@nymphjs/tilmeld 1.0.0-beta.3 → 1.0.0-beta.31

package/dist/User.js

@@ -3,12 +3,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const guid_1 = require("@nymphjs/guid");
 const strtotime_1 = __importDefault(require("locutus/php/datetime/strtotime"));
 const enc_base64_1 = __importDefault(require("crypto-js/enc-base64"));
 const sha256_1 = __importDefault(require("crypto-js/sha256"));
 const md5_1 = __importDefault(require("crypto-js/md5"));
 const lodash_1 = require("lodash");
-const guid_1 = require("@nymphjs/guid");
+const otpauth_1 = require("otpauth");
+const qrcode_1 = require("qrcode");
+const enforceTilmeld_1 = require("./enforceTilmeld");
 const AbleObject_1 = __importDefault(require("./AbleObject"));
 const errors_1 = require("./errors");
 class User extends AbleObject_1.default {
@@ -49,13 +52,15 @@ class User extends AbleObject_1.default {
         }
     }
     static current(returnObjectIfNotExist) {
-        if (this.tilmeld.currentUser == null) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (tilmeld.currentUser == null) {
             return returnObjectIfNotExist ? this.factorySync() : null;
         }
-        return this.tilmeld.currentUser;
+        return tilmeld.currentUser;
     }
     static async sendRecovery(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
@@ -63,9 +68,8 @@ class User extends AbleObject_1.default {
         }
         let user;
         const options = {};
-        if (!this.tilmeld.config.emailUsernames &&
-            data.recoveryType === 'username') {
-            const getUser = await this.nymph.getEntity({ class: this.tilmeld.User, skipAc: true }, {
+        if (!tilmeld.config.emailUsernames && data.recoveryType === 'username') {
+            const getUser = await this.nymph.getEntity({ class: tilmeld.User, skipAc: true }, {
                 type: '&',
                 ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
             });
@@ -86,7 +90,7 @@ class User extends AbleObject_1.default {
             options.locals = {};
         }
         else if (data.recoveryType === 'password') {
-            const getUser = await this.tilmeld.User.factoryUsername(data.account);
+            const getUser = await tilmeld.User.factoryUsername(data.account);
             if (getUser.guid == null) {
                 return {
                     result: false,
@@ -108,13 +112,13 @@ class User extends AbleObject_1.default {
             };
             options.locals = {
                 recoverCode: getUser.recoverSecret,
-                timeLimit: this.tilmeld.config.pwRecoveryTimeLimit,
+                timeLimit: tilmeld.config.pwRecoveryTimeLimit,
             };
         }
         else {
             return { result: false, message: 'Invalid recovery type.' };
         }
-        if (await this.tilmeld.config.sendEmail(this.tilmeld, options, user)) {
+        if (await tilmeld.config.sendEmail(tilmeld, options, user)) {
             return {
                 result: true,
                 message: "We've sent an email to your registered address. Please " +
@@ -126,17 +130,18 @@ class User extends AbleObject_1.default {
         }
     }
     static async recover(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
             };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         if (user.guid == null ||
             user.recoverSecret == null ||
             data.secret !== user.recoverSecret ||
-            (0, strtotime_1.default)('+' + this.tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
+            (0, strtotime_1.default)('+' + tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
                 1000 <
                 Date.now()) {
             return {
@@ -161,22 +166,24 @@ class User extends AbleObject_1.default {
         }
     }
     static getClientConfig() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         return {
-            regFields: this.tilmeld.config.regFields,
-            userFields: this.tilmeld.config.userFields,
-            emailUsernames: this.tilmeld.config.emailUsernames,
-            allowRegistration: this.tilmeld.config.allowRegistration,
-            allowUsernameChange: this.tilmeld.config.allowUsernameChange,
-            pwRecovery: this.tilmeld.config.pwRecovery,
-            verifyEmail: this.tilmeld.config.verifyEmail,
-            unverifiedAccess: this.tilmeld.config.unverifiedAccess,
+            regFields: tilmeld.config.regFields,
+            userFields: tilmeld.config.userFields,
+            emailUsernames: tilmeld.config.emailUsernames,
+            allowRegistration: tilmeld.config.allowRegistration,
+            allowUsernameChange: tilmeld.config.allowUsernameChange,
+            pwRecovery: tilmeld.config.pwRecovery,
+            verifyEmail: tilmeld.config.verifyEmail,
+            unverifiedAccess: tilmeld.config.unverifiedAccess,
         };
     }
     static async loginUser(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!('username' in data) || !data.username.length) {
             return { result: false, message: 'Incorrect login/password.' };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         const result = await user.$login(data);
         if (result.result) {
             user.$updateDataProtection();
@@ -185,7 +192,7 @@ class User extends AbleObject_1.default {
         return result;
     }
     async $login(data) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.guid == null) {
             return { result: false, message: 'Incorrect login/password.' };
         }
@@ -198,6 +205,20 @@ class User extends AbleObject_1.default {
         if (!this.$checkPassword(data.password)) {
