@nymphjs/tilmeld 1.0.0-alpha.4 → 1.0.0-alpha.42

package/src/Group.ts

@@ -106,9 +106,9 @@ export default class Group extends AbleObject<GroupData> {
     'getPrimaryGroups',
     'getSecondaryGroups',
   ];
-  protected $privateData = Group.DEFAULT_PRIVATE_DATA;
-  public static searchRestrictedData = Group.DEFAULT_PRIVATE_DATA;
-  protected $allowlistData? = Group.DEFAULT_ALLOWLIST_DATA;
+  protected $privateData = [...Group.DEFAULT_PRIVATE_DATA];
+  public static searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
+  protected $allowlistData? = [...Group.DEFAULT_ALLOWLIST_DATA];
   protected $allowlistTags?: string[] = [];
 
   /**
@@ -294,8 +294,8 @@ export default class Group extends AbleObject<GroupData> {
     const tilmeld = this.$nymph.tilmeld as Tilmeld;
     let user = givenUser ?? tilmeld.User.current();
 
-    this.$privateData = Group.DEFAULT_PRIVATE_DATA;
-    this.$allowlistData = Group.DEFAULT_ALLOWLIST_DATA;
+    this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
+    this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
 
     if (tilmeld.config.emailUsernames) {
       this.$privateData.push('groupname');
@@ -746,13 +746,16 @@ export default class Group extends AbleObject<GroupData> {
   }
 
   public async $delete() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = this.$nymph.tilmeld as Tilmeld;
     if (!tilmeld.gatekeeper('tilmeld/admin')) {
       throw new BadDataError("You don't have the authority to delete groups.");
     }
 
     const transaction = 'tilmeld-delete-' + this.guid;
-    const tnymph = await this.$nymph.startTransaction(transaction);
+    const nymph = this.$nymph;
+    const tnymph = await nymph.startTransaction(transaction);
+    this.$nymph = tnymph;
+    tilmeld = this.$nymph.tilmeld as Tilmeld;
 
     // Delete descendants.
     const descendants = await this.$getDescendants();
@@ -760,6 +763,7 @@ export default class Group extends AbleObject<GroupData> {
       for (let curGroup of descendants) {
         if (!(await curGroup.$delete())) {
           await tnymph.rollback(transaction);
+          this.$nymph = nymph;
           return false;
         }
       }
@@ -780,6 +784,7 @@ export default class Group extends AbleObject<GroupData> {
       delete user.group;
       if (!(await user.$save())) {
         await tnymph.rollback(transaction);
+        this.$nymph = nymph;
         return false;
       }
     }
@@ -810,6 +815,7 @@ export default class Group extends AbleObject<GroupData> {
     } else {
       await tnymph.rollback(transaction);
     }
+    this.$nymph = nymph;
     return success;
   }
 }

package/src/Tilmeld.ts

@@ -7,6 +7,7 @@ import {
   TilmeldAccessLevels,
 } from '@nymphjs/nymph';
 import { Request, Response } from 'express';
+import { xor } from 'lodash';
 
 import { Config, ConfigDefaults as defaults } from './conf';
 import { AccessControlError } from './errors';
@@ -147,14 +148,13 @@ export default class Tilmeld implements TilmeldInterface {
   }
 
   private initAccessControl() {
-    const tilmeld = this;
-
     // Check for the skip access control option and add AC selectors.
     const handleQuery = function (
-      _nymph: Nymph,
+      nymph: Nymph,
       options: Options,
       selectors: FormattedSelector[]
     ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       if (
         !options ||
         !('skipAc' in options) ||
@@ -191,9 +191,10 @@ export default class Tilmeld implements TilmeldInterface {
 
     // Filter entities being deleted for user permissions.
     const checkPermissionsDelete = function (
-      _nymph: Nymph,
+      nymph: Nymph,
       entity: EntityInterface
     ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       if (
         typeof entity.$tilmeldDeleteSkipAC === 'function' &&
         entity.$tilmeldDeleteSkipAC()
@@ -201,7 +202,7 @@ export default class Tilmeld implements TilmeldInterface {
         return;
       }
       // Test for permissions.
-      if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
+      if (!tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
         throw new AccessControlError('No permission to delete.');
       }
     };
@@ -213,8 +214,8 @@ export default class Tilmeld implements TilmeldInterface {
       guid: string,
       className?: string
     ) {
-      const entity = tilmeld.nymph.driver.getEntitySync(
-        { class: tilmeld.nymph.getEntityClass(className ?? 'Entity') },
+      const entity = nymph.driver.getEntitySync(
+        { class: nymph.getEntityClass(className ?? 'Entity') },
         { type: '&', guid: guid }
       );
       if (entity != null) {
@@ -226,9 +227,10 @@ export default class Tilmeld implements TilmeldInterface {
     // Filter entities being saved for user permissions, and filter any
     // disallowed changes to AC properties.
     const checkPermissionsSaveAndFilterAcChanges = function (
-      _nymph: Nymph,
+      nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       if (!entity) {
         return;
       }
@@ -244,15 +246,15 @@ export default class Tilmeld implements TilmeldInterface {
         // allowing a change to ac properties.
 
