@nymphjs/tilmeld 1.0.0-beta.14 → 1.0.0-beta.140

package/dist/User.js

@@ -1,1210 +1,2195 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const strtotime_1 = __importDefault(require("locutus/php/datetime/strtotime"));
-const enc_base64_1 = __importDefault(require("crypto-js/enc-base64"));
-const sha256_1 = __importDefault(require("crypto-js/sha256"));
-const md5_1 = __importDefault(require("crypto-js/md5"));
-const lodash_1 = require("lodash");
-const guid_1 = require("@nymphjs/guid");
-const AbleObject_1 = __importDefault(require("./AbleObject"));
-const errors_1 = require("./errors");
-class User extends AbleObject_1.default {
-    static async factory(guid) {
-        return (await super.factory(guid));
-    }
-    static async factoryUsername(username) {
-        const entity = new this();
-        if (username != null) {
-            const entity = await this.nymph.getEntity({
-                class: this,
-            }, {
-                type: '&',
-                ilike: ['username', username.replace(/([\\%_])/g, (s) => `\\${s}`)],
-            });
-            if (entity != null) {
-                return entity;
-            }
-        }
-        return entity;
-    }
-    static factorySync(guid) {
-        return super.factorySync(guid);
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
     }
-    constructor(guid) {
-        super(guid);
-        this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
-        this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
-        this.$allowlistTags = [];
-        this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$data.groups = [];
-            this.$data.inheritAbilities = true;
-            this.$updateDataProtection();
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
         }
     }
-    static current(returnObjectIfNotExist) {
-        if (this.tilmeld.currentUser == null) {
-            return returnObjectIfNotExist ? this.factorySync() : null;
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import crypto from 'node:crypto';
+import { transaction, transactional, } from '@nymphjs/nymph';
+import { humanSecret, nanoid } from '@nymphjs/guid';
+import { strtotime } from 'locutus/php/datetime/index';
+import { difference, xor } from 'lodash-es';
+import { TOTP, Secret } from 'otpauth';
+import { toDataURL } from 'qrcode';
+import { splitn } from '@sciactive/splitn';
+import { enforceTilmeld } from './enforceTilmeld.js';
+import { AbleObject } from './AbleObject.js';
+import { Group as GroupClass } from './Group.js';
+import { AccessControlError, BadDataError, BadEmailError, BadUsernameError, EmailChangeRateLimitExceededError, } from './errors/index.js';
+/**
+ * A user data model.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@port87.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
+let User = (() => {
+    let _classSuper = AbleObject;
+    let _instanceExtraInitializers = [];
+    let _$delete_decorators;
+    return class User extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _$delete_decorators = [transactional];
+            __esDecorate(this, null, _$delete_decorators, { kind: "method", name: "$delete", static: false, private: false, access: { has: obj => "$delete" in obj, get: obj => obj.$delete }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static ETYPE = 'tilmeld_user';
+        static class = 'User';
+        static checkUsernameCallbacks = [];
+        static beforeRegisterCallbacks = [];
+        static afterRegisterCallbacks = [];
+        static beforeSaveCallbacks = [];
+        static afterSaveCallbacks = [];
+        static beforeLoginCallbacks = [];
+        static afterLoginCallbacks = [];
+        static beforeLogoutCallbacks = [];
+        static afterLogoutCallbacks = [];
+        static beforeDeleteCallbacks = [];
+        static afterDeleteCallbacks = [];
+        static DEFAULT_CLIENT_ENABLED_METHODS = [
+            '$checkUsername',
+            '$checkEmail',
+            '$checkPhone',
+            '$getAvatar',
+            '$register',
+        ];
+        static DEFAULT_PRIVATE_DATA = [
+            // The things that are commented are there to show what is _not_ private.
+            'abilities',
+            // 'username',
+            // 'nameFirst',
+            // 'nameMiddle',
+            // 'nameLast',
+            // 'name',
+            'email',
+            // 'avatar',
+            'phone',
+            'group',
+            'groups',
+            'inheritAbilities',
+            'enabled',
+            'secret',
+            'emailChangeDate',
+            'newEmailSecret',
+            'newEmailAddress',
+            'cancelEmailSecret',
+            'cancelEmailAddress',
+            'recoverSecret',
+            'recoverSecretDate',
+            'salt',
+            'password',
+            'passwordTemp',
+            'revokeTokenDate',
+            'totpSecret',
+        ];
+        static DEFAULT_ALLOWLIST_DATA = [];
+        $clientEnabledMethods = (__runInitializers(this, _instanceExtraInitializers), [...User.DEFAULT_CLIENT_ENABLED_METHODS]);
+        static clientEnabledStaticMethods = [
+            'current',
+            'loginUser',
+            'sendRecovery',
+            'recover',
+            'getClientConfig',
+            'getDomainUsers',
+        ];
+        $privateData = [...User.DEFAULT_PRIVATE_DATA];
+        static searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+        $allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
+        $allowlistTags = [];
+        /**
+         * Gatekeeper ability cache.
+         *
+         * Gatekeeper will cache the user's abilities that it calculates, so it can
+         * check faster if that user has been checked before.
+         */
+        $gatekeeperCache;
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenSaving = false;
+        /**
+         * This should only be used by the backend.
+         */
+        $skipAcWhenDeleting = false;
+        /**
+         * The user's group descendants.
+         */
+        $descendantGroups;
+        /**
+         * Used to save the current email address to send verification if it changes
+         * from the frontend.
+         *
+         * If you are changing a user's email address and want to bypass email
+         * verification, don't set this.
+         */
+        $originalEmail;
+        /**
+         * Used to save the current username for domain admin permissions.
+         */
+        $originalUsername;
+        static getFTSText(name, value) {
+            if ([
+                'abilities',
+                'group',
+                'groups',
+                'inheritAbilities',
+                'enabled',
+                'secret',
+                'emailChangeDate',
+                'newEmailSecret',
+                'newEmailAddress',
+                'cancelEmailSecret',
+                'cancelEmailAddress',
+                'recoverSecret',
+                'recoverSecretDate',
+                'salt',
+                'password',
+                'passwordTemp',
+                'revokeTokenDate',
+                'totpSecret',
+            ].indexOf(name) !== -1) {
+                return null;
+            }
+            return super.getFTSText(name, value);
         }
-        return this.tilmeld.currentUser;
-    }
-    static async sendRecovery(data) {
-        if (!this.tilmeld.config.pwRecovery) {
-            return {
-                result: false,
-                message: 'Account recovery is not allowed.',
-            };
+        static async factoryUsername(username) {
+            const entity = new this();
+            if (username != null) {
+                const entity = await this.nymph.getEntity({ class: this }, {
+                    type: '&',
+                    ilike: ['username', username.replace(/([\\%_])/g, (s) => `\\${s}`)],
+                });
+                if (entity != null) {
+                    return entity;
+                }
+            }
+            return entity;
         }
-        let user;
-        const options = {};
-        if (!this.tilmeld.config.emailUsernames &&
-            data.recoveryType === 'username') {
-            const getUser = await this.nymph.getEntity({ class: this.tilmeld.User, skipAc: true }, {
-                type: '&',
-                ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
-            });
-            if (getUser == null) {
+        static current(returnObjectIfNotExist) {
+            const tilmeld = enforceTilmeld(this);
+            if (tilmeld.currentUser == null) {
+                return returnObjectIfNotExist ? this.factorySync() : null;
+            }
+            return tilmeld.currentUser;
+        }
+        /**
+         * Send an account recovery link.
+         *
+         * @param data The input data from the client.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        static async sendRecovery(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.config.pwRecovery) {
+                return { result: false, message: 'Account recovery is not allowed.' };
+            }
+            let user;
+            const options = {};
+            if (!tilmeld.config.emailUsernames && data.recoveryType === 'username') {
+                // Create a username recovery email.
+                const getUser = await this.nymph.getEntity({ class: tilmeld.User, skipAc: true }, {
+                    type: '&',
+                    ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
+                });
+                if (getUser == null) {
+                    return {
+                        result: false,
+                        message: 'Requested account is not accessible.',
+                    };
+                }
+                // Send the recovery email.
+                user = getUser;
+                options.template = 'RecoverUsername';
+                options.message = {
+                    to: { name: user.name ?? '', address: user.email ?? '' },
+                };
+                options.locals = {};
+            }
+            else if (data.recoveryType === 'password') {
+                // Create a password recovery email.
+                const getUser = await tilmeld.User.factoryUsername(data.account);
+                if (getUser.guid == null) {
+                    return {
+                        result: false,
+                        message: 'Requested account is not accessible.',
+                    };
+                }
+                // Create a unique secret.
+                getUser.recoverSecret = humanSecret();
+                getUser.recoverSecretDate = Date.now();
+                try {
+                    await getUser.$saveSkipAC();
+                }
+                catch (e) {
+                    return { result: false, message: "Couldn't save recovery secret." };
+                }
+                // Send the recovery email.
+                user = getUser;
+                options.template = 'RecoverPassword';
+                options.message = {
+                    to: { name: user.name ?? '', address: user.email ?? '' },
+                };
+                options.locals = {
+                    recoverCode: getUser.recoverSecret,
+                    timeLimit: tilmeld.config.pwRecoveryTimeLimit,
+                };
+            }
+            else {
+                return { result: false, message: 'Invalid recovery type.' };
+            }
+            this.nymph.config.debugLog('tilmeld', `User account recovery (${options.template}) request for "${user.username}".`);
+            // Send the email.
+            if (await tilmeld.config.sendEmail(tilmeld, options, user)) {
                 return {
-                    result: false,
-                    message: 'Requested account is not accessible.',
+                    result: true,
+                    message: "We've sent an email to your registered address. Please " +
+                        'check your email to continue with account recovery.',
                 };
             }
-            user = getUser;
-            options.template = 'RecoverUsername';
-            options.message = {
-                to: {
-                    name: user.name ?? '',
-                    address: user.email ?? '',
-                },
-            };
-            options.locals = {};
+            else {
+                return { result: false, message: "Couldn't send recovery email." };
+            }
         }
-        else if (data.recoveryType === 'password') {
-            const getUser = await this.tilmeld.User.factoryUsername(data.account);
-            if (getUser.guid == null) {
+        /**
+         * Recover account details.
+         *
+         * @param data The input data from the client.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        static async recover(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.config.pwRecovery) {
+                return { result: false, message: 'Account recovery is not allowed.' };
+            }
+            const user = await tilmeld.User.factoryUsername(data.username);
+            if (user.guid == null ||
+                user.recoverSecret == null ||
+                data.secret !== user.recoverSecret ||
+                (strtotime('+' + tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) || 0) *
+                    1000 <
+                    Date.now()) {
+                return { result: false, message: 'The secret code does not match.' };
+            }
+            if (!('password' in data) || !data.password.length) {
+                return { result: false, message: 'Password cannot be empty.' };
+            }
+            this.nymph.config.debugLog('tilmeld', `User account recovery for "${user.username}".`);
+            await user.$password(data.password);
+            delete user.recoverSecret;
+            delete user.recoverSecretDate;
+            try {
+                await user.$saveSkipAC();
                 return {
-                    result: false,
-                    message: 'Requested account is not accessible.',
+                    result: true,
+                    message: 'Your password has been reset. You can now log in using your new password.',
                 };
             }
-            getUser.recoverSecret = (0, guid_1.humanSecret)();
-            getUser.recoverSecretDate = Date.now();
-            if (!(await getUser.$saveSkipAC())) {
-                return { result: false, message: "Couldn't save recovery secret." };
-            }
-            user = getUser;
-            options.template = 'RecoverPassword';
-            options.message = {
-                to: {
-                    name: user.name ?? '',
-                    address: user.email ?? '',
-                },
-            };
-            options.locals = {
-                recoverCode: getUser.recoverSecret,
-                timeLimit: this.tilmeld.config.pwRecoveryTimeLimit,
-            };
-        }
-        else {
-            return { result: false, message: 'Invalid recovery type.' };
-        }
-        if (await this.tilmeld.config.sendEmail(this.tilmeld, options, user)) {
-            return {
-                result: true,
-                message: "We've sent an email to your registered address. Please " +
-                    'check your email to continue with account recovery.',
-            };
-        }
-        else {
-            return { result: false, message: "Couldn't send recovery email." };
-        }
-    }
-    static async recover(data) {
-        if (!this.tilmeld.config.pwRecovery) {
-            return {
-                result: false,
-                message: 'Account recovery is not allowed.',
-            };
-        }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
-        if (user.guid == null ||
-            user.recoverSecret == null ||
-            data.secret !== user.recoverSecret ||
-            (0, strtotime_1.default)('+' + this.tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
-                1000 <
-                Date.now()) {
-            return {
-                result: false,
-                message: 'The secret code does not match.',
-            };
-        }
-        if (!('password' in data) || !data.password.length) {
-            return { result: false, message: 'Password cannot be empty.' };
+            catch (e) {
+                return { result: false, message: 'Error saving new password.' };
+            }
         }
-        user.$password(data.password);
-        delete user.recoverSecret;
-        delete user.recoverSecretDate;
-        if (await user.$saveSkipAC()) {
+        static getClientConfig() {
+            const tilmeld = enforceTilmeld(this);
             return {
-                result: true,
-                message: 'Your password has been reset. You can now log in using your new password.',
+                regFields: tilmeld.config.regFields,
+                userFields: tilmeld.config.userFields,
+                emailUsernames: tilmeld.config.emailUsernames,
+                domainSupport: tilmeld.config.domainSupport,
+                allowRegistration: tilmeld.config.allowRegistration,
+                allowUsernameChange: tilmeld.config.allowUsernameChange,
+                pwRecovery: tilmeld.config.pwRecovery,
+                verifyEmail: tilmeld.config.verifyEmail,
+                unverifiedAccess: tilmeld.config.unverifiedAccess,
             };
         }
-        else {
-            return { result: false, message: 'Error saving new password.' };
-        }
-    }
-    static getClientConfig() {
-        return {
-            regFields: this.tilmeld.config.regFields,
-            userFields: this.tilmeld.config.userFields,
-            emailUsernames: this.tilmeld.config.emailUsernames,
-            allowRegistration: this.tilmeld.config.allowRegistration,
-            allowUsernameChange: this.tilmeld.config.allowUsernameChange,
-            pwRecovery: this.tilmeld.config.pwRecovery,
-            verifyEmail: this.tilmeld.config.verifyEmail,
-            unverifiedAccess: this.tilmeld.config.unverifiedAccess,
-        };
-    }
-    static async loginUser(data) {
-        if (!('username' in data) || !data.username.length) {
-            return { result: false, message: 'Incorrect login/password.' };
-        }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
-        const result = await user.$login(data);
-        if (result.result) {
-            user.$updateDataProtection();
-            result.user = user;
-        }
-        return result;
-    }
-    async $login(data) {
-        const tilmeld = this.$nymph.tilmeld;
-        if (this.guid == null) {
-            return { result: false, message: 'Incorrect login/password.' };
-        }
-        if (!this.$data.enabled) {
-            return { result: false, message: 'This user is disabled.' };
+        static async loginUser(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (!('username' in data) || !data.username.length) {
+                return { result: false, message: 'Incorrect login/password.' };
+            }
+            const user = await tilmeld.User.factoryUsername(data.username);
+            const result = await user.$login(data);
+            if (result.result) {
+                user.$updateDataProtection();
+                result.user = user;
+            }
+            return result;
+        }
+        /**
+         * Get the users in a domain. This is only accessible to the domain's admins.
