@nymphjs/tilmeld 1.0.0-beta.4 → 1.0.0-beta.41

package/CHANGELOG.md

@@ -3,6 +3,195 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [1.0.0-beta.41](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.40...v1.0.0-beta.41) (2023-07-12)
+
+### Features
+
+- remove synchronous database queries ([b579fb2](https://github.com/sciactive/nymphjs/commit/b579fb2eacd96cdd1b386a62c5c00cdbb2438f6e))
+- rewrite server side async api to match client side api ([9c537a8](https://github.com/sciactive/nymphjs/commit/9c537a8be49e9b989af0822a4c2236e8c2d20f87))
+
+# [1.0.0-beta.40](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.39...v1.0.0-beta.40) (2023-07-10)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.39](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.38...v1.0.0-beta.39) (2023-07-09)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.38](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.37...v1.0.0-beta.38) (2023-07-09)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.37](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.36...v1.0.0-beta.37) (2023-07-09)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.36](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.35...v1.0.0-beta.36) (2023-07-09)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.35](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.34...v1.0.0-beta.35) (2023-06-14)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.34](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.33...v1.0.0-beta.34) (2023-05-13)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.33](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.32...v1.0.0-beta.33) (2023-05-13)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.32](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.31...v1.0.0-beta.32) (2023-05-13)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.31](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.30...v1.0.0-beta.31) (2023-05-12)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.30](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.29...v1.0.0-beta.30) (2023-05-12)
+
+### Features
+
+- allow providing getEntityClass with a class instead of string ([ecd64c1](https://github.com/sciactive/nymphjs/commit/ecd64c1bf92e3657889613b76bcc46652f371ead))
+
+# [1.0.0-beta.29](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.28...v1.0.0-beta.29) (2023-05-08)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.28](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.27...v1.0.0-beta.28) (2023-05-05)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.27](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.26...v1.0.0-beta.27) (2023-05-04)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.26](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.25...v1.0.0-beta.26) (2023-05-04)
+
+### Features
+
+- update packages and migrate to mysql2 ([72ad611](https://github.com/sciactive/nymphjs/commit/72ad611bd2bf7bf85c3ba8a3486503d9b50c49d6))
+
+# [1.0.0-beta.25](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.24...v1.0.0-beta.25) (2023-05-04)
+
+### Bug Fixes
+
+- tilmeld uses wrong class when cloned with user ([059c2ce](https://github.com/sciactive/nymphjs/commit/059c2cedf1b07b9681e87c240eb36723a4581918))
+
+# [1.0.0-beta.24](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.23...v1.0.0-beta.24) (2023-05-02)
+
+### Bug Fixes
+
+- fill session after setting current user clone ([7bae7cf](https://github.com/sciactive/nymphjs/commit/7bae7cf1bf236b8efc00cb7b5ed53cd21f1370c7))
+
+# [1.0.0-beta.23](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.22...v1.0.0-beta.23) (2023-05-02)
+
+### Bug Fixes
+
+- rare case where currentUser isn't corrent ([97f233a](https://github.com/sciactive/nymphjs/commit/97f233a5fcfd4b97dd282562b0c99097ac3ef41d))
+
+# [1.0.0-beta.22](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.21...v1.0.0-beta.22) (2023-05-01)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.21](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.20...v1.0.0-beta.21) (2023-05-01)
+
+### Features
+
+- add totp two factor authentication ([cc9f8ed](https://github.com/sciactive/nymphjs/commit/cc9f8edb183271fa7f51e4b182b876efb8fa0f8d))
+
