@nymphjs/tilmeld 1.0.0-beta.14 → 1.0.0-beta.140

package/src/Tilmeld.ts

@@ -1,27 +1,36 @@
+import { URL } from 'node:url';
 import {
   Nymph,
+  Entity,
   EntityInterface,
   FormattedSelector,
   Options,
   TilmeldInterface,
   TilmeldAccessLevels,
+  TilmeldAccessRequest,
+  ACProperties,
+  entitiesToReferences,
+  entityConstructorsToClassNames,
+  classNamesToEntityConstructors,
+  referencesToEntities,
 } from '@nymphjs/nymph';
-import { URL } from 'url';
 import { Request, Response } from 'express';
-import { xor } from 'lodash';
+import { xor } from 'lodash-es';
+import { splitn } from '@sciactive/splitn';
 
-import { Config, ConfigDefaults as defaults } from './conf';
-import { AccessControlError } from './errors';
-import Group from './Group';
-import User, { UserData } from './User';
-import { AccessControlData } from './Tilmeld.types';
+import { Config, ConfigDefaults as defaults } from './conf/index.js';
+import { AccessControlError } from './errors/index.js';
+import { Group } from './Group.js';
+import { User } from './User.js';
+import { AccessControlData } from './Tilmeld.types.js';
+import { enforceTilmeld } from './enforceTilmeld.js';
 
 /**
  * A user and group system for Nymph.js.
  *
  * Written by Hunter Perrin for SciActive.
  *
- * @author Hunter Perrin <hperrin@gmail.com>
+ * @author Hunter Perrin <hperrin@port87.com>
  * @copyright SciActive Inc
  * @see http://nymph.io/
  */
@@ -39,7 +48,7 @@ export default class Tilmeld implements TilmeldInterface {
   /**
    * The currently logged in user.
    */
-  public currentUser: (User & UserData) | null = null;
+  public currentUser: User | null = null;
 
   /**
    * The user class for this instance of Tilmeld.
@@ -69,9 +78,17 @@ export default class Tilmeld implements TilmeldInterface {
   public response: Response | null = null;
 
   /**
-   * Skip the authenticate step of initialization.
+   * Used to avoid infinite loop.
    */
-  private skipAuthenticate = false;
+  private alreadyLoggedOutSwitch = false;
+
+  /**
+   * Gatekeeper ability cache.
+   *
+   * Gatekeeper will cache the user's abilities that it calculates, so it can
+   * check faster if that user has been checked before.
+   */
+  private gatekeeperCache: { [k: string]: true } | null = null;
 
   /**
    * Create a new instance of Tilmeld.
@@ -80,6 +97,30 @@ export default class Tilmeld implements TilmeldInterface {
    */
   public constructor(config: Partial<Config> & { jwtSecret: string }) {
     this.config = { ...defaults, ...config };
+
+    if (
+      this.config.emailUsernames &&
+      (!this.config.userFields.includes('email') ||
+        !this.config.regFields.includes('email'))
+    ) {
+      throw new Error(
+        'You must include email in userFields and regFields if you use emailUsernames.',
+      );
+    }
+
+    for (let field of this.config.regFields) {
+      if (!this.config.userFields.includes(field)) {
+        throw new Error(
+          `All fields in regFields must also be in userFields: ${field}`,
+        );
+      }
+    }
+
+    if (this.config.emailUsernames && this.config.domainSupport) {
+      throw new Error(
+        'Email usernames and domain support cannot both be enabled.',
+      );
+    }
   }
 
   /**
@@ -92,7 +133,7 @@ export default class Tilmeld implements TilmeldInterface {
     tilmeld.request = this.request;
     tilmeld.response = this.response;
     tilmeld.currentUser = this.currentUser;
-    tilmeld.skipAuthenticate = true;
+    tilmeld.gatekeeperCache = this.gatekeeperCache;
 
     return tilmeld;
   }
@@ -106,32 +147,85 @@ export default class Tilmeld implements TilmeldInterface {
    */
   public init(nymph: Nymph) {
     this.nymph = nymph;
-    const tilmeld = this;
 
-    // Set up access control hooks when Nymph is called.
     if (this.nymph.driver == null) {
       throw new Error("Tilmeld can't be configured before Nymph.");
     }
 
     // Configure the classes.
-    class NymphUser extends User {
-      static nymph: Nymph = nymph;
-      static tilmeld: Tilmeld = tilmeld;
+    if (nymph.parent) {
+      // This is a cloned Nymph, it should have classes already.
+      this.User = this.nymph.getEntityClass(User);
+      this.Group = this.nymph.getEntityClass(Group);
+    } else {
+      // This is a new Nymph, add the classes.
+      this.User = this.nymph.addEntityClass(User);
+      this.Group = this.nymph.addEntityClass(Group);
     }
-    (NymphUser as any).skipOnClone = true;
-    this.User = this.nymph.addEntityClass(NymphUser);
-    class NymphGroup extends Group {
-      static nymph: Nymph = nymph;
-      static tilmeld: Tilmeld = tilmeld;
+
+    // Clone the current user so its Nymph instance is correct.
+    if (this.currentUser) {
+      const currentUserGUID = this.currentUser.guid;
+      const currentUserCDate = this.currentUser.cdate;
+      const currentUserMDate = this.currentUser.mdate;
+      const currentUserTags = this.currentUser.tags;
+      const currentUserData = entityConstructorsToClassNames(
+        entitiesToReferences(this.currentUser.$getData(false), true),
+      );
+      const currentUserSData = this.currentUser.$getSData();
+      const currentUserOriginalAcValues =
+        this.currentUser.$getOriginalAcValues();
+
+      const user = this.User.factorySync();
+      user.guid = currentUserGUID;
+      user.cdate = currentUserCDate;
+      user.mdate = currentUserMDate;
+      user.tags = currentUserTags;
+      // First, put the trusted original AC values in with the server flag.
+      Entity.factorySync().$putData.call(
+        user,
+        {
+          ...currentUserOriginalAcValues,
+          user:
+            currentUserOriginalAcValues.user != null
+              ? this.User.factoryReference([
+                  'nymph_entity_reference',
+                  currentUserOriginalAcValues.user,
+                  this.User.class,
+                ])
+              : undefined,
+          group:
+            currentUserOriginalAcValues.group != null
+              ? this.Group.factoryReference([
+                  'nymph_entity_reference',
+                  currentUserOriginalAcValues.group,
+                  this.Group.class,
+                ])
+              : undefined,
+        },
+        {},
+        'server',
+      );
+      // Now put the real data in, that could potentially have been altered from
+      // the client.
+      user.$putData(
+        classNamesToEntityConstructors(
+          this.nymph,
+          referencesToEntities(currentUserData, this.nymph, false, false),
+          false,
+        ),
+        currentUserSData,
+      );
+      user.$originalEmail = this.currentUser.$originalEmail;
+      user.$originalUsername = this.currentUser.$originalUsername;
+      this.currentUser = user;
+      this.currentUser.$updateDataProtection();
+      this.currentUser.$updateGroupDataProtection();
     }
-    (NymphUser as any).skipOnClone = true;
-    this.Group = this.nymph.addEntityClass(NymphGroup);
 
