@nymphjs/tilmeld 1.0.0-alpha.1 → 1.0.0-alpha.5

package/src/Tilmeld.ts

@@ -1,4 +1,11 @@
-import Nymph, { EntityInterface, Options, Selector } from '@nymphjs/nymph';
+import {
+  Nymph,
+  EntityInterface,
+  FormattedSelector,
+  Options,
+  TilmeldInterface,
+  TilmeldAccessLevels,
+} from '@nymphjs/nymph';
 import { Request, Response } from 'express';
 
 import { Config, ConfigDefaults as defaults } from './conf';
@@ -16,21 +23,31 @@ import { AccessControlData } from './Tilmeld.types';
  * @copyright SciActive Inc
  * @see http://nymph.io/
  */
-export default class Tilmeld {
-  public static NO_ACCESS = 0;
-  public static READ_ACCESS = 1;
-  public static WRITE_ACCESS = 2;
-  public static FULL_ACCESS = 4;
+export default class Tilmeld implements TilmeldInterface {
+  /**
+   * The Nymph instance.
+   */
+  public nymph: Nymph = {} as Nymph;
 
   /**
    * The Tilmeld config.
    */
-  public static config: Config;
+  public config: Config;
 
   /**
    * The currently logged in user.
    */
-  public static currentUser: (User & UserData) | null = null;
+  public currentUser: (User & UserData) | null = null;
+
+  /**
+   * The user class for this instance of Tilmeld.
+   */
+  public User: typeof User = User;
+
+  /**
+   * The group class for this instance of Tilmeld.
+   */
+  public Group: typeof Group = Group;
 
   /**
    * If you will be performing authentication functions (logging in/out), you
@@ -46,47 +63,98 @@ export default class Tilmeld {
    * If you want to support cookie based authentication (which still requires an
    * XSRF token for security), you should enable the cookie parser middleware.
    */
-  public static request: Request | null = null;
-  public static response: Response | null = null;
+  public request: Request | null = null;
+  public response: Response | null = null;
 
   /**
-   * Check to see if the current user has an ability.
-   *
-   * If `ability` is undefined, it will check to see if a user is currently
-   * logged in.
+   * Skip the authenticate step of initialization.
+   */
+  private skipAuthenticate = false;
+
+  /**
+   * Create a new instance of Tilmeld.
    *
-   * @param ability The ability.
-   * @returns Whether the user has the given ability.
+   * @param config The Tilmeld configuration.
    */
-  public static gatekeeper(ability?: string): boolean {
-    if (this.currentUser == null) {
-      return false;
-    }
-    return this.currentUser.$gatekeeper(ability);
+  public constructor(config: Partial<Config> & { jwtSecret: string }) {
+    this.config = { ...defaults, ...config };
+  }
+
+  /**
+   * This is used internally by Nymph. Don't call it yourself.
+   * @returns A clone of this instance.
+   */
+  public clone() {
+    const tilmeld = new Tilmeld(this.config);
+    tilmeld.request = this.request;
+    tilmeld.response = this.response;
+    tilmeld.currentUser = this.currentUser;
+    tilmeld.skipAuthenticate = true;
+
+    return tilmeld;
   }
 
   /**
    * Initialize Tilmeld.
    *
-   * @param config The Tilmeld configuration.
+   * This is meant to be called internally by Nymph. Don't call this directly.
+   *
+   * @param nymph The Nymph instance.
    */
-  public static init(config: Partial<Config> & { jwtSecret: string }) {
-    this.config = { ...defaults, ...config };
+  public init(nymph: Nymph) {
+    this.nymph = nymph;
 
     // Set up access control hooks when Nymph is called.
-    if (Nymph.driver == null) {
+    if (this.nymph.driver == null) {
       throw new Error("Tilmeld can't be configured before Nymph.");
     }
 
