@nymphjs/tilmeld 1.0.0-alpha.9 → 1.0.0-beta.1

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AAEvB,2CAAyB;AAEzB,8DAAsC;AAC7B,qBADF,oBAAU,CACE;AAEnB,0CAAwB;AACxB,oDAA4B;AACnB,gBADF,eAAK,CACE;AAEd,wDAAgC;AACvB,kBADF,iBAAO,CACE;AAEhB,kDAAgC;AAEhC,wEAAgD;AACvC,0BADF,yBAAe,CACE;AAExB,yCAAuB;AACvB,kDAA0B;AACjB,eADF,cAAI,CACE"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,yCAAuB;AAEvB,2CAAyB;AAEzB,8DAAsC;AAC7B,qBADF,oBAAU,CACE;AAEnB,0CAAwB;AACxB,oDAA4B;AACnB,gBADF,eAAK,CACE;AAEd,wDAAgC;AACvB,kBADF,iBAAO,CACE;AAEhB,kDAAgC;AAEhC,wEAAgD;AACvC,0BADF,yBAAe,CACE;AAExB,yCAAuB;AACvB,kDAA0B;AACjB,eADF,cAAI,CACE"}

package/dist/tilmeldJoiProps.d.ts

@@ -2,11 +2,11 @@ import Joi from 'joi';
 declare const _default: {
     user: Joi.ObjectSchema<any>;
     group: Joi.ObjectSchema<any>;
-    acUser: Joi.NumberSchema;
-    acGroup: Joi.NumberSchema;
-    acOther: Joi.NumberSchema;
-    acRead: Joi.ArraySchema;
-    acWrite: Joi.ArraySchema;
-    acFull: Joi.ArraySchema;
+    acUser: Joi.NumberSchema<number>;
+    acGroup: Joi.NumberSchema<number>;
+    acOther: Joi.NumberSchema<number>;
+    acRead: Joi.ArraySchema<any[]>;
+    acWrite: Joi.ArraySchema<any[]>;
+    acFull: Joi.ArraySchema<any[]>;
 };
 export default _default;

package/jest.config.js

@@ -1,4 +1,4 @@
-/** @type {import('@ts-jest/dist/types').InitialOptionsTsJest} */
+/** @type {import('ts-jest').JestConfigWithTsJest} */
 module.exports = {
   preset: 'ts-jest',
   testEnvironment: 'node',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nymphjs/tilmeld",
-  "version": "1.0.0-alpha.9",
+  "version": "1.0.0-beta.1",
   "description": "NymphJS - Tilmeld User and Group System",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -31,34 +31,32 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@nymphjs/nymph": "^1.0.0-alpha.9",
+    "@nymphjs/guid": "^1.0.0-beta.1",
+    "@nymphjs/nymph": "^1.0.0-beta.1",
     "crypto-js": "^4.1.1",
-    "email-templates": "^8.0.8",
-    "express": "^4.17.1",
-    "joi": "^17.4.2",
+    "email-templates": "^10.0.1",
+    "express": "^4.18.2",
+    "joi": "^17.7.0",
     "jsonwebtoken": "^8.5.1",
-    "locutus": "^2.0.15",
+    "locutus": "^2.0.16",
     "lodash": "^4.17.21",
-    "nanoid": "^3.1.25",
-    "nanoid-dictionary": "^4.3.0",
     "pug": "^3.0.2"
   },
   "devDependencies": {
-    "@nymphjs/client": "^1.0.0-alpha.9",
-    "@nymphjs/client-node": "^1.0.0-alpha.9",
-    "@nymphjs/driver-sqlite3": "^1.0.0-alpha.9",
+    "@nymphjs/client": "^1.0.0-beta.1",
+    "@nymphjs/client-node": "^1.0.0-beta.1",
+    "@nymphjs/driver-sqlite3": "^1.0.0-beta.1",
     "@tsconfig/recommended": "^1.0.1",
-    "@types/crypto-js": "^4.0.2",
-    "@types/email-templates": "^8.0.4",
-    "@types/express": "^4.17.13",
-    "@types/jest": "^27.0.1",
-    "@types/jsonwebtoken": "^8.5.5",
+    "@types/crypto-js": "^4.1.1",
+    "@types/email-templates": "^10.0.1",
+    "@types/express": "^4.17.14",
+    "@types/jest": "^29.2.3",
+    "@types/jsonwebtoken": "^8.5.9",
     "@types/locutus": "^0.0.6",
-    "@types/lodash": "^4.14.172",
-    "@types/nanoid-dictionary": "^4.2.0",
-    "jest": "^27.0.6",
-    "ts-jest": "^27.0.5",
-    "typescript": "^4.3.5"
+    "@types/lodash": "^4.14.189",
+    "jest": "^29.3.1",
+    "ts-jest": "^29.0.3",
+    "typescript": "^4.9.3"
   },
-  "gitHead": "a665338b2e36ae10e48f187879984f359fe963a4"
+  "gitHead": "648d901c504d57f2d439cd751b60af0ebd4d63b8"
 }