+    // Set up access control hooks when Nymph is called.
+    this.nymph.config.debugInfo('tilmeld', 'Initializing access controls.');
     this.initAccessControl();
-    if (this.request != null && !this.skipAuthenticate) {
-      this.authenticate();
-    }
-    this.skipAuthenticate = false;
   }
 
   /**
@@ -143,21 +237,29 @@ export default class Tilmeld implements TilmeldInterface {
    * @param ability The ability.
    * @returns Whether the user has the given ability.
    */
-  public gatekeeper(ability?: string): boolean {
-    if (this.currentUser == null) {
+  public gatekeeper(ability?: string) {
+    if (this.currentUser == null || this.gatekeeperCache == null) {
       return false;
     }
-    return this.currentUser.$gatekeeper(ability);
+    if (ability == null) {
+      return true;
+    }
+    return (
+      (ability in this.gatekeeperCache && !!this.gatekeeperCache[ability]) ||
+      !!this.currentUser.abilities?.includes('system/admin')
+    );
   }
 
   private initAccessControl() {
     // Check for the skip access control option and add AC selectors.
     const handleQuery = function (
       nymph: Nymph,
-      options: Options,
-      selectors: FormattedSelector[]
+      {
+        options,
+        selectors,
+      }: { options: Options; selectors: FormattedSelector[] },
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (
         !options ||
         !('skipAc' in options) ||
@@ -166,13 +268,17 @@ export default class Tilmeld implements TilmeldInterface {
       ) {
         if (options?.source === 'client') {
           if (
-            !tilmeld.gatekeeper('tilmeld/admin') && // The user is not an admin.
+            (!tilmeld.currentUser ||
+              (!tilmeld.currentUser.abilities?.includes('tilmeld/admin') &&
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) && // The user is not an admin.
             ((!tilmeld.config.enableUserSearch &&
               options.class?.factorySync() instanceof User) || // The use is searching for a user and searching is disabled.
               (!tilmeld.config.enableGroupSearch &&
                 options.class?.factorySync() instanceof Group)) && // Or the same, but for a group.
-            (selectors[0] == null || // No selector specified.
+            (selectors.length > 1 || // There's more than one selector.
+              selectors[0] == null || // Or no selector specified.
               selectors[0].type !== '&' || // Or the type is not and.
+              Object.keys(selectors[0]).length > 2 || // Or there's more than one clause.
               (!('guid' in selectors[0]) && !('equal' in selectors[0])) || // Or they're searching for something other than guid or equal.
               ('guid' in selectors[0] &&
                 (!selectors[0].guid?.length ||
@@ -195,10 +301,11 @@ export default class Tilmeld implements TilmeldInterface {
     // Filter entities being deleted for user permissions.
     const checkPermissionsDelete = async function (
       nymph: Nymph,
-      entity: EntityInterface
+      entity: EntityInterface,
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (
+        '$tilmeldDeleteSkipAC' in entity &&
         typeof entity.$tilmeldDeleteSkipAC === 'function' &&
         entity.$tilmeldDeleteSkipAC()
       ) {
@@ -215,15 +322,19 @@ export default class Tilmeld implements TilmeldInterface {
     const checkPermissionsDeleteByID = async function (
       nymph: Nymph,
       guid: string,
-      className?: string
+      className?: string,
     ) {
-      const entity = nymph.driver.getEntitySync(
+      if (className === 'User' || className === 'Group') {
+        throw new AccessControlError("You can't delete users or groups by ID.");
+      }
+      const entity = await nymph.getEntity(
         { class: nymph.getEntityClass(className ?? 'Entity') },
-        { type: '&', guid: guid }
+        { type: '&', guid: guid },
       );
-      if (entity != null) {
-        checkPermissionsDelete(nymph, entity);
+      if (entity == null) {
+        throw new AccessControlError("You can't delete this entity by ID.");
       }
+      await checkPermissionsDelete(nymph, entity);
     };
     checkPermissionsDeleteByID.skipOnClone = true;
 
@@ -231,13 +342,14 @@ export default class Tilmeld implements TilmeldInterface {
     // disallowed changes to AC properties.
     const checkPermissionsSaveAndFilterAcChanges = async function (
       nymph: Nymph,
-      entity: EntityInterface & AccessControlData
+      entity: EntityInterface & AccessControlData,
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (!entity) {
         return;
       }
       if (
+        '$tilmeldSaveSkipAC' in entity &&
         typeof entity.$tilmeldSaveSkipAC === 'function' &&
         entity.$tilmeldSaveSkipAC()
       ) {
@@ -249,35 +361,9 @@ export default class Tilmeld implements TilmeldInterface {
         // allowing a change to ac properties.
 
         const originalAc = entity.$getOriginalAcValues();
-        const newAc: AccessControlData = {
-          user: entity.user ?? undefined,
-          group: entity.group ?? undefined,
-          acUser: entity.acUser ?? undefined,
-          acGroup: entity.acGroup ?? undefined,
-          acOther: entity.acOther ?? undefined,
-          acRead: entity.acRead ?? undefined,
-          acWrite: entity.acWrite ?? undefined,
-          acFull: entity.acFull ?? undefined,
-        };
+        const newAc = entity.$getCurrentAcValues();
 
