@nymphjs/tilmeld 1.0.0-beta.121 → 1.0.0-beta.123

package/dist/Group.js

@@ -1,4 +1,39 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
 import crypto from 'node:crypto';
+import { transaction, transactional, } from '@nymphjs/nymph';
 import { nanoid } from '@nymphjs/guid';
 import { difference, xor } from 'lodash-es';
 import { splitn } from '@sciactive/splitn';
@@ -6,882 +41,844 @@ import { enforceTilmeld } from './enforceTilmeld.js';
 import AbleObject from './AbleObject.js';
 import { AccessControlError, BadDataError, BadEmailError, BadUsernameError, CouldNotChangeDefaultPrimaryGroupError, } from './errors/index.js';
 import UserClass from './User.js';
-/**
- * A user group data model.
- *
- * Written by Hunter Perrin for SciActive.
- *
- * @author Hunter Perrin <hperrin@port87.com>
- * @copyright SciActive Inc
- * @see http://nymph.io/
- */
-export default class Group extends AbleObject {
-    /**
-     * The instance of Tilmeld to use for queries.
-     */
-    static ETYPE = 'tilmeld_group';
-    static class = 'Group';
-    static checkGroupnameCallbacks = [];
-    static beforeSaveCallbacks = [];
-    static afterSaveCallbacks = [];
-    static beforeDeleteCallbacks = [];
-    static afterDeleteCallbacks = [];
-    static DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
-    static DEFAULT_ALLOWLIST_DATA = [];
-    $tags = [];
-    $clientEnabledMethods = [
-        '$checkGroupname',
-        '$checkEmail',
-        '$getAvatar',
-        '$getChildren',
-        '$getDescendants',
-        '$getLevel',
-        '$isDescendant',
-    ];
-    static clientEnabledStaticMethods = [
-        'getPrimaryGroups',
-        'getSecondaryGroups',
-    ];
-    $privateData = [...Group.DEFAULT_PRIVATE_DATA];
-    static searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
-    $allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
-    $allowlistTags = [];
-    /**
-     * This should only be used by the backend.
-     */
-    $skipAcWhenSaving = false;
-    /**
-     * This should only be used by the backend.
-     */
-    $skipAcWhenDeleting = false;
-    /**
-     * Used to save the current groupname for domain admin permissions.
-     */
-    $originalGroupname;
-    static getFTSText(name, value) {
-        if ([
-            'abilities',
-            'parent',
-            'user',
-            'enabled',
-            'defaultPrimary',
-            'defaultSecondary',
-            'unverifiedSecondary',
-        ].indexOf(name) !== -1) {
-            return null;
-        }
-        return super.getFTSText(name, value);
-    }
-    static async factoryGroupname(groupname) {
-        const entity = new this();
-        if (groupname != null) {
-            const entity = await this.nymph.getEntity({
-                class: this,
-            }, {
-                type: '&',
-                ilike: ['groupname', groupname.replace(/([\\%_])/g, (s) => `\\${s}`)],
-            });
-            if (entity != null) {
-                return entity;
+let Group = (() => {
+    let _classSuper = AbleObject;
+    let _instanceExtraInitializers = [];
+    let _$delete_decorators;
+    return class Group extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _$delete_decorators = [transactional];
+            __esDecorate(this, null, _$delete_decorators, { kind: "method", name: "$delete", static: false, private: false, access: { has: obj => "$delete" in obj, get: obj => obj.$delete }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        /**
+         * The instance of Tilmeld to use for queries.
+         */
+        static ETYPE = 'tilmeld_group';
+        static class = 'Group';
+        static checkGroupnameCallbacks = [];
+        static beforeSaveCallbacks = [];
+        static afterSaveCallbacks = [];
+        static beforeDeleteCallbacks = [];
+        static afterDeleteCallbacks = [];
+        static DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
+        static DEFAULT_ALLOWLIST_DATA = [];
+        $tags = (__runInitializers(this, _instanceExtraInitializers), []);
+        $clientEnabledMethods = [
+            '$checkGroupname',
+            '$checkEmail',
+            '$getAvatar',
+            '$getChildren',
+            '$getDescendants',
+            '$getLevel',
+            '$isDescendant',
+        ];
+        static clientEnabledStaticMethods = [
+            'getPrimaryGroups',
+            'getSecondaryGroups',
+        ];
+        $privateData = [...Group.DEFAULT_PRIVATE_DATA];
+        static searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
+        $allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
+        $allowlistTags = [];
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenSaving = false;
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenDeleting = false;
+        /**
+         * Used to save the current groupname for domain admin permissions.
+         */
+        $originalGroupname;
+        static getFTSText(name, value) {
+            if ([
+                'abilities',
+                'parent',
+                'user',
+                'enabled',
+                'defaultPrimary',
+                'defaultSecondary',
+                'unverifiedSecondary',
+            ].indexOf(name) !== -1) {
+                return null;
             }
-        }
-        return entity;
-    }
-    /**
-     * Get all the groups that can be assigned as primary groups.
-     *
-     * @param options The options for an optional search query.
-     * @param selectors The selectors for an optional search query.
-     * @returns An array of the assignable primary groups.
-     */
-    static async getPrimaryGroups(options, selectors) {
-        const tilmeld = enforceTilmeld(this);
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new Error("You don't have permission to do that.");
-        }
-        return await this.getAssignableGroups(tilmeld.config.highestPrimary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
-    }
-    /**
-     * Get all the groups that can be assigned as secondary groups.
-     *
-     * @param options The options for an optional search query.
-     * @param selectors The selectors for an optional search query.
-     * @returns An array of the assignable secondary groups.
-     */
-    static async getSecondaryGroups(options, selectors) {
-        const tilmeld = enforceTilmeld(this);
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new Error("You don't have permission to do that.");
-        }
-        return await this.getAssignableGroups(tilmeld.config.highestSecondary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
-    }
-    static async getAssignableGroups(highestParent, options, selectors) {
-        const tilmeld = enforceTilmeld(this);
-        let assignableGroups = [];
-        if (highestParent === false) {
-            return assignableGroups;
-        }
-        assignableGroups = await this.nymph.getEntities({ ...options, class: tilmeld.Group }, ...selectors);
-        if (highestParent !== true) {
-            assignableGroups = (await Promise.all(assignableGroups.map(async (group) => {
-                let curGroup = group;
-                let parent = curGroup.parent;
-                await parent?.$wake();
-                while (parent != null && parent?.cdate != null) {
-                    if (parent?.guid === highestParent) {
-                        return group;
-                    }
-                    curGroup = parent;
-                    parent = curGroup.parent;
-                    await parent?.$wake();
+            return super.getFTSText(name, value);
+        }
+        static async factoryGroupname(groupname) {
+            const entity = new this();
+            if (groupname != null) {
+                const entity = await this.nymph.getEntity({
+                    class: this,
+                }, {
+                    type: '&',
+                    ilike: ['groupname', groupname.replace(/([\\%_])/g, (s) => `\\${s}`)],
+                });
+                if (entity != null) {
+                    return entity;
                 }
-                return null;
-            }))).filter((group) => group != null);
-        }
-        return assignableGroups;
-    }
-    constructor() {
-        super();
-        // Defaults.