+    // Configure the classes.
+    class NymphUser extends User {}
+    NymphUser.nymph = this.nymph;
+    NymphUser.tilmeld = this;
+    (NymphUser as any).skipOnClone = true;
+    this.User = NymphUser;
+    this.nymph.addEntityClass(NymphUser);
+    class NymphGroup extends Group {}
+    NymphGroup.nymph = this.nymph;
+    NymphGroup.tilmeld = this;
+    (NymphUser as any).skipOnClone = true;
+    this.Group = NymphGroup;
+    this.nymph.addEntityClass(NymphGroup);
+
     this.initAccessControl();
-    if (this.request != null) {
+    if (this.request != null && !this.skipAuthenticate) {
       this.authenticate();
     }
+    this.skipAuthenticate = false;
+  }
+
+  /**
+   * Check to see if the current user has an ability.
+   *
+   * If `ability` is undefined, it will check to see if a user is currently
+   * logged in.
+   *
+   * @param ability The ability.
+   * @returns Whether the user has the given ability.
+   */
+  public gatekeeper(ability?: string): boolean {
+    if (this.currentUser == null) {
+      return false;
+    }
+    return this.currentUser.$gatekeeper(ability);
   }
 
-  private static initAccessControl() {
+  private initAccessControl() {
+    const tilmeld = this;
+
     // Check for the skip access control option and add AC selectors.
-    const getEntities = function (options: Options, selectors: Selector[]) {
+    const handleQuery = function (
+      _nymph: Nymph,
+      options: Options,
+      selectors: FormattedSelector[]
+    ) {
       if (
         !options ||
         !('skipAc' in options) ||
@@ -95,18 +163,20 @@ export default class Tilmeld {
       ) {
         if (options?.source === 'client') {
           if (
-            !Tilmeld.gatekeeper('tilmeld/admin') &&
-            ((!Tilmeld.config.enableUserSearch &&
-              options.class?.factorySync() instanceof User) ||
-              (!Tilmeld.config.enableGroupSearch &&
-                options.class?.factorySync() instanceof Group)) &&
-            (selectors[0] == null ||
-              selectors[0].type !== '&' ||
-              (!('guid' in selectors[0]) && !('equal' in selectors[0])) ||
+            !tilmeld.gatekeeper('tilmeld/admin') && // The user is not an admin.
+            ((!tilmeld.config.enableUserSearch &&
+              options.class?.factorySync() instanceof User) || // The use is searching for a user and searching is disabled.
+              (!tilmeld.config.enableGroupSearch &&
+                options.class?.factorySync() instanceof Group)) && // Or the same, but for a group.
+            (selectors[0] == null || // No selector specified.
+              selectors[0].type !== '&' || // Or the type is not and.
+              (!('guid' in selectors[0]) && !('equal' in selectors[0])) || // Or they're searching for something other than guid or equal.
               ('guid' in selectors[0] &&
-                typeof selectors[0].guid !== 'string') ||
+                (!selectors[0].guid?.length ||
+                  !selectors[0].guid?.[0]?.length)) || // Or they're not searching for a specific guid.
               ('equal' in selectors[0] &&
-                selectors[0]['equal']?.[0] !== 'username'))
+                selectors[0].equal?.[0]?.[0] !== 'username' &&
+                selectors[0].equal?.[0]?.[0] !== 'groupname')) // Or they're not searching for a specific username/groupname.
           ) {
             // If the user is not specifically searching for a GUID or username,
             // and they're not allowed to search, it should fail.
@@ -114,12 +184,16 @@ export default class Tilmeld {
           }
         }
         // Add access control selectors
-        Tilmeld.addAccessControlSelectors(options, selectors);
+        tilmeld.addAccessControlSelectors(options, selectors);
       }
     };
+    handleQuery.skipOnClone = true;
 
