@nymphjs/tilmeld 1.0.0-alpha.2 → 1.0.0-alpha.23

package/src/Tilmeld.ts

@@ -4,8 +4,10 @@ import {
   FormattedSelector,
   Options,
   TilmeldInterface,
+  TilmeldAccessLevels,
 } from '@nymphjs/nymph';
 import { Request, Response } from 'express';
+import { xor } from 'lodash';
 
 import { Config, ConfigDefaults as defaults } from './conf';
 import { AccessControlError } from './errors';
@@ -23,15 +25,10 @@ import { AccessControlData } from './Tilmeld.types';
  * @see http://nymph.io/
  */
 export default class Tilmeld implements TilmeldInterface {
-  public static NO_ACCESS = 0;
-  public static READ_ACCESS = 1;
-  public static WRITE_ACCESS = 2;
-  public static FULL_ACCESS = 4;
-
   /**
    * The Nymph instance.
    */
-  public nymph: Nymph;
+  public nymph: Nymph = {} as Nymph;
 
   /**
    * The Tilmeld config.
@@ -70,30 +67,32 @@ export default class Tilmeld implements TilmeldInterface {
   public request: Request | null = null;
   public response: Response | null = null;
 
+  /**
+   * Skip the authenticate step of initialization.
+   */
+  private skipAuthenticate = false;
+
   /**
    * Create a new instance of Tilmeld.
    *
    * @param config The Tilmeld configuration.
    */
   public constructor(config: Partial<Config> & { jwtSecret: string }) {
-    this.nymph = new Nymph();
     this.config = { ...defaults, ...config };
   }
 
   /**
-   * Check to see if the current user has an ability.
-   *
-   * If `ability` is undefined, it will check to see if a user is currently
-   * logged in.
-   *
-   * @param ability The ability.
-   * @returns Whether the user has the given ability.
+   * This is used internally by Nymph. Don't call it yourself.
+   * @returns A clone of this instance.
    */
-  public gatekeeper(ability?: string): boolean {
-    if (this.currentUser == null) {
-      return false;
-    }
-    return this.currentUser.$gatekeeper(ability);
+  public clone() {
+    const tilmeld = new Tilmeld(this.config);
+    tilmeld.request = this.request;
+    tilmeld.response = this.response;
+    tilmeld.currentUser = this.currentUser;
+    tilmeld.skipAuthenticate = true;
+
+    return tilmeld;
   }
 
   /**
@@ -115,28 +114,47 @@ export default class Tilmeld implements TilmeldInterface {
     class NymphUser extends User {}
     NymphUser.nymph = this.nymph;
     NymphUser.tilmeld = this;
+    (NymphUser as any).skipOnClone = true;
     this.User = NymphUser;
-    this.nymph.setEntityClass(NymphUser.class, NymphUser);
+    this.nymph.addEntityClass(NymphUser);
     class NymphGroup extends Group {}
     NymphGroup.nymph = this.nymph;
     NymphGroup.tilmeld = this;
+    (NymphUser as any).skipOnClone = true;
     this.Group = NymphGroup;
-    this.nymph.setEntityClass(NymphGroup.class, NymphGroup);
+    this.nymph.addEntityClass(NymphGroup);
 
     this.initAccessControl();
-    if (this.request != null) {
+    if (this.request != null && !this.skipAuthenticate) {
       this.authenticate();
     }
+    this.skipAuthenticate = false;
   }
 
-  private initAccessControl() {
-    const tilmeld = this;
+  /**
+   * Check to see if the current user has an ability.
+   *
+   * If `ability` is undefined, it will check to see if a user is currently
+   * logged in.
+   *
+   * @param ability The ability.
+   * @returns Whether the user has the given ability.
+   */
+  public gatekeeper(ability?: string): boolean {
+    if (this.currentUser == null) {
+      return false;
+    }
+    return this.currentUser.$gatekeeper(ability);
+  }
 
