@nymphjs/tilmeld 1.0.0-beta.2 → 1.0.0-beta.21

package/src/Tilmeld.ts

@@ -15,6 +15,7 @@ import { AccessControlError } from './errors';
 import Group from './Group';
 import User, { UserData } from './User';
 import { AccessControlData } from './Tilmeld.types';
+import { enforceTilmeld } from './enforceTilmeld';
 
 /**
  * A user and group system for Nymph.js.
@@ -73,6 +74,11 @@ export default class Tilmeld implements TilmeldInterface {
    */
   private skipAuthenticate = false;
 
+  /**
+   * Used to avoid infinite loop.
+   */
+  private alreadyLoggedOutSwitch = false;
+
   /**
    * Create a new instance of Tilmeld.
    *
@@ -84,6 +90,7 @@ export default class Tilmeld implements TilmeldInterface {
 
   /**
    * This is used internally by Nymph. Don't call it yourself.
+   *
    * @returns A clone of this instance.
    */
   public clone() {
@@ -105,6 +112,7 @@ export default class Tilmeld implements TilmeldInterface {
    */
   public init(nymph: Nymph) {
     this.nymph = nymph;
+    const tilmeld = this;
 
     // Set up access control hooks when Nymph is called.
     if (this.nymph.driver == null) {
@@ -112,18 +120,18 @@ export default class Tilmeld implements TilmeldInterface {
     }
 
     // Configure the classes.
-    class NymphUser extends User {}
-    NymphUser.nymph = this.nymph;
-    NymphUser.tilmeld = this;
+    class NymphUser extends User {
+      static nymph: Nymph = nymph;
+      static tilmeld: Tilmeld = tilmeld;
+    }
     (NymphUser as any).skipOnClone = true;
-    this.User = NymphUser;
-    this.nymph.addEntityClass(NymphUser);
-    class NymphGroup extends Group {}
-    NymphGroup.nymph = this.nymph;
-    NymphGroup.tilmeld = this;
+    this.User = this.nymph.addEntityClass(NymphUser);
+    class NymphGroup extends Group {
+      static nymph: Nymph = nymph;
+      static tilmeld: Tilmeld = tilmeld;
+    }
     (NymphUser as any).skipOnClone = true;
-    this.Group = NymphGroup;
-    this.nymph.addEntityClass(NymphGroup);
+    this.Group = this.nymph.addEntityClass(NymphGroup);
 
     this.initAccessControl();
     if (this.request != null && !this.skipAuthenticate) {
@@ -150,12 +158,12 @@ export default class Tilmeld implements TilmeldInterface {
 
   private initAccessControl() {
     // Check for the skip access control option and add AC selectors.
-    const handleQuery = async function (
+    const handleQuery = function (
       nymph: Nymph,
       options: Options,
       selectors: FormattedSelector[]
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (
         !options ||
         !('skipAc' in options) ||
@@ -195,7 +203,7 @@ export default class Tilmeld implements TilmeldInterface {
       nymph: Nymph,
       entity: EntityInterface
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (
         typeof entity.$tilmeldDeleteSkipAC === 'function' &&
         entity.$tilmeldDeleteSkipAC()
@@ -231,7 +239,7 @@ export default class Tilmeld implements TilmeldInterface {
       nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       if (!entity) {
         return;
       }
@@ -342,11 +350,10 @@ export default class Tilmeld implements TilmeldInterface {
           }
 
           if (
-            ((originalAc.user && !originalAc.user.$is(newAc.user)) ||
-              (!originalAc.user &&
-                newAc.user &&
-                !newAc.user.$is(tilmeld.currentUser))) &&
-            !tilmeld.gatekeeper('tilmeld/admin')
+            (originalAc.user && !originalAc.user.$is(newAc.user)) ||
+            (!originalAc.user &&
+              newAc.user &&
+              !newAc.user.$is(tilmeld.currentUser))
           ) {
             throw new AccessControlError(
               'No permission to assign to another user.'
@@ -359,8 +366,7 @@ export default class Tilmeld implements TilmeldInterface {
             !(
               newAc.group.$is(tilmeld.currentUser?.group) ||
               newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])
-            ) &&
-            !tilmeld.gatekeeper('tilmeld/admin')
+            )
           ) {
             throw new AccessControlError(
               'No permission to assign to another group.'
@@ -398,7 +404,7 @@ export default class Tilmeld implements TilmeldInterface {
       nymph: Nymph,
       entity: EntityInterface & AccessControlData
     ) {
-      const tilmeld = nymph.tilmeld as Tilmeld;
+      const tilmeld = enforceTilmeld(nymph);
       const user = tilmeld.currentUser;
       if (
         user != null &&
@@ -530,14 +536,6 @@ export default class Tilmeld implements TilmeldInterface {
   ) {
     const user = this.currentUser;
 
