@nymphjs/tilmeld 1.0.0-beta.120 → 1.0.0-beta.122

package/dist/testArtifacts.js

@@ -1,33 +1,103 @@
-import { Entity, Nymph, TilmeldAccessLevels, TilmeldAccessRequest, } from '@nymphjs/nymph';
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Entity, Nymph, HttpError, TilmeldAccessLevels, TilmeldAccessRequest, } from '@nymphjs/nymph';
 import Tilmeld from './Tilmeld.js';
+import { requireAbility, requireAuthentication } from './decorators/index.js';
 import { AccessControlError } from './errors/index.js';
+import { UserTest } from './User.testArtifacts.js';
+import { GroupTest } from './Group.testArtifacts.js';
 /**
  * This class is a test class that extends the Entity class.
  */
-export class TestModel extends Entity {
-    static ETYPE = 'tilmeld_test_model';
-    static class = 'TestModel';
-    /**
-     * This should only be used by the backend.
-     */
-    $skipAcWhenDeleting = false;
-    /*
-     * This should *never* be accessible on the client.
-     */
-    async $deleteSkipAC() {
-        this.$skipAcWhenDeleting = true;
-        return await this.$delete();
-    }
-    $tilmeldDeleteSkipAC() {
-        if (this.$skipAcWhenDeleting) {
-            this.$skipAcWhenDeleting = false;
+let TestModel = (() => {
+    let _classSuper = Entity;
+    let _instanceExtraInitializers = [];
+    let _$testRequireAuthenticationDecorator_decorators;
+    let _$testRequireAuthenticationDecoratorAsync_decorators;
+    let _$testRequireAbilityDecorator_decorators;
+    let _$testRequireAbilityDecoratorAsync_decorators;
+    return class TestModel extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _$testRequireAuthenticationDecorator_decorators = [requireAuthentication];
+            _$testRequireAuthenticationDecoratorAsync_decorators = [requireAuthentication];
+            _$testRequireAbilityDecorator_decorators = [requireAbility('test-ability')];
+            _$testRequireAbilityDecoratorAsync_decorators = [requireAbility('test-ability')];
+            __esDecorate(this, null, _$testRequireAuthenticationDecorator_decorators, { kind: "method", name: "$testRequireAuthenticationDecorator", static: false, private: false, access: { has: obj => "$testRequireAuthenticationDecorator" in obj, get: obj => obj.$testRequireAuthenticationDecorator }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _$testRequireAuthenticationDecoratorAsync_decorators, { kind: "method", name: "$testRequireAuthenticationDecoratorAsync", static: false, private: false, access: { has: obj => "$testRequireAuthenticationDecoratorAsync" in obj, get: obj => obj.$testRequireAuthenticationDecoratorAsync }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _$testRequireAbilityDecorator_decorators, { kind: "method", name: "$testRequireAbilityDecorator", static: false, private: false, access: { has: obj => "$testRequireAbilityDecorator" in obj, get: obj => obj.$testRequireAbilityDecorator }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _$testRequireAbilityDecoratorAsync_decorators, { kind: "method", name: "$testRequireAbilityDecoratorAsync", static: false, private: false, access: { has: obj => "$testRequireAbilityDecoratorAsync" in obj, get: obj => obj.$testRequireAbilityDecoratorAsync }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static ETYPE = 'tilmeld_test_model';
+        static class = 'TestModel';
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenDeleting = (__runInitializers(this, _instanceExtraInitializers), false);
+        $testRequireAuthenticationDecorator() {
             return true;
         }
-        return false;
-    }
-}
+        async $testRequireAuthenticationDecoratorAsync() {
+            return true;
+        }
+        $testRequireAbilityDecorator() {
+            return true;
+        }
+        async $testRequireAbilityDecoratorAsync() {
+            return true;
+        }
+        /*
+         * This should *never* be accessible on the client.
