@nymphjs/tilmeld 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/User.js

@@ -3,12 +3,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const guid_1 = require("@nymphjs/guid");
 const strtotime_1 = __importDefault(require("locutus/php/datetime/strtotime"));
 const enc_base64_1 = __importDefault(require("crypto-js/enc-base64"));
 const sha256_1 = __importDefault(require("crypto-js/sha256"));
 const md5_1 = __importDefault(require("crypto-js/md5"));
 const lodash_1 = require("lodash");
-const guid_1 = require("@nymphjs/guid");
+const otpauth_1 = require("otpauth");
+const qrcode_1 = require("qrcode");
+const enforceTilmeld_1 = require("./enforceTilmeld");
 const AbleObject_1 = __importDefault(require("./AbleObject"));
 const errors_1 = require("./errors");
 class User extends AbleObject_1.default {
@@ -30,32 +33,32 @@ class User extends AbleObject_1.default {
         }
         return entity;
     }
-    static factorySync(guid) {
-        return super.factorySync(guid);
+    static factorySync() {
+        return super.factorySync();
     }
-    constructor(guid) {
-        super(guid);
+    constructor() {
+        super();
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
         this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
         this.$allowlistTags = [];
         this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$data.groups = [];
-            this.$data.inheritAbilities = true;
-            this.$updateDataProtection();
-        }
+        this.$data.enabled = true;
+        this.$data.abilities = [];
+        this.$data.groups = [];
+        this.$data.inheritAbilities = true;
+        this.$updateDataProtection();
     }
     static current(returnObjectIfNotExist) {
-        if (this.tilmeld.currentUser == null) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (tilmeld.currentUser == null) {
             return returnObjectIfNotExist ? this.factorySync() : null;
         }
-        return this.tilmeld.currentUser;
+        return tilmeld.currentUser;
     }
     static async sendRecovery(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
@@ -63,9 +66,8 @@ class User extends AbleObject_1.default {
         }
         let user;
         const options = {};
-        if (!this.tilmeld.config.emailUsernames &&
-            data.recoveryType === 'username') {
-            const getUser = await this.nymph.getEntity({ class: this.tilmeld.User, skipAc: true }, {
+        if (!tilmeld.config.emailUsernames && data.recoveryType === 'username') {
+            const getUser = await this.nymph.getEntity({ class: tilmeld.User, skipAc: true }, {
                 type: '&',
                 ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
             });
@@ -86,7 +88,7 @@ class User extends AbleObject_1.default {
             options.locals = {};
         }
         else if (data.recoveryType === 'password') {
-            const getUser = await this.tilmeld.User.factoryUsername(data.account);
+            const getUser = await tilmeld.User.factoryUsername(data.account);
             if (getUser.guid == null) {
                 return {
                     result: false,
@@ -108,13 +110,13 @@ class User extends AbleObject_1.default {
             };
             options.locals = {
                 recoverCode: getUser.recoverSecret,
-                timeLimit: this.tilmeld.config.pwRecoveryTimeLimit,
+                timeLimit: tilmeld.config.pwRecoveryTimeLimit,
             };
         }
         else {
             return { result: false, message: 'Invalid recovery type.' };
         }
-        if (await this.tilmeld.config.sendEmail(this.tilmeld, options, user)) {
+        if (await tilmeld.config.sendEmail(tilmeld, options, user)) {
             return {
                 result: true,
                 message: "We've sent an email to your registered address. Please " +
@@ -126,17 +128,18 @@ class User extends AbleObject_1.default {
         }
     }
     static async recover(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
             };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         if (user.guid == null ||
             user.recoverSecret == null ||
             data.secret !== user.recoverSecret ||
-            (0, strtotime_1.default)('+' + this.tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
+            (0, strtotime_1.default)('+' + tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
                 1000 <
                 Date.now()) {
             return {
@@ -161,22 +164,24 @@ class User extends AbleObject_1.default {
         }
     }
     static getClientConfig() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         return {
-            regFields: this.tilmeld.config.regFields,
-            userFields: this.tilmeld.config.userFields,
-            emailUsernames: this.tilmeld.config.emailUsernames,
-            allowRegistration: this.tilmeld.config.allowRegistration,
-            allowUsernameChange: this.tilmeld.config.allowUsernameChange,
-            pwRecovery: this.tilmeld.config.pwRecovery,