package/src/Group.ts

@@ -746,7 +746,7 @@ export default class Group extends AbleObject<GroupData> {
   }
 
   public async $delete() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = this.$nymph.tilmeld as Tilmeld;
     if (!tilmeld.gatekeeper('tilmeld/admin')) {
       throw new BadDataError("You don't have the authority to delete groups.");
     }
@@ -755,6 +755,7 @@ export default class Group extends AbleObject<GroupData> {
     const nymph = this.$nymph;
     const tnymph = await nymph.startTransaction(transaction);
     this.$nymph = tnymph;
+    tilmeld = this.$nymph.tilmeld as Tilmeld;
 
     // Delete descendants.
     const descendants = await this.$getDescendants();

package/src/Tilmeld.ts

@@ -6,7 +6,9 @@ import {
   TilmeldInterface,
   TilmeldAccessLevels,
 } from '@nymphjs/nymph';
+import { URL } from 'url';
 import { Request, Response } from 'express';
+import { xor } from 'lodash';
 
 import { Config, ConfigDefaults as defaults } from './conf';
 import { AccessControlError } from './errors';
@@ -201,7 +203,7 @@ export default class Tilmeld implements TilmeldInterface {
         return;
       }
       // Test for permissions.
-      if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
+      if (!tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
         throw new AccessControlError('No permission to delete.');
       }
     };
@@ -245,15 +247,15 @@ export default class Tilmeld implements TilmeldInterface {
         // allowing a change to ac properties.
 
         const originalAc = entity.$getOriginalAcValues();
-        const newAc = {
-          user: entity.user ?? null,
-          group: entity.group ?? null,
-          acUser: entity.acUser ?? null,
-          acGroup: entity.acGroup ?? null,
-          acOther: entity.acOther ?? null,
-          acRead: entity.acRead ?? null,
-          acWrite: entity.acWrite ?? null,
-          acFull: entity.acFull ?? null,
+        const newAc: AccessControlData = {
+          user: entity.user ?? undefined,
+          group: entity.group ?? undefined,
+          acUser: entity.acUser ?? undefined,
+          acGroup: entity.acGroup ?? undefined,
+          acOther: entity.acOther ?? undefined,
+          acRead: entity.acRead ?? undefined,
+          acWrite: entity.acWrite ?? undefined,
+          acFull: entity.acFull ?? undefined,
         };
 
         const setAcProperties = (acValues: { [k: string]: any }) => {
@@ -269,10 +271,102 @@ export default class Tilmeld implements TilmeldInterface {
 
         // Restore original AC properties and check permissions.
         setAcProperties(originalAc);
-        if (tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)) {
-          // Only allow changes to AC properties if the user has full access.
-          // TODO: only allow changes to `user` and `group` if tilmeld admin or
-          //       group is user's group.
+
+        function areAcPropertiesChanged(
+          a: AccessControlData,
+          b: AccessControlData
+        ) {
+          for (const name of ['user', 'group'] as ('user' | 'group')[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (!aVal.$is(bVal)) {
+              return true;
+            }
+          }
+          for (const name of ['acUser', 'acGroup', 'acOther'] as (
+            | 'acUser'
+            | 'acGroup'
+            | 'acOther'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal !== bVal) {
+              return true;
+            }
+          }
+          for (const name of ['acRead', 'acWrite', 'acFull'] as (
+            | 'acRead'
+            | 'acWrite'
+            | 'acFull'
+          )[]) {
+            const aVal = a[name];
+            const bVal = b[name];
+            if (aVal == null && bVal == null) {
+              continue;
+            } else if (aVal == null || bVal == null) {
+              return true;
+            }
+            if (aVal.length !== bVal.length) {
+              return true;
+            }
+            if (
+              xor(
+                aVal.map((entity) => entity.guid),
+                bVal.map((entity) => entity.guid)
+              ).length
+            ) {
+              return true;
+            }
+          }
+          return false;
+        }
+
+        if (areAcPropertiesChanged(originalAc, newAc)) {
+          if (
+            !tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)
+          ) {
+            // Only allow changes to AC properties if the user has full access.
+            throw new AccessControlError(
+              'No permission to change access control properties.'
+            );
+          }
+
+          if (
+            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
+              (!originalAc.user &&
+                newAc.user &&
+                !newAc.user.$is(tilmeld.currentUser))) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another user.'
+            );
+          }
+
+          if (
+            newAc.group &&
+            !newAc.group.$is(originalAc.group) &&
+            !(
+              newAc.group.$is(tilmeld.currentUser?.group) ||
+              newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
+            ) &&
+            !tilmeld.gatekeeper('tilmeld/admin')
+          ) {
+            throw new AccessControlError(
+              'No permission to assign to another group.'
+            );
+          }
+
           setAcProperties(newAc);
         }
       }
@@ -455,7 +549,7 @@ export default class Tilmeld implements TilmeldInterface {
       return;
     }
 