-        const setAcProperties = (acValues: { [k: string]: any }) => {
-          for (let name in acValues) {
-            const value = acValues[name];
-            if (value == null) {
-              delete entity[name];
-            } else {
-              entity[name] = value;
-            }
-          }
-        };
-
-        // Restore original AC properties and check permissions.
-        setAcProperties(originalAc);
-
-        function areAcPropertiesChanged(
-          a: AccessControlData,
-          b: AccessControlData
-        ) {
+        function areAcPropertiesChanged(a: ACProperties, b: ACProperties) {
           for (const name of ['user', 'group'] as ('user' | 'group')[]) {
             const aVal = a[name];
             const bVal = b[name];
@@ -286,14 +372,12 @@ export default class Tilmeld implements TilmeldInterface {
             } else if (aVal == null || bVal == null) {
               return true;
             }
-            if (!aVal.$is(bVal)) {
+            if (aVal !== bVal) {
               return true;
             }
           }
           for (const name of ['acUser', 'acGroup', 'acOther'] as (
-            | 'acUser'
-            | 'acGroup'
-            | 'acOther'
+            'acUser' | 'acGroup' | 'acOther'
           )[]) {
             const aVal = a[name];
             const bVal = b[name];
@@ -307,9 +391,7 @@ export default class Tilmeld implements TilmeldInterface {
             }
           }
           for (const name of ['acRead', 'acWrite', 'acFull'] as (
-            | 'acRead'
-            | 'acWrite'
-            | 'acFull'
+            'acRead' | 'acWrite' | 'acFull'
           )[]) {
             const aVal = a[name];
             const bVal = b[name];
@@ -321,12 +403,7 @@ export default class Tilmeld implements TilmeldInterface {
             if (aVal.length !== bVal.length) {
               return true;
             }
-            if (
-              xor(
-                aVal.map((entity) => entity.guid),
-                bVal.map((entity) => entity.guid)
-              ).length
-            ) {
+            if (xor(aVal, bVal).length) {
               return true;
             }
           }
@@ -335,41 +412,41 @@ export default class Tilmeld implements TilmeldInterface {
 
         if (areAcPropertiesChanged(originalAc, newAc)) {
           if (
-            !tilmeld.checkPermissions(entity, TilmeldAccessLevels.FULL_ACCESS)
+            !tilmeld.checkPermissions(
+              entity,
+              TilmeldAccessLevels.FULL_ACCESS,
+              originalAc,
+            )
           ) {
             // Only allow changes to AC properties if the user has full access.
             throw new AccessControlError(
-              'No permission to change access control properties.'
+              'No permission to change access control properties.',
             );
           }
 
           if (
-            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
-              (!originalAc.user &&
-                newAc.user &&
-                !newAc.user.$is(tilmeld.currentUser))) &&
-            !tilmeld.gatekeeper('tilmeld/admin')
+            (originalAc.user != null && originalAc.user !== newAc.user) ||
+            (originalAc.user == null &&
+              newAc.user != null &&
+              newAc.user !== tilmeld.currentUser?.guid)
           ) {
             throw new AccessControlError(
-              'No permission to assign to another user.'
+              'No permission to assign to another user.',
             );
           }
 
           if (
-            newAc.group &&
-            !newAc.group.$is(originalAc.group) &&
+            newAc.group != null &&
+            newAc.group !== originalAc.group &&
             !(
-              newAc.group.$is(tilmeld.currentUser?.group) ||
-              newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
-            ) &&
-            !tilmeld.gatekeeper('tilmeld/admin')
+              newAc.group === tilmeld.currentUser?.$getGid() ||
+              (tilmeld.currentUser?.$getGids() ?? []).includes(newAc.group)
+            )
           ) {
             throw new AccessControlError(
-              'No permission to assign to another group.'
+              'No permission to assign to another group.',
             );
           }
-
-          setAcProperties(newAc);
         }
       }
 
@@ -398,9 +475,9 @@ export default class Tilmeld implements TilmeldInterface {
      */
     const addAccess = async function (
       nymph: Nymph,
-      entity: EntityInterface & AccessControlData
+      entity: EntityInterface & AccessControlData,
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       const user = tilmeld.currentUser;
       if (
         user != null &&
@@ -411,12 +488,11 @@ export default class Tilmeld implements TilmeldInterface {
         if (entity.user == null) {
           entity.user = user;
         }
-        if (
-          entity.group == null &&
-          user.group != null &&
-          user.group.guid != null
-        ) {
-          entity.group = user.group;
+        if (entity.group == null) {
+          const group = user.group;
+          if (group != null && group.guid != null) {
+            entity.group = group;
+          }
         }
         if (entity.acUser == null) {
           entity.acUser = TilmeldAccessLevels.FULL_ACCESS;
@@ -442,7 +518,7 @@ export default class Tilmeld implements TilmeldInterface {
 
     const validate = async function (
       _nymph: Nymph,
-      entity: EntityInterface & AccessControlData
+      entity: EntityInterface & AccessControlData,
     ) {
       if (!(entity instanceof User) && !(entity instanceof Group)) {
         const ownershipAcPropertyValidator = (prop: any) => {
@@ -452,7 +528,7 @@ export default class Tilmeld implements TilmeldInterface {
             prop > TilmeldAccessLevels.FULL_ACCESS
           ) {
             throw new AccessControlError(
-              'Invalid access control property: ' + prop
+              'Invalid access control property: ' + prop,
             );
           }
         };
@@ -460,13 +536,13 @@ export default class Tilmeld implements TilmeldInterface {
         const accessAcPropertyValidator = (prop: any) => {
           if (!Array.isArray(prop)) {
             throw new AccessControlError(
-              'Invalid access control property: ' + prop
+              'Invalid access control property: ' + prop,
             );
           }
           prop.forEach((value) => {
-            if (!(value instanceof User || value instanceof Group)) {
+            if (typeof value !== 'string' || !value.match(/^[0-9a-f]{24}$/i)) {
               throw new AccessControlError(
-                'Invalid access control property: ' + prop
+                'Invalid access control property: ' + prop,
               );
             }
           });
@@ -475,7 +551,7 @@ export default class Tilmeld implements TilmeldInterface {
         if ('user' in entity) {
           if (!(entity.user instanceof User)) {
             throw new AccessControlError(
-              'Invalid access control property: user'
+              'Invalid access control property: user',
             );
           }
         }
@@ -483,7 +559,7 @@ export default class Tilmeld implements TilmeldInterface {
         if ('group' in entity) {
           if (!(entity.group instanceof Group)) {
             throw new AccessControlError(
-              'Invalid access control property: group'
+              'Invalid access control property: group',
             );
           }
         }
@@ -528,83 +604,134 @@ export default class Tilmeld implements TilmeldInterface {
    */
   public addAccessControlSelectors(
     options: Options,
-    selectors: FormattedSelector[]
+    selectors: FormattedSelector[],
   ) {
     const user = this.currentUser;
 