-        this.$data.enabled = true;
-        this.$data.abilities = [];
-        this.$updateDataProtection();
-    }
-    $setNymph(nymph) {
-        this.$nymph = nymph;
-        if (!this.$asleep()) {
-            if (this.$data.user && this.$data.user.$nymph !== nymph) {
-                this.$data.user.$setNymph(nymph);
             }
-            if (this.$data.parent && this.$data.parent.$nymph !== nymph) {
-                this.$data.parent.$setNymph(nymph);
+            return entity;
+        }
+        /**
+         * Get all the groups that can be assigned as primary groups.
+         *
+         * @param options The options for an optional search query.
+         * @param selectors The selectors for an optional search query.
+         * @returns An array of the assignable primary groups.
+         */
+        static async getPrimaryGroups(options, selectors) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new Error("You don't have permission to do that.");
+            }
+            return await this.getAssignableGroups(tilmeld.config.highestPrimary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        }
+        /**
+         * Get all the groups that can be assigned as secondary groups.
+         *
+         * @param options The options for an optional search query.
+         * @param selectors The selectors for an optional search query.
+         * @returns An array of the assignable secondary groups.
+         */
+        static async getSecondaryGroups(options, selectors) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new Error("You don't have permission to do that.");
+            }
+            return await this.getAssignableGroups(tilmeld.config.highestSecondary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        }
+        static async getAssignableGroups(highestParent, options, selectors) {
+            const tilmeld = enforceTilmeld(this);
+            let assignableGroups = [];
+            if (highestParent === false) {
+                return assignableGroups;
+            }
+            assignableGroups = await this.nymph.getEntities({ ...options, class: tilmeld.Group }, ...selectors);
+            if (highestParent !== true) {
+                assignableGroups = (await Promise.all(assignableGroups.map(async (group) => {
+                    let curGroup = group;
+                    let parent = curGroup.parent;
+                    await parent?.$wake();
+                    while (parent != null && parent?.cdate != null) {
+                        if (parent?.guid === highestParent) {
+                            return group;
+                        }
+                        curGroup = parent;
+                        parent = curGroup.parent;
+                        await parent?.$wake();
+                    }
+                    return null;
+                }))).filter((group) => group != null);
             }
+            return assignableGroups;
         }
-    }
-    async $getUniques() {
-        const tilmeld = enforceTilmeld(this);
-        const uniques = [`u:${this.$data.groupname}`];
-        if (!tilmeld.config.emailUsernames &&
-            tilmeld.config.userFields.includes('email')) {
-            uniques.push(`e:${this.$data.email}`);
-        }
-        if (this.$data.defaultPrimary) {
-            uniques.push(`o:default-primary`);
-        }
-        return uniques;
-    }
-    $getAvatar() {
-        if (this.$data.avatar != null && this.$data.avatar !== '') {
-            return this.$data.avatar;
-        }
-        if (this.$data.email == null || !this.$data.email.length) {
-            return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
-        }
-        return ('https://secure.gravatar.com/avatar/' +
-            crypto
-                .createHash('sha256')
-                .update(this.$data.email.trim().toLowerCase())
-                .digest('hex')
-                .toLowerCase() +
-            '?d=identicon&s=40');
-    }
-    $jsonAcceptData(input, allowConflict = false) {
-        this.$check();
-        if ('abilities' in input.data) {
-            this.$checkIncomingAbilities(input.data.abilities);
-        }
-        super.$jsonAcceptData(input, allowConflict);
-    }
-    $jsonAcceptPatch(patch, allowConflict = false) {
-        this.$check();
-        if ('abilities' in patch.set) {
-            this.$checkIncomingAbilities(patch.set.abilities);
-        }
-        super.$jsonAcceptPatch(patch, allowConflict);
-    }
-    $checkIncomingAbilities(incoming) {
-        const tilmeld = enforceTilmeld(this);
-        if (!Array.isArray(incoming) ||
-            incoming.find((ability) => typeof ability !== 'string')) {
-            throw new BadDataError('Abilities must be an array of strings.');
-        }
-        if (incoming.includes('system/admin') !==
-            this.$data.abilities?.includes('system/admin') &&
-            (!tilmeld.currentUser ||
-                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
-            throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
-        }
-        if (incoming.includes('tilmeld/admin') !==
-            this.$data.abilities?.includes('tilmeld/admin') &&
-            (!tilmeld.currentUser ||
-                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
-            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
-        }
-        if (incoming.includes('tilmeld/switch') !==
-            this.$data.abilities?.includes('tilmeld/switch') &&
-            (!tilmeld.currentUser ||
-                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
-            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
-        }
-        if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.$data.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ?? []).length &&
-            (!tilmeld.currentUser ||
-                (!tilmeld.currentUser.abilities?.includes('system/admin') &&
-                    !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
-            throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
-        }
-    }
-    $putData(data, sdata, source) {
-        super.$putData(data, sdata, source);
-        // TODO: Fix these being added by the drivers.
-        // @ts-ignore
-        delete this.$data.acRead;
-        // @ts-ignore
-        delete this.$data.acWrite;
-        // @ts-ignore
-        delete this.$data.acFull;
-        if (source === 'server') {
-            this.$originalGroupname = this.$data.groupname;
-        }
-        this.$updateDataProtection();
-    }
-    /**
-     * Update the data protection arrays for a user.
-     *
-     * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
-     */
-    $updateDataProtection(givenUser) {
-        const tilmeld = enforceTilmeld(this);
-        let user = givenUser ?? tilmeld.User.current();
-        let [_groupname, domain] = tilmeld.config.domainSupport
-            ? splitn(this.$data.groupname ?? '', '@', 2)
-            : [this.$data.groupname, null];
-        // Lowercase the domain part.
