@nymphjs/tilmeld 1.0.0-beta.17 → 1.0.0-beta.19

package/src/User.ts

@@ -14,6 +14,7 @@ import { difference } from 'lodash';
 import { humanSecret, nanoid } from '@nymphjs/guid';
 
 import type Tilmeld from './Tilmeld';
+import { enforceTilmeld } from './enforceTilmeld';
 import AbleObject from './AbleObject';
 import Group, { GroupData } from './Group';
 import {
@@ -145,7 +146,8 @@ export type UserData = {
    */
   newEmailSecret?: string;
   /**
-   * The new email address.
+   * If the user has changed their email address, this is the new one, awaiting
+   * verification.
    */
   newEmailAddress?: string;
   /**
@@ -211,23 +213,31 @@ export default class User extends AbleObject<UserData> {
     '$register',
   ];
   private static DEFAULT_PRIVATE_DATA = [
+    // The things that are commented are there to show what is _not_ private.
+    'abilities',
+    // 'username',
+    // 'nameFirst',
+    // 'nameMiddle',
+    // 'nameLast',
+    // 'name',
     'email',
-    'originalEmail',
+    // 'avatar',
     'phone',
     'group',
     'groups',
-    'abilities',
     'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
+    'enabled',
     'secret',
-    'newEmailAddress',
+    'emailChangeDate',
     'newEmailSecret',
-    'cancelEmailAddress',
+    'newEmailAddress',
     'cancelEmailSecret',
-    'emailChangeDate',
+    'cancelEmailAddress',
+    'recoverSecret',
+    'recoverSecretDate',
+    'salt',
+    'password',
+    'passwordTemp',
   ];
   private static DEFAULT_ALLOWLIST_DATA: string[] = [];
 
@@ -512,7 +522,7 @@ export default class User extends AbleObject<UserData> {
     password: string;
     additionalData?: { [k: string]: any };
   }) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.guid == null) {
       return { result: false, message: 'Incorrect login/password.' };
     }
@@ -556,12 +566,84 @@ export default class User extends AbleObject<UserData> {
     return { result: true, message: 'You are logged in.' };
   }
 
+  public async $switchUser(data?: { additionalData?: { [k: string]: any } }) {
+    const tilmeld = enforceTilmeld(this);
+    if (this.guid == null) {
+      return { result: false, message: 'Incorrect login/password.' };
+    }
+
+    let user = tilmeld.User.current();
+
+    if (!user || user.guid == null) {
+      return { result: false, message: "You're not logged in." };
+    }
+
+    const isCurrentUser = user != null && user.$is(this);
+
+    if (isCurrentUser) {
+      return { result: false, message: "You can't switch to yourself." };
+    }
+
+    const toAbilities = this.$data.abilities || [];
+    const fromAbilities = user.abilities || [];
+
+    if (
+      fromAbilities.indexOf('tilmeld/switch') === -1 &&
+      fromAbilities.indexOf('system/admin') === -1
+    ) {
+      return {
+        result: false,
+        message: "You don't have permission to switch users.",
+      };
+    }
+
+    if (
+      toAbilities.indexOf('system/admin') !== -1 ||
+      toAbilities.indexOf('tilmeld/admin') !== -1
+    ) {
+      return { result: false, message: "You can't switch to an admin." };
+    }
+
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .beforeLoginCallbacks) {
+        if (callback) {
+          await callback(this, {
+            username: this.$data.username || '',
+            password: '',
+            ...(data || {}),
+          });
+        }
+      }
+    } catch (e: any) {
+      return {
+        result: false,
+        message: e.message,
+      };
+    }
+
+    // Authentication was successful, attempt to login.
+    if (!tilmeld.loginSwitch(this, true)) {
+      return { result: false, message: 'Incorrect login/password.' };
+    }
+
+    for (let callback of (this.constructor as typeof User)
+      .afterLoginCallbacks) {
+      if (callback) {
+        await callback(this);
+      }
+    }
+
+    // Login was successful.
+    return { result: true, message: 'You are logged in.' };
+  }
+
   /**
    * Log a user out of the system.
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $logout() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
 
     try {
       for (let callback of (this.constructor as typeof User)
@@ -640,18 +722,39 @@ export default class User extends AbleObject<UserData> {
   }
 
   public $jsonAcceptData(input: EntityJson, allowConflict = false) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     this.$referenceWake();
 
     if (
       'abilities' in input.data &&
-      input.data.abilities.indexOf('system/admin') !== -1 &&
-      this.$data.abilities?.indexOf('system/admin') === -1 &&
-      tilmeld.gatekeeper('tilmeld/admin') &&
+      input.data.abilities?.includes('system/admin') !==
+        this.$data.abilities?.includes('system/admin') &&
       !tilmeld.gatekeeper('system/admin')
     ) {
       throw new BadDataError(
-        "You don't have the authority to make this user a system admin."
+        "You don't have the authority to grant or revoke system/admin."
+      );
+    }
+
+    if (
+      'abilities' in input.data &&
+      input.data.abilities?.includes('tilmeld/admin') !==
+        this.$data.abilities?.includes('tilmeld/admin') &&
+      !tilmeld.gatekeeper('system/admin')
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/admin."
+      );
+    }
+
+    if (
+      'abilities' in input.data &&
+      input.data.abilities?.includes('tilmeld/switch') !==
+        this.$data.abilities?.includes('tilmeld/switch') &&
+      !tilmeld.gatekeeper('system/admin')
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/switch."
       );
     }
 
@@ -660,18 +763,39 @@ export default class User extends AbleObject<UserData> {
   }
 
   public $jsonAcceptPatch(patch: EntityPatch, allowConflict = false) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     this.$referenceWake();
 
     if (
       'abilities' in patch.set &&
-      patch.set.abilities.indexOf('system/admin') !== -1 &&
-      this.$data.abilities?.indexOf('system/admin') === -1 &&
-      tilmeld.gatekeeper('tilmeld/admin') &&
+      patch.set.abilities?.includes('system/admin') !==
+        this.$data.abilities?.includes('system/admin') &&
       !tilmeld.gatekeeper('system/admin')
     ) {
       throw new BadDataError(
-        "You don't have the authority to make this user a system admin."
+        "You don't have the authority to grant or revoke system/admin."
+      );
+    }
+
+    if (
+      'abilities' in patch.set &&
+      patch.set.abilities?.includes('tilmeld/admin') !==
+        this.$data.abilities?.includes('tilmeld/admin') &&
+      !tilmeld.gatekeeper('system/admin')
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/admin."
+      );
+    }
+
+    if (
+      'abilities' in patch.set &&
+      patch.set.abilities?.includes('tilmeld/switch') !==
+        this.$data.abilities?.includes('tilmeld/switch') &&
+      !tilmeld.gatekeeper('system/admin')
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/switch."
       );
     }
 
@@ -690,7 +814,7 @@ export default class User extends AbleObject<UserData> {
    * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
    */
   public $updateDataProtection(givenUser?: User & UserData) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     let user = givenUser ?? tilmeld.User.current();
 
     this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
@@ -745,17 +869,43 @@ export default class User extends AbleObject<UserData> {
         this.$allowlistData.push('phone');
       }
       this.$privateData = [
+        // The things that are commented are there to show what is _not_ private.
+        // 'abilities',
+        // 'username',
+        // 'nameFirst',
+        // 'nameMiddle',
+        // 'nameLast',
+        // 'name',
+        // 'email',
+        // 'avatar',
+        // 'phone',
+        // 'group',
+        // 'groups',
+        // 'inheritAbilities',
+        'enabled',
         'secret',
+        'emailChangeDate',
         'newEmailSecret',
-        'cancelEmailAddress',
+        // 'newEmailAddress',
         'cancelEmailSecret',
-        'emailChangeDate',
+        'cancelEmailAddress',
         'recoverSecret',
         'recoverSecretDate',
-        'password',
         'salt',
+        'password',
+        'passwordTemp',
       ];
     }
+
+    if (
+      user != null &&
+      !isCurrentUser &&
+      (abilities.indexOf('tilmeld/switch') !== -1 ||
+        abilities.indexOf('system/admin') !== -1)
+    ) {
+      // Users with this ability can switch to other users.
+      this.$clientEnabledMethods.push('$switchUser');
+    }
   }
 