             return { result: false, message: 'Incorrect login/password.' };
         }
+        if (this.$data.totpSecret != null) {
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return {
+                    result: false,
+                    needTOTP: true,
+                    message: 'You need to provide a 2FA code.',
+                };
+            }
+            if (!this.$checkTOTPCode(data.code)) {
+                return { result: false, message: 'Incorrect 2FA code.' };
+            }
+        }
         try {
             for (let callback of this.constructor
                 .beforeLoginCallbacks) {
@@ -223,8 +244,63 @@ class User extends AbleObject_1.default {
         }
         return { result: true, message: 'You are logged in.' };
     }
+    async $switchUser(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (this.guid == null) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        let user = tilmeld.User.current();
+        if (!user || user.guid == null) {
+            return { result: false, message: "You're not logged in." };
+        }
+        const isCurrentUser = user != null && user.$is(this);
+        if (isCurrentUser) {
+            return { result: false, message: "You can't switch to yourself." };
+        }
+        const toAbilities = this.$data.abilities || [];
+        const fromAbilities = user.abilities || [];
+        if (fromAbilities.indexOf('tilmeld/switch') === -1 &&
+            fromAbilities.indexOf('system/admin') === -1) {
+            return {
+                result: false,
+                message: "You don't have permission to switch users.",
+            };
+        }
+        if (toAbilities.indexOf('system/admin') !== -1 ||
+            toAbilities.indexOf('tilmeld/admin') !== -1) {
+            return { result: false, message: "You can't switch to an admin." };
+        }
+        try {
+            for (let callback of this.constructor
+                .beforeLoginCallbacks) {
+                if (callback) {
+                    await callback(this, {
+                        username: this.$data.username || '',
+                        password: '',
+                        ...(data || {}),
+                    });
+                }
+            }
+        }
+        catch (e) {
+            return {
+                result: false,
+                message: e.message,
+            };
+        }
+        if (!tilmeld.loginSwitch(this, true)) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        for (let callback of this.constructor
+            .afterLoginCallbacks) {
+            if (callback) {
+                await callback(this);
+            }
+        }
+        return { result: true, message: 'You are logged in.' };
+    }
     async $logout() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         try {
             for (let callback of this.constructor
                 .beforeLogoutCallbacks) {
@@ -284,25 +360,49 @@ class User extends AbleObject_1.default {
         return this.$descendantGroups;
     }
     $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         this.$referenceWake();
-        if (input.data.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            !tilmeld.gatekeeper('system/admin')) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
             !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            !tilmeld.gatekeeper('system/admin')) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         this.$originalEmail = this.$data.email;
         super.$jsonAcceptData(input, allowConflict);
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         this.$referenceWake();
-        if (patch.set.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            !tilmeld.gatekeeper('system/admin')) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
             !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            !tilmeld.gatekeeper('system/admin')) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         this.$originalEmail = this.$data.email;
         super.$jsonAcceptPatch(patch, allowConflict);
@@ -312,7 +412,7 @@ class User extends AbleObject_1.default {
         this.$updateDataProtection();
     }
     $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let user = givenUser ?? tilmeld.User.current();
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
@@ -328,13 +428,18 @@ class User extends AbleObject_1.default {
         if (isCurrentUser) {
             this.$clientEnabledMethods.push('$gatekeeper');
             this.$clientEnabledMethods.push('$changePassword');
+            this.$clientEnabledMethods.push('$revokeCurrentTokens');
             this.$clientEnabledMethods.push('$logout');
             this.$clientEnabledMethods.push('$sendEmailVerification');
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$getNewTOTPSecret');
+            this.$clientEnabledMethods.push('$saveTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
         }
         if (user != null &&
             (abilities.indexOf('tilmeld/admin') !== -1 ||
                 abilities.indexOf('system/admin') !== -1)) {
-            this.$privateData = ['password', 'salt'];
+            this.$privateData = ['password', 'salt', 'totpSecret'];
             this.$allowlistData = undefined;
         }
         else if (isCurrentUser || isNewUser) {
@@ -355,20 +460,29 @@ class User extends AbleObject_1.default {
                 this.$allowlistData.push('phone');
             }
             this.$privateData = [
+                'enabled',
                 'secret',
+                'emailChangeDate',