-        if (domain) {
-            domain = domain.toLowerCase();
-        }
-        this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
-        if (tilmeld.config.emailUsernames) {
-            this.$privateData.push('groupname');
-        }
-        if (user != null &&
-            (user.abilities?.includes('tilmeld/admin') ||
-                user.abilities?.includes('system/admin'))) {
-            // Users who can edit groups can see their data.
-            this.$privateData = [];
-            this.$allowlistData = undefined;
-        }
-        else if (this.$data.user != null &&
-            user != null &&
-            this.$data.user.guid === user.guid) {
-            // Users can see their group's data.
-            this.$privateData = [];
-        }
-        else if (user != null &&
-            tilmeld.config.domainSupport &&
-            domain &&
-            user.abilities?.includes(`tilmeld/domain/${domain}/admin`)) {
-            // Domain admins can see their groups' data.
-            this.$privateData = [];
-        }
-    }
-    /**
-     * Check whether the group is a descendant of a group.
-     *
-     * @param group The group, or the group's GUID.
-     * @returns True or false.
-     */
-    async $isDescendant(givenGroup) {
-        const tilmeld = enforceTilmeld(this);
-        let group;
-        if (typeof givenGroup === 'string') {
-            group = await tilmeld.Group.factory(givenGroup);
-        }
-        else {
-            group = givenGroup;
-        }
-        if (group.guid == null) {
-            return false;
-        }
-        // Check to see if the group is a descendant of the given group.
-        const parent = this.$data.parent;
-        await parent?.$wake();
-        if (parent == null) {
-            return false;
-        }
-        if (parent.$is(group)) {
-            return true;
-        }
-        if (await parent.$isDescendant(group)) {
-            return true;
-        }
-        return false;
-    }
-    /**
-     * Gets an array of the group's child groups.
-     *
-     * @returns An array of groups.
-     */
-    async $getChildren() {
-        const tilmeld = enforceTilmeld(this);
-        return await this.$nymph.getEntities({ class: tilmeld.Group }, {
-            type: '&',
-            equal: ['enabled', true],
-            ref: ['parent', this],
-        });
-    }
-    /**
-     * Gets an array of the group's descendant groups.
-     *
-     * @param andSelf Include this group in the returned array.
-     * @returns An array of groups.
-     */
-    async $getDescendants(andSelf = false) {
-        const tilmeld = enforceTilmeld(this);
-        let groups = [];
-        const entities = await this.$nymph.getEntities({ class: tilmeld.Group }, {
-            type: '&',
-            equal: ['enabled', true],
-            ref: ['parent', this],
-        });
-        for (let entity of entities) {
-            groups = (await entity.$getDescendants(true)).concat(groups);
-        }
-        if (andSelf) {
-            groups.push(this);
-        }
-        return groups;
-    }
-    /**
-     * Get the number of parents the group has.
-     *
-     * If the group is a top level group, this will return 0. If it is a child of
-     * a top level group, this will return 1. If it is a grandchild of a top level
-     * group, this will return 2, and so on.
-     *
-     * Levels will max out at 1024 to avoid recursive loops.
-     *
-     * @returns The level of the group.
-     */
-    async $getLevel() {
-        const tilmeld = enforceTilmeld(this);
-        let group = await tilmeld.Group.factory(this.guid ?? undefined);
-        let parent = group.parent;
-        await parent?.$wake();
-        let level = 0;
-        while (parent != null && parent.cdate != null && level < 1024) {
-            level++;
-            group = parent;
-            parent = group.parent;
-            await parent?.$wake();
-        }
-        return level;
-    }
-    /**
-     * Gets an array of users in the group.
-     *
-     * @param descendants Include users in all descendant groups too.
-     * @param limit The limit for the query.
-     * @param offset The offset for the query.
-     * @returns An array of users.
-     */
-    async $getUsers(descendants = false, limit, offset) {
-        const tilmeld = enforceTilmeld(this);
-        let groups = [];
-        if (descendants) {
-            groups = await this.$getDescendants();
-        }
-        return await this.$nymph.getEntities({
-            class: tilmeld.User,
-            limit,
-            offset,
-        }, {
-            type: '&',
-            equal: ['enabled', true],
-        }, {
-            type: '|',
-            ref: [
-                ['group', this],
-                ['groups', this],
-                ...groups.map((group) => [
-                    'group',
-                    group,
-                ]),
-                ...groups.map((group) => [
-                    'groups',
-                    group,
-                ]),
-            ],
-        });
-    }
-    /**
-     * Check that a groupname is valid.
-     *
-     * @returns An object with a boolean 'result' entry and a 'message' entry.
-     */
-    async $checkGroupname() {
-        const tilmeld = enforceTilmeld(this);
-        if (!tilmeld.config.emailUsernames) {
-            let [groupname, domain] = tilmeld.config.domainSupport
+        constructor() {
+            super();
+            // Defaults.
+            this.$data.enabled = true;
+            this.$data.abilities = [];
+            this.$updateDataProtection();
+        }
+        async $getUniques() {
+            const tilmeld = enforceTilmeld(this);
+            const uniques = [`u:${this.$data.groupname}`];
+            if (!tilmeld.config.emailUsernames &&
+                tilmeld.config.userFields.includes('email')) {
+                uniques.push(`e:${this.$data.email}`);
+            }
+            if (this.$data.defaultPrimary) {
+                uniques.push(`o:default-primary`);
+            }
+            return uniques;
+        }
+        $getAvatar() {
+            if (this.$data.avatar != null && this.$data.avatar !== '') {
+                return this.$data.avatar;
+            }
+            if (this.$data.email == null || !this.$data.email.length) {
+                return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
+            }
+            return ('https://secure.gravatar.com/avatar/' +
+                crypto
+                    .createHash('sha256')
+                    .update(this.$data.email.trim().toLowerCase())
+                    .digest('hex')
+                    .toLowerCase() +
+                '?d=identicon&s=40');
+        }
+        $jsonAcceptData(input, allowConflict = false) {
+            this.$check();
+            if ('abilities' in input.data) {
+                this.$checkIncomingAbilities(input.data.abilities);
+            }
+            super.$jsonAcceptData(input, allowConflict);
+        }
+        $jsonAcceptPatch(patch, allowConflict = false) {
+            this.$check();
+            if ('abilities' in patch.set) {
+                this.$checkIncomingAbilities(patch.set.abilities);
+            }
+            super.$jsonAcceptPatch(patch, allowConflict);
+        }
+        $checkIncomingAbilities(incoming) {
+            const tilmeld = enforceTilmeld(this);
+            if (!Array.isArray(incoming) ||
+                incoming.find((ability) => typeof ability !== 'string')) {
+                throw new BadDataError('Abilities must be an array of strings.');
+            }
+            if (incoming.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
+            }
+            if (incoming.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+            }
+            if (incoming.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
+            }
+            if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.$data.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ?? []).length &&
+                (!tilmeld.currentUser ||
+                    (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+                        !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
+                throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
+            }
+        }
+        $putData(data, sdata, source) {
+            super.$putData(data, sdata, source);
+            // TODO: Fix these being added by the drivers.