-    if (
-      user != null &&
-      (user.abilities?.indexOf('system/admin') ?? -1) !== -1
-    ) {
-      // The user is a system admin, so they can see everything.
-      return;
-    }
-
     if (options == null) {
       throw new Error('No options in argument.');
     } else if (
@@ -669,7 +667,7 @@ export default class Tilmeld implements TilmeldInterface {
    * - FULL_ACCESS, the user has read, write, and delete access to the entity,
    *   as well as being able to manage its access controls and ownership.
    *
-   * These properties defaults to:
+   * These properties default to:
    *
    * - acUser = TilmeldAccessLevels.FULL_ACCESS
    * - acGroup = TilmeldAccessLevels.READ_ACCESS
@@ -684,9 +682,7 @@ export default class Tilmeld implements TilmeldInterface {
    * The following conditions will result in different checks, which determine
    * whether the check passes:
    *
-   * - The user has the "system/admin" ability. (Always true.)
    * - It is a user or group. (True for READ_ACCESS or Tilmeld admins.)
-   * - The entity has no "user" and no "group". (Always true.)
    * - No user is logged in. (Check other AC.)
    * - The entity is the user. (Always true.)
    * - It is the user's primary group. (True for READ_ACCESS.)
@@ -727,30 +723,22 @@ export default class Tilmeld implements TilmeldInterface {
       userOrEmpty = user;
     }
 
-    if (userOrEmpty.$gatekeeper('system/admin')) {
-      return true;
-    }
-
     // Users and groups are always readable. Editable by Tilmeld admins.
     if (
       (entity instanceof User || entity instanceof Group) &&
       (type === TilmeldAccessLevels.READ_ACCESS ||
-        userOrEmpty.$gatekeeper('tilmeld/admin'))
+        userOrEmpty.abilities?.includes('tilmeld/admin') ||
+        userOrEmpty.abilities?.includes('system/admin'))
     ) {
       return true;
     }
 
-    // Entities with no owners are always editable.
-    if (entity.user == null && entity.group == null) {
-      return true;
-    }
-
     // Load access control, since we need it now...
     const acUser = entity.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
     const acGroup = entity.acGroup ?? TilmeldAccessLevels.READ_ACCESS;
     const acOther = entity.acOther ?? TilmeldAccessLevels.NO_ACCESS;
 
-    if (userOrNull === null) {
+    if (userOrNull == null) {
       return acOther >= type;
     }
 
@@ -860,7 +848,7 @@ export default class Tilmeld implements TilmeldInterface {
       userOrEmpty = user;
     }
 
-    if (userOrEmpty.$gatekeeper('system/admin')) {
+    if (userOrEmpty.abilities?.includes('system/admin')) {
       return true;
     }
 
@@ -948,7 +936,7 @@ export default class Tilmeld implements TilmeldInterface {
         guid: guid,
       }
     );
-    if (!user || !user.guid || !user.enabled) {
+    if (!user || !user.guid) {
       return null;
     }
 
@@ -956,7 +944,17 @@ export default class Tilmeld implements TilmeldInterface {
   }
 
   /**
-   * Check for a TILMELDAUTH token, and, if set, authenticate from it.
+   * Check for TILMELDAUTH and TILMELDSWITCH tokens, and, if set, authenticate
+   * from it/them.
+   *
+   * You can also call this function after setting `response.locals.user` to the
+   * user you want to authenticate. You *should* check for `user.enabled` before
+   * setting this variable, unless you explicitly want to log in as a disabled
+   * user. (The user must be an instance of the User class for this Tilmeld
+   * instance.)
+   *
+   * This function will set `response.locals.user` to the logged in user on
+   * successful authentication.
    *
    * @param skipXsrfToken Skip the XSRF token check.
    * @returns True if a user was authenticated, false on any failure.
@@ -966,30 +964,52 @@ export default class Tilmeld implements TilmeldInterface {
       return false;
     }
 
+    if (
+      this.response &&
+      this.response.locals.user &&
+      this.response.locals.user instanceof this.User
+    ) {
+      // The user has already been authenticated through some other means.
+      const user = this.response.locals.user;
+      this.fillSession(user);
+      return true;
+    }
+
     const cookies = this.request.cookies ?? {};
 
