@nymphjs/tilmeld 1.0.0-beta.121 → 1.0.0-beta.122

package/src/User.testArtifacts.ts

@@ -95,7 +95,7 @@ export function UserTest(
         expect(e).toBeInstanceOf(EntityUniqueConstraintError);
       }
 
-      expect(await newUserA.$deleteSkipAC()).toEqual(true);
+      await newUserA.$deleteSkipAC();
 
       tilmeld.config.generatePrimary = true;
     });
@@ -139,7 +139,7 @@ export function UserTest(
         expect(e).toBeInstanceOf(EntityUniqueConstraintError);
       }
 
-      expect(await newUserA.$deleteSkipAC()).toEqual(true);
+      await newUserA.$deleteSkipAC();
 
       tilmeld.config.generatePrimary = true;
     });
@@ -155,7 +155,7 @@ export function UserTest(
       domainAdmin.$password('password');
       domainAdmin.$grant('tilmeld/domain/example.com/admin');
 
-      expect(await domainAdmin.$saveSkipAC()).toEqual(true);
+      await domainAdmin.$saveSkipAC();
 
       // Log in the domain admin.
       await tilmeld.fillSession(domainAdmin);
@@ -169,13 +169,13 @@ export function UserTest(
       domainUser.name = 'New User';
       domainUser.$password('password');
 
-      expect(await domainUser.$save()).toEqual(true);
+      await domainUser.$save();
 
       tilmeld.clearSession();
 
       for (const user of [domainAdmin, domainUser]) {
         if (user.guid != null) {
-          expect(await user.$deleteSkipAC()).toEqual(true);
+          await user.$deleteSkipAC();
         }
       }
     });
@@ -191,7 +191,7 @@ export function UserTest(
       domainAdmin.$password('password');
       domainAdmin.$grant('tilmeld/domain/example.com/admin');
 
-      expect(await domainAdmin.$saveSkipAC()).toEqual(true);
+      await domainAdmin.$saveSkipAC();
 
       // Log in the domain admin.
       await tilmeld.fillSession(domainAdmin);
@@ -218,7 +218,7 @@ export function UserTest(
 
       for (const user of [domainAdmin, domainUser]) {
         if (user.guid != null) {
-          expect(await user.$deleteSkipAC()).toEqual(true);
+          await user.$deleteSkipAC();
         }
       }
     });

package/src/User.ts

@@ -1,11 +1,13 @@
 import crypto from 'node:crypto';
-import type {
-  Nymph,
-  EntityData,
-  EntityJson,
-  EntityPatch,
-  Selector,
-  SerializedEntityData,
+import {
+  type Nymph,
+  type EntityData,
+  type EntityJson,
+  type EntityPatch,
+  type Selector,
+  type SerializedEntityData,
+  MethodFailedError,
+  HttpError,
 } from '@nymphjs/nymph';
 import { humanSecret, nanoid } from '@nymphjs/guid';
 import type { EmailOptions } from 'email-templates';
@@ -465,7 +467,9 @@ export default class User extends AbleObject<UserData> {
       // Create a unique secret.
       getUser.recoverSecret = humanSecret();
       getUser.recoverSecretDate = Date.now();
-      if (!(await getUser.$saveSkipAC())) {
+      try {
+        await getUser.$saveSkipAC();
+      } catch (e: any) {
         return { result: false, message: "Couldn't save recovery secret." };
       }
 
@@ -554,13 +558,14 @@ export default class User extends AbleObject<UserData> {
     user.$password(data.password);
     delete user.recoverSecret;
     delete user.recoverSecretDate;
-    if (await user.$saveSkipAC()) {
+    try {
+      await user.$saveSkipAC();
       return {
         result: true,
         message:
           'Your password has been reset. You can now log in using your new password.',
       };
-    } else {
+    } catch (e: any) {
       return { result: false, message: 'Error saving new password.' };
     }
   }
@@ -675,20 +680,6 @@ export default class User extends AbleObject<UserData> {
     this.$updateDataProtection();
   }
 
