@nymphjs/tilmeld 1.0.0-beta.11 → 1.0.0-beta.110

package/dist/User.js

@@ -1,19 +1,145 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const strtotime_1 = __importDefault(require("locutus/php/datetime/strtotime"));
-const enc_base64_1 = __importDefault(require("crypto-js/enc-base64"));
-const sha256_1 = __importDefault(require("crypto-js/sha256"));
-const md5_1 = __importDefault(require("crypto-js/md5"));
-const lodash_1 = require("lodash");
-const guid_1 = require("@nymphjs/guid");
-const AbleObject_1 = __importDefault(require("./AbleObject"));
-const errors_1 = require("./errors");
-class User extends AbleObject_1.default {
-    static async factory(guid) {
-        return (await super.factory(guid));
+import crypto from 'node:crypto';
+import { humanSecret, nanoid } from '@nymphjs/guid';
+import strtotime from 'locutus/php/datetime/strtotime.js';
+import { difference, xor } from 'lodash-es';
+import { TOTP, Secret } from 'otpauth';
+import { toDataURL } from 'qrcode';
+import { splitn } from '@sciactive/splitn';
+import { enforceTilmeld } from './enforceTilmeld.js';
+import AbleObject from './AbleObject.js';
+import GroupClass from './Group.js';
+import { AccessControlError, BadDataError, BadEmailError, BadUsernameError, EmailChangeRateLimitExceededError, } from './errors/index.js';
+/**
+ * A user data model.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@gmail.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
+export default class User extends AbleObject {
+    /**
+     * The instance of Tilmeld to use for queries.
+     */
+    static ETYPE = 'tilmeld_user';
+    static class = 'User';
+    static checkUsernameCallbacks = [];
+    static beforeRegisterCallbacks = [];
+    static afterRegisterCallbacks = [];
+    static beforeSaveCallbacks = [];
+    static afterSaveCallbacks = [];
+    static beforeLoginCallbacks = [];
+    static afterLoginCallbacks = [];
+    static beforeLogoutCallbacks = [];
+    static afterLogoutCallbacks = [];
+    static beforeDeleteCallbacks = [];
+    static afterDeleteCallbacks = [];
+    static DEFAULT_CLIENT_ENABLED_METHODS = [
+        '$checkUsername',
+        '$checkEmail',
+        '$checkPhone',
+        '$getAvatar',
+        '$register',
+    ];
+    static DEFAULT_PRIVATE_DATA = [
+        // The things that are commented are there to show what is _not_ private.
+        'abilities',
+        // 'username',
+        // 'nameFirst',
+        // 'nameMiddle',
+        // 'nameLast',
+        // 'name',
+        'email',
+        // 'avatar',
+        'phone',
+        'group',
+        'groups',
+        'inheritAbilities',
+        'enabled',
+        'secret',
+        'emailChangeDate',
+        'newEmailSecret',
+        'newEmailAddress',
+        'cancelEmailSecret',
+        'cancelEmailAddress',
+        'recoverSecret',
+        'recoverSecretDate',
+        'salt',
+        'password',
+        'passwordTemp',
+        'revokeTokenDate',
+        'totpSecret',
+    ];
+    static DEFAULT_ALLOWLIST_DATA = [];
+    $clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
+    static clientEnabledStaticMethods = [
+        'current',
+        'loginUser',
+        'sendRecovery',
+        'recover',
+        'getClientConfig',
+        'getDomainUsers',
+    ];
+    $privateData = [...User.DEFAULT_PRIVATE_DATA];
+    static searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+    $allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
+    $allowlistTags = [];
+    /**
+     * Gatekeeper ability cache.
+     *
+     * Gatekeeper will cache the user's abilities that it calculates, so it can
+     * check faster if that user has been checked before.
+     */
+    $gatekeeperCache;
+    /**
+     * This should only be used by the backend.
+     */
+    $skipAcWhenSaving = false;
+    /**
+     * This should only be used by the backend.
+     */
+    $skipAcWhenDeleting = false;
+    /**
+     * The user's group descendants.
+     */
+    $descendantGroups;
+    /**
+     * Used to save the current email address to send verification if it changes
+     * from the frontend.
+     *
+     * If you are changing a user's email address and want to bypass email
+     * verification, don't set this.
+     */
+    $originalEmail;
+    /**
+     * Used to save the current username for domain admin permissions.
+     */
+    $originalUsername;
+    static getFTSText(name, value) {
+        if ([
+            'abilities',
+            'group',
+            'groups',
+            'inheritAbilities',
+            'enabled',
+            'secret',
+            'emailChangeDate',
+            'newEmailSecret',
+            'newEmailAddress',
+            'cancelEmailSecret',
+            'cancelEmailAddress',
+            'recoverSecret',
+            'recoverSecretDate',
+            'salt',
+            'password',
+            'passwordTemp',
+            'revokeTokenDate',
+            'totpSecret',
+        ].indexOf(name) !== -1) {
+            return null;
+        }
+        return super.getFTSText(name, value);
     }
     static async factoryUsername(username) {
         const entity = new this();
@@ -30,32 +156,22 @@ class User extends AbleObject_1.default {
         }
         return entity;
     }
-    static factorySync(guid) {
-        return super.factorySync(guid);
-    }
-    constructor(guid) {
-        super(guid);
-        this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
-        this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
-        this.$allowlistTags = [];
-        this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$data.groups = [];
-            this.$data.inheritAbilities = true;
-            this.$updateDataProtection();
-        }
-    }
     static current(returnObjectIfNotExist) {
-        if (this.tilmeld.currentUser == null) {
+        const tilmeld = enforceTilmeld(this);
+        if (tilmeld.currentUser == null) {
             return returnObjectIfNotExist ? this.factorySync() : null;
         }
-        return this.tilmeld.currentUser;
+        return tilmeld.currentUser;
     }
+    /**
+     * Send an account recovery link.
+     *
+     * @param data The input data from the client.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     static async sendRecovery(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = enforceTilmeld(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
@@ -63,9 +179,9 @@ class User extends AbleObject_1.default {
         }
         let user;
         const options = {};
-        if (!this.tilmeld.config.emailUsernames &&
-            data.recoveryType === 'username') {
-            const getUser = await this.nymph.getEntity({ class: this.tilmeld.User, skipAc: true }, {
+        if (!tilmeld.config.emailUsernames && data.recoveryType === 'username') {
+            // Create a username recovery email.
+            const getUser = await this.nymph.getEntity({ class: tilmeld.User, skipAc: true }, {
                 type: '&',
                 ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
             });
@@ -75,6 +191,7 @@ class User extends AbleObject_1.default {
                     message: 'Requested account is not accessible.',
                 };
             }
+            // Send the recovery email.
             user = getUser;
             options.template = 'RecoverUsername';
             options.message = {
@@ -86,18 +203,21 @@ class User extends AbleObject_1.default {
             options.locals = {};
         }
         else if (data.recoveryType === 'password') {
-            const getUser = await this.tilmeld.User.factoryUsername(data.account);
+            // Create a password recovery email.
+            const getUser = await tilmeld.User.factoryUsername(data.account);
             if (getUser.guid == null) {
                 return {
                     result: false,
                     message: 'Requested account is not accessible.',
                 };
             }
-            getUser.recoverSecret = (0, guid_1.humanSecret)();
+            // Create a unique secret.
+            getUser.recoverSecret = humanSecret();
             getUser.recoverSecretDate = Date.now();
             if (!(await getUser.$saveSkipAC())) {
                 return { result: false, message: "Couldn't save recovery secret." };
             }
+            // Send the recovery email.
             user = getUser;
             options.template = 'RecoverPassword';
             options.message = {
@@ -108,13 +228,15 @@ class User extends AbleObject_1.default {
             };
             options.locals = {
                 recoverCode: getUser.recoverSecret,
-                timeLimit: this.tilmeld.config.pwRecoveryTimeLimit,
+                timeLimit: tilmeld.config.pwRecoveryTimeLimit,
             };
         }
         else {
             return { result: false, message: 'Invalid recovery type.' };
         }
-        if (await this.tilmeld.config.sendEmail(this.tilmeld, options, user)) {
+        this.nymph.config.debugLog('tilmeld', `User account recovery (${options.template}) request for "${user.username}".`);
+        // Send the email.
+        if (await tilmeld.config.sendEmail(tilmeld, options, user)) {
             return {
                 result: true,
                 message: "We've sent an email to your registered address. Please " +
@@ -125,18 +247,25 @@ class User extends AbleObject_1.default {
             return { result: false, message: "Couldn't send recovery email." };
         }
     }
+    /**
+     * Recover account details.