-            verifyEmail: this.tilmeld.config.verifyEmail,
-            unverifiedAccess: this.tilmeld.config.unverifiedAccess,
+            regFields: tilmeld.config.regFields,
+            userFields: tilmeld.config.userFields,
+            emailUsernames: tilmeld.config.emailUsernames,
+            allowRegistration: tilmeld.config.allowRegistration,
+            allowUsernameChange: tilmeld.config.allowUsernameChange,
+            pwRecovery: tilmeld.config.pwRecovery,
+            verifyEmail: tilmeld.config.verifyEmail,
+            unverifiedAccess: tilmeld.config.unverifiedAccess,
         };
     }
     static async loginUser(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!('username' in data) || !data.username.length) {
             return { result: false, message: 'Incorrect login/password.' };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         const result = await user.$login(data);
         if (result.result) {
             user.$updateDataProtection();
@@ -185,19 +190,33 @@ class User extends AbleObject_1.default {
         return result;
     }
     async $login(data) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.guid == null) {
             return { result: false, message: 'Incorrect login/password.' };
         }
         if (!this.$data.enabled) {
             return { result: false, message: 'This user is disabled.' };
         }
-        if (this.$gatekeeper()) {
+        if (await this.$gatekeeper()) {
             return { result: true, message: 'You are already logged in.' };
         }
         if (!this.$checkPassword(data.password)) {
             return { result: false, message: 'Incorrect login/password.' };
         }
+        if (this.$data.totpSecret != null) {
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return {
+                    result: false,
+                    needTOTP: true,
+                    message: 'You need to provide a 2FA code.',
+                };
+            }
+            if (!this.$checkTOTPCode(data.code)) {
+                return { result: false, message: 'Incorrect 2FA code.' };
+            }
+        }
         try {
             for (let callback of this.constructor
                 .beforeLoginCallbacks) {
@@ -223,8 +242,63 @@ class User extends AbleObject_1.default {
         }
         return { result: true, message: 'You are logged in.' };
     }
+    async $switchUser(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (this.guid == null) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        let user = tilmeld.User.current();
+        if (!user || user.guid == null) {
+            return { result: false, message: "You're not logged in." };
+        }
+        const isCurrentUser = user != null && user.$is(this);
+        if (isCurrentUser) {
+            return { result: false, message: "You can't switch to yourself." };
+        }
+        const toAbilities = this.$data.abilities || [];
+        const fromAbilities = user.abilities || [];
+        if (fromAbilities.indexOf('tilmeld/switch') === -1 &&
+            fromAbilities.indexOf('system/admin') === -1) {
+            return {
+                result: false,
+                message: "You don't have permission to switch users.",
+            };
+        }
+        if (toAbilities.indexOf('system/admin') !== -1 ||
+            toAbilities.indexOf('tilmeld/admin') !== -1) {
+            return { result: false, message: "You can't switch to an admin." };
+        }
+        try {
+            for (let callback of this.constructor
+                .beforeLoginCallbacks) {
+                if (callback) {
+                    await callback(this, {
+                        username: this.$data.username || '',
+                        password: '',
+                        ...(data || {}),
+                    });
+                }
+            }
+        }
+        catch (e) {
+            return {
+                result: false,
+                message: e.message,
+            };
+        }
+        if (!tilmeld.loginSwitch(this, true)) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        for (let callback of this.constructor
+            .afterLoginCallbacks) {
+            if (callback) {
+                await callback(this);
+            }
+        }
+        return { result: true, message: 'You are logged in.' };
+    }
     async $logout() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         try {
             for (let callback of this.constructor
                 .beforeLogoutCallbacks) {
@@ -239,7 +313,7 @@ class User extends AbleObject_1.default {
                 message: e.message,
             };
         }
-        tilmeld.logout();
+        await tilmeld.logout();
         for (let callback of this.constructor
             .afterLogoutCallbacks) {
             if (callback) {
@@ -259,50 +333,84 @@ class User extends AbleObject_1.default {
             (0, md5_1.default)(this.$data.email.trim().toLowerCase()).toString() +
             '?d=identicon&s=40');
     }
+    $getGid() {
+        if (this.$data.group) {