         const originalAc = entity.$getOriginalAcValues();
-        const newAc = {
-          user: entity.user ?? null,
-          group: entity.group ?? null,
-          acUser: entity.acUser ?? null,
-          acGroup: entity.acGroup ?? null,
-          acOther: entity.acOther ?? null,
-          acRead: entity.acRead ?? null,
-          acWrite: entity.acWrite ?? null,
-          acFull: entity.acFull ?? null,
+        const newAc: AccessControlData = {
+          user: entity.user ?? undefined,
+          group: entity.group ?? undefined,
+          acUser: entity.acUser ?? undefined,
+          acGroup: entity.acGroup ?? undefined,
+          acOther: entity.acOther ?? undefined,
+          acRead: entity.acRead ?? undefined,
+          acWrite: entity.acWrite ?? undefined,
+          acFull: entity.acFull ?? undefined,
         };
 
         const setAcProperties = (acValues: { [k: string]: any }) => {
@@ -268,10 +270,102 @@ export default class Tilmeld implements TilmeldInterface {
 
         // Restore original AC properties and check permissions.
         setAcProperties(originalAc);
-        if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
-          // Only allow changes to AC properties if the user has full access.
-          // TODO: only allow changes to `user` and `group` if tilmeld admin or
-          //       group is user's group.
+
+        function areAcPropertiesChanged(
+          a: AccessControlData,
+          b: AccessControlData
+        ) {
+          for (const name of ['user', 'group'] as ('user' | 'group')[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (!aVal.$is(bVal)) {
+              return true;
+            }
+          }
+          for (const name of ['acUser', 'acGroup', 'acOther'] as (
+            | 'acUser'
+            | 'acGroup'
+            | 'acOther'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal !== bVal) {
+              return true;
+            }
+          }
+          for (const name of ['acRead', 'acWrite', 'acFull'] as (
+            | 'acRead'
+            | 'acWrite'
+            | 'acFull'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal.length !== bVal.length) {
+              return true;
+            }
+            if (
+              xor(
+                aVal.map((entity) => entity.guid),
+                bVal.map((entity) => entity.guid)
+              ).length
+            ) {
+              return true;
+            }
+          }
+          return false;
+        }
+
+        if (areAcPropertiesChanged(originalAc, newAc)) {
+          if (
+            !tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)
+          ) {
+            // Only allow changes to AC properties if the user has full access.
+            throw new AccessControlError(
+              'No permission to change access control properties.'
+            );
+          }
+
+          if (
+            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
+              (!originalAc.user &&
+                newAc.user &&
+                !newAc.user.$is(tilmeld.currentUser))) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another user.'
+            );
+          }
+
+          if (
+            newAc.group &&
+            !newAc.group.$is(originalAc.group) &&
+            !(
+              newAc.group.$is(tilmeld.currentUser?.group) ||
+              newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
+            ) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another group.'
+            );
+          }
+
           setAcProperties(newAc);
         }
       }
@@ -300,9 +394,10 @@ export default class Tilmeld implements TilmeldInterface {
      * - acOther = TilmeldAccessLevels.NO_ACCESS
      */
     const addAccess = function (
-      _nymph: Nymph,
+      nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
+      const tilmeld = nymph.tilmeld as Tilmeld;
       const user = tilmeld.currentUser;
       if (
         user != null &&
@@ -353,30 +448,40 @@ export default class Tilmeld implements TilmeldInterface {
             prop < TilmeldAccessLevels.NO_ACCESS ||
             prop > TilmeldAccessLevels.FULL_ACCESS
           ) {
-            throw new AccessControlError('Invalid access control property.');
+            throw new AccessControlError(
+              'Invalid access control property: ' + prop
+            );
           }
         };
 
         const accessAcPropertyValidator = (prop: any) => {
           if (!Array.isArray(prop)) {
-            throw new AccessControlError('Invalid access control property.');
+            throw new AccessControlError(
+              'Invalid access control property: ' + prop
+            );
           }
           prop.forEach((value) => {
             if (!(value instanceof User || value instanceof Group)) {
-              throw new AccessControlError('Invalid access control property.');
+              throw new AccessControlError(
+                'Invalid access control property: ' + prop
+              );
             }
           });
         };
 
         if ('user' in entity) {
           if (!(entity.user instanceof User)) {
-            throw new AccessControlError('Invalid access control property.');
+            throw new AccessControlError(
+              'Invalid access control property: user'
+            );
           }
         }
 
         if ('group' in entity) {
-          if (!(entity.Group instanceof Group)) {
-            throw new AccessControlError('Invalid access control property.');
+          if (!(entity.group instanceof Group)) {
+            throw new AccessControlError(
+              'Invalid access control property: group'
+            );
           }
         }
 
