile_image')
+            },
+            {authorIds}
+        );
     } catch (err) {
         logging.warn({err}, 'Failed to record post presence');
     }
diff --git a/ghost/core/core/server/services/post-presence/index.js b/ghost/core/core/server/services/post-presence/index.js
index 781cde030fa..578e1de4ede 100644
--- a/ghost/core/core/server/services/post-presence/index.js
+++ b/ghost/core/core/server/services/post-presence/index.js
@@ -1,6 +1,3 @@
 const PostPresenceService = require('./post-presence-service');
 
-const service = new PostPresenceService();
-service.PRESENCE_EVENT_TYPES = PostPresenceService.PRESENCE_EVENT_TYPES;
-
-module.exports = service;
+module.exports = new PostPresenceService();
diff --git a/ghost/core/core/server/services/post-presence/post-presence-service.js b/ghost/core/core/server/services/post-presence/post-presence-service.js
index 4fb5766bb42..d400dd062cd 100644
--- a/ghost/core/core/server/services/post-presence/post-presence-service.js
+++ b/ghost/core/core/server/services/post-presence/post-presence-service.js
@@ -86,6 +86,13 @@ class PostPresenceService {
         this.cleanupIntervalMs = cleanupIntervalMs || Math.max(1000, Math.floor(ttlMs / 6));
         /** @type {Map<string, Map<string, PresenceEntry>>} */
         this._byPostId = new Map();
+        /**
+         * Per-post context (currently just the post's author IDs).
+         * Carried alongside each event so the SSE handler can filter
+         * by subscriber permission without an extra DB hop.
+         * @type {Map<string, {authorIds: string[]}>}
+         */
+        this._postContexts = new Map();
         this._emitter = new EventEmitter();
         this._emitter.setMaxListeners(1000);
         this._cleanupTimer = null;
@@ -122,10 +129,17 @@ class PostPresenceService {
      * heartbeats are silent on the bus so autosaves don't fan out N×M
      * events to every connected admin tab.
      *
+     * `postContext.authorIds` is captured per post and carried on every
+     * event for that post, so the SSE handler can filter what each
+     * subscriber sees by their permission to read the post. Callers
+     * (markPostPresence on the edit path, presence-enter) are expected
+     * to pass it; if omitted we keep whatever was previously stored.
+     *
      * @param {string} postId
      * @param {PresenceUser} user
+     * @param {{authorIds?: string[]}} [postContext]
      */
-    mark(postId, user) {
+    mark(postId, user, postContext) {
         if (!postId || !user || !user.id) {
             return;
         }
@@ -133,6 +147,10 @@ class PostPresenceService {
             this.start();
         }
 
+        if (postContext && Array.isArray(postContext.authorIds)) {
+            this._postContexts.set(postId, {authorIds: postContext.authorIds.slice()});
+        }
+
         const now = Date.now();
         const entries = this._byPostId.get(postId) || new Map();
         const prev = entries.get(user.id);
@@ -165,16 +183,23 @@ class PostPresenceService {
             return;
         }
         entries.delete(userId);
+        // Publish BEFORE dropping the postContext: subscribers who can
+        // see this post need the "users: []" event to clear stale
+        // avatars, and the filter depends on authorIds still being
+        // available at emit time.
+        this._publish(postId, entries);
         if (entries.size === 0) {
             this._byPostId.delete(postId);
+            this._postContexts.delete(postId);
         }
-        this._publish(postId, entries);
     }
 
     /**
-     * Filters stale entries on the way out.
+     * Filters stale entries on the way out. Each post carries its
+     * authorIds so the SSE handler can filter the snapshot by the
+     * subscriber's permission.
      *
-     * @returns {Array<{postId: string, users: PresenceUserView[]}>}
+     * @returns {Array<{postId: string, authorIds: string[], users: PresenceUserView[]}>}
      */
     snapshot() {
         const now = Date.now();
@@ -187,12 +212,17 @@ class PostPresenceService {
                 }
             }
             if (users.length > 0) {
-                out.push({postId, users});
+                out.push({postId, authorIds: this._authorIdsFor(postId), users});
             }
         }
         return out;
     }
 
+    _authorIdsFor(postId) {
+        const ctx = this._postContexts.get(postId);
+        return ctx && Array.isArray(ctx.authorIds) ? ctx.authorIds.slice() : [];
+    }
+
     /**
      * Strips `lastSeen` (internal sweep timestamp) from an entry before
      * it goes over the wire.
@@ -213,6 +243,7 @@ class PostPresenceService {
         const event = {
             type: PRESENCE_EVENT_TYPES.POST,
             postId,
+            authorIds: this._authorIdsFor(postId),
             users: entries ? Array.from(entries.values()).map(entry => this._toWireUser(entry)) : []
         };
         try {
@@ -234,10 +265,14 @@ class PostPresenceService {
                 if (!changed) {
                     continue;
                 }
+                // Publish first (see leave() — authorIds must still be
+                // populated at emit time so non-elevated subscribers
+                // who had this post receive the clear).
+                this._publish(postId, entries);
                 if (entries.size === 0) {
                     this._byPostId.delete(postId);
+                    this._postContexts.delete(postId);
                 }
-                this._publish(postId, entries);
             } catch (err) {
                 logging.warn({err, postId}, 'Presence cleanup iteration failed');
             }
diff --git a/ghost/core/core/server/services/post-presence/presence-permissions.js b/ghost/core/core/server/services/post-presence/presence-permissions.js
new file mode 100644
index 00000000000..17623d20a3e
--- /dev/null
+++ b/ghost/core/core/server/services/post-presence/presence-permissions.js
@@ -0,0 +1,40 @@
+// Roles that see all posts in the publication. Anyone with one of
+// these roles receives every presence event over SSE without further
+// per-post filtering. Author and Contributor are NOT elevated — for
+// them, the SSE handler filters events to only those for posts where
+// they're listed as an author.
+const ELEVATED_ROLES = ['Owner', 'Administrator', 'Super Editor', 'Editor'];
+
+function hasElevatedPresenceAccess(user) {
+    if (!user || typeof user.hasRole !== 'function') {
+        return false;
+    }
+    return ELEVATED_ROLES.some(role => user.hasRole(role));
+}
+
+/**
+ * Whether a subscriber should receive a presence event for a given
+ * post. Elevated roles see everything; non-elevated only see events
+ * for posts where they're listed as an author.
+ *
+ * @param {{elevated: boolean, userId: string}} subscriber
+ * @param {{authorIds?: string[]}} event
+ */
+function canReceiveEvent(subscriber, event) {
+    if (!subscriber) {
+        return false;
+    }
+    if (subscriber.elevated) {
+        return true;
+    }
+    if (!event || !Array.isArray(event.authorIds)) {
+        return false;
+    }
+    return event.authorIds.includes(subscriber.userId);
+}
+
+module.exports = {
+    hasElevatedPresenceAccess,
+    canReceiveEvent,
+    ELEVATED_ROLES
+};
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
index c151e25d285..cc7d9f220a8 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
@@ -1,13 +1,17 @@
 const logging = require('@tryghost/logging');
 const labs = require('../../../../../../shared/labs');
+const models = require('../../../../../models');
 const postPresence = require('../../../../../services/post-presence');
 
 /**
- * Explicit "I just opened this post in the editor" handler. Explicit
- * enter so opening the editor (not, say, viewing analytics) is what
- * registers presence. Best-effort.
+ * Explicit "I just opened this post in the editor" handler. Looks up
+ * the post through the user's context so Ghost's permission system
+ * rejects the call if the user can't read the post — that also keeps
+ * a Contributor from injecting their avatar onto posts they can't
+ * access. The post's author IDs are passed through so the SSE handler
+ * can filter events to other Authors/Contributors.
  */
-module.exports = function presenceEnter(req, res) {
+module.exports = async function presenceEnter(req, res) {
     try {
         if (!labs.isSet('editorPresence')) {
             res.status(404).end();
@@ -15,13 +19,43 @@ module.exports = function presenceEnter(req, res) {
         }
         const postId = req.params && req.params.id;
         const user = req.user;
-        if (postId && user && user.id) {
-            postPresence.mark(postId, {
+        if (!postId || !user || !user.id) {
+            res.status(204).end();
+            return;
+        }
+
+        let post;
+        try {
+            post = await models.Post.findOne(
+                {id: postId, status: 'all'},
+                {
+                    context: {user: user.id},
+                    withRelated: ['authors']
+                }
+            );
+        } catch (err) {
+            // Permission denied or other lookup failure — don't mark.
+            res.status(403).end();
+            return;
+        }
+        if (!post) {
+            res.status(404).end();
+            return;
+        }
+
+        const authorIds = post
+            .related('authors')
+            .map(author => author.get('id'));
+
+        postPresence.mark(
+            postId,
+            {
                 id: user.id,
                 name: user.get('name'),
                 profileImage: user.get('profile_image')
-            });
-        }
+            },
+            {authorIds}
+        );
     } catch (err) {
         logging.warn({err}, 'Failed to record presence enter');
     }
diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
index 8e76ea6af12..005ca2b9e5d 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-stream.js
@@ -2,18 +2,37 @@ const logging = require('@tryghost/logging');
 const labs = require('../../../../../../shared/labs');
 const postPresence = require('../../../../../services/post-presence');
 const {PRESENCE_EVENT_TYPES} = require('../../../../../services/post-presence/post-presence-service');
+const {
+    hasElevatedPresenceAccess,
+    canReceiveEvent
+} = require('../../../../../services/post-presence/presence-permissions');
 
 const KEEPALIVE_MS = 30 * 1000;
 
