@nymphjs/tilmeld 1.0.0-beta.14 → 1.0.0-beta.140

package/src/Group.ts

@@ -1,26 +1,68 @@
+import crypto from 'node:crypto';
 import {
-  EntityData,
-  EntityInterface,
-  EntityJson,
-  EntityPatch,
-  Options,
-  Selector,
-  SerializedEntityData,
+  clearSearchRestrictedData,
+  type EntityJson,
+  type EntityPatch,
+  type Options,
+  type Selector,
+  type SerializedEntityData,
+  transaction,
+  transactional,
 } from '@nymphjs/nymph';
-import md5 from 'crypto-js/md5';
-import { difference } from 'lodash';
+import { nanoid } from '@nymphjs/guid';
+import { difference, xor } from 'lodash-es';
+import { splitn } from '@sciactive/splitn';
 
-import type Tilmeld from './Tilmeld';
-import AbleObject from './AbleObject';
+import { enforceTilmeld } from './enforceTilmeld.js';
+import { AbleObject } from './AbleObject.js';
 import {
+  AccessControlError,
   BadDataError,
   BadEmailError,
   BadUsernameError,
   CouldNotChangeDefaultPrimaryGroupError,
-} from './errors';
-import User, { UserData } from './User';
+} from './errors/index.js';
+import { User as UserClass } from './User.js';
 
-export type GroupData = {
+export type GroupEventType =
+  | 'checkGroupname'
+  | 'beforeSave'
+  | 'afterSave'
+  | 'beforeDelete'
+  | 'afterDelete';
+/**
+ * This is run when the user has entered an otherwise valid groupname into the
+ * signup form. It should return a result, which when false will stop the
+ * process and return the included message, disallowing the groupname.
+ */
+export type TilmeldCheckGroupnameCallback = (
+  group: Group,
+  data: { groupname: string },
+) => Promise<{ result: boolean; message?: string }>;
+/**
+ * This is run just before the group is saved, so all checks have passed.
+ *
+ * The transaction is available in `group.$nymph`.
+ */
+export type TilmeldBeforeGroupSaveCallback = (group: Group) => Promise<void>;
+/**
+ * This is run before the transaction is committed, and you can perform
+ * additional functions on the transaction, which is available in
+ * `group.$nymph`.
+ */
+export type TilmeldAfterGroupSaveCallback = (group: Group) => Promise<void>;
+/**
+ * The transaction is available in `group.$nymph`.
+ */
+export type TilmeldBeforeGroupDeleteCallback = (group: Group) => Promise<void>;
+/**
+ * This is run before the transaction is committed, and you can perform
+ * additional functions on the transaction, which is available in
+ * `group.$nymph`.
+ */
+export type TilmeldAfterGroupDeleteCallback = (group: Group) => Promise<void>;
+
+export interface GroupData {
   /**
    * The abilities granted to the group.
    */
@@ -48,11 +90,11 @@ export type GroupData = {
   /**
    * The group's parent.
    */
-  parent?: Group & GroupData;
+  parent?: Group;
   /**
    * If generatePrimary is on, this will be the user who generated this group.
    */
-  user?: (User & UserData) | null;
+  user?: UserClass | null;
 
   /**
    * Whether the group can be used.
@@ -70,24 +112,27 @@ export type GroupData = {
    * Whether this group is a default secondary group for unverified users.
    */
   unverifiedSecondary?: boolean;
-};
+}
+
+export interface Group extends GroupData {}
 
 /**
  * A user group data model.
  *
  * Written by Hunter Perrin for SciActive.
  *
- * @author Hunter Perrin <hperrin@gmail.com>
+ * @author Hunter Perrin <hperrin@port87.com>
  * @copyright SciActive Inc
  * @see http://nymph.io/
  */
-export default class Group extends AbleObject<GroupData> {
-  /**
-   * The instance of Tilmeld to use for queries.
-   */
-  static tilmeld: Tilmeld;
+export class Group extends AbleObject<GroupData> {
   static ETYPE = 'tilmeld_group';
   static class = 'Group';
+  private static checkGroupnameCallbacks: TilmeldCheckGroupnameCallback[] = [];
+  private static beforeSaveCallbacks: TilmeldBeforeGroupSaveCallback[] = [];
+  private static afterSaveCallbacks: TilmeldAfterGroupSaveCallback[] = [];
+  private static beforeDeleteCallbacks: TilmeldBeforeGroupDeleteCallback[] = [];
+  private static afterDeleteCallbacks: TilmeldAfterGroupDeleteCallback[] = [];
 
   private static DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
   private static DEFAULT_ALLOWLIST_DATA: string[] = [];
@@ -112,17 +157,36 @@ export default class Group extends AbleObject<GroupData> {
   protected $allowlistTags?: string[] = [];
 
   /**
-   * This is explicitly used only during the registration proccess.
+   * This should only be used by the backend.
    */
   private $skipAcWhenSaving = false;
+  /**
+   * This should only be used by the backend.
+   */
+  private $skipAcWhenDeleting = false;
+  /**
+   * Used to save the current groupname for domain admin permissions.
+   */
+  public $originalGroupname?: string;
 
-  static async factory(guid?: string): Promise<Group & GroupData> {
-    return (await super.factory(guid)) as Group & GroupData;
+  public static getFTSText(name: string, value: any) {
+    if (
+      [
+        'abilities',
+        'parent',
+        'user',
+        'enabled',
+        'defaultPrimary',
+        'defaultSecondary',
+        'unverifiedSecondary',
+      ].indexOf(name) !== -1
+    ) {
+      return null;
+    }
+    return super.getFTSText(name, value);
   }
 
