@nymphjs/tilmeld 1.0.0-beta.139 → 1.0.0-beta.140

package/src/Group.ts

@@ -342,6 +342,12 @@ export class Group extends AbleObject<GroupData> {
 
     if ('abilities' in input.data) {
       this.$checkIncomingAbilities(input.data.abilities);
+    } else if (
+      (this.$allowlistData == null ||
+        this.$allowlistData.includes('abilities')) &&
+      (this.$privateData == null || !this.$privateData.includes('abilities'))
+    ) {
+      this.$checkIncomingAbilities(undefined);
     }
 
     super.$jsonAcceptData(input, allowConflict);
@@ -354,6 +360,10 @@ export class Group extends AbleObject<GroupData> {
       this.$checkIncomingAbilities(patch.set.abilities);
     }
 
+    if (patch.unset.includes('abilities')) {
+      this.$checkIncomingAbilities(undefined);
+    }
+
     super.$jsonAcceptPatch(patch, allowConflict);
   }
 
@@ -378,6 +388,20 @@ export class Group extends AbleObject<GroupData> {
       );
     }
 
+    if (
+      xor(
+        incoming.filter((ability) => ability.startsWith('system/')),
+        this.abilities?.filter((ability) => ability.startsWith('system/')) ??
+          [],
+      ).length &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke system abilities.",
+      );
+    }
+
     if (
       incoming.includes('tilmeld/admin') !==
         this.abilities?.includes('tilmeld/admin') &&
@@ -402,10 +426,9 @@ export class Group extends AbleObject<GroupData> {
 
     if (
       xor(
-        incoming.filter((ability: string) => ability.startsWith('tilmeld/')),
-        this.abilities?.filter((ability: string) =>
-          ability.startsWith('tilmeld/'),
-        ) ?? [],
+        incoming.filter((ability) => ability.startsWith('tilmeld/')),
+        this.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ??
+          [],
       ).length &&
       (!tilmeld.currentUser ||
         (!tilmeld.currentUser.abilities?.includes('system/admin') &&
@@ -422,14 +445,21 @@ export class Group extends AbleObject<GroupData> {
     sdata?: SerializedEntityData,
     source?: 'server',
   ) {
-    super.$putData(data, sdata, source);
+    let newData = { ...data };
+    let newSdata = sdata && { ...sdata };
     // TODO: Fix these being added by the drivers.
     // @ts-ignore
-    delete this.acRead;
+    delete newData.acRead;
     // @ts-ignore
-    delete this.acWrite;
+    delete newData.acWrite;
     // @ts-ignore
-    delete this.acFull;
+    delete newData.acFull;
+    if (newSdata) {
+      delete newSdata.acRead;
+      delete newSdata.acWrite;
+      delete newSdata.acFull;
+    }
+    super.$putData(newData, newSdata, source);
     if (source === 'server') {
       this.$originalGroupname = this.groupname;
     }
@@ -437,13 +467,10 @@ export class Group extends AbleObject<GroupData> {
   }
 
   /**
-   * Update the data protection arrays for a user.
-   *
-   * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+   * Update the data protection arrays for the current user.
    */
-  public $updateDataProtection(givenUser?: UserClass) {
+  public $updateDataProtection() {
     const tilmeld = enforceTilmeld(this);
-    let user = givenUser ?? tilmeld.User.current();
     let [_groupname, domain] = tilmeld.config.domainSupport
       ? splitn(this.groupname ?? '', '@', 2)
       : [this.groupname, null];
@@ -460,25 +487,23 @@ export class Group extends AbleObject<GroupData> {
     }
 
     if (
-      user != null &&
-      (user.abilities?.includes('tilmeld/admin') ||
-        user.abilities?.includes('system/admin'))
+      tilmeld.gatekeeper('tilmeld/admin') ||
+      tilmeld.gatekeeper('system/admin')
     ) {
       // Users who can edit groups can see their data.
       this.$privateData = [];
       this.$allowlistData = undefined;
     } else if (
       this.user != null &&
-      user != null &&
-      this.user.guid === user.guid
+      tilmeld.currentUser != null &&
+      this.user.guid === tilmeld.currentUser.guid
     ) {
       // Users can see their group's data.
       this.$privateData = [];
     } else if (
-      user != null &&
       tilmeld.config.domainSupport &&
       domain &&
-      user.abilities?.includes(`tilmeld/domain/${domain}/admin`)
+      tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)
     ) {
       // Domain admins can see their groups' data.
       this.$privateData = [];
@@ -914,7 +939,7 @@ export class Group extends AbleObject<GroupData> {
     }
 