 /**
  * SSE handler that streams presence events to a single admin tab.
+ * Events are filtered per-subscriber so Author/Contributor only see
+ * events for posts they're listed as authors on; Editor+ see all.
  */
-module.exports = function presenceStream(req, res) {
+module.exports = async function presenceStream(req, res) {
     if (!labs.isSet('editorPresence')) {
         res.status(404).end();
         return;
     }
 
+    // Session middleware loads req.user without roles. Force-load
+    // them once at connect so hasElevatedPresenceAccess can resolve
+    // the user's role for per-event filtering.
+    if (req.user && typeof req.user.load === 'function') {
+        try {
+            await req.user.load(['roles']);
+        } catch (err) {
+            logging.warn({err}, 'presence-stream: failed to load user roles');
+            res.status(500).end();
+            return;
+        }
+    }
+
     try {
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -54,13 +73,31 @@ module.exports = function presenceStream(req, res) {
         }
     };
 
+    // Per-subscriber permission context, captured once at connect.
+    // Elevated roles (Owner/Admin/Super Editor/Editor) receive every
+    // event. Author/Contributor only receive events for posts where
+    // their user.id appears in the event's authorIds. This is the
+    // hard filter that keeps post IDs and activity from leaking
+    // across the role boundary via the SSE stream.
+    const subscriber = {
+        userId: req.user && req.user.id,
+        elevated: hasElevatedPresenceAccess(req.user)
+    };
+
     try {
-        sendEvent({type: PRESENCE_EVENT_TYPES.SNAPSHOT, posts: postPresence.snapshot()});
+        const filteredPosts = postPresence.snapshot().filter(post => canReceiveEvent(subscriber, post));
+        sendEvent({type: PRESENCE_EVENT_TYPES.SNAPSHOT, posts: filteredPosts});
     } catch (err) {
         logging.warn({err}, 'presence-stream: failed to send initial snapshot');
     }
 
-    const unsubscribe = postPresence.subscribe(sendEvent);
+    const forwardEvent = (event) => {
+        if (!canReceiveEvent(subscriber, event)) {
+            return;
+        }
+        sendEvent(event);
+    };
+    const unsubscribe = postPresence.subscribe(forwardEvent);
 