+            return this.$data.group.guid;
+        }
+        return null;
+    }
+    $getGids() {
+        if (this.$data.groups) {
+            return this.$data.groups
+                .map((group) => group.guid)
+                .filter((guid) => guid != null);
+        }
+        return null;
+    }
     async $getDescendantGroups() {
         if (this.$descendantGroups == null) {
             this.$descendantGroups = [];
             if (this.$data.group != null) {
+                await this.$data.group.$wake();
                 this.$descendantGroups = await this.$data.group.$getDescendants();
             }
+            await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
             for (let curGroup of this.$data.groups ?? []) {
                 this.$descendantGroups = this.$descendantGroups?.concat(await curGroup.$getDescendants());
             }
         }
         return this.$descendantGroups;
     }
-    $getDescendantGroupsSync() {
-        if (this.$descendantGroups == null) {
-            this.$descendantGroups = [];
-            if (this.$data.group != null) {
-                this.$descendantGroups = this.$data.group.$getDescendantsSync();
-            }
-            for (let curGroup of this.$data.groups ?? []) {
-                this.$descendantGroups = this.$descendantGroups?.concat(curGroup.$getDescendantsSync());
-            }
-        }
-        return this.$descendantGroups;
-    }
     $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (input.data.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        this.$check();
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         this.$originalEmail = this.$data.email;
         super.$jsonAcceptData(input, allowConflict);
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (patch.set.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        this.$check();
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         this.$originalEmail = this.$data.email;
         super.$jsonAcceptPatch(patch, allowConflict);
@@ -312,7 +420,7 @@ class User extends AbleObject_1.default {
         this.$updateDataProtection();
     }
     $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let user = givenUser ?? tilmeld.User.current();
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
@@ -328,13 +436,18 @@ class User extends AbleObject_1.default {
         if (isCurrentUser) {
             this.$clientEnabledMethods.push('$gatekeeper');
             this.$clientEnabledMethods.push('$changePassword');
+            this.$clientEnabledMethods.push('$revokeCurrentTokens');
             this.$clientEnabledMethods.push('$logout');
             this.$clientEnabledMethods.push('$sendEmailVerification');
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$getNewTOTPSecret');
+            this.$clientEnabledMethods.push('$saveTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
         }
         if (user != null &&
             (abilities.indexOf('tilmeld/admin') !== -1 ||
                 abilities.indexOf('system/admin') !== -1)) {
-            this.$privateData = ['password', 'salt'];
+            this.$privateData = ['password', 'salt', 'totpSecret'];
             this.$allowlistData = undefined;
         }
         else if (isCurrentUser || isNewUser) {
@@ -355,41 +468,61 @@ class User extends AbleObject_1.default {
                 this.$allowlistData.push('phone');
             }
             this.$privateData = [
+                'enabled',
                 'secret',
+                'emailChangeDate',
                 'newEmailSecret',
-                'cancelEmailAddress',
                 'cancelEmailSecret',
-                'emailChangeDate',
+                'cancelEmailAddress',
                 'recoverSecret',
                 'recoverSecretDate',
-                'password',
                 'salt',
+                'password',
+                'passwordTemp',
+                'totpSecret',
             ];
         }
+        if (user != null &&
+            !isCurrentUser &&
+            (abilities.indexOf('tilmeld/switch') !== -1 ||
+                abilities.indexOf('system/admin') !== -1)) {
+            this.$clientEnabledMethods.push('$switchUser');
+        }
+    }
+    $updateGroupDataProtection() {
+        if (this.$data.group != null && !this.$data.group.$asleep()) {
+            this.$data.group.$updateDataProtection();
+        }
+        for (let group of this.$data.groups ?? []) {
+            if (!group.$asleep()) {
+                group.$updateDataProtection();
+            }
+        }
     }
-    $gatekeeper(ability) {
-        const tilmeld = this.$nymph.tilmeld;
+    async $gatekeeper(ability) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (ability == null) {
             return tilmeld.User.current()?.$is(this) ?? false;
         }
         if (this.$gatekeeperCache == null) {
             let abilities = this.$data.abilities ?? [];
             if (this.$data.inheritAbilities) {
+                await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