+  private initAccessControl() {
     // Check for the skip access control option and add AC selectors.
     const handleQuery = function (
+      nymph: Nymph,
       options: Options,
       selectors: FormattedSelector[]
     ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       if (
         !options ||
         !('skipAc' in options) ||
@@ -145,20 +163,20 @@ export default class Tilmeld implements TilmeldInterface {
       ) {
         if (options?.source === 'client') {
           if (
-            !tilmeld.gatekeeper('tilmeld/admin') &&
+            !tilmeld.gatekeeper('tilmeld/admin') && // The user is not an admin.
             ((!tilmeld.config.enableUserSearch &&
-              options.class?.factorySync() instanceof User) ||
+              options.class?.factorySync() instanceof User) || // The use is searching for a user and searching is disabled.
               (!tilmeld.config.enableGroupSearch &&
-                options.class?.factorySync() instanceof Group)) &&
-            (selectors[0] == null ||
-              selectors[0].type !== '&' ||
-              (!('guid' in selectors[0]) && !('equal' in selectors[0])) ||
+                options.class?.factorySync() instanceof Group)) && // Or the same, but for a group.
+            (selectors[0] == null || // No selector specified.
+              selectors[0].type !== '&' || // Or the type is not and.
+              (!('guid' in selectors[0]) && !('equal' in selectors[0])) || // Or they're searching for something other than guid or equal.
               ('guid' in selectors[0] &&
-                selectors[0].guid?.length === 1 &&
-                typeof selectors[0].guid?.[0] !== 'string') ||
+                (!selectors[0].guid?.length ||
+                  !selectors[0].guid?.[0]?.length)) || // Or they're not searching for a specific guid.
               ('equal' in selectors[0] &&
-                selectors[0].equal?.length === 1 &&
-                selectors[0].equal?.[0]?.[0] !== 'username'))
+                selectors[0].equal?.[0]?.[0] !== 'username' &&
+                selectors[0].equal?.[0]?.[0] !== 'groupname')) // Or they're not searching for a specific username/groupname.
           ) {
             // If the user is not specifically searching for a GUID or username,
             // and they're not allowed to search, it should fail.
@@ -169,9 +187,14 @@ export default class Tilmeld implements TilmeldInterface {
         tilmeld.addAccessControlSelectors(options, selectors);
       }
     };
+    handleQuery.skipOnClone = true;
 
     // Filter entities being deleted for user permissions.
-    const checkPermissionsDelete = function (entity: EntityInterface) {
+    const checkPermissionsDelete = function (
+      nymph: Nymph,
+      entity: EntityInterface
+    ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       if (
         typeof entity.$tilmeldDeleteSkipAC === 'function' &&
         entity.$tilmeldDeleteSkipAC()
@@ -179,30 +202,35 @@ export default class Tilmeld implements TilmeldInterface {
         return;
       }
       // Test for permissions.
-      if (tilmeld.checkPermissions(entity, Tilmeld.FULL_ACCESS)) {
+      if (!tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
         throw new AccessControlError('No permission to delete.');
       }
     };
+    checkPermissionsDelete.skipOnClone = true;
 
     // Filter entities being deleted for user permissions.
     const checkPermissionsDeleteByID = function (
+      nymph: Nymph,
       guid: string,
       className?: string
     ) {
-      const entity = tilmeld.nymph.driver.getEntitySync(
-        { class: tilmeld.nymph.getEntityClass(className ?? 'Entity') },
+      const entity = nymph.driver.getEntitySync(
+        { class: nymph.getEntityClass(className ?? 'Entity') },
         { type: '&', guid: guid }
       );
       if (entity != null) {
-        checkPermissionsDelete(entity);
+        checkPermissionsDelete(nymph, entity);
       }
     };
+    checkPermissionsDeleteByID.skipOnClone = true;
 
     // Filter entities being saved for user permissions, and filter any
     // disallowed changes to AC properties.
     const checkPermissionsSaveAndFilterAcChanges = function (
+      nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       if (!entity) {
         return;
       }
@@ -218,15 +246,15 @@ export default class Tilmeld implements TilmeldInterface {
         // allowing a change to ac properties.
 
         const originalAc = entity.$getOriginalAcValues();
-        const newAc = {
-          user: entity.user ?? null,
-          group: entity.group ?? null,
-          acUser: entity.acUser ?? null,
-          acGroup: entity.acGroup ?? null,
-          acOther: entity.acOther ?? null,
-          acRead: entity.acRead ?? null,
-          acWrite: entity.acWrite ?? null,
-          acFull: entity.acFull ?? null,
+        const newAc: AccessControlData = {
+          user: entity.user ?? undefined,
+          group: entity.group ?? undefined,
+          acUser: entity.acUser ?? undefined,
+          acGroup: entity.acGroup ?? undefined,
+          acOther: entity.acOther ?? undefined,
+          acRead: entity.acRead ?? undefined,
+          acWrite: entity.acWrite ?? undefined,
+          acFull: entity.acFull ?? undefined,
         };
 
         const setAcProperties = (acValues: { [k: string]: any }) => {
@@ -242,19 +270,112 @@ export default class Tilmeld implements TilmeldInterface {
 