     // Comment frames keep idle proxies from dropping the connection.
     // EventSource ignores them on the client side.
diff --git a/ghost/core/test/unit/server/services/post-presence/presence-security.test.js b/ghost/core/test/unit/server/services/post-presence/presence-security.test.js
new file mode 100644
index 00000000000..a698afaa845
--- /dev/null
+++ b/ghost/core/test/unit/server/services/post-presence/presence-security.test.js
@@ -0,0 +1,346 @@
+const {EventEmitter} = require('events');
+const assert = require('node:assert/strict');
+const sinon = require('sinon');
+const rewire = require('rewire');
+
+const labs = require('../../../../../core/shared/labs');
+const models = require('../../../../../core/server/models');
+const postPresence = require('../../../../../core/server/services/post-presence');
+const PostPresenceService = require('../../../../../core/server/services/post-presence/post-presence-service');
+const {canReceiveEvent} = require('../../../../../core/server/services/post-presence/presence-permissions');
+const presenceStream = require('../../../../../core/server/web/api/endpoints/admin/lib/presence-stream');
+const presenceEnter = require('../../../../../core/server/web/api/endpoints/admin/lib/presence-enter');
+
+function fakeReqRes(user) {
+    const req = new EventEmitter();
+    req.user = user;
+    const res = new EventEmitter();
+    res.writeHead = sinon.stub();
+    res.flushHeaders = sinon.stub();
+    res.write = sinon.stub();
+    res.status = sinon.stub().returnsThis();
+    res.end = sinon.stub();
+    return {req, res};
+}
+
+function fakeUser({id, roles = []}) {
+    return {
+        id,
+        get: () => null,
+        hasRole: name => roles.includes(name)
+    };
+}
+
+describe('PostPresence security: per-subscriber filtering', function () {
+    let labsStub;
+
+    beforeEach(function () {
+        labsStub = sinon.stub(labs, 'isSet');
+        labsStub.withArgs('editorPresence').returns(true);
+    });
+
+    afterEach(function () {
+        sinon.restore();
+    });
+
+    describe('canReceiveEvent (the permission filter itself)', function () {
+        it('elevated subscribers receive every event regardless of authorIds', function () {
+            const editor = {userId: 'editor-1', elevated: true};
+            assert.equal(canReceiveEvent(editor, {authorIds: []}), true);
+            assert.equal(canReceiveEvent(editor, {authorIds: ['someone-else']}), true);
+            assert.equal(canReceiveEvent(editor, {}), true); // missing authorIds, elevated still sees
+        });
+
+        it('non-elevated subscribers ONLY see events where their userId is in authorIds', function () {
+            const author = {userId: 'author-1', elevated: false};
+            assert.equal(canReceiveEvent(author, {authorIds: ['author-1']}), true);
+            assert.equal(canReceiveEvent(author, {authorIds: ['author-1', 'editor-1']}), true);
+            assert.equal(canReceiveEvent(author, {authorIds: ['someone-else']}), false);
+            assert.equal(canReceiveEvent(author, {authorIds: []}), false);
+        });
+
+        it('non-elevated subscribers see nothing if the event has no authorIds', function () {
+            const author = {userId: 'author-1', elevated: false};
+            assert.equal(canReceiveEvent(author, {}), false);
+            assert.equal(canReceiveEvent(author, {authorIds: null}), false);
+            assert.equal(canReceiveEvent(author, {authorIds: 'not-an-array'}), false);
+        });
+
+        it('a null subscriber receives nothing', function () {
+            assert.equal(canReceiveEvent(null, {authorIds: ['x']}), false);
+        });
+    });
+
+    describe('service: authorIds are captured and emitted on every event', function () {
+        let service;
+        afterEach(function () {
+            if (service) {
+                service.stop();
+            }
+        });
+
+        it('mark stores postContext and includes authorIds in the published event', function () {
+            service = new PostPresenceService({idleMs: 1000, ttlMs: 5000, cleanupIntervalMs: 500});
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark('p1', {id: 'u1', name: 'A'}, {authorIds: ['u1', 'u2']});
+
+            assert.equal(handler.callCount, 1);
+            const event = handler.firstCall.args[0];
+            assert.deepEqual(event.authorIds, ['u1', 'u2']);
+        });
+
+        it('snapshot includes authorIds per post', function () {
+            service = new PostPresenceService({idleMs: 1000, ttlMs: 5000, cleanupIntervalMs: 500});
+            service.mark('p1', {id: 'u1', name: 'A'}, {authorIds: ['u1']});
+            service.mark('p2', {id: 'u2', name: 'B'}, {authorIds: ['u2', 'u3']});
+
+            const snap = service.snapshot();
+            const p1 = snap.find(p => p.postId === 'p1');
+            const p2 = snap.find(p => p.postId === 'p2');
+            assert.deepEqual(p1.authorIds, ['u1']);
+            assert.deepEqual(p2.authorIds, ['u2', 'u3']);
+        });
+
+        it('when last user leaves a post, the postContext is dropped', function () {
+            service = new PostPresenceService({idleMs: 1000, ttlMs: 5000, cleanupIntervalMs: 500});
+            service.mark('p1', {id: 'u1', name: 'A'}, {authorIds: ['u1']});
+            service.leave('p1', 'u1');
+
+            assert.equal(service._postContexts.has('p1'), false);
+        });
+
+        it('leave publishes BEFORE clearing the postContext so non-elevated subscribers still get the empty event', function () {
+            // Regression test: the published empty-leave event must
+            // carry the post's authorIds so a non-elevated subscriber
+            // who currently has this post in view receives the
+            // "users: []" signal and clears the stale avatar.
+            service = new PostPresenceService({idleMs: 1000, ttlMs: 5000, cleanupIntervalMs: 500});
+            const handler = sinon.spy();
+            service.subscribe(handler);
+
+            service.mark('p1', {id: 'editor-1', name: 'E'}, {authorIds: ['author-7']});
+            handler.resetHistory();
+
+            service.leave('p1', 'editor-1');
+
+            assert.equal(handler.callCount, 1);
+            const event = handler.firstCall.args[0];
+            assert.equal(event.users.length, 0);
+            assert.deepEqual(event.authorIds, ['author-7'], 'authorIds must survive the leave so subscribers in that list can receive the clear');
+        });
+
+        it('_cleanupAll publishes BEFORE clearing the postContext (TTL path)', function () {
+            const clock = sinon.useFakeTimers();
+            try {
+                service = new PostPresenceService({idleMs: 100, ttlMs: 300, cleanupIntervalMs: 50});
+                const handler = sinon.spy();
+                service.subscribe(handler);
+
+                service.mark('p1', {id: 'editor-1', name: 'E'}, {authorIds: ['author-7']});
+                handler.resetHistory();
+
+                clock.tick(400); // past ttlMs
+
+                const removalEvent = handler.getCalls().find(call => call.args[0].users.length === 0);
+                assert.ok(removalEvent, 'a removal event must fire');
+                assert.deepEqual(removalEvent.args[0].authorIds, ['author-7'], 'authorIds must survive TTL cleanup');
+            } finally {
+                clock.restore();
+            }
+        });
+    });
+
+    describe('SSE handler: an Author cannot see presence for posts they do not author', function () {
+        beforeEach(function () {
+            // Reset the singleton's state between tests so test order doesn't matter.
+            postPresence._byPostId.clear();
+            postPresence._postContexts.clear();
+        });
+
+        it('snapshot sent on connect is filtered: Author receives only their own post', function () {
+            // Two posts are active. The Author is only listed as an author on p1.
+            // The Editor's draft (p2) must NOT leak to the Author.
+            postPresence.mark('p1', {id: 'author-1', name: 'A'}, {authorIds: ['author-1']});
+            postPresence.mark('p2', {id: 'editor-1', name: 'E'}, {authorIds: ['editor-1']});
+
+            const author = fakeUser({id: 'author-1', roles: ['Author']});
+            const {req, res} = fakeReqRes(author);
+            presenceStream(req, res);
+
+            // First res.write call is the snapshot frame.
+            const writeCall = res.write.firstCall;
+            assert.ok(writeCall, 'snapshot should be written');
+            const sseFrame = writeCall.args[0];
+            // Parse the SSE data line.
+            const dataLine = sseFrame.match(/^data: (.+)\n\n$/)[1];
+            const payload = JSON.parse(dataLine);
+
+            assert.equal(payload.type, 'snapshot');
+            const postIds = payload.posts.map(p => p.postId);
+            assert.deepEqual(postIds, ['p1'], 'Author must only see p1, NEVER p2');
+
+            req.emit('close');
+        });
+
+        it('per-event forwarding: Author does not receive an event for an editor-only post', function () {
+            const author = fakeUser({id: 'author-1', roles: ['Author']});
+            const {req, res} = fakeReqRes(author);
+            presenceStream(req, res);
+            res.write.resetHistory();
+
+            // Editor marks themselves on p2 (Author has no role on this post).
+            postPresence.mark('p2', {id: 'editor-1', name: 'E'}, {authorIds: ['editor-1']});
+
+            // No SSE write should occur for the Author.
+            assert.equal(res.write.callCount, 0, 'Author must not receive events for p2');
+
+            req.emit('close');
+        });
+
+        it('per-event forwarding: Author DOES receive an event for a post they author', function () {
+            const author = fakeUser({id: 'author-1', roles: ['Author']});
+            const {req, res} = fakeReqRes(author);
+            presenceStream(req, res);
+            res.write.resetHistory();
+
+            postPresence.mark('p1', {id: 'editor-1', name: 'E'}, {authorIds: ['author-1', 'editor-1']});
+
+            assert.equal(res.write.callCount, 1, 'Author should receive event for p1');
+            const dataLine = res.write.firstCall.args[0].match(/^data: (.+)\n\n$/)[1];
+            const payload = JSON.parse(dataLine);
+            assert.equal(payload.postId, 'p1');
+
+            req.emit('close');
+        });
+
+        it('Editor (elevated) receives ALL events regardless of authorIds', function () {
+            const editor = fakeUser({id: 'editor-1', roles: ['Editor']});
+            const {req, res} = fakeReqRes(editor);
+            presenceStream(req, res);
+            res.write.resetHistory();
+
+            postPresence.mark('p99', {id: 'someone', name: 'S'}, {authorIds: ['somebody-else']});
+
+            assert.equal(res.write.callCount, 1, 'Editor sees every event');
+            const dataLine = res.write.firstCall.args[0].match(/^data: (.+)\n\n$/)[1];
+            assert.equal(JSON.parse(dataLine).postId, 'p99');
+
+            req.emit('close');
+        });
+
+        it('Contributor (non-elevated) does NOT see drafts they are not authoring', function () {
+            postPresence.mark('p-draft', {id: 'editor-1', name: 'E'}, {authorIds: ['editor-1']});
+
+            const contributor = fakeUser({id: 'contributor-1', roles: ['Contributor']});
+            const {req, res} = fakeReqRes(contributor);
+            presenceStream(req, res);
+
+            const dataLine = res.write.firstCall.args[0].match(/^data: (.+)\n\n$/)[1];
+            const payload = JSON.parse(dataLine);
+            assert.deepEqual(payload.posts, [], 'Contributor must see empty snapshot');
+
+            req.emit('close');
+        });
+    });
+
+    describe('presence-enter handler authorizes via the Post model', function () {
+        it('returns 403 when Post.findOne throws (permission denied)', async function () {
+            sinon.stub(models.Post, 'findOne').rejects(new Error('No permissions to read post.'));
+            const markSpy = sinon.spy(postPresence, 'mark');
+            const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
+
+            await presenceEnter(
+                {params: {id: 'p1'}, user: {id: 'u1', get: () => null}},
+                res
+            );
+
+            sinon.assert.calledWith(res.status, 403);
+            sinon.assert.notCalled(markSpy);
+        });
+
+        it('returns 404 when the post does not exist (findOne resolves null)', async function () {
+            sinon.stub(models.Post, 'findOne').resolves(null);
+            const markSpy = sinon.spy(postPresence, 'mark');
+            const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
+
+            await presenceEnter(
+                {params: {id: 'missing'}, user: {id: 'u1', get: () => null}},
+                res
+            );
+
+            sinon.assert.calledWith(res.status, 404);
+            sinon.assert.notCalled(markSpy);
+        });
+
+        it('passes authorIds from the post model through to mark()', async function () {
+            const fakePost = {
+                related: () => ({
+                    map: fn => [{id: 'u1'}, {id: 'u9'}].map(a => fn({get: k => a[k]}))
+                })
+            };
+            sinon.stub(models.Post, 'findOne').resolves(fakePost);
+            const markStub = sinon.stub(postPresence, 'mark');
+            const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
+
+            await presenceEnter(
+                {params: {id: 'p1'}, user: {id: 'u1', get: () => 'Alice'}},
+                res
+            );
+
+            sinon.assert.calledOnce(markStub);
+            const [postId, user, postContext] = markStub.firstCall.args;
+            assert.equal(postId, 'p1');
+            assert.equal(user.id, 'u1');
+            assert.deepEqual(postContext.authorIds, ['u1', 'u9']);
+            sinon.assert.calledWith(res.status, 204);
+        });
+    });
+
+    describe('markPostPresence helper (posts.js)', function () {
+        const postsEndpoint = rewire('../../../../../core/server/api/endpoints/posts');
+        const markPostPresence = postsEndpoint.__get__('markPostPresence');
+
+        it('does not mark when the edit came via a staff API token (api_key context)', function () {
+            const markSpy = sinon.spy(postPresence, 'mark');
+
+            markPostPresence(
+                {
+                    user: {id: 'u1', get: () => 'Alice'},
+                    options: {context: {api_key: 'some-api-key-id'}}
+                },
+                {id: 'post-1', authors: [{id: 'u1'}]}
+            );
+
+            sinon.assert.notCalled(markSpy);
+        });
+
+        it('passes authorIds extracted from the post DTO through to mark()', function () {
+            const markStub = sinon.stub(postPresence, 'mark');
+
+            markPostPresence(
+                {user: {id: 'u1', get: () => 'Alice'}, options: {context: {user: 'u1'}}},
+                {id: 'post-1', authors: [{id: 'u1'}, {id: 'u2'}]}
+            );
+
+            sinon.assert.calledOnce(markStub);
+            const [postId, user, postContext] = markStub.firstCall.args;
+            assert.equal(postId, 'post-1');
+            assert.equal(user.id, 'u1');
+            assert.deepEqual(postContext.authorIds, ['u1', 'u2']);
+        });
+
+        it('passes an empty authorIds array when the DTO has no authors field', function () {
+            const markStub = sinon.stub(postPresence, 'mark');
+
+            markPostPresence(
+                {user: {id: 'u1', get: () => 'Alice'}, options: {}},
+                {id: 'post-1'}
+            );
+
+            sinon.assert.calledOnce(markStub);
+            assert.deepEqual(markStub.firstCall.args[2].authorIds, []);
+        });
+    });
+});