-  static async factoryGroupname(
-    groupname?: string
-  ): Promise<Group & GroupData> {
+  static async factoryGroupname(groupname?: string): Promise<Group> {
     const entity = new this();
     if (groupname != null) {
       const entity = await this.nymph.getEntity(
@@ -132,7 +196,7 @@ export default class Group extends AbleObject<GroupData> {
         {
           type: '&',
           ilike: ['groupname', groupname.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        }
+        },
       );
       if (entity != null) {
         return entity;
@@ -141,21 +205,6 @@ export default class Group extends AbleObject<GroupData> {
     return entity;
   }
 
-  static factorySync(guid?: string): Group & GroupData {
-    return super.factorySync(guid) as Group & GroupData;
-  }
-
-  constructor(guid?: string) {
-    super(guid);
-
-    if (this.guid == null) {
-      // Defaults.
-      this.$data.enabled = true;
-      this.$data.abilities = [];
-      this.$updateDataProtection();
-    }
-  }
-
   /**
    * Get all the groups that can be assigned as primary groups.
    *
@@ -165,16 +214,17 @@ export default class Group extends AbleObject<GroupData> {
    */
   public static async getPrimaryGroups(
     options?: Options,
-    selectors?: Selector[]
+    selectors?: Selector[],
   ) {
-    if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
+    const tilmeld = enforceTilmeld(this);
+    if (!tilmeld.gatekeeper('tilmeld/admin')) {
       throw new Error("You don't have permission to do that.");
     }
 
     return await this.getAssignableGroups(
-      this.tilmeld.config.highestPrimary,
-      { ...options, class: this.tilmeld.Group, return: 'entity' },
-      [...(selectors ?? [])]
+      tilmeld.config.highestPrimary,
+      { ...options, class: tilmeld.Group, return: 'entity' },
+      [...(selectors ?? [])],
     );
   }
 
@@ -187,112 +237,247 @@ export default class Group extends AbleObject<GroupData> {
    */
   public static async getSecondaryGroups(
     options?: Options,
-    selectors?: Selector[]
+    selectors?: Selector[],
   ) {
-    if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
+    const tilmeld = enforceTilmeld(this);
+    if (!tilmeld.gatekeeper('tilmeld/admin')) {
       throw new Error("You don't have permission to do that.");
     }
 
     return await this.getAssignableGroups(
-      this.tilmeld.config.highestSecondary,
-      { ...options, class: this.tilmeld.Group, return: 'entity' },
-      [...(selectors ?? [])]
+      tilmeld.config.highestSecondary,
+      { ...options, class: tilmeld.Group, return: 'entity' },
+      [...(selectors ?? [])],
     );
   }
 
   private static async getAssignableGroups(
     highestParent: string | boolean,
     options: Options<typeof Group>,
-    selectors: Selector[]
+    selectors: Selector[],
   ) {
-    let assignableGroups: (Group & GroupData)[] = [];
+    const tilmeld = enforceTilmeld(this);
+    let assignableGroups: Group[] = [];
 
     if (highestParent === false) {
       return assignableGroups;
     }
 
+    ({ options, selectors } = clearSearchRestrictedData({
+      options,
+      selectors,
+    }));
+
     assignableGroups = await this.nymph.getEntities(
-      { ...options, class: this.tilmeld.Group },
-      ...selectors
+      { ...options, class: tilmeld.Group },
+      ...selectors,
     );
     if (highestParent !== true) {
-      assignableGroups = assignableGroups.filter((group) => {
-        let curGroup = group;
-        while (curGroup.parent != null && curGroup.parent.cdate != null) {
-          if (curGroup.parent.guid === highestParent) {
-            return true;
-          }
-          curGroup = curGroup.parent;
-        }
-        return false;
-      });
+      assignableGroups = (
+        await Promise.all(
+          assignableGroups.map(async (group) => {
+            let curGroup = group;
+            let parent = curGroup.parent;
+            await parent?.$wake();
+            while (parent != null && parent?.cdate != null) {
+              if (parent?.guid === highestParent) {
+                return group;
+              }
+              curGroup = parent;
+              parent = curGroup.parent;
+              await parent?.$wake();
+            }
+            return null;
+          }),
+        )
+      ).filter((group) => group != null) as Group[];
     }
     return assignableGroups;
   }
 
-  public $getAvatar() {
-    if (this.$data.avatar != null && this.$data.avatar !== '') {
-      return this.$data.avatar;
+  constructor() {
+    super();
+
+    // Defaults.
+    this.enabled = true;
+    this.abilities = [];
+    this.$updateDataProtection();
+  }
+
+  async $getUniques(): Promise<string[]> {
+    const tilmeld = enforceTilmeld(this);
+    const uniques = [`u:${this.groupname}`];
+    if (
+      !tilmeld.config.emailUsernames &&
+      tilmeld.config.userFields.includes('email')
+    ) {
+      uniques.push(`e:${this.email}`);
+    }
+    if (this.defaultPrimary) {
+      uniques.push(`o:default-primary`);
+    }
+    return uniques;
+  }
+
+  public $getAvatar(): string {
+    if (this.avatar != null && this.avatar !== '') {
+      return this.avatar;
     }
-    if (this.$data.email == null || !this.$data.email.length) {
+    if (this.email == null || !this.email.length) {
       return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
     }
     return (
       'https://secure.gravatar.com/avatar/' +
-      md5(this.$data.email.trim().toLowerCase()).toString() +
+      crypto
+        .createHash('sha256')
+        .update(this.email.trim().toLowerCase())
+        .digest('hex')
+        .toLowerCase() +
       '?d=identicon&s=40'
     );
   }
 
   public $jsonAcceptData(input: EntityJson, allowConflict = false) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    this.$referenceWake();
+    this.$check();
 