     // Filter entities being deleted for user permissions.
-    const checkPermissionsDelete = function (entity: EntityInterface) {
+    const checkPermissionsDelete = function (
+      _nymph: Nymph,
+      entity: EntityInterface
+    ) {
       if (
         typeof entity.$tilmeldDeleteSkipAC === 'function' &&
         entity.$tilmeldDeleteSkipAC()
@@ -127,28 +201,32 @@ export default class Tilmeld {
         return;
       }
       // Test for permissions.
-      if (Tilmeld.checkPermissions(entity, Tilmeld.FULL_ACCESS)) {
+      if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
         throw new AccessControlError('No permission to delete.');
       }
     };
+    checkPermissionsDelete.skipOnClone = true;
 
     // Filter entities being deleted for user permissions.
     const checkPermissionsDeleteByID = function (
+      nymph: Nymph,
       guid: string,
       className?: string
     ) {
-      const entity = Nymph.driver.getEntitySync(
-        { class: Nymph.getEntityClass(className ?? 'Entity') },
+      const entity = tilmeld.nymph.driver.getEntitySync(
+        { class: tilmeld.nymph.getEntityClass(className ?? 'Entity') },
         { type: '&', guid: guid }
       );
       if (entity != null) {
-        checkPermissionsDelete(entity);
+        checkPermissionsDelete(nymph, entity);
       }
     };
+    checkPermissionsDeleteByID.skipOnClone = true;
 
     // Filter entities being saved for user permissions, and filter any
     // disallowed changes to AC properties.
     const checkPermissionsSaveAndFilterAcChanges = function (
+      _nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
       if (!entity) {
@@ -190,7 +268,7 @@ export default class Tilmeld {
 
         // Restore original AC properties and check permissions.
         setAcProperties(originalAc);
-        if (Tilmeld.checkPermissions(entity, Tilmeld.FULL_ACCESS)) {
+        if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
           // Only allow changes to AC properties if the user has full access.
           // TODO: only allow changes to `user` and `group` if tilmeld admin or
           //       group is user's group.
@@ -199,10 +277,11 @@ export default class Tilmeld {
       }
 
       // Test for permissions.
-      if (!Tilmeld.checkPermissions(entity, Tilmeld.WRITE_ACCESS)) {
+      if (!tilmeld.checkPermissions(entity, TilmeldAccessLevels.WRITE_ACCESS)) {
         throw new AccessControlError('No permission to write.');
       }
     };
+    checkPermissionsSaveAndFilterAcChanges.skipOnClone = true;
 
     /*
      * Add the current user's "user", "group", and access control to new entity.
@@ -216,12 +295,15 @@ export default class Tilmeld {
      *
      * Default access control is
      *
-     * - acUser = Tilmeld::FULL_ACCESS
-     * - acGroup = Tilmeld::READ_ACCESS
-     * - acOther = Tilmeld::NO_ACCESS
+     * - acUser = TilmeldAccessLevels.FULL_ACCESS
+     * - acGroup = TilmeldAccessLevels.READ_ACCESS
+     * - acOther = TilmeldAccessLevels.NO_ACCESS
      */
-    const addAccess = function (entity: EntityInterface & AccessControlData) {
-      const user = Tilmeld.currentUser;
+    const addAccess = function (
+      _nymph: Nymph,
+      entity: EntityInterface & AccessControlData
+    ) {
+      const user = tilmeld.currentUser;
       if (
         user != null &&
         entity.guid == null &&
@@ -239,13 +321,13 @@ export default class Tilmeld {
           entity.group = user.group;
         }
         if (entity.acUser == null) {
-          entity.acUser = Tilmeld.FULL_ACCESS;
+          entity.acUser = TilmeldAccessLevels.FULL_ACCESS;
         }
         if (entity.acGroup == null) {
-          entity.acGroup = Tilmeld.READ_ACCESS;
+          entity.acGroup = TilmeldAccessLevels.READ_ACCESS;
         }
         if (entity.acOther == null) {
-          entity.acOther = Tilmeld.NO_ACCESS;
+          entity.acOther = TilmeldAccessLevels.NO_ACCESS;
         }
         if (entity.acRead == null) {
           entity.acRead = [];
@@ -258,14 +340,18 @@ export default class Tilmeld {
         }
       }
     };
+    addAccess.skipOnClone = true;
 