@@ -443,7 +548,7 @@ export default class Tilmeld implements TilmeldInterface {
       return;
     }
 
-    if (user === null) {
+    if (user == null || user.guid == null) {
       selectors.push({
         type: '|',
         // Other access control is sufficient.
@@ -452,7 +557,7 @@ export default class Tilmeld implements TilmeldInterface {
         selector: [
           {
             type: '&',
-            '!defined': ['user', 'group'],
+            '!defined': [['user', 'group']],
           },
         ],
       });
@@ -460,56 +565,43 @@ export default class Tilmeld implements TilmeldInterface {
       const subSelectors: FormattedSelector[] = [
         {
           type: '&',
-          '!defined': ['user', 'group'],
+          '!defined': [['user', 'group']],
         },
         // It is owned by the user.
         {
           type: '&',
-          ref: [['user', user]],
+          ref: [['user', user.guid]],
           gte: [['acUser', TilmeldAccessLevels.READ_ACCESS]],
         },
       ];
-      const selector: FormattedSelector = {
-        type: '|',
-        // Other access control is sufficient.
-        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
-        // The user and group are not set.
-        selector: subSelectors,
-        // The user is listed in acRead, acWrite, or acFull.
-        ref: [
-          ['acRead', user],
-          ['acWrite', user],
-          ['acFull', user],
-        ],
-      };
       const groupRefs: FormattedSelector['ref'] = [];
       const acRefs: FormattedSelector['ref'] = [];
       if (user.group != null && user.group.guid != null) {
         // It belongs to the user's primary group.
-        groupRefs.push(['group', user.group]);
+        groupRefs.push(['group', user.group.guid]);
         // User's primary group is listed in acRead, acWrite, or acFull.
-        acRefs.push(['acRead', user.group]);
-        acRefs.push(['acWrite', user.group]);
-        acRefs.push(['acFull', user.group]);
+        acRefs.push(['acRead', user.group.guid]);
+        acRefs.push(['acWrite', user.group.guid]);
+        acRefs.push(['acFull', user.group.guid]);
       }
       for (let curSecondaryGroup of user.groups ?? []) {
         if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curSecondaryGroup]);
+          groupRefs.push(['group', curSecondaryGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curSecondaryGroup]);
-          acRefs.push(['acWrite', curSecondaryGroup]);
-          acRefs.push(['acFull', curSecondaryGroup]);
+          acRefs.push(['acRead', curSecondaryGroup.guid]);
+          acRefs.push(['acWrite', curSecondaryGroup.guid]);
+          acRefs.push(['acFull', curSecondaryGroup.guid]);
         }
       }
       for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
         if (curDescendantGroup != null && curDescendantGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curDescendantGroup]);
+          groupRefs.push(['group', curDescendantGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curDescendantGroup]);
-          acRefs.push(['acWrite', curDescendantGroup]);
-          acRefs.push(['acFull', curDescendantGroup]);
+          acRefs.push(['acRead', curDescendantGroup.guid]);
+          acRefs.push(['acWrite', curDescendantGroup.guid]);
+          acRefs.push(['acFull', curDescendantGroup.guid]);
         }
       }
       // All the group refs.
@@ -532,6 +624,19 @@ export default class Tilmeld implements TilmeldInterface {
           ref: acRefs,
         });
       }
+      const selector: FormattedSelector = {
+        type: '|',
+        // Other access control is sufficient.
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
+        // The user and group are not set.
+        selector: subSelectors,
+        // The user is listed in acRead, acWrite, or acFull.
+        ref: [
+          ['acRead', user.guid],
+          ['acWrite', user.guid],
+          ['acFull', user.guid],
+        ],
+      };
       selectors.push(selector);
     }
   }

package/src/User.test.ts

@@ -40,6 +40,14 @@ describe('User', () => {
     return newUser;
   }
 
+  it('new user passes validation', async () => {
+    const validUser = await makeNewUser();
+
+    expect(() => {
+      defaults.validatorUser(validUser);
+    }).not.toThrow();
+  });
+
   it("doesn't allow unknown keys", async () => {
     const invalidUser = await makeNewUser();