@nymphjs/tilmeld 1.0.0-beta.45 → 1.0.0-beta.47

package/src/User.ts

@@ -40,7 +40,7 @@ export type EventType =
  */
 export type TilmeldCheckUsernameCallback = (
   user: User & UserData,
-  data: { username: string }
+  data: { username: string },
 ) => Promise<{ result: boolean; message?: string }>;
 /**
  * Theses are run before the user data checks, so the only checks before are
@@ -48,11 +48,11 @@ export type TilmeldCheckUsernameCallback = (
  */
 export type TilmeldBeforeRegisterCallback = (
   user: User & UserData,
-  data: { password: string; additionalData?: { [k: string]: any } }
+  data: { password: string; additionalData?: { [k: string]: any } },
 ) => Promise<void>;
 export type TilmeldAfterRegisterCallback = (
   user: User & UserData,
-  result: { loggedin: boolean; message: string }
+  result: { loggedin: boolean; message: string },
 ) => Promise<void>;
 /**
  * These are run after the authentication checks, but before the login action.
@@ -63,20 +63,20 @@ export type TilmeldBeforeLoginCallback = (
     username: string;
     password: string;
     additionalData?: { [k: string]: any };
-  }
+  },
 ) => Promise<void>;
 /**
  * This is run before the transaction is committed, and you can perform
  * additional functions on the transaction, which is available in `user.$nymph`.
  */
 export type TilmeldAfterLoginCallback = (
-  user: User & UserData
+  user: User & UserData,
 ) => Promise<void>;
 export type TilmeldBeforeLogoutCallback = (
-  user: User & UserData
+  user: User & UserData,
 ) => Promise<void>;
 export type TilmeldAfterLogoutCallback = (
-  user: User & UserData
+  user: User & UserData,
 ) => Promise<void>;
 
 export type UserData = {
@@ -303,7 +303,7 @@ export default class User extends AbleObject<UserData> {
         {
           type: '&',
           ilike: ['username', username.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        }
+        },
       );
       if (entity != null) {
         return entity;
@@ -329,10 +329,10 @@ export default class User extends AbleObject<UserData> {
 
   public static current(returnObjectIfNotExist: true): User & UserData;
   public static current(
-    returnObjectIfNotExist?: false
+    returnObjectIfNotExist?: false,
   ): (User & UserData) | null;
   public static current(
-    returnObjectIfNotExist?: boolean
+    returnObjectIfNotExist?: boolean,
   ): (User & UserData) | null {
     const tilmeld = enforceTilmeld(this);
     if (tilmeld.currentUser == null) {
@@ -370,7 +370,7 @@ export default class User extends AbleObject<UserData> {
         {
           type: '&',
           ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        }
+        },
       );
 
       if (getUser == null) {
@@ -466,7 +466,7 @@ export default class User extends AbleObject<UserData> {
       data.secret !== user.recoverSecret ||
       strtotime(
         '+' + tilmeld.config.pwRecoveryTimeLimit,
-        Math.floor((user.recoverSecretDate ?? 0) / 1000)
+        Math.floor((user.recoverSecretDate ?? 0) / 1000),
       ) *
         1000 <
         Date.now()
@@ -745,7 +745,7 @@ export default class User extends AbleObject<UserData> {
       await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
       for (let curGroup of this.$data.groups ?? []) {
         this.$descendantGroups = this.$descendantGroups?.concat(
-          await curGroup.$getDescendants()
+          await curGroup.$getDescendants(),
         );
       }
     }
@@ -764,7 +764,7 @@ export default class User extends AbleObject<UserData> {
         !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to grant or revoke system/admin."
+        "You don't have the authority to grant or revoke system/admin.",
       );
     }
 
@@ -776,7 +776,7 @@ export default class User extends AbleObject<UserData> {
         !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to grant or revoke tilmeld/admin."
+        "You don't have the authority to grant or revoke tilmeld/admin.",
       );
     }
 
@@ -788,7 +788,7 @@ export default class User extends AbleObject<UserData> {
         !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to grant or revoke tilmeld/switch."
+        "You don't have the authority to grant or revoke tilmeld/switch.",
       );
     }
 
@@ -808,7 +808,7 @@ export default class User extends AbleObject<UserData> {
         !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to grant or revoke system/admin."
+        "You don't have the authority to grant or revoke system/admin.",
       );
     }
 
@@ -820,7 +820,7 @@ export default class User extends AbleObject<UserData> {
         !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to grant or revoke tilmeld/admin."
+        "You don't have the authority to grant or revoke tilmeld/admin.",
       );
     }
 
@@ -832,7 +832,7 @@ export default class User extends AbleObject<UserData> {
         !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to grant or revoke tilmeld/switch."
+        "You don't have the authority to grant or revoke tilmeld/switch.",
       );
     }
 