-  $setNymph(nymph: Nymph) {
-    this.$nymph = nymph;
-    if (!this.$asleep()) {
-      if (this.$data.group && this.$data.group.$nymph !== nymph) {
-        this.$data.group.$setNymph(nymph);
-      }
-      for (const group of this.$data.groups ?? []) {
-        if (group && group.$nymph !== nymph) {
-          group.$setNymph(nymph);
-        }
-      }
-    }
-  }
-
   async $getUniques(): Promise<string[]> {
     const tilmeld = enforceTilmeld(this);
     const uniques = [`u:${this.$data.username}`];
@@ -1581,13 +1572,14 @@ export default class User extends AbleObject<UserData> {
     if (data.revokeCurrentTokens) {
       this.$data.revokeTokenDate = Date.now();
     }
-    if (await this.$save()) {
+    try {
+      await this.$save();
       if (data.revokeCurrentTokens) {
         const tilmeld = enforceTilmeld(this);
         await tilmeld.login(this, true);
       }
       return { result: true, message: 'Your password has been changed.' };
-    } else {
+    } catch (e: any) {
       return { result: false, message: "Couldn't save new password." };
     }
   }
@@ -1639,14 +1631,15 @@ export default class User extends AbleObject<UserData> {
 
     this.$data.revokeTokenDate = Date.now();
 
-    if (await this.$save()) {
+    try {
+      await this.$save();
       const tilmeld = enforceTilmeld(this);
       await tilmeld.login(this, true);
       return {
         result: true,
         message: 'You have logged out of all other sessions.',
       };
-    } else {
+    } catch (e: any) {
       return { result: false, message: "Couldn't save revocation date." };
     }
   }
@@ -1766,9 +1759,10 @@ export default class User extends AbleObject<UserData> {
 
     this.$data.totpSecret = data.secret;
 
-    if (await this.$save()) {
+    try {
+      await this.$save();
       return { result: true, message: 'Your two factor secret is now set.' };
-    } else {
+    } catch (e: any) {
       return { result: false, message: "Couldn't save two factor secret." };
     }
   }
@@ -1824,12 +1818,13 @@ export default class User extends AbleObject<UserData> {
 
     delete this.$data.totpSecret;
 
-    if (await this.$save()) {
+    try {
+      await this.$save();
       return {
         result: true,
         message: 'Two factor secret has been removed.',
       };
-    } else {
+    } catch (e: any) {
       return { result: false, message: "Couldn't remove two factor secret." };
     }
   }
@@ -2198,7 +2193,8 @@ export default class User extends AbleObject<UserData> {
         'tilmeld',
         `Registering new user "${this.$data.username}".`,
       );
-      if (await this.$saveSkipAC()) {
+      try {
+        await this.$saveSkipAC();
         this.$nymph.config.debugLog(
           'tilmeld',
           `New user registered "${this.$data.username}".`,
@@ -2266,7 +2262,10 @@ export default class User extends AbleObject<UserData> {
             });
           }
         }
-      } else {
+      } catch (e: any) {
+        if (e instanceof HttpError) {
+          throw e;
+        }
         this.$nymph.config.debugError(
           'tilmeld',
           `Error registering new user "${this.$data.username}".`,
@@ -2307,7 +2306,7 @@ export default class User extends AbleObject<UserData> {
   public async $save() {
     let tilmeld = enforceTilmeld(this);
     if (this.$data.username == null || !this.$data.username.trim().length) {
-      return false;
+      throw new BadUsernameError('Username must not be empty.');
     }
 
     if (
@@ -2673,9 +2672,7 @@ export default class User extends AbleObject<UserData> {
           changed = true;
         }
         if (changed || group.guid == null) {
-          if (!(await group.$saveSkipAC())) {
-            throw Error('Error updating primary group for user.');
-          }
+          await group.$saveSkipAC();
         }
         this.$data.group = group;
       }
@@ -2719,7 +2716,6 @@ export default class User extends AbleObject<UserData> {
       throw e;
     }
 