-    if (
-      input.data.abilities?.indexOf('system/admin') !== -1 &&
-      this.$data.abilities?.indexOf('system/admin') === -1 &&
-      tilmeld.gatekeeper('tilmeld/admin') &&
-      !tilmeld.gatekeeper('system/admin')
+    if ('abilities' in input.data) {
+      this.$checkIncomingAbilities(input.data.abilities);
+    } else if (
+      (this.$allowlistData == null ||
+        this.$allowlistData.includes('abilities')) &&
+      (this.$privateData == null || !this.$privateData.includes('abilities'))
     ) {
-      throw new BadDataError(
-        "You don't have the authority to make this group a system admin."
-      );
+      this.$checkIncomingAbilities(undefined);
     }
 
     super.$jsonAcceptData(input, allowConflict);
   }
 
   public $jsonAcceptPatch(patch: EntityPatch, allowConflict = false) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    this.$referenceWake();
+    this.$check();
+
+    if ('abilities' in patch.set) {
+      this.$checkIncomingAbilities(patch.set.abilities);
+    }
+
+    if (patch.unset.includes('abilities')) {
+      this.$checkIncomingAbilities(undefined);
+    }
+
+    super.$jsonAcceptPatch(patch, allowConflict);
+  }
+
+  private $checkIncomingAbilities(incoming: any) {
+    const tilmeld = enforceTilmeld(this);
+
+    if (
+      !Array.isArray(incoming) ||
+      incoming.find((ability) => typeof ability !== 'string')
+    ) {
+      throw new BadDataError('Abilities must be an array of strings.');
+    }
 
     if (
-      patch.set.abilities?.indexOf('system/admin') !== -1 &&
-      this.$data.abilities?.indexOf('system/admin') === -1 &&
-      tilmeld.gatekeeper('tilmeld/admin') &&
-      !tilmeld.gatekeeper('system/admin')
+      incoming.includes('system/admin') !==
+        this.abilities?.includes('system/admin') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to make this group a system admin."
+        "You don't have the authority to grant or revoke system/admin.",
       );
     }
 
-    super.$jsonAcceptPatch(patch, allowConflict);
+    if (
+      xor(
+        incoming.filter((ability) => ability.startsWith('system/')),
+        this.abilities?.filter((ability) => ability.startsWith('system/')) ??
+          [],
+      ).length &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke system abilities.",
+      );
+    }
+
+    if (
+      incoming.includes('tilmeld/admin') !==
+        this.abilities?.includes('tilmeld/admin') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/admin.",
+      );
+    }
+
+    if (
+      incoming.includes('tilmeld/switch') !==
+        this.abilities?.includes('tilmeld/switch') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/switch.",
+      );
+    }
+
+    if (
+      xor(
+        incoming.filter((ability) => ability.startsWith('tilmeld/')),
+        this.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ??
+          [],
+      ).length &&
+      (!tilmeld.currentUser ||
+        (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+          !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke Tilmeld abilities.",
+      );
+    }
   }
 
-  public $putData(data: EntityData, sdata?: SerializedEntityData) {
-    super.$putData(data, sdata);
+  public $putData(
+    data: GroupData,
+    sdata?: SerializedEntityData,
+    source?: 'server',
+  ) {
+    let newData = { ...data };
+    let newSdata = sdata && { ...sdata };
+    // TODO: Fix these being added by the drivers.
+    // @ts-ignore
+    delete newData.acRead;
+    // @ts-ignore
+    delete newData.acWrite;
+    // @ts-ignore
+    delete newData.acFull;
+    if (newSdata) {
+      delete newSdata.acRead;
+      delete newSdata.acWrite;
+      delete newSdata.acFull;
+    }
+    super.$putData(newData, newSdata, source);
+    if (source === 'server') {
+      this.$originalGroupname = this.groupname;
+    }
     this.$updateDataProtection();
   }
 
   /**
-   * Update the data protection arrays for a user.
-   *
-   * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+   * Update the data protection arrays for the current user.
    */
-  public $updateDataProtection(givenUser?: User & UserData) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    let user = givenUser ?? tilmeld.User.current();
+  public $updateDataProtection() {
+    const tilmeld = enforceTilmeld(this);
+    let [_groupname, domain] = tilmeld.config.domainSupport
+      ? splitn(this.groupname ?? '', '@', 2)
+      : [this.groupname, null];
+    // Lowercase the domain part.
+    if (domain) {
+      domain = domain.toLowerCase();
+    }
 
     this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
     this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
@@ -302,34 +487,40 @@ export default class Group extends AbleObject<GroupData> {
     }
 
     if (
-      user != null &&
-      ((user.abilities?.indexOf('tilmeld/admin') ?? -1) !== -1 ||
-        (user.abilities?.indexOf('system/admin') ?? -1) !== -1)
+      tilmeld.gatekeeper('tilmeld/admin') ||
+      tilmeld.gatekeeper('system/admin')
     ) {
       // Users who can edit groups can see their data.
       this.$privateData = [];
       this.$allowlistData = undefined;
     } else if (
-      this.$data.user != null &&
-      user != null &&
-      this.$data.user.$is(user)
+      this.user != null &&
+      tilmeld.currentUser != null &&
+      this.user.guid === tilmeld.currentUser.guid
     ) {
       // Users can see their group's data.
       this.$privateData = [];
+    } else if (
+      tilmeld.config.domainSupport &&
+      domain &&
+      tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)
+    ) {
+      // Domain admins can see their groups' data.
+      this.$privateData = [];
     }
   }
 