-    if (
-      user != null &&
-      (user.abilities?.indexOf('system/admin') ?? -1) !== -1
-    ) {
-      // The user is a system admin, so they can see everything.
-      return;
-    }
-
     if (options == null) {
       throw new Error('No options in argument.');
     } else if (
-      'class' in options &&
-      (options.class?.factorySync() instanceof User ||
-        options.class?.factorySync() instanceof Group)
+      !('class' in options) ||
+      !(options.class?.prototype instanceof Entity)
+    ) {
+      throw new Error('No class in options.');
+    } else if (options.class.class === 'Entity') {
+      throw new Error("Can't use Entity class directly.");
+    } else if (
+      options.class.factorySync() instanceof User ||
+      options.class.factorySync() instanceof Group
     ) {
       // They are requesting a user/group. Always accessible for reading.
       return;
     }
 
     if (user == null || user.guid == null) {
-      selectors.push({
-        type: '|',
+      // Access requests for only public entities.
+
+      const allAccessRequests =
+        TilmeldAccessRequest.OTHER_ACCESSIBLE | TilmeldAccessRequest.UNOWNED;
+      const requestedAccess = (options.acRequest ?? 0) & allAccessRequests;
+      const defaultAccess = requestedAccess === TilmeldAccessRequest.ALL_LEVELS;
+
+      const selector: FormattedSelector = { type: '|' };
+
+      if (
+        defaultAccess ||
+        requestedAccess & TilmeldAccessRequest.OTHER_ACCESSIBLE
+      ) {
         // Other access control is sufficient.
-        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
+        selector.gte = [['acOther', TilmeldAccessLevels.READ_ACCESS]];
+      }
+
+      if (defaultAccess || requestedAccess & TilmeldAccessRequest.UNOWNED) {
         // The user and group are not set.
-        selector: [
+        selector.selector = [
           {
             type: '&',
             '!defined': [['user', 'group']],
           },
-        ],
-      });
+        ];
+      }
+
+      if (Object.keys(selector).length <= 1) {
+        this.nymph.config.debugError(
+          'tilmeld',
+          'No access controls were added to the query. This should not be possible.',
+        );
+        throw new Error('Access control error.');
+      }
+
+      selectors.push(selector);
     } else {
-      const subSelectors: FormattedSelector[] = [
-        {
+      // Access requests for public and private entities.
+
+      const allAccessRequests =
+        TilmeldAccessRequest.USER_OWNED |
+        TilmeldAccessRequest.PRIMARY_GROUP_OWNED |
+        TilmeldAccessRequest.SECONDARY_GROUP_OWNED |
+        TilmeldAccessRequest.USER_ACCESSIBLE |
+        TilmeldAccessRequest.PRIMARY_GROUP_ACCESSIBLE |
+        TilmeldAccessRequest.SECONDARY_GROUP_ACCESSIBLE |
+        TilmeldAccessRequest.OTHER_ACCESSIBLE |
+        TilmeldAccessRequest.UNOWNED;
+      const requestedAccess = (options.acRequest ?? 0) & allAccessRequests;
+      const defaultAccess = requestedAccess === TilmeldAccessRequest.ALL_LEVELS;
+
+      const subSelectors: FormattedSelector[] = [];
+      if (defaultAccess || requestedAccess & TilmeldAccessRequest.UNOWNED) {
+        subSelectors.push({
           type: '&',
+          // The user and group are not set.
           '!defined': [['user', 'group']],
-        },
+        });
+      }
+      // USER_OWNED is always enforced.
+      subSelectors.push(
         // It is owned by the user.
         {
           type: '&',
           ref: [['user', user.guid]],
           gte: [['acUser', TilmeldAccessLevels.READ_ACCESS]],
         },
-      ];
+      );
       const groupRefs: FormattedSelector['ref'] = [];
-      const acRefs: FormattedSelector['ref'] = [];
-      if (user.group != null && user.group.guid != null) {
-        // It belongs to the user's primary group.
-        groupRefs.push(['group', user.group.guid]);
-        // User's primary group is listed in acRead, acWrite, or acFull.
-        acRefs.push(['acRead', user.group.guid]);
-        acRefs.push(['acWrite', user.group.guid]);
-        acRefs.push(['acFull', user.group.guid]);
-      }
-      for (let curSecondaryGroup of user.groups ?? []) {
-        if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
-          // It belongs to the user's secondary group.
-          groupRefs.push(['group', curSecondaryGroup.guid]);
-          // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curSecondaryGroup.guid]);
-          acRefs.push(['acWrite', curSecondaryGroup.guid]);
-          acRefs.push(['acFull', curSecondaryGroup.guid]);
+      const acContains: FormattedSelector['contain'] = [];
+      const gid = user.$getGid();
+      if (gid != null) {
+        if (
+          defaultAccess ||
+          requestedAccess & TilmeldAccessRequest.PRIMARY_GROUP_OWNED
+        ) {
+          // It belongs to the user's primary group.
+          groupRefs.push(['group', gid]);
+        }
+        if (
+          defaultAccess ||
+          requestedAccess & TilmeldAccessRequest.PRIMARY_GROUP_ACCESSIBLE
+        ) {
+          // User's primary group guid is listed in acRead, acWrite, or acFull.
+          acContains.push(['acRead', gid]);
+          acContains.push(['acWrite', gid]);
+          acContains.push(['acFull', gid]);
         }
       }
-      for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
-        if (curDescendantGroup != null && curDescendantGroup.guid != null) {
+      const gids = user.$getGids();
+      for (let curGid of gids ?? []) {
+        if (
+          defaultAccess ||
+          requestedAccess & TilmeldAccessRequest.SECONDARY_GROUP_OWNED
+        ) {
           // It belongs to the user's secondary group.
-          groupRefs.push(['group', curDescendantGroup.guid]);
-          // User's secondary group is listed in acRead, acWrite, or acFull.
-          acRefs.push(['acRead', curDescendantGroup.guid]);
-          acRefs.push(['acWrite', curDescendantGroup.guid]);
-          acRefs.push(['acFull', curDescendantGroup.guid]);
+          groupRefs.push(['group', curGid]);
+        }
+        if (
+          defaultAccess ||
+          requestedAccess & TilmeldAccessRequest.SECONDARY_GROUP_ACCESSIBLE
+        ) {
+          // User's secondary group guid is listed in acRead, acWrite, or acFull.
+          acContains.push(['acRead', curGid]);
+          acContains.push(['acWrite', curGid]);
+          acContains.push(['acFull', curGid]);
         }
       }
       // All the group refs.
@@ -612,40 +739,49 @@ export default class Tilmeld implements TilmeldInterface {
         subSelectors.push({
           type: '&',
           gte: [['acGroup', TilmeldAccessLevels.READ_ACCESS]],
-          selector: [
-            {
-              type: '|',
-              ref: groupRefs,
-            },
-          ],
+          selector: [{ type: '|', ref: groupRefs }],
         });
       }
-      // All the acRead, acWrite, and acFull refs.
-      if (acRefs.length) {
-        subSelectors.push({
-          type: '|',
-          ref: acRefs,
-        });
+      // All the acRead, acWrite, and acFull contains.
+      if (acContains.length) {
+        subSelectors.push({ type: '|', contain: acContains });
       }
-      const selector: FormattedSelector = {
-        type: '|',
+      const selector: FormattedSelector = { type: '|' };
+      if (
+        defaultAccess ||
+        requestedAccess & TilmeldAccessRequest.OTHER_ACCESSIBLE
+      ) {
         // Other access control is sufficient.
-        gte: [['acOther', TilmeldAccessLevels.READ_ACCESS]],
-        // The user and group are not set.
-        selector: subSelectors,
+        selector.gte = [['acOther', TilmeldAccessLevels.READ_ACCESS]];
+      }
+      if (subSelectors.length) {
+        // One of the sub selectors.
+        selector.selector = subSelectors;
+      }
+      if (
+        defaultAccess ||
+        requestedAccess & TilmeldAccessRequest.USER_ACCESSIBLE
+      ) {
         // The user is listed in acRead, acWrite, or acFull.
-        ref: [
+        selector.contain = [
           ['acRead', user.guid],
           ['acWrite', user.guid],
           ['acFull', user.guid],
-        ],
-      };
+        ];
+      }
+      if (Object.keys(selector).length <= 1) {
+        this.nymph.config.debugError(
+          'tilmeld',
+          'No access controls were added to the query. This should not be possible.',
+        );
+        throw new Error('Access control error.');
+      }
       selectors.push(selector);
     }
   }
 
   /**
-   * Check an entity's permissions for a user.
+   * Check an entity's permissions for the current user.
    *
    * This will check the AC (Access Control) properties of the entity. These
    * include the following properties:
@@ -671,7 +807,7 @@ export default class Tilmeld implements TilmeldInterface {
    * - FULL_ACCESS, the user has read, write, and delete access to the entity,
    *   as well as being able to manage its access controls and ownership.
    *
-   * These properties defaults to:
+   * These properties default to:
    *
    * - acUser = TilmeldAccessLevels.FULL_ACCESS
    * - acGroup = TilmeldAccessLevels.READ_ACCESS
@@ -686,9 +822,9 @@ export default class Tilmeld implements TilmeldInterface {
    * The following conditions will result in different checks, which determine
    * whether the check passes:
    *
-   * - The user has the "system/admin" ability. (Always true.)
    * - It is a user or group. (True for READ_ACCESS or Tilmeld admins.)
-   * - The entity has no "user" and no "group". (Always true.)
+   * - It is a user or group that belongs to a domain the current user is an
+   *   admin for, and domain support is enabled. (Always true.)
    * - No user is logged in. (Check other AC.)
    * - The entity is the user. (Always true.)
    * - It is the user's primary group. (True for READ_ACCESS.)
@@ -705,54 +841,54 @@ export default class Tilmeld implements TilmeldInterface {
    *
    * @param entity The entity to check.
    * @param type The lowest level of permission to consider a pass.
-   * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
+   * @param acProperties The acProperties to use instead of getting them from the entity.
    * @returns Whether the current user has at least `type` permission for the entity.
    */
   public checkPermissions(
-    entity: EntityInterface & AccessControlData,
+    entity: EntityInterface,
     type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
-    user?: (User & UserData) | false
+    acProperties?: ACProperties,
   ) {
-    // Only works for entities.
-    if (typeof entity !== 'object' || typeof entity.$is !== 'function') {
-      return false;
+    if (!acProperties) {
+      acProperties = entity.$getCurrentAcValues() as ACProperties;
     }
 
-    let userOrNull: (User & UserData) | null = null;
-    let userOrEmpty: User & UserData = this.User.factorySync();
-    // Calculate the user.
-    if (user == null) {
-      userOrNull = this.currentUser;
-      userOrEmpty = this.User.current(true);
-    } else if (user !== false) {
-      userOrNull = user;
-      userOrEmpty = user;
-    }
-
-    if (userOrEmpty.$gatekeeper('system/admin')) {
-      return true;
-    }
+    let userOrEmpty: User = this.User.current(true);
 
     // Users and groups are always readable. Editable by Tilmeld admins.
     if (
       (entity instanceof User || entity instanceof Group) &&
       (type === TilmeldAccessLevels.READ_ACCESS ||
-        userOrEmpty.$gatekeeper('tilmeld/admin'))
+        this.gatekeeper('tilmeld/admin') ||
+        this.gatekeeper('system/admin'))
     ) {
       return true;
     }
 
-    // Entities with no owners are always editable.
-    if (entity.user == null && entity.group == null) {
-      return true;
+    // Users and groups that belong to a domain are readable and editable by
+    // that domain's admins.
+    if (
+      this.config.domainSupport &&
+      (entity instanceof User || entity instanceof Group)
+    ) {
+      const [_local, domain] = splitn(
+        (entity instanceof User
+          ? (entity as User).username
+          : (entity as Group).groupname) ?? '',
+        '@',
+        2,
+      );
+      if (domain && this.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+        return true;
+      }
     }
 
     // Load access control, since we need it now...
-    const acUser = entity.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
-    const acGroup = entity.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
-    const acOther = entity.acOther ?? TilmeldAccessLevels.NO_ACCESS;
+    const acUser = acProperties.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
+    const acGroup = acProperties.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
+    const acOther = acProperties.acOther ?? TilmeldAccessLevels.NO_ACCESS;
 
-    if (userOrNull === null) {
+    if (this.currentUser == null) {
       return acOther >= type;
     }
 
@@ -762,45 +898,59 @@ export default class Tilmeld implements TilmeldInterface {
     }
 
     // Check if the entity is the user's group. Always readable.
+    const gid = userOrEmpty.$getGid();
     if (
-      userOrEmpty.group != null &&
-      typeof userOrEmpty.group.$is === 'function' &&
-      userOrEmpty.group.$is(entity) &&
+      gid != null &&
+      entity.guid === gid &&
       type === TilmeldAccessLevels.READ_ACCESS
     ) {
       return true;
     }
 