+         */
+        static async getDomainUsers(domain, options) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.config.domainSupport) {
+                throw new AccessControlError('Domain support is not enabled.');
+            }
+            if (options?.sort != null &&
+                User.searchRestrictedData.includes(options.sort)) {
+                throw new AccessControlError("Can't sort by that property.");
+            }
+            if (!domain) {
+                throw new BadDataError('Domain is required.');
+            }
+            domain = domain.toLowerCase();
+            if (!tilmeld.config.validDomainRegex.test(domain)) {
+                throw new BadDataError(tilmeld.config.validDomainRegexNotice);
+            }
+            if (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                throw new AccessControlError('You do not have the authority to manage this domain.');
+            }
+            return await this.nymph.getEntities({
+                class: User,
+                ...(options?.limit != null ? { limit: options.limit } : {}),
+                ...(options?.offset != null ? { offset: options.offset } : {}),
+                ...(options?.sort != null ? { sort: options.sort } : {}),
+                ...(options?.reverse != null ? { reverse: options.reverse } : {}),
+            }, {
+                type: '&',
+                like: ['username', `%@${domain.replace(/([\\%_])/g, (s) => `\\${s}`)}`],
+            });
         }
-        if (this.$gatekeeper()) {
-            return { result: true, message: 'You are already logged in.' };
+        constructor() {
+            super();
+            // Defaults.
+            this.enabled = true;
+            this.abilities = [];
+            this.groups = [];
+            this.inheritAbilities = true;
+            this.$updateDataProtection();
         }
-        if (!this.$checkPassword(data.password)) {
-            return { result: false, message: 'Incorrect login/password.' };
+        async $getUniques() {
+            const tilmeld = enforceTilmeld(this);
+            const uniques = [`u:${this.username}`];
+            if (this.abilities?.includes('system/autogranted')) {
+                // Prevent multiple users from ever being granted admin automatically.
+                uniques.push('a:autogranted');
+            }
+            if (!tilmeld.config.emailUsernames &&
+                tilmeld.config.userFields.includes('email')) {
+                uniques.push(`e:${this.email}`);
+                if (this.newEmailAddress != null) {
+                    uniques.push(`e:${this.newEmailAddress}`);
+                }
+            }
+            return uniques;
         }
-        try {
+        async $login(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (this.guid == null) {
+                await tilmeld.config.failedLoginAttempt(null, data);
+                return { result: false, message: 'Incorrect login/password.' };
+            }
+            if (!(await this.$checkPassword(data.password))) {
+                await tilmeld.config.failedLoginAttempt(this, data);
+                return { result: false, message: 'Incorrect login/password.' };
+            }
+            if (!this.enabled) {
+                return { result: false, message: 'Your account is disabled.' };
+            }
+            if (await this.$gatekeeper()) {
+                return { result: true, message: 'You are already logged in.' };
+            }
+            if (this.totpSecret != null) {
+                if (data.code == null ||
+                    typeof data.code !== 'string' ||
+                    data.code.length !== 6) {
+                    return {
+                        result: false,
+                        needTOTP: true,
+                        message: 'You need to provide a 2FA code.',
+                    };
+                }
+                if (!this.$checkTOTPCode(data.code)) {
+                    await tilmeld.config.failedLoginAttempt(this, data);
+                    return { result: false, message: 'Incorrect 2FA code.' };
+                }
+            }
+            try {
+                for (let callback of this.constructor
+                    .beforeLoginCallbacks) {
+                    if (callback) {
+                        await callback(this, data);
+                    }
+                }
+            }
+            catch (e) {
+                return { result: false, message: e.message };
+            }
+            this.$nymph.config.debugLog('tilmeld', `User login for "${this.username}".`);
+            // Authentication was successful, attempt to login.
+            if (!(await tilmeld.login(this, true))) {
+                return { result: false, message: 'Incorrect login/password.' };
+            }
             for (let callback of this.constructor
-                .beforeLoginCallbacks) {
+                .afterLoginCallbacks) {
                 if (callback) {
-                    await callback(this, data);
+                    await callback(this);
                 }
             }
-        }
-        catch (e) {
-            return {
-                result: false,
-                message: e.message,
-            };
-        }
-        if (!tilmeld.login(this, true)) {
-            return { result: false, message: 'Incorrect login/password.' };
-        }
-        for (let callback of this.constructor
-            .afterLoginCallbacks) {
-            if (callback) {
-                await callback(this);
+            // Check if the password uses the old hash method.
+            if (tilmeld.config.pwMethod === 'salt' &&
+                !this.password?.startsWith('scrypt$')) {
+                // Update the password hash with one using the new method.
+                await this.$refresh();
+                await this.$password(data.password);
+                await this.$save();
             }
+            // Login was successful.
+            return { result: true, message: 'You are logged in.' };
         }
-        return { result: true, message: 'You are logged in.' };
-    }
-    async $logout() {
-        const tilmeld = this.$nymph.tilmeld;
-        try {
+        async $switchUser(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (this.guid == null) {
+                return { result: false, message: 'Incorrect login/password.' };
+            }
+            let user = tilmeld.User.current();
+            if (!user || user.guid == null) {
+                return { result: false, message: "You're not logged in." };
+            }
+            const isCurrentUser = user != null && user.$is(this);
+            if (isCurrentUser) {
+                return { result: false, message: "You can't switch to yourself." };
+            }
+            const toAbilities = this.abilities || [];
+            const fromAbilities = user.abilities || [];
+            if (!fromAbilities.includes('tilmeld/switch') &&
+                !fromAbilities.includes('system/admin')) {
+                return {
+                    result: false,
+                    message: "You don't have permission to switch users.",
+                };
+            }
+            if (toAbilities.includes('system/admin') ||
+                toAbilities.includes('tilmeld/admin')) {
+                return { result: false, message: "You can't switch to an admin." };
+            }
+            try {
+                for (let callback of this.constructor
+                    .beforeLoginCallbacks) {
+                    if (callback) {
+                        await callback(this, {
+                            username: this.username || '',
+                            password: '',
+                            ...(data || {}),
+                        });
+                    }
+                }
+            }
+            catch (e) {
+                return { result: false, message: e.message };
+            }
+            this.$nymph.config.debugLog('tilmeld', `User login switch for "${user.username}" to "${this.username}".`);
+            // Authentication was successful, attempt to login.
+            if (!(await tilmeld.loginSwitch(user, this, true))) {
+                return { result: false, message: 'Incorrect login/password.' };
+            }
             for (let callback of this.constructor
-                .beforeLogoutCallbacks) {
+                .afterLoginCallbacks) {
                 if (callback) {
                     await callback(this);
                 }
             }
-        }
-        catch (e) {
-            return {
-                result: false,
-                message: e.message,
-            };
-        }
-        tilmeld.logout();
-        for (let callback of this.constructor
-            .afterLogoutCallbacks) {
-            if (callback) {
-                await callback(this);
+            // Login was successful.
+            return { result: true, message: 'You are logged in.' };
+        }
+        /**
+         * Log a user out of the system.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $logout() {
+            const tilmeld = enforceTilmeld(this);
+            try {
+                for (let callback of this.constructor
+                    .beforeLogoutCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
             }
-        }
-        return { result: true, message: 'You have been logged out.' };
-    }
-    $getAvatar() {
-        if (this.$data.avatar != null && this.$data.avatar !== '') {
-            return this.$data.avatar;
-        }
-        if (this.$data.email == null || this.$data.email === '') {
-            return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
-        }
-        return ('https://secure.gravatar.com/avatar/' +
-            (0, md5_1.default)(this.$data.email.trim().toLowerCase()).toString() +
-            '?d=identicon&s=40');
-    }
-    async $getDescendantGroups() {
-        if (this.$descendantGroups == null) {
-            this.$descendantGroups = [];
-            if (this.$data.group != null) {
-                this.$descendantGroups = await this.$data.group.$getDescendants();
+            catch (e) {
+                return { result: false, message: e.message };
             }
-            for (let curGroup of this.$data.groups ?? []) {
-                this.$descendantGroups = this.$descendantGroups?.concat(await curGroup.$getDescendants());
+            this.$nymph.config.debugLog('tilmeld', `User logout for "${this.username}".`);
+            await tilmeld.logout();
+            for (let callback of this.constructor
+                .afterLogoutCallbacks) {
+                if (callback) {
+                    await callback(this);
+                }
             }
+            return { result: true, message: 'You have been logged out.' };
         }
-        return this.$descendantGroups;
-    }
-    $getDescendantGroupsSync() {
-        if (this.$descendantGroups == null) {
-            this.$descendantGroups = [];
-            if (this.$data.group != null) {
-                this.$descendantGroups = this.$data.group.$getDescendantsSync();
+        $getAvatar() {
+            if (this.avatar != null && this.avatar !== '') {
+                return this.avatar;
+            }
+            if (this.email == null || this.email === '') {
+                return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
             }
-            for (let curGroup of this.$data.groups ?? []) {
-                this.$descendantGroups = this.$descendantGroups?.concat(curGroup.$getDescendantsSync());
+            return ('https://secure.gravatar.com/avatar/' +
+                crypto
+                    .createHash('sha256')
+                    .update(this.email.trim().toLowerCase())
+                    .digest('hex')
+                    .toLowerCase() +
+                '?d=identicon&s=40');
+        }
+        $getGid() {
+            if (this.group) {
+                return this.group.guid;
             }
+            return null;
         }
-        return this.$descendantGroups;
-    }
-    $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if ('abilities' in input.data &&
-            input.data.abilities.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+        $getGids() {
+            if (this.groups) {
+                return this.groups
+                    .map((group) => group.guid)
+                    .filter((guid) => guid != null);
+            }
+            return null;
+        }
+        /**
+         * Get the user's group descendants.
+         */
+        async $getDescendantGroups() {
+            if (this.$descendantGroups == null) {
+                this.$descendantGroups = [];
+                if (this.group != null) {
+                    await this.group.$wake();
+                    this.$descendantGroups = await this.group.$getDescendants();
+                }
+                await Promise.all(this.groups?.map((e) => e.$wake()) || []);
+                for (let curGroup of this.groups ?? []) {
+                    this.$descendantGroups = this.$descendantGroups?.concat(await curGroup.$getDescendants());
+                }
+            }
+            return this.$descendantGroups;
         }
-        this.$originalEmail = this.$data.email;
-        super.$jsonAcceptData(input, allowConflict);
-    }
-    $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if ('abilities' in patch.set &&
-            patch.set.abilities.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+        $jsonAcceptData(input, allowConflict = false) {
+            const tilmeld = enforceTilmeld(this);
+            this.$check();
+            if ('abilities' in input.data) {
+                this.$checkIncomingAbilities(input.data.abilities);
+            }
+            else if ((this.$allowlistData == null ||
+                this.$allowlistData.includes('abilities')) &&
+                (this.$privateData == null || !this.$privateData.includes('abilities'))) {
+                this.$checkIncomingAbilities(undefined);
+            }
+            // If the user is a new domain user, the data protection needs to be updated
+            // before the data is accepted, or else some things won't be accepted
+            // correctly (enabled, passwordTemp).