From e4a6d98b043b4da24b584d9ed8eed8572e6245a7 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 16:09:22 +0300
Subject: [PATCH 07/11] Addressed CI failures and CodeRabbit / CodeQL feedback

- Updated config.test.js snapshot to include editorPresence in the
  labs map (e2e admin acceptance test fix)
- presence-enter: distinguish permission errors (still 403) from
  transient lookup failures (log + 204, preserving best-effort
  semantics). New test covers the 204 path.
- Added per-staff-user rate limiter on /presence/stream,
  /presence/posts/:id/enter, and /presence/posts/:id/leave via a
  new shared.middleware.brute.presenceLimiter. Backed by a new
  presenceBlock ExpressBrute instance with permissive defaults
  (600 requests / hour / user) so legitimate editor navigation
  never hits the limit, but a runaway client gets capped.
---
 .../api/endpoints/admin/lib/presence-enter.js | 11 ++++-
 .../server/web/api/endpoints/admin/routes.js  |  6 +--
 .../shared/middleware/api/spam-prevention.js  | 40 ++++++++++++++++++-
 .../server/web/shared/middleware/brute.js     | 19 +++++++++
 .../admin/__snapshots__/config.test.js.snap   |  1 +
 .../post-presence/presence-security.test.js   | 23 ++++++++++-
 6 files changed, 92 insertions(+), 8 deletions(-)

diff --git a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
index cc7d9f220a8..bf306851a86 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/lib/presence-enter.js
@@ -34,8 +34,15 @@ module.exports = async function presenceEnter(req, res) {
                 }
             );
         } catch (err) {
-            // Permission denied or other lookup failure — don't mark.
-            res.status(403).end();
+            // Only permission failures should be reported as 403. Other
+            // failures (transient DB, etc.) are logged and treated as
+            // best-effort — never block the editor flow.
+            if (err && (err.errorType === 'NoPermissionError' || err.statusCode === 403)) {
+                res.status(403).end();
+                return;
+            }
+            logging.warn({err, postId, userId: user.id}, 'presence-enter: post lookup failed');
+            res.status(204).end();
             return;
         }
         if (!post) {
diff --git a/ghost/core/core/server/web/api/endpoints/admin/routes.js b/ghost/core/core/server/web/api/endpoints/admin/routes.js
index b93b13292f2..df961e08b37 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/routes.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/routes.js
@@ -29,9 +29,9 @@ module.exports = function apiRoutes() {
     router.get('/explore', mw.authAdminApi, http(api.explore.read));
 
     // ## Presence (editorPresence labs flag; handlers 404 when off)
-    router.get('/presence/stream', mw.authAdminApi, presenceStream);
-    router.post('/presence/posts/:id/enter', mw.authAdminApi, presenceEnter);
-    router.post('/presence/posts/:id/leave', mw.authAdminApi, presenceLeave);
+    router.get('/presence/stream', mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceStream);
+    router.post('/presence/posts/:id/enter', mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceEnter);
+    router.post('/presence/posts/:id/leave', mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceLeave);
 
     // ## Posts
     router.get('/posts', mw.authAdminApi, http(api.posts.browse));
diff --git a/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js b/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js
index 9c66f57f8cc..0343c2d9cf6 100644
--- a/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js
+++ b/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js
@@ -26,7 +26,8 @@ const messages = {
         context: 'Too many verification code attempts.'
     },
     webmentionsBlock: 'Too many mention attempts',
-    emailPreviewBlock: 'Only 10 test emails can be sent per hour'
+    emailPreviewBlock: 'Only 10 test emails can be sent per hour',
+    presenceBlock: 'Too many editor presence requests, please slow down'
 };
 let spamPrivateBlock = spam.private_block || {};
 let spamGlobalBlock = spam.global_block || {};
@@ -39,6 +40,7 @@ let spamMemberLogin = spam.member_login || {};
 let spamContentApiKey = spam.content_api_key || {};
 let spamWebmentionsBlock = spam.webmentions_block || {};
 let spamEmailPreviewBlock = spam.email_preview_block || {};
+let spamPresenceBlock = spam.presence_block || {};
 let spamOtcVerificationEnumeration = spam.otc_verification_enumeration || {};
 let spamOtcVerification = spam.otc_verification || {};
 
@@ -56,6 +58,7 @@ let sendVerificationCodeInstance;
 let userVerificationInstance;
 let contentApiKeyInstance;
 let emailPreviewBlockInstance;
+let presenceBlockInstance;
 let otcVerificationEnumerationInstance;
 let otcVerificationInstance;
 
@@ -167,6 +170,38 @@ const webmentionsBlock = () => {
     return webmentionsBlockInstance;
 };
 
+// Per-staff-user limiter for editor presence POSTs (/enter, /leave).
+// Generous because legitimate use fires on every editor navigation:
+// 600 requests / hour / user is roughly 1 every 6s, comfortably above
+// expected editorial usage but tight enough to cap a runaway client.
+const presenceBlock = () => {
+    const ExpressBrute = require('express-brute');
+    const BruteKnex = require('brute-knex');
+    const db = require('../../../../data/db');
+
+    store = store || new BruteKnex({
+        tablename: 'brute',
+        createTable: false,
+        knex: db.knex
+    });
+
+    presenceBlockInstance = presenceBlockInstance || new ExpressBrute(store,
+        extend({
+            attachResetToRequest: false,
+            failCallback(req, res, next) {
+                return next(new errors.TooManyRequestsError({
+                    message: messages.presenceBlock
+                }));
+            },
+            handleStoreError: handleStoreError,
+            freeRetries: 600,
+            lifetime: 60 * 60
+        }, pick(spamPresenceBlock, spamConfigKeys))
+    );
+
+    return presenceBlockInstance;
+};
+
 const emailPreviewBlock = () => {
     const ExpressBrute = require('express-brute');
     const BruteKnex = require('brute-knex');
@@ -509,6 +544,7 @@ module.exports = {
     contentApiKey: contentApiKey,
     webmentionsBlock: webmentionsBlock,
     emailPreviewBlock: emailPreviewBlock,
+    presenceBlock: presenceBlock,
     reset: () => {
         store = undefined;
         memoryStore = undefined;
@@ -524,6 +560,8 @@ module.exports = {
         contentApiKeyInstance = undefined;
         otcVerificationEnumerationInstance = undefined;
         otcVerificationInstance = undefined;
+        emailPreviewBlockInstance = undefined;
+        presenceBlockInstance = undefined;
 