+     *
+     * @param data The input data from the client.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     static async recover(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = enforceTilmeld(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
             };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         if (user.guid == null ||
             user.recoverSecret == null ||
             data.secret !== user.recoverSecret ||
-            (0, strtotime_1.default)('+' + this.tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
+            strtotime('+' + tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
                 1000 <
                 Date.now()) {
             return {
@@ -147,6 +276,7 @@ class User extends AbleObject_1.default {
         if (!('password' in data) || !data.password.length) {
             return { result: false, message: 'Password cannot be empty.' };
         }
+        this.nymph.config.debugLog('tilmeld', `User account recovery for "${user.username}".`);
         user.$password(data.password);
         delete user.recoverSecret;
         delete user.recoverSecretDate;
@@ -161,22 +291,25 @@ class User extends AbleObject_1.default {
         }
     }
     static getClientConfig() {
+        const tilmeld = enforceTilmeld(this);
         return {
-            regFields: this.tilmeld.config.regFields,
-            userFields: this.tilmeld.config.userFields,
-            emailUsernames: this.tilmeld.config.emailUsernames,
-            allowRegistration: this.tilmeld.config.allowRegistration,
-            allowUsernameChange: this.tilmeld.config.allowUsernameChange,
-            pwRecovery: this.tilmeld.config.pwRecovery,
-            verifyEmail: this.tilmeld.config.verifyEmail,
-            unverifiedAccess: this.tilmeld.config.unverifiedAccess,
+            regFields: tilmeld.config.regFields,
+            userFields: tilmeld.config.userFields,
+            emailUsernames: tilmeld.config.emailUsernames,
+            domainSupport: tilmeld.config.domainSupport,
+            allowRegistration: tilmeld.config.allowRegistration,
+            allowUsernameChange: tilmeld.config.allowUsernameChange,
+            pwRecovery: tilmeld.config.pwRecovery,
+            verifyEmail: tilmeld.config.verifyEmail,
+            unverifiedAccess: tilmeld.config.unverifiedAccess,
         };
     }
     static async loginUser(data) {
+        const tilmeld = enforceTilmeld(this);
         if (!('username' in data) || !data.username.length) {
             return { result: false, message: 'Incorrect login/password.' };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         const result = await user.$login(data);
         if (result.result) {
             user.$updateDataProtection();
@@ -184,19 +317,115 @@ class User extends AbleObject_1.default {
         }
         return result;
     }
+    /**
+     * Get the users in a domain. This is only accessible to the domain's admins.
+     */
+    static async getDomainUsers(domain, options) {
+        const tilmeld = enforceTilmeld(this);
+        if (!tilmeld.config.domainSupport) {
+            throw new AccessControlError('Domain support is not enabled.');
+        }
+        if (!domain) {
+            throw new BadDataError('Domain is required.');
+        }
+        domain = domain.toLowerCase();
+        if (!tilmeld.config.validDomainRegex.test(domain)) {
+            throw new BadDataError(tilmeld.config.validDomainRegexNotice);
+        }
+        if (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+            throw new AccessControlError('You do not have the authority to manage this domain.');
+        }
+        return await this.nymph.getEntities({
+            class: this.nymph.getEntityClass(User),
+            ...(options?.limit != null
+                ? {
+                    limit: options.limit,
+                }
+                : {}),
+            ...(options?.offset != null
+                ? {
+                    offset: options.offset,
+                }
+                : {}),
+            ...(options?.sort != null
+                ? {
+                    sort: options.sort,
+                }
+                : {}),
+            ...(options?.reverse != null
+                ? {
+                    reverse: options.reverse,
+                }
+                : {}),
+        }, {
+            type: '&',
+            like: ['username', `%@${domain.replace(/([\\%_])/g, (s) => `\\${s}`)}`],
+        });
+    }
+    constructor() {
+        super();
+        // Defaults.
+        this.$data.enabled = true;
+        this.$data.abilities = [];
+        this.$data.groups = [];
+        this.$data.inheritAbilities = true;
+        this.$updateDataProtection();
+    }
+    $setNymph(nymph) {
+        this.$nymph = nymph;
+        if (!this.$asleep()) {
+            if (this.$data.group && this.$data.group.$nymph !== nymph) {
+                this.$data.group.$setNymph(nymph);
+            }
+            for (const group of this.$data.groups ?? []) {
+                if (group && group.$nymph !== nymph) {
+                    group.$setNymph(nymph);
+                }
+            }
+        }
+    }
+    async $getUniques() {
+        const tilmeld = enforceTilmeld(this);
+        const uniques = [`u:${this.$data.username}`];
+        if (!tilmeld.config.emailUsernames &&
+            tilmeld.config.userFields.includes('email')) {
+            uniques.push(`e:${this.$data.email}`);
+            if (this.$data.newEmailAddress != null) {
+                uniques.push(`e:${this.$data.newEmailAddress}`);
+            }
+        }
+        return uniques;
+    }
     async $login(data) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         if (this.guid == null) {
+            await tilmeld.config.failedLoginAttempt(null, data);
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        if (!this.$checkPassword(data.password)) {
+            await tilmeld.config.failedLoginAttempt(this, data);
             return { result: false, message: 'Incorrect login/password.' };
         }
         if (!this.$data.enabled) {
-            return { result: false, message: 'This user is disabled.' };
+            return { result: false, message: 'Your account is disabled.' };
         }
-        if (this.$gatekeeper()) {
+        if (await this.$gatekeeper()) {
             return { result: true, message: 'You are already logged in.' };
         }
-        if (!this.$checkPassword(data.password)) {
-            return { result: false, message: 'Incorrect login/password.' };
+        if (this.$data.totpSecret != null) {
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return {
+                    result: false,
+                    needTOTP: true,
+                    message: 'You need to provide a 2FA code.',
+                };
+            }
+            if (!this.$checkTOTPCode(data.code)) {
+                await tilmeld.config.failedLoginAttempt(this, data);
+                return { result: false, message: 'Incorrect 2FA code.' };
+            }
         }
         try {
             for (let callback of this.constructor
@@ -212,7 +441,67 @@ class User extends AbleObject_1.default {
                 message: e.message,
             };
         }
-        if (!tilmeld.login(this, true)) {
+        this.$nymph.config.debugLog('tilmeld', `User login for "${this.$data.username}".`);
+        // Authentication was successful, attempt to login.
+        if (!(await tilmeld.login(this, true))) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        for (let callback of this.constructor
+            .afterLoginCallbacks) {
+            if (callback) {
+                await callback(this);
+            }
+        }
+        // Login was successful.
+        return { result: true, message: 'You are logged in.' };
+    }
+    async $switchUser(data) {
+        const tilmeld = enforceTilmeld(this);
+        if (this.guid == null) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        let user = tilmeld.User.current();
+        if (!user || user.guid == null) {
+            return { result: false, message: "You're not logged in." };
+        }
+        const isCurrentUser = user != null && user.$is(this);
+        if (isCurrentUser) {
+            return { result: false, message: "You can't switch to yourself." };
+        }
+        const toAbilities = this.$data.abilities || [];
+        const fromAbilities = user.abilities || [];
+        if (!fromAbilities.includes('tilmeld/switch') &&
+            !fromAbilities.includes('system/admin')) {
+            return {
+                result: false,
+                message: "You don't have permission to switch users.",
+            };
+        }
+        if (toAbilities.includes('system/admin') ||
+            toAbilities.includes('tilmeld/admin')) {
+            return { result: false, message: "You can't switch to an admin." };
+        }
+        try {
+            for (let callback of this.constructor
+                .beforeLoginCallbacks) {
+                if (callback) {
+                    await callback(this, {
+                        username: this.$data.username || '',
+                        password: '',
+                        ...(data || {}),
+                    });
+                }
+            }
+        }
+        catch (e) {
+            return {
+                result: false,
+                message: e.message,
+            };
+        }
+        this.$nymph.config.debugLog('tilmeld', `User login switch for "${user.username}" to "${this.$data.username}".`);
+        // Authentication was successful, attempt to login.
+        if (!(await tilmeld.loginSwitch(this, true))) {
             return { result: false, message: 'Incorrect login/password.' };
         }
         for (let callback of this.constructor
@@ -221,10 +510,15 @@ class User extends AbleObject_1.default {
                 await callback(this);
             }
         }
+        // Login was successful.
         return { result: true, message: 'You are logged in.' };
     }
+    /**
+     * Log a user out of the system.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $logout() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         try {
             for (let callback of this.constructor
                 .beforeLogoutCallbacks) {
@@ -239,7 +533,8 @@ class User extends AbleObject_1.default {
                 message: e.message,
             };
         }
-        tilmeld.logout();
+        this.$nymph.config.debugLog('tilmeld', `User logout for "${this.$data.username}".`);
+        await tilmeld.logout();
         for (let callback of this.constructor
             .afterLogoutCallbacks) {
             if (callback) {
@@ -256,66 +551,142 @@ class User extends AbleObject_1.default {
             return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
         }
         return ('https://secure.gravatar.com/avatar/' +
-            (0, md5_1.default)(this.$data.email.trim().toLowerCase()).toString() +
+            crypto
+                .createHash('sha256')
+                .update(this.$data.email.trim().toLowerCase())
+                .digest('hex')
+                .toLowerCase() +
             '?d=identicon&s=40');
     }
+    $getGid() {
+        if (this.$data.group) {
+            return this.$data.group.guid;
+        }
+        return null;
+    }
+    $getGids() {
+        if (this.$data.groups) {
+            return this.$data.groups
+                .map((group) => group.guid)
+                .filter((guid) => guid != null);
+        }
+        return null;
+    }
+    /**
+     * Get the user's group descendants.