+            let reloadDataProtection = false;
+            if (tilmeld.config.domainSupport) {
+                let [_username, domain] = splitn(input.data.username ?? '', '@', 2);
+                // Lowercase the domain part.
+                if (domain) {
+                    domain = domain.toLowerCase();
+                }
+                const isCurrentUser = this.$is(tilmeld.currentUser);
+                const isNewUser = input.guid == null;
+                const isDomainUser = !isCurrentUser &&
+                    domain &&
+                    tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`);
+                reloadDataProtection = !!(isNewUser && isDomainUser);
+            }
+            super.$jsonAcceptData(input, allowConflict);
+            if (reloadDataProtection) {
+                // Load it again after data protection is run.
+                this.$updateDataProtection();
+                super.$jsonAcceptData(input, allowConflict);
+            }
         }
-        this.$originalEmail = this.$data.email;
-        super.$jsonAcceptPatch(patch, allowConflict);
-    }
-    $putData(data, sdata) {
-        super.$putData(data, sdata);
-        this.$updateDataProtection();
-    }
-    $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
-        let user = givenUser ?? tilmeld.User.current();
-        this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
-        this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
-        if (tilmeld.config.emailUsernames) {
-            this.$privateData.push('username');
+        $jsonAcceptPatch(patch, allowConflict = false) {
+            this.$check();
+            if ('abilities' in patch.set) {
+                this.$checkIncomingAbilities(patch.set.abilities);
+            }
+            if (patch.unset.includes('abilities')) {
+                this.$checkIncomingAbilities(undefined);
+            }
+            super.$jsonAcceptPatch(patch, allowConflict);
         }
-        const isCurrentUser = user != null && user.$is(this);
-        const abilities = (isCurrentUser || user == null
-            ? this.$data.abilities
-            : user?.abilities) ?? [];
-        const isNewUser = this.guid == null;
-        if (isCurrentUser) {
-            this.$clientEnabledMethods.push('$gatekeeper');
-            this.$clientEnabledMethods.push('$changePassword');
-            this.$clientEnabledMethods.push('$logout');
-            this.$clientEnabledMethods.push('$sendEmailVerification');
+        $checkIncomingAbilities(incoming) {
+            const tilmeld = enforceTilmeld(this);
+            if (!Array.isArray(incoming) ||
+                incoming.find((ability) => typeof ability !== 'string')) {
+                throw new BadDataError('Abilities must be an array of strings.');
+            }
+            if (incoming.includes('system/admin') !==
+                this.abilities?.includes('system/admin') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
+            }
+            if (xor(incoming.filter((ability) => ability.startsWith('system/')), this.abilities?.filter((ability) => ability.startsWith('system/')) ??
+                []).length &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke system abilities.");
+            }
+            if (incoming.includes('tilmeld/admin') !==
+                this.abilities?.includes('tilmeld/admin') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+            }
+            if (incoming.includes('tilmeld/switch') !==
+                this.abilities?.includes('tilmeld/switch') &&
+                (!tilmeld.currentUser ||
+                    !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+                throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
+            }
+            if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ??
+                []).length &&
+                (!tilmeld.currentUser ||
+                    (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+                        !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
+                throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
+            }
         }
-        if (user != null &&
-            (abilities.indexOf('tilmeld/admin') !== -1 ||
-                abilities.indexOf('system/admin') !== -1)) {
-            this.$privateData = ['password', 'salt'];
-            this.$allowlistData = undefined;
+        $putData(data, sdata, source) {
+            let newData = { ...data };
+            let newSdata = sdata && { ...sdata };
+            // TODO: Fix these being added by the drivers.
+            // @ts-ignore
+            delete newData.acRead;
+            // @ts-ignore
+            delete newData.acWrite;
+            // @ts-ignore
+            delete newData.acFull;
+            if (newSdata) {
+                delete newSdata.acRead;
+                delete newSdata.acWrite;
+                delete newSdata.acFull;
+            }
+            super.$putData(newData, newSdata, source);
+            if (source === 'server') {
+                this.$originalEmail = this.email;
+                this.$originalUsername = this.username;
+            }
+            this.$updateDataProtection();
         }
-        else if (isCurrentUser || isNewUser) {
-            if (tilmeld.config.allowUsernameChange || isNewUser) {
-                this.$allowlistData.push('username');
+        /**
+         * Update the data protection arrays for the current user.
+         */
+        $updateDataProtection() {
+            const tilmeld = enforceTilmeld(this);
+            let [_username, domain] = tilmeld.config.domainSupport
+                ? splitn(this.$originalUsername ?? this.username ?? '', '@', 2)
+                : [this.$originalUsername ?? this.username, null];
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
             }
-            this.$allowlistData.push('avatar');
-            if (tilmeld.config.userFields.indexOf('name') !== -1) {
-                this.$allowlistData.push('nameFirst');
-                this.$allowlistData.push('nameMiddle');
-                this.$allowlistData.push('nameLast');
-                this.$allowlistData.push('name');
+            this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
+            this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
+            this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
+            if (tilmeld.config.emailUsernames) {
+                this.$privateData.push('username');
             }
-            if (tilmeld.config.userFields.indexOf('email') !== -1) {
-                this.$allowlistData.push('email');
+            const isCurrentUser = this.$is(tilmeld.currentUser);
+            const isNewUser = this.guid == null;
+            const isDomainUser = tilmeld.config.domainSupport &&
+                !isCurrentUser &&
+                domain &&
+                tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`);
+            if (isCurrentUser) {
+                // Users can check to see what abilities they have.
+                this.$clientEnabledMethods.push('$gatekeeper');
+                this.$clientEnabledMethods.push('$changePassword');
+                this.$clientEnabledMethods.push('$revokeCurrentTokens');
+                this.$clientEnabledMethods.push('$logout');
+                this.$clientEnabledMethods.push('$hasTOTPSecret');
+                this.$clientEnabledMethods.push('$getNewTOTPSecret');
+                this.$clientEnabledMethods.push('$saveTOTPSecret');
+                this.$clientEnabledMethods.push('$removeTOTPSecret');
             }
-            if (tilmeld.config.userFields.indexOf('phone') !== -1) {
-                this.$allowlistData.push('phone');
+            if (isDomainUser) {
+                // Domain admins can check to see what abilities their users have.
+                this.$clientEnabledMethods.push('$gatekeeper');
+                this.$clientEnabledMethods.push('$changePassword');
+                this.$clientEnabledMethods.push('$revokeCurrentTokens');
+                this.$clientEnabledMethods.push('$hasTOTPSecret');
+                this.$clientEnabledMethods.push('$getNewTOTPSecret');
+                this.$clientEnabledMethods.push('$saveTOTPSecret');
+                this.$clientEnabledMethods.push('$removeTOTPSecret');
+            }
+            if (tilmeld.gatekeeper('tilmeld/admin') ||
+                tilmeld.gatekeeper('system/admin')) {
+                // Users who can edit other users can see most of their data.
+                this.$privateData = [
+                    'newEmailSecret',
+                    'cancelEmailSecret',
+                    'recoverSecret',
+                    'salt',
+                    'password',
+                    'totpSecret',
+                ];
+                this.$clientEnabledMethods.push('$hasTOTPSecret');
+                this.$clientEnabledMethods.push('$removeTOTPSecret');
+                this.$allowlistData = undefined;
+            }
+            else if (isDomainUser) {
+                // Domain admins can see their users' data, and edit some of it.
+                if (tilmeld.config.allowUsernameChange || isNewUser) {
+                    this.$allowlistData.push('username');
+                }
+                this.$allowlistData.push('avatar');
+                if (tilmeld.config.userFields.includes('name')) {
+                    this.$allowlistData.push('nameFirst');
+                    this.$allowlistData.push('nameMiddle');
+                    this.$allowlistData.push('nameLast');
+                    this.$allowlistData.push('name');
+                }
+                if (tilmeld.config.userFields.includes('email')) {
+                    this.$allowlistData.push('email');
+                }
+                if (tilmeld.config.userFields.includes('phone')) {
+                    this.$allowlistData.push('phone');
+                }
+                this.$allowlistData.push('enabled');
+                this.$allowlistData.push('passwordTemp');
+                this.$privateData = [
+                    // The things commented are there to show what is _not_ private.
+                    // 'abilities',
+                    // 'username',
+                    // 'nameFirst',
+                    // 'nameMiddle',
+                    // 'nameLast',
+                    // 'name',
+                    // 'email',
+                    // 'avatar',
+                    // 'phone',
+                    // 'group',
+                    // 'groups',
+                    // 'inheritAbilities',
+                    // 'enabled',
+                    'secret',
+                    'emailChangeDate',
+                    'newEmailSecret',
+                    // 'newEmailAddress',
+                    'cancelEmailSecret',
+                    'cancelEmailAddress',
+                    'recoverSecret',
+                    'recoverSecretDate',
+                    'salt',
+                    'password',
+                    // 'passwordTemp',
+                    // 'revokeTokenDate',
+                    'totpSecret',
+                ];
+            }
+            else if (isCurrentUser || isNewUser) {
+                // Users can see their own data, and edit some of it.
+                if (tilmeld.config.allowUsernameChange || isNewUser) {
+                    this.$allowlistData.push('username');
+                }
+                this.$allowlistData.push('avatar');
+                if (tilmeld.config.userFields.includes('name')) {
+                    this.$allowlistData.push('nameFirst');
+                    this.$allowlistData.push('nameMiddle');
+                    this.$allowlistData.push('nameLast');
+                    this.$allowlistData.push('name');
+                }
+                if (tilmeld.config.userFields.includes('email')) {
+                    this.$allowlistData.push('email');
+                }
+                if (tilmeld.config.userFields.includes('phone')) {
+                    this.$allowlistData.push('phone');
+                }
+                this.$privateData = [
+                    // The things commented are there to show what is _not_ private.
+                    // 'abilities',
+                    // 'username',
+                    // 'nameFirst',
+                    // 'nameMiddle',
+                    // 'nameLast',
+                    // 'name',
+                    // 'email',
+                    // 'avatar',
+                    // 'phone',
+                    // 'group',
+                    // 'groups',
+                    // 'inheritAbilities',
+                    'enabled',
+                    'secret',
+                    'emailChangeDate',
+                    'newEmailSecret',
+                    // 'newEmailAddress',
+                    'cancelEmailSecret',
+                    'cancelEmailAddress',
+                    'recoverSecret',
+                    'recoverSecretDate',
+                    'salt',
+                    'password',
+                    'passwordTemp',
+                    // 'revokeTokenDate',
+                    'totpSecret',
+                ];
+            }
+            if (!isCurrentUser &&
+                (tilmeld.gatekeeper('tilmeld/switch') ||
+                    tilmeld.gatekeeper('system/admin'))) {
+                // Users with this ability can switch to other users.
+                this.$clientEnabledMethods.push('$switchUser');
             }
-            this.$privateData = [
-                'secret',
-                'newEmailSecret',
-                'cancelEmailAddress',
-                'cancelEmailSecret',
-                'emailChangeDate',
-                'recoverSecret',
-                'recoverSecretDate',
-                'password',
-                'salt',
-            ];
         }
-    }
-    $gatekeeper(ability) {
-        const tilmeld = this.$nymph.tilmeld;
-        if (ability == null) {
-            return tilmeld.User.current()?.$is(this) ?? false;
+        $updateGroupDataProtection() {
+            if (this.group != null && !this.group.$asleep()) {
+                this.group.$updateDataProtection();
+            }
+            for (let group of this.groups ?? []) {
+                if (!group.$asleep()) {
+                    group.$updateDataProtection();
+                }
+            }
         }
-        if (this.$gatekeeperCache == null) {
-            let abilities = this.$data.abilities ?? [];
-            if (this.$data.inheritAbilities) {
-                for (let curGroup of this.$data.groups ?? []) {
+        /**
+         * Check to see if a user has an ability.
+         *
+         * This function will check both user and group abilities, if the user is
+         * marked to inherit the abilities of its group.
+         *
+         * If `ability` is undefined, it will check to see if the user is currently
+         * logged in.
+         *
+         * If the user has the "system/admin" ability, this function will return true.
+         *
+         * @param ability The ability.
+         * @returns True or false.
+         */
+        async $gatekeeper(ability) {
+            await this.$wake();
+            const tilmeld = enforceTilmeld(this);
+            if (ability == null) {
+                return tilmeld.User.current()?.$is(this) ?? false;
+            }
+            // Check the cache to see if we've already checked this user.
+            if (this.$gatekeeperCache == null) {
+                this.$gatekeeperCache = await this.$getGatekeeperCache();
+            }
+            return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
+                !!this.abilities?.includes('system/admin'));
+        }
+        /**
+         * Build a gatekeeper cache object.