+    // Check if the entity is one of the user's secondary groups. Always
+    // readable.
+    const gids = userOrEmpty.$getGids();
+    if (
+      gids != null &&
+      entity.guid != null &&
+      gids.indexOf(entity.guid) !== -1 &&
+      type === TilmeldAccessLevels.READ_ACCESS
+    ) {
+      return true;
+    }
+
+    // At this point, if the entity is a user or group, it should not be
+    // accessible.
+    if (entity instanceof User || entity instanceof Group) {
+      return false;
+    }
+
     // Calculate all the groups the user belongs to.
-    let allGroups = userOrEmpty.group == null ? [] : [userOrEmpty.group];
-    allGroups = allGroups.concat(userOrEmpty.groups ?? []);
-    allGroups = allGroups.concat(userOrEmpty.$getDescendantGroupsSync());
+    let allGids = gid == null ? [] : [gid];
+    allGids = allGids.concat(gids ?? []);
 
     // Check access ac properties.
     const checks = [
       {
         type: TilmeldAccessLevels.FULL_ACCESS,
-        array: [...(entity.acFull ?? [])],
+        array: [...(acProperties.acFull ?? [])],
       },
       {
         type: TilmeldAccessLevels.WRITE_ACCESS,
-        array: [...(entity.acWrite ?? [])],
+        array: [...(acProperties.acWrite ?? [])],
       },
       {
         type: TilmeldAccessLevels.READ_ACCESS,
-        array: [...(entity.acRead ?? [])],
+        array: [...(acProperties.acRead ?? [])],
       },
     ];
     for (let curCheck of checks) {
       if (type <= curCheck.type) {
-        if (userOrEmpty.$inArray(curCheck.array)) {
+        if (curCheck.array.includes(userOrEmpty.guid)) {
           return true;
         }
-        for (let curGroup of allGroups) {
-          if (
-            typeof curGroup.$inArray === 'function' &&
-            curGroup.$inArray(curCheck.array)
-          ) {
+        for (let curGid of allGids) {
+          if (curCheck.array.includes(curGid)) {
             return true;
           }
         }
@@ -809,17 +959,12 @@ export default class Tilmeld implements TilmeldInterface {
 
     // Check ownership ac properties.
     if (
-      entity.user != null &&
-      typeof entity.user.$is === 'function' &&
-      entity.user.$is(userOrNull)
+      acProperties.user != null &&
+      acProperties.user === this.currentUser.guid
     ) {
       return acUser >= type;
     }
-    if (
-      entity.group != null &&
-      typeof entity.group.$inArray === 'function' &&
-      entity.group.$inArray(allGroups)
-    ) {
+    if (acProperties.group != null && allGids.includes(acProperties.group)) {
       return acGroup >= type;
     }
     return acOther >= type;
@@ -849,12 +994,12 @@ export default class Tilmeld implements TilmeldInterface {
    * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
    * @returns Whether the current user has at least `type` permission for the UID.
    */
-  public checkClientUIDPermissions(
+  public async checkClientUIDPermissions(
     name: string,
     type: TilmeldAccessLevels = TilmeldAccessLevels.READ_ACCESS,
-    user?: (User & UserData) | false
+    user?: User | false,
   ) {
-    let userOrEmpty: User & UserData = this.User.factorySync();
+    let userOrEmpty: User = this.User.factorySync();
     // Calculate the user.
     if (user == null) {
       userOrEmpty = this.User.current(true);
@@ -862,30 +1007,30 @@ export default class Tilmeld implements TilmeldInterface {
       userOrEmpty = user;
     }
 
-    if (userOrEmpty.$gatekeeper('system/admin')) {
+    if (userOrEmpty.abilities?.includes('system/admin')) {
       return true;
     }
 
     if (type === TilmeldAccessLevels.FULL_ACCESS) {
       return (
-        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+        this.config.clientSetabledUIDs.includes(name) ||
+        (await userOrEmpty.$gatekeeper(`uid/set/${name}`))
       );
     } else if (type === TilmeldAccessLevels.WRITE_ACCESS) {
       return (
-        this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
-        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-        userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
-        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+        this.config.clientEnabledUIDs.includes(name) ||
+        this.config.clientSetabledUIDs.includes(name) ||
+        (await userOrEmpty.$gatekeeper(`uid/new/${name}`)) ||
+        (await userOrEmpty.$gatekeeper(`uid/set/${name}`))
       );
     } else if (type === TilmeldAccessLevels.READ_ACCESS) {
       return (
-        this.config.clientReadableUIDs.indexOf(name) !== -1 ||
-        this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
-        this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-        userOrEmpty.$gatekeeper(`uid/get/${name}`) ||
-        userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
-        userOrEmpty.$gatekeeper(`uid/set/${name}`)
+        this.config.clientReadableUIDs.includes(name) ||
+        this.config.clientEnabledUIDs.includes(name) ||
+        this.config.clientSetabledUIDs.includes(name) ||
+        (await userOrEmpty.$gatekeeper(`uid/get/${name}`)) ||
+        (await userOrEmpty.$gatekeeper(`uid/new/${name}`)) ||
+        (await userOrEmpty.$gatekeeper(`uid/set/${name}`))
       );
     }
 
@@ -897,20 +1042,29 @@ export default class Tilmeld implements TilmeldInterface {
    *
    * @param user The user.
    */
-  public fillSession(user: User & UserData) {
-    // Read groups right now, since gatekeeper needs them, so
-    // $udpateDataProtection will fail to read them (since it runs gatekeeper).
-    const _group = user.group;
-    const _groups = user.groups;
+  public async fillSession(user: User) {
+    // Clear any currently logged in user.
+    const oldUser = this.currentUser;
+    this.currentUser = null;
+    this.gatekeeperCache = null;
+    if (oldUser) {
+      oldUser.$updateDataProtection();
+      oldUser.$updateGroupDataProtection();
+    }
+
+    // Update data protection on the incoming user.
+    user.$updateDataProtection();
+    user.$updateGroupDataProtection();
+
+    // Get the gatekeeper cache for incoming user.
+    this.gatekeeperCache = await user.$getGatekeeperCache();
+
+    // Now we're ready to set the current user.
     this.currentUser = user;
-    // Now update the data protection on the user and all the groups.
+
+    // And update the data protection on the user and all the groups.
     this.currentUser.$updateDataProtection();
-    if (this.currentUser.group != null) {
-      this.currentUser.group.$updateDataProtection();
-    }
-    for (let group of this.currentUser.groups ?? []) {
-      group.$updateDataProtection();
-    }
+    this.currentUser.$updateGroupDataProtection();
   }
 
   /**
@@ -919,109 +1073,204 @@ export default class Tilmeld implements TilmeldInterface {
   public clearSession() {
     const user = this.currentUser;
     this.currentUser = null;
+    this.gatekeeperCache = null;
     if (user) {
       user.$updateDataProtection();
-      if (user.group != null) {
-        user.group.$updateDataProtection();
-      }
-      for (let group of user.groups ?? []) {
-        group.$updateDataProtection();
-      }
+      user.$updateGroupDataProtection();
     }
   }
 