                 for (let curGroup of this.$data.groups ?? []) {
                     if (curGroup.enabled) {
                         abilities = abilities.concat(curGroup.abilities ?? []);
                     }
                 }
-                if (this.$data.group != null &&
-                    this.$data.group.cdate != null &&
-                    this.$data.group.enabled) {
-                    abilities = abilities.concat(this.$data.group.abilities ?? []);
+                await this.$data.group?.$wake();
+                const group = this.$data.group;
+                if (group != null && group.cdate != null && group.enabled) {
+                    abilities = abilities.concat(group.abilities ?? []);
                 }
             }
             this.$gatekeeperCache = Object.fromEntries(abilities.map((ability) => [ability, true]));
         }
         return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-            !!this.$gatekeeperCache['system/admin']);
+            !!this.$data.abilities?.includes('system/admin'));
     }
     $clearCache() {
         const ret = super.$clearCache();
@@ -398,7 +531,7 @@ class User extends AbleObject_1.default {
         return ret;
     }
     async $sendEmailVerification() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.guid == null) {
             return false;
         }
@@ -461,18 +594,21 @@ class User extends AbleObject_1.default {
         }
         return success;
     }
-    $addGroup(group) {
-        if (this.$data.groups == null) {
-            this.$data.groups = [];
+    async $addGroup(group) {
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+        let groups = this.$data.groups;
+        if (groups == null) {
+            groups = [];
         }
-        if (!group.$inArray(this.$data.groups)) {
-            this.$data.groups.push(group);
-            return this.$data.groups;
+        if (!group.$inArray(groups)) {
+            groups.push(group);
+            this.$data.groups = groups;
+            return groups;
         }
         return true;
     }
     $checkPassword(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 return this.$data.password === password;
@@ -484,10 +620,12 @@ class User extends AbleObject_1.default {
                     (0, sha256_1.default)(password + this.$data.salt).toString(enc_base64_1.default));
         }
     }
-    $delGroup(group) {
-        if (this.$data.groups != null && group.$inArray(this.$data.groups)) {
+    async $delGroup(group) {
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+        let groups = this.$data.groups || [];
+        if (this.$data.groups != null && group.$inArray(groups)) {
             const newGroups = [];
-            for (let curGroup of this.$data.groups) {
+            for (let curGroup of groups) {
                 if (!group.$is(curGroup)) {
                     newGroups.push(curGroup);
                 }
@@ -497,7 +635,7 @@ class User extends AbleObject_1.default {
         }
         return true;
     }
-    $inGroup(group) {
+    async $inGroup(group) {
         if (typeof group === 'string') {
             if (this.$data.group?.guid === group) {
                 return true;
@@ -511,13 +649,16 @@ class User extends AbleObject_1.default {
         }
         return (group.$is(this.$data.group) || group.$inArray(this.$data.groups ?? []));
     }
-    $isDescendant(group) {
-        if (this.$data.group?.cdate != null &&
-            this.$data.group.$isDescendant(group)) {
+    async $isDescendant(group) {
+        await this.$data.group?.$wake();
+        if (this.$data.group != null &&
+            this.$data.group?.cdate != null &&
+            (await this.$data.group?.$isDescendant(group))) {
             return true;
         }
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
         for (let curGroup of this.$data.groups ?? []) {
-            if (curGroup.$isDescendant(group)) {
+            if (await curGroup.$isDescendant(group)) {
                 return true;
             }
         }
@@ -531,7 +672,14 @@ class User extends AbleObject_1.default {
             return { result: false, message: 'Incorrect password.' };
         }
         this.$data.passwordTemp = data.newPassword;
+        if (data.revokeCurrentTokens) {
+            this.$data.revokeTokenDate = Date.now();
+        }
         if (await this.$save()) {
+            if (data.revokeCurrentTokens) {
+                const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+                tilmeld.login(this, true);
+            }
             return { result: true, message: 'Your password has been changed.' };
         }
         else {
@@ -539,7 +687,7 @@ class User extends AbleObject_1.default {
         }
     }
     $password(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 delete this.$data.salt;
@@ -557,8 +705,137 @@ class User extends AbleObject_1.default {
         }
         return this.$data.password;
     }
+    async $revokeCurrentTokens(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        this.$data.revokeTokenDate = Date.now();
+        if (await this.$save()) {