+         */
+        async $getGatekeeperCache() {
+            await this.$wake();
+            let abilities = this.abilities ?? [];
+            if (this.inheritAbilities) {
+                await Promise.all(this.groups?.map((e) => e.$wake()) || []);
+                for (let curGroup of this.groups ?? []) {
                     if (curGroup.enabled) {
                         abilities = abilities.concat(curGroup.abilities ?? []);
                     }
                 }
-                if (this.$data.group != null &&
-                    this.$data.group.cdate != null &&
-                    this.$data.group.enabled) {
-                    abilities = abilities.concat(this.$data.group.abilities ?? []);
+                await this.group?.$wake();
+                const group = this.group;
+                if (group != null && group.cdate != null && group.enabled) {
+                    abilities = abilities.concat(group.abilities ?? []);
                 }
             }
-            this.$gatekeeperCache = Object.fromEntries(abilities.map((ability) => [ability, true]));
-        }
-        return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-            !!this.$gatekeeperCache['system/admin']);
-    }
-    $clearCache() {
-        const ret = super.$clearCache();
-        this.$descendantGroups = undefined;
-        this.$gatekeeperCache = undefined;
-        return ret;
-    }
-    async $sendEmailVerification() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (this.guid == null) {
-            return false;
+            return Object.fromEntries(abilities.map((ability) => [ability, true]));
         }
-        let success = true;
-        const verifyUrl = `${tilmeld.config.appUrl.replace(/\/$/, () => '')}${tilmeld.config.setupPath}/verify`;
-        if (this.$data.secret != null) {
-            const link = `${verifyUrl}?action=verify&id=${encodeURIComponent(this.guid)}&secret=${encodeURIComponent(this.$data.secret)}`;
-            success =
-                success &&
-                    (await tilmeld.config.sendEmail(tilmeld, {
-                        template: 'VerifyEmail',
-                        message: {
-                            to: {
-                                name: this.$data.name ?? '',
-                                address: this.$data.email ?? '',
+        $clearCache() {
+            const ret = super.$clearCache();
+            this.$descendantGroups = undefined;
+            this.$gatekeeperCache = undefined;
+            return ret;
+        }
+        /**
+         * Send the user email verification/change/cancellation links.
+         *
+         * @returns True on success, false on failure.
+         */
+        async $sendEmailVerification() {
+            const tilmeld = enforceTilmeld(this);
+            if (this.guid == null) {
+                return false;
+            }
+            let success = true;
+            const verifyUrl = `${tilmeld.config.appUrl.replace(/\/$/, () => '')}${tilmeld.config.setupPath}/verify`;
+            if (this.secret != null) {
+                const link = `${verifyUrl}?action=verify&id=${encodeURIComponent(this.guid)}&secret=${encodeURIComponent(this.secret)}`;
+                success =
+                    success &&
+                        (await tilmeld.config.sendEmail(tilmeld, {
+                            template: 'VerifyEmail',
+                            message: {
+                                to: {
+                                    name: this.name ?? '',
+                                    address: this.email ?? '',
+                                },
                             },
-                        },
-                        locals: {
-                            verifyLink: link,
-                        },
-                    }, this));
-        }
-        if (this.$data.newEmailSecret != null) {
-            const link = `${verifyUrl}?action=verifychange&id=${encodeURIComponent(this.guid)}&secret=${encodeURIComponent(this.$data.newEmailSecret)}`;
-            success =
-                success &&
-                    (await tilmeld.config.sendEmail(tilmeld, {
-                        template: 'VerifyEmailChange',
-                        message: {
-                            to: {
-                                name: this.$data.name ?? '',
-                                address: this.$data.newEmailAddress ?? '',
+                            locals: { verifyLink: link },
+                        }, this));
+            }
+            if (this.newEmailSecret != null) {
+                const link = `${verifyUrl}?action=verifychange&id=${encodeURIComponent(this.guid)}&secret=${encodeURIComponent(this.newEmailSecret)}`;
+                success =
+                    success &&
+                        (await tilmeld.config.sendEmail(tilmeld, {
+                            template: 'VerifyEmailChange',
+                            message: {
+                                to: {
+                                    name: this.name ?? '',
+                                    address: this.newEmailAddress ?? '',
+                                },
                             },
-                        },
-                        locals: {
-                            verifyLink: link,
-                            oldEmail: this.$data.cancelEmailAddress,
-                            newEmail: this.$data.newEmailAddress,
-                        },
-                    }, this));
-        }
-        if (this.$data.cancelEmailSecret != null) {
-            const link = `${verifyUrl}?action=cancelchange&id=${encodeURIComponent(this.guid)}&secret=${encodeURIComponent(this.$data.cancelEmailSecret)}`;
-            success =
-                success &&
-                    (await tilmeld.config.sendEmail(tilmeld, {
-                        template: 'CancelEmailChange',
-                        message: {
-                            to: {
-                                name: this.$data.name ?? '',
-                                address: this.$data.cancelEmailAddress ?? '',
+                            locals: {
+                                verifyLink: link,
+                                oldEmail: this.cancelEmailAddress,
+                                newEmail: this.newEmailAddress,
                             },
-                        },
-                        locals: {
-                            cancelLink: link,
-                            oldEmail: this.$data.cancelEmailAddress,
-                            newEmail: this.$data.newEmailAddress ?? this.$data.email,
-                        },
-                    }, this));
-        }
-        return success;
-    }
-    $addGroup(group) {
-        if (this.$data.groups == null) {
-            this.$data.groups = [];
-        }
-        if (!group.$inArray(this.$data.groups)) {
-            this.$data.groups.push(group);
-            return this.$data.groups;
+                        }, this));
+            }
+            if (this.cancelEmailSecret != null) {
+                const link = `${verifyUrl}?action=cancelchange&id=${encodeURIComponent(this.guid)}&secret=${encodeURIComponent(this.cancelEmailSecret)}`;
+                success =
+                    success &&
+                        (await tilmeld.config.sendEmail(tilmeld, {
+                            template: 'CancelEmailChange',
+                            message: {
+                                to: {
+                                    name: this.name ?? '',
+                                    address: this.cancelEmailAddress ?? '',
+                                },
+                            },
+                            locals: {
+                                cancelLink: link,
+                                oldEmail: this.cancelEmailAddress,
+                                newEmail: this.newEmailAddress ?? this.email,
+                            },
+                        }, this));
+            }
+            return success;
+        }
+        /**
+         * Add the user to a (secondary) group.
+         *
+         * @param group The group.
+         * @returns True if the user is already in the group. The resulting array of groups if the user was not.
+         */
+        async $addGroup(group) {
+            await Promise.all(this.groups?.map((e) => e.$wake()) || []);
+            let groups = this.groups;
+            if (groups == null) {
+                groups = [];
+            }
+            if (!group.$inArray(groups)) {
+                groups.push(group);
+                this.groups = groups;
+                return groups;
+            }
+            return true;
         }
-        return true;
-    }
-    $checkPassword(password) {
-        const tilmeld = this.$nymph.tilmeld;
-        switch (tilmeld.config.pwMethod) {
-            case 'plain':
-                return this.$data.password === password;
-            case 'digest':
-                return this.$data.password === (0, sha256_1.default)(password).toString(enc_base64_1.default);
-            case 'salt':
-            default:
-                return (this.$data.password ===
-                    (0, sha256_1.default)(password + this.$data.salt).toString(enc_base64_1.default));
+        /**
+         * Check the given password against the user's.
+         *
+         * @param password The password in question.
+         * @returns True if the passwords match, otherwise false.
+         */
+        async $checkPassword(password) {
+            const tilmeld = enforceTilmeld(this);
+            switch (tilmeld.config.pwMethod) {
+                case 'plain':
+                    return crypto.timingSafeEqual(Buffer.from(this.password ?? ''), Buffer.from(password));
+                case 'digest':
+                    return crypto.timingSafeEqual(Buffer.from(this.password ?? '', 'base64'), crypto.createHash('sha256').update(password).digest());
+                case 'salt':
+                default:
+                    if (!this.password?.startsWith('scrypt$')) {
+                        // Check using the old hash method.
+                        return crypto.timingSafeEqual(Buffer.from(this.password ?? '', 'base64'), crypto
+                            .createHash('sha256')
+                            .update(password + this.salt)
+                            .digest());
+                    }
+                    // Check using the new hash method.
+                    const [alg, n, rr, pp, salt, keyB64] = (this.password ?? '').split('$');
+                    if (alg !== 'scrypt') {
+                        return false;
+                    }
+                    const expected = Buffer.from(keyB64, 'base64');
+                    const N = Number(n), r = Number(rr), p = Number(pp);
+                    const key = await new Promise((resolve, reject) => {
+                        crypto.scrypt(password, salt, expected.length, { N, r, p, maxmem: 256 * N * r }, (err, key) => {
+                            if (err) {
+                                return reject(err);
+                            }
+                            resolve(key);
+                        });
+                    });
+                    return crypto.timingSafeEqual(key, expected);
+            }
         }
-    }
-    $delGroup(group) {
-        if (this.$data.groups != null && group.$inArray(this.$data.groups)) {
-            const newGroups = [];
-            for (let curGroup of this.$data.groups) {
-                if (!group.$is(curGroup)) {
-                    newGroups.push(curGroup);
+        /**
+         * Remove the user from a (secondary) group.
+         *
+         * @param group The group.
+         * @returns True if the user wasn't in the group. The resulting array of groups if the user was.
+         */
+        async $delGroup(group) {
+            await Promise.all(this.groups?.map((e) => e.$wake()) || []);
+            let groups = this.groups || [];
+            if (this.groups != null && group.$inArray(groups)) {
+                const newGroups = [];
+                for (let curGroup of groups) {
+                    if (!group.$is(curGroup)) {
+                        newGroups.push(curGroup);
+                    }
                 }
+                this.groups = newGroups;
+                return this.groups;
             }
-            this.$data.groups = newGroups;
-            return this.$data.groups;
+            return true;
         }
-        return true;
-    }
-    $inGroup(group) {
-        if (typeof group === 'string') {
-            if (this.$data.group?.guid === group) {
+        /**
+         * Check whether the user is in a (primary or secondary) group.
+         *
+         * @param group The group, or the group's GUID.
+         * @returns True or false.
+         */
+        async $inGroup(group) {
+            if (typeof group === 'string') {
+                if (this.group?.guid === group) {
+                    return true;
+                }
+                for (let curGroup of this.groups ?? []) {
+                    if (curGroup.guid === group) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+            return group.$is(this.group) || group.$inArray(this.groups ?? []);
+        }
+        /**
+         * Check whether the user is a descendant of a group.
+         *
+         * @param group The group, or the group's GUID.
+         * @returns True or false.
+         */
+        async $isDescendant(group) {
+            // Check to see if the user is in a descendant group of the given group.
+            await this.group?.$wake();
+            if (this.group != null &&
+                this.group?.cdate != null &&
+                (await this.group?.$isDescendant(group))) {
                 return true;
             }
-            for (let curGroup of this.$data.groups ?? []) {
-                if (curGroup.guid === group) {
+            await Promise.all(this.groups?.map((e) => e.$wake()) || []);
+            for (let curGroup of this.groups ?? []) {
+                if (await curGroup.$isDescendant(group)) {
                     return true;
                 }
             }
             return false;
         }
-        return (group.$is(this.$data.group) || group.$inArray(this.$data.groups ?? []));
-    }
-    $isDescendant(group) {
-        if (this.$data.group?.cdate != null &&
-            this.$data.group.$isDescendant(group)) {
-            return true;
-        }
-        for (let curGroup of this.$data.groups ?? []) {
-            if (curGroup.$isDescendant(group)) {
-                return true;
+        /**
+         * A frontend accessible method to change the user's password.
+         *
+         * @param data The input data from the client.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $changePassword(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.gatekeeper()) {
+                return { result: false, message: 'You must be logged in.' };
+            }
+            this.$nymph.config.debugLog('tilmeld', `Password change request for "${this.username}".`);
+            if (!('newPassword' in data) || !data.newPassword.length) {
+                return { result: false, message: 'Please specify a password.' };
+            }
+            if (!(await this.$checkPassword(data.currentPassword ?? ''))) {
+                this.$nymph.config.debugLog('tilmeld', `Incorrect password for change request for "${this.username}".`);
+                return { result: false, message: 'Incorrect password.' };
+            }
+            this.passwordTemp = data.newPassword;
+            if (data.revokeCurrentTokens) {
+                this.revokeTokenDate = Date.now();
+            }
+            try {
+                await this.$save();
+                if (data.revokeCurrentTokens && this.$is(tilmeld.currentUser)) {
+                    await tilmeld.login(this, true);
+                }
+                return {
+                    result: true,
+                    message: this.$is(tilmeld.currentUser)
+                        ? 'Your password has been changed.'
+                        : "User's password has been changed.",
+                };
+            }
+            catch (e) {
+                return { result: false, message: "Couldn't save new password." };
             }
         }
-        return false;
-    }
-    async $changePassword(data) {
-        if (!('newPassword' in data) || !data.newPassword.length) {
-            return { result: false, message: 'Please specify a password.' };
-        }
-        if (!this.$checkPassword(data.currentPassword ?? '')) {
-            return { result: false, message: 'Incorrect password.' };
-        }
-        this.$data.passwordTemp = data.newPassword;
-        if (await this.$save()) {
-            return { result: true, message: 'Your password has been changed.' };
-        }
-        else {
-            return { result: false, message: "Couldn't save new password." };
+        /**
+         * Change the user's password.
+         *
+         * @param password The new password.
+         * @returns The resulting password or hash which is stored in the entity.