   /**
-   * Check whether the group is a descendant of a group.
+   * Check whether the group is a descendant of the given group.
    *
    * @param group The group, or the group's GUID.
    * @returns True or false.
    */
-  public $isDescendant(givenGroup: (Group & GroupData) | string): boolean {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    let group: Group & GroupData;
+  public async $isDescendant(givenGroup: Group | string): Promise<boolean> {
+    const tilmeld = enforceTilmeld(this);
+    let group: Group;
     if (typeof givenGroup === 'string') {
-      group = tilmeld.Group.factorySync(givenGroup);
+      group = await tilmeld.Group.factory(givenGroup);
     } else {
       group = givenGroup;
     }
@@ -337,13 +528,15 @@ export default class Group extends AbleObject<GroupData> {
       return false;
     }
     // Check to see if the group is a descendant of the given group.
-    if (this.$data.parent == null) {
+    const parent = this.parent;
+    await parent?.$wake();
+    if (parent == null) {
       return false;
     }
-    if (this.$data.parent.$is(group)) {
+    if (parent.$is(group)) {
       return true;
     }
-    if (this.$data.parent.$isDescendant(group)) {
+    if (await parent.$isDescendant(group)) {
       return true;
     }
     return false;
@@ -354,15 +547,15 @@ export default class Group extends AbleObject<GroupData> {
    *
    * @returns An array of groups.
    */
-  public async $getChildren() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+  public async $getChildren(): Promise<Group[]> {
+    const tilmeld = enforceTilmeld(this);
     return await this.$nymph.getEntities(
       { class: tilmeld.Group },
       {
         type: '&',
         equal: ['enabled', true],
         ref: ['parent', this],
-      }
+      },
     );
   }
 
@@ -370,20 +563,22 @@ export default class Group extends AbleObject<GroupData> {
    * Gets an array of the group's descendant groups.
    *
    * @param andSelf Include this group in the returned array.
+   * @param andDisabled Include disabled groups.
    * @returns An array of groups.
    */
   public async $getDescendants(
-    andSelf = false
-  ): Promise<(Group & GroupData)[]> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    let groups: (Group & GroupData)[] = [];
+    andSelf = false,
+    andDisabled = false,
+  ): Promise<Group[]> {
+    const tilmeld = enforceTilmeld(this);
+    let groups: Group[] = [];
     const entities = await this.$nymph.getEntities(
       { class: tilmeld.Group },
       {
         type: '&',
-        equal: ['enabled', true],
+        ...(andDisabled ? {} : { equal: ['enabled', true] }),
         ref: ['parent', this],
-      }
+      },
     );
     for (let entity of entities) {
       groups = (await entity.$getDescendants(true)).concat(groups);
@@ -394,37 +589,6 @@ export default class Group extends AbleObject<GroupData> {
     return groups;
   }
 
-  /**
-   * Gets an array of the group's descendant groups.
-   *
-   * @param andSelf Include this group in the returned array.
-   * @returns An array of groups.
-   */
-  public $getDescendantsSync(andSelf = false): (Group & GroupData)[] {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    let groups: (Group & GroupData)[] = [];
-    let entity: EntityInterface | null;
-    let offset = 0;
-    do {
-      entity = this.$nymph.driver.getEntitySync(
-        { class: tilmeld.Group, offset },
-        {
-          type: '&',
-          equal: ['enabled', true],
-          ref: ['parent', this],
-        }
-      );
-      if (entity != null) {
-        groups = entity.$getDescendantsSync(true).concat(groups);
-      }
-      offset++;
-    } while (entity != null);
-    if (andSelf) {
-      groups.push(this);
-    }
-    return groups;
-  }
-
   /**
    * Get the number of parents the group has.
    *
@@ -436,19 +600,23 @@ export default class Group extends AbleObject<GroupData> {
    *
    * @returns The level of the group.
    */
-  public $getLevel() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    let group = tilmeld.Group.factorySync(this.guid ?? undefined);
+  public async $getLevel(): Promise<number> {
+    const tilmeld = enforceTilmeld(this);
+    let group = await tilmeld.Group.factory(this.guid ?? undefined);
+    let parent = group.parent;
+    await parent?.$wake();
     let level = 0;
-    while (group.parent != null && group.parent.cdate != null && level < 1024) {
+    while (parent != null && parent.cdate != null && level < 1024) {
       level++;
-      group = group.parent;
+      group = parent;
+      parent = group.parent;
+      await parent?.$wake();
     }
     return level;
   }
 