     // If a client does't support cookies, they can use the X-TILMELDAUTH header
     // to provide the auth token.
     let fromAuthHeader = false;
     let authToken: string;
+    let switchToken: string | null;
     if (this.request.header('x-tilmeldauth') != null) {
       fromAuthHeader = true;
       authToken = this.request.header('x-tilmeldauth') as string;
+      switchToken =
+        (this.request.header('x-tilmeldswitch') as string) ||
+        'TILMELDSWITCH' in cookies
+          ? cookies.TILMELDSWITCH
+          : null;
     } else if ('TILMELDAUTH' in cookies) {
       fromAuthHeader = false;
       authToken = cookies.TILMELDAUTH;
+      switchToken = 'TILMELDSWITCH' in cookies ? cookies.TILMELDSWITCH : null;
     } else {
       return false;
     }
 
-    let extract: { guid: string; expire: Date } | null;
+    let authExtract: { guid: string; issued: Date; expire: Date } | null;
+    let switchExtract: { guid: string; expire: Date } | null;
     if (
       skipXsrfToken ||
       this.request.originalUrl.startsWith(this.config.setupPath)
     ) {
       // The request is for the setup app, or we were told to skip the XSRF
       // check, so don't check for the XSRF token.
-      extract = this.config.jwtExtract(this.config, authToken);
+      authExtract = this.config.jwtExtract(this.config, authToken);
+      switchExtract = switchToken
+        ? this.config.jwtExtract(this.config, switchToken)
+        : null;
     } else {
       // The request is for something else, so check for a valid XSRF token,
       // unless the auth token is provided by a header (instead of a cookie).
@@ -998,28 +1018,62 @@ export default class Tilmeld implements TilmeldInterface {
         return false;
       }
 
-      extract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+      authExtract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+      switchExtract = switchToken
+        ? this.config.jwtExtract(this.config, switchToken)
+        : null;
     }
 
-    if (extract == null) {
+    if (authExtract == null) {
       this.logout();
       return false;
     }
-    const { guid, expire } = extract;
+    const { guid, issued, expire } = authExtract;
+    const { guid: switchGuid, expire: switchExpire } = switchExtract || {
+      guid: null,
+      expire: null,
+    };
 
     const user = this.User.factorySync(guid);
-    if (user.guid == null || !user.enabled) {
+    if (
+      user.guid == null ||
+      !user.enabled ||
+      expire.getTime() <= Date.now() ||
+      issued.getTime() > Date.now() ||
+      (user.revokeTokenDate != null && issued.getTime() <= user.revokeTokenDate)
+    ) {
       this.logout();
       return false;
     }
 
-    if (expire.valueOf() < Date.now() + this.config.jwtRenew * 1000) {
+    if (switchGuid && switchExpire && switchExpire.getTime() > Date.now()) {
+      // Load the switch user.
+      const switchUser = this.User.factorySync(switchGuid);
+      if (switchUser.guid == null) {
+        this.logoutSwitch();
+      } else {
+        this.fillSession(switchUser);
+
+        if (this.response) {
+          this.response.locals.user = switchUser;
+        }
+
+        return true;
+      }
+    }
+
+    if (expire.getTime() < Date.now() + this.config.jwtRenew * 1000) {
       // If the user is less than renew time from needing a new token, give them
       // a new one.
       this.login(user, fromAuthHeader);
     } else {
       this.fillSession(user);
     }
+
+    if (this.response) {
+      this.response.locals.user = user;
+    }
+
     return true;
   }
 