+            // @ts-ignore
+            delete this.$data.acRead;
+            // @ts-ignore
+            delete this.$data.acWrite;
+            // @ts-ignore
+            delete this.$data.acFull;
+            if (source === 'server') {
+                this.$originalGroupname = this.$data.groupname;
+            }
+            this.$updateDataProtection();
+        }
+        /**
+         * Update the data protection arrays for a user.
+         *
+         * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+         */
+        $updateDataProtection(givenUser) {
+            const tilmeld = enforceTilmeld(this);
+            let user = givenUser ?? tilmeld.User.current();
+            let [_groupname, domain] = tilmeld.config.domainSupport
                 ? splitn(this.$data.groupname ?? '', '@', 2)
                 : [this.$data.groupname, null];
             // Lowercase the domain part.
             if (domain) {
                 domain = domain.toLowerCase();
-                this.$data.groupname = `${groupname}@${domain}`;
             }
-            if (this.$data.groupname == null ||
-                !this.$data.groupname.length ||
-                groupname == null ||
-                !groupname.length) {
-                return { result: false, message: 'Please specify a groupname.' };
+            this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
+            this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
+            if (tilmeld.config.emailUsernames) {
+                this.$privateData.push('groupname');
+            }
+            if (user != null &&
+                (user.abilities?.includes('tilmeld/admin') ||
+                    user.abilities?.includes('system/admin'))) {
+                // Users who can edit groups can see their data.
+                this.$privateData = [];
+                this.$allowlistData = undefined;
+            }
+            else if (this.$data.user != null &&
+                user != null &&
+                this.$data.user.guid === user.guid) {
+                // Users can see their group's data.
+                this.$privateData = [];
+            }
+            else if (user != null &&
+                tilmeld.config.domainSupport &&
+                domain &&
+                user.abilities?.includes(`tilmeld/domain/${domain}/admin`)) {
+                // Domain admins can see their groups' data.
+                this.$privateData = [];
+            }
+        }
+        /**
+         * Check whether the group is a descendant of the given group.
+         *
+         * @param group The group, or the group's GUID.
+         * @returns True or false.
+         */
+        async $isDescendant(givenGroup) {
+            const tilmeld = enforceTilmeld(this);
+            let group;
+            if (typeof givenGroup === 'string') {
+                group = await tilmeld.Group.factory(givenGroup);
             }
-            if (groupname.length < tilmeld.config.minUsernameLength) {
-                return {
-                    result: false,
-                    message: 'Groupnames must be at least ' +
-                        tilmeld.config.minUsernameLength +
-                        ' characters.',
-                };
+            else {
+                group = givenGroup;
             }
-            if (groupname.length > tilmeld.config.maxUsernameLength) {
-                return {
-                    result: false,
-                    message: 'Groupnames must not exceed ' +
-                        tilmeld.config.maxUsernameLength +
-                        ' characters.',
-                };
+            if (group.guid == null) {
+                return false;
             }
-            if (difference(groupname.split(''), tilmeld.config.validChars.split(''))
-                .length) {
-                return {
-                    result: false,
-                    message: tilmeld.config.validCharsNotice,
-                };
+            // Check to see if the group is a descendant of the given group.
+            const parent = this.$data.parent;
+            await parent?.$wake();
+            if (parent == null) {
+                return false;
+            }
+            if (parent.$is(group)) {
+                return true;
+            }
+            if (await parent.$isDescendant(group)) {
+                return true;
+            }
+            return false;
+        }
+        /**
+         * Gets an array of the group's child groups.
+         *
+         * @returns An array of groups.
+         */
+        async $getChildren() {
+            const tilmeld = enforceTilmeld(this);
+            return await this.$nymph.getEntities({ class: tilmeld.Group }, {
+                type: '&',
+                equal: ['enabled', true],
+                ref: ['parent', this],
+            });
+        }
+        /**
+         * Gets an array of the group's descendant groups.
+         *
+         * @param andSelf Include this group in the returned array.
+         * @param andDisabled Include disabled groups.
+         * @returns An array of groups.
+         */
+        async $getDescendants(andSelf = false, andDisabled = false) {
+            const tilmeld = enforceTilmeld(this);
+            let groups = [];
+            const entities = await this.$nymph.getEntities({ class: tilmeld.Group }, {
+                type: '&',
+                ...(andDisabled ? {} : { equal: ['enabled', true] }),
+                ref: ['parent', this],
+            });
+            for (let entity of entities) {
+                groups = (await entity.$getDescendants(true)).concat(groups);
+            }
+            if (andSelf) {
+                groups.push(this);
+            }
+            return groups;
+        }
+        /**
+         * Get the number of parents the group has.
+         *
+         * If the group is a top level group, this will return 0. If it is a child of
+         * a top level group, this will return 1. If it is a grandchild of a top level
+         * group, this will return 2, and so on.
+         *
+         * Levels will max out at 1024 to avoid recursive loops.
+         *
+         * @returns The level of the group.
+         */
+        async $getLevel() {
+            const tilmeld = enforceTilmeld(this);
+            let group = await tilmeld.Group.factory(this.guid ?? undefined);
+            let parent = group.parent;
+            await parent?.$wake();
+            let level = 0;
+            while (parent != null && parent.cdate != null && level < 1024) {
+                level++;
+                group = parent;
+                parent = group.parent;
+                await parent?.$wake();
             }
-            if (!tilmeld.config.validRegex.test(groupname)) {
+            return level;
+        }
+        /**
+         * Gets an array of enabled users in the group.
+         *
+         * @param descendants Include users in all descendant groups too.
+         * @param limit The limit for the query.
+         * @param offset The offset for the query.
+         * @returns An array of users.