+         */
+        async $deleteSkipAC() {
+            this.$skipAcWhenDeleting = true;
+            return await this.$delete();
+        }
+        $tilmeldDeleteSkipAC() {
+            if (this.$skipAcWhenDeleting) {
+                this.$skipAcWhenDeleting = false;
+                return true;
+            }
+            return false;
+        }
+    };
+})();
+export { TestModel };
 const TestModelClass = TestModel;
-export function TilmeldTest(nymphBase, it) {
+export function TilmeldTest(nymphBase, describe, it) {
     const tilmeld = new Tilmeld({
         appName: 'My App',
         appUrl: 'http://localhost:8080',
@@ -45,1120 +115,1203 @@ export function TilmeldTest(nymphBase, it) {
         },
     });
     const nymph = new Nymph(nymphBase.config, nymphBase.driver, tilmeld);
-    const User = tilmeld.User;
-    const Group = tilmeld.Group;
-    const TestModel = nymph.addEntityClass(TestModelClass);
-    async function deleteTestData() {
-        let all = await nymph.getEntities({
-            class: TestModel,
-        });
-        expect(Array.isArray(all)).toEqual(true);
-        for (const cur of all) {
-            expect(await cur.$deleteSkipAC()).toEqual(true);
-        }
-        all = await nymph.getEntities({ class: TestModel });
-        expect(all.length).toEqual(0);
-        all = await nymph.getEntities({ class: User });
-        expect(Array.isArray(all)).toEqual(true);
-        for (const cur of all) {
-            expect(await cur.$deleteSkipAC()).toEqual(true);
-        }
-        all = await nymph.getEntities({ class: User });
-        expect(all.length).toEqual(0);
-        all = await nymph.getEntities({ class: Group });
-        expect(Array.isArray(all)).toEqual(true);
-        for (const cur of all) {
-            expect(await cur.$deleteSkipAC()).toEqual(true);
-        }
-        all = await nymph.getEntities({ class: Group });
-        expect(all.length).toEqual(0);
-    }
-    async function makeUsers() {
-        const admin = await User.factoryUsername('admin');
-        const bob = await User.factoryUsername('bob');
-        const alice = await User.factoryUsername('alice');
-        const abgroup = await Group.factoryGroupname('abgroup');
-        if (admin.guid == null) {
-            admin.username = 'admin';
-            admin.email = 'admin@localhost';
-            admin.nameFirst = 'Admin';
-            admin.nameLast = 'User';
-            admin.name = 'Admin User';
-            admin.$password('password');
-            admin.$grant('system/admin');
-            await admin.$saveSkipAC();
-        }
-        if (abgroup.guid == null) {
-            abgroup.groupname = 'abgroup';
-            abgroup.email = 'abgroup@localhost';
-            abgroup.name = 'AB Group';
-            await abgroup.$saveSkipAC();
+    describe('Tilmeld', () => {
+        UserTest(nymph, tilmeld, describe, it);
+        GroupTest(nymph, tilmeld, describe, it);
+        const User = tilmeld.User;
+        const Group = tilmeld.Group;
+        const TestModel = nymph.addEntityClass(TestModelClass);
+        async function deleteTestData() {
+            let all = await nymph.getEntities({
+                class: TestModel,
+            });
+            expect(Array.isArray(all)).toEqual(true);
+            for (const cur of all) {
+                await cur.$deleteSkipAC();
+            }
+            all = await nymph.getEntities({ class: TestModel });
+            expect(all.length).toEqual(0);
+            all = await nymph.getEntities({ class: User });
+            expect(Array.isArray(all)).toEqual(true);
+            for (const cur of all) {
+                await cur.$deleteSkipAC();
+            }
+            all = await nymph.getEntities({ class: User });
+            expect(all.length).toEqual(0);
+            all = await nymph.getEntities({ class: Group });
+            expect(Array.isArray(all)).toEqual(true);
+            for (const cur of all) {
+                await cur.$deleteSkipAC();
+            }
+            all = await nymph.getEntities({ class: Group });
+            expect(all.length).toEqual(0);
         }
-        if (bob.guid == null) {
-            bob.username = 'bob';
-            bob.email = 'bob@localhost';
-            bob.nameFirst = 'Bob';
-            bob.nameLast = 'User';
-            bob.name = 'Bob User';
-            bob.$password('password');
-            bob.$addGroup(abgroup);
-            await bob.$saveSkipAC();
+        async function makeUsers() {
+            const admin = await User.factoryUsername('admin');
+            const bob = await User.factoryUsername('bob');
+            const alice = await User.factoryUsername('alice');
+            const abgroup = await Group.factoryGroupname('abgroup');
+            if (admin.guid == null) {
+                admin.username = 'admin';
+                admin.email = 'admin@localhost';
+                admin.nameFirst = 'Admin';
+                admin.nameLast = 'User';
+                admin.name = 'Admin User';
+                admin.$password('password');
+                admin.$grant('system/admin');
+                await admin.$saveSkipAC();
+            }
+            if (abgroup.guid == null) {
+                abgroup.groupname = 'abgroup';
+                abgroup.email = 'abgroup@localhost';
+                abgroup.name = 'AB Group';
+                await abgroup.$saveSkipAC();
+            }
+            if (bob.guid == null) {
+                bob.username = 'bob';
+                bob.email = 'bob@localhost';
+                bob.nameFirst = 'Bob';
+                bob.nameLast = 'User';
+                bob.name = 'Bob User';
+                bob.$password('password');
+                bob.$addGroup(abgroup);
+                await bob.$saveSkipAC();
+            }
+            if (alice.guid == null) {
+                alice.username = 'alice';
+                alice.email = 'alice@localhost';
+                alice.nameFirst = 'Alice';
+                alice.nameLast = 'User';
+                alice.name = 'Alice User';
+                alice.$password('password');
+                alice.$addGroup(abgroup);
+                await alice.$saveSkipAC();
+            }
+            return { admin, bob, alice, abgroup };
         }
-        if (alice.guid == null) {
-            alice.username = 'alice';
-            alice.email = 'alice@localhost';
-            alice.nameFirst = 'Alice';
-            alice.nameLast = 'User';
-            alice.name = 'Alice User';
-            alice.$password('password');
-            alice.$addGroup(abgroup);
-            await alice.$saveSkipAC();
-        }
-        return { admin, bob, alice, abgroup };
-    }
-    it('delete old test data', async () => {
-        await deleteTestData();
-    });
-    it('users can log in', async () => {
-        const { admin, bob, alice } = await makeUsers();
-        let result = await admin.$login({
-            username: 'admin',
-            password: 'password',
+        it('delete old test data', async () => {
+            await deleteTestData();
         });
-        expect(result.result).toEqual(true);
-        expect(admin.$is(User.current())).toEqual(true);