         // Restore original AC properties and check permissions.
         setAcProperties(originalAc);
-        if (tilmeld.checkPermissions(entity, Tilmeld.FULL_ACCESS)) {
-          // Only allow changes to AC properties if the user has full access.
-          // TODO: only allow changes to `user` and `group` if tilmeld admin or
-          //       group is user's group.
+
+        function areAcPropertiesChanged(
+          a: AccessControlData,
+          b: AccessControlData
+        ) {
+          for (const name of ['user', 'group'] as ('user' | 'group')[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (!aVal.$is(bVal)) {
+              return true;
+            }
+          }
+          for (const name of ['acUser', 'acGroup', 'acOther'] as (
+            | 'acUser'
+            | 'acGroup'
+            | 'acOther'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal !== bVal) {
+              return true;
+            }
+          }
+          for (const name of ['acRead', 'acWrite', 'acFull'] as (
+            | 'acRead'
+            | 'acWrite'
+            | 'acFull'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal.length !== bVal.length) {
+              return true;
+            }
+            if (
+              xor(
+                aVal.map((entity) => entity.guid),
+                bVal.map((entity) => entity.guid)
+              ).length
+            ) {
+              return true;
+            }
+          }
+          return false;
+        }
+
+        if (areAcPropertiesChanged(originalAc, newAc)) {
+          if (
+            !tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)
+          ) {
+            // Only allow changes to AC properties if the user has full access.
+            throw new AccessControlError(
+              'No permission to change access control properties.'
+            );
+          }
+
+          if (
+            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
+              (!originalAc.user &&
+                newAc.user &&
+                !newAc.user.$is(tilmeld.currentUser))) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another user.'
+            );
+          }
+
+          if (
+            newAc.group &&
+            !newAc.group.$is(originalAc.group) &&
+            !(
+              newAc.group.$is(tilmeld.currentUser?.group) ||
+              newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
+            ) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another group.'
+            );
+          }
+
           setAcProperties(newAc);
         }
       }
 
       // Test for permissions.
-      if (!tilmeld.checkPermissions(entity, Tilmeld.WRITE_ACCESS)) {
+      if (!tilmeld.checkPermissions(entity, TilmeldAccessLevels.WRITE_ACCESS)) {
         throw new AccessControlError('No permission to write.');
       }
     };
+    checkPermissionsSaveAndFilterAcChanges.skipOnClone = true;
 
     /*
      * Add the current user's "user", "group", and access control to new entity.
@@ -268,11 +389,15 @@ export default class Tilmeld implements TilmeldInterface {
      *
      * Default access control is
      *
-     * - acUser = Tilmeld::FULL_ACCESS
-     * - acGroup = Tilmeld::READ_ACCESS
-     * - acOther = Tilmeld::NO_ACCESS
+     * - acUser = TilmeldAccessLevels.FULL_ACCESS
+     * - acGroup = TilmeldAccessLevels.READ_ACCESS
+     * - acOther = TilmeldAccessLevels.NO_ACCESS
      */
-    const addAccess = function (entity: EntityInterface & AccessControlData) {
+    const addAccess = function (
+      nymph: Nymph,
+      entity: EntityInterface & AccessControlData
+    ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       const user = tilmeld.currentUser;
       if (
         user != null &&
@@ -291,13 +416,13 @@ export default class Tilmeld implements TilmeldInterface {
           entity.group = user.group;
         }
         if (entity.acUser == null) {
-          entity.acUser = Tilmeld.FULL_ACCESS;
+          entity.acUser = TilmeldAccessLevels.FULL_ACCESS;
         }
         if (entity.acGroup == null) {
-          entity.acGroup = Tilmeld.READ_ACCESS;
+          entity.acGroup = TilmeldAccessLevels.READ_ACCESS;
         }
         if (entity.acOther == null) {
-          entity.acOther = Tilmeld.NO_ACCESS;
+          entity.acOther = TilmeldAccessLevels.NO_ACCESS;
         }
         if (entity.acRead == null) {
           entity.acRead = [];
@@ -310,39 +435,53 @@ export default class Tilmeld implements TilmeldInterface {
         }
       }
     };
+    addAccess.skipOnClone = true;
 
