@nymphjs/tilmeld 1.0.0-beta.13 → 1.0.0-beta.130

package/dist/Group.js

@@ -1,38 +1,71 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const md5_1 = __importDefault(require("crypto-js/md5"));
-const lodash_1 = require("lodash");
-const AbleObject_1 = __importDefault(require("./AbleObject"));
-const errors_1 = require("./errors");
-class Group extends AbleObject_1.default {
-    static async factory(guid) {
-        return (await super.factory(guid));
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
     }
-    static async factoryGroupname(groupname) {
-        const entity = new this();
-        if (groupname != null) {
-            const entity = await this.nymph.getEntity({
-                class: this,
-            }, {
-                type: '&',
-                ilike: ['groupname', groupname.replace(/([\\%_])/g, (s) => `\\${s}`)],
-            });
-            if (entity != null) {
-                return entity;
-            }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
         }
-        return entity;
-    }
-    static factorySync(guid) {
-        return super.factorySync(guid);
     }
-    constructor(guid) {
-        super(guid);
-        this.$tags = [];
-        this.$clientEnabledMethods = [
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import crypto from 'node:crypto';
+import { transaction, transactional, } from '@nymphjs/nymph';
+import { nanoid } from '@nymphjs/guid';
+import { difference, xor } from 'lodash-es';
+import { splitn } from '@sciactive/splitn';
+import { enforceTilmeld } from './enforceTilmeld.js';
+import AbleObject from './AbleObject.js';
+import { AccessControlError, BadDataError, BadEmailError, BadUsernameError, CouldNotChangeDefaultPrimaryGroupError, } from './errors/index.js';
+import UserClass from './User.js';
+let Group = (() => {
+    let _classSuper = AbleObject;
+    let _instanceExtraInitializers = [];
+    let _$delete_decorators;
+    return class Group extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _$delete_decorators = [transactional];
+            __esDecorate(this, null, _$delete_decorators, { kind: "method", name: "$delete", static: false, private: false, access: { has: obj => "$delete" in obj, get: obj => obj.$delete }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        /**
+         * The instance of Tilmeld to use for queries.
+         */
+        static ETYPE = 'tilmeld_group';
+        static class = 'Group';
+        static checkGroupnameCallbacks = [];
+        static beforeSaveCallbacks = [];
+        static afterSaveCallbacks = [];
+        static beforeDeleteCallbacks = [];
+        static afterDeleteCallbacks = [];
+        static DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
+        static DEFAULT_ALLOWLIST_DATA = [];
+        $tags = (__runInitializers(this, _instanceExtraInitializers), []);
+        $clientEnabledMethods = [
             '$checkGroupname',
             '$checkEmail',
             '$getAvatar',
@@ -41,467 +74,811 @@ class Group extends AbleObject_1.default {
             '$getLevel',
             '$isDescendant',
         ];
-        this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
-        this.$allowlistTags = [];
-        this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$updateDataProtection();
-        }
-    }
-    static async getPrimaryGroups(options, selectors) {
-        if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new Error("You don't have permission to do that.");
-        }
-        return await this.getAssignableGroups(this.tilmeld.config.highestPrimary, { ...options, class: this.tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
-    }
-    static async getSecondaryGroups(options, selectors) {
-        if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new Error("You don't have permission to do that.");
-        }
-        return await this.getAssignableGroups(this.tilmeld.config.highestSecondary, { ...options, class: this.tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
-    }
-    static async getAssignableGroups(highestParent, options, selectors) {
-        let assignableGroups = [];
-        if (highestParent === false) {
-            return assignableGroups;
-        }
-        assignableGroups = await this.nymph.getEntities({ ...options, class: this.tilmeld.Group }, ...selectors);
-        if (highestParent !== true) {
-            assignableGroups = assignableGroups.filter((group) => {
-                let curGroup = group;
-                while (curGroup.parent != null && curGroup.parent.cdate != null) {
-                    if (curGroup.parent.guid === highestParent) {
-                        return true;
-                    }
-                    curGroup = curGroup.parent;
+        static clientEnabledStaticMethods = [
+            'getPrimaryGroups',
+            'getSecondaryGroups',
+        ];
+        $privateData = [...Group.DEFAULT_PRIVATE_DATA];
+        static searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
+        $allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
+        $allowlistTags = [];
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenSaving = false;
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenDeleting = false;
+        /**
+         * Used to save the current groupname for domain admin permissions.