-    const validate = function (entity: EntityInterface & AccessControlData) {
+    const validate = function (
+      _nymph: Nymph,
+      entity: EntityInterface & AccessControlData
+    ) {
       if (!(entity instanceof User) && !(entity instanceof Group)) {
         const ownershipAcPropertyValidator = (prop: any) => {
           if (
             typeof prop != 'number' ||
-            prop < Tilmeld.NO_ACCESS ||
-            prop > Tilmeld.FULL_ACCESS
+            prop < TilmeldAccessLevels.NO_ACCESS ||
+            prop > TilmeldAccessLevels.FULL_ACCESS
           ) {
             throw new AccessControlError('Invalid access control property.');
           }
@@ -314,16 +400,16 @@ export default class Tilmeld {
         }
       }
     };
+    validate.skipOnClone = true;
 
-    Nymph.on('beforeGetEntity', getEntities);
-    Nymph.on('beforeGetEntities', getEntities);
+    this.nymph.on('query', handleQuery);
 
-    Nymph.on('beforeSaveEntity', addAccess);
-    Nymph.on('beforeSaveEntity', validate);
-    Nymph.on('beforeSaveEntity', checkPermissionsSaveAndFilterAcChanges);
+    this.nymph.on('beforeSaveEntity', addAccess);
+    this.nymph.on('beforeSaveEntity', validate);
+    this.nymph.on('beforeSaveEntity', checkPermissionsSaveAndFilterAcChanges);
 
-    Nymph.on('beforeDeleteEntity', checkPermissionsDelete);
-    Nymph.on('beforeDeleteEntityByID', checkPermissionsDeleteByID);
+    this.nymph.on('beforeDeleteEntity', checkPermissionsDelete);
+    this.nymph.on('beforeDeleteEntityByID', checkPermissionsDeleteByID);
   }
 
   /**
@@ -332,9 +418,9 @@ export default class Tilmeld {
    *
    * @param optionsAndSelectors The options and selectors of the query.
    */
-  public static addAccessControlSelectors(
+  public addAccessControlSelectors(
     options: Options,
-    selectors: Selector[]
+    selectors: FormattedSelector[]
   ) {
     const user = this.currentUser;
 