-    const validate = function (entity: EntityInterface & AccessControlData) {
+    const validate = function (
+      _nymph: Nymph,
+      entity: EntityInterface & AccessControlData
+    ) {
       if (!(entity instanceof User) && !(entity instanceof Group)) {
         const ownershipAcPropertyValidator = (prop: any) => {
           if (
             typeof prop != 'number' ||
-            prop < Tilmeld.NO_ACCESS ||
-            prop > Tilmeld.FULL_ACCESS
+            prop < TilmeldAccessLevels.NO_ACCESS ||
+            prop > TilmeldAccessLevels.FULL_ACCESS
           ) {
-            throw new AccessControlError('Invalid access control property.');
+            throw new AccessControlError(
+              'Invalid access control property: ' + prop
+            );
           }
         };
 
         const accessAcPropertyValidator = (prop: any) => {
           if (!Array.isArray(prop)) {
-            throw new AccessControlError('Invalid access control property.');
+            throw new AccessControlError(
+              'Invalid access control property: ' + prop
+            );
           }
           prop.forEach((value) => {
             if (!(value instanceof User || value instanceof Group)) {
-              throw new AccessControlError('Invalid access control property.');
+              throw new AccessControlError(
+                'Invalid access control property: ' + prop
+              );
             }
           });
         };
 
         if ('user' in entity) {
           if (!(entity.user instanceof User)) {
-            throw new AccessControlError('Invalid access control property.');
+            throw new AccessControlError(
+              'Invalid access control property: user'
+            );
           }
         }
 
         if ('group' in entity) {
-          if (!(entity.Group instanceof Group)) {
-            throw new AccessControlError('Invalid access control property.');
+          if (!(entity.group instanceof Group)) {
+            throw new AccessControlError(
+              'Invalid access control property: group'
+            );
           }
         }
 
@@ -366,6 +505,7 @@ export default class Tilmeld implements TilmeldInterface {
         }
       }
     };
+    validate.skipOnClone = true;
 
     this.nymph.on('query', handleQuery);
 
@@ -408,16 +548,16 @@ export default class Tilmeld implements TilmeldInterface {
       return;
     }
 