+     */
     async $getDescendantGroups() {
         if (this.$descendantGroups == null) {
             this.$descendantGroups = [];
             if (this.$data.group != null) {
+                await this.$data.group.$wake();
                 this.$descendantGroups = await this.$data.group.$getDescendants();
             }
+            await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
             for (let curGroup of this.$data.groups ?? []) {
                 this.$descendantGroups = this.$descendantGroups?.concat(await curGroup.$getDescendants());
             }
         }
         return this.$descendantGroups;
     }
-    $getDescendantGroupsSync() {
-        if (this.$descendantGroups == null) {
-            this.$descendantGroups = [];
-            if (this.$data.group != null) {
-                this.$descendantGroups = this.$data.group.$getDescendantsSync();
-            }
-            for (let curGroup of this.$data.groups ?? []) {
-                this.$descendantGroups = this.$descendantGroups?.concat(curGroup.$getDescendantsSync());
-            }
-        }
-        return this.$descendantGroups;
-    }
     $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if ('abilities' in input.data &&
-            input.data.abilities.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+        const tilmeld = enforceTilmeld(this);
+        this.$check();
+        if ('abilities' in input.data) {
+            this.$checkIncomingAbilities(input.data.abilities);
+        }
+        // If the user is a new domain user, the data protection needs to be updated
+        // before the data is accepted, or else some things won't be accepted
+        // correctly (enabled, passwordTemp).
+        let reloadDataProtection = false;
+        if (tilmeld.config.domainSupport) {
+            let [_username, domain] = splitn(input.data.username ?? '', '@', 2);
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+            }
+            const user = tilmeld.User.current();
+            const isCurrentUser = user != null && user.$is(this);
+            // While loading, accessing abilities on the current user will infinitely
+            // loop, but if this is the current user, we can use its abilities.
+            const abilities = (isCurrentUser || user == null
+                ? this.$data.abilities
+                : user?.abilities) ?? [];
+            const isNewUser = input.guid == null;
+            const isDomainUser = !isCurrentUser &&
+                user != null &&
+                domain &&
+                abilities.includes(`tilmeld/domain/${domain}/admin`);
+            reloadDataProtection = !!(isNewUser && isDomainUser);
         }
-        this.$originalEmail = this.$data.email;
         super.$jsonAcceptData(input, allowConflict);
+        if (reloadDataProtection) {
+            // Load it again after data protection is run.
+            this.$updateDataProtection();
+            super.$jsonAcceptData(input, allowConflict);
+        }
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if ('abilities' in patch.set &&
-            patch.set.abilities.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+        this.$check();
+        if ('abilities' in patch.set) {
+            this.$checkIncomingAbilities(patch.set.abilities);
         }
-        this.$originalEmail = this.$data.email;
         super.$jsonAcceptPatch(patch, allowConflict);
     }
-    $putData(data, sdata) {
-        super.$putData(data, sdata);
+    $checkIncomingAbilities(incoming) {
+        const tilmeld = enforceTilmeld(this);
+        if (!Array.isArray(incoming) ||
+            incoming.find((ability) => typeof ability !== 'string')) {
+            throw new BadDataError('Abilities must be an array of strings.');
+        }
+        if (incoming.includes('system/admin') !==
+            this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if (incoming.includes('tilmeld/admin') !==
+            this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if (incoming.includes('tilmeld/switch') !==
+            this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
+        }
+        if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.$data.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ?? []).length &&
+            (!tilmeld.currentUser ||
+                (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+                    !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
+            throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
+        }
+    }
+    $putData(data, sdata, source) {
+        super.$putData(data, sdata, source);
+        if (source === 'server') {
+            this.$originalEmail = this.$data.email;
+            this.$originalUsername = this.$data.username;
+        }
         this.$updateDataProtection();
     }
+    /**
+     * Update the data protection arrays for a user.
+     *
+     * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+     */
     $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         let user = givenUser ?? tilmeld.User.current();
+        let [_username, domain] = tilmeld.config.domainSupport
+            ? splitn(this.$originalUsername ?? this.$data.username ?? '', '@', 2)
+            : [this.$originalUsername ?? this.$data.username, null];
+        // Lowercase the domain part.
+        if (domain) {
+            domain = domain.toLowerCase();
+        }
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
         this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
@@ -323,75 +694,211 @@ class User extends AbleObject_1.default {
             this.$privateData.push('username');
         }
         const isCurrentUser = user != null && user.$is(this);
+        // While loading, accessing abilities on the current user will infinitely
+        // loop, but if this is the current user, we can use its abilities.
         const abilities = (isCurrentUser || user == null
             ? this.$data.abilities
             : user?.abilities) ?? [];
         const isNewUser = this.guid == null;
+        const isDomainUser = tilmeld.config.domainSupport &&
+            !isCurrentUser &&
+            user != null &&
+            domain &&
+            abilities.includes(`tilmeld/domain/${domain}/admin`);
         if (isCurrentUser) {
+            // Users can check to see what abilities they have.
             this.$clientEnabledMethods.push('$gatekeeper');
             this.$clientEnabledMethods.push('$changePassword');
+            this.$clientEnabledMethods.push('$revokeCurrentTokens');
             this.$clientEnabledMethods.push('$logout');
             this.$clientEnabledMethods.push('$sendEmailVerification');
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$getNewTOTPSecret');
+            this.$clientEnabledMethods.push('$saveTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
+        }
+        if (isDomainUser) {
+            // Domain admins can check to see what abilities their users have.
+            this.$clientEnabledMethods.push('$gatekeeper');
+            this.$clientEnabledMethods.push('$changePassword');
+            this.$clientEnabledMethods.push('$revokeCurrentTokens');
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$getNewTOTPSecret');
+            this.$clientEnabledMethods.push('$saveTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
         }
         if (user != null &&
-            (abilities.indexOf('tilmeld/admin') !== -1 ||
-                abilities.indexOf('system/admin') !== -1)) {
-            this.$privateData = ['password', 'salt'];
+            (abilities.includes('tilmeld/admin') ||
+                abilities.includes('system/admin'))) {
+            // Users who can edit other users can see most of their data.
+            this.$privateData = ['password', 'salt', 'totpSecret'];
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
             this.$allowlistData = undefined;
         }
-        else if (isCurrentUser || isNewUser) {
+        else if (isDomainUser) {
+            // Domain admins can see their users' data, and edit some of it.
             if (tilmeld.config.allowUsernameChange || isNewUser) {
                 this.$allowlistData.push('username');
             }
             this.$allowlistData.push('avatar');
-            if (tilmeld.config.userFields.indexOf('name') !== -1) {
+            if (tilmeld.config.userFields.includes('name')) {
                 this.$allowlistData.push('nameFirst');
                 this.$allowlistData.push('nameMiddle');
                 this.$allowlistData.push('nameLast');
                 this.$allowlistData.push('name');
             }
-            if (tilmeld.config.userFields.indexOf('email') !== -1) {
+            if (tilmeld.config.userFields.includes('email')) {
                 this.$allowlistData.push('email');
             }
-            if (tilmeld.config.userFields.indexOf('phone') !== -1) {
+            if (tilmeld.config.userFields.includes('phone')) {
                 this.$allowlistData.push('phone');
             }
+            this.$allowlistData.push('enabled');
+            this.$allowlistData.push('passwordTemp');
             this.$privateData = [
+                // The things commented are there to show what is _not_ private.
+                // 'abilities',
+                // 'username',
+                // 'nameFirst',
+                // 'nameMiddle',
+                // 'nameLast',
+                // 'name',
+                // 'email',
+                // 'avatar',
+                // 'phone',
+                // 'group',
+                // 'groups',
+                // 'inheritAbilities',
+                // 'enabled',
                 'secret',
+                'emailChangeDate',
                 'newEmailSecret',
-                'cancelEmailAddress',
+                // 'newEmailAddress',
                 'cancelEmailSecret',
-                'emailChangeDate',
+                'cancelEmailAddress',
                 'recoverSecret',
                 'recoverSecretDate',
+                'salt',
                 'password',
+                // 'passwordTemp',
+                // 'revokeTokenDate',
+                'totpSecret',
+            ];
+        }
+        else if (isCurrentUser || isNewUser) {
+            // Users can see their own data, and edit some of it.
+            if (tilmeld.config.allowUsernameChange || isNewUser) {
+                this.$allowlistData.push('username');
+            }
+            this.$allowlistData.push('avatar');
+            if (tilmeld.config.userFields.includes('name')) {
+                this.$allowlistData.push('nameFirst');
+                this.$allowlistData.push('nameMiddle');
+                this.$allowlistData.push('nameLast');
+                this.$allowlistData.push('name');
+            }
+            if (tilmeld.config.userFields.includes('email')) {
+                this.$allowlistData.push('email');
+            }
+            if (tilmeld.config.userFields.includes('phone')) {
+                this.$allowlistData.push('phone');
+            }
+            this.$privateData = [
+                // The things commented are there to show what is _not_ private.
+                // 'abilities',
+                // 'username',
+                // 'nameFirst',
+                // 'nameMiddle',
+                // 'nameLast',
+                // 'name',
+                // 'email',
+                // 'avatar',
+                // 'phone',
+                // 'group',
+                // 'groups',
+                // 'inheritAbilities',
+                'enabled',
+                'secret',
+                'emailChangeDate',
+                'newEmailSecret',
+                // 'newEmailAddress',
+                'cancelEmailSecret',
+                'cancelEmailAddress',
+                'recoverSecret',
+                'recoverSecretDate',
                 'salt',
+                'password',
+                'passwordTemp',
+                // 'revokeTokenDate',
+                'totpSecret',
             ];
         }
+        if (user != null &&
+            !isCurrentUser &&
+            (abilities.includes('tilmeld/switch') ||
+                abilities.includes('system/admin'))) {
+            // Users with this ability can switch to other users.