-    let ret = false;
     let preGuid = this.guid;
     let preCdate = this.cdate;
     let preMdate = this.mdate;
@@ -2732,7 +2728,7 @@ export default class User extends AbleObject<UserData> {
         }
       }
 
-      ret = await super.$save();
+      await super.$save();
     } catch (e: any) {
       await tnymph.rollback(transaction);
       this.guid = preGuid;
@@ -2742,45 +2738,41 @@ export default class User extends AbleObject<UserData> {
       throw e;
     }
 
-    if (ret) {
-      if (sendVerification) {
-        // The email has changed, so send a new verification email.
-        if (!(await this.$sendEmailVerification())) {
-          await tnymph.rollback(transaction);
-          this.guid = preGuid;
-          this.cdate = preCdate;
-          this.mdate = preMdate;
-          this.$setNymph(nymph);
-          throw new Error("Couldn't send verification email.");
-        }
-      }
-
-      this.$descendantGroups = undefined;
-      this.$gatekeeperCache = undefined;
-
-      try {
-        for (let callback of (this.constructor as typeof User)
-          .afterSaveCallbacks) {
-          if (callback) {
-            await callback(this);
-          }
-        }
-      } catch (e: any) {
+    if (sendVerification) {
+      // The email has changed, so send a new verification email.
+      if (!(await this.$sendEmailVerification())) {
         await tnymph.rollback(transaction);
         this.guid = preGuid;
         this.cdate = preCdate;
         this.mdate = preMdate;
         this.$setNymph(nymph);
-        throw e;
+        throw new Error("Couldn't send verification email.");
       }
+    }
 
-      ret = await tnymph.commit(transaction);
-    } else {
+    this.$descendantGroups = undefined;
+    this.$gatekeeperCache = undefined;
+
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .afterSaveCallbacks) {
+        if (callback) {
+          await callback(this);
+        }
+      }
+    } catch (e: any) {
       await tnymph.rollback(transaction);
+      this.guid = preGuid;
+      this.cdate = preCdate;
+      this.mdate = preMdate;
+      this.$setNymph(nymph);
+      throw e;
     }
+
+    const committed = await tnymph.commit(transaction);
     this.$setNymph(nymph);
 
-    if (ret) {
+    if (committed) {
       this.$originalEmail = this.$data.email;
       this.$originalUsername = this.$data.username;
 
@@ -2790,9 +2782,9 @@ export default class User extends AbleObject<UserData> {
         // Update the user in the session cache.
         await tilmeld.fillSession(this);
       }
+    } else {
+      throw new MethodFailedError('Transaction could not be committed.');
     }
-
-    return ret;
   }
 
   /**
@@ -2800,7 +2792,7 @@ export default class User extends AbleObject<UserData> {
    */
   public async $saveSkipAC() {
     this.$skipAcWhenSaving = true;
-    return await this.$save();
+    await this.$save();
   }
 
   public $tilmeldSaveSkipAC() {
@@ -2838,8 +2830,6 @@ export default class User extends AbleObject<UserData> {
     const tnymph = await nymph.startTransaction(transaction);
     this.$setNymph(tnymph);
 
-    let success = false;
-
     try {
       if (!(await this.$refresh())) {
         throw new BadDataError('User could not be refreshed.');
@@ -2871,15 +2861,15 @@ export default class User extends AbleObject<UserData> {
         const $skipAcWhenDeleting = this.$skipAcWhenDeleting;
 