+# [1.0.0-beta.20](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.19...v1.0.0-beta.20) (2023-04-30)
+
+### Features
+
+- let the user revoke all current auth tokens ([63af3b9](https://github.com/sciactive/nymphjs/commit/63af3b9a31c6c221ab40c2c8a69231675f4634a2))
+
+# [1.0.0-beta.19](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.18...v1.0.0-beta.19) (2023-04-29)
+
+### Bug Fixes
+
+- some type issues ([ee69d5d](https://github.com/sciactive/nymphjs/commit/ee69d5d73361dacda5745d697df18fafd47810bc))
+
+# [1.0.0-beta.18](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.17...v1.0.0-beta.18) (2023-04-27)
+
+### Bug Fixes
+
+- small type issues ([b91579c](https://github.com/sciactive/nymphjs/commit/b91579c9c1e96500d903332648f5a93c9a7e7d9b))
+
+### Features
+
+- add enforceTilmeld function ([130faf1](https://github.com/sciactive/nymphjs/commit/130faf151dcdfbfacd6814833868907dca037d24))
+- add the ability to switch to a user without their password ([ca4466a](https://github.com/sciactive/nymphjs/commit/ca4466af1704d68905ac087350a8cf151c1072d9))
+- forbid modifying ac props from client ([f9e896f](https://github.com/sciactive/nymphjs/commit/f9e896f6c57b08ae100bc50d33a0234b6a431333))
+- remove access control bypass for sysadmins and ownerless entities, no longer needed ([345bbf4](https://github.com/sciactive/nymphjs/commit/345bbf4fd78a8f9d6d01fd0be8337854a1277ce6))
+
+# [1.0.0-beta.17](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.16...v1.0.0-beta.17) (2023-04-24)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.16](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.15...v1.0.0-beta.16) (2023-03-31)
+
+### Features
+
+- add ability to tell tilmeld to log in a specific user during authentication ([922e145](https://github.com/sciactive/nymphjs/commit/922e1452adae44bed2aa9655be16e19796acb39b))
+- username check callback ([372e95c](https://github.com/sciactive/nymphjs/commit/372e95c39664c0d718e497ec1b09426e7cfa8862))
+
+# [1.0.0-beta.15](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.14...v1.0.0-beta.15) (2023-03-23)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.14](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.13...v1.0.0-beta.14) (2023-03-17)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.13](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.12...v1.0.0-beta.13) (2023-03-16)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.12](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.11...v1.0.0-beta.12) (2023-03-04)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.11](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.10...v1.0.0-beta.11) (2023-02-27)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.10](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.9...v1.0.0-beta.10) (2023-01-19)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.9](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.8...v1.0.0-beta.9) (2023-01-09)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.8](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.7...v1.0.0-beta.8) (2023-01-09)
+
+**Note:** Version bump only for package @nymphjs/tilmeld
+
+# [1.0.0-beta.7](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.6...v1.0.0-beta.7) (2023-01-05)
+
+### Bug Fixes
+
+- sqlite transaction returns wrong instance of nymph if it has been cloned ([b278c76](https://github.com/sciactive/nymphjs/commit/b278c7633722cb1cca7a941187ae2f1ff8ebdc7b))
+
+# [1.0.0-beta.6](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.5...v1.0.0-beta.6) (2023-01-05)
+
+### Bug Fixes
+
+- extend class with correct nymph property when added to instance ([1d63f45](https://github.com/sciactive/nymphjs/commit/1d63f457c16de852322d81fd9fdc25e3eb841c8d))
+
+### Features
+
+- addEntityClass now returns the new class, which is required to use the class ([e752c3e](https://github.com/sciactive/nymphjs/commit/e752c3e50796656bdea8f8525932ede07c8a5378))
+
+# [1.0.0-beta.5](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.4...v1.0.0-beta.5) (2022-11-24)
+
+### Bug Fixes
+
+- correctly check for system admin ability in incoming data ([e777902](https://github.com/sciactive/nymphjs/commit/e77790260bd7ca5331a9d1923dc7d4f3281749dc))
+
 # [1.0.0-beta.4](https://github.com/sciactive/nymphjs/compare/v1.0.0-beta.3...v1.0.0-beta.4) (2022-11-23)
 