+            this.$clientEnabledMethods.push('$switchUser');
+        }
+    }
+    $updateGroupDataProtection() {
+        if (this.$data.group != null && !this.$data.group.$asleep()) {
+            this.$data.group.$updateDataProtection();
+        }
+        for (let group of this.$data.groups ?? []) {
+            if (!group.$asleep()) {
+                group.$updateDataProtection();
+            }
+        }
     }
-    $gatekeeper(ability) {
-        const tilmeld = this.$nymph.tilmeld;
+    /**
+     * Check to see if a user has an ability.
+     *
+     * This function will check both user and group abilities, if the user is
+     * marked to inherit the abilities of its group.
+     *
+     * If `ability` is undefined, it will check to see if the user is currently
+     * logged in.
+     *
+     * If the user has the "system/admin" ability, this function will return true.
+     *
+     * @param ability The ability.
+     * @returns True or false.
+     */
+    async $gatekeeper(ability) {
+        await this.$wake();
+        const tilmeld = enforceTilmeld(this);
         if (ability == null) {
             return tilmeld.User.current()?.$is(this) ?? false;
         }
+        // Check the cache to see if we've already checked this user.
         if (this.$gatekeeperCache == null) {
-            let abilities = this.$data.abilities ?? [];
-            if (this.$data.inheritAbilities) {
-                for (let curGroup of this.$data.groups ?? []) {
-                    if (curGroup.enabled) {
-                        abilities = abilities.concat(curGroup.abilities ?? []);
-                    }
-                }
-                if (this.$data.group != null &&
-                    this.$data.group.cdate != null &&
-                    this.$data.group.enabled) {
-                    abilities = abilities.concat(this.$data.group.abilities ?? []);
+            this.$gatekeeperCache = await this.$getGatekeeperCache();
+        }
+        return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
+            !!this.$data.abilities?.includes('system/admin'));
+    }
+    /**
+     * Build a gatekeeper cache object.
+     */
+    async $getGatekeeperCache() {
+        await this.$wake();
+        let abilities = this.$data.abilities ?? [];
+        if (this.$data.inheritAbilities) {
+            await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+            for (let curGroup of this.$data.groups ?? []) {
+                if (curGroup.enabled) {
+                    abilities = abilities.concat(curGroup.abilities ?? []);
                 }
             }
-            this.$gatekeeperCache = Object.fromEntries(abilities.map((ability) => [ability, true]));
+            await this.$data.group?.$wake();
+            const group = this.$data.group;
+            if (group != null && group.cdate != null && group.enabled) {
+                abilities = abilities.concat(group.abilities ?? []);
+            }
         }
-        return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-            !!this.$gatekeeperCache['system/admin']);
+        return Object.fromEntries(abilities.map((ability) => [ability, true]));
     }
     $clearCache() {
         const ret = super.$clearCache();
@@ -399,8 +906,13 @@ class User extends AbleObject_1.default {
         this.$gatekeeperCache = undefined;
         return ret;
     }
+    /**
+     * Send the user email verification/change/cancellation links.
+     *
+     * @returns True on success, false on failure.
+     */
     async $sendEmailVerification() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         if (this.guid == null) {
             return false;
         }
@@ -463,33 +975,60 @@ class User extends AbleObject_1.default {
         }
         return success;
     }
-    $addGroup(group) {
-        if (this.$data.groups == null) {
-            this.$data.groups = [];
-        }
-        if (!group.$inArray(this.$data.groups)) {
-            this.$data.groups.push(group);
-            return this.$data.groups;
+    /**
+     * Add the user to a (secondary) group.
+     *
+     * @param group The group.
+     * @returns True if the user is already in the group. The resulting array of groups if the user was not.
+     */
+    async $addGroup(group) {
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+        let groups = this.$data.groups;
+        if (groups == null) {
+            groups = [];
+        }
+        if (!group.$inArray(groups)) {
+            groups.push(group);
+            this.$data.groups = groups;
+            return groups;
         }
         return true;
     }
+    /**
+     * Check the given password against the user's.
+     *
+     * @param password The password in question.
+     * @returns True if the passwords match, otherwise false.
+     */
     $checkPassword(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 return this.$data.password === password;
             case 'digest':
-                return this.$data.password === (0, sha256_1.default)(password).toString(enc_base64_1.default);
+                return (this.$data.password ===
+                    crypto.createHash('sha256').update(password).digest('base64'));
             case 'salt':
             default:
                 return (this.$data.password ===
-                    (0, sha256_1.default)(password + this.$data.salt).toString(enc_base64_1.default));
+                    crypto
+                        .createHash('sha256')
+                        .update(password + this.$data.salt)
+                        .digest('base64'));
         }
     }
-    $delGroup(group) {
-        if (this.$data.groups != null && group.$inArray(this.$data.groups)) {
+    /**
+     * Remove the user from a (secondary) group.
+     *
+     * @param group The group.
+     * @returns True if the user wasn't in the group. The resulting array of groups if the user was.
+     */
+    async $delGroup(group) {
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+        let groups = this.$data.groups || [];
+        if (this.$data.groups != null && group.$inArray(groups)) {
             const newGroups = [];
-            for (let curGroup of this.$data.groups) {
+            for (let curGroup of groups) {
                 if (!group.$is(curGroup)) {
                     newGroups.push(curGroup);
                 }
@@ -499,7 +1038,13 @@ class User extends AbleObject_1.default {
         }
         return true;
     }
-    $inGroup(group) {
+    /**
+     * Check whether the user is in a (primary or secondary) group.
+     *
+     * @param group The group, or the group's GUID.
+     * @returns True or false.
+     */
+    async $inGroup(group) {
         if (typeof group === 'string') {
             if (this.$data.group?.guid === group) {
                 return true;
@@ -513,35 +1058,66 @@ class User extends AbleObject_1.default {
         }
         return (group.$is(this.$data.group) || group.$inArray(this.$data.groups ?? []));
     }
-    $isDescendant(group) {
-        if (this.$data.group?.cdate != null &&
-            this.$data.group.$isDescendant(group)) {
+    /**
+     * Check whether the user is a descendant of a group.
+     *
+     * @param group The group, or the group's GUID.
+     * @returns True or false.
+     */
+    async $isDescendant(group) {
+        // Check to see if the user is in a descendant group of the given group.
+        await this.$data.group?.$wake();
+        if (this.$data.group != null &&
+            this.$data.group?.cdate != null &&
+            (await this.$data.group?.$isDescendant(group))) {
             return true;
         }
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
         for (let curGroup of this.$data.groups ?? []) {
-            if (curGroup.$isDescendant(group)) {
+            if (await curGroup.$isDescendant(group)) {
                 return true;
             }
         }
         return false;
     }
+    /**
+     * A frontend accessible method to change the user's password.
+     *
+     * @param data The input data from the client.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $changePassword(data) {
+        this.$nymph.config.debugLog('tilmeld', `Password change request for "${this.$data.username}".`);
         if (!('newPassword' in data) || !data.newPassword.length) {
             return { result: false, message: 'Please specify a password.' };
         }
         if (!this.$checkPassword(data.currentPassword ?? '')) {
+            this.$nymph.config.debugLog('tilmeld', `Incorrect password for change request for "${this.$data.username}".`);
             return { result: false, message: 'Incorrect password.' };
         }
         this.$data.passwordTemp = data.newPassword;
+        if (data.revokeCurrentTokens) {
+            this.$data.revokeTokenDate = Date.now();
+        }
         if (await this.$save()) {
+            if (data.revokeCurrentTokens) {
+                const tilmeld = enforceTilmeld(this);
+                await tilmeld.login(this, true);
+            }
             return { result: true, message: 'Your password has been changed.' };
         }
         else {
             return { result: false, message: "Couldn't save new password." };
         }
     }
+    /**
+     * Change the user's password.
+     *
+     * @param password The new password.
+     * @returns The resulting password or hash which is stored in the entity.
+     */
     $password(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 delete this.$data.salt;
@@ -549,24 +1125,221 @@ class User extends AbleObject_1.default {
                 break;
             case 'digest':
                 delete this.$data.salt;
-                this.$data.password = (0, sha256_1.default)(password).toString(enc_base64_1.default);
+                this.$data.password = crypto
+                    .createHash('sha256')
+                    .update(password)
+                    .digest('base64');
                 break;
             case 'salt':
             default:
-                this.$data.salt = (0, guid_1.nanoid)();
-                this.$data.password = (0, sha256_1.default)(password + this.$data.salt).toString(enc_base64_1.default);
+                this.$data.salt = nanoid();
+                this.$data.password = crypto
+                    .createHash('sha256')
+                    .update(password + this.$data.salt)
+                    .digest('base64');
                 break;
         }
         return this.$data.password;
     }
+    /**
+     * A frontend accessible method to revoke all currently issued tokens.