+         */
+        async $getUsers(descendants = false, limit, offset) {
+            const tilmeld = enforceTilmeld(this);
+            let groups = [];
+            if (descendants) {
+                groups = await this.$getDescendants();
+            }
+            return await this.$nymph.getEntities({
+                class: tilmeld.User,
+                limit,
+                offset,
+            }, { type: '&', equal: ['enabled', true] }, {
+                type: '|',
+                ref: [
+                    ['group', this],
+                    ['groups', this],
+                    ...groups.map((group) => [
+                        'group',
+                        group,
+                    ]),
+                    ...groups.map((group) => [
+                        'groups',
+                        group,
+                    ]),
+                ],
+            });
+        }
+        /**
+         * Check that a groupname is valid.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkGroupname() {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.config.emailUsernames) {
+                let [groupname, domain] = tilmeld.config.domainSupport
+                    ? splitn(this.$data.groupname ?? '', '@', 2)
+                    : [this.$data.groupname, null];
+                // Lowercase the domain part.
+                if (domain) {
+                    domain = domain.toLowerCase();
+                    this.$data.groupname = `${groupname}@${domain}`;
+                }
+                if (this.$data.groupname == null ||
+                    !this.$data.groupname.length ||
+                    groupname == null ||
+                    !groupname.length) {
+                    return { result: false, message: 'Please specify a groupname.' };
+                }
+                if (groupname.length < tilmeld.config.minUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Groupnames must be at least ' +
+                            tilmeld.config.minUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (groupname.length > tilmeld.config.maxUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Groupnames must not exceed ' +
+                            tilmeld.config.maxUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (difference(groupname.split(''), tilmeld.config.validChars.split(''))
+                    .length) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validCharsNotice,
+                    };
+                }
+                if (!tilmeld.config.validRegex.test(groupname)) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validRegexNotice,
+                    };
+                }
+                if (domain != null) {
+                    if (!tilmeld.config.validDomainRegex.test(domain)) {
+                        return {
+                            result: false,
+                            message: tilmeld.config.validDomainRegexNotice,
+                        };
+                    }
+                    if (!this.$is(tilmeld.currentUser?.group) &&
+                        !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                        return {
+                            result: false,
+                            message: "You don't have the authority to manage groups on this domain.",
+                        };
+                    }
+                }
+                const selector = {
+                    type: '&',
+                    ilike: [
+                        'groupname',
+                        this.$data.groupname.replace(/([\\%_])/g, (s) => `\\${s}`),
+                    ],
+                };
+                if (this.guid != null) {
+                    selector['!guid'] = this.guid;
+                }
+                const test = await this.$nymph.getEntity({ class: tilmeld.Group, skipAc: true }, selector);
+                if (test != null) {
+                    return { result: false, message: 'That groupname is taken.' };
+                }
+                for (let callback of this.constructor
+                    .checkGroupnameCallbacks) {
+                    if (callback) {
+                        const result = await callback(this, {
+                            groupname: this.$data.groupname,
+                        });
+                        if (!result.result) {
+                            return { message: 'Groupname is not available.', ...result };
+                        }
+                    }
+                }
                 return {
-                    result: false,
-                    message: tilmeld.config.validRegexNotice,
+                    result: true,
+                    message: this.guid != null ? 'Groupname is valid.' : 'Groupname is available!',
                 };
             }
-            if (domain != null) {
-                if (!tilmeld.config.validDomainRegex.test(domain)) {
+            else {
+                this.$data.email = this.$data.groupname;
+                if (this.$data.groupname == null || !this.$data.groupname.length) {
+                    return { result: false, message: 'Please specify an email.' };
+                }
+                if (this.$data.groupname.length < tilmeld.config.minUsernameLength) {
                     return {
                         result: false,
-                        message: tilmeld.config.validDomainRegexNotice,
+                        message: 'Emails must be at least ' +
+                            tilmeld.config.minUsernameLength +
+                            ' characters.',
                     };
                 }
-                if (!this.$is(tilmeld.currentUser?.group) &&
-                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                if (this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
                     return {
                         result: false,
-                        message: "You don't have the authority to manage groups on this domain.",
+                        message: 'Emails must not exceed ' +
+                            tilmeld.config.maxUsernameLength +
+                            ' characters.',
                     };
                 }
+                return await this.$checkEmail();
+            }
+        }
+        /**
+         * Check that an email is unique.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkEmail() {
+            const tilmeld = enforceTilmeld(this);
+            if (this.$data.email === '') {
+                return { result: true, message: '' };
+            }
+            if (this.$data.email == null) {
+                return { result: false, message: 'Please specify a valid email.' };
+            }
+            if (!tilmeld.config.validEmailRegex.test(this.$data.email)) {
+                return {
+                    result: false,
+                    message: tilmeld.config.validEmailRegexNotice,
+                };
             }
             const selector = {
                 type: '&',
-                ilike: [
-                    'groupname',
-                    this.$data.groupname.replace(/([\\%_])/g, (s) => `\\${s}`),
-                ],
+                ilike: ['email', this.$data.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
             };
             if (this.guid != null) {
                 selector['!guid'] = this.guid;
             }
             const test = await this.$nymph.getEntity({ class: tilmeld.Group, skipAc: true }, selector);
             if (test != null) {
-                return { result: false, message: 'That groupname is taken.' };
-            }
-            for (let callback of this.constructor
-                .checkGroupnameCallbacks) {
-                if (callback) {
-                    const result = await callback(this, {
-                        groupname: this.$data.groupname,
-                    });
-                    if (!result.result) {
-                        return { message: 'Groupname is not available.', ...result };
-                    }
-                }
-            }
-            return {
-                result: true,
-                message: this.guid != null ? 'Groupname is valid.' : 'Groupname is available!',
-            };
-        }
-        else {
-            this.$data.email = this.$data.groupname;
-            if (this.$data.groupname == null || !this.$data.groupname.length) {
-                return { result: false, message: 'Please specify an email.' };
-            }
-            if (this.$data.groupname.length < tilmeld.config.minUsernameLength) {
                 return {
                     result: false,
-                    message: 'Emails must be at least ' +
-                        tilmeld.config.minUsernameLength +
-                        ' characters.',
+                    message: 'That email address is already registered.',
                 };
             }
-            if (this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
-                return {
-                    result: false,
-                    message: 'Emails must not exceed ' +
-                        tilmeld.config.maxUsernameLength +
-                        ' characters.',
-                };
-            }
-            return await this.$checkEmail();
-        }
-    }
-    /**
-     * Check that an email is unique.
-     *
-     * @returns An object with a boolean 'result' entry and a 'message' entry.