         spam = config.get('spam') || {};
         spamPrivateBlock = spam.private_block || {};
diff --git a/ghost/core/core/server/web/shared/middleware/brute.js b/ghost/core/core/server/web/shared/middleware/brute.js
index f249422a839..b2f4b2614dd 100644
--- a/ghost/core/core/server/web/shared/middleware/brute.js
+++ b/ghost/core/core/server/web/shared/middleware/brute.js
@@ -175,5 +175,24 @@ module.exports = {
                 return _next('preview_email_blocked');
             }
         })(req, res, next);
+    },
+
+    /**
+     * Per-staff-user limiter for the editor presence POST endpoints.
+     * Generous limits so legitimate editor navigation never hits them;
+     * tight enough to bound a runaway client.
+     */
+    presenceLimiter(req, res, next) {
+        return spamPrevention.presenceBlock().getMiddleware({
+            ignoreIP: true,
+            key(_req, _res, _next) {
+                // Keyed by the authenticated staff user. Falls back to
+                // a static key for unauthenticated requests so the
+                // limiter still exists (those should be rejected by
+                // mw.authAdminApi before reaching this point).
+                const userId = _req.user && _req.user.id;
+                return _next(userId ? `presence_${userId}` : 'presence_anon');
+            }
+        })(req, res, next);
     }
 };
diff --git a/ghost/core/test/e2e-api/admin/__snapshots__/config.test.js.snap b/ghost/core/test/e2e-api/admin/__snapshots__/config.test.js.snap
index 1437a03c0a0..2a1b9c6f4c3 100644
--- a/ghost/core/test/e2e-api/admin/__snapshots__/config.test.js.snap
+++ b/ghost/core/test/e2e-api/admin/__snapshots__/config.test.js.snap
@@ -18,6 +18,7 @@ Object {
       "customFonts": true,
       "dangerZoneResetAuth": true,
       "editorExcerpt": true,
+      "editorPresence": true,
       "emailCustomization": true,
       "emailUniqueid": true,
       "explore": true,
diff --git a/ghost/core/test/unit/server/services/post-presence/presence-security.test.js b/ghost/core/test/unit/server/services/post-presence/presence-security.test.js
index a698afaa845..3aa0f034912 100644
--- a/ghost/core/test/unit/server/services/post-presence/presence-security.test.js
+++ b/ghost/core/test/unit/server/services/post-presence/presence-security.test.js
@@ -246,8 +246,10 @@ describe('PostPresence security: per-subscriber filtering', function () {
     });
 
     describe('presence-enter handler authorizes via the Post model', function () {
-        it('returns 403 when Post.findOne throws (permission denied)', async function () {
-            sinon.stub(models.Post, 'findOne').rejects(new Error('No permissions to read post.'));
+        it('returns 403 when Post.findOne throws a permission error', async function () {
+            const permError = new Error('No permissions to read post.');
+            permError.errorType = 'NoPermissionError';
+            sinon.stub(models.Post, 'findOne').rejects(permError);
             const markSpy = sinon.spy(postPresence, 'mark');
             const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
 
@@ -260,6 +262,23 @@ describe('PostPresence security: per-subscriber filtering', function () {
             sinon.assert.notCalled(markSpy);
         });
 
+        it('returns 204 (best-effort, no mark) when Post.findOne throws a non-permission error', async function () {
+            // Transient errors (DB blip, etc.) must not be misreported
+            // as 403. The presence flow degrades silently — no avatar
+            // appears for the caller, but the editor continues normally.
+            sinon.stub(models.Post, 'findOne').rejects(new Error('Connection reset'));
+            const markSpy = sinon.spy(postPresence, 'mark');
+            const res = {status: sinon.stub().returnsThis(), end: sinon.stub()};
+
+            await presenceEnter(
+                {params: {id: 'p1'}, user: {id: 'u1', get: () => null}},
+                res
+            );
+
+            sinon.assert.calledWith(res.status, 204);
+            sinon.assert.notCalled(markSpy);
+        });
+
         it('returns 404 when the post does not exist (findOne resolves null)', async function () {
             sinon.stub(models.Post, 'findOne').resolves(null);
             const markSpy = sinon.spy(postPresence, 'mark');

From 778a47cb649c48ddfc2d4e8b1399211a13868771 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 16:32:46 +0300
Subject: [PATCH 08/11] Added pre-auth IP rate limiter to presence routes

Addresses CodeQL js/missing-rate-limiting on /presence/stream,
/enter, and /leave. The per-user limiter remains in place (after
auth, keyed by req.user.id, 600/hr/user) and now sits behind a
per-IP limiter applied before mw.authAdminApi (6000/hr/IP).

Defense in depth: unauthenticated DoS attempts are now bounded
before they hit the auth layer; legitimate editorial use is well
below both ceilings (~60 requests/hour per active editor).

Both limits are overridable via config:
  spam.presence_ip_block.freeRetries
  spam.presence_block.freeRetries
---
 .../server/web/api/endpoints/admin/routes.js  |  9 ++--
 .../shared/middleware/api/spam-prevention.js  | 50 +++++++++++++++++--
 .../server/web/shared/middleware/brute.js     | 25 +++++++---
 3 files changed, 69 insertions(+), 15 deletions(-)

diff --git a/ghost/core/core/server/web/api/endpoints/admin/routes.js b/ghost/core/core/server/web/api/endpoints/admin/routes.js
index df961e08b37..049800a9ef6 100644
--- a/ghost/core/core/server/web/api/endpoints/admin/routes.js
+++ b/ghost/core/core/server/web/api/endpoints/admin/routes.js
@@ -29,9 +29,12 @@ module.exports = function apiRoutes() {
     router.get('/explore', mw.authAdminApi, http(api.explore.read));
 
     // ## Presence (editorPresence labs flag; handlers 404 when off)
-    router.get('/presence/stream', mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceStream);
-    router.post('/presence/posts/:id/enter', mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceEnter);
-    router.post('/presence/posts/:id/leave', mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceLeave);
+    // Two-stage rate limit: per-IP before auth (loose, defense in
+    // depth against unauthenticated DoS), per-user after auth (tight,
+    // catches a runaway authenticated client).
+    router.get('/presence/stream', shared.middleware.brute.presenceIpLimiter, mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceStream);
+    router.post('/presence/posts/:id/enter', shared.middleware.brute.presenceIpLimiter, mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceEnter);
+    router.post('/presence/posts/:id/leave', shared.middleware.brute.presenceIpLimiter, mw.authAdminApi, shared.middleware.brute.presenceLimiter, presenceLeave);
 
     // ## Posts
     router.get('/posts', mw.authAdminApi, http(api.posts.browse));
diff --git a/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js b/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js
index 0343c2d9cf6..5b1999e5906 100644
--- a/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js
+++ b/ghost/core/core/server/web/shared/middleware/api/spam-prevention.js
@@ -27,7 +27,8 @@ const messages = {
     },
     webmentionsBlock: 'Too many mention attempts',
     emailPreviewBlock: 'Only 10 test emails can be sent per hour',
-    presenceBlock: 'Too many editor presence requests, please slow down'
+    presenceBlock: 'Too many editor presence requests, please slow down',
+    presenceIpBlock: 'Too many editor presence requests from this IP, please slow down'
 };
 let spamPrivateBlock = spam.private_block || {};
 let spamGlobalBlock = spam.global_block || {};
@@ -41,6 +42,7 @@ let spamContentApiKey = spam.content_api_key || {};
 let spamWebmentionsBlock = spam.webmentions_block || {};
 let spamEmailPreviewBlock = spam.email_preview_block || {};
 let spamPresenceBlock = spam.presence_block || {};
+let spamPresenceIpBlock = spam.presence_ip_block || {};
 let spamOtcVerificationEnumeration = spam.otc_verification_enumeration || {};
 let spamOtcVerification = spam.otc_verification || {};
 
@@ -59,6 +61,7 @@ let userVerificationInstance;
 let contentApiKeyInstance;
 let emailPreviewBlockInstance;
 let presenceBlockInstance;
+let presenceIpBlockInstance;
 let otcVerificationEnumerationInstance;
 let otcVerificationInstance;
 
@@ -170,10 +173,45 @@ const webmentionsBlock = () => {
     return webmentionsBlockInstance;
 };
 