@@ -891,6 +891,8 @@ export default class User extends AbleObject<UserData> {
     ) {
       // Users who can edit other users can see most of their data.
       this.$privateData = ['password', 'salt', 'totpSecret'];
+      this.$clientEnabledMethods.push('$hasTOTPSecret');
+      this.$clientEnabledMethods.push('$removeTOTPSecret');
       this.$allowlistData = undefined;
     } else if (isCurrentUser || isNewUser) {
       // Users can see their own data, and edit some of it.
@@ -1013,7 +1015,7 @@ export default class User extends AbleObject<UserData> {
       }
     }
     return Object.fromEntries(
-      abilities.map((ability) => [ability, true as true])
+      abilities.map((ability) => [ability, true as true]),
     );
   }
 
@@ -1042,7 +1044,7 @@ export default class User extends AbleObject<UserData> {
 
     if (this.$data.secret != null) {
       const link = `${verifyUrl}?action=verify&id=${encodeURIComponent(
-        this.guid
+        this.guid,
       )}&secret=${encodeURIComponent(this.$data.secret)}`;
       success =
         success &&
@@ -1060,13 +1062,13 @@ export default class User extends AbleObject<UserData> {
               verifyLink: link,
             },
           },
-          this
+          this,
         ));
     }
 
     if (this.$data.newEmailSecret != null) {
       const link = `${verifyUrl}?action=verifychange&id=${encodeURIComponent(
-        this.guid
+        this.guid,
       )}&secret=${encodeURIComponent(this.$data.newEmailSecret)}`;
       success =
         success &&
@@ -1086,13 +1088,13 @@ export default class User extends AbleObject<UserData> {
               newEmail: this.$data.newEmailAddress,
             },
           },
-          this
+          this,
         ));
     }
 
     if (this.$data.cancelEmailSecret != null) {
       const link = `${verifyUrl}?action=cancelchange&id=${encodeURIComponent(
-        this.guid
+        this.guid,
       )}&secret=${encodeURIComponent(this.$data.cancelEmailSecret)}`;
       success =
         success &&
@@ -1112,7 +1114,7 @@ export default class User extends AbleObject<UserData> {
               newEmail: this.$data.newEmailAddress ?? this.$data.email,
             },
           },
-          this
+          this,
         ));
     }
 
@@ -1284,7 +1286,7 @@ export default class User extends AbleObject<UserData> {
       default:
         this.$data.salt = nanoid();
         this.$data.password = sha256(password + this.$data.salt).toString(
-          Base64
+          Base64,
         );
         break;
     }
@@ -1447,39 +1449,46 @@ export default class User extends AbleObject<UserData> {
    * @param data The input data from the client.
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
-  public async $removeTOTPSecret(data: {
+  public async $removeTOTPSecret(data?: {
     password: string;
     code: string;
   }): Promise<{ result: boolean; message: string }> {
-    if (!this.$checkPassword(data.password ?? '')) {
-      return { result: false, message: 'Incorrect password.' };
-    }
-
-    if (this.$data.totpSecret == null) {
-      return { result: false, message: "You don't have a 2FA secret." };
-    }
+    const tilmeld = enforceTilmeld(this);
 
-    if (
-      data.code == null ||
-      typeof data.code !== 'string' ||
-      data.code.length !== 6
-    ) {
-      return { result: false, message: '2FA code is invalid.' };
-    }
+    if (data) {
+      if (!this.$checkPassword(data.password ?? '')) {
+        return { result: false, message: 'Incorrect password.' };
+      }
 
-    const tilmeld = enforceTilmeld(this);
+      if (
+        data.code == null ||
+        typeof data.code !== 'string' ||
+        data.code.length !== 6
+      ) {
+        return { result: false, message: '2FA code is invalid.' };
+      }
 
-    const totp = new TOTP({
-      issuer: tilmeld.config.appName,
-      label: this.$data.username,
-      algorithm: 'SHA1',
-      digits: 6,
-      period: 30,
-      secret: this.$data.totpSecret,
-    });
+      if (this.$data.totpSecret == null) {
+        return { result: false, message: "You don't have a 2FA secret." };
+      }
 