+     *
+     * @param data The input data from the client.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
+    async $revokeCurrentTokens(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        this.$data.revokeTokenDate = Date.now();
+        if (await this.$save()) {
+            const tilmeld = enforceTilmeld(this);
+            await tilmeld.login(this, true);
+            return {
+                result: true,
+                message: 'You have logged out of all other sessions.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't save revocation date." };
+        }
+    }
+    async $hasTOTPSecret() {
+        return this.$data.totpSecret != null;
+    }
+    /**
+     * Check the given code against the user's TOTP secret.
+     *
+     * @param code The code in question.
+     * @returns True if the code is valid, otherwise false.
+     */
+    $checkTOTPCode(code) {
+        if (this.$data.totpSecret == null) {
+            return false;
+        }
+        const tilmeld = enforceTilmeld(this);
+        const totp = new TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: this.$data.totpSecret,
+        });
+        return totp.validate({ token: code, window: 2 }) != null;
+    }
+    /**
+     * A frontend accessible method to generate a new TOTP secret.
+     *
+     * @returns An object with 'uri', 'qrcode', and 'secret'.
+     */
+    async $getNewTOTPSecret() {
+        const tilmeld = enforceTilmeld(this);
+        if (this.$data.totpSecret != null) {
+            throw new BadDataError('You already have a 2FA secret.');
+        }
+        const secret = new Secret();
+        const totp = new TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret,
+        });
+        const uri = totp.toString();
+        const qrcode = await toDataURL(uri);
+        return {
+            uri,
+            qrcode,
+            secret: secret.base32,
+        };
+    }
+    /**
+     * A frontend accessible method to save a TOTP secret into the user's account.
+     *
+     * @param data The input data from the client.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
+    async $saveTOTPSecret(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        if (this.$data.totpSecret != null) {
+            return { result: false, message: 'You already have a 2FA secret.' };
+        }
+        if (data.secret == null ||
+            typeof data.secret !== 'string' ||
+            data.secret === '') {
+            return { result: false, message: '2FA secret is invalid.' };
+        }
+        if (data.code == null ||
+            typeof data.code !== 'string' ||
+            data.code.length !== 6) {
+            return { result: false, message: '2FA code is invalid.' };
+        }
+        const tilmeld = enforceTilmeld(this);
+        const totp = new TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: data.secret,
+        });
+        if (totp.validate({ token: data.code, window: 2 }) == null) {
+            return { result: false, message: '2FA code is incorrect.' };
+        }
+        this.$data.totpSecret = data.secret;
+        if (await this.$save()) {
+            return { result: true, message: 'Your two factor secret is now set.' };
+        }
+        else {
+            return { result: false, message: "Couldn't save two factor secret." };
+        }
+    }
+    /**
+     * A frontend accessible method to remove the TOTP secret from the user's
+     * account.
+     *
+     * @param data The input data from the client.
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
+    async $removeTOTPSecret(data) {
+        const tilmeld = enforceTilmeld(this);
+        if (data) {
+            if (!this.$checkPassword(data.password ?? '')) {
+                return { result: false, message: 'Incorrect password.' };
+            }
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return { result: false, message: '2FA code is invalid.' };
+            }
+            if (this.$data.totpSecret == null) {
+                return { result: false, message: "You don't have a 2FA secret." };
+            }
+            const totp = new TOTP({
+                issuer: tilmeld.config.appName,
+                label: this.$data.username,
+                algorithm: 'SHA1',
+                digits: 6,
+                period: 30,
+                secret: this.$data.totpSecret,
+            });
+            if (totp.validate({ token: data.code, window: 2 }) == null) {
+                return { result: false, message: '2FA code is incorrect.' };
+            }
+        }
+        else if (!tilmeld.gatekeeper('tilmeld/admin')) {
+            return {
+                result: false,
+                message: 'You must provide your password and 2FA code.',
+            };
+        }
+        delete this.$data.totpSecret;
+        if (await this.$save()) {
+            return {
+                result: true,
+                message: 'Two factor secret has been removed.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't remove two factor secret." };
+        }
+    }
+    /**
+     * Check that a username is valid.
+     *
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $checkUsername() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
+        this.$nymph.config.debugInfo('tilmeld', `Username check "${this.$data.username}".`);
         if (!tilmeld.config.emailUsernames) {
-            if (this.$data.username == null || !this.$data.username.length) {
+            let [username, domain] = tilmeld.config.domainSupport
+                ? splitn(this.$data.username ?? '', '@', 2)
+                : [this.$data.username, null];
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+                this.$data.username = `${username}@${domain}`;
+            }
+            if (this.$data.username == null ||
+                !this.$data.username.length ||
+                username == null ||
+                !username.length) {
                 return { result: false, message: 'Please specify a username.' };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.username.length > tilmeld.config.maxUsernameLength) {
+            if (username.length < tilmeld.config.minUsernameLength) {
+                return {
+                    result: false,
+                    message: 'Usernames must be at least ' +
+                        tilmeld.config.minUsernameLength +
+                        ' characters.',
+                };
+            }
+            if (username.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Usernames must not exceed ' +
@@ -574,18 +1347,35 @@ class User extends AbleObject_1.default {
                         ' characters.',
                 };
             }
-            if ((0, lodash_1.difference)(this.$data.username.split(''), tilmeld.config.validChars.split('')).length) {
+            if (difference(username.split(''), tilmeld.config.validChars.split(''))
+                .length) {
                 return {
                     result: false,
                     message: tilmeld.config.validCharsNotice,
                 };
             }
-            if (!tilmeld.config.validRegex.test(this.$data.username)) {
+            if (!tilmeld.config.validRegex.test(username)) {
                 return {
                     result: false,
                     message: tilmeld.config.validRegexNotice,
                 };
             }
+            if (domain != null) {
+                if (!tilmeld.config.validDomainRegex.test(domain)) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validDomainRegexNotice,
+                    };
+                }
+                if (!this.$skipAcWhenSaving &&
+                    !this.$is(tilmeld.currentUser) &&
+                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                    return {
+                        result: false,
+                        message: "You don't have the authority to manage users on this domain.",
+                    };
+                }
+            }
             const selector = {
                 type: '&',
                 ilike: [
@@ -600,6 +1390,17 @@ class User extends AbleObject_1.default {
             if (test != null) {
                 return { result: false, message: 'That username is taken.' };
             }
+            for (let callback of this.constructor
+                .checkUsernameCallbacks) {
+                if (callback) {
+                    const result = await callback(this, {
+                        username: this.$data.username,
+                    });
+                    if (!result.result) {
+                        return { message: 'Username is not available.', ...result };
+                    }
+                }
+            }
             return {
                 result: true,
                 message: this.guid != null ? 'Username is valid.' : 'Username is available!',
@@ -610,8 +1411,15 @@ class User extends AbleObject_1.default {
             if (this.$data.username == null || !this.$data.username.length) {
                 return { result: false, message: 'Please specify an email.' };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.username.length > tilmeld.config.maxUsernameLength) {
+            if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+                return {
+                    result: false,
+                    message: 'Emails must be at least ' +
+                        tilmeld.config.minUsernameLength +
+                        ' characters.',
+                };
+            }
+            if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Emails must not exceed ' +
@@ -622,8 +1430,14 @@ class User extends AbleObject_1.default {
             return await this.$checkEmail();
         }
     }
+    /**
+     * Check that an email is unique.
+     *
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
+        this.$nymph.config.debugInfo('tilmeld', `Email check "${this.$data.email}".`);
         if (this.$data.email == null || !this.$data.email.length) {
             if (tilmeld.config.verifyEmail) {
                 return { result: false, message: 'Please specify an email.' };
@@ -657,8 +1471,14 @@ class User extends AbleObject_1.default {
             message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
         };
     }
+    /**
+     * Check that a phone number is unique.
+     *
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $checkPhone() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
+        this.$nymph.config.debugInfo('tilmeld', `Phone check "${this.$data.phone}".`);
         if (this.$data.phone == null || !this.$data.phone.length) {
             return { result: false, message: 'Please specify a phone number.' };
         }
@@ -686,7 +1506,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $register(data) {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = enforceTilmeld(this);
         if (!tilmeld.config.allowRegistration) {
             return {
                 result: false,
@@ -701,21 +1521,6 @@ class User extends AbleObject_1.default {
                 message: 'This is already a registered user.',
             };
         }
-        try {
-            for (let callback of this.constructor
-                .beforeRegisterCallbacks) {
-                if (callback) {
-                    await callback(this, data);
-                }
-            }
-        }
-        catch (e) {
-            return {
-                result: false,
-                loggedin: false,
-                message: e.message,
-            };
-        }
         if (!('password' in data) || !data.password.length) {
             return {
                 result: false,
@@ -728,7 +1533,7 @@ class User extends AbleObject_1.default {
             return { ...unCheck, loggedin: false };
         }
         this.$password(data.password);
-        if (tilmeld.config.regFields.indexOf('name') !== -1) {
+        if (tilmeld.config.regFields.includes('name')) {
             this.$data.name =
                 this.$data.nameFirst +
                     (this.$data.nameMiddle == null ? '' : ' ' + this.$data.nameMiddle) +
@@ -740,59 +1545,35 @@ class User extends AbleObject_1.default {
         if (tilmeld.config.emailUsernames) {
             this.$data.email = this.$data.username;
         }
-        const transaction = 'tilmeld-register-' + (0, guid_1.nanoid)();
+        // Start transaction.