+         */
+        $originalGroupname;
+        static getFTSText(name, value) {
+            if ([
+                'abilities',
+                'parent',
+                'user',
+                'enabled',
+                'defaultPrimary',
+                'defaultSecondary',
+                'unverifiedSecondary',
+            ].indexOf(name) !== -1) {
+                return null;
+            }
+            return super.getFTSText(name, value);
+        }
+        static async factoryGroupname(groupname) {
+            const entity = new this();
+            if (groupname != null) {
+                const entity = await this.nymph.getEntity({
+                    class: this,
+                }, {
+                    type: '&',
+                    ilike: ['groupname', groupname.replace(/([\\%_])/g, (s) => `\\${s}`)],
+                });
+                if (entity != null) {
+                    return entity;
                 }
-                return false;
-            });
-        }
-        return assignableGroups;
-    }
-    $getAvatar() {
-        if (this.$data.avatar != null && this.$data.avatar !== '') {
-            return this.$data.avatar;
-        }
-        if (this.$data.email == null || !this.$data.email.length) {
-            return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
+            }
+            return entity;
+        }
+        /**
+         * Get all the groups that can be assigned as primary groups.
+         *
+         * @param options The options for an optional search query.
+         * @param selectors The selectors for an optional search query.
+         * @returns An array of the assignable primary groups.
+         */
+        static async getPrimaryGroups(options, selectors) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new Error("You don't have permission to do that.");
+            }
+            return await this.getAssignableGroups(tilmeld.config.highestPrimary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        }
+        /**
+         * Get all the groups that can be assigned as secondary groups.
+         *
+         * @param options The options for an optional search query.
+         * @param selectors The selectors for an optional search query.
+         * @returns An array of the assignable secondary groups.
+         */
+        static async getSecondaryGroups(options, selectors) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new Error("You don't have permission to do that.");
+            }
+            return await this.getAssignableGroups(tilmeld.config.highestSecondary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
         }
-        return ('https://secure.gravatar.com/avatar/' +
-            (0, md5_1.default)(this.$data.email.trim().toLowerCase()).toString() +
-            '?d=identicon&s=40');
-    }
-    $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (input.data.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this group a system admin.");
+        static async getAssignableGroups(highestParent, options, selectors) {
+            const tilmeld = enforceTilmeld(this);
+            let assignableGroups = [];
+            if (highestParent === false) {
+                return assignableGroups;
+            }
+            assignableGroups = await this.nymph.getEntities({ ...options, class: tilmeld.Group }, ...selectors);
+            if (highestParent !== true) {
+                assignableGroups = (await Promise.all(assignableGroups.map(async (group) => {
+                    let curGroup = group;
+                    let parent = curGroup.parent;
+                    await parent?.$wake();
+                    while (parent != null && parent?.cdate != null) {
+                        if (parent?.guid === highestParent) {
+                            return group;
+                        }
+                        curGroup = parent;
+                        parent = curGroup.parent;
+                        await parent?.$wake();
+                    }
+                    return null;
+                }))).filter((group) => group != null);
+            }
+            return assignableGroups;
         }
-        super.$jsonAcceptData(input, allowConflict);
-    }
-    $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (patch.set.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this group a system admin.");
+        constructor() {
+            super();
+            // Defaults.
+            this.$data.enabled = true;
+            this.$data.abilities = [];
+            this.$updateDataProtection();
         }
-        super.$jsonAcceptPatch(patch, allowConflict);
-    }
-    $putData(data, sdata) {
-        super.$putData(data, sdata);
-        this.$updateDataProtection();
-    }
-    $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
-        let user = givenUser ?? tilmeld.User.current();
-        this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
-        if (tilmeld.config.emailUsernames) {
-            this.$privateData.push('groupname');
+        async $getUniques() {
+            const tilmeld = enforceTilmeld(this);
+            const uniques = [`u:${this.$data.groupname}`];
+            if (!tilmeld.config.emailUsernames &&
+                tilmeld.config.userFields.includes('email')) {
+                uniques.push(`e:${this.$data.email}`);
+            }
+            if (this.$data.defaultPrimary) {
+                uniques.push(`o:default-primary`);
+            }
+            return uniques;
         }
-        if (user != null &&
-            ((user.abilities?.indexOf('tilmeld/admin') ?? -1) !== -1 ||
-                (user.abilities?.indexOf('system/admin') ?? -1) !== -1)) {
-            this.$privateData = [];
-            this.$allowlistData = undefined;
+        $getAvatar() {
+            if (this.$data.avatar != null && this.$data.avatar !== '') {
+                return this.$data.avatar;
+            }
+            if (this.$data.email == null || !this.$data.email.length) {
+                return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
+            }
+            return ('https://secure.gravatar.com/avatar/' +
+                crypto
+                    .createHash('sha256')
+                    .update(this.$data.email.trim().toLowerCase())
+                    .digest('hex')
+                    .toLowerCase() +
+                '?d=identicon&s=40');
+        }
+        $jsonAcceptData(input, allowConflict = false) {
+            this.$check();
+            if ('abilities' in input.data) {
+                this.$checkIncomingAbilities(input.data.abilities);
+            }
+            super.$jsonAcceptData(input, allowConflict);
         }
-        else if (this.$data.user != null &&
-            user != null &&
-            this.$data.user.$is(user)) {
-            this.$privateData = [];
+        $jsonAcceptPatch(patch, allowConflict = false) {
+            this.$check();
+            if ('abilities' in patch.set) {
+                this.$checkIncomingAbilities(patch.set.abilities);
+            }
+            super.$jsonAcceptPatch(patch, allowConflict);
         }
-    }
-    $isDescendant(givenGroup) {
-        const tilmeld = this.$nymph.tilmeld;
-        let group;
-        if (typeof givenGroup === 'string') {
-            group = tilmeld.Group.factorySync(givenGroup);
+        $checkIncomingAbilities(incoming) {
+            const tilmeld = enforceTilmeld(this);
+            if (!Array.isArray(incoming) ||
+                incoming.find((ability) => typeof ability !== 'string')) {
+                throw new BadDataError('Abilities must be an array of strings.');
+            }
+            if (incoming.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
+            }
+            if (incoming.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+            }
+            if (incoming.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
+            }
+            if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.$data.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ?? []).length &&
+                (!tilmeld.currentUser ||
+                    (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+                        !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
+                throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
+            }
         }
-        else {
-            group = givenGroup;
+        $putData(data, sdata, source) {
+            super.$putData(data, sdata, source);
+            // TODO: Fix these being added by the drivers.
