@nymphjs/tilmeld 1.0.0-beta.5 → 1.0.0-beta.50

package/src/User.ts

@@ -5,15 +5,17 @@ import {
   Selector,
   SerializedEntityData,
 } from '@nymphjs/nymph';
+import { humanSecret, nanoid } from '@nymphjs/guid';
 import { EmailOptions } from 'email-templates';
 import strtotime from 'locutus/php/datetime/strtotime';
 import Base64 from 'crypto-js/enc-base64';
 import sha256 from 'crypto-js/sha256';
 import md5 from 'crypto-js/md5';
 import { difference } from 'lodash';
-import { humanSecret, nanoid } from '@nymphjs/guid';
+import { TOTP, Secret } from 'otpauth';
+import { toDataURL } from 'qrcode';
 
-import type Tilmeld from './Tilmeld';
+import { enforceTilmeld } from './enforceTilmeld';
 import AbleObject from './AbleObject';
 import Group, { GroupData } from './Group';
 import {
@@ -24,23 +26,33 @@ import {
 } from './errors';
 
 export type EventType =
+  | 'checkUsername'
   | 'beforeRegister'
   | 'afterRegister'
   | 'beforeLogin'
   | 'afterLogin'
   | 'beforeLogout'
   | 'afterLogout';
+/**
+ * This is run when the user has entered an otherwise valid username into the
+ * signup form. It should return a result, which when false will stop the
+ * process and return the included message, disallowing the username.
+ */
+export type TilmeldCheckUsernameCallback = (
+  user: User & UserData,
+  data: { username: string },
+) => Promise<{ result: boolean; message?: string }>;
 /**
  * Theses are run before the user data checks, so the only checks before are
  * whether registration is allowed and whether the user is already registered.
  */
 export type TilmeldBeforeRegisterCallback = (
   user: User & UserData,
-  data: { password: string; additionalData?: { [k: string]: any } }
+  data: { password: string; additionalData?: { [k: string]: any } },
 ) => Promise<void>;
 export type TilmeldAfterRegisterCallback = (
   user: User & UserData,
-  result: { loggedin: boolean; message: string }
+  result: { loggedin: boolean; message: string },
 ) => Promise<void>;
 /**
  * These are run after the authentication checks, but before the login action.
@@ -51,20 +63,20 @@ export type TilmeldBeforeLoginCallback = (
     username: string;
     password: string;
     additionalData?: { [k: string]: any };
-  }
+  },
 ) => Promise<void>;
 /**
  * This is run before the transaction is committed, and you can perform
  * additional functions on the transaction, which is available in `user.$nymph`.
  */
 export type TilmeldAfterLoginCallback = (
-  user: User & UserData
+  user: User & UserData,
 ) => Promise<void>;
 export type TilmeldBeforeLogoutCallback = (
-  user: User & UserData
+  user: User & UserData,
 ) => Promise<void>;
 export type TilmeldAfterLogoutCallback = (
-  user: User & UserData
+  user: User & UserData,
 ) => Promise<void>;
 
 export type UserData = {
@@ -135,7 +147,8 @@ export type UserData = {
    */
   newEmailSecret?: string;
   /**
-   * The new email address.
+   * If the user has changed their email address, this is the new one, awaiting
+   * verification.
    */
   newEmailAddress?: string;
   /**
@@ -167,6 +180,15 @@ export type UserData = {
    * database.
    */
   passwordTemp?: string;
+  /**
+   * If set, this timestamp is the cutoff point for JWT issue dates. Any token
+   * issued before this date will not authenticate the user.
+   */
+  revokeTokenDate?: number;
+  /**
+   * Two factor auth secret.
+   */
+  totpSecret?: string;
 };
 
 /**
@@ -182,9 +204,9 @@ export default class User extends AbleObject<UserData> {
   /**
    * The instance of Tilmeld to use for queries.
    */
-  static tilmeld: Tilmeld;
   static ETYPE = 'tilmeld_user';
   static class = 'User';
+  private static checkUsernameCallbacks: TilmeldCheckUsernameCallback[] = [];
   private static beforeRegisterCallbacks: TilmeldBeforeRegisterCallback[] = [];
   private static afterRegisterCallbacks: TilmeldAfterRegisterCallback[] = [];
   private static beforeLoginCallbacks: TilmeldBeforeLoginCallback[] = [];
@@ -200,23 +222,33 @@ export default class User extends AbleObject<UserData> {
     '$register',
   ];
   private static DEFAULT_PRIVATE_DATA = [
+    // The things that are commented are there to show what is _not_ private.
+    'abilities',
+    // 'username',
+    // 'nameFirst',
+    // 'nameMiddle',
+    // 'nameLast',
+    // 'name',
     'email',
-    'originalEmail',
+    // 'avatar',
     'phone',
     'group',
     'groups',
-    'abilities',
     'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
+    'enabled',
     'secret',
-    'newEmailAddress',
+    'emailChangeDate',
     'newEmailSecret',
-    'cancelEmailAddress',
+    'newEmailAddress',
     'cancelEmailSecret',
-    'emailChangeDate',
+    'cancelEmailAddress',
+    'recoverSecret',
+    'recoverSecretDate',
+    'salt',
+    'password',
+    'passwordTemp',
+    'revokeTokenDate',
+    'totpSecret',
   ];
   private static DEFAULT_ALLOWLIST_DATA: string[] = [];
 
