ghost/core/core/server/api/endpoints/previews.js (1)

21-23: Setting frame.isPreview for member_status previews is correct and fixes status stripping

Marking preview frames ensures clean.post preserves attrs.status for Content API previews, restoring the redirect behavior for published posts accessed via preview URLs. Nice, tight fix that aligns with the new serializer logic.

As a small clarity nit, consider adding an inline comment to explain why isPreview is set here (it’s consumed by serializers to preserve status and support redirect logic):

     // only set apiType when given a member_status to preserve backwards compatibility
     // where we used to serve "Admin API" content with no gating for all previews
     frame.apiType = 'content';
+    // Mark as preview so serializers can preserve attrs.status (used for redirect decisions)
     frame.isPreview = true;

ghost/core/core/server/api/endpoints/utils/index.js (1)

50-52: Defensively handle undefined frames in isPreview

Minor hardening: use optional chaining so the helper gracefully handles unexpected undefined/null frames without throwing.

-    isPreview: (frame) => {
-        return frame.isPreview === true;
-    }
+    isPreview: (frame) => {
+        return frame?.isPreview === true;
+    }

ghost/core/test/e2e-frontend/preview_routes.test.js (1)

148-155: Good added coverage for published redirect with member_status=paid

This validates the regression path and ensures parity with the non-parameter case. Consider extending coverage to the other allowed values to fully exercise the validation matrix: ?member_status=free and ?member_status=anonymous.

Example additions:

it('should redirect published posts to their live url with ?member_status=free', async function () {
    await request.get('/p/2ac6b4f6-e1f3-406c-9247-c94a0496d39d/?member_status=free')
        .expect(301)
        .expect('Location', '/short-and-sweet/')
        .expect('Cache-Control', testUtils.cacheRules.year)
        .expect(assertCorrectFrontendHeaders);
});

it('should redirect published posts to their live url with ?member_status=anonymous', async function () {
    await request.get('/p/2ac6b4f6-e1f3-406c-9247-c94a0496d39d/?member_status=anonymous')
        .expect(301)
        .expect('Location', '/short-and-sweet/')
        .expect('Cache-Control', testUtils.cacheRules.year)
        .expect(assertCorrectFrontendHeaders);
});

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro