@nymphjs/tilmeld 1.0.0-beta.17 → 1.0.0-beta.18

package/src/Tilmeld.ts

@@ -15,6 +15,7 @@ import { AccessControlError } from './errors';
 import Group from './Group';
 import User, { UserData } from './User';
 import { AccessControlData } from './Tilmeld.types';
+import { enforceTilmeld } from './enforceTilmeld';
 
 /**
  * A user and group system for Nymph.js.
@@ -73,6 +74,11 @@ export default class Tilmeld implements TilmeldInterface {
    */
   private skipAuthenticate = false;
 
+  /**
+   * Used to avoid infinite loop.
+   */
+  private alreadyLoggedOutSwitch = false;
+
   /**
    * Create a new instance of Tilmeld.
    *
@@ -157,7 +163,7 @@ export default class Tilmeld implements TilmeldInterface {
       options: Options,
       selectors: FormattedSelector[]
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (
         !options ||
         !('skipAc' in options) ||
@@ -197,7 +203,7 @@ export default class Tilmeld implements TilmeldInterface {
       nymph: Nymph,
       entity: EntityInterface
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (
         typeof entity.$tilmeldDeleteSkipAC === 'function' &&
         entity.$tilmeldDeleteSkipAC()
@@ -233,7 +239,7 @@ export default class Tilmeld implements TilmeldInterface {
       nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (!entity) {
         return;
       }
@@ -344,11 +350,10 @@ export default class Tilmeld implements TilmeldInterface {
           }
 
           if (
-            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
-              (!originalAc.user &&
-                newAc.user &&
-                !newAc.user.$is(tilmeld.currentUser))) &&
-            !tilmeld.gatekeeper('tilmeld/admin')
+            (originalAc.user && !originalAc.user.$is(newAc.user)) ||
+            (!originalAc.user &&
+              newAc.user &&
+              !newAc.user.$is(tilmeld.currentUser))
           ) {
             throw new AccessControlError(
               'No permission to assign to another user.'
@@ -361,8 +366,7 @@ export default class Tilmeld implements TilmeldInterface {
             !(
               newAc.group.$is(tilmeld.currentUser?.group) ||
               newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
-            ) &&
-            !tilmeld.gatekeeper('tilmeld/admin')
+            )
           ) {
             throw new AccessControlError(
               'No permission to assign to another group.'
@@ -400,7 +404,7 @@ export default class Tilmeld implements TilmeldInterface {
       nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       const user = tilmeld.currentUser;
       if (
         user != null &&
@@ -532,14 +536,6 @@ export default class Tilmeld implements TilmeldInterface {
   ) {
     const user = this.currentUser;
 
-    if (
-      user != null &&
-      (user.abilities?.indexOf('system/admin') ?? -1) !== -1
-    ) {
-      // The user is a system admin, so they can see everything.
-      return;
-    }
-
     if (options == null) {
       throw new Error('No options in argument.');
     } else if (
@@ -671,7 +667,7 @@ export default class Tilmeld implements TilmeldInterface {
    * - FULL_ACCESS, the user has read, write, and delete access to the entity,
    *   as well as being able to manage its access controls and ownership.
    *
-   * These properties defaults to:
+   * These properties default to:
    *
    * - acUser = TilmeldAccessLevels.FULL_ACCESS
    * - acGroup = TilmeldAccessLevels.READ_ACCESS
@@ -686,9 +682,7 @@ export default class Tilmeld implements TilmeldInterface {
    * The following conditions will result in different checks, which determine
    * whether the check passes:
    *
-   * - The user has the "system/admin" ability. (Always true.)
    * - It is a user or group. (True for READ_ACCESS or Tilmeld admins.)
-   * - The entity has no "user" and no "group". (Always true.)
    * - No user is logged in. (Check other AC.)
    * - The entity is the user. (Always true.)
    * - It is the user's primary group. (True for READ_ACCESS.)
@@ -729,30 +723,22 @@ export default class Tilmeld implements TilmeldInterface {
       userOrEmpty = user;
     }
 