+         */
+        async $password(password) {
+            const tilmeld = enforceTilmeld(this);
+            switch (tilmeld.config.pwMethod) {
+                case 'plain':
+                    delete this.salt;
+                    this.password = password;
+                    break;
+                case 'digest':
+                    delete this.salt;
+                    this.password = crypto
+                        .createHash('sha256')
+                        .update(password)
+                        .digest('base64');
+                    break;
+                case 'salt':
+                default:
+                    this.salt = nanoid();
+                    const N = 131072;
+                    const r = 8;
+                    const p = 1;
+                    const KEYLEN = 64;
+                    const opts = { N, r, p, maxmem: 256 * N * r };
+                    const key = await new Promise((resolve, reject) => {
+                        crypto.scrypt(password, this.salt ?? '', KEYLEN, opts, (err, key) => {
+                            if (err) {
+                                return reject(err);
+                            }
+                            resolve(key);
+                        });
+                    });
+                    this.password = `scrypt$${N}$${r}$${p}$${this.salt}$${key.toString('base64')}`;
+                    break;
+            }
+            return this.password;
+        }
+        /**
+         * A frontend accessible method to revoke all currently issued tokens.
+         *
+         * @param data The input data from the client.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $revokeCurrentTokens(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (!tilmeld.gatekeeper()) {
+                return { result: false, message: 'You must be logged in.' };
+            }
+            if (this.guid == null) {
+                return { result: false, message: 'This user has not been saved.' };
+            }
+            // Work on real data.
+            await this.$refresh();
+            let [_username, domain] = tilmeld.config.domainSupport
+                ? splitn(this.$originalUsername ?? this.username ?? '', '@', 2)
+                : [this.$originalUsername ?? this.username, null];
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+            }
+            const isAdmin = tilmeld.gatekeeper('tilmeld/admin');
+            const isDomainUser = tilmeld.config.domainSupport &&
+                !this.$is(tilmeld.currentUser) &&
+                domain &&
+                tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`);
+            if (!isAdmin &&
+                !isDomainUser &&
+                (data == null || !(await this.$checkPassword(data.password ?? '')))) {
+                return { result: false, message: 'Incorrect password.' };
+            }
+            this.revokeTokenDate = Date.now();
+            try {
+                await this.$save();
+                if (this.$is(tilmeld.currentUser)) {
+                    await tilmeld.login(this, true);
+                    return {
+                        result: true,
+                        message: 'You have logged out of all other sessions.',
+                    };
+                }
+                else {
+                    return {
+                        result: true,
+                        message: 'The user has been logged out of all sessions.',
+                    };
+                }
+            }
+            catch (e) {
+                return { result: false, message: "Couldn't save revocation date." };
+            }
         }
-    }
-    $password(password) {
-        const tilmeld = this.$nymph.tilmeld;
-        switch (tilmeld.config.pwMethod) {
-            case 'plain':
-                delete this.$data.salt;
-                this.$data.password = password;
-                break;
-            case 'digest':
-                delete this.$data.salt;
-                this.$data.password = (0, sha256_1.default)(password).toString(enc_base64_1.default);
-                break;
-            case 'salt':
-            default:
-                this.$data.salt = (0, guid_1.nanoid)();
-                this.$data.password = (0, sha256_1.default)(password + this.$data.salt).toString(enc_base64_1.default);
-                break;
+        $hasTOTPSecret() {
+            return this.totpSecret != null;
+        }
+        /**
+         * Check the given code against the user's TOTP secret.
+         *
+         * @param code The code in question.
+         * @returns True if the code is valid, otherwise false.
+         */
+        $checkTOTPCode(code) {
+            if (this.totpSecret == null) {
+                return false;
+            }
+            const tilmeld = enforceTilmeld(this);
+            const totp = new TOTP({
+                issuer: tilmeld.config.appName,
+                label: this.username,
+                algorithm: 'SHA1',
+                digits: 6,
+                period: 30,
+                secret: this.totpSecret,
+            });
+            return totp.validate({ token: code, window: 2 }) != null;
+        }
+        /**
+         * A frontend accessible method to generate a new TOTP secret.
+         *
+         * @returns An object with 'uri', 'qrcode', and 'secret'.
+         */
+        async $getNewTOTPSecret() {
+            const tilmeld = enforceTilmeld(this);
+            if (this.totpSecret != null) {
+                throw new BadDataError('You already have a 2FA secret.');
+            }
+            const secret = new Secret();
+            const totp = new TOTP({
+                issuer: tilmeld.config.appName,
+                label: this.username,
+                algorithm: 'SHA1',
+                digits: 6,
+                period: 30,
+                secret,
+            });
+            const uri = totp.toString();
+            const qrcode = await toDataURL(uri);
+            return { uri, qrcode, secret: secret.base32 };
+        }
+        /**
+         * A frontend accessible method to save a TOTP secret into the user's account.
+         *
+         * @param data The input data from the client.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $saveTOTPSecret(data) {
+            if (!(await this.$checkPassword(data.password ?? ''))) {
+                return { result: false, message: 'Incorrect password.' };
+            }
+            if (this.totpSecret != null) {
+                return { result: false, message: 'You already have a 2FA secret.' };
+            }
+            if (data.secret == null ||
+                typeof data.secret !== 'string' ||
+                data.secret === '') {
+                return { result: false, message: '2FA secret is invalid.' };
+            }
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return { result: false, message: '2FA code is invalid.' };
+            }
+            const tilmeld = enforceTilmeld(this);
+            const totp = new TOTP({
+                issuer: tilmeld.config.appName,
+                label: this.username,
+                algorithm: 'SHA1',
+                digits: 6,
+                period: 30,
+                secret: data.secret,
+            });
+            if (totp.validate({ token: data.code, window: 2 }) == null) {
+                return { result: false, message: '2FA code is incorrect.' };
+            }
+            this.totpSecret = data.secret;
+            try {
+                await this.$save();
+                return { result: true, message: 'Your two factor secret is now set.' };
+            }
+            catch (e) {
+                return { result: false, message: "Couldn't save two factor secret." };
+            }
         }
-        return this.$data.password;
-    }
-    async $checkUsername() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.config.emailUsernames) {
-            if (this.$data.username == null || !this.$data.username.length) {
-                return { result: false, message: 'Please specify a username.' };
-            }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.username.length > tilmeld.config.maxUsernameLength) {
+        /**
+         * A frontend accessible method to remove the TOTP secret from the user's
+         * account.
+         *
+         * @param data The input data from the client.
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $removeTOTPSecret(data) {
+            const tilmeld = enforceTilmeld(this);
+            if (data) {
+                if (!(await this.$checkPassword(data.password ?? ''))) {
+                    return { result: false, message: 'Incorrect password.' };
+                }
+                if (data.code == null ||
+                    typeof data.code !== 'string' ||
+                    data.code.length !== 6) {
+                    return { result: false, message: '2FA code is invalid.' };
+                }
+                if (this.totpSecret == null) {
+                    return { result: false, message: "You don't have a 2FA secret." };
+                }
+                const totp = new TOTP({
+                    issuer: tilmeld.config.appName,
+                    label: this.username,
+                    algorithm: 'SHA1',
+                    digits: 6,
+                    period: 30,
+                    secret: this.totpSecret,
+                });
+                if (totp.validate({ token: data.code, window: 2 }) == null) {
+                    return { result: false, message: '2FA code is incorrect.' };
+                }
+            }
+            else if (!tilmeld.gatekeeper('tilmeld/admin')) {
                 return {
                     result: false,
-                    message: 'Usernames must not exceed ' +
-                        tilmeld.config.maxUsernameLength +
-                        ' characters.',
+                    message: 'You must provide your password and 2FA code.',
                 };
             }
-            if ((0, lodash_1.difference)(this.$data.username.split(''), tilmeld.config.validChars.split('')).length) {
+            delete this.totpSecret;
+            try {
+                await this.$save();
+                return { result: true, message: 'Two factor secret has been removed.' };
+            }
+            catch (e) {
+                return { result: false, message: "Couldn't remove two factor secret." };
+            }
+        }
+        /**
+         * Check that a username is valid.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkUsername() {
+            const tilmeld = enforceTilmeld(this);
+            this.$nymph.config.debugInfo('tilmeld', `Username check "${this.username}".`);
+            if (!tilmeld.config.emailUsernames) {
+                let [username, domain] = tilmeld.config.domainSupport
+                    ? splitn(this.username ?? '', '@', 2)
+                    : [this.username, null];
+                // Lowercase the domain part.
+                if (domain) {
+                    domain = domain.toLowerCase();
+                    this.username = `${username}@${domain}`;
+                }
+                if (this.username == null ||
+                    !this.username.length ||
+                    username == null ||
+                    !username.length) {
+                    return { result: false, message: 'Please specify a username.' };
+                }
+                if (username.length < tilmeld.config.minUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Usernames must be at least ' +
+                            tilmeld.config.minUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (username.length > tilmeld.config.maxUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Usernames must not exceed ' +
+                            tilmeld.config.maxUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (difference(username.split(''), tilmeld.config.validChars.split(''))
+                    .length) {
+                    return { result: false, message: tilmeld.config.validCharsNotice };
+                }
+                if (!tilmeld.config.validRegex.test(username)) {
+                    return { result: false, message: tilmeld.config.validRegexNotice };
+                }
+                if (domain != null) {
+                    if (!tilmeld.config.validDomainRegex.test(domain)) {
+                        return {
+                            result: false,
+                            message: tilmeld.config.validDomainRegexNotice,
+                        };
+                    }
+                    if (!this.$skipAcWhenSaving &&
+                        !this.$is(tilmeld.currentUser) &&
+                        !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                        return {
+                            result: false,
+                            message: "You don't have the authority to manage users on this domain.",
+                        };
+                    }
+                }
+                const selector = {
+                    type: '&',
+                    ilike: [
+                        'username',
+                        this.username.replace(/([\\%_])/g, (s) => `\\${s}`),
+                    ],
+                };
+                if (this.guid != null) {
+                    selector['!guid'] = this.guid;
+                }
+                const test = await this.$nymph.getEntity({ class: tilmeld.User, skipAc: true }, selector);
+                if (test != null) {
+                    return { result: false, message: 'That username is taken.' };
+                }
+                for (let callback of this.constructor
+                    .checkUsernameCallbacks) {
+                    if (callback) {
+                        const result = await callback(this, {
+                            username: this.username,
+                        });
+                        if (!result.result) {
+                            return { message: 'Username is not available.', ...result };
+                        }
+                    }
+                }
+                return {
+                    result: true,
+                    message: this.guid != null ? 'Username is valid.' : 'Username is available!',
+                };
+            }
+            else {
+                this.email = this.username;
+                if (this.username == null || !this.username.length) {
+                    return { result: false, message: 'Please specify an email.' };
+                }
+                if (this.username.length < tilmeld.config.minUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Emails must be at least ' +
+                            tilmeld.config.minUsernameLength +
+                            ' characters.',
+                    };
+                }
+                if (this.username.length > tilmeld.config.maxUsernameLength) {
+                    return {
+                        result: false,
+                        message: 'Emails must not exceed ' +
+                            tilmeld.config.maxUsernameLength +
+                            ' characters.',
+                    };
+                }
+                return await this.$checkEmail();
+            }
+        }
+        /**
+         * Check that an email is unique.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkEmail() {
+            const tilmeld = enforceTilmeld(this);
+            this.$nymph.config.debugInfo('tilmeld', `Email check "${this.email}".`);
+            if (this.email == null || !this.email.length) {
+                if (tilmeld.config.verifyEmail) {
+                    return { result: false, message: 'Please specify an email.' };
+                }
+                else {
+                    return { result: true, message: '' };
+                }
+            }
+            if (!tilmeld.config.validEmailRegex.test(this.email)) {
+                return { result: false, message: tilmeld.config.validEmailRegexNotice };
+            }
+            const selector = {
+                type: '&',
+                ilike: ['email', this.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
+            };
+            if (this.guid != null) {
+                selector['!guid'] = this.guid;
+            }
+            const test = await this.$nymph.getEntity({ class: tilmeld.User, skipAc: true }, selector);
+            if (test != null) {
                 return {
                     result: false,
-                    message: tilmeld.config.validCharsNotice,
+                    message: 'That email address is already registered.',
                 };
             }
-            if (!tilmeld.config.validRegex.test(this.$data.username)) {
+            return {
+                result: true,
+                message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
+            };
+        }
+        /**
+         * Check that a phone number is unique.
+         *
+         * @returns An object with a boolean 'result' entry and a 'message' entry.