-// Per-staff-user limiter for editor presence POSTs (/enter, /leave).
-// Generous because legitimate use fires on every editor navigation:
-// 600 requests / hour / user is roughly 1 every 6s, comfortably above
-// expected editorial usage but tight enough to cap a runaway client.
+// Per-IP defense-in-depth limiter for the presence routes, applied
+// BEFORE authentication so unauthenticated DoS attempts are bounded
+// before they hit the auth layer. Loose (6000 / hour / IP ≈ 100 / min)
+// so a shared office IP with many staff never hits it under normal
+// use; tight enough to stop a runaway anon attacker.
+const presenceIpBlock = () => {
+    const ExpressBrute = require('express-brute');
+    const BruteKnex = require('brute-knex');
+    const db = require('../../../../data/db');
+
+    store = store || new BruteKnex({
+        tablename: 'brute',
+        createTable: false,
+        knex: db.knex
+    });
+
+    presenceIpBlockInstance = presenceIpBlockInstance || new ExpressBrute(store,
+        extend({
+            attachResetToRequest: false,
+            failCallback(req, res, next) {
+                return next(new errors.TooManyRequestsError({
+                    message: messages.presenceIpBlock
+                }));
+            },
+            handleStoreError: handleStoreError,
+            freeRetries: 6000,
+            lifetime: 60 * 60
+        }, pick(spamPresenceIpBlock, spamConfigKeys))
+    );
+
+    return presenceIpBlockInstance;
+};
+
+// Per-staff-user limiter for editor presence routes, applied AFTER
+// authentication so the key can use req.user.id. Generous because
+// legitimate use fires on every editor navigation: 600 requests /
+// hour / user is roughly 1 every 6s, comfortably above expected
+// editorial usage but tight enough to cap a runaway authenticated
+// client.
 const presenceBlock = () => {
     const ExpressBrute = require('express-brute');
     const BruteKnex = require('brute-knex');
@@ -545,6 +583,7 @@ module.exports = {
     webmentionsBlock: webmentionsBlock,
     emailPreviewBlock: emailPreviewBlock,
     presenceBlock: presenceBlock,
+    presenceIpBlock: presenceIpBlock,
     reset: () => {
         store = undefined;
         memoryStore = undefined;
@@ -562,6 +601,7 @@ module.exports = {
         otcVerificationInstance = undefined;
         emailPreviewBlockInstance = undefined;
         presenceBlockInstance = undefined;
+        presenceIpBlockInstance = undefined;
 
         spam = config.get('spam') || {};
         spamPrivateBlock = spam.private_block || {};
diff --git a/ghost/core/core/server/web/shared/middleware/brute.js b/ghost/core/core/server/web/shared/middleware/brute.js
index b2f4b2614dd..b966570b820 100644
--- a/ghost/core/core/server/web/shared/middleware/brute.js
+++ b/ghost/core/core/server/web/shared/middleware/brute.js
@@ -178,18 +178,29 @@ module.exports = {
     },
 
     /**
-     * Per-staff-user limiter for the editor presence POST endpoints.
-     * Generous limits so legitimate editor navigation never hits them;
-     * tight enough to bound a runaway client.
+     * Per-IP defense-in-depth limiter for the editor presence routes,
+     * applied BEFORE authentication so unauthenticated DoS attempts
+     * are bounded before they hit the auth layer.
+     */
+    presenceIpLimiter(req, res, next) {
+        return spamPrevention.presenceIpBlock().getMiddleware({
+            ignoreIP: false,
+            key(_req, _res, _next) {
+                return _next('presence_ip');
+            }
+        })(req, res, next);
+    },
+
+    /**
+     * Per-staff-user limiter for the editor presence routes, applied
+     * AFTER authentication so the key can use req.user.id. Generous
+     * limits so legitimate editor navigation never hits them; tight
+     * enough to bound a runaway authenticated client.
      */
     presenceLimiter(req, res, next) {
         return spamPrevention.presenceBlock().getMiddleware({
             ignoreIP: true,
             key(_req, _res, _next) {
-                // Keyed by the authenticated staff user. Falls back to
-                // a static key for unauthenticated requests so the
-                // limiter still exists (those should be rejected by
-                // mw.authAdminApi before reaching this point).
                 const userId = _req.user && _req.user.id;
                 return _next(userId ? `presence_${userId}` : 'presence_anon');
             }

From f080749da011700716851afc862315866d3bf7b6 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 17:10:45 +0300
Subject: [PATCH 09/11] Added E2E acceptance tests for presence routes

Brings E2E coverage back above the codecov 0.2% threshold by
exercising the new presence routes end-to-end. Covers:

- All 3 routes return 403 to unauthenticated requests
- /enter returns 404 for non-existent posts
- /enter returns 204 for a valid post (Owner)
- /leave returns 204 regardless of state (idempotent)
- /enter and /leave work for an Author on their own post

These complement the existing 45 unit tests by exercising the
real Express middleware chain, route registration, and the
Post.findOne permission lookup that's hard to test in isolation.
---
 .../core/test/e2e-api/admin/presence.test.js  | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 ghost/core/test/e2e-api/admin/presence.test.js

diff --git a/ghost/core/test/e2e-api/admin/presence.test.js b/ghost/core/test/e2e-api/admin/presence.test.js
new file mode 100644
index 00000000000..c656a727511
--- /dev/null
+++ b/ghost/core/test/e2e-api/admin/presence.test.js
@@ -0,0 +1,78 @@
+const {agentProvider, fixtureManager} = require('../../utils/e2e-framework');
+
+describe('Presence API', function () {
+    let agent;
+
+    before(async function () {
+        agent = await agentProvider.getAdminAPIAgent();
+        await fixtureManager.init('users', 'posts');
+    });
+
+    describe('As Unauthorized User', function () {
+        it('rejects /presence/stream', async function () {
+            await agent.get('/presence/stream/').expectStatus(403);
+        });
+
+        it('rejects /presence/posts/:id/enter', async function () {
+            await agent.post('/presence/posts/abc123/enter/').expectStatus(403);
+        });
+
+        it('rejects /presence/posts/:id/leave', async function () {
+            await agent.post('/presence/posts/abc123/leave/').expectStatus(403);
+        });
+    });
+
+    describe('As Owner', function () {
+        before(async function () {
+            await agent.loginAsOwner();
+        });
+
+        it('returns 404 from /presence/posts/:id/enter for a non-existent post', async function () {
+            await agent
+                .post('/presence/posts/non-existent-id/enter/')
+                .expectStatus(404);
+        });
+
+        it('returns 204 from /presence/posts/:id/enter for a real post', async function () {
+            const postId = fixtureManager.get('posts', 0).id;
+            await agent
+                .post(`/presence/posts/${postId}/enter/`)
+                .expectStatus(204);
+        });
+
+        it('returns 204 from /presence/posts/:id/leave regardless of state', async function () {
+            const postId = fixtureManager.get('posts', 0).id;
+            await agent
+                .post(`/presence/posts/${postId}/leave/`)
+                .expectStatus(204);
+        });
+
+        it('returns 204 from /presence/posts/:id/leave even for a post the user never entered', async function () {
+            await agent
+                .post('/presence/posts/never-entered/leave/')
+                .expectStatus(204);
+        });
+    });
+
+    describe('As Author (non-elevated role)', function () {
+        before(async function () {
+            await agent.loginAsAuthor();
+        });
+
+        it('returns 204 from /presence/posts/:id/enter for a post the author owns', async function () {
+            // The author fixture authors their own post; the lookup
+            // via Post.findOne with the user context will succeed.
+            const ownPostId = fixtureManager.get('posts', 6).id;
+            await agent
+                .post(`/presence/posts/${ownPostId}/enter/`)
+                .expectStatus(204);
+        });
+
+        it('returns 204 from /presence/posts/:id/leave', async function () {
+            const ownPostId = fixtureManager.get('posts', 6).id;
+            await agent
+                .post(`/presence/posts/${ownPostId}/leave/`)
+                .expectStatus(204);
+        });
+    });
+});

From a12a651d8960580eb170d41530251156d1a1c33d Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 17:37:00 +0300
Subject: [PATCH 10/11] Added labs-off E2E tests for presence routes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three more acceptance tests covering the labs flag gate at the HTTP
layer. With editorPresence disabled via mockManager, each of the
three routes returns 404 — verifies the labs.isSet branch in each
handler.

