@nymphjs/tilmeld 1.0.0-alpha.8 → 1.0.0-beta.0

package/src/Tilmeld.ts

@@ -7,6 +7,7 @@ import {
   TilmeldAccessLevels,
 } from '@nymphjs/nymph';
 import { Request, Response } from 'express';
+import { xor } from 'lodash';
 
 import { Config, ConfigDefaults as defaults } from './conf';
 import { AccessControlError } from './errors';
@@ -201,7 +202,7 @@ export default class Tilmeld implements TilmeldInterface {
         return;
       }
       // Test for permissions.
-      if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
+      if (!tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
         throw new AccessControlError('No permission to delete.');
       }
     };
@@ -245,15 +246,15 @@ export default class Tilmeld implements TilmeldInterface {
         // allowing a change to ac properties.
 
         const originalAc = entity.$getOriginalAcValues();
-        const newAc = {
-          user: entity.user ?? null,
-          group: entity.group ?? null,
-          acUser: entity.acUser ?? null,
-          acGroup: entity.acGroup ?? null,
-          acOther: entity.acOther ?? null,
-          acRead: entity.acRead ?? null,
-          acWrite: entity.acWrite ?? null,
-          acFull: entity.acFull ?? null,
+        const newAc: AccessControlData = {
+          user: entity.user ?? undefined,
+          group: entity.group ?? undefined,
+          acUser: entity.acUser ?? undefined,
+          acGroup: entity.acGroup ?? undefined,
+          acOther: entity.acOther ?? undefined,
+          acRead: entity.acRead ?? undefined,
+          acWrite: entity.acWrite ?? undefined,
+          acFull: entity.acFull ?? undefined,
         };
 
         const setAcProperties = (acValues: { [k: string]: any }) => {
@@ -269,10 +270,102 @@ export default class Tilmeld implements TilmeldInterface {
 
         // Restore original AC properties and check permissions.
         setAcProperties(originalAc);
-        if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
-          // Only allow changes to AC properties if the user has full access.
-          // TODO: only allow changes to `user` and `group` if tilmeld admin or
-          //       group is user's group.
+
+        function areAcPropertiesChanged(
+          a: AccessControlData,
+          b: AccessControlData
+        ) {
+          for (const name of ['user', 'group'] as ('user' | 'group')[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (!aVal.$is(bVal)) {
+              return true;
+            }
+          }
+          for (const name of ['acUser', 'acGroup', 'acOther'] as (
+            | 'acUser'
+            | 'acGroup'
+            | 'acOther'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal !== bVal) {
+              return true;
+            }
+          }
+          for (const name of ['acRead', 'acWrite', 'acFull'] as (
+            | 'acRead'
+            | 'acWrite'
+            | 'acFull'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal.length !== bVal.length) {
+              return true;
+            }
+            if (
+              xor(
+                aVal.map((entity) => entity.guid),
+                bVal.map((entity) => entity.guid)
+              ).length
+            ) {
+              return true;
+            }
+          }
+          return false;
+        }
+
+        if (areAcPropertiesChanged(originalAc, newAc)) {
+          if (
+            !tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)
+          ) {
+            // Only allow changes to AC properties if the user has full access.
+            throw new AccessControlError(
+              'No permission to change access control properties.'
+            );
+          }
+
+          if (
+            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
+              (!originalAc.user &&
+                newAc.user &&
+                !newAc.user.$is(tilmeld.currentUser))) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another user.'
+            );
+          }
+
+          if (
+            newAc.group &&
+            !newAc.group.$is(originalAc.group) &&
+            !(
+              newAc.group.$is(tilmeld.currentUser?.group) ||
+              newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
+            ) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another group.'
+            );
+          }
+
           setAcProperties(newAc);
         }
       }
@@ -455,7 +548,7 @@ export default class Tilmeld implements TilmeldInterface {
       return;
     }
 