-    if (user === null) {
+    if (user == null || user.guid == null) {
       selectors.push({
         type: '|',
         // Other access control is sufficient.
@@ -464,7 +558,7 @@ export default class Tilmeld implements TilmeldInterface {
         selector: [
           {
             type: '&',
-            '!defined': ['user', 'group'],
+            '!defined': [['user', 'group']],
           },
         ],
       });
@@ -472,56 +566,43 @@ export default class Tilmeld implements TilmeldInterface {
       const subSelectors: FormattedSelector[] = [
         {
           type: '&',
-          '!defined': ['user', 'group'],
+          '!defined': [['user', 'group']],
         },
         // It is owned by the user.
         {
           type: '&',
-          ref: [['user', user]],
+          ref: [['user', user.guid]],
           gte: [['acUser', TilmeldAccessLevels.READ_ACCESS]],
         },
       ];
-      const selector: FormattedSelector = {
-        type: '|',
-        // Other access control is sufficient.
-        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
-        // The user and group are not set.
-        selector: subSelectors,
-        // The user is listed in acRead, acWrite, or acFull.
-        ref: [
-          ['acRead', user],
-          ['acWrite', user],
-          ['acFull', user],
-        ],
-      };
       const groupRefs: FormattedSelector['ref'] = [];
       const acRefs: FormattedSelector['ref'] = [];
       if (user.group != null && user.group.guid != null) {
         // It belongs to the user's primary group.
-        groupRefs.push(['group', user.group]);
+        groupRefs.push(['group', user.group.guid]);
         // User's primary group is listed in acRead, acWrite, or acFull.
-        acRefs.push(['acRead', user.group]);
-        acRefs.push(['acWrite', user.group]);
-        acRefs.push(['acFull', user.group]);
+        acRefs.push(['acRead', user.group.guid]);
+        acRefs.push(['acWrite', user.group.guid]);
+        acRefs.push(['acFull', user.group.guid]);
       }
       for (let curSecondaryGroup of user.groups ?? []) {
         if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curSecondaryGroup]);
+          groupRefs.push(['group', curSecondaryGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curSecondaryGroup]);
-          acRefs.push(['acWrite', curSecondaryGroup]);
-          acRefs.push(['acFull', curSecondaryGroup]);
+          acRefs.push(['acRead', curSecondaryGroup.guid]);
+          acRefs.push(['acWrite', curSecondaryGroup.guid]);
+          acRefs.push(['acFull', curSecondaryGroup.guid]);
         }
       }
       for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
         if (curDescendantGroup != null && curDescendantGroup.guid != null) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curDescendantGroup]);
+          groupRefs.push(['group', curDescendantGroup.guid]);
           // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curDescendantGroup]);
-          acRefs.push(['acWrite', curDescendantGroup]);
-          acRefs.push(['acFull', curDescendantGroup]);
+          acRefs.push(['acRead', curDescendantGroup.guid]);
+          acRefs.push(['acWrite', curDescendantGroup.guid]);
+          acRefs.push(['acFull', curDescendantGroup.guid]);
         }
       }
       // All the group refs.
@@ -544,6 +625,19 @@ export default class Tilmeld implements TilmeldInterface {
           ref: acRefs,
         });
       }
+      const selector: FormattedSelector = {
+        type: '|',
+        // Other access control is sufficient.
+        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
+        // The user and group are not set.
+        selector: subSelectors,
+        // The user is listed in acRead, acWrite, or acFull.
+        ref: [
+          ['acRead', user.guid],
+          ['acWrite', user.guid],
+          ['acFull', user.guid],
+        ],
+      };
       selectors.push(selector);
     }
   }