+         */
+        async $checkPhone() {
+            const tilmeld = enforceTilmeld(this);
+            this.$nymph.config.debugInfo('tilmeld', `Phone check "${this.phone}".`);
+            if (this.phone == null || !this.phone.length) {
+                return { result: false, message: 'Please specify a phone number.' };
+            }
+            const stripToDigits = this.phone.replace(/\D/g, () => '');
+            if (!/\d{10}/.test(stripToDigits)) {
                 return {
                     result: false,
-                    message: tilmeld.config.validRegexNotice,
+                    message: 'Phone must contain at least 10 digits, but formatting does not matter.',
                 };
             }
             const selector = {
                 type: '&',
-                ilike: [
-                    'username',
-                    this.$data.username.replace(/([\\%_])/g, (s) => `\\${s}`),
-                ],
+                equal: ['phone', stripToDigits],
             };
             if (this.guid != null) {
                 selector['!guid'] = this.guid;
             }
             const test = await this.$nymph.getEntity({ class: tilmeld.User, skipAc: true }, selector);
             if (test != null) {
-                return { result: false, message: 'That username is taken.' };
+                return { result: false, message: 'Phone number is in use.' };
             }
             return {
                 result: true,
-                message: this.guid != null ? 'Username is valid.' : 'Username is available!',
+                message: this.guid != null ? 'Phone number is valid.' : 'Phone number is valid!',
             };
         }
-        else {
-            this.$data.email = this.$data.username;
-            if (this.$data.username == null || !this.$data.username.length) {
-                return { result: false, message: 'Please specify an email.' };
+        async $register(data) {
+            let tilmeld = enforceTilmeld(this);
+            if (!tilmeld.config.allowRegistration) {
+                return {
+                    result: false,
+                    loggedin: false,
+                    message: 'Registration is not allowed.',
+                };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.username.length > tilmeld.config.maxUsernameLength) {
+            if (this.guid != null) {
                 return {
                     result: false,
-                    message: 'Emails must not exceed ' +
-                        tilmeld.config.maxUsernameLength +
-                        ' characters.',
+                    loggedin: false,
+                    message: 'This is already a registered user.',
                 };
             }
-            return await this.$checkEmail();
-        }
-    }
-    async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (this.$data.email == null || !this.$data.email.length) {
-            if (tilmeld.config.verifyEmail) {
-                return { result: false, message: 'Please specify an email.' };
+            if (!('password' in data) || !data.password.length) {
+                return {
+                    result: false,
+                    loggedin: false,
+                    message: 'Password is a required field.',
+                };
             }
-            else {
-                return { result: true, message: '' };
+            const unCheck = await this.$checkUsername();
+            if (!unCheck.result) {
+                return { ...unCheck, loggedin: false };
             }
-        }
-        if (!tilmeld.config.validEmailRegex.test(this.$data.email)) {
-            return {
-                result: false,
-                message: tilmeld.config.validEmailRegexNotice,
-            };
-        }
-        const selector = {
-            type: '&',
-            ilike: ['email', this.$data.email.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        };
-        if (this.guid != null) {
-            selector['!guid'] = this.guid;
-        }
-        const test = await this.$nymph.getEntity({ class: tilmeld.User, skipAc: true }, selector);
-        if (test != null) {
-            return {
-                result: false,
-                message: 'That email address is already registered.',
-            };
-        }
-        return {
-            result: true,
-            message: this.guid != null ? 'Email is valid.' : 'Email address is valid!',
-        };
-    }
-    async $checkPhone() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (this.$data.phone == null || !this.$data.phone.length) {
-            return { result: false, message: 'Please specify a phone number.' };
-        }
-        const stripToDigits = this.$data.phone.replace(/\D/g, () => '');
-        if (!/\d{10}/.test(stripToDigits)) {
-            return {
-                result: false,
-                message: 'Phone must contain at least 10 digits, but formatting does not matter.',
-            };
-        }
-        const selector = {
-            type: '&',
-            equal: ['phone', stripToDigits],
-        };
-        if (this.guid != null) {
-            selector['!guid'] = this.guid;
-        }
-        const test = await this.$nymph.getEntity({ class: tilmeld.User, skipAc: true }, selector);
-        if (test != null) {
-            return { result: false, message: 'Phone number is in use.' };
-        }
-        return {
-            result: true,
-            message: this.guid != null ? 'Phone number is valid.' : 'Phone number is valid!',
-        };
-    }
-    async $register(data) {
-        let tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.config.allowRegistration) {
-            return {
-                result: false,
-                loggedin: false,
-                message: 'Registration is not allowed.',
-            };
-        }
-        if (this.guid != null) {
-            return {
-                result: false,
-                loggedin: false,
-                message: 'This is already a registered user.',
-            };
-        }
-        try {
-            for (let callback of this.constructor
-                .beforeRegisterCallbacks) {
-                if (callback) {
-                    await callback(this, data);
+            await this.$password(data.password);
+            if (tilmeld.config.regFields.includes('name')) {
+                this.name =
+                    this.nameFirst +
+                        (this.nameMiddle == null ? '' : ' ' + this.nameMiddle) +
+                        (this.nameLast == null ? '' : ' ' + this.nameLast);
+                if (this.name === '') {
+                    this.name = this.username;
                 }
             }
-        }
-        catch (e) {
-            return {
-                result: false,
-                loggedin: false,
-                message: e.message,
-            };
-        }
-        if (!('password' in data) || !data.password.length) {
-            return {
-                result: false,
-                loggedin: false,
-                message: 'Password is a required field.',
-            };
-        }
-        const unCheck = await this.$checkUsername();
-        if (!unCheck.result) {
-            return { ...unCheck, loggedin: false };
-        }
-        this.$password(data.password);
-        if (tilmeld.config.regFields.indexOf('name') !== -1) {
-            this.$data.name =
-                this.$data.nameFirst +
-                    (this.$data.nameMiddle == null ? '' : ' ' + this.$data.nameMiddle) +
-                    (this.$data.nameLast == null ? '' : ' ' + this.$data.nameLast);
-            if (this.$data.name === '') {
-                this.$data.name = this.$data.username;
+            if (tilmeld.config.emailUsernames) {
+                this.email = this.username;
             }
-        }
-        if (tilmeld.config.emailUsernames) {
-            this.$data.email = this.$data.username;
-        }
-        const transaction = 'tilmeld-register-' + (0, guid_1.nanoid)();
-        const nymph = this.$nymph;
-        const tnymph = await this.$nymph.startTransaction(transaction);
-        this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        try {
-            let generatedPrimaryGroup = null;
-            if (tilmeld.config.generatePrimary) {
-                generatedPrimaryGroup = await tilmeld.Group.factory();
-                generatedPrimaryGroup.groupname = this.$data.username;
-                generatedPrimaryGroup.avatar = this.$data.avatar;
-                generatedPrimaryGroup.name = this.$data.name;
-                generatedPrimaryGroup.email = this.$data.email;
-                const parent = await tnymph.getEntity({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['defaultPrimary', true],
+            try {
+                const result = await transaction(this.$nymph, 'tilmeld-register-' + nanoid(), async (nymph) => {
+                    this.$setNymph(nymph);
+                    const tilmeld = enforceTilmeld(this);
+                    let message = '';
+                    let loggedin = false;
+                    for (let callback of this.constructor
+                        .beforeRegisterCallbacks) {
+                        if (callback) {
+                            await callback(this, data);
+                        }
+                    }
+                    if (tilmeld.config.userFields.includes('email') &&
+                        tilmeld.config.verifyEmail) {
+                        // The user will be enabled after verifying their e-mail address.
+                        if (!tilmeld.config.unverifiedAccess) {
+                            this.enabled = false;
+                        }
+                    }
+                    else {
+                        this.enabled = true;
+                    }
+                    // If createAdmin is true and there are no other users, grant
+                    // "system/admin".
+                    let madeAdmin = false;
+                    if (tilmeld.config.createAdmin) {
+                        const otherUsers = await this.$nymph.getEntities({
+                            class: tilmeld.User,
+                            skipAc: true,
+                            limit: 1,
+                            return: 'guid',
+                        });
+                        // Make sure it's not just null, cause that means an error.
+                        if (otherUsers == null) {
+                            throw new Error('An error occurred.');
+                        }
+                        if (!otherUsers.length) {
+                            this.$grant('system/admin');
+                            this.$grant('system/autogranted');
+                            this.enabled = true;
+                            madeAdmin = true;
+                        }
+                    }
+                    this.$nymph.config.debugLog('tilmeld', `Registering new user "${this.username}".`);
+                    await this.$saveSkipAC();
+                    // Finish up.
+                    if (tilmeld.config.verifyEmail &&
+                        !tilmeld.config.unverifiedAccess &&
+                        !madeAdmin &&
+                        tilmeld.config.userFields.includes('email')) {
+                        message +=
+                            `Almost there. An email has been sent to ${this.email} ` +
+                                'with a verification link for you to finish registration.';
+                    }
+                    else if (tilmeld.config.verifyEmail &&
+                        tilmeld.config.unverifiedAccess &&
+                        !madeAdmin &&
+                        tilmeld.config.userFields.includes('email')) {
+                        if (!(await tilmeld.login(this, true))) {
+                            throw new Error('An error occurred trying to log you in.');
+                        }
+                        message +=
+                            "You're now logged in! An email has been sent to " +
+                                `${this.email} with a verification link for you to finish ` +
+                                'registration.';
+                        loggedin = true;
+                    }
+                    else {
+                        if (!(await tilmeld.login(this, true))) {
+                            throw new Error('An error occurred trying to log you in.');
+                        }
+                        message += "You're now registered and logged in!";
+                        loggedin = true;
+                    }
+                    for (let callback of this.constructor
+                        .afterRegisterCallbacks) {
+                        if (callback) {
+                            await callback(this, { loggedin, message });
+                        }
+                    }
+                    return { result: true, loggedin, message };
+                }, async (nymph) => {
+                    this.$setNymph(nymph);
                 });
-                if (parent != null) {
-                    generatedPrimaryGroup.parent = parent;
+                // Send the new user registered email.
+                if (tilmeld.config.userRegisteredRecipient != null) {
+                    try {
+                        if (!(await tilmeld.config.sendEmail(tilmeld, {
+                            template: 'UserRegistered',
+                            message: { to: tilmeld.config.userRegisteredRecipient },
+                            locals: {
+                                userUsername: this.username,
+                                userName: this.name,
+                                userFirstName: this.nameFirst,
+                                userLastName: this.nameLast,
+                                userEmail: this.email,
+                                userPhone: this.phone,
+                            },
+                        }, this))) {
+                            throw new Error('Failed to send.');
+                        }
+                    }
+                    catch (e) {
+                        this.$nymph.config.debugError('tilmeld', `Couldn't send new user registered email for "${this.username}": ${e.message}`);
+                    }
                 }
-                if (!(await generatedPrimaryGroup.$saveSkipAC())) {
-                    await tnymph.rollback(transaction);
-                    this.$nymph = nymph;
-                    return {
-                        result: false,
-                        loggedin: false,
-                        message: 'Error creating primary group for user.',
-                    };
+                if (result.loggedin) {
+                    try {
+                        await this.$nymph.tilmeld?.fillSession(this);
+                    }
+                    catch (e) {
+                        return {
+                            result: true,
+                            loggedin: false,
+                            message: `You are registered, but an error occurred logging you in: ${e.message}`,
+                        };
+                    }
                 }
-                this.$data.group = generatedPrimaryGroup;
+                return result;
             }
-            else {
-                const group = await tnymph.getEntity({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['defaultPrimary', true],
-                });
-                if (group != null) {
-                    this.$data.group = group;
+            catch (e) {
+                return { result: false, loggedin: false, message: e.message };
+            }
+        }
+        async $save() {
+            let tilmeld = enforceTilmeld(this);
+            if (this.username == null || !this.username.trim().length) {
+                throw new BadUsernameError('Username must not be empty.');
+            }
+            if (!this.$skipAcWhenSaving &&
+                tilmeld.gatekeeper('tilmeld/admin') &&
+                !tilmeld.gatekeeper('system/admin') &&
+                this.abilities?.includes('system/admin')) {
+                throw new AccessControlError("You don't have the authority to modify system admins.");
+            }
+            // Lowercase the domain part.
+            if (tilmeld.config.domainSupport) {
+                const [username, domain] = splitn(this.username ?? '', '@', 2);
+                if (domain) {
+                    this.username = `${username}@${domain.toLowerCase()}`;
                 }
             }
-            if (tilmeld.config.verifyEmail && tilmeld.config.unverifiedAccess) {
-                this.$data.groups = await tnymph.getEntities({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['unverifiedSecondary', true],
-                });
+            if (tilmeld.config.domainSupport) {
+                const [_username, domain] = splitn(this.username ?? '', '@', 2);
+                const [_originalUsername, originalDomain] = splitn(this.$originalUsername ?? '', '@', 2);
+                if (this.guid != null &&
+                    ((originalDomain == null && domain != null) ||
+                        (domain == null && originalDomain != null))) {
+                    throw new AccessControlError("Users can't switch to or from having a domain once created.");
+                }
+                if (!this.$skipAcWhenSaving &&
+                    !tilmeld.gatekeeper('tilmeld/admin') &&
+                    !tilmeld.gatekeeper('system/admin')) {
+                    if (domain != null &&
+                        !this.$is(tilmeld.currentUser) &&
+                        !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                        throw new AccessControlError("You don't have the authority to modify users on this domain.");
+                    }
+                    if (originalDomain != null &&
+                        originalDomain !== domain &&
+                        (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+                            !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
+                        throw new AccessControlError("You don't have the authority to modify users on this domain.");
+                    }
+                }
             }
-            else {
-                this.$data.groups = await tnymph.getEntities({ class: tilmeld.Group }, {
-                    type: '&',
-                    equal: ['defaultSecondary', true],
-                });
+            let sendVerification = false;
+            // Formatting.