 **Note:** Version bump only for package @nymphjs/tilmeld

package/README.md

@@ -49,6 +49,19 @@ const { User, Group } = tilmeld;
 
 See the [config declaration file](src/conf/d.ts).
 
+## Abilities
+
+There are a few abilities that Tilmeld uses internally:
+
+- `system/admin` - A user with this ability has **all** abilities.
+- `tilmeld/admin` - Allow the user to manage and edit other user's account and group information and grant/revoke abilities.
+- `tilmeld/switch` - Allow the user to switch to other users (log in as them without their password).
+- `uid/get/[name]` - Allow the user to read the named UID.
+- `uid/new/[name]` - Allow the user to read, create, and increment the named UID.
+- `uid/set/[name]` - Allow the user to read, create, increment, set, and delete the named UID.
+
+The admin and switch abilities cannot be inherited from groups.
+
 # License
 
 Copyright 2021 SciActive Inc

package/dist/Group.d.ts

@@ -1,5 +1,4 @@
 import { EntityData, EntityJson, EntityPatch, Options, Selector, SerializedEntityData } from '@nymphjs/nymph';
-import type Tilmeld from './Tilmeld';
 import AbleObject from './AbleObject';
 import User, { UserData } from './User';
 export type GroupData = {
@@ -17,7 +16,6 @@ export type GroupData = {
     unverifiedSecondary?: boolean;
 };
 export default class Group extends AbleObject<GroupData> {
-    static tilmeld: Tilmeld;
     static ETYPE: string;
     static class: string;
     private static DEFAULT_PRIVATE_DATA;
@@ -32,8 +30,8 @@ export default class Group extends AbleObject<GroupData> {
     private $skipAcWhenSaving;
     static factory(guid?: string): Promise<Group & GroupData>;
     static factoryGroupname(groupname?: string): Promise<Group & GroupData>;
-    static factorySync(guid?: string): Group & GroupData;
-    constructor(guid?: string);
+    static factorySync(): Group & GroupData;
+    constructor();
     static getPrimaryGroups(options?: Options, selectors?: Selector[]): Promise<(Group & GroupData)[]>;
     static getSecondaryGroups(options?: Options, selectors?: Selector[]): Promise<(Group & GroupData)[]>;
     private static getAssignableGroups;
@@ -42,11 +40,10 @@ export default class Group extends AbleObject<GroupData> {
     $jsonAcceptPatch(patch: EntityPatch, allowConflict?: boolean): void;
     $putData(data: EntityData, sdata?: SerializedEntityData): void;
     $updateDataProtection(givenUser?: User & UserData): void;
-    $isDescendant(givenGroup: (Group & GroupData) | string): boolean;
+    $isDescendant(givenGroup: (Group & GroupData) | string): Promise<boolean>;
     $getChildren(): Promise<(Group & GroupData)[]>;
     $getDescendants(andSelf?: boolean): Promise<(Group & GroupData)[]>;
-    $getDescendantsSync(andSelf?: boolean): (Group & GroupData)[];
-    $getLevel(): number;
+    $getLevel(): Promise<number>;
     $getUsers(descendants?: boolean, limit?: number, offset?: number): Promise<(User & UserData)[]>;
     $checkGroupname(): Promise<{
         result: boolean;