-    if (totp.validate({ token: data.code, window: 2 }) == null) {
-      return { result: false, message: '2FA code is incorrect.' };
+      const totp = new TOTP({
+        issuer: tilmeld.config.appName,
+        label: this.$data.username,
+        algorithm: 'SHA1',
+        digits: 6,
+        period: 30,
+        secret: this.$data.totpSecret,
+      });
+
+      if (totp.validate({ token: data.code, window: 2 }) == null) {
+        return { result: false, message: '2FA code is incorrect.' };
+      }
+    } else if (!tilmeld.gatekeeper('tilmeld/admin')) {
+      return {
+        result: false,
+        message: 'You must provide your password and 2FA code.',
+      };
     }
 
     delete this.$data.totpSecret;
@@ -1487,7 +1496,7 @@ export default class User extends AbleObject<UserData> {
     if (await this.$save()) {
       return {
         result: true,
-        message: 'Your two factor secret has been removed.',
+        message: 'Two factor secret has been removed.',
       };
     } else {
       return { result: false, message: "Couldn't remove two factor secret." };
@@ -1505,10 +1514,16 @@ export default class User extends AbleObject<UserData> {
       if (this.$data.username == null || !this.$data.username.length) {
         return { result: false, message: 'Please specify a username.' };
       }
-      if (
-        tilmeld.config.maxUsernameLength > 0 &&
-        this.$data.username.length > tilmeld.config.maxUsernameLength
-      ) {
+      if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+        return {
+          result: false,
+          message:
+            'Usernames must be at least ' +
+            tilmeld.config.minUsernameLength +
+            ' characters.',
+        };
+      }
+      if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -1521,7 +1536,7 @@ export default class User extends AbleObject<UserData> {
       if (
         difference(
           this.$data.username.split(''),
-          tilmeld.config.validChars.split('')
+          tilmeld.config.validChars.split(''),
         ).length
       ) {
         return {
@@ -1548,7 +1563,7 @@ export default class User extends AbleObject<UserData> {
       }
       const test = await this.$nymph.getEntity(
         { class: tilmeld.User, skipAc: true },
-        selector
+        selector,
       );
       if (test != null) {
         return { result: false, message: 'That username is taken.' };
@@ -1576,10 +1591,16 @@ export default class User extends AbleObject<UserData> {
       if (this.$data.username == null || !this.$data.username.length) {
         return { result: false, message: 'Please specify an email.' };
       }
-      if (
-        tilmeld.config.maxUsernameLength > 0 &&
-        this.$data.username.length > tilmeld.config.maxUsernameLength
-      ) {
+      if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+        return {
+          result: false,
+          message:
+            'Emails must be at least ' +
+            tilmeld.config.minUsernameLength +
+            ' characters.',
+        };
+      }
+      if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -1622,7 +1643,7 @@ export default class User extends AbleObject<UserData> {
     }
     const test = await this.$nymph.getEntity(
       { class: tilmeld.User, skipAc: true },
-      selector
+      selector,
     );
     if (test != null) {
       return {
@@ -1666,7 +1687,7 @@ export default class User extends AbleObject<UserData> {
     }
     const test = await this.$nymph.getEntity(
       { class: tilmeld.User, skipAc: true },
-      selector
+      selector,
     );
     if (test != null) {
       return { result: false, message: 'Phone number is in use.' };
@@ -1762,7 +1783,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['defaultPrimary', true],
-          }
+          },
         );
         if (parent != null) {
           generatedPrimaryGroup.parent = parent;
@@ -1784,7 +1805,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['defaultPrimary', true],
-          }
+          },
         );
         if (group != null) {
           this.$data.group = group;
@@ -1799,7 +1820,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['unverifiedSecondary', true],
-          }
+          },
         );
       } else {
         // Add the default secondaries.
@@ -1808,7 +1829,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['defaultSecondary', true],
-          }
+          },
         );
       }
 
@@ -1858,7 +1879,7 @@ export default class User extends AbleObject<UserData> {
                 userPhone: this.$data.phone,
               },
             },
-            this
+            this,
           );
         }
 
@@ -1961,7 +1982,7 @@ export default class User extends AbleObject<UserData> {
       this.$data.abilities?.includes('system/admin')
     ) {
       throw new BadDataError(
-        "You don't have the authority to modify system admins."
+        "You don't have the authority to modify system admins.",
       );
     }
 
@@ -2079,10 +2100,10 @@ export default class User extends AbleObject<UserData> {
                 new Date(
                   strtotime(
                     '+' + tilmeld.config.emailRateLimit,
-                    Math.floor(this.$data.emailChangeDate / 1000)
-                  ) * 1000
+                    Math.floor(this.$data.emailChangeDate / 1000),
+                  ) * 1000,
                 ).toString() +
-                ' to change your email address again.'
+                ' to change your email address again.',
             );
           } else {
             if (
@@ -2237,7 +2258,7 @@ export default class User extends AbleObject<UserData> {
       this.$data.abilities?.includes('system/admin')
     ) {
       throw new BadDataError(
-        "You don't have the authority to delete system admins."
+        "You don't have the authority to delete system admins.",
       );
     }
     if (tilmeld.User.current(true).$is(this)) {
@@ -2262,7 +2283,7 @@ export default class User extends AbleObject<UserData> {
       ? TilmeldBeforeLogoutCallback
       : T extends 'afterLogout'
       ? TilmeldAfterLogoutCallback
-      : never
+      : never,
   ) {
     const prop = (event + 'Callbacks') as T extends 'checkUsername'
       ? 'checkUsernameCallbacks'
@@ -2303,7 +2324,7 @@ export default class User extends AbleObject<UserData> {
       ? TilmeldBeforeLogoutCallback
       : T extends 'afterLogout'
       ? TilmeldAfterLogoutCallback
-      : never
+      : never,
   ) {
     const prop = (event + 'Callbacks') as T extends 'checkUsername'
       ? 'checkUsernameCallbacks'