     // Groups should never have 'system/admin', 'tilmeld/admin',
-    // 'tilmeld/switch', or domain admin abilities.
+    // 'tilmeld/switch', or system abilities.
     this.abilities = (this.abilities ?? []).filter((ability) => {
       if (
         ['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
@@ -925,7 +950,7 @@ export class Group extends AbleObject<GroupData> {
       if (ability == null) {
         return false;
       }
-      if (ability.startsWith('tilmeld/domain/') && ability.endsWith('/admin')) {
+      if (ability.startsWith('system/')) {
         return false;
       }
       return true;

package/src/Tilmeld.ts

@@ -9,6 +9,10 @@ import {
   TilmeldAccessLevels,
   TilmeldAccessRequest,
   ACProperties,
+  entitiesToReferences,
+  entityConstructorsToClassNames,
+  classNamesToEntityConstructors,
+  referencesToEntities,
 } from '@nymphjs/nymph';
 import { Request, Response } from 'express';
 import { xor } from 'lodash-es';
@@ -165,15 +169,53 @@ export default class Tilmeld implements TilmeldInterface {
       const currentUserCDate = this.currentUser.cdate;
       const currentUserMDate = this.currentUser.mdate;
       const currentUserTags = this.currentUser.tags;
-      const currentUserData = this.currentUser.$getData();
+      const currentUserData = entityConstructorsToClassNames(
+        entitiesToReferences(this.currentUser.$getData(false), true),
+      );
       const currentUserSData = this.currentUser.$getSData();
+      const currentUserOriginalAcValues =
+        this.currentUser.$getOriginalAcValues();
 
       const user = this.User.factorySync();
       user.guid = currentUserGUID;
       user.cdate = currentUserCDate;
       user.mdate = currentUserMDate;
       user.tags = currentUserTags;
-      user.$putData(currentUserData, currentUserSData);
+      // First, put the trusted original AC values in with the server flag.
+      Entity.factorySync().$putData.call(
+        user,
+        {
+          ...currentUserOriginalAcValues,
+          user:
+            currentUserOriginalAcValues.user != null
+              ? this.User.factoryReference([
+                  'nymph_entity_reference',
+                  currentUserOriginalAcValues.user,
+                  this.User.class,
+                ])
+              : undefined,
+          group:
+            currentUserOriginalAcValues.group != null
+              ? this.Group.factoryReference([
+                  'nymph_entity_reference',
+                  currentUserOriginalAcValues.group,
+                  this.Group.class,
+                ])
+              : undefined,
+        },
+        {},
+        'server',
+      );
+      // Now put the real data in, that could potentially have been altered from
+      // the client.
+      user.$putData(
+        classNamesToEntityConstructors(
+          this.nymph,
+          referencesToEntities(currentUserData, this.nymph, false, false),
+          false,
+        ),
+        currentUserSData,
+      );
       user.$originalEmail = this.currentUser.$originalEmail;
       user.$originalUsername = this.currentUser.$originalUsername;
       this.currentUser = user;
@@ -292,7 +334,7 @@ export default class Tilmeld implements TilmeldInterface {
       if (entity == null) {
         throw new AccessControlError("You can't delete this entity by ID.");
       }
-      checkPermissionsDelete(nymph, entity);
+      await checkPermissionsDelete(nymph, entity);
     };
     checkPermissionsDeleteByID.skipOnClone = true;
 
@@ -373,7 +415,6 @@ export default class Tilmeld implements TilmeldInterface {
             !tilmeld.checkPermissions(
               entity,
               TilmeldAccessLevels.FULL_ACCESS,
-              undefined,
               originalAc,
             )
           ) {
@@ -740,7 +781,7 @@ export default class Tilmeld implements TilmeldInterface {
   }
 
   /**
-   * Check an entity's permissions for a user.
+   * Check an entity's permissions for the current user.
    *
    * This will check the AC (Access Control) properties of the entity. These
    * include the following properties:
@@ -800,37 +841,26 @@ export default class Tilmeld implements TilmeldInterface {
    *
    * @param entity The entity to check.
    * @param type The lowest level of permission to consider a pass.
-   * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
    * @param acProperties The acProperties to use instead of getting them from the entity.
    * @returns Whether the current user has at least `type` permission for the entity.
    */
   public checkPermissions(
     entity: EntityInterface,
     type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
-    user?: User | false,
     acProperties?: ACProperties,
   ) {
     if (!acProperties) {
       acProperties = entity.$getCurrentAcValues() as ACProperties;
     }
 
-    let userOrNull: User | null = null;
-    let userOrEmpty: User = this.User.factorySync();
-    // Calculate the user.
-    if (user == null) {
-      userOrNull = this.currentUser;
-      userOrEmpty = this.User.current(true);
-    } else if (user !== false) {
-      userOrNull = user;
-      userOrEmpty = user;
-    }
+    let userOrEmpty: User = this.User.current(true);
 