@@ -1027,26 +1081,86 @@ export default class Tilmeld implements TilmeldInterface {
    * Logs the given user into the system.
    *
    * @param user The user.
-   * @param sendAuthHeader When true, a custom header with the auth token will be sent.
+   * @param sendAuthHeader Send the auth token as a custom header.
+   * @param sendCookie Send the auth token as a cookie.
    * @returns True on success, false on failure.
    */
-  public login(user: User & UserData, sendAuthHeader: boolean) {
+  public login(
+    user: User & UserData,
+    sendAuthHeader: boolean,
+    sendCookie = true
+  ) {
     if (user.guid != null && user.enabled) {
-      if (this.response && !this.response.headersSent) {
-        const token = this.config.jwtBuilder(this.config, user);
-        const appUrl = new URL(this.config.appUrl);
-        this.response.cookie('TILMELDAUTH', token, {
-          domain: this.config.cookieDomain,
-          path: this.config.cookiePath,
-          maxAge: this.config.jwtExpire * 1000,
-          secure: appUrl.protocol === 'https',
-          httpOnly: false, // Allow JS access (for CSRF protection).
-          sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
-        });
-        if (sendAuthHeader) {
-          this.response.set('X-TILMELDAUTH', token);
+      if (this.response) {
+        if (!this.response.headersSent) {
+          const token = this.config.jwtBuilder(this.config, user);
+
+          if (sendCookie) {
+            const appUrl = new URL(this.config.appUrl);
+            this.response.cookie('TILMELDAUTH', token, {
+              domain: this.config.cookieDomain,
+              path: this.config.cookiePath,
+              maxAge: this.config.jwtExpire * 1000,
+              secure: appUrl.protocol === 'https',
+              httpOnly: false, // Allow JS access (for CSRF protection).
+              sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
+            });
+          }
+
+          if (sendAuthHeader) {
+            this.response.set('X-TILMELDAUTH', token);
+          }
         }
+
+        this.response.locals.user = user;
       }
+
+      this.fillSession(user);
+      return true;
+    }
+    return false;
+  }
+
+  /**
+   * Adds a switch auth token for the given user.
+   *
+   * This effectively logs the current user in to the system as the given user.
+   *
+   * @param user The user.
+   * @param sendAuthHeader Send the auth token as a custom header.
+   * @param sendCookie Send the auth token as a cookie.
+   * @returns True on success, false on failure.
+   */
+  public loginSwitch(
+    user: User & UserData,
+    sendAuthHeader: boolean,
+    sendCookie = true
+  ) {
+    if (user.guid != null) {
+      if (this.response) {
+        if (!this.response.headersSent) {
+          const token = this.config.jwtBuilder(this.config, user, true);
+
+          if (sendCookie) {
+            const appUrl = new URL(this.config.appUrl);
+            this.response.cookie('TILMELDSWITCH', token, {
+              domain: this.config.cookieDomain,
+              path: this.config.cookiePath,
+              maxAge: this.config.jwtSwitchExpire * 1000,
+              secure: appUrl.protocol === 'https',
+              httpOnly: false, // Allow JS access (for PubSub auth token).
+              sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
+            });
+          }
+
+          if (sendAuthHeader) {
+            this.response.set('X-TILMELDSWITCH', token);
+          }
+        }
+
+        this.response.locals.user = user;
+      }
+
       this.fillSession(user);
       return true;
     }
@@ -1055,15 +1169,50 @@ export default class Tilmeld implements TilmeldInterface {
 
   /**
    * Logs the current user out of the system.
+   *
+   * @param clearCookie Clear the auth cookie. (Also send a header.)
    */
-  public logout() {
+  public logout(clearCookie = true) {
+    if (this.request && !this.alreadyLoggedOutSwitch) {
+      const cookies = this.request.cookies ?? {};
+
+      if ('TILMELDSWITCH' in cookies) {
+        this.alreadyLoggedOutSwitch = true;
+        return this.logoutSwitch(clearCookie);
+      }
+    }
+
     this.clearSession();
-    if (this.response && !this.response.headersSent) {
-      this.response.clearCookie('TILMELDAUTH', {
-        domain: this.config.cookieDomain,
-        path: this.config.cookiePath,
-      });
-      this.response.set('X-TILMELDAUTH', '');
+    if (this.response) {
+      if (clearCookie && !this.response.headersSent) {
+        this.response.clearCookie('TILMELDAUTH', {
+          domain: this.config.cookieDomain,
+          path: this.config.cookiePath,
+        });
+        this.response.set('X-TILMELDAUTH', '');
+      }
+      this.response.locals.user = null;
+    }
+  }
+
+  /**
+   * Clears the switch user out of the system.
+   *
+   * @param clearCookie Clear the auth cookie. (Also send a header.)
+   */
+  public logoutSwitch(clearCookie = true) {
+    this.clearSession();
+    if (this.response) {
+      if (clearCookie && !this.response.headersSent) {
+        this.response.clearCookie('TILMELDSWITCH', {
+          domain: this.config.cookieDomain,
+          path: this.config.cookiePath,
+        });
+        this.response.set('X-TILMELDSWITCH', '');
+      }
+      this.response.locals.user = null;
+
+      this.authenticate();
     }
   }