+            // @ts-ignore
+            delete this.$data.acRead;
+            // @ts-ignore
+            delete this.$data.acWrite;
+            // @ts-ignore
+            delete this.$data.acFull;
+            if (source === 'server') {
+                this.$originalGroupname = this.$data.groupname;
+            }
+            this.$updateDataProtection();
         }
-        if (group.guid == null) {
-            return false;
+        /**
+         * Update the data protection arrays for a user.
+         *
+         * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+         */
+        $updateDataProtection(givenUser) {
+            const tilmeld = enforceTilmeld(this);
+            let user = givenUser ?? tilmeld.User.current();
+            let [_groupname, domain] = tilmeld.config.domainSupport
+                ? splitn(this.$data.groupname ?? '', '@', 2)
+                : [this.$data.groupname, null];
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+            }
+            this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
+            this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
+            if (tilmeld.config.emailUsernames) {
+                this.$privateData.push('groupname');
+            }
+            if (user != null &&
+                (user.abilities?.includes('tilmeld/admin') ||
+                    user.abilities?.includes('system/admin'))) {
+                // Users who can edit groups can see their data.
+                this.$privateData = [];
+                this.$allowlistData = undefined;
+            }
+            else if (this.$data.user != null &&
+                user != null &&
+                this.$data.user.guid === user.guid) {
+                // Users can see their group's data.
+                this.$privateData = [];
+            }
+            else if (user != null &&
+                tilmeld.config.domainSupport &&
+                domain &&
+                user.abilities?.includes(`tilmeld/domain/${domain}/admin`)) {
+                // Domain admins can see their groups' data.
+                this.$privateData = [];
+            }
         }
-        if (this.$data.parent == null) {
+        /**
+         * Check whether the group is a descendant of the given group.
+         *
+         * @param group The group, or the group's GUID.
+         * @returns True or false.
+         */
+        async $isDescendant(givenGroup) {
+            const tilmeld = enforceTilmeld(this);
+            let group;
+            if (typeof givenGroup === 'string') {
+                group = await tilmeld.Group.factory(givenGroup);
+            }
+            else {
+                group = givenGroup;
+            }
+            if (group.guid == null) {
+                return false;
+            }
+            // Check to see if the group is a descendant of the given group.
+            const parent = this.$data.parent;
+            await parent?.$wake();
+            if (parent == null) {
+                return false;
+            }
+            if (parent.$is(group)) {
+                return true;
+            }
+            if (await parent.$isDescendant(group)) {
+                return true;
+            }
             return false;
         }
-        if (this.$data.parent.$is(group)) {
-            return true;
-        }
-        if (this.$data.parent.$isDescendant(group)) {
-            return true;
-        }
-        return false;
-    }
-    async $getChildren() {
-        const tilmeld = this.$nymph.tilmeld;
-        return await this.$nymph.getEntities({ class: tilmeld.Group }, {
-            type: '&',
-            equal: ['enabled', true],
-            ref: ['parent', this],
-        });
-    }
-    async $getDescendants(andSelf = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        let groups = [];
-        const entities = await this.$nymph.getEntities({ class: tilmeld.Group }, {
-            type: '&',
-            equal: ['enabled', true],
-            ref: ['parent', this],
-        });
-        for (let entity of entities) {
-            groups = (await entity.$getDescendants(true)).concat(groups);
-        }
-        if (andSelf) {
-            groups.push(this);
-        }
-        return groups;
-    }
-    $getDescendantsSync(andSelf = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        let groups = [];
-        let entity;
-        let offset = 0;
-        do {
-            entity = this.$nymph.driver.getEntitySync({ class: tilmeld.Group, offset }, {
+        /**
+         * Gets an array of the group's child groups.