   /**
-   * Gets an array of users in the group.
+   * Gets an array of enabled users in the group.
    *
    * @param descendants Include users in all descendant groups too.
    * @param limit The limit for the query.
@@ -458,10 +626,10 @@ export default class Group extends AbleObject<GroupData> {
   public async $getUsers(
     descendants = false,
     limit?: number,
-    offset?: number
-  ): Promise<(User & UserData)[]> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    let groups: (Group & GroupData)[] = [];
+    offset?: number,
+  ): Promise<UserClass[]> {
+    const tilmeld = enforceTilmeld(this);
+    let groups: Group[] = [];
     if (descendants) {
       groups = await this.$getDescendants();
     }
@@ -471,25 +639,16 @@ export default class Group extends AbleObject<GroupData> {
         limit,
         offset,
       },
-      {
-        type: '&',
-        equal: ['enabled', true],
-      },
+      { type: '&', equal: ['enabled', true] },
       {
         type: '|',
         ref: [
           ['group', this],
           ['groups', this],
-          ...groups.map((group): [string, Group & GroupData] => [
-            'group',
-            group,
-          ]),
-          ...groups.map((group): [string, Group & GroupData] => [
-            'groups',
-            group,
-          ]),
+          ...groups.map((group): [string, Group] => ['group', group]),
+          ...groups.map((group): [string, Group] => ['groups', group]),
         ],
-      }
+      },
     );
   }
 
@@ -502,15 +661,36 @@ export default class Group extends AbleObject<GroupData> {
     result: boolean;
     message: string;
   }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (!tilmeld.config.emailUsernames) {
-      if (this.$data.groupname == null || !this.$data.groupname.length) {
-        return { result: false, message: 'Please specify a groupname.' };
+      let [groupname, domain] = tilmeld.config.domainSupport
+        ? splitn(this.groupname ?? '', '@', 2)
+        : [this.groupname, null];
+
+      // Lowercase the domain part.
+      if (domain) {
+        domain = domain.toLowerCase();
+        this.groupname = `${groupname}@${domain}`;
       }
+
       if (
-        tilmeld.config.maxUsernameLength > 0 &&
-        this.$data.groupname.length > tilmeld.config.maxUsernameLength
+        this.groupname == null ||
+        !this.groupname.length ||
+        groupname == null ||
+        !groupname.length
       ) {
+        return { result: false, message: 'Please specify a groupname.' };
+      }
+      if (groupname.length < tilmeld.config.minUsernameLength) {
+        return {
+          result: false,
+          message:
+            'Groupnames must be at least ' +
+            tilmeld.config.minUsernameLength +
+            ' characters.',
+        };
+      }
+      if (groupname.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -520,28 +700,44 @@ export default class Group extends AbleObject<GroupData> {
         };
       }
       if (
-        difference(
-          this.$data.groupname.split(''),
-          tilmeld.config.validChars.split('')
-        ).length
+        difference(groupname.split(''), tilmeld.config.validChars.split(''))
+          .length
       ) {
         return {
           result: false,
           message: tilmeld.config.validCharsNotice,
         };
       }
-      if (!tilmeld.config.validRegex.test(this.$data.groupname)) {
+      if (!tilmeld.config.validRegex.test(groupname)) {
         return {
           result: false,
           message: tilmeld.config.validRegexNotice,
         };
       }
+      if (domain != null) {
+        if (!tilmeld.config.validDomainRegex.test(domain)) {
+          return {
+            result: false,
+            message: tilmeld.config.validDomainRegexNotice,
+          };
+        }
+        if (
+          !this.$is(tilmeld.currentUser?.group) &&
+          !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)
+        ) {
+          return {
+            result: false,
+            message:
+              "You don't have the authority to manage groups on this domain.",
+          };
+        }
+      }
 
       const selector: Selector = {
         type: '&',
         ilike: [
           'groupname',
-          this.$data.groupname.replace(/([\\%_])/g, (s) => `\\${s}`),
+          this.groupname.replace(/([\\%_])/g, (s) => `\\${s}`),
         ],
       };
       if (this.guid != null) {
@@ -549,26 +745,44 @@ export default class Group extends AbleObject<GroupData> {
       }
       const test = await this.$nymph.getEntity(
         { class: tilmeld.Group, skipAc: true },
-        selector
+        selector,
       );
       if (test != null) {
         return { result: false, message: 'That groupname is taken.' };
       }
 
+      for (let callback of (this.constructor as typeof Group)
+        .checkGroupnameCallbacks) {
+        if (callback) {
+          const result = await callback(this, {
+            groupname: this.groupname,
+          });
+          if (!result.result) {
+            return { message: 'Groupname is not available.', ...result };
+          }
+        }
+      }
+
       return {
         result: true,
         message:
           this.guid != null ? 'Groupname is valid.' : 'Groupname is available!',
       };
     } else {
-      this.$data.email = this.$data.groupname;
-      if (this.$data.groupname == null || !this.$data.groupname.length) {
+      this.email = this.groupname;
+      if (this.groupname == null || !this.groupname.length) {
         return { result: false, message: 'Please specify an email.' };
       }
-      if (
-        tilmeld.config.maxUsernameLength > 0 &&
-        this.$data.groupname.length > tilmeld.config.maxUsernameLength
-      ) {
+      if (this.groupname.length < tilmeld.config.minUsernameLength) {
+        return {
+          result: false,
+          message:
+            'Emails must be at least ' +
+            tilmeld.config.minUsernameLength +
+            ' characters.',
+        };
+      }
+      if (this.groupname.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -588,14 +802,14 @@ export default class Group extends AbleObject<GroupData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkEmail(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    if (this.$data.email === '') {
+    const tilmeld = enforceTilmeld(this);
+    if (this.email === '') {
       return { result: true, message: '' };
     }
-    if (this.$data.email == null) {
+    if (this.email == null) {
       return { result: false, message: 'Please specify a valid email.' };
     }
-    if (!tilmeld.config.validEmailRegex.test(this.$data.email)) {
+    if (!tilmeld.config.validEmailRegex.test(this.email)) {
       return {
         result: false,
         message: tilmeld.config.validEmailRegexNotice,
@@ -603,14 +817,14 @@ export default class Group extends AbleObject<GroupData> {
     }
     const selector: Selector = {
       type: '&',
-      ilike: ['email', this.$data.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
+      ilike: ['email', this.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
     };
     if (this.guid != null) {
       selector['!guid'] = this.guid;
     }
     const test = await this.$nymph.getEntity(
       { class: tilmeld.Group, skipAc: true },
-      selector
+      selector,
     );
     if (test != null) {
       return {
@@ -627,64 +841,130 @@ export default class Group extends AbleObject<GroupData> {
   }
 