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+            tilmeld.login(this, true);
+            return {
+                result: true,
+                message: 'You have logged out of all other sessions.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't save revocation date." };
+        }
+    }
+    async $hasTOTPSecret() {
+        return this.$data.totpSecret != null;
+    }
+    $checkTOTPCode(code) {
+        if (this.$data.totpSecret == null) {
+            return false;
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: this.$data.totpSecret,
+        });
+        return totp.validate({ token: code, window: 2 }) != null;
+    }
+    async $getNewTOTPSecret() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (this.$data.totpSecret != null) {
+            throw new errors_1.BadDataError('You already have a 2FA secret.');
+        }
+        const secret = new otpauth_1.Secret();
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret,
+        });
+        const uri = totp.toString();
+        const qrcode = await (0, qrcode_1.toDataURL)(uri);
+        return {
+            uri,
+            qrcode,
+            secret: secret.base32,
+        };
+    }
+    async $saveTOTPSecret(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        if (this.$data.totpSecret != null) {
+            return { result: false, message: 'You already have a 2FA secret.' };
+        }
+        if (data.secret == null ||
+            typeof data.secret !== 'string' ||
+            data.secret === '') {
+            return { result: false, message: '2FA secret is invalid.' };
+        }
+        if (data.code == null ||
+            typeof data.code !== 'string' ||
+            data.code.length !== 6) {
+            return { result: false, message: '2FA code is invalid.' };
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: data.secret,
+        });
+        if (totp.validate({ token: data.code, window: 2 }) == null) {
+            return { result: false, message: '2FA code is incorrect.' };
+        }
+        this.$data.totpSecret = data.secret;
+        if (await this.$save()) {
+            return { result: true, message: 'Your two factor secret is now set.' };
+        }
+        else {
+            return { result: false, message: "Couldn't save two factor secret." };
+        }
+    }
+    async $removeTOTPSecret(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        if (this.$data.totpSecret == null) {
+            return { result: false, message: "You don't have a 2FA secret." };
+        }
+        if (data.code == null ||
+            typeof data.code !== 'string' ||
+            data.code.length !== 6) {
+            return { result: false, message: '2FA code is invalid.' };
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: this.$data.totpSecret,
+        });
+        if (totp.validate({ token: data.code, window: 2 }) == null) {
+            return { result: false, message: '2FA code is incorrect.' };
+        }
+        delete this.$data.totpSecret;
+        if (await this.$save()) {
+            return {
+                result: true,
+                message: 'Your two factor secret has been removed.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't remove two factor secret." };
+        }
+    }
     async $checkUsername() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.emailUsernames) {
             if (this.$data.username == null || !this.$data.username.length) {
                 return { result: false, message: 'Please specify a username.' };
@@ -598,6 +875,17 @@ class User extends AbleObject_1.default {
             if (test != null) {
                 return { result: false, message: 'That username is taken.' };
             }
+            for (let callback of this.constructor
+                .checkUsernameCallbacks) {
+                if (callback) {
+                    const result = await callback(this, {
+                        username: this.$data.username,
+                    });
+                    if (!result.result) {
+                        return { message: 'Username is not available.', ...result };
+                    }
+                }
+            }
             return {
                 result: true,
                 message: this.guid != null ? 'Username is valid.' : 'Username is available!',
@@ -621,7 +909,7 @@ class User extends AbleObject_1.default {
         }
     }
     async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.email == null || !this.$data.email.length) {
             if (tilmeld.config.verifyEmail) {
                 return { result: false, message: 'Please specify an email.' };
@@ -656,7 +944,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $checkPhone() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.phone == null || !this.$data.phone.length) {
             return { result: false, message: 'Please specify a phone number.' };
         }
@@ -684,7 +972,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $register(data) {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.allowRegistration) {