     // Users and groups are always readable. Editable by Tilmeld admins.
     if (
       (entity instanceof User || entity instanceof Group) &&
       (type === TilmeldAccessLevels.READ_ACCESS ||
-        userOrEmpty.abilities?.includes('tilmeld/admin') ||
-        userOrEmpty.abilities?.includes('system/admin'))
+        this.gatekeeper('tilmeld/admin') ||
+        this.gatekeeper('system/admin'))
     ) {
       return true;
     }
@@ -848,10 +878,7 @@ export default class Tilmeld implements TilmeldInterface {
         '@',
         2,
       );
-      if (
-        domain &&
-        userOrEmpty.abilities?.includes(`tilmeld/domain/${domain}/admin`)
-      ) {
+      if (domain && this.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
         return true;
       }
     }
@@ -861,7 +888,7 @@ export default class Tilmeld implements TilmeldInterface {
     const acGroup = acProperties.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
     const acOther = acProperties.acOther ?? TilmeldAccessLevels.NO_ACCESS;
 
-    if (userOrNull == null) {
+    if (this.currentUser == null) {
       return acOther >= type;
     }
 
@@ -931,7 +958,10 @@ export default class Tilmeld implements TilmeldInterface {
     }
 
     // Check ownership ac properties.
-    if (acProperties.user != null && acProperties.user === userOrNull.guid) {
+    if (
+      acProperties.user != null &&
+      acProperties.user === this.currentUser.guid
+    ) {
       return acUser >= type;
     }
     if (acProperties.group != null && allGids.includes(acProperties.group)) {
@@ -1013,10 +1043,26 @@ export default class Tilmeld implements TilmeldInterface {
    * @param user The user.
    */
   public async fillSession(user: User) {
-    this.currentUser = user;
+    // Clear any currently logged in user.
+    const oldUser = this.currentUser;
+    this.currentUser = null;
+    this.gatekeeperCache = null;
+    if (oldUser) {
+      oldUser.$updateDataProtection();
+      oldUser.$updateGroupDataProtection();
+    }
+
+    // Update data protection on the incoming user.
+    user.$updateDataProtection();
+    user.$updateGroupDataProtection();
+
+    // Get the gatekeeper cache for incoming user.
     this.gatekeeperCache = await user.$getGatekeeperCache();
 
-    // Now update the data protection on the user and all the groups.
+    // Now we're ready to set the current user.
+    this.currentUser = user;
+
+    // And update the data protection on the user and all the groups.
     this.currentUser.$updateDataProtection();
     this.currentUser.$updateGroupDataProtection();
   }

package/src/User.ts

@@ -927,19 +927,12 @@ export class User extends AbleObject<UserData> {
       if (domain) {
         domain = domain.toLowerCase();
       }
-      const user = tilmeld.User.current();
-      const isCurrentUser = user != null && user.$is(this);
-      // While loading, accessing abilities on the current user will infinitely
-      // loop, but if this is the current user, we can use its abilities.
-      const abilities =
-        (isCurrentUser || user == null ? this.abilities : user?.abilities) ??
-        [];
+      const isCurrentUser = this.$is(tilmeld.currentUser);
       const isNewUser = input.guid == null;
       const isDomainUser =
         !isCurrentUser &&
-        user != null &&
         domain &&
-        abilities.includes(`tilmeld/domain/${domain}/admin`);
+        tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`);
 
       reloadDataProtection = !!(isNewUser && isDomainUser);
     }
@@ -1045,14 +1038,21 @@ export class User extends AbleObject<UserData> {
     sdata?: SerializedEntityData,
     source?: 'server',
   ) {
-    super.$putData(data, sdata, source);
+    let newData = { ...data };
+    let newSdata = sdata && { ...sdata };
     // TODO: Fix these being added by the drivers.
     // @ts-ignore
-    delete this.acRead;
+    delete newData.acRead;
     // @ts-ignore
-    delete this.acWrite;
+    delete newData.acWrite;
     // @ts-ignore
-    delete this.acFull;
+    delete newData.acFull;
+    if (newSdata) {
+      delete newSdata.acRead;
+      delete newSdata.acWrite;
+      delete newSdata.acFull;
+    }
+    super.$putData(newData, newSdata, source);
     if (source === 'server') {
       this.$originalEmail = this.email;
       this.$originalUsername = this.username;
@@ -1061,13 +1061,10 @@ export class User extends AbleObject<UserData> {
   }
 