         // Delete the user.
-        success = await super.$delete();
-        if (success) {
-          // Delete the generated group.
-          success = $skipAcWhenDeleting
-            ? await this.$data.group.$deleteSkipAC()
-            : await this.$data.group.$delete();
+        await super.$delete();
+        // Delete the generated group.
+        if ($skipAcWhenDeleting) {
+          await this.$data.group.$deleteSkipAC();
+        } else {
+          await this.$data.group.$delete();
         }
       } else {
-        success = await super.$delete();
+        await super.$delete();
       }
     } catch (e: any) {
       await tnymph.rollback(transaction);
@@ -2887,25 +2877,37 @@ export default class User extends AbleObject<UserData> {
       throw e;
     }
 
-    if (success) {
-      try {
-        for (let callback of (this.constructor as typeof User)
-          .afterDeleteCallbacks) {
-          if (callback) {
-            await callback(this);
-          }
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .afterDeleteCallbacks) {
+        if (callback) {
+          await callback(this);
         }
-      } catch (e: any) {
+      }
+    } catch (e: any) {
+      try {
         await tnymph.rollback(transaction);
-        this.$setNymph(nymph);
-        throw e;
+      } catch (e: any) {
+        nymph.config.debugError(
+          'tilmeld',
+          `Rollback of transaction ${transaction} failed, reason: ${e.message}`,
+        );
       }
-      success = await tnymph.commit(transaction);
-    } else {
-      await tnymph.rollback(transaction);
+      this.$setNymph(nymph);
+      throw e;
+    }
+
+    let committed = false;
+    try {
+      committed = await tnymph.commit(transaction);
+    } catch (e: any) {
+      committed = false;
     }
     this.$setNymph(nymph);
-    return success;
+
+    if (!committed) {
+      throw new MethodFailedError('Transaction could not be committed.');
+    }
   }
 
   /*
@@ -2913,7 +2915,7 @@ export default class User extends AbleObject<UserData> {
    */
   async $deleteSkipAC() {
     this.$skipAcWhenDeleting = true;
-    return await this.$delete();
+    await this.$delete();
   }
 
   $tilmeldDeleteSkipAC() {

package/src/decorators/index.ts

@@ -0,0 +1,2 @@
+export * from './requireAbility.js';
+export * from './requireAuthentication.js';

package/src/decorators/requireAbility.ts

@@ -0,0 +1,26 @@
+import { Entity, HttpError } from '@nymphjs/nymph';
+
+/**
+ * A decorator that checks for an ability before running the method.
+ *
+ * If the logged in user does not have the given ability, the decorator will
+ * cause the method to throw a 403 Forbidden HttpError.
+ *
+ * @param ability The ability to check for.
+ */
+export function requireAbility(ability: string) {
+  return function (
+    target: (...args: any[]) => any,
+    _context: ClassMethodDecoratorContext,
+  ) {
+    return function (this: Entity, ...args: unknown[]) {
+      if (
+        this.$nymph.tilmeld == null ||
+        !this.$nymph.tilmeld.gatekeeper(ability)
+      ) {
+        throw new HttpError('Forbidden', 403);
+      }
+      return target.apply(this, args);
+    };
+  };
+}

package/src/decorators/requireAuthentication.ts

@@ -0,0 +1,19 @@
+import { Entity, HttpError } from '@nymphjs/nymph';
+
+/**
+ * A decorator that checks for authentication before running the method.
+ *
+ * If the user is not logged in, the decorator will cause the method to throw a
+ * 403 Forbidden HttpError.
+ */
+export function requireAuthentication(
+  target: (...args: any[]) => any,
+  _context: ClassMethodDecoratorContext,
+) {
+  return function (this: Entity, ...args: unknown[]) {
+    if (this.$nymph.tilmeld == null || !this.$nymph.tilmeld.gatekeeper()) {
+      throw new HttpError('Forbidden', 403);
+    }
+    return target.apply(this, args);
+  };
+}

package/src/index.ts

@@ -2,6 +2,7 @@ export * from './conf/index.js';
 
 export * from './enforceTilmeld.js';
 
+export * from './decorators/index.js';
 export * from './errors/index.js';
 
 import AbleObject from './AbleObject.js';