-    if (userOrEmpty.$gatekeeper('system/admin')) {
-      return true;
-    }
-
     // Users and groups are always readable. Editable by Tilmeld admins.
     if (
       (entity instanceof User || entity instanceof Group) &&
       (type === TilmeldAccessLevels.READ_ACCESS ||
-        userOrEmpty.$gatekeeper('tilmeld/admin'))
+        userOrEmpty.abilities?.includes('tilmeld/admin') ||
+        userOrEmpty.abilities?.includes('system/admin'))
     ) {
       return true;
     }
 
-    // Entities with no owners are always editable.
-    if (entity.user == null && entity.group == null) {
-      return true;
-    }
-
     // Load access control, since we need it now...
     const acUser = entity.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
     const acGroup = entity.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
     const acOther = entity.acOther ?? TilmeldAccessLevels.NO_ACCESS;
 
-    if (userOrNull === null) {
+    if (userOrNull == null) {
       return acOther >= type;
     }
 
@@ -862,7 +848,7 @@ export default class Tilmeld implements TilmeldInterface {
       userOrEmpty = user;
     }
 
-    if (userOrEmpty.$gatekeeper('system/admin')) {
+    if (userOrEmpty.abilities?.includes('system/admin')) {
       return true;
     }
 
@@ -950,7 +936,7 @@ export default class Tilmeld implements TilmeldInterface {
         guid: guid,
       }
     );
-    if (!user || !user.guid || !user.enabled) {
+    if (!user || !user.guid) {
       return null;
     }
 
@@ -958,7 +944,8 @@ export default class Tilmeld implements TilmeldInterface {
   }
 
   /**
-   * Check for a TILMELDAUTH token, and, if set, authenticate from it.
+   * Check for TILMELDAUTH and TILMELDSWITCH tokens, and, if set, authenticate
+   * from it/them.
    *
    * You can also call this function after setting `response.locals.user` to the
    * user you want to authenticate. You *should* check for `user.enabled` before
@@ -994,24 +981,35 @@ export default class Tilmeld implements TilmeldInterface {
     // to provide the auth token.
     let fromAuthHeader = false;
     let authToken: string;
+    let switchToken: string | null;
     if (this.request.header('x-tilmeldauth') != null) {
       fromAuthHeader = true;
       authToken = this.request.header('x-tilmeldauth') as string;
+      switchToken =
+        (this.request.header('x-tilmeldswitch') as string) ||
+        'TILMELDSWITCH' in cookies
+          ? cookies.TILMELDSWITCH
+          : null;
     } else if ('TILMELDAUTH' in cookies) {
       fromAuthHeader = false;
       authToken = cookies.TILMELDAUTH;
+      switchToken = 'TILMELDSWITCH' in cookies ? cookies.TILMELDSWITCH : null;
     } else {
       return false;
     }
 
-    let extract: { guid: string; expire: Date } | null;
+    let authExtract: { guid: string; expire: Date } | null;
+    let switchExtract: { guid: string; expire: Date } | null;
     if (
       skipXsrfToken ||
       this.request.originalUrl.startsWith(this.config.setupPath)
     ) {
       // The request is for the setup app, or we were told to skip the XSRF
       // check, so don't check for the XSRF token.
-      extract = this.config.jwtExtract(this.config, authToken);
+      authExtract = this.config.jwtExtract(this.config, authToken);
+      switchExtract = switchToken
+        ? this.config.jwtExtract(this.config, switchToken)
+        : null;
     } else {
       // The request is for something else, so check for a valid XSRF token,
       // unless the auth token is provided by a header (instead of a cookie).
@@ -1020,21 +1018,44 @@ export default class Tilmeld implements TilmeldInterface {
         return false;
       }
 
-      extract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+      authExtract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+      switchExtract = switchToken
+        ? this.config.jwtExtract(this.config, switchToken)
+        : null;
     }
 