   /**
-   * Update the data protection arrays for a user.
-   *
-   * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+   * Update the data protection arrays for the current user.
    */
-  public $updateDataProtection(givenUser?: User) {
+  public $updateDataProtection() {
     const tilmeld = enforceTilmeld(this);
-    let user = givenUser ?? tilmeld.User.current();
     let [_username, domain] = tilmeld.config.domainSupport
       ? splitn(this.$originalUsername ?? this.username ?? '', '@', 2)
       : [this.$originalUsername ?? this.username, null];
@@ -1084,18 +1081,13 @@ export class User extends AbleObject<UserData> {
       this.$privateData.push('username');
     }
 
-    const isCurrentUser = user != null && user.$is(this);
-    // While loading, accessing abilities on the current user will infinitely
-    // loop, but if this is the current user, we can use its abilities.
-    const abilities =
-      (isCurrentUser || user == null ? this.abilities : user?.abilities) ?? [];
+    const isCurrentUser = this.$is(tilmeld.currentUser);
     const isNewUser = this.guid == null;
     const isDomainUser =
       tilmeld.config.domainSupport &&
       !isCurrentUser &&
-      user != null &&
       domain &&
-      abilities.includes(`tilmeld/domain/${domain}/admin`);
+      tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`);
 
     if (isCurrentUser) {
       // Users can check to see what abilities they have.
@@ -1121,12 +1113,18 @@ export class User extends AbleObject<UserData> {
     }
 
     if (
-      user != null &&
-      (abilities.includes('tilmeld/admin') ||
-        abilities.includes('system/admin'))
+      tilmeld.gatekeeper('tilmeld/admin') ||
+      tilmeld.gatekeeper('system/admin')
     ) {
       // Users who can edit other users can see most of their data.
-      this.$privateData = ['password', 'salt', 'totpSecret'];
+      this.$privateData = [
+        'newEmailSecret',
+        'cancelEmailSecret',
+        'recoverSecret',
+        'salt',
+        'password',
+        'totpSecret',
+      ];
       this.$clientEnabledMethods.push('$hasTOTPSecret');
       this.$clientEnabledMethods.push('$removeTOTPSecret');
       this.$allowlistData = undefined;
@@ -1229,10 +1227,9 @@ export class User extends AbleObject<UserData> {
     }
 
     if (
-      user != null &&
       !isCurrentUser &&
-      (abilities.includes('tilmeld/switch') ||
-        abilities.includes('system/admin'))
+      (tilmeld.gatekeeper('tilmeld/switch') ||
+        tilmeld.gatekeeper('system/admin'))
     ) {
       // Users with this ability can switch to other users.
       this.$clientEnabledMethods.push('$switchUser');
@@ -1647,14 +1644,42 @@ export class User extends AbleObject<UserData> {
    * @param data The input data from the client.
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
-  public async $revokeCurrentTokens(data: {
+  public async $revokeCurrentTokens(data?: {
     password: string;
   }): Promise<{ result: boolean; message: string }> {
     const tilmeld = enforceTilmeld(this);
+
     if (!tilmeld.gatekeeper()) {
       return { result: false, message: 'You must be logged in.' };
     }
-    if (!(await this.$checkPassword(data.password ?? ''))) {
+
+    if (this.guid == null) {
+      return { result: false, message: 'This user has not been saved.' };
+    }
+
+    // Work on real data.
+    await this.$refresh();
+
+    let [_username, domain] = tilmeld.config.domainSupport
+      ? splitn(this.$originalUsername ?? this.username ?? '', '@', 2)
+      : [this.$originalUsername ?? this.username, null];
+    // Lowercase the domain part.
+    if (domain) {
+      domain = domain.toLowerCase();
+    }
+
+    const isAdmin = tilmeld.gatekeeper('tilmeld/admin');
+    const isDomainUser =
+      tilmeld.config.domainSupport &&
+      !this.$is(tilmeld.currentUser) &&
+      domain &&
+      tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`);
+
+    if (
+      !isAdmin &&
+      !isDomainUser &&
+      (data == null || !(await this.$checkPassword(data.password ?? '')))
+    ) {
       return { result: false, message: 'Incorrect password.' };
     }
 

package/src/conf/defaults.ts

@@ -233,6 +233,21 @@ export default {
             .pattern(/^[0-9]+$/, 'numbers'),
         }
       : {};
+    for (let ability of group.abilities ?? []) {
+      if (ability.startsWith('system/')) {
+        throw new Error('Invalid Group: Groups cannot have system abilities.');
+      }
+      if (ability === 'tilmeld/admin') {
+        throw new Error(
+          'Invalid Group: Groups cannot have Tilmeld admin ability.',
+        );
+      }
+      if (ability === 'tilmeld/switch') {
+        throw new Error(
+          'Invalid Group: Groups cannot have Tilmeld switch ability.',
+        );
+      }
+    }
     Joi.attempt(
       group.$getValidatable(),
       Joi.object().keys({