-    if (user === null) {
+    if (user == null || user.guid == null) {
       selectors.push({
         type: '|',
         // Other access control is sufficient.
@@ -464,7 +557,7 @@ export default class Tilmeld implements TilmeldInterface {
         selector: [
           {
             type: '&',
-            '!defined': ['user', 'group'],
+            '!defined': [['user', 'group']],
           },
         ],
       });
@@ -472,56 +565,43 @@ export default class Tilmeld implements TilmeldInterface {
       const subSelectors: FormattedSelector[] = [
         {
           type: '&',
-          '!defined': ['user', 'group'],
+          '!defined': [['user', 'group']],
         },
         // It is owned by the user.
         {
           type: '&',
-          ref: [['user', user]],
+          ref: [['user', user.guid]],
           gte: [['acUser', TilmeldAccessLevels.READ_ACCESS]],
         },
       ];
-      const selector: FormattedSelector = {
-        type: '|',
-        // Other access control is sufficient.
-        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
-        // The user and group are not set.
-        selector: subSelectors,
-        // The user is listed in acRead, acWrite, or acFull.
-        ref: [
-          ['acRead', user],
-          ['acWrite', user],
-          ['acFull', user],
-        ],
-      };
       const groupRefs: FormattedSelector['ref'] = [];
       const acRefs: FormattedSelector['ref'] = [];
       if (user.group != null && user.group.guid != null) {
         // It belongs to the user's primary group.
-        groupRefs.push(['group', user.group]);
+        groupRefs.push(['group', user.group.guid]);
         // User's primary group is listed in acRead, acWrite, or acFull.
-        acRefs.push(['acRead', user.group]);
-        acRefs.push(['acWrite', user.group]);
-        acRefs.push(['acFull', user.group]);
+        acRefs.push(['acRead', user.group.guid]);
+        acRefs.push(['acWrite', user.group.guid]);
+        acRefs.push(['acFull', user.group.guid]);
       }
       for (let curSecondaryGroup of user.groups ?? []) {
         if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curSecondaryGroup]);
+          groupRefs.push(['group', curSecondaryGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curSecondaryGroup]);
-          acRefs.push(['acWrite', curSecondaryGroup]);
-          acRefs.push(['acFull', curSecondaryGroup]);
+          acRefs.push(['acRead', curSecondaryGroup.guid]);
+          acRefs.push(['acWrite', curSecondaryGroup.guid]);
+          acRefs.push(['acFull', curSecondaryGroup.guid]);
         }
       }
       for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
         if (curDescendantGroup != null && curDescendantGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curDescendantGroup]);
+          groupRefs.push(['group', curDescendantGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curDescendantGroup]);
-          acRefs.push(['acWrite', curDescendantGroup]);
-          acRefs.push(['acFull', curDescendantGroup]);
+          acRefs.push(['acRead', curDescendantGroup.guid]);
+          acRefs.push(['acWrite', curDescendantGroup.guid]);
+          acRefs.push(['acFull', curDescendantGroup.guid]);
         }
       }
       // All the group refs.
@@ -544,6 +624,19 @@ export default class Tilmeld implements TilmeldInterface {
           ref: acRefs,
         });
       }
+      const selector: FormattedSelector = {
+        type: '|',
+        // Other access control is sufficient.
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
+        // The user and group are not set.
+        selector: subSelectors,
+        // The user is listed in acRead, acWrite, or acFull.
+        ref: [
+          ['acRead', user.guid],
+          ['acWrite', user.guid],
+          ['acFull', user.guid],
+        ],
+      };
       selectors.push(selector);
     }
   }

package/src/User.ts

@@ -7,12 +7,11 @@ import {
 } from '@nymphjs/nymph';
 import { EmailOptions } from 'email-templates';
 import strtotime from 'locutus/php/datetime/strtotime';
-import { nanoid, customAlphabet } from 'nanoid';
-import { nolookalikesSafe } from 'nanoid-dictionary';
 import Base64 from 'crypto-js/enc-base64';
 import sha256 from 'crypto-js/sha256';
 import md5 from 'crypto-js/md5';
 import { difference } from 'lodash';
+import { humanSecret, nanoid } from '@nymphjs/guid';
 
 import type Tilmeld from './Tilmeld';
 import AbleObject from './AbleObject';
@@ -24,6 +23,44 @@ import {
   EmailChangeRateLimitExceededError,
 } from './errors';
 