   public async $save() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
-      return false;
+    let tilmeld = enforceTilmeld(this);
+    if (this.groupname == null || !this.groupname.trim().length) {
+      throw new BadUsernameError('Groupname must not be empty.');
+    }
+
+    // Lowercase the domain part.
+    if (tilmeld.config.domainSupport) {
+      const [groupname, domain] = splitn(this.groupname ?? '', '@', 2);
+      if (domain) {
+        this.groupname = `${groupname}@${domain.toLowerCase()}`;
+      }
+    }
+
+    if (tilmeld.config.domainSupport) {
+      const [_groupname, domain] = splitn(this.groupname ?? '', '@', 2);
+      const [_originalGroupname, originalDomain] = splitn(
+        this.$originalGroupname ?? '',
+        '@',
+        2,
+      );
+
+      if (
+        this.guid != null &&
+        ((originalDomain == null && domain != null) ||
+          (domain == null && originalDomain != null))
+      ) {
+        throw new AccessControlError(
+          "Groups can't switch to or from having a domain once created.",
+        );
+      }
+
+      if (
+        !this.$skipAcWhenSaving &&
+        !tilmeld.gatekeeper('tilmeld/admin') &&
+        !tilmeld.gatekeeper('system/admin')
+      ) {
+        if (
+          domain != null &&
+          !this.$is(tilmeld.currentUser) &&
+          !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)
+        ) {
+          throw new AccessControlError(
+            "You don't have the authority to modify groups on this domain.",
+          );
+        }
+        if (
+          originalDomain != null &&
+          originalDomain !== domain &&
+          (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+            !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))
+        ) {
+          throw new AccessControlError(
+            "You don't have the authority to modify groups on this domain.",
+          );
+        }
+      }
     }
 
     // Formatting.
-    this.$data.groupname = this.$data.groupname.trim();
+    this.groupname = this.groupname.trim();
     if (tilmeld.config.emailUsernames) {
-      this.$data.email = this.$data.groupname;
+      this.email = this.groupname;
     }
-    this.$data.email = (this.$data.email ?? '').trim();
-    this.$data.name = (this.$data.name ?? '').trim();
-    this.$data.phone = (this.$data.phone ?? '').trim();
-    this.$data.enabled = !!this.$data.enabled;
+    this.email = (this.email ?? '').trim();
+    this.name = (this.name ?? '').trim();
+    this.phone = (this.phone ?? '').trim();
+    this.enabled = !!this.enabled;
 
     // Clear empty values.
-    if (this.$data.name === '') {
-      delete this.$data.name;
+    if (this.name === '' || !tilmeld.config.userFields.includes('name')) {
+      delete this.name;
     }
-    if (this.$data.email === '') {
-      delete this.$data.email;
+    if (this.email === '' || !tilmeld.config.userFields.includes('email')) {
+      delete this.email;
     }
-    if (this.$data.avatar === '') {
-      delete this.$data.avatar;
+    if (this.avatar === '') {
+      delete this.avatar;
     }
-    if (this.$data.phone === '') {
-      delete this.$data.phone;
+    if (this.phone === '' || !tilmeld.config.userFields.includes('phone')) {
+      delete this.phone;
     }
-    if (this.$data.parent == null) {
-      delete this.$data.parent;
+    if (this.parent == null) {
+      delete this.parent;
     }
-    if (this.$data.user == null) {
-      delete this.$data.user;
+    if (this.user == null) {
+      delete this.user;
     }
-    if (!this.$data.defaultPrimary) {
-      delete this.$data.defaultPrimary;
+    if (!this.defaultPrimary) {
+      delete this.defaultPrimary;
     }
-    if (!this.$data.defaultSecondary) {
-      delete this.$data.defaultSecondary;
+    if (!this.defaultSecondary) {
+      delete this.defaultSecondary;
     }
-    if (!this.$data.unverifiedSecondary) {
-      delete this.$data.unverifiedSecondary;
+    if (!this.unverifiedSecondary) {
+      delete this.unverifiedSecondary;
     }
 
-    // Groups should never have 'system/admin' or 'tilmeld/admin' abilities.
-    this.$data.abilities = difference(this.$data.abilities ?? [], [
-      'system/admin',
-      'tilmeld/admin',
-      null,
-      undefined,
-    ]) as string[];
+    // Groups should never have 'system/admin', 'tilmeld/admin',
+    // 'tilmeld/switch', or system abilities.
+    this.abilities = (this.abilities ?? []).filter((ability) => {
+      if (
+        ['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
+        -1
+      ) {
+        return false;
+      }
+      if (ability == null) {
+        return false;
+      }
+      if (ability.startsWith('system/')) {
+        return false;
+      }
+      return true;
+    }) as string[];
 