+            this.username = this.username.trim();
+            if (tilmeld.config.emailUsernames) {
+                this.email = this.username;
+            }
+            this.nameFirst = (this.nameFirst ?? '').trim();
+            this.nameMiddle = (this.nameMiddle ?? '').trim();
+            this.nameLast = (this.nameLast ?? '').trim();
+            this.phone = (this.phone ?? '').trim();
+            this.name =
+                this.nameFirst +
+                    (this.nameMiddle ? ' ' + this.nameMiddle : '') +
+                    (this.nameLast ? ' ' + this.nameLast : '');
+            this.enabled = !!this.enabled;
+            // Clear empty values.
+            if (this.nameFirst === '' || !tilmeld.config.userFields.includes('name')) {
+                delete this.nameFirst;
+            }
+            if (this.nameMiddle === '' || !tilmeld.config.userFields.includes('name')) {
+                delete this.nameMiddle;
+            }
+            if (this.nameLast === '' || !tilmeld.config.userFields.includes('name')) {
+                delete this.nameLast;
+            }
+            if (this.name === '' || !tilmeld.config.userFields.includes('name')) {
+                delete this.name;
+            }
+            if (this.email === '' || !tilmeld.config.userFields.includes('email')) {
+                delete this.email;
+            }
+            if (this.avatar === '') {
+                delete this.avatar;
+            }
+            if (this.phone === '' || !tilmeld.config.userFields.includes('phone')) {
+                delete this.phone;
+            }
+            if (this.secret === '' || !tilmeld.config.userFields.includes('email')) {
+                delete this.secret;
+            }
+            if (this.emailChangeDate === 0 ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.emailChangeDate;
+            }
+            if (this.newEmailSecret === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.newEmailSecret;
+            }
+            if (this.newEmailAddress === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.newEmailAddress;
+            }
+            if (this.cancelEmailSecret === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.cancelEmailSecret;
+            }
+            if (this.cancelEmailAddress === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.cancelEmailAddress;
+            }
+            if (this.recoverSecret === '' ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.recoverSecret;
+            }
+            if (this.recoverSecretDate === 0 ||
+                !tilmeld.config.userFields.includes('email')) {
+                delete this.recoverSecretDate;
+            }
+            if (this.password === '') {
+                delete this.password;
+            }
+            if (this.passwordTemp === '') {
+                delete this.passwordTemp;
+            }
+            if (this.inheritAbilities === false) {
+                delete this.inheritAbilities;
+            }
+            // Verification.
+            const unCheck = await this.$checkUsername();
+            if (!unCheck.result) {
+                throw new BadUsernameError(unCheck.message);
             }
-            if (tilmeld.config.verifyEmail) {
-                if (!tilmeld.config.unverifiedAccess) {
-                    this.$data.enabled = false;
+            if (!tilmeld.config.emailUsernames &&
+                tilmeld.config.userFields.includes('email')) {
+                const emCheck = await this.$checkEmail();
+                if (!emCheck.result) {
+                    throw new BadEmailError(emCheck.message);
                 }
             }
-            else {
-                this.$data.enabled = true;
-            }
-            let madeAdmin = false;
-            if (tilmeld.config.createAdmin) {
-                const otherUsers = await tnymph.getEntities({
-                    class: tilmeld.User,
-                    skipAc: true,
-                    limit: 1,
-                    return: 'guid',
-                });
-                if (!otherUsers.length) {
-                    this.$grant('system/admin');
-                    this.$data.enabled = true;
-                    madeAdmin = true;
+            // Email changes.
+            if (!tilmeld.gatekeeper('tilmeld/admin') &&
+                tilmeld.config.userFields.includes('email')) {
+                // The user isn't an admin, so email address changes should contain some
+                // security measures.
+                if (tilmeld.config.verifyEmail) {
+                    // The user needs to verify this new email address.
+                    if (this.guid == null) {
+                        // If this is the first user, they'll be made an admin, so they don't
+                        // need to verify.
+                        if (!this.abilities?.includes('system/admin')) {
+                            this.secret = nanoid();
+                            sendVerification = true;
+                        }
+                    }
+                    else if (this.$originalEmail != null &&
+                        this.$originalEmail !== this.email) {
+                        // The user already has an old email address.
+                        if (tilmeld.config.emailRateLimit !== '' &&
+                            this.emailChangeDate != null &&
+                            this.emailChangeDate >=
+                                (strtotime('-' + tilmeld.config.emailRateLimit) || 0) * 1000) {
+                            throw new EmailChangeRateLimitExceededError('You already changed your email address recently. Please wait until ' +
+                                new Date((strtotime('+' + tilmeld.config.emailRateLimit, Math.floor(this.emailChangeDate / 1000)) || 0) * 1000).toString() +
+                                ' to change your email address again.');
+                        }
+                        else {
+                            if (this.newEmailSecret == null &&
+                                tilmeld.config.emailRateLimit !== '' &&
+                                // Make sure the user has at least the rate limit time to cancel
+                                // an email change.
+                                (this.emailChangeDate == null ||
+                                    this.emailChangeDate <
+                                        (strtotime('-' + tilmeld.config.emailRateLimit) || 0) * 1000)) {
+                                // Save the old email in case the cancel change link is clicked.
+                                this.cancelEmailAddress = this.$originalEmail;
+                                this.cancelEmailSecret = nanoid();
+                                this.emailChangeDate = Date.now();
+                            }
+                            // Save the new address and reset to the old one (until they verify
+                            // it).
+                            this.newEmailAddress = this.email;
+                            this.email = this.$originalEmail;
+                            if (tilmeld.config.emailUsernames) {
+                                this.username = this.email;
+                            }
+                            this.newEmailSecret = nanoid();
+                            sendVerification = true;
+                        }
+                    }
+                }
+                else if (this.guid != null &&
+                    this.$originalEmail != null &&
+                    this.$originalEmail !== this.email &&
+                    // Make sure the user has at least the rate limit time to cancel an
+                    // email change.
+                    (this.emailChangeDate == null ||
+                        this.emailChangeDate <
+                            (strtotime('-' + tilmeld.config.emailRateLimit) || 0) * 1000)) {
+                    // The user doesn't need to verify their new email address, but should
+                    // be able to cancel the email change from their old address.
+                    this.cancelEmailAddress = this.$originalEmail;
+                    this.cancelEmailSecret = nanoid();
+                    this.emailChangeDate = Date.now();
+                    sendVerification = true;
                 }
             }
-            if (await this.$saveSkipAC()) {
-                if (tilmeld.config.userRegisteredRecipient != null) {
-                    await tilmeld.config.sendEmail(tilmeld, {
-                        template: 'UserRegistered',
-                        message: {
-                            to: tilmeld.config.userRegisteredRecipient,
-                        },
-                        locals: {
-                            userUsername: this.$data.username,
-                            userName: this.$data.name,
-                            userFirstName: this.$data.nameFirst,
-                            userLastName: this.$data.nameLast,
-                            userEmail: this.$data.email,
-                            userPhone: this.$data.phone,
-                        },
-                    }, this);
-                }
-                let message = '';
-                let loggedin = false;
-                if (generatedPrimaryGroup != null) {
-                    generatedPrimaryGroup.user = this;
-                    if (!(await generatedPrimaryGroup.$saveSkipAC())) {
-                        await tnymph.rollback(transaction);
-                        this.$nymph = nymph;
-                        return {
-                            result: false,
-                            loggedin: false,
-                            message: 'Your primary group could not be assigned. Please try again later.',
-                        };
+            if (this.passwordTemp != null) {
+                await this.$password(this.passwordTemp);
+            }
+            delete this.passwordTemp;
+            if (this.password == null) {
+                throw new BadDataError('A password is required.');
+            }
+            let preGuid = this.guid;
+            let preCdate = this.cdate;
+            let preMdate = this.mdate;
+            return await transaction(this.$nymph, 'tilmeld-save-user-' + (this.guid || nanoid()), async (nymph) => {
+                this.$setNymph(nymph);
+                const tilmeld = enforceTilmeld(this);
+                const Group = this.$nymph.getEntityClass(GroupClass);
+                let group = this.group;
+                if (group != null) {
+                    // Make sure to get fresh group data.
+                    if (group.$asleep()) {
+                        await group.$wake();
+                    }
+                    else {
+                        if (!(await group.$refresh())) {
+                            throw new Error("Couldn't retrieve primary group info.");
+                        }
                     }
                 }
-                if (tilmeld.config.verifyEmail &&
-                    !tilmeld.config.unverifiedAccess &&
-                    !madeAdmin) {
-                    message +=
-                        `Almost there. An email has been sent to ${this.$data.email} ` +
-                            'with a verification link for you to finish registration.';
-                }
-                else if (tilmeld.config.verifyEmail &&
-                    tilmeld.config.unverifiedAccess &&
-                    !madeAdmin) {
-                    if (!tilmeld.login(this, true)) {
-                        throw new Error('An error occurred trying to log you in.');
+                if (group == null && this.guid == null) {
+                    if (tilmeld.config.generatePrimary) {
+                        // Generate a new primary group for the user.
+                        group = await Group.factory();
+                        group.user = this;
+                        const parent = await this.$nymph.getEntity({ class: Group }, { type: '&', equal: ['defaultPrimary', true] });
+                        if (parent != null) {
+                            group.parent = parent;
+                        }
+                    }
+                    else {
+                        // Add the default primary.
+                        const group = await this.$nymph.getEntity({ class: Group }, { type: '&', equal: ['defaultPrimary', true] });
+                        if (group != null) {
+                            this.group = group;
+                        }
                     }
-                    message +=
-                        "You're now logged in! An email has been sent to " +
-                            `${this.$data.email} with a verification link for you to finish ` +
-                            'registration.';
-                    loggedin = true;
                 }
-                else {
-                    if (!tilmeld.login(this, true)) {
-                        throw new Error('An error occurred trying to log you in.');
+                if (group != null && group.user != null && this.$is(group.user)) {
+                    // Update the user's generated primary group.
+                    let changed = false;
+                    if (group.groupname !== this.username) {
+                        group.groupname = this.username;
+                        changed = true;
                     }
-                    message += "You're now registered and logged in!";
-                    loggedin = true;
+                    if (group.avatar !== this.avatar) {
+                        group.avatar = this.avatar;
+                        changed = true;
+                    }
+                    if (tilmeld.config.userFields.includes('email') &&
+                        group.email !== this.email) {
+                        group.email = this.email;
+                        changed = true;
+                    }
+                    if (tilmeld.config.userFields.includes('name') &&
+                        group.name !== this.name) {
+                        group.name = this.name;
+                        changed = true;
+                    }
+                    if (tilmeld.config.userFields.includes('phone') &&
+                        group.phone !== this.phone) {
+                        group.phone = this.phone;
+                        changed = true;
+                    }
+                    if (changed || group.guid == null) {
+                        await group.$saveSkipAC();
+                    }
+                    this.group = group;
                 }
-                for (let callback of this.constructor
-                    .afterRegisterCallbacks) {
-                    if (callback) {
-                        await callback(this, {
-                            loggedin,
-                            message,
-                        });
+                if (this.groups == null || this.groups.length === 0) {
+                    // Add secondary groups.
+                    if (tilmeld.config.userFields.includes('email') &&
+                        tilmeld.config.verifyEmail &&
+                        tilmeld.config.unverifiedAccess &&
+                        this.secret != null) {
+                        // Add the default secondaries for unverified users.
+                        this.groups = await this.$nymph.getEntities({ class: Group }, { type: '&', equal: ['unverifiedSecondary', true] });
+                    }
+                    else {
+                        // Add the default secondaries.