+        const transaction = 'tilmeld-register-' + nanoid();
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
-        this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
+        this.$setNymph(tnymph);
+        tilmeld = enforceTilmeld(this);
+        let message = '';
+        let loggedin = false;
         try {
-            let generatedPrimaryGroup = null;
-            if (tilmeld.config.generatePrimary) {
-                generatedPrimaryGroup = await tilmeld.Group.factory();
-                generatedPrimaryGroup.groupname = this.$data.username;
-                generatedPrimaryGroup.avatar = this.$data.avatar;
-                generatedPrimaryGroup.name = this.$data.name;
-                generatedPrimaryGroup.email = this.$data.email;
-                const parent = await tnymph.getEntity({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['defaultPrimary', true],
-                });
-                if (parent != null) {
-                    generatedPrimaryGroup.parent = parent;
-                }
-                if (!(await generatedPrimaryGroup.$saveSkipAC())) {
-                    await tnymph.rollback(transaction);
-                    this.$nymph = nymph;
-                    return {
-                        result: false,
-                        loggedin: false,
-                        message: 'Error creating primary group for user.',
-                    };
-                }
-                this.$data.group = generatedPrimaryGroup;
-            }
-            else {
-                const group = await tnymph.getEntity({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['defaultPrimary', true],
-                });
-                if (group != null) {
-                    this.$data.group = group;
+            try {
+                for (let callback of this.constructor
+                    .beforeRegisterCallbacks) {
+                    if (callback) {
+                        await callback(this, data);
+                    }
                 }
             }
-            if (tilmeld.config.verifyEmail && tilmeld.config.unverifiedAccess) {
-                this.$data.groups = await tnymph.getEntities({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['unverifiedSecondary', true],
-                });
-            }
-            else {
-                this.$data.groups = await tnymph.getEntities({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['defaultSecondary', true],
-                });
+            catch (e) {
+                await tnymph.rollback(transaction);
+                this.$setNymph(nymph);
+                return {
+                    result: false,
+                    loggedin: false,
+                    message: e.message,
+                };
             }
-            if (tilmeld.config.verifyEmail) {
+            if (tilmeld.config.userFields.includes('email') &&
+                tilmeld.config.verifyEmail) {
+                // The user will be enabled after verifying their e-mail address.
                 if (!tilmeld.config.unverifiedAccess) {
                     this.$data.enabled = false;
                 }
@@ -800,6 +1581,8 @@ class User extends AbleObject_1.default {
             else {
                 this.$data.enabled = true;
             }
+            // If createAdmin is true and there are no other users, grant
+            // "system/admin".
             let madeAdmin = false;
             if (tilmeld.config.createAdmin) {
                 const otherUsers = await tnymph.getEntities({
@@ -808,13 +1591,26 @@ class User extends AbleObject_1.default {
                     limit: 1,
                     return: 'guid',
                 });
+                // Make sure it's not just null, cause that means an error.
+                if (otherUsers == null) {
+                    await tnymph.rollback(transaction);
+                    this.$setNymph(nymph);
+                    return {
+                        result: false,
+                        loggedin: false,
+                        message: 'An error occurred.',
+                    };
+                }
                 if (!otherUsers.length) {
                     this.$grant('system/admin');
                     this.$data.enabled = true;
                     madeAdmin = true;
                 }
             }
+            this.$nymph.config.debugLog('tilmeld', `Registering new user "${this.$data.username}".`);
             if (await this.$saveSkipAC()) {
+                this.$nymph.config.debugLog('tilmeld', `New user registered "${this.$data.username}".`);
+                // Send the new user registered email.
                 if (tilmeld.config.userRegisteredRecipient != null) {
                     await tilmeld.config.sendEmail(tilmeld, {
                         template: 'UserRegistered',
@@ -831,31 +1627,20 @@ class User extends AbleObject_1.default {
                         },
                     }, this);
                 }
-                let message = '';
-                let loggedin = false;
-                if (generatedPrimaryGroup != null) {
-                    generatedPrimaryGroup.user = this;
-                    if (!(await generatedPrimaryGroup.$saveSkipAC())) {
-                        await tnymph.rollback(transaction);
-                        this.$nymph = nymph;
-                        return {
-                            result: false,
-                            loggedin: false,
-                            message: 'Your primary group could not be assigned. Please try again later.',
-                        };
-                    }
-                }
+                // Finish up.
                 if (tilmeld.config.verifyEmail &&
                     !tilmeld.config.unverifiedAccess &&
-                    !madeAdmin) {
+                    !madeAdmin &&
+                    tilmeld.config.userFields.includes('email')) {
                     message +=
                         `Almost there. An email has been sent to ${this.$data.email} ` +
                             'with a verification link for you to finish registration.';
                 }
                 else if (tilmeld.config.verifyEmail &&
                     tilmeld.config.unverifiedAccess &&
-                    !madeAdmin) {
-                    if (!tilmeld.login(this, true)) {
+                    !madeAdmin &&
+                    tilmeld.config.userFields.includes('email')) {
+                    if (!(await tilmeld.login(this, true))) {
                         throw new Error('An error occurred trying to log you in.');
                     }
                     message +=
@@ -865,7 +1650,7 @@ class User extends AbleObject_1.default {
                     loggedin = true;
                 }
                 else {
-                    if (!tilmeld.login(this, true)) {
+                    if (!(await tilmeld.login(this, true))) {
                         throw new Error('An error occurred trying to log you in.');
                     }
                     message += "You're now registered and logged in!";
@@ -880,23 +1665,11 @@ class User extends AbleObject_1.default {
                         });
                     }
                 }
-                try {
-                    await tnymph.commit(transaction);
-                    this.$nymph = nymph;
-                    this.$nymph.tilmeld?.fillSession(this);
-                }
-                catch (e) {
-                    throw e;
-                }
-                return {
-                    result: true,
-                    loggedin,
-                    message,
-                };
             }
             else {
+                this.$nymph.config.debugError('tilmeld', `Error registering new user "${this.$data.username}".`);
                 await tnymph.rollback(transaction);
-                this.$nymph = nymph;
+                this.$setNymph(nymph);
                 return {
                     result: false,
                     loggedin: false,
@@ -905,22 +1678,69 @@ class User extends AbleObject_1.default {
             }
         }
         catch (e) {
+            this.$nymph.config.debugError('tilmeld', `Error registering new user "${this.$data.username}": ${e}`);
             await tnymph.rollback(transaction);
-            this.$nymph = nymph;
+            this.$setNymph(nymph);
+            throw e;
+        }
+        try {
+            await tnymph.commit(transaction);
+            this.$setNymph(nymph);
+            await this.$nymph.tilmeld?.fillSession(this);
+        }
+        catch (e) {
             throw e;
         }
+        return {
+            result: true,
+            loggedin,
+            message,
+        };
     }
     async $save() {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = enforceTilmeld(this);
         if (this.$data.username == null || !this.$data.username.trim().length) {
             return false;
         }
-        if (tilmeld.gatekeeper('tilmeld/admin') &&
+        if (!this.$skipAcWhenSaving &&
+            tilmeld.gatekeeper('tilmeld/admin') &&
             !tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to modify system admins.");
+            this.$data.abilities?.includes('system/admin')) {
+            throw new AccessControlError("You don't have the authority to modify system admins.");
+        }
+        // Lowercase the domain part.
+        if (tilmeld.config.domainSupport) {
+            const [username, domain] = splitn(this.$data.username ?? '', '@', 2);
+            if (domain) {
+                this.$data.username = `${username}@${domain.toLowerCase()}`;
+            }
+        }
+        if (tilmeld.config.domainSupport) {
+            const [_username, domain] = splitn(this.$data.username ?? '', '@', 2);
+            const [_originalUsername, originalDomain] = splitn(this.$originalUsername ?? '', '@', 2);
+            if (this.guid != null &&
+                ((originalDomain == null && domain != null) ||
+                    (domain == null && originalDomain != null))) {
+                throw new AccessControlError("Users can't switch to or from having a domain once created.");
+            }
+            if (!this.$skipAcWhenSaving &&
+                !tilmeld.gatekeeper('tilmeld/admin') &&
+                !tilmeld.gatekeeper('system/admin')) {
+                if (domain != null &&
+                    !this.$is(tilmeld.currentUser) &&
+                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                    throw new AccessControlError("You don't have the authority to modify users on this domain.");
+                }
+                if (originalDomain != null &&
+                    originalDomain !== domain &&
+                    (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+                        !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
+                    throw new AccessControlError("You don't have the authority to modify users on this domain.");
+                }
+            }
         }
         let sendVerification = false;
+        // Formatting.
         this.$data.username = this.$data.username.trim();
         if (tilmeld.config.emailUsernames) {
             this.$data.email = this.$data.username;
@@ -934,49 +1754,63 @@ class User extends AbleObject_1.default {
                 (this.$data.nameMiddle ? ' ' + this.$data.nameMiddle : '') +
                 (this.$data.nameLast ? ' ' + this.$data.nameLast : '');
         this.$data.enabled = !!this.$data.enabled;
-        if (this.$data.nameFirst === '') {
+        // Clear empty values.