-        result = await admin.$logout();
-        expect(result.result).toEqual(true);
-        expect(User.current()).toBeNull();
-        result = await bob.$login({
-            username: 'bob',
-            password: 'password',
+        it('users can log in', async () => {
+            const { admin, bob, alice } = await makeUsers();
+            let result = await admin.$login({
+                username: 'admin',
+                password: 'password',
+            });
+            expect(result.result).toEqual(true);
+            expect(admin.$is(User.current())).toEqual(true);
+            result = await admin.$logout();
+            expect(result.result).toEqual(true);
+            expect(User.current()).toBeNull();
+            result = await bob.$login({
+                username: 'bob',
+                password: 'password',
+            });
+            expect(result.result).toEqual(true);
+            expect(bob.$is(User.current())).toEqual(true);
+            result = await bob.$logout();
+            expect(result.result).toEqual(true);
+            expect(User.current()).toBeNull();
+            result = await alice.$login({
+                username: 'alice',
+                password: 'password',
+            });
+            expect(result.result).toEqual(true);
+            expect(alice.$is(User.current())).toEqual(true);
+            result = await alice.$logout();
+            expect(result.result).toEqual(true);
+            expect(User.current()).toBeNull();
         });
-        expect(result.result).toEqual(true);
-        expect(bob.$is(User.current())).toEqual(true);
-        result = await bob.$logout();
-        expect(result.result).toEqual(true);
-        expect(User.current()).toBeNull();
-        result = await alice.$login({
-            username: 'alice',
-            password: 'password',
+        it('creates tables for test model', async () => {
+            const testEntity = await nymph.getEntity({ class: TestModel });
+            expect(testEntity).toBeNull();
         });
-        expect(result.result).toEqual(true);
-        expect(alice.$is(User.current())).toEqual(true);
-        result = await alice.$logout();
-        expect(result.result).toEqual(true);
-        expect(User.current()).toBeNull();
-    });
-    it('creates tables for test model', async () => {
-        const testEntity = await nymph.getEntity({ class: TestModel });
-        expect(testEntity).toBeNull();
-    });
-    it('user ownership, group ownership, and access controls are added on entities', async () => {
-        const { bob } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        expect(testEntityBob?.user?.$is(bob)).toEqual(true);
-        expect(testEntityBob?.group?.$is(bob.group)).toEqual(true);
-        expect(testEntityBob?.acUser).toEqual(TilmeldAccessLevels.FULL_ACCESS);
-        expect(testEntityBob?.acGroup).toEqual(TilmeldAccessLevels.READ_ACCESS);
-        expect(testEntityBob?.acOther).toEqual(TilmeldAccessLevels.NO_ACCESS);
-        expect(testEntityBob?.acRead).toEqual([]);
-        expect(testEntityBob?.acWrite).toEqual([]);
-        expect(testEntityBob?.acFull).toEqual([]);
-    });
-    it("alice can't access an entity owned by bob", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).toBeNull();
-    });
-    it("alice can't write to an entity she doesn't have write permission for", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acRead = [alice.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        try {
-            await testEntityAlice.$save();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Bob's Entity");
-    });
-    it('alice can write to an entity she has write permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acWrite = [alice.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        expect(await testEntityAlice.$save()).toEqual(true);
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
-    });
-    it("alice can't delete an entity she doesn't have full permission for", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acWrite = [alice.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        try {
-            await testEntityAlice.$delete();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
-    });
-    it('alice can delete an entity she has full permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acFull = [alice.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        expect(await testEntityAlice.$delete()).toEqual(true);
-        const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(verifyEntityAlice).toBeNull();
-    });
-    it('alice can access an entity her group has permission for', async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acRead = [abgroup.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-    });
-    it("alice can't write to an entity her group doesn't have write permission for", async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acRead = [abgroup.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        try {
-            await testEntityAlice.$save();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Bob's Entity");
-    });
-    it('alice can write to an entity her group has write permission for', async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acWrite = [abgroup.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        expect(await testEntityAlice.$save()).toEqual(true);
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
-    });
-    it("alice can't delete an entity her group doesn't have full permission for", async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acWrite = [abgroup.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        try {
-            await testEntityAlice.$delete();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
-    });
-    it('alice can delete an entity her group has full permission for', async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acFull = [abgroup.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        expect(await testEntityAlice.$delete()).toEqual(true);
-        const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(verifyEntityAlice).toBeNull();
-    });
-    it('alice can access an entity her primary group has permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = alice.group;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-    });
-    it("alice can't write to an entity her primary group doesn't have write permission for", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = alice.group;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        try {
-            await testEntityAlice.$save();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Bob's Entity");
-    });
-    it('alice can write to an entity her primary group has write permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = alice.group;
-        bobsEntity.acGroup = TilmeldAccessLevels.WRITE_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        expect(await testEntityAlice.$save()).toEqual(true);
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
-    });