   /**
@@ -773,7 +923,7 @@ export default class User extends AbleObject<UserData> {
    * @returns True or false.
    */
   public $gatekeeper(ability?: string): boolean {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (ability == null) {
       return tilmeld.User.current()?.$is(this) ?? false;
     }
@@ -800,7 +950,7 @@ export default class User extends AbleObject<UserData> {
     }
     return (
       (ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-      !!this.$gatekeeperCache['system/admin']
+      !!this.$data.abilities?.includes('system/admin')
     );
   }
 
@@ -817,7 +967,7 @@ export default class User extends AbleObject<UserData> {
    * @returns True on success, false on failure.
    */
   public async $sendEmailVerification() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.guid == null) {
       return false;
     }
@@ -930,7 +1080,7 @@ export default class User extends AbleObject<UserData> {
    * @returns True if the passwords match, otherwise false.
    */
   public $checkPassword(password: string) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     switch (tilmeld.config.pwMethod) {
       case 'plain':
         return this.$data.password === password;
@@ -1041,7 +1191,7 @@ export default class User extends AbleObject<UserData> {
    * @returns The resulting password or hash which is stored in the entity.
    */
   public $password(password: string) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     switch (tilmeld.config.pwMethod) {
       case 'plain':
         delete this.$data.salt;
@@ -1068,7 +1218,7 @@ export default class User extends AbleObject<UserData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkUsername(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (!tilmeld.config.emailUsernames) {
       if (this.$data.username == null || !this.$data.username.length) {
         return { result: false, message: 'Please specify a username.' };
@@ -1167,7 +1317,7 @@ export default class User extends AbleObject<UserData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkEmail(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.$data.email == null || !this.$data.email.length) {
       if (tilmeld.config.verifyEmail) {
         return { result: false, message: 'Please specify an email.' };
@@ -1212,7 +1362,7 @@ export default class User extends AbleObject<UserData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkPhone(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.$data.phone == null || !this.$data.phone.length) {
       return { result: false, message: 'Please specify a phone number.' };
     }
@@ -1251,7 +1401,7 @@ export default class User extends AbleObject<UserData> {
     password: string;
     additionalData?: { [k: string]: any };
   }): Promise<{ result: boolean; loggedin: boolean; message: string }> {
-    let tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = enforceTilmeld(this);
     if (!tilmeld.config.allowRegistration) {
       return {
         result: false,
@@ -1313,7 +1463,7 @@ export default class User extends AbleObject<UserData> {
     const nymph = this.$nymph;
     const tnymph = await this.$nymph.startTransaction(transaction);
     this.$nymph = tnymph;
-    tilmeld = this.$nymph.tilmeld as Tilmeld;
+    tilmeld = enforceTilmeld(this);
 
     try {
       // Add primary group.
@@ -1518,7 +1668,7 @@ export default class User extends AbleObject<UserData> {
   }
 
   public async $save() {
-    let tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = enforceTilmeld(this);
     if (this.$data.username == null || !this.$data.username.trim().length) {
       return false;
     }
@@ -1526,7 +1676,7 @@ export default class User extends AbleObject<UserData> {
     if (
       tilmeld.gatekeeper('tilmeld/admin') &&
       !tilmeld.gatekeeper('system/admin') &&
-      this.$gatekeeper('system/admin')
+      this.$data.abilities?.includes('system/admin')
     ) {
       throw new BadDataError(
         "You don't have the authority to modify system admins."
@@ -1716,7 +1866,7 @@ export default class User extends AbleObject<UserData> {
     const nymph = this.$nymph;
     const tnymph = await this.$nymph.startTransaction(transaction);
     this.$nymph = tnymph;
-    tilmeld = this.$nymph.tilmeld as Tilmeld;
+    tilmeld = enforceTilmeld(this);
 
     if (
       this.$data.group != null &&
@@ -1767,9 +1917,9 @@ export default class User extends AbleObject<UserData> {
       this.$gatekeeperCache = undefined;
       await tnymph.commit(transaction);
 