+        if (this.$data.nameFirst === '' ||
+            !tilmeld.config.userFields.includes('name')) {
             delete this.$data.nameFirst;
         }
-        if (this.$data.nameMiddle === '') {
+        if (this.$data.nameMiddle === '' ||
+            !tilmeld.config.userFields.includes('name')) {
             delete this.$data.nameMiddle;
         }
-        if (this.$data.nameLast === '') {
+        if (this.$data.nameLast === '' ||
+            !tilmeld.config.userFields.includes('name')) {
             delete this.$data.nameLast;
         }
-        if (this.$data.name === '') {
+        if (this.$data.name === '' || !tilmeld.config.userFields.includes('name')) {
             delete this.$data.name;
         }
-        if (this.$data.email === '') {
+        if (this.$data.email === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.email;
         }
         if (this.$data.avatar === '') {
             delete this.$data.avatar;
         }
-        if (this.$data.phone === '') {
+        if (this.$data.phone === '' ||
+            !tilmeld.config.userFields.includes('phone')) {
             delete this.$data.phone;
         }
-        if (this.$data.secret === '') {
+        if (this.$data.secret === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.secret;
         }
-        if (this.$data.emailChangeDate === 0) {
+        if (this.$data.emailChangeDate === 0 ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.emailChangeDate;
         }
-        if (this.$data.newEmailSecret === '') {
+        if (this.$data.newEmailSecret === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.newEmailSecret;
         }
-        if (this.$data.newEmailAddress === '') {
+        if (this.$data.newEmailAddress === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.newEmailAddress;
         }
-        if (this.$data.cancelEmailSecret === '') {
+        if (this.$data.cancelEmailSecret === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.cancelEmailSecret;
         }
-        if (this.$data.cancelEmailAddress === '') {
+        if (this.$data.cancelEmailAddress === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.cancelEmailAddress;
         }
-        if (this.$data.recoverSecret === '') {
+        if (this.$data.recoverSecret === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.recoverSecret;
         }
-        if (this.$data.recoverSecretDate === 0) {
+        if (this.$data.recoverSecretDate === 0 ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.recoverSecretDate;
         }
         if (this.$data.password === '') {
@@ -988,50 +1822,65 @@ class User extends AbleObject_1.default {
         if (this.$data.inheritAbilities === false) {
             delete this.$data.inheritAbilities;
         }
+        // Verification.
         const unCheck = await this.$checkUsername();
         if (!unCheck.result) {
-            throw new errors_1.BadUsernameError(unCheck.message);
+            throw new BadUsernameError(unCheck.message);
         }
-        if (!tilmeld.config.emailUsernames) {
+        if (!tilmeld.config.emailUsernames &&
+            tilmeld.config.userFields.includes('email')) {
             const emCheck = await this.$checkEmail();
             if (!emCheck.result) {
-                throw new errors_1.BadEmailError(emCheck.message);
+                throw new BadEmailError(emCheck.message);
             }
         }
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
+        // Email changes.
+        if (!tilmeld.gatekeeper('tilmeld/admin') &&
+            tilmeld.config.userFields.includes('email')) {
+            // The user isn't an admin, so email address changes should contain some
+            // security measures.
             if (tilmeld.config.verifyEmail) {
+                // The user needs to verify this new email address.
                 if (this.guid == null) {
-                    if ((this.$data.abilities?.indexOf('system/admin') ?? -1) === -1) {
-                        this.$data.secret = (0, guid_1.nanoid)();
+                    // If this is the first user, they'll be made an admin, so they don't
+                    // need to verify.
+                    if (!this.$data.abilities?.includes('system/admin')) {
+                        this.$data.secret = nanoid();
                         sendVerification = true;
                     }
                 }
                 else if (this.$originalEmail != null &&
                     this.$originalEmail !== this.$data.email) {
+                    // The user already has an old email address.
                     if (tilmeld.config.emailRateLimit !== '' &&
                         this.$data.emailChangeDate != null &&
                         this.$data.emailChangeDate >=
-                            (0, strtotime_1.default)('-' + tilmeld.config.emailRateLimit) * 1000) {
-                        throw new errors_1.EmailChangeRateLimitExceededError('You already changed your email address recently. Please wait until ' +
-                            new Date((0, strtotime_1.default)('+' + tilmeld.config.emailRateLimit, Math.floor(this.$data.emailChangeDate / 1000)) * 1000).toString() +
+                            strtotime('-' + tilmeld.config.emailRateLimit) * 1000) {
+                        throw new EmailChangeRateLimitExceededError('You already changed your email address recently. Please wait until ' +
+                            new Date(strtotime('+' + tilmeld.config.emailRateLimit, Math.floor(this.$data.emailChangeDate / 1000)) * 1000).toString() +
                             ' to change your email address again.');
                     }
                     else {
                         if (this.$data.newEmailSecret == null &&
                             tilmeld.config.emailRateLimit !== '' &&
+                            // Make sure the user has at least the rate limit time to cancel
+                            // an email change.
                             (this.$data.emailChangeDate == null ||
                                 this.$data.emailChangeDate <
-                                    (0, strtotime_1.default)('-' + tilmeld.config.emailRateLimit) * 1000)) {
+                                    strtotime('-' + tilmeld.config.emailRateLimit) * 1000)) {
+                            // Save the old email in case the cancel change link is clicked.
                             this.$data.cancelEmailAddress = this.$originalEmail;
-                            this.$data.cancelEmailSecret = (0, guid_1.nanoid)();
+                            this.$data.cancelEmailSecret = nanoid();
                             this.$data.emailChangeDate = Date.now();
                         }
+                        // Save the new address and reset to the old one (until they verify
+                        // it).
                         this.$data.newEmailAddress = this.$data.email;
                         this.$data.email = this.$originalEmail;
                         if (tilmeld.config.emailUsernames) {
                             this.$data.username = this.$data.email;
                         }
-                        this.$data.newEmailSecret = (0, guid_1.nanoid)();
+                        this.$data.newEmailSecret = nanoid();
                         sendVerification = true;
                     }
                 }
@@ -1039,11 +1888,15 @@ class User extends AbleObject_1.default {
             else if (this.guid != null &&
                 this.$originalEmail != null &&
                 this.$originalEmail !== this.$data.email &&
+                // Make sure the user has at least the rate limit time to cancel an
+                // email change.
                 (this.$data.emailChangeDate == null ||
                     this.$data.emailChangeDate <
-                        (0, strtotime_1.default)('-' + tilmeld.config.emailRateLimit) * 1000)) {
+                        strtotime('-' + tilmeld.config.emailRateLimit) * 1000)) {
+                // The user doesn't need to verify their new email address, but should
+                // be able to cancel the email change from their old address.
                 this.$data.cancelEmailAddress = this.$originalEmail;
-                this.$data.cancelEmailSecret = (0, guid_1.nanoid)();
+                this.$data.cancelEmailSecret = nanoid();
                 sendVerification = true;
             }
         }
@@ -1052,72 +1905,188 @@ class User extends AbleObject_1.default {
         }
         delete this.$data.passwordTemp;
         if (this.$data.password == null) {
-            throw new errors_1.BadDataError('A password is required.');
-        }
-        try {
-            tilmeld.config.validatorUser(this);
+            throw new BadDataError('A password is required.');
         }
-        catch (e) {
-            throw new errors_1.BadDataError(e?.message);
-        }
-        const transaction = 'tilmeld-save-' + (0, guid_1.nanoid)();
+        // Start transaction.
+        const transaction = 'tilmeld-save-user-' + (this.guid || nanoid());
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
-        this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        if (this.$data.group != null &&
-            this.$data.group.user != null &&
-            this.$is(this.$data.group.user)) {
+        this.$setNymph(tnymph);
+        tilmeld = enforceTilmeld(this);
+        const Group = tnymph.getEntityClass(GroupClass);
+        try {
+            let group = this.$data.group;
+            if (group != null) {
+                // Make sure to get fresh group data.
+                if (group.$asleep()) {
+                    await group.$wake();
+                }
+                else {
+                    if (!(await group.$refresh())) {
+                        throw new Error("Couldn't retrieve primary group info.");
+                    }
+                }
+            }
+            if (group == null && this.guid == null) {
+                if (tilmeld.config.generatePrimary) {
+                    // Generate a new primary group for the user.
+                    group = await Group.factory();
+                    group.user = this;
+                    const parent = await tnymph.getEntity({ class: Group }, {
+                        type: '&',
+                        equal: ['defaultPrimary', true],
+                    });
+                    if (parent != null) {
+                        group.parent = parent;
+                    }
+                }
+                else {
+                    // Add the default primary.
+                    const group = await tnymph.getEntity({ class: Group }, {
+                        type: '&',
+                        equal: ['defaultPrimary', true],
+                    });
+                    if (group != null) {
+                        this.$data.group = group;
+                    }
+                }
+            }
+            if (group != null && group.user != null && this.$is(group.user)) {
+                // Update the user's generated primary group.