                 'newEmailSecret',
-                'cancelEmailAddress',
                 'cancelEmailSecret',
-                'emailChangeDate',
+                'cancelEmailAddress',
                 'recoverSecret',
                 'recoverSecretDate',
-                'password',
                 'salt',
+                'password',
+                'passwordTemp',
+                'totpSecret',
             ];
         }
+        if (user != null &&
+            !isCurrentUser &&
+            (abilities.indexOf('tilmeld/switch') !== -1 ||
+                abilities.indexOf('system/admin') !== -1)) {
+            this.$clientEnabledMethods.push('$switchUser');
+        }
     }
     $gatekeeper(ability) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (ability == null) {
             return tilmeld.User.current()?.$is(this) ?? false;
         }
@@ -389,7 +503,7 @@ class User extends AbleObject_1.default {
             this.$gatekeeperCache = Object.fromEntries(abilities.map((ability) => [ability, true]));
         }
         return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-            !!this.$gatekeeperCache['system/admin']);
+            !!this.$data.abilities?.includes('system/admin'));
     }
     $clearCache() {
         const ret = super.$clearCache();
@@ -398,7 +512,7 @@ class User extends AbleObject_1.default {
         return ret;
     }
     async $sendEmailVerification() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.guid == null) {
             return false;
         }
@@ -472,7 +586,7 @@ class User extends AbleObject_1.default {
         return true;
     }
     $checkPassword(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 return this.$data.password === password;
@@ -531,7 +645,14 @@ class User extends AbleObject_1.default {
             return { result: false, message: 'Incorrect password.' };
         }
         this.$data.passwordTemp = data.newPassword;
+        if (data.revokeCurrentTokens) {
+            this.$data.revokeTokenDate = Date.now();
+        }
         if (await this.$save()) {
+            if (data.revokeCurrentTokens) {
+                const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+                tilmeld.login(this, true);
+            }
             return { result: true, message: 'Your password has been changed.' };
         }
         else {
@@ -539,7 +660,7 @@ class User extends AbleObject_1.default {
         }
     }
     $password(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 delete this.$data.salt;
@@ -557,8 +678,137 @@ class User extends AbleObject_1.default {
         }
         return this.$data.password;
     }
+    async $revokeCurrentTokens(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        this.$data.revokeTokenDate = Date.now();
+        if (await this.$save()) {
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+            tilmeld.login(this, true);
+            return {
+                result: true,
+                message: 'You have logged out of all other sessions.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't save revocation date." };
+        }
+    }
+    async $hasTOTPSecret() {
+        return this.$data.totpSecret != null;
+    }
+    $checkTOTPCode(code) {
+        if (this.$data.totpSecret == null) {
+            return false;
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: this.$data.totpSecret,
+        });
+        return totp.validate({ token: code, window: 2 }) != null;
+    }
+    async $getNewTOTPSecret() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (this.$data.totpSecret != null) {
+            throw new errors_1.BadDataError('You already have a 2FA secret.');
+        }
+        const secret = new otpauth_1.Secret();
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret,
+        });
+        const uri = totp.toString();
+        const qrcode = await (0, qrcode_1.toDataURL)(uri);
+        return {
+            uri,
+            qrcode,
+            secret: secret.base32,
+        };
+    }
+    async $saveTOTPSecret(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        if (this.$data.totpSecret != null) {
+            return { result: false, message: 'You already have a 2FA secret.' };
+        }
+        if (data.secret == null ||
+            typeof data.secret !== 'string' ||
+            data.secret === '') {
+            return { result: false, message: '2FA secret is invalid.' };
+        }
+        if (data.code == null ||
+            typeof data.code !== 'string' ||
+            data.code.length !== 6) {
+            return { result: false, message: '2FA code is invalid.' };
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: data.secret,
+        });
+        if (totp.validate({ token: data.code, window: 2 }) == null) {
+            return { result: false, message: '2FA code is incorrect.' };
+        }
+        this.$data.totpSecret = data.secret;
+        if (await this.$save()) {
+            return { result: true, message: 'Your two factor secret is now set.' };
+        }
+        else {
+            return { result: false, message: "Couldn't save two factor secret." };
+        }
+    }
+    async $removeTOTPSecret(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        if (this.$data.totpSecret == null) {
+            return { result: false, message: "You don't have a 2FA secret." };
+        }
+        if (data.code == null ||
+            typeof data.code !== 'string' ||
+            data.code.length !== 6) {
+            return { result: false, message: '2FA code is invalid.' };
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: this.$data.totpSecret,
+        });