@@ -350,7 +436,8 @@ export default class Tilmeld {
       throw new Error('No options in argument.');
     } else if (
       'class' in options &&
-      (options.class === User || options.class === Group)
+      (options.class?.factorySync() instanceof User ||
+        options.class?.factorySync() instanceof Group)
     ) {
       // They are requesting a user/group. Always accessible for reading.
       return;
@@ -360,15 +447,17 @@ export default class Tilmeld {
       selectors.push({
         type: '|',
         // Other access control is sufficient.
-        gte: ['acOther', Tilmeld.READ_ACCESS],
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
         // The user and group are not set.
-        selector: {
-          type: '&',
-          '!defined': ['user', 'group'],
-        },
+        selector: [
+          {
+            type: '&',
+            '!defined': ['user', 'group'],
+          },
+        ],
       });
     } else {
-      const subSelectors: Selector[] = [
+      const subSelectors: FormattedSelector[] = [
         {
           type: '&',
           '!defined': ['user', 'group'],
@@ -376,14 +465,14 @@ export default class Tilmeld {
         // It is owned by the user.
         {
           type: '&',
-          ref: ['user', user],
-          gte: ['acUser', Tilmeld.READ_ACCESS],
+          ref: [['user', user]],
+          gte: [['acUser', TilmeldAccessLevels.READ_ACCESS]],
         },
       ];
-      const selector: Selector = {
+      const selector: FormattedSelector = {
         type: '|',
         // Other access control is sufficient.
-        gte: ['acOther', Tilmeld.READ_ACCESS],
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
         // The user and group are not set.
         selector: subSelectors,
         // The user is listed in acRead, acWrite, or acFull.
@@ -393,8 +482,8 @@ export default class Tilmeld {
           ['acFull', user],
         ],
       };
-      const groupRefs: Selector['ref'] = [];
-      const acRefs: Selector['ref'] = [];
+      const groupRefs: FormattedSelector['ref'] = [];
+      const acRefs: FormattedSelector['ref'] = [];
       if (user.group != null && user.group.guid != null) {
         // It belongs to the user's primary group.
         groupRefs.push(['group', user.group]);
@@ -427,11 +516,13 @@ export default class Tilmeld {
       if (groupRefs.length) {
         subSelectors.push({
           type: '&',
-          gte: ['acGroup', Tilmeld.READ_ACCESS],
-          selector: {
-            type: '|',
-            ref: groupRefs,
-          },
+          gte: [['acGroup', TilmeldAccessLevels.READ_ACCESS]],
+          selector: [
+            {
+              type: '|',
+              ref: groupRefs,
+            },
+          ],
         });
       }
       // All the acRead, acWrite, and acFull refs.
@@ -474,9 +565,9 @@ export default class Tilmeld {
    *
    * These properties defaults to:
    *
-   * - acUser = Tilmeld.FULL_ACCESS
-   * - acGroup = Tilmeld.READ_ACCESS
-   * - acOther = Tilmeld.NO_ACCESS
+   * - acUser = TilmeldAccessLevels.FULL_ACCESS
+   * - acGroup = TilmeldAccessLevels.READ_ACCESS
+   * - acOther = TilmeldAccessLevels.NO_ACCESS
    *
    * "acRead", "acWrite", and "acFull" are arrays of users and/or groups that
    * also have those permissions.
@@ -505,13 +596,13 @@ export default class Tilmeld {
    * - None of the above. (Check other AC.)
    *
    * @param entity The entity to check.
-   * @param type The lowest level of permission to consider a pass. One of Tilmeld.READ_ACCESS, Tilmeld.WRITE_ACCESS, or Tilmeld.FULL_ACCESS.
+   * @param type The lowest level of permission to consider a pass.
    * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
    * @returns Whether the current user has at least `type` permission for the entity.
    */
-  public static checkPermissions(
+  public checkPermissions(
     entity: EntityInterface & AccessControlData,
-    type = Tilmeld.READ_ACCESS,
+    type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
     user?: (User & UserData) | false
   ) {
     // Only works for entities.
@@ -520,11 +611,11 @@ export default class Tilmeld {
     }
 
     let userOrNull: (User & UserData) | null = null;
-    let userOrEmpty: User & UserData = User.factorySync();
+    let userOrEmpty: User & UserData = this.User.factorySync();
     // Calculate the user.
     if (user == null) {
       userOrNull = this.currentUser;
-      userOrEmpty = User.current(true);
+      userOrEmpty = this.User.current(true);
     } else if (user !== false) {
       userOrNull = user;
       userOrEmpty = user;
@@ -537,7 +628,8 @@ export default class Tilmeld {
     // Users and groups are always readable. Editable by Tilmeld admins.
     if (
       (entity instanceof User || entity instanceof Group) &&
-      (type === Tilmeld.READ_ACCESS || userOrEmpty.$gatekeeper('tilmeld/admin'))
+      (type === TilmeldAccessLevels.READ_ACCESS ||
+        userOrEmpty.$gatekeeper('tilmeld/admin'))
     ) {
       return true;
     }
@@ -548,9 +640,9 @@ export default class Tilmeld {
     }
 