-    if (user === null) {
+    if (user == null || user.guid == null) {
       selectors.push({
         type: '|',
         // Other access control is sufficient.
-        gte: [['acOther', Tilmeld.READ_ACCESS]],
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
         // The user and group are not set.
         selector: [
           {
             type: '&',
-            '!defined': ['user', 'group'],
+            '!defined': [['user', 'group']],
           },
         ],
       });
@@ -425,63 +565,50 @@ export default class Tilmeld implements TilmeldInterface {
       const subSelectors: FormattedSelector[] = [
         {
           type: '&',
-          '!defined': ['user', 'group'],
+          '!defined': [['user', 'group']],
         },
         // It is owned by the user.
         {
           type: '&',
-          ref: [['user', user]],
-          gte: [['acUser', Tilmeld.READ_ACCESS]],
+          ref: [['user', user.guid]],
+          gte: [['acUser', TilmeldAccessLevels.READ_ACCESS]],
         },
       ];
-      const selector: FormattedSelector = {
-        type: '|',
-        // Other access control is sufficient.
-        gte: [['acOther', Tilmeld.READ_ACCESS]],
-        // The user and group are not set.
-        selector: subSelectors,
-        // The user is listed in acRead, acWrite, or acFull.
-        ref: [
-          ['acRead', user],
-          ['acWrite', user],
-          ['acFull', user],
-        ],
-      };
       const groupRefs: FormattedSelector['ref'] = [];
       const acRefs: FormattedSelector['ref'] = [];
       if (user.group != null && user.group.guid != null) {
         // It belongs to the user's primary group.
-        groupRefs.push(['group', user.group]);
+        groupRefs.push(['group', user.group.guid]);
         // User's primary group is listed in acRead, acWrite, or acFull.
-        acRefs.push(['acRead', user.group]);
-        acRefs.push(['acWrite', user.group]);
-        acRefs.push(['acFull', user.group]);
+        acRefs.push(['acRead', user.group.guid]);
+        acRefs.push(['acWrite', user.group.guid]);
+        acRefs.push(['acFull', user.group.guid]);
       }
       for (let curSecondaryGroup of user.groups ?? []) {
         if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curSecondaryGroup]);
+          groupRefs.push(['group', curSecondaryGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curSecondaryGroup]);
-          acRefs.push(['acWrite', curSecondaryGroup]);
-          acRefs.push(['acFull', curSecondaryGroup]);
+          acRefs.push(['acRead', curSecondaryGroup.guid]);
+          acRefs.push(['acWrite', curSecondaryGroup.guid]);
+          acRefs.push(['acFull', curSecondaryGroup.guid]);
         }
       }
       for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
         if (curDescendantGroup != null && curDescendantGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curDescendantGroup]);
+          groupRefs.push(['group', curDescendantGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curDescendantGroup]);
-          acRefs.push(['acWrite', curDescendantGroup]);
-          acRefs.push(['acFull', curDescendantGroup]);
+          acRefs.push(['acRead', curDescendantGroup.guid]);
+          acRefs.push(['acWrite', curDescendantGroup.guid]);
+          acRefs.push(['acFull', curDescendantGroup.guid]);
         }
       }
       // All the group refs.
       if (groupRefs.length) {
         subSelectors.push({
           type: '&',
-          gte: [['acGroup', Tilmeld.READ_ACCESS]],
+          gte: [['acGroup', TilmeldAccessLevels.READ_ACCESS]],
           selector: [
             {
               type: '|',
@@ -497,6 +624,19 @@ export default class Tilmeld implements TilmeldInterface {
           ref: acRefs,
         });
       }
+      const selector: FormattedSelector = {
+        type: '|',
+        // Other access control is sufficient.
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
+        // The user and group are not set.
+        selector: subSelectors,
+        // The user is listed in acRead, acWrite, or acFull.
+        ref: [
+          ['acRead', user.guid],
+          ['acWrite', user.guid],
+          ['acFull', user.guid],
+        ],
+      };
       selectors.push(selector);
     }
   }
@@ -530,9 +670,9 @@ export default class Tilmeld implements TilmeldInterface {
    *
    * These properties defaults to:
    *
-   * - acUser = Tilmeld.FULL_ACCESS
-   * - acGroup = Tilmeld.READ_ACCESS
-   * - acOther = Tilmeld.NO_ACCESS
+   * - acUser = TilmeldAccessLevels.FULL_ACCESS
+   * - acGroup = TilmeldAccessLevels.READ_ACCESS
+   * - acOther = TilmeldAccessLevels.NO_ACCESS
    *
    * "acRead", "acWrite", and "acFull" are arrays of users and/or groups that
    * also have those permissions.
@@ -561,13 +701,13 @@ export default class Tilmeld implements TilmeldInterface {
    * - None of the above. (Check other AC.)
    *
    * @param entity The entity to check.
-   * @param type The lowest level of permission to consider a pass. One of Tilmeld.READ_ACCESS, Tilmeld.WRITE_ACCESS, or Tilmeld.FULL_ACCESS.
+   * @param type The lowest level of permission to consider a pass.
    * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
    * @returns Whether the current user has at least `type` permission for the entity.
    */
   public checkPermissions(
     entity: EntityInterface & AccessControlData,
-    type = Tilmeld.READ_ACCESS,
+    type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
     user?: (User & UserData) | false
   ) {
     // Only works for entities.
@@ -593,7 +733,8 @@ export default class Tilmeld implements TilmeldInterface {
     // Users and groups are always readable. Editable by Tilmeld admins.
     if (
       (entity instanceof User || entity instanceof Group) &&
-      (type === Tilmeld.READ_ACCESS || userOrEmpty.$gatekeeper('tilmeld/admin'))
+      (type === TilmeldAccessLevels.READ_ACCESS ||
+        userOrEmpty.$gatekeeper('tilmeld/admin'))
     ) {
       return true;
     }
@@ -604,9 +745,9 @@ export default class Tilmeld implements TilmeldInterface {
     }
 
     // Load access control, since we need it now...
-    const acUser = entity.acUser ?? Tilmeld.FULL_ACCESS;
-    const acGroup = entity.acGroup ?? Tilmeld.READ_ACCESS;
-    const acOther = entity.acOther ?? Tilmeld.NO_ACCESS;
+    const acUser = entity.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
+    const acGroup = entity.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
+    const acOther = entity.acOther ?? TilmeldAccessLevels.NO_ACCESS;
 
     if (userOrNull === null) {
       return acOther >= type;
@@ -622,7 +763,7 @@ export default class Tilmeld implements TilmeldInterface {
       userOrEmpty.group != null &&
       typeof userOrEmpty.group.$is === 'function' &&
       userOrEmpty.group.$is(entity) &&
-      type === Tilmeld.READ_ACCESS
+      type === TilmeldAccessLevels.READ_ACCESS
     ) {
       return true;
     }
@@ -634,9 +775,18 @@ export default class Tilmeld implements TilmeldInterface {
 