   /**
    * Validate and extract the user from a token.
    *
+   * For primary tokens, you want to enforce user restrictions. This keeps
+   * disabled users from logging in and protects accounts with token revocation
+   * dates.
+   *
+   * For switch tokens, you don't want to enforce user restrictions. This allows
+   * an admin to switch to a user even if they are disabled or have revoked the
+   * switch token. Admin actions take precedence over anything a normal user can
+   * do.
+   *
    * @param token The authentication token.
-   * @returns The user on success, null on failure.
+   * @param enforceUserRestrictions Validate that the user is enabled and the token was issued after user's revocation date.
+   * @param xsrfToken Validate this XSRF Token against the auth token.
+   * @returns The user and extraction on success, null on failure.
    */
-  public async extractToken(token: string) {
-    const extract = this.config.jwtExtract(this.config, token);
+  public async extractToken(
+    token: string,
+    enforceUserRestrictions: boolean,
+    xsrfToken?: string,
+  ) {
+    this.nymph.config.debugInfo('tilmeld', 'Extracting and validating token.');
+    const extract = this.config.jwtExtract(this.config, token, xsrfToken);
     if (extract == null) {
-      return null;
+      return { user: null, extract };
+    }
+    const { guid, issued, expire } = extract;
+
+    if (expire.getTime() <= Date.now() || issued.getTime() > Date.now()) {
+      return { user: null, extract };
     }
-    const { guid } = extract;
 
     const user = await this.nymph.getEntity(
       { class: this.User },
-      {
-        type: '&',
-        guid: guid,
-      }
+      { type: '&', guid },
     );
-    if (!user || !user.guid || !user.enabled) {
-      return null;
+    if (
+      user == null ||
+      user.guid == null ||
+      (enforceUserRestrictions &&
+        (!user.enabled ||
+          (user.revokeTokenDate != null &&
+            issued.getTime() <= user.revokeTokenDate)))
+    ) {
+      return { user: null, extract };
     }
 
-    return user;
+    return { user, extract };
   }
 
   /**
-   * Check for a TILMELDAUTH token, and, if set, authenticate from it.
+   * Check for TILMELDAUTH and TILMELDSWITCH tokens, and, if set, authenticate
+   * from it/them.
+   *
+   * You can also call this function after setting `response.locals.user` to the
+   * user you want to authenticate. You *should* check for `user.enabled` before
+   * setting this variable, unless you explicitly want to log in as a disabled
+   * user. (The user must be an instance of the User class for this Tilmeld
+   * instance.)
+   *
+   * This function will set `response.locals.user` to the logged in user on
+   * successful authentication.
    *
    * @param skipXsrfToken Skip the XSRF token check.
+   * @param skipRenew Skip the token renewal step, even if the token is close to expiration.
    * @returns True if a user was authenticated, false on any failure.
    */
-  public authenticate(skipXsrfToken = false) {
+  public async authenticate(skipXsrfToken = false, skipRenew = false) {
     if (this.request == null) {
       return false;
     }
 
+    if (
+      this.response &&
+      this.response.locals.user &&
+      this.response.locals.user instanceof this.User
+    ) {
+      // The user has already been authenticated through some other means.
+      const user = this.response.locals.user;
+      await this.fillSession(user);
+      return true;
+    }
+
     const cookies = this.request.cookies ?? {};
 
     // If a client does't support cookies, they can use the X-TILMELDAUTH header
     // to provide the auth token.
     let fromAuthHeader = false;
     let authToken: string;
+    let switchToken: string | null;
     if (this.request.header('x-tilmeldauth') != null) {
       fromAuthHeader = true;
       authToken = this.request.header('x-tilmeldauth') as string;
+      switchToken =
+        (this.request.header('x-tilmeldswitch') as string) ||
+        'TILMELDSWITCH' in cookies
+          ? cookies.TILMELDSWITCH
+          : null;
     } else if ('TILMELDAUTH' in cookies) {
       fromAuthHeader = false;
       authToken = cookies.TILMELDAUTH;
+      switchToken = 'TILMELDSWITCH' in cookies ? cookies.TILMELDSWITCH : null;
     } else {
+      this.clearSession();
       return false;
     }
 
-    let extract: { guid: string; expire: Date } | null;
+    let user: User | null;
+    let authExtract: {
+      sub: string;
+      guid: string;
+      issued: Date;
+      expire: Date;
+      switch?: true;
+    } | null;
+    let switchUser: User | null = null;
+    let switchExtract: {
+      sub: string;
+      guid: string;
+      issued: Date;
+      expire: Date;
+      switch?: true;
+    } | null = null;
+    let xsrfToken: string | undefined = undefined;
     if (
       skipXsrfToken ||
       this.request.originalUrl.startsWith(this.config.setupPath)
     ) {
       // The request is for the setup app, or we were told to skip the XSRF
       // check, so don't check for the XSRF token.
-      extract = this.config.jwtExtract(this.config, authToken);
     } else {
       // The request is for something else, so check for a valid XSRF token,
       // unless the auth token is provided by a header (instead of a cookie).
-      const xsrfToken = this.request.header('x-xsrf-token');
+      xsrfToken = this.request.header('x-xsrf-token');
       if (xsrfToken == null && !fromAuthHeader) {
         return false;
       }
-
-      extract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+    }
+    ({ user, extract: authExtract } = await this.extractToken(
+      authToken,
+      true,
+      xsrfToken,
+    ));
+    if (switchToken) {
+      ({ user: switchUser, extract: switchExtract } = await this.extractToken(
+        switchToken,
+        false,
+      ));
     }
 
-    if (extract == null) {
-      this.logout();
+    if (user == null || authExtract == null || authExtract.switch) {
+      await this.logout();
       return false;
     }
-    const { guid, expire } = extract;
 
-    const user = this.User.factorySync(guid);
-    if (user.guid == null || !user.enabled) {
-      this.logout();
-      return false;
+    if (switchToken) {
+      if (
+        switchUser == null ||
+        switchExtract == null ||
+        !switchExtract.switch ||
+        switchExtract.sub !== user.guid
+      ) {
+        await this.logoutSwitch();
+      } else {
+        await this.fillSession(switchUser);
+
+        if (this.response) {
+          this.response.locals.user = switchUser;
+        }
+
+        return true;
+      }
     }
 