+export type EventType =
+  | 'beforeRegister'
+  | 'afterRegister'
+  | 'beforeLogin'
+  | 'afterLogin'
+  | 'beforeLogout'
+  | 'afterLogout';
+/**
+ * Theses are run before the user data checks, so the only checks before are
+ * whether registration is allowed and whether the user is already registered.
+ */
+export type TilmeldBeforeRegisterCallback = (
+  user: User & UserData,
+  data: { password: string; additionalData?: { [k: string]: any } }
+) => Promise<void> | void;
+export type TilmeldAfterRegisterCallback = (
+  user: User & UserData,
+  result: { loggedin: boolean; message: string }
+) => Promise<void> | void;
+/**
+ * These are run after the authentication checks, but before the login action.
+ */
+export type TilmeldBeforeLoginCallback = (
+  user: User & UserData,
+  data: {
+    username: string;
+    password: string;
+    additionalData?: { [k: string]: any };
+  }
+) => void;
+/**
+ * This is run before the transaction is committed, and you can perform
+ * additional functions on the transaction, which is available in `user.$nymph`.
+ */
+export type TilmeldAfterLoginCallback = (user: User & UserData) => void;
+export type TilmeldBeforeLogoutCallback = (user: User & UserData) => void;
+export type TilmeldAfterLogoutCallback = (user: User & UserData) => void;
+
 export type UserData = {
   /**
    * The abilities granted to the user.
@@ -142,6 +179,12 @@ export default class User extends AbleObject<UserData> {
   static tilmeld: Tilmeld;
   static ETYPE = 'tilmeld_user';
   static class = 'User';
+  private static beforeRegisterCallbacks: TilmeldBeforeRegisterCallback[] = [];
+  private static afterRegisterCallbacks: TilmeldAfterRegisterCallback[] = [];
+  private static beforeLoginCallbacks: TilmeldBeforeLoginCallback[] = [];
+  private static afterLoginCallbacks: TilmeldAfterLoginCallback[] = [];
+  private static beforeLogoutCallbacks: TilmeldBeforeLogoutCallback[] = [];
+  private static afterLogoutCallbacks: TilmeldAfterLogoutCallback[] = [];
 
   private static DEFAULT_CLIENT_ENABLED_METHODS = [
     '$checkUsername',
@@ -171,7 +214,7 @@ export default class User extends AbleObject<UserData> {
   ];
   private static DEFAULT_ALLOWLIST_DATA: string[] = [];
 
-  protected $clientEnabledMethods = User.DEFAULT_CLIENT_ENABLED_METHODS;
+  protected $clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
   public static clientEnabledStaticMethods = [
     'current',
     'loginUser',
@@ -179,9 +222,9 @@ export default class User extends AbleObject<UserData> {
     'recover',
     'getClientConfig',
   ];
-  protected $privateData = User.DEFAULT_PRIVATE_DATA;
-  public static searchRestrictedData = User.DEFAULT_PRIVATE_DATA;
-  protected $allowlistData? = User.DEFAULT_ALLOWLIST_DATA;
+  protected $privateData = [...User.DEFAULT_PRIVATE_DATA];
+  public static searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+  protected $allowlistData? = [...User.DEFAULT_ALLOWLIST_DATA];
   protected $allowlistTags?: string[] = [];
 
   /**
@@ -325,7 +368,7 @@ export default class User extends AbleObject<UserData> {
       }
 
       // Create a unique secret.
-      getUser.recoverSecret = customAlphabet(nolookalikesSafe, 10)();
+      getUser.recoverSecret = humanSecret();
       getUser.recoverSecretDate = Date.now();
       if (!(await getUser.$saveSkipAC())) {
         return { result: false, message: "Couldn't save recovery secret." };
@@ -429,7 +472,11 @@ export default class User extends AbleObject<UserData> {
     };
   }
 
-  public static async loginUser(data: { username: string; password: string }) {
+  public static async loginUser(data: {
+    username: string;
+    password: string;
+    additionalData?: { [k: string]: any };
+  }) {
     if (!('username' in data) || !data.username.length) {
       return { result: false, message: 'Incorrect login/password.' };
     }
@@ -443,7 +490,11 @@ export default class User extends AbleObject<UserData> {
     return result;
   }
 
-  public $login(data: { username: string; password: string }) {
+  public $login(data: {
+    username: string;
+    password: string;
+    additionalData?: { [k: string]: any };
+  }) {
     const tilmeld = this.$nymph.tilmeld as Tilmeld;
     if (this.guid == null) {
       return { result: false, message: 'Incorrect login/password.' };
@@ -458,11 +509,32 @@ export default class User extends AbleObject<UserData> {
       return { result: false, message: 'Incorrect login/password.' };
     }
 
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .beforeLoginCallbacks) {
+        if (callback) {
+          callback(this, data);
+        }
+      }
+    } catch (e: any) {
+      return {
+        result: false,
+        message: e.message,
+      };
+    }
+
     // Authentication was successful, attempt to login.
     if (!tilmeld.login(this, true)) {
       return { result: false, message: 'Incorrect login/password.' };
     }
 