-      if ((nymph.tilmeld as Tilmeld).User.current(true).$is(this)) {
+      if (enforceTilmeld(nymph).User.current(true).$is(this)) {
         // Update the user in the session cache.
-        (nymph.tilmeld as Tilmeld).fillSession(this);
+        enforceTilmeld(nymph).fillSession(this);
       }
     } else {
       await tnymph.rollback(transaction);
@@ -1795,13 +1945,13 @@ export default class User extends AbleObject<UserData> {
   }
 
   public async $delete() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (!tilmeld.gatekeeper('tilmeld/admin')) {
       throw new BadDataError("You don't have the authority to delete users.");
     }
     if (
       !tilmeld.gatekeeper('system/admin') &&
-      this.$gatekeeper('system/admin')
+      this.$data.abilities?.includes('system/admin')
     ) {
       throw new BadDataError(
         "You don't have the authority to delete system admins."

package/src/conf/d.ts

@@ -217,6 +217,11 @@ export interface Config {
    * How long from current time, in seconds, the JWT token expires.
    */
   jwtExpire: number;
+  /**
+   * How long from current time, in seconds, the JWT token for a user switch
+   * expires.
+   */
+  jwtSwitchExpire: number;
   /**
    * How long, in seconds, before the JWT token expires to give the user a new
    * one.
@@ -225,7 +230,11 @@ export interface Config {
   /**
    * Function to build the JWT for user sessions.
    */
-  jwtBuilder: (config: Config, user: User) => string;
+  jwtBuilder: (
+    config: Config,
+    user: User & UserData,
+    switchToken?: boolean
+  ) => string;
   /**
    * Function to verify that a JWT was signed with the secret key, vaildate its
    * data, validate the XSRF token, and extract the GUID.

package/src/conf/defaults.ts

@@ -52,8 +52,9 @@ export default {
   maxUsernameLength: 128,
   jwtSecret: '',
   jwtExpire: 60 * 60 * 24 * 7 * 8, // 8 weeks(ish)
+  jwtSwitchExpire: 60 * 60 * 6, // 6 hours
   jwtRenew: 60 * 60 * 24 * 7 * 2, // 2 weeks(ish)
-  jwtBuilder: (config, user) => {
+  jwtBuilder: (config, user, switchToken) => {
     const secret = config.jwtSecret;
     if (secret === '') {
       throw new Error('JWT secret is not configured.');
@@ -67,7 +68,7 @@ export default {
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
       },
       secret,
-      { expiresIn: config.jwtExpire }
+      { expiresIn: switchToken ? config.jwtSwitchExpire : config.jwtExpire }
     );
   },
   jwtExtract: (config, token, xsrfToken?) => {

package/src/enforceTilmeld.ts

@@ -0,0 +1,20 @@
+import { Entity, EntityConstructor, Nymph } from '@nymphjs/nymph';
+
+import Tilmeld from './Tilmeld';
+
+export function enforceTilmeld(object: Nymph | Entity | EntityConstructor) {
+  let tilmeld: Tilmeld | undefined;
+  if (object instanceof Entity) {
+    tilmeld = object.$nymph.tilmeld as Tilmeld | undefined;
+  } else if (object instanceof Nymph) {
+    tilmeld = object.tilmeld as Tilmeld | undefined;
+  } else {
+    tilmeld = object.nymph.tilmeld as Tilmeld | undefined;
+  }
+
+  if (tilmeld == null) {
+    throw new Error('Tilmeld was not configured on this Nymph instance!');
+  }
+
+  return tilmeld;
+}

package/src/index.ts

@@ -1,5 +1,7 @@
 export * from './conf';
 
+export * from './enforceTilmeld';
+
 export * from './errors';
 
 import AbleObject from './AbleObject';