-    if (extract == null) {
+    if (authExtract == null) {
       this.logout();
       return false;
     }
-    const { guid, expire } = extract;
+    const { guid, expire } = authExtract;
+    const { guid: switchGuid, expire: switchExpire } = switchExtract || {
+      guid: null,
+      expire: null,
+    };
 
     const user = this.User.factorySync(guid);
-    if (user.guid == null || !user.enabled) {
+    if (user.guid == null || !user.enabled || expire.valueOf() <= Date.now()) {
       this.logout();
       return false;
     }
 
+    if (switchGuid && switchExpire && switchExpire.valueOf() > Date.now()) {
+      // Load the switch user.
+      const switchUser = this.User.factorySync(switchGuid);
+      if (switchUser.guid == null) {
+        this.logoutSwitch();
+      } else {
+        this.fillSession(switchUser);
+
+        if (this.response) {
+          this.response.locals.user = switchUser;
+        }
+
+        return true;
+      }
+    }
+
     if (expire.valueOf() < Date.now() + this.config.jwtRenew * 1000) {
       // If the user is less than renew time from needing a new token, give them
       // a new one.
@@ -1094,12 +1115,67 @@ export default class Tilmeld implements TilmeldInterface {
     return false;
   }
 
+  /**
+   * Adds a switch auth token for the given user.
+   *
+   * This effectively logs the current user in to the system as the given user.
+   *
+   * @param user The user.
+   * @param sendAuthHeader Send the auth token as a custom header.
+   * @param sendCookie Send the auth token as a cookie.
+   * @returns True on success, false on failure.
+   */
+  public loginSwitch(
+    user: User & UserData,
+    sendAuthHeader: boolean,
+    sendCookie = true
+  ) {
+    if (user.guid != null) {
+      if (this.response) {
+        if (!this.response.headersSent) {
+          const token = this.config.jwtBuilder(this.config, user, true);
+
+          if (sendCookie) {
+            const appUrl = new URL(this.config.appUrl);
+            this.response.cookie('TILMELDSWITCH', token, {
+              domain: this.config.cookieDomain,
+              path: this.config.cookiePath,
+              maxAge: this.config.jwtSwitchExpire * 1000,
+              secure: appUrl.protocol === 'https',
+              httpOnly: false, // Allow JS access (for PubSub auth token).
+              sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
+            });
+          }
+
+          if (sendAuthHeader) {
+            this.response.set('X-TILMELDSWITCH', token);
+          }
+        }
+
+        this.response.locals.user = user;
+      }
+
+      this.fillSession(user);
+      return true;
+    }
+    return false;
+  }
+
   /**
    * Logs the current user out of the system.
    *
    * @param clearCookie Clear the auth cookie. (Also send a header.)
    */
   public logout(clearCookie = true) {
+    if (this.request && !this.alreadyLoggedOutSwitch) {
+      const cookies = this.request.cookies ?? {};
+
+      if ('TILMELDSWITCH' in cookies) {
+        this.alreadyLoggedOutSwitch = true;
+        return this.logoutSwitch(clearCookie);
+      }
+    }
+
     this.clearSession();
     if (this.response) {
       if (clearCookie && !this.response.headersSent) {
@@ -1113,6 +1189,27 @@ export default class Tilmeld implements TilmeldInterface {
     }
   }
 
+  /**
+   * Clears the switch user out of the system.
+   *
+   * @param clearCookie Clear the auth cookie. (Also send a header.)
+   */
+  public logoutSwitch(clearCookie = true) {
+    this.clearSession();
+    if (this.response) {
+      if (clearCookie && !this.response.headersSent) {
+        this.response.clearCookie('TILMELDSWITCH', {
+          domain: this.config.cookieDomain,
+          path: this.config.cookiePath,
+        });
+        this.response.set('X-TILMELDSWITCH', '');
+      }
+      this.response.locals.user = null;
+
+      this.authenticate();
+    }
+  }
+
   // /**
   //  * Sort an array of groups hierarchically.
   //  *