-    it("alice can't delete an entity her primary group doesn't have full permission for", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = alice.group;
-        bobsEntity.acGroup = TilmeldAccessLevels.WRITE_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        try {
-            await testEntityAlice.$delete();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
-    });
-    it('alice can delete an entity her primary group has full permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = alice.group;
-        bobsEntity.acGroup = TilmeldAccessLevels.FULL_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        expect(await testEntityAlice.$delete()).toEqual(true);
-        const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(verifyEntityAlice).toBeNull();
-    });
-    it('alice can access an entity everyone has permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.READ_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-    });
-    it("alice can't write to an entity everyone doesn't have write permission for", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.READ_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        try {
+        it('user ownership, group ownership, and access controls are added on entities', async () => {
+            const { bob } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            expect(testEntityBob?.user?.$is(bob)).toEqual(true);
+            expect(testEntityBob?.group?.$is(bob.group)).toEqual(true);
+            expect(testEntityBob?.acUser).toEqual(TilmeldAccessLevels.FULL_ACCESS);
+            expect(testEntityBob?.acGroup).toEqual(TilmeldAccessLevels.READ_ACCESS);
+            expect(testEntityBob?.acOther).toEqual(TilmeldAccessLevels.NO_ACCESS);
+            expect(testEntityBob?.acRead).toEqual([]);
+            expect(testEntityBob?.acWrite).toEqual([]);
+            expect(testEntityBob?.acFull).toEqual([]);
+        });
+        it('require authentication decorator', async () => {
+            const { bob } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            await bobsEntity.$save();
+            expect(bobsEntity.$testRequireAuthenticationDecorator()).toEqual(true);
+            expect(await bobsEntity.$testRequireAuthenticationDecoratorAsync()).toEqual(true);
+            tilmeld.clearSession();
+            try {
+                bobsEntity.$testRequireAuthenticationDecorator();
+                throw new Error('Should have thrown.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(HttpError);
+                expect(e.status).toEqual(403);
+                expect(e.message).toEqual('Forbidden');
+            }
+            try {
+                await bobsEntity.$testRequireAuthenticationDecoratorAsync();
+                throw new Error('Should have thrown.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(HttpError);
+                expect(e.status).toEqual(403);
+                expect(e.message).toEqual('Forbidden');
+            }
+        });
+        it('require ability decorator', async () => {
+            const { bob } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            await bobsEntity.$save();
+            try {
+                bobsEntity.$testRequireAbilityDecorator();
+                throw new Error('Should have thrown.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(HttpError);
+                expect(e.status).toEqual(403);
+                expect(e.message).toEqual('Forbidden');
+            }
+            try {
+                await bobsEntity.$testRequireAbilityDecoratorAsync();
+                throw new Error('Should have thrown.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(HttpError);
+                expect(e.status).toEqual(403);
+                expect(e.message).toEqual('Forbidden');
+            }
+            tilmeld.clearSession();
+            try {
+                bobsEntity.$testRequireAbilityDecorator();
+                throw new Error('Should have thrown.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(HttpError);
+                expect(e.status).toEqual(403);
+                expect(e.message).toEqual('Forbidden');
+            }
+            try {
+                await bobsEntity.$testRequireAbilityDecoratorAsync();
+                throw new Error('Should have thrown.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(HttpError);
+                expect(e.status).toEqual(403);
+                expect(e.message).toEqual('Forbidden');
+            }
+            bob.$grant('test-ability');
+            await tilmeld.fillSession(bob);
+            expect(bobsEntity.$testRequireAbilityDecorator()).toEqual(true);
+            expect(await bobsEntity.$testRequireAbilityDecoratorAsync()).toEqual(true);
+        });
+        it("alice can't access an entity owned by bob", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).toBeNull();
+        });
+        it("alice can't write to an entity she doesn't have write permission for", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acRead = [alice.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            try {
+                await testEntityAlice.$save();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Bob's Entity");
+        });
+        it('alice can write to an entity she has write permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acWrite = [alice.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
             await testEntityAlice.$save();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Bob's Entity");
-    });
-    it('alice can write to an entity everyone has write permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.WRITE_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        testEntityAlice.name = "Haha! It's mine now!";
-        expect(await testEntityAlice.$save()).toEqual(true);
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
-    });
-    it("alice can't delete an entity everyone doesn't have full permission for", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.WRITE_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        try {
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
+        });
+        it("alice can't delete an entity she doesn't have full permission for", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acWrite = [alice.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            try {
+                await testEntityAlice.$delete();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
+        });
+        it('alice can delete an entity she has full permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acFull = [alice.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
             await testEntityAlice.$delete();
-            throw new Error('It should have thrown AccessControlError.');
-        }
-        catch (e) {
-            expect(e).toBeInstanceOf(AccessControlError);
-        }
-        expect(await testEntityAlice.$refresh()).toEqual(true);
-        expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
-    });
-    it('alice can delete an entity everyone has full permission for', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.FULL_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        if (testEntityAlice == null) {