+        if (totp.validate({ token: data.code, window: 2 }) == null) {
+            return { result: false, message: '2FA code is incorrect.' };
+        }
+        delete this.$data.totpSecret;
+        if (await this.$save()) {
+            return {
+                result: true,
+                message: 'Your two factor secret has been removed.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't remove two factor secret." };
+        }
+    }
     async $checkUsername() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.emailUsernames) {
             if (this.$data.username == null || !this.$data.username.length) {
                 return { result: false, message: 'Please specify a username.' };
@@ -598,6 +848,17 @@ class User extends AbleObject_1.default {
             if (test != null) {
                 return { result: false, message: 'That username is taken.' };
             }
+            for (let callback of this.constructor
+                .checkUsernameCallbacks) {
+                if (callback) {
+                    const result = await callback(this, {
+                        username: this.$data.username,
+                    });
+                    if (!result.result) {
+                        return { message: 'Username is not available.', ...result };
+                    }
+                }
+            }
             return {
                 result: true,
                 message: this.guid != null ? 'Username is valid.' : 'Username is available!',
@@ -621,7 +882,7 @@ class User extends AbleObject_1.default {
         }
     }
     async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.email == null || !this.$data.email.length) {
             if (tilmeld.config.verifyEmail) {
                 return { result: false, message: 'Please specify an email.' };
@@ -656,7 +917,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $checkPhone() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.phone == null || !this.$data.phone.length) {
             return { result: false, message: 'Please specify a phone number.' };
         }
@@ -684,7 +945,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $register(data) {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.allowRegistration) {
             return {
                 result: false,
@@ -742,7 +1003,7 @@ class User extends AbleObject_1.default {
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         try {
             let generatedPrimaryGroup = null;
             if (tilmeld.config.generatePrimary) {
@@ -909,13 +1170,13 @@ class User extends AbleObject_1.default {
         }
     }
     async $save() {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.username == null || !this.$data.username.trim().length) {
             return false;
         }
         if (tilmeld.gatekeeper('tilmeld/admin') &&
             !tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
+            this.$data.abilities?.includes('system/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to modify system admins.");
         }
         let sendVerification = false;
@@ -1062,7 +1323,7 @@ class User extends AbleObject_1.default {
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.group != null &&
             this.$data.group.user != null &&
             this.$is(this.$data.group.user)) {
@@ -1106,8 +1367,8 @@ class User extends AbleObject_1.default {
             this.$descendantGroups = undefined;
             this.$gatekeeperCache = undefined;
             await tnymph.commit(transaction);
-            if (nymph.tilmeld.User.current(true).$is(this)) {
-                nymph.tilmeld.fillSession(this);
+            if ((0, enforceTilmeld_1.enforceTilmeld)(nymph).User.current(true).$is(this)) {
+                (0, enforceTilmeld_1.enforceTilmeld)(nymph).fillSession(this);
             }
         }
         else {
@@ -1128,12 +1389,12 @@ class User extends AbleObject_1.default {
         return false;
     }
     async $delete() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.gatekeeper('tilmeld/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to delete users.");
         }
         if (!tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
+            this.$data.abilities?.includes('system/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to delete system admins.");
         }
         if (tilmeld.User.current(true).$is(this)) {
@@ -1161,9 +1422,9 @@ class User extends AbleObject_1.default {
         return true;
     }
 }
-exports.default = User;
 User.ETYPE = 'tilmeld_user';
 User.class = 'User';
+User.checkUsernameCallbacks = [];
 User.beforeRegisterCallbacks = [];
 User.afterRegisterCallbacks = [];
 User.beforeLoginCallbacks = [];
@@ -1178,23 +1439,26 @@ User.DEFAULT_CLIENT_ENABLED_METHODS = [
     '$register',
 ];
 User.DEFAULT_PRIVATE_DATA = [
+    'abilities',
     'email',
-    'originalEmail',
     'phone',
     'group',
     'groups',
-    'abilities',
     'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
+    'enabled',
     'secret',
-    'newEmailAddress',
+    'emailChangeDate',
     'newEmailSecret',
-    'cancelEmailAddress',
+    'newEmailAddress',
     'cancelEmailSecret',
-    'emailChangeDate',
+    'cancelEmailAddress',
+    'recoverSecret',
+    'recoverSecretDate',
+    'salt',
+    'password',
+    'passwordTemp',
+    'revokeTokenDate',
+    'totpSecret',
 ];
 User.DEFAULT_ALLOWLIST_DATA = [];
 User.clientEnabledStaticMethods = [
@@ -1205,4 +1469,5 @@ User.clientEnabledStaticMethods = [
     'getClientConfig',
 ];
 User.searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+exports.default = User;
 //# sourceMappingURL=User.js.map