package/src/conf/d.ts

@@ -206,7 +206,11 @@ export interface Config {
    */
   validEmailRegexNotice: string;
   /**
-   * The maximum length for usernames. Infinity for unlimited.
+   * The minimum length for usernames.
+   */
+  minUsernameLength: number;
+  /**
+   * The maximum length for usernames. `Infinity` for unlimited.
    */
   maxUsernameLength: number;
   /**
@@ -233,7 +237,7 @@ export interface Config {
   jwtBuilder: (
     config: Config,
     user: User & UserData,
-    switchToken?: boolean
+    switchToken?: boolean,
   ) => string;
   /**
    * Function to verify that a JWT was signed with the secret key, validate its
@@ -247,7 +251,7 @@ export interface Config {
   jwtExtract: (
     config: Config,
     token: string,
-    xsrfToken?: string
+    xsrfToken?: string,
   ) => { guid: string; issued: Date; expire: Date } | null;
   /**
    * The absolute path to the email template directory. Used by the default
@@ -264,7 +268,7 @@ export interface Config {
   configEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<EmailConfig>;
   /**
    * Send an email to a user. Uses `email-templates` by default.
@@ -294,7 +298,7 @@ export interface Config {
   sendEmail: (
     tilmeld: Tilmeld,
     options: EmailOptions,
-    user: User & UserData
+    user: User & UserData,
   ) => Promise<boolean>;
   /**
    * The address you'd like to receive a notification of registered users, if

package/src/conf/defaults.ts

@@ -49,6 +49,7 @@ export default {
   validEmailRegex:
     /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,
   validEmailRegexNotice: 'Email must be a correctly formatted address.',
+  minUsernameLength: 1,
   maxUsernameLength: 128,
   jwtSecret: '',
   jwtExpire: 60 * 60 * 24 * 7 * 8, // 8 weeks(ish)
@@ -68,7 +69,7 @@ export default {
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
       },
       secret,
-      { expiresIn: switchToken ? config.jwtSwitchExpire : config.jwtExpire }
+      { expiresIn: switchToken ? config.jwtSwitchExpire : config.jwtExpire },
     );
   },
   jwtExtract: (config, token, xsrfToken?) => {
@@ -128,14 +129,14 @@ export default {
   },
   sendEmail: async (tilmeld, options, user) => {
     const email = new Email(
-      await tilmeld.config.configEmail(tilmeld, options, user)
+      await tilmeld.config.configEmail(tilmeld, options, user),
     );
     try {
       const result = await email.send({
         ...options,
         template: path.join(
           tilmeld.config.emailTemplateDir,
-          options.template ?? '.'
+          options.template ?? '.',
         ),
         locals: {
           // System
@@ -205,13 +206,13 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         defaultPrimary: Joi.boolean(),
         defaultSecondary: Joi.boolean(),
         unverifiedSecondary: Joi.boolean(),
       }),
-      'Invalid Group: '
+      'Invalid Group: ',
     );
   },
   validatorUser: (user) => {
@@ -274,7 +275,7 @@ export default {
               name: 'control characters',
               invert: true,
             })
-            .max(256)
+            .max(256),
         ),
         inheritAbilities: Joi.boolean(),
         secret: Joi.string()
@@ -322,7 +323,7 @@ export default {
           .max(40)
           .pattern(/^[A-Z234567]+$/, 'base32 encoded unpadded'),
       }),
-      'Invalid User: '
+      'Invalid User: ',
     );
   },
 } as Config;

package/src/tilmeldJoiProps.ts

@@ -11,36 +11,36 @@ export default {
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acGroup: Joi.number().valid(
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acOther: Joi.number().valid(
     TilmeldAccessLevels.NO_ACCESS,
     TilmeldAccessLevels.READ_ACCESS,
     TilmeldAccessLevels.WRITE_ACCESS,
-    TilmeldAccessLevels.FULL_ACCESS
+    TilmeldAccessLevels.FULL_ACCESS,
   ),
   acRead: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
   acWrite: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
   acFull: Joi.array().items(
     Joi.alternatives().try(
       Joi.object().instance(User),
-      Joi.object().instance(Group)
-    )
+      Joi.object().instance(Group),
+    ),
   ),
 };