+         *
+         * @returns An array of groups.
+         */
+        async $getChildren() {
+            const tilmeld = enforceTilmeld(this);
+            return await this.$nymph.getEntities({ class: tilmeld.Group }, {
                 type: '&',
                 equal: ['enabled', true],
                 ref: ['parent', this],
             });
-            if (entity != null) {
-                groups = entity.$getDescendantsSync(true).concat(groups);
-            }
-            offset++;
-        } while (entity != null);
-        if (andSelf) {
-            groups.push(this);
-        }
-        return groups;
-    }
-    $getLevel() {
-        const tilmeld = this.$nymph.tilmeld;
-        let group = tilmeld.Group.factorySync(this.guid ?? undefined);
-        let level = 0;
-        while (group.parent != null && group.parent.cdate != null && level < 1024) {
-            level++;
-            group = group.parent;
         }
-        return level;
-    }
-    async $getUsers(descendants = false, limit, offset) {
-        const tilmeld = this.$nymph.tilmeld;
-        let groups = [];
-        if (descendants) {
-            groups = await this.$getDescendants();
+        /**
+         * Gets an array of the group's descendant groups.
+         *
+         * @param andSelf Include this group in the returned array.
+         * @param andDisabled Include disabled groups.
+         * @returns An array of groups.
+         */
+        async $getDescendants(andSelf = false, andDisabled = false) {
+            const tilmeld = enforceTilmeld(this);
+            let groups = [];
+            const entities = await this.$nymph.getEntities({ class: tilmeld.Group }, {
+                type: '&',
+                ...(andDisabled ? {} : { equal: ['enabled', true] }),
+                ref: ['parent', this],
+            });
+            for (let entity of entities) {
+                groups = (await entity.$getDescendants(true)).concat(groups);
+            }
+            if (andSelf) {
+                groups.push(this);
+            }
+            return groups;
+        }
+        /**
+         * Get the number of parents the group has.
+         *
+         * If the group is a top level group, this will return 0. If it is a child of
+         * a top level group, this will return 1. If it is a grandchild of a top level
+         * group, this will return 2, and so on.
+         *
+         * Levels will max out at 1024 to avoid recursive loops.
+         *
+         * @returns The level of the group.
+         */
+        async $getLevel() {
+            const tilmeld = enforceTilmeld(this);
+            let group = await tilmeld.Group.factory(this.guid ?? undefined);
+            let parent = group.parent;
+            await parent?.$wake();
+            let level = 0;
+            while (parent != null && parent.cdate != null && level < 1024) {
+                level++;
+                group = parent;
+                parent = group.parent;
+                await parent?.$wake();
+            }
+            return level;
+        }
+        /**
+         * Gets an array of enabled users in the group.
+         *
+         * @param descendants Include users in all descendant groups too.
+         * @param limit The limit for the query.
+         * @param offset The offset for the query.
+         * @returns An array of users.
+         */
+        async $getUsers(descendants = false, limit, offset) {
+            const tilmeld = enforceTilmeld(this);
+            let groups = [];
+            if (descendants) {
+                groups = await this.$getDescendants();
+            }
+            return await this.$nymph.getEntities({
+                class: tilmeld.User,
+                limit,
+                offset,
+            }, { type: '&', equal: ['enabled', true] }, {
+                type: '|',
+                ref: [
+                    ['group', this],
+                    ['groups', this],
+                    ...groups.map((group) => [
+                        'group',
+                        group,
+                    ]),
+                    ...groups.map((group) => [
+                        'groups',
+                        group,
+                    ]),
+                ],
+            });
         }
-        return await this.$nymph.getEntities({
-            class: tilmeld.User,
-            limit,
-            offset,
-        }, {
-            type: '&',
-            equal: ['enabled', true],
-        }, {
-            type: '|',
-            ref: [
-                ['group', this],
-                ['groups', this],
-                ...groups.map((group) => [
-                    'group',
-                    group,
-                ]),
-                ...groups.map((group) => [
-                    'groups',
-                    group,
-                ]),
-            ],
-        });
-    }
-    async $checkGroupname() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.config.emailUsernames) {
-            if (this.$data.groupname == null || !this.$data.groupname.length) {
-                return { result: false, message: 'Please specify a groupname.' };
-            }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
-                return {
-                    result: false,
-                    message: 'Groupnames must not exceed ' +
-                        tilmeld.config.maxUsernameLength +
-                        ' characters.',
+        /**
+         * Check that a groupname is valid.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkGroupname() {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.config.emailUsernames) {
+                let [groupname, domain] = tilmeld.config.domainSupport
+                    ? splitn(this.$data.groupname ?? '', '@', 2)
+                    : [this.$data.groupname, null];
+                // Lowercase the domain part.