     // Verification.
     const unCheck = await this.$checkGroupname();
     if (!unCheck.result) {
       throw new BadUsernameError(unCheck.message);
     }
-    if (!tilmeld.config.emailUsernames) {
+    if (
+      !tilmeld.config.emailUsernames &&
+      tilmeld.config.userFields.includes('email')
+    ) {
       const emCheck = await this.$checkEmail();
       if (!emCheck.result) {
         throw new BadEmailError(emCheck.message);
@@ -692,41 +972,85 @@ export default class Group extends AbleObject<GroupData> {
     }
 
     // Validate group parent. Make sure it's not a descendant of this group.
+    const parent = this.parent;
+    await parent?.$wake();
     if (
-      this.$data.parent &&
-      (this.$data.parent.cdate == null ||
-        this.$is(this.$data.parent) ||
-        this.$data.parent.$isDescendant(this))
+      parent &&
+      (parent.cdate == null ||
+        this.$is(parent) ||
+        (await parent.$isDescendant(this)))
     ) {
       throw new BadDataError(
-        "Group parent can't be itself or descendant of itself."
+        "Group parent can't be itself or descendant of itself.",
       );
     }
 
     try {
-      tilmeld.config.validatorGroup(this);
+      tilmeld.config.validatorGroup(tilmeld, this);
     } catch (e: any) {
       throw new BadDataError(e?.message);
     }
 
     // Only one default primary group is allowed.
-    if (this.$data.defaultPrimary) {
+    if (this.defaultPrimary) {
       const currentPrimary = await this.$nymph.getEntity(
         { class: tilmeld.Group },
-        { type: '&', truthy: 'defaultPrimary' }
+        { type: '&', truthy: 'defaultPrimary' },
       );
       if (currentPrimary != null && !this.$is(currentPrimary)) {
         currentPrimary.defaultPrimary = false;
-        if (!(await currentPrimary.$save())) {
+        try {
+          if (this.$skipAcWhenSaving) {
+            await currentPrimary.$saveSkipAC();
+          } else {
+            await currentPrimary.$save();
+          }
+        } catch (e: any) {
           throw new CouldNotChangeDefaultPrimaryGroupError(
             'Could not change new user primary group from ' +
-              `${currentPrimary.groupname}.`
+              `${currentPrimary.groupname}.`,
           );
         }
       }
     }
 
-    return await super.$save();
+    let preGuid = this.guid;
+    let preCdate = this.cdate;
+    let preMdate = this.mdate;
+    return await transaction(
+      this.$nymph,
+      'tilmeld-save-group-' + (this.guid || nanoid()),
+      async (nymph) => {
+        this.$setNymph(nymph);
+
+        for (let callback of (this.constructor as typeof Group)
+          .beforeSaveCallbacks) {
+          if (callback) {
+            await callback(this);
+          }
+        }
+
+        await super.$save();
+
+        for (let callback of (this.constructor as typeof Group)
+          .afterSaveCallbacks) {
+          if (callback) {
+            await callback(this);
+          }
+        }
+      },
+      async (nymph, committed) => {
+        this.$setNymph(nymph);
+
+        if (committed) {
+          this.$originalGroupname = this.groupname;
+        } else {
+          this.guid = preGuid;
+          this.cdate = preCdate;
+          this.mdate = preMdate;
+        }
+      },
+    );
   }
 
   /*
@@ -734,7 +1058,7 @@ export default class Group extends AbleObject<GroupData> {
    */
   public async $saveSkipAC() {
     this.$skipAcWhenSaving = true;
-    return await this.$save();
+    await this.$save();
   }
 
   public $tilmeldSaveSkipAC() {
@@ -745,77 +1069,166 @@ export default class Group extends AbleObject<GroupData> {
     return false;
   }
 
+  @transactional
   public async $delete() {
-    let tilmeld = this.$nymph.tilmeld as Tilmeld;
-    if (!tilmeld.gatekeeper('tilmeld/admin')) {
-      throw new BadDataError("You don't have the authority to delete groups.");
-    }
-
-    const transaction = 'tilmeld-delete-' + this.guid;
-    const nymph = this.$nymph;
-    const tnymph = await nymph.startTransaction(transaction);
-    this.$nymph = tnymph;
-    tilmeld = this.$nymph.tilmeld as Tilmeld;
-
-    // Delete descendants.
-    const descendants = await this.$getDescendants();
-    if (descendants.length) {
-      for (let curGroup of descendants) {
-        if (!(await curGroup.$delete())) {
-          await tnymph.rollback(transaction);
-          this.$nymph = nymph;
-          return false;
+    let tilmeld = enforceTilmeld(this);
+    const User = this.$nymph.getEntityClass(UserClass);
+
+    if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
+      throw new AccessControlError(
+        "You don't have the authority to delete groups.",
+      );
+    }
+    if (this.groupname !== this.$originalGroupname) {
+      throw new AccessControlError(
+        "You can't delete a group while switching its groupname.",
+      );
+    }
+
+    for (let callback of (this.constructor as typeof Group)
+      .beforeDeleteCallbacks) {
+      if (callback) {
+        await callback(this);
+      }
+    }
+
+    // Delete children.
+    const children = await this.$nymph.getEntities(
+      { class: tilmeld.Group, skipAc: true },
+      { type: '&', ref: ['parent', this] },
+    );
+    if (children.length) {
+      for (let curGroup of children) {
+        if (this.$skipAcWhenDeleting) {
+          await curGroup.$deleteSkipAC();
+        } else {
+          await curGroup.$delete();
         }
       }
     }
 