-    if (expire.valueOf() < Date.now() + this.config.jwtRenew * 1000) {
+    if (
+      !skipRenew &&
+      authExtract &&
+      authExtract.expire.getTime() < Date.now() + this.config.jwtRenew * 1000
+    ) {
       // If the user is less than renew time from needing a new token, give them
       // a new one.
-      this.login(user, fromAuthHeader);
+      await this.login(user, fromAuthHeader);
     } else {
-      this.fillSession(user);
+      await this.fillSession(user);
     }
+
+    if (this.response) {
+      this.response.locals.user = user;
+    }
+
     return true;
   }
 
@@ -1029,27 +1278,85 @@ export default class Tilmeld implements TilmeldInterface {
    * Logs the given user into the system.
    *
    * @param user The user.
-   * @param sendAuthHeader When true, a custom header with the auth token will be sent.
+   * @param sendAuthHeader Send the auth token as a custom header.
+   * @param sendCookie Send the auth token as a cookie.
    * @returns True on success, false on failure.
    */
-  public login(user: User & UserData, sendAuthHeader: boolean) {
+  public async login(user: User, sendAuthHeader: boolean, sendCookie = true) {
     if (user.guid != null && user.enabled) {
-      if (this.response && !this.response.headersSent) {
-        const token = this.config.jwtBuilder(this.config, user);
-        const appUrl = new URL(this.config.appUrl);
-        this.response.cookie('TILMELDAUTH', token, {
-          domain: this.config.cookieDomain,
-          path: this.config.cookiePath,
-          maxAge: this.config.jwtExpire * 1000,
-          secure: appUrl.protocol === 'https',
-          httpOnly: false, // Allow JS access (for CSRF protection).
-          sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
-        });
-        if (sendAuthHeader) {
-          this.response.set('X-TILMELDAUTH', token);
+      if (this.response) {
+        if (!this.response.headersSent) {
+          const token = this.config.jwtBuilder(this.config, user);
+
+          if (sendCookie) {
+            const appUrl = new URL(this.config.appUrl);
+            this.response.cookie('TILMELDAUTH', token, {
+              domain: this.config.cookieDomain,
+              path: this.config.cookiePath,
+              maxAge: this.config.jwtExpire * 1000,
+              secure: appUrl.protocol === 'https:',
+              httpOnly: false, // Allow JS access (for CSRF protection).
+              sameSite: appUrl.protocol === 'https:' ? 'lax' : 'strict',
+            });
+          }
+
+          if (sendAuthHeader) {
+            this.response.set('X-TILMELDAUTH', token);
+          }
+        }
+
+        this.response.locals.user = user;
+      }
+
+      await this.fillSession(user);
+      return true;
+    }
+    return false;
+  }
+
+  /**
+   * Adds a switch auth token for the given user.
+   *
+   * This effectively logs the current user in to the system as the given user.
+   *
+   * @param user The current user doing the switch.
+   * @param target The target user being switched to.
+   * @param sendAuthHeader Send the auth token as a custom header.
+   * @param sendCookie Send the auth token as a cookie.
+   * @returns True on success, false on failure.
+   */
+  public async loginSwitch(
+    user: User,
+    target: User,
+    sendAuthHeader: boolean,
+    sendCookie = true,
+  ) {
+    if (target.guid != null) {
+      if (this.response) {
+        if (!this.response.headersSent) {
+          const token = this.config.jwtBuilder(this.config, target, true, user);
+
+          if (sendCookie) {
+            const appUrl = new URL(this.config.appUrl);
+            this.response.cookie('TILMELDSWITCH', token, {
+              domain: this.config.cookieDomain,
+              path: this.config.cookiePath,
+              maxAge: this.config.jwtSwitchExpire * 1000,
+              secure: appUrl.protocol === 'https:',
+              httpOnly: false, // Allow JS access (for PubSub auth token).
+              sameSite: appUrl.protocol === 'https:' ? 'lax' : 'strict',
+            });
+          }
+
+          if (sendAuthHeader) {
+            this.response.set('X-TILMELDSWITCH', token);
+          }
         }
+
+        this.response.locals.user = target;
       }
-      this.fillSession(user);
+
+      await this.fillSession(target);
       return true;
     }
     return false;
@@ -1057,35 +1364,50 @@ export default class Tilmeld implements TilmeldInterface {
 
   /**
    * Logs the current user out of the system.
+   *
+   * @param clearCookie Clear the auth cookie. (Also send a header.)
    */
-  public logout() {
+  public async logout(clearCookie = true) {
+    if (this.request && !this.alreadyLoggedOutSwitch) {
+      const cookies = this.request.cookies ?? {};
+
+      if ('TILMELDSWITCH' in cookies) {
+        this.alreadyLoggedOutSwitch = true;
+        return await this.logoutSwitch(clearCookie);
+      }
+    }
+
     this.clearSession();
-    if (this.response && !this.response.headersSent) {
-      this.response.clearCookie('TILMELDAUTH', {
-        domain: this.config.cookieDomain,
-        path: this.config.cookiePath,
-      });
-      this.response.set('X-TILMELDAUTH', '');
+    if (this.response) {
+      if (clearCookie && !this.response.headersSent) {
+        this.response.clearCookie('TILMELDAUTH', {
+          domain: this.config.cookieDomain,
+          path: this.config.cookiePath,
+        });
+        this.response.set('X-TILMELDAUTH', '');
+      }
+      this.response.locals.user = null;
     }
   }
 
-  // /**
-  //  * Sort an array of groups hierarchically.
-  //  *
-  //  * An additional property of the groups can be used to sort them under their
-  //  * parents.
-  //  *
-  //  * @param array The array of groups.
-  //  * @param property The name of the property to sort groups by. Undefined for no additional sorting.
-  //  * @param caseSensitive Sort case sensitively.
-  //  * @param reverse Reverse the sort order.
-  //  */
-  // public static groupSort(
-  //   array: any[],
-  //   property?: string,
-  //   caseSensitive = false,
-  //   reverse = false
-  // ) {
-  //   hsort(array, property, 'parent', caseSensitive, reverse);
-  // }
+  /**
+   * Clears the switch user out of the system.
+   *
+   * @param clearCookie Clear the auth cookie. (Also send a header.)
+   */
+  public async logoutSwitch(clearCookie = true) {
+    this.clearSession();
+    if (this.response) {
+      if (clearCookie && !this.response.headersSent) {
+        this.response.clearCookie('TILMELDSWITCH', {
+          domain: this.config.cookieDomain,
+          path: this.config.cookiePath,
+        });
+        this.response.set('X-TILMELDSWITCH', '');
+      }
+      this.response.locals.user = null;
+
+      await this.authenticate(false, true);
+    }
+  }
 }