+    for (let callback of (this.constructor as typeof User)
+      .afterLoginCallbacks) {
+      if (callback) {
+        callback(this);
+      }
+    }
+
     // Login was successful.
     return { result: true, message: 'You are logged in.' };
   }
@@ -473,7 +545,30 @@ export default class User extends AbleObject<UserData> {
    */
   public $logout() {
     const tilmeld = this.$nymph.tilmeld as Tilmeld;
+
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .beforeLogoutCallbacks) {
+        if (callback) {
+          callback(this);
+        }
+      }
+    } catch (e: any) {
+      return {
+        result: false,
+        message: e.message,
+      };
+    }
+
     tilmeld.logout();
+
+    for (let callback of (this.constructor as typeof User)
+      .afterLogoutCallbacks) {
+      if (callback) {
+        callback(this);
+      }
+    }
+
     return { result: true, message: 'You have been logged out.' };
   }
 
@@ -579,9 +674,9 @@ export default class User extends AbleObject<UserData> {
     const tilmeld = this.$nymph.tilmeld as Tilmeld;
     let user = givenUser ?? tilmeld.User.current();
 
-    this.$clientEnabledMethods = User.DEFAULT_CLIENT_ENABLED_METHODS;
-    this.$privateData = User.DEFAULT_PRIVATE_DATA;
-    this.$allowlistData = User.DEFAULT_ALLOWLIST_DATA;
+    this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
+    this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
+    this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
 
     if (tilmeld.config.emailUsernames) {
       this.$privateData.push('username');
@@ -1123,8 +1218,9 @@ export default class User extends AbleObject<UserData> {
 
   public async $register(data: {
     password: string;
+    additionalData?: { [k: string]: any };
   }): Promise<{ result: boolean; loggedin: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = this.$nymph.tilmeld as Tilmeld;
     if (!tilmeld.config.allowRegistration) {
       return {
         result: false,
@@ -1139,6 +1235,22 @@ export default class User extends AbleObject<UserData> {
         message: 'This is already a registered user.',
       };
     }
+
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .beforeRegisterCallbacks) {
+        if (callback) {
+          await callback(this, data);
+        }
+      }
+    } catch (e: any) {
+      return {
+        result: false,
+        loggedin: false,
+        message: e.message,
+      };
+    }
+
     if (!('password' in data) || !data.password.length) {
       return {
         result: false,
@@ -1170,6 +1282,7 @@ export default class User extends AbleObject<UserData> {
     const nymph = this.$nymph;
     const tnymph = await this.$nymph.startTransaction(transaction);
     this.$nymph = tnymph;
+    tilmeld = this.$nymph.tilmeld as Tilmeld;
 
     try {
       // Add primary group.
@@ -1318,19 +1431,40 @@ export default class User extends AbleObject<UserData> {
           tilmeld.config.unverifiedAccess &&
           !madeAdmin
         ) {
-          tilmeld.login(this, true);
+          if (!tilmeld.login(this, true)) {
+            throw new Error('An error occurred trying to log you in.');
+          }
           message +=
             "You're now logged in! An email has been sent to " +
             `${this.$data.email} with a verification link for you to finish ` +
             'registration.';
           loggedin = true;
         } else {
-          tilmeld.login(this, true);
+          if (!tilmeld.login(this, true)) {
+            throw new Error('An error occurred trying to log you in.');
+          }
           message += "You're now registered and logged in!";
           loggedin = true;
         }
-        await tnymph.commit(transaction);
-        this.$nymph = nymph;
+
+        for (let callback of (this.constructor as typeof User)
+          .afterRegisterCallbacks) {
+          if (callback) {
+            await callback(this, {
+              loggedin,
+              message,
+            });
+          }
+        }
+
+        try {
+          await tnymph.commit(transaction);
+          this.$nymph = nymph;
+          this.$nymph.tilmeld?.fillSession(this);
+        } catch (e: any) {
+          throw e;
+        }
+
         return {
           result: true,
           loggedin,
@@ -1353,7 +1487,7 @@ export default class User extends AbleObject<UserData> {
   }
 
   public async $save() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = this.$nymph.tilmeld as Tilmeld;
     if (this.$data.username == null || !this.$data.username.trim().length) {
       return false;
     }
@@ -1551,6 +1685,7 @@ export default class User extends AbleObject<UserData> {
     const nymph = this.$nymph;
     const tnymph = await this.$nymph.startTransaction(transaction);
     this.$nymph = tnymph;
+    tilmeld = this.$nymph.tilmeld as Tilmeld;
 
     if (
       this.$data.group != null &&
@@ -1597,14 +1732,14 @@ export default class User extends AbleObject<UserData> {
         }
       }
 