             return {
                 result: false,
@@ -742,7 +1030,7 @@ class User extends AbleObject_1.default {
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         try {
             let generatedPrimaryGroup = null;
             if (tilmeld.config.generatePrimary) {
@@ -909,13 +1197,13 @@ class User extends AbleObject_1.default {
         }
     }
     async $save() {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.username == null || !this.$data.username.trim().length) {
             return false;
         }
-        if (tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
+        if ((await tilmeld.gatekeeper('tilmeld/admin')) &&
+            !(await tilmeld.gatekeeper('system/admin')) &&
+            this.$data.abilities?.includes('system/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to modify system admins.");
         }
         let sendVerification = false;
@@ -996,7 +1284,7 @@ class User extends AbleObject_1.default {
                 throw new errors_1.BadEmailError(emCheck.message);
             }
         }
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
+        if (!(await tilmeld.gatekeeper('tilmeld/admin'))) {
             if (tilmeld.config.verifyEmail) {
                 if (this.guid == null) {
                     if ((this.$data.abilities?.indexOf('system/admin') ?? -1) === -1) {
@@ -1062,17 +1350,18 @@ class User extends AbleObject_1.default {
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        if (this.$data.group != null &&
-            this.$data.group.user != null &&
-            this.$is(this.$data.group.user)) {
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const group = this.$data.group;
+        await group?.$wake();
+        if (group != null && group.user != null && this.$is(group.user)) {
             try {
-                this.$data.group.groupname = this.$data.username;
-                this.$data.group.avatar = this.$data.avatar;
-                this.$data.group.email = this.$data.email;
-                this.$data.group.name = this.$data.name;
-                this.$data.group.phone = this.$data.phone;
-                await this.$data.group.$saveSkipAC();
+                group.groupname = this.$data.username;
+                group.avatar = this.$data.avatar;
+                group.email = this.$data.email;
+                group.name = this.$data.name;
+                group.phone = this.$data.phone;
+                await group.$saveSkipAC();
+                this.$data.group = group;
             }
             catch (e) {
                 await tnymph.rollback(transaction);
@@ -1106,8 +1395,8 @@ class User extends AbleObject_1.default {
             this.$descendantGroups = undefined;
             this.$gatekeeperCache = undefined;
             await tnymph.commit(transaction);
-            if (nymph.tilmeld.User.current(true).$is(this)) {
-                nymph.tilmeld.fillSession(this);
+            if ((0, enforceTilmeld_1.enforceTilmeld)(nymph).User.current(true).$is(this)) {
+                (0, enforceTilmeld_1.enforceTilmeld)(nymph).fillSession(this);
             }
         }
         else {
@@ -1128,12 +1417,12 @@ class User extends AbleObject_1.default {
         return false;
     }
     async $delete() {
-        const tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!(await tilmeld.gatekeeper('tilmeld/admin'))) {
             throw new errors_1.BadDataError("You don't have the authority to delete users.");
         }
-        if (!tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
+        if (!(await tilmeld.gatekeeper('system/admin')) &&
+            this.$data.abilities?.includes('system/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to delete system admins.");
         }
         if (tilmeld.User.current(true).$is(this)) {
@@ -1161,9 +1450,9 @@ class User extends AbleObject_1.default {
         return true;
     }
 }
-exports.default = User;
 User.ETYPE = 'tilmeld_user';
 User.class = 'User';
+User.checkUsernameCallbacks = [];
 User.beforeRegisterCallbacks = [];
 User.afterRegisterCallbacks = [];
 User.beforeLoginCallbacks = [];
@@ -1178,23 +1467,26 @@ User.DEFAULT_CLIENT_ENABLED_METHODS = [
     '$register',
 ];
 User.DEFAULT_PRIVATE_DATA = [
+    'abilities',
     'email',
-    'originalEmail',
     'phone',
     'group',
     'groups',
-    'abilities',
     'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
+    'enabled',
     'secret',
-    'newEmailAddress',
+    'emailChangeDate',
     'newEmailSecret',
-    'cancelEmailAddress',
+    'newEmailAddress',
     'cancelEmailSecret',
-    'emailChangeDate',
+    'cancelEmailAddress',
+    'recoverSecret',
+    'recoverSecretDate',
+    'salt',
+    'password',
+    'passwordTemp',
+    'revokeTokenDate',
+    'totpSecret',
 ];
 User.DEFAULT_ALLOWLIST_DATA = [];
 User.clientEnabledStaticMethods = [
@@ -1205,4 +1497,5 @@ User.clientEnabledStaticMethods = [
     'getClientConfig',
 ];
 User.searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+exports.default = User;
 //# sourceMappingURL=User.js.map