-     */
-    async $checkEmail() {
-        const tilmeld = enforceTilmeld(this);
-        if (this.$data.email === '') {
-            return { result: true, message: '' };
-        }
-        if (this.$data.email == null) {
-            return { result: false, message: 'Please specify a valid email.' };
-        }
-        if (!tilmeld.config.validEmailRegex.test(this.$data.email)) {
-            return {
-                result: false,
-                message: tilmeld.config.validEmailRegexNotice,
-            };
-        }
-        const selector = {
-            type: '&',
-            ilike: ['email', this.$data.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        };
-        if (this.guid != null) {
-            selector['!guid'] = this.guid;
-        }
-        const test = await this.$nymph.getEntity({ class: tilmeld.Group, skipAc: true }, selector);
-        if (test != null) {
             return {
-                result: false,
-                message: 'That email address is already registered.',
+                result: true,
+                message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
             };
         }
-        return {
-            result: true,
-            message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
-        };
-    }
-    async $save() {
-        let tilmeld = enforceTilmeld(this);
-        if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
-            return false;
-        }
-        // Lowercase the domain part.
-        if (tilmeld.config.domainSupport) {
-            const [groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
-            if (domain) {
-                this.$data.groupname = `${groupname}@${domain.toLowerCase()}`;
+        async $save() {
+            let tilmeld = enforceTilmeld(this);
+            if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
+                throw new BadUsernameError('Groupname must not be empty.');
             }
-        }
-        if (tilmeld.config.domainSupport) {
-            const [_groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
-            const [_originalGroupname, originalDomain] = splitn(this.$originalGroupname ?? '', '@', 2);
-            if (this.guid != null &&
-                ((originalDomain == null && domain != null) ||
-                    (domain == null && originalDomain != null))) {
-                throw new AccessControlError("Groups can't switch to or from having a domain once created.");
-            }
-            if (!this.$skipAcWhenSaving &&
-                !tilmeld.gatekeeper('tilmeld/admin') &&
-                !tilmeld.gatekeeper('system/admin')) {
-                if (domain != null &&
-                    !this.$is(tilmeld.currentUser) &&
-                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
-                    throw new AccessControlError("You don't have the authority to modify groups on this domain.");
-                }
-                if (originalDomain != null &&
-                    originalDomain !== domain &&
-                    (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
-                        !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
-                    throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+            // Lowercase the domain part.
+            if (tilmeld.config.domainSupport) {
+                const [groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+                if (domain) {
+                    this.$data.groupname = `${groupname}@${domain.toLowerCase()}`;
                 }
             }
-        }
-        // Formatting.
-        this.$data.groupname = this.$data.groupname.trim();
-        if (tilmeld.config.emailUsernames) {
-            this.$data.email = this.$data.groupname;
-        }
-        this.$data.email = (this.$data.email ?? '').trim();
-        this.$data.name = (this.$data.name ?? '').trim();
-        this.$data.phone = (this.$data.phone ?? '').trim();
-        this.$data.enabled = !!this.$data.enabled;
-        // Clear empty values.
-        if (this.$data.name === '' || !tilmeld.config.userFields.includes('name')) {
-            delete this.$data.name;
-        }
-        if (this.$data.email === '' ||
-            !tilmeld.config.userFields.includes('email')) {
-            delete this.$data.email;
-        }
-        if (this.$data.avatar === '') {
-            delete this.$data.avatar;
-        }
-        if (this.$data.phone === '' ||
-            !tilmeld.config.userFields.includes('phone')) {
-            delete this.$data.phone;
-        }
-        if (this.$data.parent == null) {
-            delete this.$data.parent;
-        }
-        if (this.$data.user == null) {
-            delete this.$data.user;
-        }
-        if (!this.$data.defaultPrimary) {
-            delete this.$data.defaultPrimary;
-        }
-        if (!this.$data.defaultSecondary) {
-            delete this.$data.defaultSecondary;
-        }
-        if (!this.$data.unverifiedSecondary) {
-            delete this.$data.unverifiedSecondary;
-        }
-        // Groups should never have 'system/admin', 'tilmeld/admin',
-        // 'tilmeld/switch', or domain admin abilities.
-        this.$data.abilities = (this.$data.abilities ?? []).filter((ability) => {
-            if (['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
-                -1) {
-                return false;
+            if (tilmeld.config.domainSupport) {
+                const [_groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+                const [_originalGroupname, originalDomain] = splitn(this.$originalGroupname ?? '', '@', 2);
+                if (this.guid != null &&
+                    ((originalDomain == null && domain != null) ||
+                        (domain == null && originalDomain != null))) {
+                    throw new AccessControlError("Groups can't switch to or from having a domain once created.");
+                }
+                if (!this.$skipAcWhenSaving &&
+                    !tilmeld.gatekeeper('tilmeld/admin') &&
+                    !tilmeld.gatekeeper('system/admin')) {
+                    if (domain != null &&
+                        !this.$is(tilmeld.currentUser) &&
+                        !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                        throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+                    }
+                    if (originalDomain != null &&
+                        originalDomain !== domain &&
+                        (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+                            !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
+                        throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+                    }
+                }
             }
-            if (ability == null) {
-                return false;
+            // Formatting.
+            this.$data.groupname = this.$data.groupname.trim();
+            if (tilmeld.config.emailUsernames) {
+                this.$data.email = this.$data.groupname;
             }
-            if (ability.startsWith('tilmeld/domain/') && ability.endsWith('/admin')) {
-                return false;
+            this.$data.email = (this.$data.email ?? '').trim();
+            this.$data.name = (this.$data.name ?? '').trim();
+            this.$data.phone = (this.$data.phone ?? '').trim();
+            this.$data.enabled = !!this.$data.enabled;
+            // Clear empty values.
+            if (this.$data.name === '' || !tilmeld.config.userFields.includes('name')) {
+                delete this.$data.name;
             }
-            return true;
-        });
-        // Verification.
-        const unCheck = await this.$checkGroupname();
-        if (!unCheck.result) {
-            throw new BadUsernameError(unCheck.message);
-        }
-        if (!tilmeld.config.emailUsernames &&
-            tilmeld.config.userFields.includes('email')) {
-            const emCheck = await this.$checkEmail();
-            if (!emCheck.result) {
-                throw new BadEmailError(emCheck.message);
+            if (this.$data.email === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.$data.email;
             }
-        }
-        // Validate group parent. Make sure it's not a descendant of this group.