Brings the E2E suite for presence to 12 tests, addressing the
codecov project coverage gate.
---
 .../core/test/e2e-api/admin/presence.test.js  | 34 ++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/ghost/core/test/e2e-api/admin/presence.test.js b/ghost/core/test/e2e-api/admin/presence.test.js
index c656a727511..f31b638340c 100644
--- a/ghost/core/test/e2e-api/admin/presence.test.js
+++ b/ghost/core/test/e2e-api/admin/presence.test.js
@@ -1,4 +1,4 @@
-const {agentProvider, fixtureManager} = require('../../utils/e2e-framework');
+const {agentProvider, fixtureManager, mockManager} = require('../../utils/e2e-framework');
 
 describe('Presence API', function () {
     let agent;
@@ -8,6 +8,10 @@ describe('Presence API', function () {
         await fixtureManager.init('users', 'posts');
     });
 
+    afterEach(function () {
+        mockManager.restore();
+    });
+
     describe('As Unauthorized User', function () {
         it('rejects /presence/stream', async function () {
             await agent.get('/presence/stream/').expectStatus(403);
@@ -75,4 +79,32 @@ describe('Presence API', function () {
                 .expectStatus(204);
         });
     });
+
+    describe('With editorPresence labs flag disabled', function () {
+        before(async function () {
+            await agent.loginAsOwner();
+        });
+
+        beforeEach(function () {
+            mockManager.mockLabsDisabled('editorPresence');
+        });
+
+        it('returns 404 from /presence/stream', async function () {
+            await agent.get('/presence/stream/').expectStatus(404);
+        });
+
+        it('returns 404 from /presence/posts/:id/enter', async function () {
+            const postId = fixtureManager.get('posts', 0).id;
+            await agent
+                .post(`/presence/posts/${postId}/enter/`)
+                .expectStatus(404);
+        });
+
+        it('returns 404 from /presence/posts/:id/leave', async function () {
+            const postId = fixtureManager.get('posts', 0).id;
+            await agent
+                .post(`/presence/posts/${postId}/leave/`)
+                .expectStatus(404);
+        });
+    });
 });

From 3d163caafabf803aca32195a8f89c4f165ca26d3 Mon Sep 17 00:00:00 2001
From: Renato Costa <renatocesarcp@gmail.com>
Date: Thu, 28 May 2026 17:43:31 +0300
Subject: [PATCH 11/11] Regenerated pnpm-lock.yaml after rebase

The auto-merge between this branch and main was producing a
duplicated mapping key (jiti@2.7.0) because several recent
dependency-bump commits on main each touched the lockfile in
overlapping ways. Regenerated cleanly with pnpm install
--lockfile-only.
---
 pnpm-lock.yaml | 114 +++++++++++++++++++++++++++++++++++--------------
 1 file changed, 83 insertions(+), 31 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 66700a734a8..489653429ba 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2977,6 +2977,10 @@ packages:
     resolution: {integrity: sha512-I7FLyoQtf6Jv4fC++1DavM/HVknyb4Un8V5/uuVMd3AlvfsuprcPF0iLYce3bFjjoKKg8H2lC9uXKAPjwwgsqw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/core@3.974.13':
+    resolution: {integrity: sha512-+Y5/4tHki0uYgyx8eun146DegRVQBpdKGK5RbV0FTKJPpaKTchvqVxrrRFK6Wk0JksO4iAZKw3eqxGEIwtO98w==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/core@3.974.14':
     resolution: {integrity: sha512-ppamm04uoj3hhNO5IlQSs5D6rWX1fWkzcn6a4pZrojk8Y6ObY9wzLDdT/Eq3gv6O9hOebi9tYTNB8b8fQj9XJw==}
     engines: {node: '>=20.0.0'}
@@ -3045,6 +3049,10 @@ packages:
     resolution: {integrity: sha512-nWXXJ1r/r8N2Gw1pWolRgED38/A9A8DHR2ETWIv220zh4PZHcybbR4hUVWWktmNXTRHzDJwRluapHn0rZxuoqA==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/signature-v4-multi-region@3.996.28':
+    resolution: {integrity: sha512-qs9z5LqXO/CZC2Lg9SGKpoLU8Rhi+m2pFKZqfO9pytX1clc0katqtsDNupJxFy0xT9wsZSPzM2v1y+/H/zfp5Q==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/signature-v4-multi-region@3.996.29':
     resolution: {integrity: sha512-Few9FoQqOt/0KSvZYP+qdW0dfOhfQ9N+gl2UUDvCPW6mkPKHli9LMbKxWj+wZ5zKPaOoqxuR3Hhy3OTpndkfSw==}
     engines: {node: '>=20.0.0'}
@@ -3061,6 +3069,10 @@ packages:
     resolution: {integrity: sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/xml-builder@3.972.25':
+    resolution: {integrity: sha512-GH+Kjz4nPKWKHnsiQpnhP1MJdTGIcK4rAka6tzakgjjUkVgNsmPeEbbRAf09SzS1hjGu6duGHCBsxYke0BhHjQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/xml-builder@3.972.26':
     resolution: {integrity: sha512-cDbrqvDS73whl6YAPSPq0U6whzG6UWI9PuWh0wrUuGoZexhWEqhdunbukV7iBoaWnFV1AODutM5hOD6rtn439g==}
     engines: {node: '>=20.0.0'}
@@ -9062,6 +9074,9 @@ packages:
   '@types/react-world-flags@1.6.0':
     resolution: {integrity: sha512-j/uVy2fnG8gX3Ckic4sccYm9XjieasUsJDMqBDtdPdcwe3aFfz+iBbds+wxOiTzfe5BErVGjdFu6NO1hCg/7lw==}
 
+  '@types/react@18.3.28':
+    resolution: {integrity: sha512-z9VXpC7MWrhfWipitjNdgCauoMLRdIILQsAEV+ZesIzBq/oUlxk0m3ApZuMFCXdnS4U7KrI+l3WRUEGQ8K1QKw==}
+
   '@types/react@18.3.29':
     resolution: {integrity: sha512-ch0qJdr2JY0r04NXSprbK6TXOgnaJ1Tz23fm5W+z0/CBah6BSBc3n96h7K9GOtwh0HrilNWHIBzE1Ko4Dcw/Wg==}
 
@@ -14427,6 +14442,10 @@ packages:
     resolution: {integrity: sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==}
     engines: {node: '>=18'}
 
+  globals@17.4.0:
+    resolution: {integrity: sha512-hjrNztw/VajQwOLsMNT1cbJiH2muO3OROCHnbehc8eY5JyD2gqz4AcMHPqgaOR59DjgUjYAYLeH699g/eWi2jw==}
+    engines: {node: '>=18'}
+
   globals@17.6.0:
     resolution: {integrity: sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==}
     engines: {node: '>=18'}
@@ -14467,7 +14486,7 @@ packages:
       csstype: ^3.0.10
 
   google-caja-bower@https://codeload.github.com/acburdine/google-caja-bower/tar.gz/275cb75249f038492094a499756a73719ae071fd:
-    resolution: {gitHosted: true, tarball: https://codeload.github.com/acburdine/google-caja-bower/tar.gz/275cb75249f038492094a499756a73719ae071fd}
+    resolution: {gitHosted: true, integrity: sha512-mmCXdxGKGKDznjgkNzVqzTslaldslk5KMb/A7l8rxWnqyxzwsdPhuBJ6oT1Kh/Y3k4jN54ISee/2AgjFyCBxYw==, tarball: https://codeload.github.com/acburdine/google-caja-bower/tar.gz/275cb75249f038492094a499756a73719ae071fd}
     version: 6011.0.0
 
   gopd@1.2.0:
@@ -15651,8 +15670,8 @@ packages:
     resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
     hasBin: true
 
-  jiti@2.7.0:
-    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
+  jiti@2.6.1:
+    resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
     hasBin: true
 
   jiti@2.7.0:
@@ -15872,7 +15891,7 @@ packages:
     engines: {node: '>= 0.6'}
 
   keymaster@https://codeload.github.com/madrobby/keymaster/tar.gz/f8f43ddafad663b505dc0908e72853bcf8daea49:
-    resolution: {gitHosted: true, tarball: https://codeload.github.com/madrobby/keymaster/tar.gz/f8f43ddafad663b505dc0908e72853bcf8daea49}
+    resolution: {gitHosted: true, integrity: sha512-/WVovQslVEqPGNoD97TbqNHuCDPYu2v4/ggrZj0a+9PVPw3Rud4Ut2K7fOi0kMqzoJINkgP68e9m09Al/wFZ8g==, tarball: https://codeload.github.com/madrobby/keymaster/tar.gz/f8f43ddafad663b505dc0908e72853bcf8daea49}
     version: 1.6.3
 
   keypair@1.0.4:
@@ -17097,7 +17116,7 @@ packages:
     hasBin: true
 
   mock-knex@https://codeload.github.com/TryGhost/mock-knex/tar.gz/68948e11b0ea4fe63456098dfdc169bea7f62009:
-    resolution: {gitHosted: true, tarball: https://codeload.github.com/TryGhost/mock-knex/tar.gz/68948e11b0ea4fe63456098dfdc169bea7f62009}
+    resolution: {gitHosted: true, integrity: sha512-VVShGrOVsuUDz9ueLO/3hcMzwNGr/e/dvYoiXCJSs7hI8TWdSWsEXDURWp251+NZHEZG/CI+L78lBFv+piGfxg==, tarball: https://codeload.github.com/TryGhost/mock-knex/tar.gz/68948e11b0ea4fe63456098dfdc169bea7f62009}
     version: 0.4.13
     peerDependencies:
       knex: '> 0.8'
@@ -21784,8 +21803,8 @@ packages:
     resolution: {integrity: sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==}
     engines: {node: '>= 6'}
 