+                        this.groups = await this.$nymph.getEntities({ class: Group }, { type: '&', equal: ['defaultSecondary', true] });
                     }
                 }
                 try {
-                    await tnymph.commit(transaction);
-                    this.$nymph = nymph;
-                    this.$nymph.tilmeld?.fillSession(this);
+                    tilmeld.config.validatorUser(tilmeld, this);
                 }
                 catch (e) {
-                    throw e;
+                    throw new BadDataError(e?.message);
                 }
-                return {
-                    result: true,
-                    loggedin,
-                    message,
-                };
-            }
-            else {
-                await tnymph.rollback(transaction);
-                this.$nymph = nymph;
-                return {
-                    result: false,
-                    loggedin: false,
-                    message: 'Error registering user.',
-                };
-            }
-        }
-        catch (e) {
-            await tnymph.rollback(transaction);
-            this.$nymph = nymph;
-            throw e;
-        }
-    }
-    async $save() {
-        let tilmeld = this.$nymph.tilmeld;
-        if (this.$data.username == null || !this.$data.username.trim().length) {
-            return false;
-        }
-        if (tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to modify system admins.");
-        }
-        let sendVerification = false;
-        this.$data.username = this.$data.username.trim();
-        if (tilmeld.config.emailUsernames) {
-            this.$data.email = this.$data.username;
-        }
-        this.$data.nameFirst = (this.$data.nameFirst ?? '').trim();
-        this.$data.nameMiddle = (this.$data.nameMiddle ?? '').trim();
-        this.$data.nameLast = (this.$data.nameLast ?? '').trim();
-        this.$data.phone = (this.$data.phone ?? '').trim();
-        this.$data.name =
-            this.$data.nameFirst +
-                (this.$data.nameMiddle ? ' ' + this.$data.nameMiddle : '') +
-                (this.$data.nameLast ? ' ' + this.$data.nameLast : '');
-        this.$data.enabled = !!this.$data.enabled;
-        if (this.$data.nameFirst === '') {
-            delete this.$data.nameFirst;
-        }
-        if (this.$data.nameMiddle === '') {
-            delete this.$data.nameMiddle;
-        }
-        if (this.$data.nameLast === '') {
-            delete this.$data.nameLast;
-        }
-        if (this.$data.name === '') {
-            delete this.$data.name;
-        }
-        if (this.$data.email === '') {
-            delete this.$data.email;
-        }
-        if (this.$data.avatar === '') {
-            delete this.$data.avatar;
-        }
-        if (this.$data.phone === '') {
-            delete this.$data.phone;
-        }
-        if (this.$data.secret === '') {
-            delete this.$data.secret;
-        }
-        if (this.$data.emailChangeDate === 0) {
-            delete this.$data.emailChangeDate;
-        }
-        if (this.$data.newEmailSecret === '') {
-            delete this.$data.newEmailSecret;
-        }
-        if (this.$data.newEmailAddress === '') {
-            delete this.$data.newEmailAddress;
-        }
-        if (this.$data.cancelEmailSecret === '') {
-            delete this.$data.cancelEmailSecret;
-        }
-        if (this.$data.cancelEmailAddress === '') {
-            delete this.$data.cancelEmailAddress;
-        }
-        if (this.$data.recoverSecret === '') {
-            delete this.$data.recoverSecret;
-        }
-        if (this.$data.recoverSecretDate === 0) {
-            delete this.$data.recoverSecretDate;
-        }
-        if (this.$data.password === '') {
-            delete this.$data.password;
-        }
-        if (this.$data.passwordTemp === '') {
-            delete this.$data.passwordTemp;
-        }
-        if (this.$data.inheritAbilities === false) {
-            delete this.$data.inheritAbilities;
-        }
-        const unCheck = await this.$checkUsername();
-        if (!unCheck.result) {
-            throw new errors_1.BadUsernameError(unCheck.message);
-        }
-        if (!tilmeld.config.emailUsernames) {
-            const emCheck = await this.$checkEmail();
-            if (!emCheck.result) {
-                throw new errors_1.BadEmailError(emCheck.message);
-            }
-        }
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            if (tilmeld.config.verifyEmail) {
-                if (this.guid == null) {
-                    if ((this.$data.abilities?.indexOf('system/admin') ?? -1) === -1) {
-                        this.$data.secret = (0, guid_1.nanoid)();
-                        sendVerification = true;
+                for (let callback of this.constructor
+                    .beforeSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
                     }
                 }
-                else if (this.$originalEmail != null &&
-                    this.$originalEmail !== this.$data.email) {
-                    if (tilmeld.config.emailRateLimit !== '' &&
-                        this.$data.emailChangeDate != null &&
-                        this.$data.emailChangeDate >=
-                            (0, strtotime_1.default)('-' + tilmeld.config.emailRateLimit) * 1000) {
-                        throw new errors_1.EmailChangeRateLimitExceededError('You already changed your email address recently. Please wait until ' +
-                            new Date((0, strtotime_1.default)('+' + tilmeld.config.emailRateLimit, Math.floor(this.$data.emailChangeDate / 1000)) * 1000).toString() +
-                            ' to change your email address again.');
+                await super.$save();
+                if (sendVerification) {
+                    // The email has changed, so send a new verification email.
+                    if (!(await this.$sendEmailVerification())) {
+                        throw new Error("Couldn't send verification email.");
                     }
-                    else {
-                        if (this.$data.newEmailSecret == null &&
-                            tilmeld.config.emailRateLimit !== '' &&
-                            (this.$data.emailChangeDate == null ||
-                                this.$data.emailChangeDate <
-                                    (0, strtotime_1.default)('-' + tilmeld.config.emailRateLimit) * 1000)) {
-                            this.$data.cancelEmailAddress = this.$originalEmail;
-                            this.$data.cancelEmailSecret = (0, guid_1.nanoid)();
-                            this.$data.emailChangeDate = Date.now();
-                        }
-                        this.$data.newEmailAddress = this.$data.email;
-                        this.$data.email = this.$originalEmail;
-                        if (tilmeld.config.emailUsernames) {
-                            this.$data.username = this.$data.email;
+                }
+                this.$descendantGroups = undefined;
+                this.$gatekeeperCache = undefined;
+                for (let callback of this.constructor
+                    .afterSaveCallbacks) {
+                    if (callback) {
+                        await callback(this);
+                    }
+                }
+            }, async (nymph, committed) => {
+                this.$setNymph(nymph);
+                if (committed) {
+                    this.$originalEmail = this.email;
+                    this.$originalUsername = this.username;
+                    try {
+                        const tilmeld = enforceTilmeld(nymph);
+                        if (tilmeld.User.current(true).$is(this)) {
+                            // Update the user in the session cache.
+                            await tilmeld.fillSession(this);
                         }
-                        this.$data.newEmailSecret = (0, guid_1.nanoid)();
-                        sendVerification = true;
+                    }
+                    catch (e) {
+                        // Ignore.
                     }
                 }
-            }
-            else if (this.guid != null &&
-                this.$originalEmail != null &&
-                this.$originalEmail !== this.$data.email &&
-                (this.$data.emailChangeDate == null ||
-                    this.$data.emailChangeDate <
-                        (0, strtotime_1.default)('-' + tilmeld.config.emailRateLimit) * 1000)) {
-                this.$data.cancelEmailAddress = this.$originalEmail;
-                this.$data.cancelEmailSecret = (0, guid_1.nanoid)();
-                sendVerification = true;
-            }
-        }
-        if (this.$data.passwordTemp != null) {
-            this.$password(this.$data.passwordTemp);
-        }
-        delete this.$data.passwordTemp;
-        if (this.$data.password == null) {
-            throw new errors_1.BadDataError('A password is required.');
+                else {
+                    this.guid = preGuid;
+                    this.cdate = preCdate;
+                    this.mdate = preMdate;
+                }
+            });
         }
-        try {
-            tilmeld.config.validatorUser(this);
+        /**
+         * This should *never* be accessible on the client.
+         */
+        async $saveSkipAC() {
+            this.$skipAcWhenSaving = true;
+            await this.$save();
         }
-        catch (e) {
-            throw new errors_1.BadDataError(e?.message);
+        $tilmeldSaveSkipAC() {
+            if (this.$skipAcWhenSaving) {
+                this.$skipAcWhenSaving = false;
+                return true;
+            }
+            return false;
         }
-        const transaction = 'tilmeld-save-' + (0, guid_1.nanoid)();
-        const nymph = this.$nymph;
-        const tnymph = await this.$nymph.startTransaction(transaction);
-        this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        if (this.$data.group != null &&
-            this.$data.group.user != null &&
-            this.$is(this.$data.group.user)) {
-            try {
-                this.$data.group.groupname = this.$data.username;
-                this.$data.group.avatar = this.$data.avatar;
-                this.$data.group.email = this.$data.email;
-                this.$data.group.name = this.$data.name;
-                this.$data.group.phone = this.$data.phone;
-                await this.$data.group.$saveSkipAC();
+        async $delete() {
+            const tilmeld = enforceTilmeld(this);
+            if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
+                throw new AccessControlError("You don't have the authority to delete users.");
             }
-            catch (e) {
-                await tnymph.rollback(transaction);
-                this.$nymph = nymph;
-                throw e;
+            if (!this.$skipAcWhenDeleting &&
+                !tilmeld.gatekeeper('system/admin') &&
+                this.abilities?.includes('system/admin')) {
+                throw new AccessControlError("You don't have the authority to delete system admins.");
             }
-        }
-        let ret;
-        let preGuid = this.guid;
-        let preCdate = this.cdate;
-        let preMdate = this.mdate;
-        try {
-            ret = await super.$save();
-        }
-        catch (e) {
-            await tnymph.rollback(transaction);
-            this.$nymph = nymph;
-            throw e;
-        }
-        if (ret) {
-            if (sendVerification) {
-                if (!(await this.$sendEmailVerification())) {
-                    await tnymph.rollback(transaction);
-                    this.guid = preGuid;
-                    this.cdate = preCdate;
-                    this.mdate = preMdate;
-                    this.$nymph = nymph;
-                    throw new Error("Couldn't send verification email.");
+            if (this.username !== this.$originalUsername) {
+                throw new AccessControlError("You can't delete a user while switching their username.");
+            }
+            if (!(await this.$refresh())) {
+                throw new BadDataError('User could not be refreshed.');
+            }
+            if (this.group != null) {
+                if (this.group.$asleep()) {
+                    await this.group.$wake();
+                }
+                else {
+                    if (!(await this.group.$refresh())) {
+                        throw new BadDataError('Group could not be refreshed.');
+                    }
                 }
             }
-            this.$descendantGroups = undefined;
-            this.$gatekeeperCache = undefined;
-            await tnymph.commit(transaction);
-            if (nymph.tilmeld.User.current(true).$is(this)) {
-                nymph.tilmeld.fillSession(this);
+            for (let callback of this.constructor
+                .beforeDeleteCallbacks) {
+                if (callback) {
+                    await callback(this);
+                }
+            }
+            if (tilmeld.User.current(true).$is(this)) {
+                await this.$logout();
+            }
+            if (this.group != null && this.$is(this.group.user)) {
+                // Read the skip ac value here, because super.$delete changes it.
+                const $skipAcWhenDeleting = this.$skipAcWhenDeleting;
+                // Delete the user.
+                await super.$delete();
+                // Delete the generated group.
+                if ($skipAcWhenDeleting) {
+                    await this.group.$deleteSkipAC();
+                }
+                else {
+                    await this.group.$delete();
+                }
+            }
+            else {
+                await super.$delete();
+            }
+            for (let callback of this.constructor
+                .afterDeleteCallbacks) {
+                if (callback) {
+                    await callback(this);
+                }
             }
         }
-        else {
-            await tnymph.rollback(transaction);
-        }
-        this.$nymph = nymph;
-        return ret;
-    }
-    async $saveSkipAC() {
-        this.$skipAcWhenSaving = true;
-        return await this.$save();
-    }
-    $tilmeldSaveSkipAC() {
-        if (this.$skipAcWhenSaving) {
-            this.$skipAcWhenSaving = false;
-            return true;
-        }
-        return false;
-    }
-    async $delete() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to delete users.");
-        }
-        if (!tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to delete system admins.");
-        }
-        if (tilmeld.User.current(true).$is(this)) {
-            await this.$logout();
-        }
-        return await super.$delete();
-    }
-    static on(event, callback) {
-        const prop = (event + 'Callbacks');
-        if (!(prop in this)) {
-            throw new Error('Invalid event type.');
+        /*
+         * This should *never* be accessible on the client.
+         */
+        async $deleteSkipAC() {
+            this.$skipAcWhenDeleting = true;
+            await this.$delete();
         }
-        this[prop].push(callback);
-        return () => this.off(event, callback);
-    }
-    static off(event, callback) {
-        const prop = (event + 'Callbacks');
-        if (!(prop in this)) {
+        $tilmeldDeleteSkipAC() {
+            if (this.$skipAcWhenDeleting) {
+                this.$skipAcWhenDeleting = false;
+                return true;
+            }
             return false;
         }
-        const i = this[prop].indexOf(callback);
-        if (i > -1) {
-            this[prop].splice(i, 1);
+        static on(event, callback) {
+            const prop = (event + 'Callbacks');
+            if (!(prop in this)) {
+                throw new Error('Invalid event type.');
+            }
+            // @ts-ignore: The callback should always be the right type here.
+            this[prop].push(callback);
+            return () => this.off(event, callback);
+        }
+        static off(event, callback) {
+            const prop = (event + 'Callbacks');
+            if (!(prop in this)) {
+                return false;
+            }
+            // @ts-ignore: The callback should always be the right type here.
+            const i = this[prop].indexOf(callback);
+            if (i > -1) {
+                // @ts-ignore: The callback should always be the right type here.
+                this[prop].splice(i, 1);
+            }
+            return true;
         }
-        return true;
-    }
-}
-exports.default = User;
-User.ETYPE = 'tilmeld_user';
-User.class = 'User';
-User.beforeRegisterCallbacks = [];
-User.afterRegisterCallbacks = [];
-User.beforeLoginCallbacks = [];
-User.afterLoginCallbacks = [];
-User.beforeLogoutCallbacks = [];
-User.afterLogoutCallbacks = [];
-User.DEFAULT_CLIENT_ENABLED_METHODS = [
-    '$checkUsername',
-    '$checkEmail',
-    '$checkPhone',
-    '$getAvatar',
-    '$register',
-];
-User.DEFAULT_PRIVATE_DATA = [
-    'email',
-    'originalEmail',
-    'phone',
-    'group',
-    'groups',
-    'abilities',
-    'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
-    'secret',
-    'newEmailAddress',
-    'newEmailSecret',
-    'cancelEmailAddress',
-    'cancelEmailSecret',
-    'emailChangeDate',
-];
-User.DEFAULT_ALLOWLIST_DATA = [];
-User.clientEnabledStaticMethods = [
-    'current',
-    'loginUser',
-    'sendRecovery',
-    'recover',
-    'getClientConfig',
-];
-User.searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+    };
+})();
+export { User };
 //# sourceMappingURL=User.js.map