-        const parent = this.$data.parent;
-        await parent?.$wake();
-        if (parent &&
-            (parent.cdate == null ||
-                this.$is(parent) ||
-                (await parent.$isDescendant(this)))) {
-            throw new BadDataError("Group parent can't be itself or descendant of itself.");
-        }
-        try {
-            tilmeld.config.validatorGroup(tilmeld, this);
-        }
-        catch (e) {
-            throw new BadDataError(e?.message);
-        }
-        // Only one default primary group is allowed.
-        if (this.$data.defaultPrimary) {
-            const currentPrimary = await this.$nymph.getEntity({ class: tilmeld.Group }, { type: '&', truthy: 'defaultPrimary' });
-            if (currentPrimary != null && !this.$is(currentPrimary)) {
-                currentPrimary.defaultPrimary = false;
-                if (this.$skipAcWhenSaving
-                    ? !(await currentPrimary.$saveSkipAC())
-                    : !(await currentPrimary.$save())) {
-                    throw new CouldNotChangeDefaultPrimaryGroupError('Could not change new user primary group from ' +
-                        `${currentPrimary.groupname}.`);
-                }
+            if (this.$data.avatar === '') {
+                delete this.$data.avatar;
             }
-        }
-        const transaction = 'tilmeld-save-group-' + (this.guid || nanoid());
-        const nymph = this.$nymph;
-        const tnymph = await nymph.startTransaction(transaction);
-        this.$setNymph(tnymph);
-        tilmeld = enforceTilmeld(this);
-        let preGuid = this.guid;
-        let preCdate = this.cdate;
-        let preMdate = this.mdate;
-        try {
-            for (let callback of this.constructor
-                .beforeSaveCallbacks) {
-                if (callback) {
-                    await callback(this);
-                }
+            if (this.$data.phone === '' ||
+                !tilmeld.config.userFields.includes('phone')) {
+                delete this.$data.phone;
             }
-            let ret = await super.$save();
-            if (ret) {
-                this.$originalGroupname = this.$data.groupname;
+            if (this.$data.parent == null) {
+                delete this.$data.parent;
             }
-            for (let callback of this.constructor
-                .afterSaveCallbacks) {
-                if (callback) {
-                    await callback(this);
+            if (this.$data.user == null) {
+                delete this.$data.user;
+            }
+            if (!this.$data.defaultPrimary) {
+                delete this.$data.defaultPrimary;
+            }
+            if (!this.$data.defaultSecondary) {
+                delete this.$data.defaultSecondary;
+            }
+            if (!this.$data.unverifiedSecondary) {
+                delete this.$data.unverifiedSecondary;
+            }
+            // Groups should never have 'system/admin', 'tilmeld/admin',
+            // 'tilmeld/switch', or domain admin abilities.
+            this.$data.abilities = (this.$data.abilities ?? []).filter((ability) => {
+                if (['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
+                    -1) {
+                    return false;
+                }
+                if (ability == null) {
+                    return false;
+                }
+                if (ability.startsWith('tilmeld/domain/') && ability.endsWith('/admin')) {
+                    return false;
+                }
+                return true;
+            });
+            // Verification.
+            const unCheck = await this.$checkGroupname();
+            if (!unCheck.result) {
+                throw new BadUsernameError(unCheck.message);
+            }
+            if (!tilmeld.config.emailUsernames &&
+                tilmeld.config.userFields.includes('email')) {
+                const emCheck = await this.$checkEmail();
+                if (!emCheck.result) {
+                    throw new BadEmailError(emCheck.message);
                 }
             }
-            ret = await tnymph.commit(transaction);
-            this.$setNymph(nymph);
-            return ret;
-        }
-        catch (e) {
-            await tnymph.rollback(transaction);
-            this.guid = preGuid;
-            this.cdate = preCdate;
-            this.mdate = preMdate;
-            this.$setNymph(nymph);
-            throw e;
-        }
-    }
-    /*
-     * This should *never* be accessible on the client.
-     */
-    async $saveSkipAC() {
-        this.$skipAcWhenSaving = true;
-        return await this.$save();
-    }
-    $tilmeldSaveSkipAC() {
-        if (this.$skipAcWhenSaving) {
-            this.$skipAcWhenSaving = false;
-            return true;
+            // Validate group parent. Make sure it's not a descendant of this group.
+            const parent = this.$data.parent;
+            await parent?.$wake();
+            if (parent &&
+                (parent.cdate == null ||
+                    this.$is(parent) ||
+                    (await parent.$isDescendant(this)))) {
+                throw new BadDataError("Group parent can't be itself or descendant of itself.");
+            }
+            try {
+                tilmeld.config.validatorGroup(tilmeld, this);
+            }
+            catch (e) {
+                throw new BadDataError(e?.message);
+            }
+            // Only one default primary group is allowed.
+            if (this.$data.defaultPrimary) {
+                const currentPrimary = await this.$nymph.getEntity({ class: tilmeld.Group }, { type: '&', truthy: 'defaultPrimary' });
+                if (currentPrimary != null && !this.$is(currentPrimary)) {
+                    currentPrimary.defaultPrimary = false;
+                    try {
+                        if (this.$skipAcWhenSaving) {
+                            await currentPrimary.$saveSkipAC();
+                        }
+                        else {
+                            await currentPrimary.$save();
+                        }
+                    }
+                    catch (e) {
+                        throw new CouldNotChangeDefaultPrimaryGroupError('Could not change new user primary group from ' +
+                            `${currentPrimary.groupname}.`);
+                    }
+                }
+            }
+            let preGuid = this.guid;
+            let preCdate = this.cdate;
+            let preMdate = this.mdate;
+            return await transaction(this.$nymph, 'tilmeld-save-group-' + (this.guid || nanoid()), async (nymph) => {
+                this.$setNymph(nymph);
+                for (let callback of this.constructor
+                    .beforeSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
+                await super.$save();
+                for (let callback of this.constructor
+                    .afterSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
+            }, async (nymph, committed) => {
+                this.$setNymph(nymph);
+                if (committed) {
+                    this.$originalGroupname = this.$data.groupname;
+                }
+                else {
+                    this.guid = preGuid;
+                    this.cdate = preCdate;
+                    this.mdate = preMdate;
+                }
+            });
         }
-        return false;
-    }
-    async $delete() {
-        let tilmeld = enforceTilmeld(this);
-        if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new AccessControlError("You don't have the authority to delete groups.");
+        /*
+         * This should *never* be accessible on the client.