-  yaml@2.9.0:
-    resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
+  yaml@2.8.3:
+    resolution: {integrity: sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
@@ -21973,7 +21992,7 @@ snapshots:
       '@aws-crypto/sha1-browser': 5.2.0
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/credential-provider-node': 3.972.44
       '@aws-sdk/middleware-bucket-endpoint': 3.972.16
       '@aws-sdk/middleware-expect-continue': 3.972.13
@@ -21981,7 +22000,7 @@ snapshots:
       '@aws-sdk/middleware-location-constraint': 3.972.11
       '@aws-sdk/middleware-sdk-s3': 3.972.43
       '@aws-sdk/middleware-ssec': 3.972.11
-      '@aws-sdk/signature-v4-multi-region': 3.996.29
+      '@aws-sdk/signature-v4-multi-region': 3.996.28
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
       '@smithy/fetch-http-handler': 5.4.4
@@ -21993,9 +22012,9 @@ snapshots:
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/credential-provider-node': 3.972.44
-      '@aws-sdk/signature-v4-multi-region': 3.996.29
+      '@aws-sdk/signature-v4-multi-region': 3.996.28
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
       '@smithy/fetch-http-handler': 5.4.4
@@ -22003,6 +22022,17 @@ snapshots:
       '@smithy/types': 4.14.2
       tslib: 2.8.1
 
+  '@aws-sdk/core@3.974.13':
+    dependencies:
+      '@aws-sdk/types': 3.973.9
+      '@aws-sdk/xml-builder': 3.972.25
+      '@aws/lambda-invoke-store': 0.2.4
+      '@smithy/core': 3.24.4
+      '@smithy/signature-v4': 5.4.4
+      '@smithy/types': 4.14.2
+      bowser: 2.14.1
+      tslib: 2.8.1
+
   '@aws-sdk/core@3.974.14':
     dependencies:
       '@aws-sdk/types': 3.973.9
@@ -22021,7 +22051,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-env@3.972.39':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
       '@smithy/types': 4.14.2
@@ -22029,7 +22059,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-http@3.972.41':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
       '@smithy/fetch-http-handler': 5.4.4
@@ -22039,7 +22069,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-ini@3.972.43':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/credential-provider-env': 3.972.39
       '@aws-sdk/credential-provider-http': 3.972.41
       '@aws-sdk/credential-provider-login': 3.972.43
@@ -22055,7 +22085,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-login@3.972.43':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/nested-clients': 3.997.11
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
@@ -22078,7 +22108,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-process@3.972.39':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
       '@smithy/types': 4.14.2
@@ -22086,7 +22116,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-sso@3.972.43':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/nested-clients': 3.997.11
       '@aws-sdk/token-providers': 3.1052.0
       '@aws-sdk/types': 3.973.9
@@ -22096,7 +22126,7 @@ snapshots:
 
   '@aws-sdk/credential-provider-web-identity@3.972.43':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/nested-clients': 3.997.11
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
@@ -22155,8 +22185,8 @@ snapshots:
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.14
-      '@aws-sdk/signature-v4-multi-region': 3.996.29
+      '@aws-sdk/core': 3.974.13
+      '@aws-sdk/signature-v4-multi-region': 3.996.28
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
       '@smithy/fetch-http-handler': 5.4.4
@@ -22164,6 +22194,14 @@ snapshots:
       '@smithy/types': 4.14.2
       tslib: 2.8.1
 
+  '@aws-sdk/signature-v4-multi-region@3.996.28':
+    dependencies:
+      '@aws-sdk/types': 3.973.9
+      '@smithy/core': 3.24.4
+      '@smithy/signature-v4': 5.4.4
+      '@smithy/types': 4.14.2
+      tslib: 2.8.1
+
   '@aws-sdk/signature-v4-multi-region@3.996.29':
     dependencies:
       '@aws-sdk/types': 3.973.9
@@ -22173,7 +22211,7 @@ snapshots:
 
   '@aws-sdk/token-providers@3.1052.0':
     dependencies:
-      '@aws-sdk/core': 3.974.14
+      '@aws-sdk/core': 3.974.13
       '@aws-sdk/nested-clients': 3.997.11
       '@aws-sdk/types': 3.973.9
       '@smithy/core': 3.24.4
@@ -22189,6 +22227,13 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  '@aws-sdk/xml-builder@3.972.25':
+    dependencies:
+      '@nodable/entities': 2.1.0
+      '@smithy/types': 4.14.2
+      fast-xml-parser: 5.7.3
+      tslib: 2.8.1
+
   '@aws-sdk/xml-builder@3.972.26':
     dependencies:
       '@smithy/types': 4.14.2
@@ -27933,7 +27978,7 @@ snapshots:
     dependencies:
       '@jridgewell/remapping': 2.3.5
       enhanced-resolve: 5.20.1
-      jiti: 2.7.0
+      jiti: 2.6.1
       lightningcss: 1.32.0
       magic-string: 0.30.21
       source-map-js: 1.2.1
@@ -29341,7 +29386,7 @@ snapshots:
 
   '@types/react-svg-map@2.1.4':
     dependencies:
-      '@types/react': 18.3.29
+      '@types/react': 18.3.28
 
   '@types/react-transition-group@4.4.12(@types/react@18.3.29)':
     dependencies:
@@ -29349,7 +29394,12 @@ snapshots:
 
   '@types/react-world-flags@1.6.0':
     dependencies:
-      '@types/react': 18.3.29
+      '@types/react': 18.3.28
+
+  '@types/react@18.3.28':
+    dependencies:
+      '@types/prop-types': 15.7.15
+      csstype: 3.2.3
 
   '@types/react@18.3.29':
     dependencies:
@@ -35782,7 +35832,7 @@ snapshots:
   eslint-plugin-playwright@2.10.4(eslint@8.57.1):
     dependencies:
       eslint: 8.57.1
-      globals: 17.6.0
+      globals: 17.4.0
 
   eslint-plugin-react-hooks@4.6.2(eslint@8.57.1):
     dependencies:
@@ -37155,6 +37205,8 @@ snapshots:
 
   globals@15.15.0: {}
 
+  globals@17.4.0: {}
+
   globals@17.6.0: {}
 
   globals@9.18.0: {}
@@ -38807,7 +38859,7 @@ snapshots:
 
   jiti@1.21.7: {}
 
-  jiti@2.7.0: {}
+  jiti@2.6.1: {}
 
   jiti@2.7.0: {}
 
@@ -39445,7 +39497,7 @@ snapshots:
       picomatch: 4.0.4
       string-argv: 0.3.2
       tinyexec: 1.1.1
-      yaml: 2.9.0
+      yaml: 2.8.3
 
   liquid-fire@0.34.0(ember-source@3.24.0(@babel/core@7.29.0)):
     dependencies:
@@ -41279,7 +41331,7 @@ snapshots:
       tree-kill: 1.2.2
       tsconfig-paths: 4.2.0
       tslib: 2.8.1
-      yaml: 2.9.0
+      yaml: 2.8.3
       yargs: 17.7.2
       yargs-parser: 21.1.1
     optionalDependencies:
@@ -42128,7 +42180,7 @@ snapshots:
   postcss-load-config@5.1.0(jiti@2.7.0)(postcss@8.5.10)(tsx@4.21.0):
     dependencies:
       lilconfig: 3.1.3
-      yaml: 2.9.0
+      yaml: 2.8.3
     optionalDependencies:
       jiti: 2.7.0
       postcss: 8.5.10
@@ -44846,7 +44898,7 @@ snapshots:
   tailwind-api-utils@1.0.3(tailwindcss@4.2.2):
     dependencies:
       enhanced-resolve: 5.20.1
-      jiti: 2.7.0
+      jiti: 2.6.1
       local-pkg: 1.1.2
       tailwindcss: 4.2.2
 
@@ -46509,7 +46561,7 @@ snapshots:
 
   yaml@1.10.3: {}
 
-  yaml@2.9.0: {}
+  yaml@2.8.3: {}
 
   yaml@2.9.0: {}