package/dist/Group.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const md5_1 = __importDefault(require("crypto-js/md5"));
 const lodash_1 = require("lodash");
+const enforceTilmeld_1 = require("./enforceTilmeld");
 const AbleObject_1 = __importDefault(require("./AbleObject"));
 const errors_1 = require("./errors");
 class Group extends AbleObject_1.default {
@@ -26,11 +27,11 @@ class Group extends AbleObject_1.default {
         }
         return entity;
     }
-    static factorySync(guid) {
-        return super.factorySync(guid);
+    static factorySync() {
+        return super.factorySync();
     }
-    constructor(guid) {
-        super(guid);
+    constructor() {
+        super();
         this.$tags = [];
         this.$clientEnabledMethods = [
             '$checkGroupname',
@@ -45,41 +46,46 @@ class Group extends AbleObject_1.default {
         this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
         this.$allowlistTags = [];
         this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$updateDataProtection();
-        }
+        this.$data.enabled = true;
+        this.$data.abilities = [];
+        this.$updateDataProtection();
     }
     static async getPrimaryGroups(options, selectors) {
-        if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!(await tilmeld.gatekeeper('tilmeld/admin'))) {
             throw new Error("You don't have permission to do that.");
         }
-        return await this.getAssignableGroups(this.tilmeld.config.highestPrimary, { ...options, class: this.tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        return await this.getAssignableGroups(tilmeld.config.highestPrimary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
     }
     static async getSecondaryGroups(options, selectors) {
-        if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!(await tilmeld.gatekeeper('tilmeld/admin'))) {
             throw new Error("You don't have permission to do that.");
         }
-        return await this.getAssignableGroups(this.tilmeld.config.highestSecondary, { ...options, class: this.tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        return await this.getAssignableGroups(tilmeld.config.highestSecondary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
     }
     static async getAssignableGroups(highestParent, options, selectors) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let assignableGroups = [];
         if (highestParent === false) {
             return assignableGroups;
         }
-        assignableGroups = await this.nymph.getEntities({ ...options, class: this.tilmeld.Group }, ...selectors);
+        assignableGroups = await this.nymph.getEntities({ ...options, class: tilmeld.Group }, ...selectors);
         if (highestParent !== true) {
-            assignableGroups = assignableGroups.filter((group) => {
+            assignableGroups = (await Promise.all(assignableGroups.map(async (group) => {
                 let curGroup = group;
-                while (curGroup.parent != null && curGroup.parent.cdate != null) {
-                    if (curGroup.parent.guid === highestParent) {
-                        return true;
+                let parent = curGroup.parent;
+                await parent?.$wake();
+                while (parent != null && parent?.cdate != null) {
+                    if (parent?.guid === highestParent) {
+                        return group;
                     }
-                    curGroup = curGroup.parent;
+                    curGroup = parent;
+                    parent = curGroup.parent;
+                    await parent?.$wake();
                 }
-                return false;
-            });
+                return null;
+            }))).filter((group) => group != null);
         }
         return assignableGroups;
     }
@@ -95,24 +101,54 @@ class Group extends AbleObject_1.default {
             '?d=identicon&s=40');
     }
     $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (input.data.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this group a system admin.");
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        this.$check();
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         super.$jsonAcceptData(input, allowConflict);
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (patch.set.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this group a system admin.");
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        this.$check();
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         super.$jsonAcceptPatch(patch, allowConflict);
     }
@@ -121,7 +157,7 @@ class Group extends AbleObject_1.default {
         this.$updateDataProtection();
     }
     $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let user = givenUser ?? tilmeld.User.current();
         this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
         this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
@@ -136,15 +172,15 @@ class Group extends AbleObject_1.default {
         }
         else if (this.$data.user != null &&
             user != null &&
-            this.$data.user.$is(user)) {
+            this.$data.user.guid === user.guid) {
             this.$privateData = [];
         }
     }
-    $isDescendant(givenGroup) {
-        const tilmeld = this.$nymph.tilmeld;
+    async $isDescendant(givenGroup) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let group;
         if (typeof givenGroup === 'string') {
-            group = tilmeld.Group.factorySync(givenGroup);
+            group = await tilmeld.Group.factory(givenGroup);
         }
         else {
             group = givenGroup;