+                if (domain) {
+                    domain = domain.toLowerCase();
+                    this.$data.groupname = `${groupname}@${domain}`;
+                }
+                if (this.$data.groupname == null ||
+                    !this.$data.groupname.length ||
+                    groupname == null ||
+                    !groupname.length) {
+                    return { result: false, message: 'Please specify a groupname.' };
+                }
+                if (groupname.length < tilmeld.config.minUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Groupnames must be at least ' +
+                            tilmeld.config.minUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (groupname.length > tilmeld.config.maxUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Groupnames must not exceed ' +
+                            tilmeld.config.maxUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (difference(groupname.split(''), tilmeld.config.validChars.split(''))
+                    .length) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validCharsNotice,
+                    };
+                }
+                if (!tilmeld.config.validRegex.test(groupname)) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validRegexNotice,
+                    };
+                }
+                if (domain != null) {
+                    if (!tilmeld.config.validDomainRegex.test(domain)) {
+                        return {
+                            result: false,
+                            message: tilmeld.config.validDomainRegexNotice,
+                        };
+                    }
+                    if (!this.$is(tilmeld.currentUser?.group) &&
+                        !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                        return {
+                            result: false,
+                            message: "You don't have the authority to manage groups on this domain.",
+                        };
+                    }
+                }
+                const selector = {
+                    type: '&',
+                    ilike: [
+                        'groupname',
+                        this.$data.groupname.replace(/([\\%_])/g, (s) => `\\${s}`),
+                    ],
                 };
-            }
-            if ((0, lodash_1.difference)(this.$data.groupname.split(''), tilmeld.config.validChars.split('')).length) {
+                if (this.guid != null) {
+                    selector['!guid'] = this.guid;
+                }
+                const test = await this.$nymph.getEntity({ class: tilmeld.Group, skipAc: true }, selector);
+                if (test != null) {
+                    return { result: false, message: 'That groupname is taken.' };
+                }
+                for (let callback of this.constructor
+                    .checkGroupnameCallbacks) {
+                    if (callback) {
+                        const result = await callback(this, {
+                            groupname: this.$data.groupname,
+                        });
+                        if (!result.result) {
+                            return { message: 'Groupname is not available.', ...result };
+                        }
+                    }
+                }
                 return {
-                    result: false,
-                    message: tilmeld.config.validCharsNotice,
+                    result: true,
+                    message: this.guid != null ? 'Groupname is valid.' : 'Groupname is available!',
                 };
             }
-            if (!tilmeld.config.validRegex.test(this.$data.groupname)) {
+            else {
+                this.$data.email = this.$data.groupname;
+                if (this.$data.groupname == null || !this.$data.groupname.length) {
+                    return { result: false, message: 'Please specify an email.' };
+                }
+                if (this.$data.groupname.length < tilmeld.config.minUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Emails must be at least ' +
+                            tilmeld.config.minUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Emails must not exceed ' +
+                            tilmeld.config.maxUsernameLength +
+                            ' characters.',
+                    };
+                }
+                return await this.$checkEmail();
+            }
+        }
+        /**
+         * Check that an email is unique.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkEmail() {
+            const tilmeld = enforceTilmeld(this);
+            if (this.$data.email === '') {
+                return { result: true, message: '' };
+            }
+            if (this.$data.email == null) {
+                return { result: false, message: 'Please specify a valid email.' };
+            }
+            if (!tilmeld.config.validEmailRegex.test(this.$data.email)) {
                 return {
                     result: false,
-                    message: tilmeld.config.validRegexNotice,
+                    message: tilmeld.config.validEmailRegexNotice,
                 };
             }
             const selector = {
                 type: '&',
-                ilike: [
-                    'groupname',
-                    this.$data.groupname.replace(/([\\%_])/g, (s) => `\\${s}`),
-                ],
+                ilike: ['email', this.$data.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
             };
             if (this.guid != null) {
                 selector['!guid'] = this.guid;
             }
             const test = await this.$nymph.getEntity({ class: tilmeld.Group, skipAc: true }, selector);
             if (test != null) {
-                return { result: false, message: 'That groupname is taken.' };
-            }
-            return {
-                result: true,
-                message: this.guid != null ? 'Groupname is valid.' : 'Groupname is available!',
-            };
-        }
-        else {
-            this.$data.email = this.$data.groupname;
-            if (this.$data.groupname == null || !this.$data.groupname.length) {
-                return { result: false, message: 'Please specify an email.' };
-            }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
-                    message: 'Emails must not exceed ' +
-                        tilmeld.config.maxUsernameLength +
-                        ' characters.',
+                    message: 'That email address is already registered.',
                 };
             }
-            return await this.$checkEmail();
-        }
-    }
-    async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (this.$data.email === '') {
-            return { result: true, message: '' };
-        }
-        if (this.$data.email == null) {
-            return { result: false, message: 'Please specify a valid email.' };
-        }
-        if (!tilmeld.config.validEmailRegex.test(this.$data.email)) {
             return {
-                result: false,
-                message: tilmeld.config.validEmailRegexNotice,
+                result: true,
+                message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
             };
         }
-        const selector = {
-            type: '&',
-            ilike: ['email', this.$data.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        };
-        if (this.guid != null) {
-            selector['!guid'] = this.guid;
-        }
-        const test = await this.$nymph.getEntity({ class: tilmeld.Group, skipAc: true }, selector);
-        if (test != null) {
-            return {
-                result: false,
-                message: 'That email address is already registered.',
-            };
+        async $save() {
+            let tilmeld = enforceTilmeld(this);
+            if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
+                throw new BadUsernameError('Groupname must not be empty.');
+            }
+            // Lowercase the domain part.