     // Remove users from this primary group.
-    const primaryUsers = await tnymph.getEntities(
-      {
-        class: tilmeld.User,
-        skipAc: true,
-      },
-      {
-        type: '&',
-        ref: ['group', this],
-      }
+    const primaryUsers = await this.$nymph.getEntities(
+      { class: User, skipAc: true },
+      { type: '&', ref: ['group', this] },
     );
     for (let user of primaryUsers) {
       delete user.group;
-      if (!(await user.$save())) {
-        await tnymph.rollback(transaction);
-        this.$nymph = nymph;
-        return false;
+      if (this.$skipAcWhenDeleting) {
+        await user.$saveSkipAC();
+      } else {
+        await user.$save();
       }
     }
 
     // Remove users from this secondary group.
-    const secondaryUsers = await tnymph.getEntities(
-      {
-        class: tilmeld.User,
-        skipAc: true,
-      },
-      {
-        type: '&',
-        ref: ['groups', this],
-      }
+    const secondaryUsers = await this.$nymph.getEntities(
+      { class: User, skipAc: true },
+      { type: '&', ref: ['groups', this] },
     );
     for (let user of secondaryUsers) {
       user.$delGroup(this);
-      if (!(await user.$save())) {
-        await tnymph.rollback(transaction);
-        return false;
+      if (this.$skipAcWhenDeleting) {
+        await user.$saveSkipAC();
+      } else {
+        await user.$save();
       }
     }
 
     // Delete the group.
-    const success = await super.$delete();
-    if (success) {
-      await tnymph.commit(transaction);
-    } else {
-      await tnymph.rollback(transaction);
+    await super.$delete();
+
+    for (let callback of (this.constructor as typeof Group)
+      .afterDeleteCallbacks) {
+      if (callback) {
+        await callback(this);
+      }
+    }
+  }
+
+  /*
+   * This should *never* be accessible on the client.
+   */
+  async $deleteSkipAC() {
+    this.$skipAcWhenDeleting = true;
+    await this.$delete();
+  }
+
+  $tilmeldDeleteSkipAC() {
+    if (this.$skipAcWhenDeleting) {
+      this.$skipAcWhenDeleting = false;
+      return true;
+    }
+    return false;
+  }
+
+  public static on<T extends GroupEventType>(
+    event: T,
+    callback: T extends 'checkGroupname'
+      ? TilmeldCheckGroupnameCallback
+      : T extends 'beforeSave'
+        ? TilmeldBeforeGroupSaveCallback
+        : T extends 'afterSave'
+          ? TilmeldAfterGroupSaveCallback
+          : T extends 'beforeDelete'
+            ? TilmeldBeforeGroupDeleteCallback
+            : T extends 'afterDelete'
+              ? TilmeldAfterGroupDeleteCallback
+              : never,
+  ) {
+    const prop = (event + 'Callbacks') as T extends 'checkGroupname'
+      ? 'checkGroupnameCallbacks'
+      : T extends 'beforeSave'
+        ? 'beforeSaveCallbacks'
+        : T extends 'afterSave'
+          ? 'afterSaveCallbacks'
+          : T extends 'beforeDelete'
+            ? 'beforeDeleteCallbacks'
+            : T extends 'afterDelete'
+              ? 'afterDeleteCallbacks'
+              : never;
+    if (!(prop in this)) {
+      throw new Error('Invalid event type.');
+    }
+    // @ts-ignore: The callback should always be the right type here.
+    this[prop].push(callback);
+    return () => this.off(event, callback);
+  }
+
+  public static off<T extends GroupEventType>(
+    event: T,
+    callback: T extends 'checkGroupname'
+      ? TilmeldCheckGroupnameCallback
+      : T extends 'beforeSave'
+        ? TilmeldBeforeGroupSaveCallback
+        : T extends 'afterSave'
+          ? TilmeldAfterGroupSaveCallback
+          : T extends 'beforeDelete'
+            ? TilmeldBeforeGroupDeleteCallback
+            : T extends 'afterDelete'
+              ? TilmeldAfterGroupDeleteCallback
+              : never,
+  ) {
+    const prop = (event + 'Callbacks') as T extends 'checkGroupname'
+      ? 'checkGroupnameCallbacks'
+      : T extends 'beforeSave'
+        ? 'beforeSaveCallbacks'
+        : T extends 'afterSave'
+          ? 'afterSaveCallbacks'
+          : T extends 'beforeDelete'
+            ? 'beforeDeleteCallbacks'
+            : T extends 'afterDelete'
+              ? 'afterDeleteCallbacks'
+              : never;
+    if (!(prop in this)) {
+      return false;
+    }
+    // @ts-ignore: The callback should always be the right type here.
+    const i = this[prop].indexOf(callback);
+    if (i > -1) {
+      // @ts-ignore: The callback should always be the right type here.
+      this[prop].splice(i, 1);
     }
-    this.$nymph = nymph;
-    return success;
+    return true;
   }
 }