-            throw new Error();
-        }
-        expect(await testEntityAlice.$delete()).toEqual(true);
-        const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(verifyEntityAlice).toBeNull();
-    });
-    it('a clear session can delete an entity everyone has full permission for', async () => {
-        const { bob } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.FULL_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        const testEntityNobody = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityNobody).not.toBeNull();
-        expect(testEntityNobody?.guid).toEqual(bobsEntity.guid);
-        if (testEntityNobody == null) {
-            throw new Error();
-        }
-        expect(await testEntityNobody.$delete()).toEqual(true);
-        const verifyEntityNobody = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(verifyEntityNobody).toBeNull();
-    });
-    it('allows skip ac deletions', async () => {
-        const allEntities = [
-            ...(await nymph.getEntities({ class: TestModel, skipAc: true })),
-            ...(await nymph.getEntities({ class: User, skipAc: true })),
-            ...(await nymph.getEntities({ class: Group, skipAc: true })),
-        ];
-        for (let entity of allEntities) {
-            expect(await entity.$deleteSkipAC()).toEqual(true);
-        }
-    });
-    it('entity can be retrieved by queries on ac properties', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acRead = [
-            alice.guid ?? '',
-            bob.guid ?? '',
-            ...(bob.group ? [bob.group.guid ?? ''] : []),
-        ];
-        bobsEntity.acWrite = [alice.guid ?? '', bob.guid ?? ''];
-        bobsEntity.acFull = [bob.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        // Equals queries.
-        let testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            equal: ['user', bob.guid],
+            const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(verifyEntityAlice).toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            equal: ['user', '000000000000000000000000'],
+        it('alice can access an entity her group has permission for', async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acRead = [abgroup.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            equal: ['group', bob.group?.guid],
+        it("alice can't write to an entity her group doesn't have write permission for", async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acRead = [abgroup.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            try {
+                await testEntityAlice.$save();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Bob's Entity");
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            equal: ['group', '000000000000000000000000'],
+        it('alice can write to an entity her group has write permission for', async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acWrite = [abgroup.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            await testEntityAlice.$save();
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
         });
-        expect(testEntityAlice).toBeNull();
-        // Contains queries.
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['user', bob.guid],
+        it("alice can't delete an entity her group doesn't have full permission for", async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acWrite = [abgroup.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            try {
+                await testEntityAlice.$delete();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['user', '000000000000000000000000'],
+        it('alice can delete an entity her group has full permission for', async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acFull = [abgroup.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            await testEntityAlice.$delete();
+            const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(verifyEntityAlice).toBeNull();
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['group', bob.group?.guid],
+        it('alice can access an entity her primary group has permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = alice.group;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['group', '000000000000000000000000'],
+        it("alice can't write to an entity her primary group doesn't have write permission for", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = alice.group;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            try {
+                await testEntityAlice.$save();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Bob's Entity");
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['acRead', alice.guid],
+        it('alice can write to an entity her primary group has write permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = alice.group;
+            bobsEntity.acGroup = TilmeldAccessLevels.WRITE_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            await testEntityAlice.$save();
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['acRead', '000000000000000000000000'],
+        it("alice can't delete an entity her primary group doesn't have full permission for", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = alice.group;
+            bobsEntity.acGroup = TilmeldAccessLevels.WRITE_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            try {
+                await testEntityAlice.$delete();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['acWrite', bob.guid],
+        it('alice can delete an entity her primary group has full permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = alice.group;
+            bobsEntity.acGroup = TilmeldAccessLevels.FULL_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            await testEntityAlice.$delete();
+            const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(verifyEntityAlice).toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['acWrite', '000000000000000000000000'],
+        it('alice can access an entity everyone has permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.READ_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['acFull', bob.guid],
+        it("alice can't write to an entity everyone doesn't have write permission for", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.READ_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            try {
+                await testEntityAlice.$save();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Bob's Entity");
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            contain: ['acFull', '000000000000000000000000'],
+        it('alice can write to an entity everyone has write permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.WRITE_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            testEntityAlice.name = "Haha! It's mine now!";
+            await testEntityAlice.$save();
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.name).toEqual("Haha! It's mine now!");
         });
-        expect(testEntityAlice).toBeNull();
-        // Ref queries.