+            if (tilmeld.config.domainSupport) {
+                const [groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+                if (domain) {
+                    this.$data.groupname = `${groupname}@${domain.toLowerCase()}`;
+                }
+            }
+            if (tilmeld.config.domainSupport) {
+                const [_groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+                const [_originalGroupname, originalDomain] = splitn(this.$originalGroupname ?? '', '@', 2);
+                if (this.guid != null &&
+                    ((originalDomain == null && domain != null) ||
+                        (domain == null && originalDomain != null))) {
+                    throw new AccessControlError("Groups can't switch to or from having a domain once created.");
+                }
+                if (!this.$skipAcWhenSaving &&
+                    !tilmeld.gatekeeper('tilmeld/admin') &&
+                    !tilmeld.gatekeeper('system/admin')) {
+                    if (domain != null &&
+                        !this.$is(tilmeld.currentUser) &&
+                        !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                        throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+                    }
+                    if (originalDomain != null &&
+                        originalDomain !== domain &&
+                        (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+                            !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
+                        throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+                    }
+                }
+            }
+            // Formatting.
+            this.$data.groupname = this.$data.groupname.trim();
+            if (tilmeld.config.emailUsernames) {
+                this.$data.email = this.$data.groupname;
+            }
+            this.$data.email = (this.$data.email ?? '').trim();
+            this.$data.name = (this.$data.name ?? '').trim();
+            this.$data.phone = (this.$data.phone ?? '').trim();
+            this.$data.enabled = !!this.$data.enabled;
+            // Clear empty values.
+            if (this.$data.name === '' || !tilmeld.config.userFields.includes('name')) {
+                delete this.$data.name;
+            }
+            if (this.$data.email === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.$data.email;
+            }
+            if (this.$data.avatar === '') {
+                delete this.$data.avatar;
+            }
+            if (this.$data.phone === '' ||
+                !tilmeld.config.userFields.includes('phone')) {
+                delete this.$data.phone;
+            }
+            if (this.$data.parent == null) {
+                delete this.$data.parent;
+            }
+            if (this.$data.user == null) {
+                delete this.$data.user;
+            }
+            if (!this.$data.defaultPrimary) {
+                delete this.$data.defaultPrimary;
+            }
+            if (!this.$data.defaultSecondary) {
+                delete this.$data.defaultSecondary;
+            }
+            if (!this.$data.unverifiedSecondary) {
+                delete this.$data.unverifiedSecondary;
+            }
+            // Groups should never have 'system/admin', 'tilmeld/admin',
+            // 'tilmeld/switch', or domain admin abilities.
+            this.$data.abilities = (this.$data.abilities ?? []).filter((ability) => {
+                if (['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
+                    -1) {
+                    return false;
+                }
+                if (ability == null) {
+                    return false;
+                }
+                if (ability.startsWith('tilmeld/domain/') && ability.endsWith('/admin')) {
+                    return false;
+                }
+                return true;
+            });
+            // Verification.
+            const unCheck = await this.$checkGroupname();
+            if (!unCheck.result) {
+                throw new BadUsernameError(unCheck.message);
+            }
+            if (!tilmeld.config.emailUsernames &&
+                tilmeld.config.userFields.includes('email')) {
+                const emCheck = await this.$checkEmail();
+                if (!emCheck.result) {
+                    throw new BadEmailError(emCheck.message);
+                }
+            }
+            // Validate group parent. Make sure it's not a descendant of this group.
+            const parent = this.$data.parent;
+            await parent?.$wake();
+            if (parent &&
+                (parent.cdate == null ||
+                    this.$is(parent) ||
+                    (await parent.$isDescendant(this)))) {
+                throw new BadDataError("Group parent can't be itself or descendant of itself.");
+            }
+            try {
+                tilmeld.config.validatorGroup(tilmeld, this);
+            }
+            catch (e) {
+                throw new BadDataError(e?.message);
+            }
+            // Only one default primary group is allowed.