     // Load access control, since we need it now...
-    const acUser = entity.acUser ?? Tilmeld.FULL_ACCESS;
-    const acGroup = entity.acGroup ?? Tilmeld.READ_ACCESS;
-    const acOther = entity.acOther ?? Tilmeld.NO_ACCESS;
+    const acUser = entity.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
+    const acGroup = entity.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
+    const acOther = entity.acOther ?? TilmeldAccessLevels.NO_ACCESS;
 
     if (userOrNull === null) {
       return acOther >= type;
@@ -566,7 +658,7 @@ export default class Tilmeld {
       userOrEmpty.group != null &&
       typeof userOrEmpty.group.$is === 'function' &&
       userOrEmpty.group.$is(entity) &&
-      type === Tilmeld.READ_ACCESS
+      type === TilmeldAccessLevels.READ_ACCESS
     ) {
       return true;
     }
@@ -578,9 +670,18 @@ export default class Tilmeld {
 
     // Check access ac properties.
     const checks = [
-      { type: Tilmeld.FULL_ACCESS, array: [...(entity.acFull ?? [])] },
-      { type: Tilmeld.WRITE_ACCESS, array: [...(entity.acWrite ?? [])] },
-      { type: Tilmeld.READ_ACCESS, array: [...(entity.acRead ?? [])] },
+      {
+        type: TilmeldAccessLevels.FULL_ACCESS,
+        array: [...(entity.acFull ?? [])],
+      },
+      {
+        type: TilmeldAccessLevels.WRITE_ACCESS,
+        array: [...(entity.acWrite ?? [])],
+      },
+      {
+        type: TilmeldAccessLevels.READ_ACCESS,
+        array: [...(entity.acRead ?? [])],
+      },
     ];
     for (let curCheck of checks) {
       if (type <= curCheck.type) {
@@ -616,12 +717,79 @@ export default class Tilmeld {
     return acOther >= type;
   }
 
+  /**
+   * Check a UID's permissions for a user.
+   *
+   * ## THIS ONLY CHECKS AUTOMATICALLY FOR CLIENT REQUESTS.
+   *
+   * UID functions on the Node.js side are not checked automatically. This
+   * function is only run automatically for UID functions run from the client.
+   * You should call this function manually if you're running a UID function on
+   * the Node.js side and you want it gated.
+   *
+   * This will check the Tilmeld config and the user's abilities.
+   *
+   * - READ_ACCESS, the UID is listed in clientReadableUIDs or the user has the
+   *   "uid/get/nameofuid" ability.
+   * - WRITE_ACCESS, the UID is listed in clientEnabledUIDs or the user has the
+   *   "uid/new/nameofuid" ability.
+   * - FULL_ACCESS, the UID is listed in clientSetabledUIDs or the user has the
+   *   "uid/set/nameofuid" ability.
+   *
+   * @param name The UID to check.
+   * @param type The lowest level of permission to consider a pass.
+   * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
+   * @returns Whether the current user has at least `type` permission for the UID.
+   */
+  public checkClientUIDPermissions(
+    name: string,
+    type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
+    user?: (User & UserData) | false
+  ) {
+    let userOrEmpty: User & UserData = this.User.factorySync();
+    // Calculate the user.
+    if (user == null) {
+      userOrEmpty = this.User.current(true);
+    } else if (user !== false) {
+      userOrEmpty = user;
+    }
+
+    if (userOrEmpty.$gatekeeper('system/admin')) {
+      return true;
+    }
+
+    if (type === TilmeldAccessLevels.FULL_ACCESS) {
+      return (
+        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
+        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+      );
+    } else if (type === TilmeldAccessLevels.WRITE_ACCESS) {
+      return (
+        this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
+        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
+        userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
+        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+      );
+    } else if (type === TilmeldAccessLevels.READ_ACCESS) {
+      return (
+        this.config.clientReadableUIDs.indexOf(name) !== -1 ||
+        this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
+        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
+        userOrEmpty.$gatekeeper(`uid/get/${name}`) ||
+        userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
+        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+      );
+    }
+
+    return false;
+  }
+
   /**
    * Fill session user data.
    *
    * @param user The user.
    */
-  public static fillSession(user: User & UserData) {
+  public fillSession(user: User & UserData) {
     // Read groups right now, since gatekeeper needs them, so
     // $udpateDataProtection will fail to read them (since it runs gatekeeper).
     const _group = user.group;
@@ -640,7 +808,7 @@ export default class Tilmeld {
   /**
    * Clear session user data.
    */
-  public static clearSession() {
+  public clearSession() {
     const user = this.currentUser;
     this.currentUser = null;
     if (user) {
@@ -660,15 +828,15 @@ export default class Tilmeld {
    * @param token The authentication token.
    * @returns The user on success, null on failure.
    */
-  public static async extractToken(token: string) {
-    const extract = this.config.jwtExtract(token);
+  public async extractToken(token: string) {
+    const extract = this.config.jwtExtract(this.config, token);
     if (extract == null) {
       return null;
     }
     const { guid } = extract;
 