+                let changed = false;
+                if (group.groupname !== this.$data.username) {
+                    group.groupname = this.$data.username;
+                    changed = true;
+                }
+                if (group.avatar !== this.$data.avatar) {
+                    group.avatar = this.$data.avatar;
+                    changed = true;
+                }
+                if (tilmeld.config.userFields.includes('email') &&
+                    group.email !== this.$data.email) {
+                    group.email = this.$data.email;
+                    changed = true;
+                }
+                if (tilmeld.config.userFields.includes('name') &&
+                    group.name !== this.$data.name) {
+                    group.name = this.$data.name;
+                    changed = true;
+                }
+                if (tilmeld.config.userFields.includes('phone') &&
+                    group.phone !== this.$data.phone) {
+                    group.phone = this.$data.phone;
+                    changed = true;
+                }
+                if (changed || group.guid == null) {
+                    if (!(await group.$saveSkipAC())) {
+                        throw Error('Error updating primary group for user.');
+                    }
+                }
+                this.$data.group = group;
+            }
+            if (this.$data.groups == null || this.$data.groups.length === 0) {
+                // Add secondary groups.
+                if (tilmeld.config.userFields.includes('email') &&
+                    tilmeld.config.verifyEmail &&
+                    tilmeld.config.unverifiedAccess &&
+                    this.$data.secret != null) {
+                    // Add the default secondaries for unverified users.
+                    this.$data.groups = await tnymph.getEntities({ class: Group }, {
+                        type: '&',
+                        equal: ['unverifiedSecondary', true],
+                    });
+                }
+                else {
+                    // Add the default secondaries.
+                    this.$data.groups = await tnymph.getEntities({ class: Group }, {
+                        type: '&',
+                        equal: ['defaultSecondary', true],
+                    });
+                }
+            }
             try {
-                this.$data.group.groupname = this.$data.username;
-                this.$data.group.avatar = this.$data.avatar;
-                this.$data.group.email = this.$data.email;
-                this.$data.group.name = this.$data.name;
-                this.$data.group.phone = this.$data.phone;
-                await this.$data.group.$saveSkipAC();
+                tilmeld.config.validatorUser(tilmeld, this);
             }
             catch (e) {
-                await tnymph.rollback(transaction);
-                this.$nymph = nymph;
-                throw e;
+                throw new BadDataError(e?.message);
             }
         }
-        let ret;
+        catch (e) {
+            await tnymph.rollback(transaction);
+            this.$setNymph(nymph);
+            throw e;
+        }
+        let ret = false;
         let preGuid = this.guid;
         let preCdate = this.cdate;
         let preMdate = this.mdate;
         try {
+            for (let callback of this.constructor
+                .beforeSaveCallbacks) {
+                if (callback) {
+                    await callback(this);
+                }
+            }
             ret = await super.$save();
         }
         catch (e) {
             await tnymph.rollback(transaction);
-            this.$nymph = nymph;
+            this.guid = preGuid;
+            this.cdate = preCdate;
+            this.mdate = preMdate;
+            this.$setNymph(nymph);
             throw e;
         }
         if (ret) {
             if (sendVerification) {
+                // The email has changed, so send a new verification email.
                 if (!(await this.$sendEmailVerification())) {
                     await tnymph.rollback(transaction);
                     this.guid = preGuid;
                     this.cdate = preCdate;
                     this.mdate = preMdate;
-                    this.$nymph = nymph;
+                    this.$setNymph(nymph);
                     throw new Error("Couldn't send verification email.");
                 }
             }
             this.$descendantGroups = undefined;
             this.$gatekeeperCache = undefined;
-            await tnymph.commit(transaction);
-            if (nymph.tilmeld.User.current(true).$is(this)) {
-                nymph.tilmeld.fillSession(this);
+            try {
+                for (let callback of this.constructor
+                    .afterSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
             }
+            catch (e) {
+                await tnymph.rollback(transaction);
+                this.guid = preGuid;
+                this.cdate = preCdate;
+                this.mdate = preMdate;
+                this.$setNymph(nymph);
+                throw e;
+            }
+            ret = await tnymph.commit(transaction);
         }
         else {
             await tnymph.rollback(transaction);
         }
-        this.$nymph = nymph;
+        this.$setNymph(nymph);
+        if (ret) {
+            this.$originalEmail = this.$data.email;
+            this.$originalUsername = this.$data.username;
+            const tilmeld = enforceTilmeld(nymph);
+            if (tilmeld.User.current(true).$is(this)) {
+                // Update the user in the session cache.
+                await tilmeld.fillSession(this);
+            }
+        }
         return ret;
     }
+    /**
+     * This should *never* be accessible on the client.
+     */
     async $saveSkipAC() {
         this.$skipAcWhenSaving = true;
         return await this.$save();
@@ -1130,24 +2099,109 @@ class User extends AbleObject_1.default {
         return false;
     }
     async $delete() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to delete users.");
+        const tilmeld = enforceTilmeld(this);
+        if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
+            throw new AccessControlError("You don't have the authority to delete users.");
+        }
+        if (!this.$skipAcWhenDeleting &&
+            !tilmeld.gatekeeper('system/admin') &&
+            this.$data.abilities?.includes('system/admin')) {
+            throw new AccessControlError("You don't have the authority to delete system admins.");
         }
-        if (!tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to delete system admins.");
+        if (this.$data.username !== this.$originalUsername) {
+            throw new AccessControlError("You can't delete a user while switching their username.");
         }
-        if (tilmeld.User.current(true).$is(this)) {
-            await this.$logout();
+        const transaction = 'tilmeld-delete-user-' + this.guid;
+        const nymph = this.$nymph;
+        const tnymph = await nymph.startTransaction(transaction);
+        this.$setNymph(tnymph);
+        let success = false;
+        try {
+            if (!(await this.$refresh())) {
+                throw new BadDataError('User could not be refreshed.');
+            }
+            if (this.$data.group != null) {
+                if (this.$data.group.$asleep()) {
+                    await this.$data.group.$wake();
+                }
+                else {
+                    if (!(await this.$data.group.$refresh())) {
+                        throw new BadDataError('Group could not be refreshed.');
+                    }
+                }
+            }
+            for (let callback of this.constructor
+                .beforeDeleteCallbacks) {
+                if (callback) {
+                    await callback(this);
+                }
+            }
+            if (tilmeld.User.current(true).$is(this)) {
+                await this.$logout();
+            }
+            if (this.$data.group != null && this.$is(this.$data.group.user)) {
+                // Read the skip ac value here, because super.$delete changes it.
+                const $skipAcWhenDeleting = this.$skipAcWhenDeleting;
+                // Delete the user.
+                success = await super.$delete();
+                if (success) {
+                    // Delete the generated group.
+                    success = $skipAcWhenDeleting
+                        ? await this.$data.group.$deleteSkipAC()
+                        : await this.$data.group.$delete();
+                }
+            }
+            else {
+                success = await super.$delete();
+            }
         }
-        return await super.$delete();
+        catch (e) {
+            await tnymph.rollback(transaction);
+            this.$setNymph(nymph);
+            throw e;
+        }
+        if (success) {
+            try {
+                for (let callback of this.constructor
+                    .afterDeleteCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
+            }
+            catch (e) {
+                await tnymph.rollback(transaction);
+                this.$setNymph(nymph);
+                throw e;
+            }
+            success = await tnymph.commit(transaction);
+        }
+        else {
+            await tnymph.rollback(transaction);
+        }
+        this.$setNymph(nymph);
+        return success;
+    }
+    /*
+     * This should *never* be accessible on the client.
+     */
+    async $deleteSkipAC() {
+        this.$skipAcWhenDeleting = true;
+        return await this.$delete();
+    }
+    $tilmeldDeleteSkipAC() {
+        if (this.$skipAcWhenDeleting) {
+            this.$skipAcWhenDeleting = false;
+            return true;
+        }
+        return false;
     }
     static on(event, callback) {
         const prop = (event + 'Callbacks');
         if (!(prop in this)) {
             throw new Error('Invalid event type.');
         }
+        // @ts-ignore: The callback should always be the right type here.
         this[prop].push(callback);
         return () => this.off(event, callback);
     }
@@ -1156,55 +2210,13 @@ class User extends AbleObject_1.default {
         if (!(prop in this)) {
             return false;
         }
+        // @ts-ignore: The callback should always be the right type here.
         const i = this[prop].indexOf(callback);
         if (i > -1) {
+            // @ts-ignore: The callback should always be the right type here.
             this[prop].splice(i, 1);
         }
         return true;
     }
 }
-exports.default = User;
-User.ETYPE = 'tilmeld_user';
-User.class = 'User';
-User.beforeRegisterCallbacks = [];
-User.afterRegisterCallbacks = [];
-User.beforeLoginCallbacks = [];
-User.afterLoginCallbacks = [];
-User.beforeLogoutCallbacks = [];
-User.afterLogoutCallbacks = [];
-User.DEFAULT_CLIENT_ENABLED_METHODS = [
-    '$checkUsername',
-    '$checkEmail',
-    '$checkPhone',
-    '$getAvatar',
-    '$register',
-];
-User.DEFAULT_PRIVATE_DATA = [
-    'email',
-    'originalEmail',
-    'phone',
-    'group',
-    'groups',
-    'abilities',
-    'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
-    'secret',
-    'newEmailAddress',
-    'newEmailSecret',
-    'cancelEmailAddress',
-    'cancelEmailSecret',
-    'emailChangeDate',
-];
-User.DEFAULT_ALLOWLIST_DATA = [];
-User.clientEnabledStaticMethods = [
-    'current',
-    'loginUser',
-    'sendRecovery',
-    'recover',
-    'getClientConfig',
-];
-User.searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
 //# sourceMappingURL=User.js.map