+            if (this.$data.defaultPrimary) {
+                const currentPrimary = await this.$nymph.getEntity({ class: tilmeld.Group }, { type: '&', truthy: 'defaultPrimary' });
+                if (currentPrimary != null && !this.$is(currentPrimary)) {
+                    currentPrimary.defaultPrimary = false;
+                    try {
+                        if (this.$skipAcWhenSaving) {
+                            await currentPrimary.$saveSkipAC();
+                        }
+                        else {
+                            await currentPrimary.$save();
+                        }
+                    }
+                    catch (e) {
+                        throw new CouldNotChangeDefaultPrimaryGroupError('Could not change new user primary group from ' +
+                            `${currentPrimary.groupname}.`);
+                    }
+                }
+            }
+            let preGuid = this.guid;
+            let preCdate = this.cdate;
+            let preMdate = this.mdate;
+            return await transaction(this.$nymph, 'tilmeld-save-group-' + (this.guid || nanoid()), async (nymph) => {
+                this.$setNymph(nymph);
+                for (let callback of this.constructor
+                    .beforeSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
+                await super.$save();
+                for (let callback of this.constructor
+                    .afterSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
+            }, async (nymph, committed) => {
+                this.$setNymph(nymph);
+                if (committed) {
+                    this.$originalGroupname = this.$data.groupname;
+                }
+                else {
+                    this.guid = preGuid;
+                    this.cdate = preCdate;
+                    this.mdate = preMdate;
+                }
+            });
         }
-        return {
-            result: true,
-            message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
-        };
-    }
-    async $save() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
+        /*
+         * This should *never* be accessible on the client.
+         */
+        async $saveSkipAC() {
+            this.$skipAcWhenSaving = true;
+            await this.$save();
+        }
+        $tilmeldSaveSkipAC() {
+            if (this.$skipAcWhenSaving) {
+                this.$skipAcWhenSaving = false;
+                return true;
+            }
             return false;
         }
-        this.$data.groupname = this.$data.groupname.trim();
-        if (tilmeld.config.emailUsernames) {
-            this.$data.email = this.$data.groupname;
-        }
-        this.$data.email = (this.$data.email ?? '').trim();
-        this.$data.name = (this.$data.name ?? '').trim();
-        this.$data.phone = (this.$data.phone ?? '').trim();
-        this.$data.enabled = !!this.$data.enabled;
-        if (this.$data.name === '') {
-            delete this.$data.name;
-        }
-        if (this.$data.email === '') {
-            delete this.$data.email;
-        }
-        if (this.$data.avatar === '') {
-            delete this.$data.avatar;
-        }
-        if (this.$data.phone === '') {
-            delete this.$data.phone;
-        }
-        if (this.$data.parent == null) {
-            delete this.$data.parent;
-        }
-        if (this.$data.user == null) {
-            delete this.$data.user;
-        }
-        if (!this.$data.defaultPrimary) {
-            delete this.$data.defaultPrimary;
-        }
-        if (!this.$data.defaultSecondary) {
-            delete this.$data.defaultSecondary;
-        }
-        if (!this.$data.unverifiedSecondary) {
-            delete this.$data.unverifiedSecondary;
-        }
-        this.$data.abilities = (0, lodash_1.difference)(this.$data.abilities ?? [], [
-            'system/admin',
-            'tilmeld/admin',
-            null,
-            undefined,
-        ]);
-        const unCheck = await this.$checkGroupname();
-        if (!unCheck.result) {
-            throw new errors_1.BadUsernameError(unCheck.message);
-        }
-        if (!tilmeld.config.emailUsernames) {
-            const emCheck = await this.$checkEmail();
-            if (!emCheck.result) {
-                throw new errors_1.BadEmailError(emCheck.message);
+        async $delete() {
+            let tilmeld = enforceTilmeld(this);
+            const User = this.$nymph.getEntityClass(UserClass);
+            if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new AccessControlError("You don't have the authority to delete groups.");
             }
-        }
-        if (this.$data.parent &&
-            (this.$data.parent.cdate == null ||
-                this.$is(this.$data.parent) ||
-                this.$data.parent.$isDescendant(this))) {
-            throw new errors_1.BadDataError("Group parent can't be itself or descendant of itself.");
-        }
-        try {
-            tilmeld.config.validatorGroup(this);
-        }
-        catch (e) {
-            throw new errors_1.BadDataError(e?.message);
-        }
-        if (this.$data.defaultPrimary) {
-            const currentPrimary = await this.$nymph.getEntity({ class: tilmeld.Group }, { type: '&', truthy: 'defaultPrimary' });
-            if (currentPrimary != null && !this.$is(currentPrimary)) {
-                currentPrimary.defaultPrimary = false;
-                if (!(await currentPrimary.$save())) {
-                    throw new errors_1.CouldNotChangeDefaultPrimaryGroupError('Could not change new user primary group from ' +
-                        `${currentPrimary.groupname}.`);
+            if (this.$data.groupname !== this.$originalGroupname) {
+                throw new AccessControlError("You can't delete a group while switching its groupname.");
+            }
+            for (let callback of this.constructor
+                .beforeDeleteCallbacks) {
+                if (callback) {
+                    await callback(this);
                 }
             }
-        }
-        return await super.$save();
-    }
-    async $saveSkipAC() {
-        this.$skipAcWhenSaving = true;
-        return await this.$save();
-    }
-    $tilmeldSaveSkipAC() {
-        if (this.$skipAcWhenSaving) {
-            this.$skipAcWhenSaving = false;
-            return true;
-        }
-        return false;
-    }
-    async $delete() {
-        let tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to delete groups.");
-        }
-        const transaction = 'tilmeld-delete-' + this.guid;
-        const nymph = this.$nymph;
-        const tnymph = await nymph.startTransaction(transaction);
-        this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        const descendants = await this.$getDescendants();
-        if (descendants.length) {
-            for (let curGroup of descendants) {
-                if (!(await curGroup.$delete())) {
-                    await tnymph.rollback(transaction);
-                    this.$nymph = nymph;
-                    return false;
+            // Delete children.