-    const user = await Nymph.getEntity(
-      { class: User },
+    const user = await this.nymph.getEntity(
+      { class: this.User },
       {
         type: '&',
         guid: guid,
@@ -687,7 +855,7 @@ export default class Tilmeld {
    * @param skipXsrfToken Skip the XSRF token check.
    * @returns True if a user was authenticated, false on any failure.
    */
-  public static authenticate(skipXsrfToken = false) {
+  public authenticate(skipXsrfToken = false) {
     if (this.request == null) {
       return false;
     }
@@ -698,9 +866,9 @@ export default class Tilmeld {
     // to provide the auth token.
     let fromAuthHeader = false;
     let authToken: string;
-    if (this.request.header('HTTP_X_TILMELDAUTH') != null) {
+    if (this.request.header('x-tilmeldauth') != null) {
       fromAuthHeader = true;
-      authToken = this.request.header('HTTP_X_TILMELDAUTH') as string;
+      authToken = this.request.header('x-tilmeldauth') as string;
     } else if ('TILMELDAUTH' in cookies) {
       fromAuthHeader = false;
       authToken = cookies.TILMELDAUTH;
@@ -715,16 +883,16 @@ export default class Tilmeld {
     ) {
       // The request is for the setup app, or we were told to skip the XSRF
       // check, so don't check for the XSRF token.
-      extract = this.config.jwtExtract(authToken);
+      extract = this.config.jwtExtract(this.config, authToken);
     } else {
       // The request is for something else, so check for a valid XSRF token,
       // unless the auth token is provided by a header (instead of a cookie).
-      const xsrfToken = this.request.header('HTTP_X_XSRF_TOKEN');
+      const xsrfToken = this.request.header('x-xsrf-token');
       if (xsrfToken == null && !fromAuthHeader) {
         return false;
       }
 
-      extract = this.config.jwtExtract(authToken, xsrfToken);
+      extract = this.config.jwtExtract(this.config, authToken, xsrfToken);
     }
 
     if (extract == null) {
@@ -733,7 +901,7 @@ export default class Tilmeld {
     }
     const { guid, expire } = extract;
 
-    const user = User.factorySync(guid);
+    const user = this.User.factorySync(guid);
     if (user.guid == null || !user.enabled) {
       this.logout();
       return false;
@@ -756,10 +924,10 @@ export default class Tilmeld {
    * @param sendAuthHeader When true, a custom header with the auth token will be sent.
    * @returns True on success, false on failure.
    */
-  public static login(user: User & UserData, sendAuthHeader: boolean) {
+  public login(user: User & UserData, sendAuthHeader: boolean) {
     if (user.guid != null && user.enabled) {
       if (this.response && !this.response.headersSent) {
-        const token = this.config.jwtBuilder(user);
+        const token = this.config.jwtBuilder(this.config, user);
         const appUrl = new URL(this.config.appUrl);
         this.response.cookie('TILMELDAUTH', token, {
           domain: this.config.cookieDomain,
@@ -782,7 +950,7 @@ export default class Tilmeld {
   /**
    * Logs the current user out of the system.
    */
-  public static logout() {
+  public logout() {
     this.clearSession();
     if (this.response && !this.response.headersSent) {
       this.response.clearCookie('TILMELDAUTH', {