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['user', bob],
+        it("alice can't delete an entity everyone doesn't have full permission for", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.WRITE_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            try {
+                await testEntityAlice.$delete();
+                throw new Error('It should have thrown AccessControlError.');
+            }
+            catch (e) {
+                expect(e).toBeInstanceOf(AccessControlError);
+            }
+            expect(await testEntityAlice.$refresh()).toEqual(true);
+            expect(testEntityAlice.guid).toEqual(bobsEntity.guid);
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['user', '000000000000000000000000'],
+        it('alice can delete an entity everyone has full permission for', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.FULL_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            if (testEntityAlice == null) {
+                throw new Error();
+            }
+            await testEntityAlice.$delete();
+            const verifyEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(verifyEntityAlice).toBeNull();
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['group', bob.group ?? ''],
+        it('a clear session can delete an entity everyone has full permission for', async () => {
+            const { bob } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.FULL_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            const testEntityNobody = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityNobody).not.toBeNull();
+            expect(testEntityNobody?.guid).toEqual(bobsEntity.guid);
+            if (testEntityNobody == null) {
+                throw new Error();
+            }
+            await testEntityNobody.$delete();
+            const verifyEntityNobody = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(verifyEntityNobody).toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['group', '000000000000000000000000'],
+        it('allows skip ac deletions', async () => {
+            const allEntities = [
+                ...(await nymph.getEntities({ class: TestModel, skipAc: true })),
+                ...(await nymph.getEntities({ class: User, skipAc: true })),
+                ...(await nymph.getEntities({ class: Group, skipAc: true })),
+            ];
+            for (let entity of allEntities) {
+                await entity.$deleteSkipAC();
+            }
+        });
+        it('entity can be retrieved by queries on ac properties', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acRead = [
+                alice.guid ?? '',
+                bob.guid ?? '',
+                ...(bob.group ? [bob.group.guid ?? ''] : []),
+            ];
+            bobsEntity.acWrite = [alice.guid ?? '', bob.guid ?? ''];
+            bobsEntity.acFull = [bob.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            // Equals queries.
+            let testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                equal: ['user', bob.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                equal: ['user', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                equal: ['group', bob.group?.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                equal: ['group', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            // Contains queries.
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['user', bob.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['user', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['group', bob.group?.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['group', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['acRead', alice.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['acRead', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['acWrite', bob.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['acWrite', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['acFull', bob.guid],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                contain: ['acFull', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            // Ref queries.
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['user', bob],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['user', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['group', bob.group ?? ''],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['group', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['acRead', alice],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['acRead', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['acWrite', bob],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['acWrite', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['acFull', bob],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                ref: ['acFull', '000000000000000000000000'],
+            });
+            expect(testEntityAlice).toBeNull();
+            // QRef queries.
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                qref: [
+                    'user',
+                    [
+                        { class: User },
+                        { type: '&', equal: ['username', bob.username ?? ''] },
+                    ],
+                ],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                qref: [
+                    'user',
+                    [{ class: User }, { type: '&', equal: ['username', 'pickle'] }],
+                ],
+            });
+            expect(testEntityAlice).toBeNull();
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                qref: [
+                    'acRead',
+                    [
+                        { class: User },
+                        { type: '&', equal: ['username', alice.username ?? ''] },
+                    ],
+                ],
+            });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
+            testEntityAlice = await nymph.getEntity({ class: TestModel }, {
+                type: '&',
+                guid: bobsEntity.guid || '',
+                qref: [
+                    'acRead',
+                    [{ class: User }, { type: '&', equal: ['username', 'pickle'] }],
+                ],
+            });
+            expect(testEntityAlice).toBeNull();
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['acRead', alice],
+        it('alice can access an entity with an access request', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(alice);
+            const alicesEntity = await TestModel.factory();
+            alicesEntity.name = "Alice's Entity";
+            await alicesEntity.$save();
+            expect(alicesEntity.guid).not.toBeNull();
+            expect(alice.$is(alicesEntity.user)).toEqual(true);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: alicesEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            expect(testEntityAlice?.guid).toEqual(alicesEntity.guid);
+            tilmeld.clearSession();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['acRead', '000000000000000000000000'],
+        it("access request for user owned doesn't return group owned entity", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = alice.group;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
+            const testSuccessEntityAlice = await nymph.getEntity({
+                class: TestModel,
+                acRequest: TilmeldAccessRequest.PRIMARY_GROUP_OWNED,
+            }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice).not.toBeNull();
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['acWrite', bob],
+        it("access request for user owned doesn't return acOther accessible entity", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acOther = TilmeldAccessLevels.READ_ACCESS;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
+            const testSuccessEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.OTHER_ACCESSIBLE }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice).not.toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['acWrite', '000000000000000000000000'],
+        it("access request for user owned doesn't return user acRead accessible entity", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acRead = [alice.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
+            const testSuccessEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_ACCESSIBLE }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice).not.toBeNull();
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['acFull', bob],
+        it("access request for user owned doesn't return group acRead accessible entity", async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acWrite = [alice.group?.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
+            const testSuccessEntityAlice = await nymph.getEntity({
+                class: TestModel,
+                acRequest: TilmeldAccessRequest.PRIMARY_GROUP_ACCESSIBLE,
+            }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice).not.toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            ref: ['acFull', '000000000000000000000000'],
+        it("access request for user owned doesn't return secondary group owned entity", async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.group = abgroup;
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
+            const testSuccessEntityAlice = await nymph.getEntity({
+                class: TestModel,
+                acRequest: TilmeldAccessRequest.SECONDARY_GROUP_OWNED,
+            }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice).not.toBeNull();
         });
-        expect(testEntityAlice).toBeNull();
-        // QRef queries.