+            const children = await this.$nymph.getEntities({ class: tilmeld.Group, skipAc: true }, { type: '&', ref: ['parent', this] });
+            if (children.length) {
+                for (let curGroup of children) {
+                    if (this.$skipAcWhenDeleting) {
+                        await curGroup.$deleteSkipAC();
+                    }
+                    else {
+                        await curGroup.$delete();
+                    }
                 }
             }
-        }
-        const primaryUsers = await tnymph.getEntities({
-            class: tilmeld.User,
-            skipAc: true,
-        }, {
-            type: '&',
-            ref: ['group', this],
-        });
-        for (let user of primaryUsers) {
-            delete user.group;
-            if (!(await user.$save())) {
-                await tnymph.rollback(transaction);
-                this.$nymph = nymph;
-                return false;
+            // Remove users from this primary group.
+            const primaryUsers = await this.$nymph.getEntities({ class: User, skipAc: true }, { type: '&', ref: ['group', this] });
+            for (let user of primaryUsers) {
+                delete user.group;
+                if (this.$skipAcWhenDeleting) {
+                    await user.$saveSkipAC();
+                }
+                else {
+                    await user.$save();
+                }
+            }
+            // Remove users from this secondary group.
+            const secondaryUsers = await this.$nymph.getEntities({ class: User, skipAc: true }, { type: '&', ref: ['groups', this] });
+            for (let user of secondaryUsers) {
+                user.$delGroup(this);
+                if (this.$skipAcWhenDeleting) {
+                    await user.$saveSkipAC();
+                }
+                else {
+                    await user.$save();
+                }
+            }
+            // Delete the group.
+            await super.$delete();
+            for (let callback of this.constructor
+                .afterDeleteCallbacks) {
+                if (callback) {
+                    await callback(this);
+                }
             }
         }
-        const secondaryUsers = await tnymph.getEntities({
-            class: tilmeld.User,
-            skipAc: true,
-        }, {
-            type: '&',
-            ref: ['groups', this],
-        });
-        for (let user of secondaryUsers) {
-            user.$delGroup(this);
-            if (!(await user.$save())) {
-                await tnymph.rollback(transaction);
-                return false;
+        /*
+         * This should *never* be accessible on the client.
+         */
+        async $deleteSkipAC() {
+            this.$skipAcWhenDeleting = true;
+            await this.$delete();
+        }
+        $tilmeldDeleteSkipAC() {
+            if (this.$skipAcWhenDeleting) {
+                this.$skipAcWhenDeleting = false;
+                return true;
             }
+            return false;
         }
-        const success = await super.$delete();
-        if (success) {
-            await tnymph.commit(transaction);
+        static on(event, callback) {
+            const prop = (event + 'Callbacks');
+            if (!(prop in this)) {
+                throw new Error('Invalid event type.');
+            }
+            // @ts-ignore: The callback should always be the right type here.
+            this[prop].push(callback);
+            return () => this.off(event, callback);
         }
-        else {
-            await tnymph.rollback(transaction);
+        static off(event, callback) {
+            const prop = (event + 'Callbacks');
+            if (!(prop in this)) {
+                return false;
+            }
+            // @ts-ignore: The callback should always be the right type here.
+            const i = this[prop].indexOf(callback);
+            if (i > -1) {
+                // @ts-ignore: The callback should always be the right type here.
+                this[prop].splice(i, 1);
+            }
+            return true;
         }
-        this.$nymph = nymph;
-        return success;
-    }
-}
-exports.default = Group;
-Group.ETYPE = 'tilmeld_group';
-Group.class = 'Group';
-Group.DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
-Group.DEFAULT_ALLOWLIST_DATA = [];
-Group.clientEnabledStaticMethods = [
-    'getPrimaryGroups',
-    'getSecondaryGroups',
-];
-Group.searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
+    };
+})();
+/**
+ * A user group data model.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@port87.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
+export default Group;
 //# sourceMappingURL=Group.js.map