+         */
+        async $saveSkipAC() {
+            this.$skipAcWhenSaving = true;
+            await this.$save();
         }
-        if (this.$data.groupname !== this.$originalGroupname) {
-            throw new AccessControlError("You can't delete a group while switching its groupname.");
+        $tilmeldSaveSkipAC() {
+            if (this.$skipAcWhenSaving) {
+                this.$skipAcWhenSaving = false;
+                return true;
+            }
+            return false;
         }
-        const transaction = 'tilmeld-delete-group-' + this.guid;
-        const nymph = this.$nymph;
-        const tnymph = await nymph.startTransaction(transaction);
-        this.$setNymph(tnymph);
-        tilmeld = enforceTilmeld(this);
-        const User = tnymph.getEntityClass(UserClass);
-        try {
+        async $delete() {
+            let tilmeld = enforceTilmeld(this);
+            const User = this.$nymph.getEntityClass(UserClass);
+            if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new AccessControlError("You don't have the authority to delete groups.");
+            }
+            if (this.$data.groupname !== this.$originalGroupname) {
+                throw new AccessControlError("You can't delete a group while switching its groupname.");
+            }
             for (let callback of this.constructor
                 .beforeDeleteCallbacks) {
                 if (callback) {
                     await callback(this);
                 }
             }
-            // Delete descendants.
-            const descendants = await this.$getDescendants();
-            if (descendants.length) {
-                for (let curGroup of descendants) {
-                    if (this.$skipAcWhenDeleting
-                        ? !(await curGroup.$deleteSkipAC())
-                        : !(await curGroup.$delete())) {
-                        await tnymph.rollback(transaction);
-                        this.$setNymph(nymph);
-                        return false;
+            // Delete children.
+            const children = await this.$nymph.getEntities({ class: tilmeld.Group, skipAc: true }, { type: '&', ref: ['parent', this] });
+            if (children.length) {
+                for (let curGroup of children) {
+                    if (this.$skipAcWhenDeleting) {
+                        await curGroup.$deleteSkipAC();
+                    }
+                    else {
+                        await curGroup.$delete();
                     }
                 }
             }
             // Remove users from this primary group.
-            const primaryUsers = await tnymph.getEntities({
-                class: User,
-                skipAc: true,
-            }, {
-                type: '&',
-                ref: ['group', this],
-            });
+            const primaryUsers = await this.$nymph.getEntities({ class: User, skipAc: true }, { type: '&', ref: ['group', this] });
             for (let user of primaryUsers) {
                 delete user.group;
-                if (this.$skipAcWhenDeleting
-                    ? !(await user.$saveSkipAC())
-                    : !(await user.$save())) {
-                    await tnymph.rollback(transaction);
-                    this.$setNymph(nymph);
-                    return false;
+                if (this.$skipAcWhenDeleting) {
+                    await user.$saveSkipAC();
+                }
+                else {
+                    await user.$save();
                 }
             }
             // Remove users from this secondary group.
-            const secondaryUsers = await tnymph.getEntities({
-                class: User,
-                skipAc: true,
-            }, {
-                type: '&',
-                ref: ['groups', this],
-            });
+            const secondaryUsers = await this.$nymph.getEntities({ class: User, skipAc: true }, { type: '&', ref: ['groups', this] });
             for (let user of secondaryUsers) {
                 user.$delGroup(this);
-                if (this.$skipAcWhenDeleting
-                    ? !(await user.$saveSkipAC())
-                    : !(await user.$save())) {
-                    await tnymph.rollback(transaction);
-                    this.$setNymph(nymph);
-                    return false;
+                if (this.$skipAcWhenDeleting) {
+                    await user.$saveSkipAC();
+                }
+                else {
+                    await user.$save();
                 }
             }
             // Delete the group.
-            let success = await super.$delete();
-            if (success) {
-                for (let callback of this.constructor
-                    .afterDeleteCallbacks) {
-                    if (callback) {
-                        await callback(this);
-                    }
+            await super.$delete();
+            for (let callback of this.constructor
+                .afterDeleteCallbacks) {
+                if (callback) {
+                    await callback(this);
                 }
-                success = await tnymph.commit(transaction);
             }
-            else {
-                await tnymph.rollback(transaction);
-            }
-            this.$setNymph(nymph);
-            return success;
         }
-        catch (e) {
-            await tnymph.rollback(transaction);
-            this.$setNymph(nymph);
-            throw e;
+        /*
+         * This should *never* be accessible on the client.
+         */
+        async $deleteSkipAC() {
+            this.$skipAcWhenDeleting = true;
+            await this.$delete();
         }
-    }
-    /*
-     * This should *never* be accessible on the client.
-     */
-    async $deleteSkipAC() {
-        this.$skipAcWhenDeleting = true;
-        return await this.$delete();
-    }
-    $tilmeldDeleteSkipAC() {
-        if (this.$skipAcWhenDeleting) {
-            this.$skipAcWhenDeleting = false;
-            return true;
-        }
-        return false;
-    }
-    static on(event, callback) {
-        const prop = (event + 'Callbacks');
-        if (!(prop in this)) {
-            throw new Error('Invalid event type.');
-        }
-        // @ts-ignore: The callback should always be the right type here.
-        this[prop].push(callback);
-        return () => this.off(event, callback);
-    }
-    static off(event, callback) {
-        const prop = (event + 'Callbacks');
-        if (!(prop in this)) {
+        $tilmeldDeleteSkipAC() {
+            if (this.$skipAcWhenDeleting) {
+                this.$skipAcWhenDeleting = false;
+                return true;
+            }
             return false;
         }
-        // @ts-ignore: The callback should always be the right type here.
-        const i = this[prop].indexOf(callback);
-        if (i > -1) {
+        static on(event, callback) {
+            const prop = (event + 'Callbacks');
+            if (!(prop in this)) {
+                throw new Error('Invalid event type.');
+            }
             // @ts-ignore: The callback should always be the right type here.
-            this[prop].splice(i, 1);
+            this[prop].push(callback);
+            return () => this.off(event, callback);
         }
-        return true;
-    }
-}
+        static off(event, callback) {
+            const prop = (event + 'Callbacks');
+            if (!(prop in this)) {
+                return false;
+            }
+            // @ts-ignore: The callback should always be the right type here.
+            const i = this[prop].indexOf(callback);
+            if (i > -1) {
+                // @ts-ignore: The callback should always be the right type here.
+                this[prop].splice(i, 1);
+            }
+            return true;
+        }
+    };
+})();
+/**
+ * A user group data model.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@port87.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
+export default Group;
 //# sourceMappingURL=Group.js.map