@@ -152,19 +188,21 @@ class Group extends AbleObject_1.default {
         if (group.guid == null) {
             return false;
         }
-        if (this.$data.parent == null) {
+        const parent = this.$data.parent;
+        await parent?.$wake();
+        if (parent == null) {
             return false;
         }
-        if (this.$data.parent.$is(group)) {
+        if (parent.$is(group)) {
             return true;
         }
-        if (this.$data.parent.$isDescendant(group)) {
+        if (await parent.$isDescendant(group)) {
             return true;
         }
         return false;
     }
     async $getChildren() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         return await this.$nymph.getEntities({ class: tilmeld.Group }, {
             type: '&',
             equal: ['enabled', true],
@@ -172,7 +210,7 @@ class Group extends AbleObject_1.default {
         });
     }
     async $getDescendants(andSelf = false) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let groups = [];
         const entities = await this.$nymph.getEntities({ class: tilmeld.Group }, {
             type: '&',
@@ -187,39 +225,22 @@ class Group extends AbleObject_1.default {
         }
         return groups;
     }
-    $getDescendantsSync(andSelf = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        let groups = [];
-        let entity;
-        let offset = 0;
-        do {
-            entity = this.$nymph.driver.getEntitySync({ class: tilmeld.Group, offset }, {
-                type: '&',
-                equal: ['enabled', true],
-                ref: ['parent', this],
-            });
-            if (entity != null) {
-                groups = entity.$getDescendantsSync(true).concat(groups);
-            }
-            offset++;
-        } while (entity != null);
-        if (andSelf) {
-            groups.push(this);
-        }
-        return groups;
-    }
-    $getLevel() {
-        const tilmeld = this.$nymph.tilmeld;
-        let group = tilmeld.Group.factorySync(this.guid ?? undefined);
+    async $getLevel() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        let group = await tilmeld.Group.factory(this.guid ?? undefined);
+        let parent = group.parent;
+        await parent?.$wake();
         let level = 0;
-        while (group.parent != null && group.parent.cdate != null && level < 1024) {
+        while (parent != null && parent.cdate != null && level < 1024) {
             level++;
-            group = group.parent;
+            group = parent;
+            parent = group.parent;
+            await parent?.$wake();
         }
         return level;
     }
     async $getUsers(descendants = false, limit, offset) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let groups = [];
         if (descendants) {
             groups = await this.$getDescendants();
@@ -248,7 +269,7 @@ class Group extends AbleObject_1.default {
         });
     }
     async $checkGroupname() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.emailUsernames) {
             if (this.$data.groupname == null || !this.$data.groupname.length) {
                 return { result: false, message: 'Please specify a groupname.' };
@@ -311,7 +332,7 @@ class Group extends AbleObject_1.default {
         }
     }
     async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.email === '') {
             return { result: true, message: '' };
         }
@@ -344,7 +365,7 @@ class Group extends AbleObject_1.default {
         };
     }
     async $save() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
             return false;
         }
@@ -386,6 +407,7 @@ class Group extends AbleObject_1.default {
         this.$data.abilities = (0, lodash_1.difference)(this.$data.abilities ?? [], [
             'system/admin',
             'tilmeld/admin',
+            'tilmeld/switch',
             null,
             undefined,
         ]);
@@ -399,10 +421,12 @@ class Group extends AbleObject_1.default {
                 throw new errors_1.BadEmailError(emCheck.message);
             }
         }
-        if (this.$data.parent &&
-            (this.$data.parent.cdate == null ||
-                this.$is(this.$data.parent) ||
-                this.$data.parent.$isDescendant(this))) {
+        const parent = this.$data.parent;
+        await parent?.$wake();
+        if (parent &&
+            (parent.cdate == null ||
+                this.$is(parent) ||
+                (await parent.$isDescendant(this)))) {
             throw new errors_1.BadDataError("Group parent can't be itself or descendant of itself.");
         }
         try {
@@ -435,15 +459,15 @@ class Group extends AbleObject_1.default {
         return false;
     }
     async $delete() {
-        let tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!(await tilmeld.gatekeeper('tilmeld/admin'))) {
             throw new errors_1.BadDataError("You don't have the authority to delete groups.");
         }
         const transaction = 'tilmeld-delete-' + this.guid;
         const nymph = this.$nymph;
         const tnymph = await nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         const descendants = await this.$getDescendants();
         if (descendants.length) {
             for (let curGroup of descendants) {
@@ -494,7 +518,6 @@ class Group extends AbleObject_1.default {
         return success;
     }
 }
-exports.default = Group;
 Group.ETYPE = 'tilmeld_group';
 Group.class = 'Group';
 Group.DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
@@ -504,4 +527,5 @@ Group.clientEnabledStaticMethods = [
     'getSecondaryGroups',
 ];
 Group.searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
+exports.default = Group;
 //# sourceMappingURL=Group.js.map