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            qref: [
-                'user',
-                [
-                    { class: User },
-                    { type: '&', equal: ['username', bob.username ?? ''] },
-                ],
-            ],
+        it("access request for user owned doesn't return secondary group accessible entity", async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acFull = [abgroup.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
+            const testSuccessEntityAlice = await nymph.getEntity({
+                class: TestModel,
+                acRequest: TilmeldAccessRequest.SECONDARY_GROUP_ACCESSIBLE,
+            }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice).not.toBeNull();
+            // Test or-ing two levels together.
+            const testSuccessEntityAlice2 = await nymph.getEntity({
+                class: TestModel,
+                acRequest: TilmeldAccessRequest.SECONDARY_GROUP_ACCESSIBLE |
+                    TilmeldAccessRequest.PRIMARY_GROUP_ACCESSIBLE,
+            }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testSuccessEntityAlice2).not.toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            qref: [
-                'user',
-                [{ class: User }, { type: '&', equal: ['username', 'pickle'] }],
-            ],
+        it('access request for entity still works when filtering user owned entities manually', async () => {
+            const { bob, alice } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            bobsEntity.acFull = [alice.guid ?? ''];
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const alicesEntity = await TestModel.factory();
+            alicesEntity.name = "Alice's Entity";
+            await alicesEntity.$save();
+            expect(alicesEntity.guid).not.toBeNull();
+            expect(alice.$is(alicesEntity.user)).toEqual(true);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).not.toBeNull();
+            const testWithoutFiltering = await nymph.getEntities({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '|', guid: [alicesEntity.guid || '', bobsEntity.guid || ''] });
+            expect(testWithoutFiltering.length).toEqual(1);
+            expect(testWithoutFiltering[0].guid).toEqual(alicesEntity?.guid || '');
+            const testWithFiltering = await nymph.getEntities({
+                class: TestModel,
+                acRequest: TilmeldAccessRequest.USER_OWNED,
+            }, { type: '|', guid: [alicesEntity.guid || '', bobsEntity.guid || ''] }, { type: '!&', ref: ['user', alice] });
+            expect(testWithFiltering.length).toEqual(0);
+            const testInclusive = await nymph.getEntities({ class: TestModel });
+            const testInclusiveWithFiltering = await nymph.getEntities({ class: TestModel }, { type: '!&', ref: ['user', alice] });
+            expect(testInclusiveWithFiltering.length).toBeGreaterThanOrEqual(1);
+            const guids = testInclusiveWithFiltering.map((entity) => entity.guid);
+            expect(guids).not.toContain(alicesEntity?.guid || '');
+            expect(guids).toContain(bobsEntity?.guid || '');
+            const allDefaultGuids = testInclusive.map((entity) => entity.guid);
+            for (let guid of guids) {
+                expect(allDefaultGuids).toContain(guid);
+            }
         });
-        expect(testEntityAlice).toBeNull();
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            qref: [
-                'acRead',
-                [
-                    { class: User },
-                    { type: '&', equal: ['username', alice.username ?? ''] },
-                ],
-            ],
+        it("access request for invalid access control doesn't return any inaccessible entities", async () => {
+            const { bob, alice, abgroup } = await makeUsers();
+            await tilmeld.fillSession(bob);
+            const bobsEntity = await TestModel.factory();
+            bobsEntity.name = "Bob's Entity";
+            await bobsEntity.$save();
+            expect(bobsEntity.guid).not.toBeNull();
+            expect(bob.$is(bobsEntity.user)).toEqual(true);
+            const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityBob).not.toBeNull();
+            expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+            tilmeld.clearSession();
+            await tilmeld.fillSession(alice);
+            const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testEntityAlice).toBeNull();
+            const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.UNOWNED * 2 }, { type: '&', guid: bobsEntity.guid || '' });
+            expect(testFailureEntityAlice).toBeNull();
         });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(bobsEntity.guid);
-        testEntityAlice = await nymph.getEntity({ class: TestModel }, {
-            type: '&',
-            guid: bobsEntity.guid || '',
-            qref: [
-                'acRead',
-                [{ class: User }, { type: '&', equal: ['username', 'pickle'] }],
-            ],
+        it('delete test data again', async () => {
+            await deleteTestData();
         });
-        expect(testEntityAlice).toBeNull();
-    });
-    it('alice can access an entity with an access request', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(alice);
-        const alicesEntity = await TestModel.factory();
-        alicesEntity.name = "Alice's Entity";
-        expect(await alicesEntity.$save()).toEqual(true);
-        expect(alicesEntity.guid).not.toBeNull();
-        expect(alice.$is(alicesEntity.user)).toEqual(true);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: alicesEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        expect(testEntityAlice?.guid).toEqual(alicesEntity.guid);
-        tilmeld.clearSession();
-    });