-      if (tilmeld.User.current(true).$is(this)) {
-        // Update the user in the session cache.
-        tilmeld.fillSession(this);
-      }
-
       this.$descendantGroups = undefined;
       this.$gatekeeperCache = undefined;
       await tnymph.commit(transaction);
+
+      if ((nymph.tilmeld as Tilmeld).User.current(true).$is(this)) {
+        // Update the user in the session cache.
+        (nymph.tilmeld as Tilmeld).fillSession(this);
+      }
     } else {
       await tnymph.rollback(transaction);
     }
@@ -1646,4 +1781,82 @@ export default class User extends AbleObject<UserData> {
     }
     return await super.$delete();
   }
+
+  public static on<T extends EventType>(
+    event: T,
+    callback: T extends 'beforeRegister'
+      ? TilmeldBeforeRegisterCallback
+      : T extends 'afterRegister'
+      ? TilmeldAfterRegisterCallback
+      : T extends 'beforeLogin'
+      ? TilmeldBeforeLoginCallback
+      : T extends 'afterLogin'
+      ? TilmeldAfterLoginCallback
+      : T extends 'beforeLogout'
+      ? TilmeldBeforeLogoutCallback
+      : T extends 'afterLogout'
+      ? TilmeldAfterLogoutCallback
+      : never
+  ) {
+    const prop = (event + 'Callbacks') as T extends 'beforeRegister'
+      ? 'beforeRegisterCallbacks'
+      : T extends 'afterRegister'
+      ? 'afterRegisterCallbacks'
+      : T extends 'beforeLogin'
+      ? 'beforeLoginCallbacks'
+      : T extends 'afterLogin'
+      ? 'afterLoginCallbacks'
+      : T extends 'beforeLogout'
+      ? 'beforeLogoutCallbacks'
+      : T extends 'afterLogout'
+      ? 'afterLogoutCallbacks'
+      : never;
+    if (!(prop in this)) {
+      throw new Error('Invalid event type.');
+    }
+    // @ts-ignore: The callback should always be the right type here.
+    this[prop].push(callback);
+    return () => this.off(event, callback);
+  }
+
+  public static off<T extends EventType>(
+    event: T,
+    callback: T extends 'beforeRegister'
+      ? TilmeldBeforeRegisterCallback
+      : T extends 'afterRegister'
+      ? TilmeldAfterRegisterCallback
+      : T extends 'beforeLogin'
+      ? TilmeldBeforeLoginCallback
+      : T extends 'afterLogin'
+      ? TilmeldAfterLoginCallback
+      : T extends 'beforeLogout'
+      ? TilmeldBeforeLogoutCallback
+      : T extends 'afterLogout'
+      ? TilmeldAfterLogoutCallback
+      : never
+  ) {
+    const prop = (event + 'Callbacks') as T extends 'beforeRegister'
+      ? 'beforeRegisterCallbacks'
+      : T extends 'afterRegister'
+      ? 'afterRegisterCallbacks'
+      : T extends 'beforeLogin'
+      ? 'beforeLoginCallbacks'
+      : T extends 'afterLogin'
+      ? 'afterLoginCallbacks'
+      : T extends 'beforeLogout'
+      ? 'beforeLogoutCallbacks'
+      : T extends 'afterLogout'
+      ? 'afterLogoutCallbacks'
+      : never;
+    if (!(prop in this)) {
+      return false;
+    }
+    // @ts-ignore: The callback should always be the right type here.
+    const i = this[prop].indexOf(callback);
+    if (i > -1) {
+      // @ts-ignore: The callback should always be the right type here.
+      this[prop].splice(i, 1);
+    }
+    return true;
+  }
 }

package/src/conf/d.ts

@@ -1,4 +1,4 @@
-import { EmailOptions } from 'email-templates';
+import { EmailOptions, EmailConfig } from 'email-templates';
 
 import type Tilmeld from '../Tilmeld';
 import Group, { GroupData } from '../Group';
@@ -245,6 +245,18 @@ export interface Config {
    * email sender.
    */
   emailTemplateDir: string;
+  /**
+   * Configure an email object to prepare for sending.
+   *
+   * You can use this, for example, for DKIM signing.
+   *
+   * See: https://github.com/forwardemail/email-templates/blob/v8.0.9/README.md#Options
+   */
+  configEmail: (
+    tilmeld: Tilmeld,
+    options: EmailOptions,
+    user: User & UserData
+  ) => Promise<EmailConfig>;
   /**
    * Send an email to a user. Uses `email-templates` by default.
    *