     // Check access ac properties.
     const checks = [
-      { type: Tilmeld.FULL_ACCESS, array: [...(entity.acFull ?? [])] },
-      { type: Tilmeld.WRITE_ACCESS, array: [...(entity.acWrite ?? [])] },
-      { type: Tilmeld.READ_ACCESS, array: [...(entity.acRead ?? [])] },
+      {
+        type: TilmeldAccessLevels.FULL_ACCESS,
+        array: [...(entity.acFull ?? [])],
+      },
+      {
+        type: TilmeldAccessLevels.WRITE_ACCESS,
+        array: [...(entity.acWrite ?? [])],
+      },
+      {
+        type: TilmeldAccessLevels.READ_ACCESS,
+        array: [...(entity.acRead ?? [])],
+      },
     ];
     for (let curCheck of checks) {
       if (type <= curCheck.type) {
@@ -672,6 +822,73 @@ export default class Tilmeld implements TilmeldInterface {
     return acOther >= type;
   }
 
+  /**
+   * Check a UID's permissions for a user.
+   *
+   * ## THIS ONLY CHECKS AUTOMATICALLY FOR CLIENT REQUESTS.
+   *
+   * UID functions on the Node.js side are not checked automatically. This
+   * function is only run automatically for UID functions run from the client.
+   * You should call this function manually if you're running a UID function on
+   * the Node.js side and you want it gated.
+   *
+   * This will check the Tilmeld config and the user's abilities.
+   *
+   * - READ_ACCESS, the UID is listed in clientReadableUIDs or the user has the
+   *   "uid/get/nameofuid" ability.
+   * - WRITE_ACCESS, the UID is listed in clientEnabledUIDs or the user has the
+   *   "uid/new/nameofuid" ability.
+   * - FULL_ACCESS, the UID is listed in clientSetabledUIDs or the user has the
+   *   "uid/set/nameofuid" ability.
+   *
+   * @param name The UID to check.
+   * @param type The lowest level of permission to consider a pass.
+   * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
+   * @returns Whether the current user has at least `type` permission for the UID.
+   */
+  public checkClientUIDPermissions(
+    name: string,
+    type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
+    user?: (User & UserData) | false
+  ) {
+    let userOrEmpty: User & UserData = this.User.factorySync();
+    // Calculate the user.
+    if (user == null) {
+      userOrEmpty = this.User.current(true);
+    } else if (user !== false) {
+      userOrEmpty = user;
+    }
+
+    if (userOrEmpty.$gatekeeper('system/admin')) {
+      return true;
+    }
+
+    if (type === TilmeldAccessLevels.FULL_ACCESS) {
+      return (
+        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
+        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+      );
+    } else if (type === TilmeldAccessLevels.WRITE_ACCESS) {
+      return (
+        this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
+        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
+        userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
+        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+      );
+    } else if (type === TilmeldAccessLevels.READ_ACCESS) {
+      return (
+        this.config.clientReadableUIDs.indexOf(name) !== -1 ||
+        this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
+        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
+        userOrEmpty.$gatekeeper(`uid/get/${name}`) ||
+        userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
+        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+      );
+    }
+
+    return false;
+  }
+
   /**
    * Fill session user data.
    *
@@ -754,9 +971,9 @@ export default class Tilmeld implements TilmeldInterface {
     // to provide the auth token.
     let fromAuthHeader = false;
     let authToken: string;
-    if (this.request.header('HTTP_X_TILMELDAUTH') != null) {
+    if (this.request.header('x-tilmeldauth') != null) {
       fromAuthHeader = true;
-      authToken = this.request.header('HTTP_X_TILMELDAUTH') as string;
+      authToken = this.request.header('x-tilmeldauth') as string;
     } else if ('TILMELDAUTH' in cookies) {
       fromAuthHeader = false;
       authToken = cookies.TILMELDAUTH;
@@ -775,7 +992,7 @@ export default class Tilmeld implements TilmeldInterface {
     } else {
       // The request is for something else, so check for a valid XSRF token,
       // unless the auth token is provided by a header (instead of a cookie).
-      const xsrfToken = this.request.header('HTTP_X_XSRF_TOKEN');
+      const xsrfToken = this.request.header('x-xsrf-token');
       if (xsrfToken == null && !fromAuthHeader) {
         return false;
       }