-    it("access request for user owned doesn't return group owned entity", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = alice.group;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-        const testSuccessEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.PRIMARY_GROUP_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice).not.toBeNull();
-    });
-    it("access request for user owned doesn't return acOther accessible entity", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acOther = TilmeldAccessLevels.READ_ACCESS;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-        const testSuccessEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.OTHER_ACCESSIBLE }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice).not.toBeNull();
-    });
-    it("access request for user owned doesn't return user acRead accessible entity", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acRead = [alice.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-        const testSuccessEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_ACCESSIBLE }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice).not.toBeNull();
-    });
-    it("access request for user owned doesn't return group acRead accessible entity", async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acWrite = [alice.group?.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-        const testSuccessEntityAlice = await nymph.getEntity({
-            class: TestModel,
-            acRequest: TilmeldAccessRequest.PRIMARY_GROUP_ACCESSIBLE,
-        }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice).not.toBeNull();
-    });
-    it("access request for user owned doesn't return secondary group owned entity", async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.group = abgroup;
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-        const testSuccessEntityAlice = await nymph.getEntity({
-            class: TestModel,
-            acRequest: TilmeldAccessRequest.SECONDARY_GROUP_OWNED,
-        }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice).not.toBeNull();
-    });
-    it("access request for user owned doesn't return secondary group accessible entity", async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acFull = [abgroup.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-        const testSuccessEntityAlice = await nymph.getEntity({
-            class: TestModel,
-            acRequest: TilmeldAccessRequest.SECONDARY_GROUP_ACCESSIBLE,
-        }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice).not.toBeNull();
-        // Test or-ing two levels together.
-        const testSuccessEntityAlice2 = await nymph.getEntity({
-            class: TestModel,
-            acRequest: TilmeldAccessRequest.SECONDARY_GROUP_ACCESSIBLE |
-                TilmeldAccessRequest.PRIMARY_GROUP_ACCESSIBLE,
-        }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testSuccessEntityAlice2).not.toBeNull();
-    });
-    it('access request for entity still works when filtering user owned entities manually', async () => {
-        const { bob, alice } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        bobsEntity.acFull = [alice.guid ?? ''];
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const alicesEntity = await TestModel.factory();
-        alicesEntity.name = "Alice's Entity";
-        expect(await alicesEntity.$save()).toEqual(true);
-        expect(alicesEntity.guid).not.toBeNull();
-        expect(alice.$is(alicesEntity.user)).toEqual(true);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).not.toBeNull();
-        const testWithoutFiltering = await nymph.getEntities({ class: TestModel, acRequest: TilmeldAccessRequest.USER_OWNED }, { type: '|', guid: [alicesEntity.guid || '', bobsEntity.guid || ''] });
-        expect(testWithoutFiltering.length).toEqual(1);
-        expect(testWithoutFiltering[0].guid).toEqual(alicesEntity?.guid || '');
-        const testWithFiltering = await nymph.getEntities({
-            class: TestModel,
-            acRequest: TilmeldAccessRequest.USER_OWNED,
-        }, { type: '|', guid: [alicesEntity.guid || '', bobsEntity.guid || ''] }, { type: '!&', ref: ['user', alice] });
-        expect(testWithFiltering.length).toEqual(0);
-        const testInclusive = await nymph.getEntities({ class: TestModel });
-        const testInclusiveWithFiltering = await nymph.getEntities({ class: TestModel }, { type: '!&', ref: ['user', alice] });
-        expect(testInclusiveWithFiltering.length).toBeGreaterThanOrEqual(1);
-        const guids = testInclusiveWithFiltering.map((entity) => entity.guid);
-        expect(guids).not.toContain(alicesEntity?.guid || '');
-        expect(guids).toContain(bobsEntity?.guid || '');
-        const allDefaultGuids = testInclusive.map((entity) => entity.guid);
-        for (let guid of guids) {
-            expect(allDefaultGuids).toContain(guid);
-        }
-    });
-    it("access request for invalid access control doesn't return any inaccessible entities", async () => {
-        const { bob, alice, abgroup } = await makeUsers();
-        await tilmeld.fillSession(bob);
-        const bobsEntity = await TestModel.factory();
-        bobsEntity.name = "Bob's Entity";
-        expect(await bobsEntity.$save()).toEqual(true);
-        expect(bobsEntity.guid).not.toBeNull();
-        expect(bob.$is(bobsEntity.user)).toEqual(true);
-        const testEntityBob = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityBob).not.toBeNull();
-        expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
-        tilmeld.clearSession();
-        await tilmeld.fillSession(alice);
-        const testEntityAlice = await nymph.getEntity({ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testEntityAlice).toBeNull();
-        const testFailureEntityAlice = await nymph.getEntity({ class: TestModel, acRequest: TilmeldAccessRequest.UNOWNED * 2 }, { type: '&', guid: bobsEntity.guid || '' });
-        expect(testFailureEntityAlice).toBeNull();
-    });
-    it('delete test data again', async () => {
-        await deleteTestData();
     });
 }
 //# sourceMappingURL=testArtifacts.js.map