@@ -271,7 +303,7 @@ export default class User extends AbleObject<UserData> {
         {
           type: '&',
           ilike: ['username', username.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        }
+        },
       );
       if (entity != null) {
         return entity;
@@ -280,34 +312,33 @@ export default class User extends AbleObject<UserData> {
     return entity;
   }
 
-  static factorySync(guid?: string): User & UserData {
-    return super.factorySync(guid) as User & UserData;
+  static factorySync(): User & UserData {
+    return super.factorySync() as User & UserData;
   }
 
-  constructor(guid?: string) {
-    super(guid);
+  constructor() {
+    super();
 
-    if (this.guid == null) {
-      // Defaults.
-      this.$data.enabled = true;
-      this.$data.abilities = [];
-      this.$data.groups = [];
-      this.$data.inheritAbilities = true;
-      this.$updateDataProtection();
-    }
+    // Defaults.
+    this.$data.enabled = true;
+    this.$data.abilities = [];
+    this.$data.groups = [];
+    this.$data.inheritAbilities = true;
+    this.$updateDataProtection();
   }
 
   public static current(returnObjectIfNotExist: true): User & UserData;
   public static current(
-    returnObjectIfNotExist?: false
+    returnObjectIfNotExist?: false,
   ): (User & UserData) | null;
   public static current(
-    returnObjectIfNotExist?: boolean
+    returnObjectIfNotExist?: boolean,
   ): (User & UserData) | null {
-    if (this.tilmeld.currentUser == null) {
+    const tilmeld = enforceTilmeld(this);
+    if (tilmeld.currentUser == null) {
       return returnObjectIfNotExist ? this.factorySync() : null;
     }
-    return this.tilmeld.currentUser;
+    return tilmeld.currentUser;
   }
 
   /**
@@ -320,7 +351,8 @@ export default class User extends AbleObject<UserData> {
     recoveryType: 'username' | 'password';
     account: string;
   }): Promise<{ result: boolean; message: string }> {
-    if (!this.tilmeld.config.pwRecovery) {
+    const tilmeld = enforceTilmeld(this);
+    if (!tilmeld.config.pwRecovery) {
       return {
         result: false,
         message: 'Account recovery is not allowed.',
@@ -330,18 +362,15 @@ export default class User extends AbleObject<UserData> {
     let user: User & UserData;
     const options: EmailOptions = {};
 
-    if (
-      !this.tilmeld.config.emailUsernames &&
-      data.recoveryType === 'username'
-    ) {
+    if (!tilmeld.config.emailUsernames && data.recoveryType === 'username') {
       // Create a username recovery email.
 
       const getUser = await this.nymph.getEntity(
-        { class: this.tilmeld.User, skipAc: true },
+        { class: tilmeld.User, skipAc: true },
         {
           type: '&',
           ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
-        }
+        },
       );
 
       if (getUser == null) {
@@ -364,7 +393,7 @@ export default class User extends AbleObject<UserData> {
     } else if (data.recoveryType === 'password') {
       // Create a password recovery email.
 
-      const getUser = await this.tilmeld.User.factoryUsername(data.account);
+      const getUser = await tilmeld.User.factoryUsername(data.account);
 
       if (getUser.guid == null) {
         return {
@@ -391,14 +420,14 @@ export default class User extends AbleObject<UserData> {
       };
       options.locals = {
         recoverCode: getUser.recoverSecret,
-        timeLimit: this.tilmeld.config.pwRecoveryTimeLimit,
+        timeLimit: tilmeld.config.pwRecoveryTimeLimit,
       };
     } else {
       return { result: false, message: 'Invalid recovery type.' };
     }
 
     // Send the email.
-    if (await this.tilmeld.config.sendEmail(this.tilmeld, options, user)) {
+    if (await tilmeld.config.sendEmail(tilmeld, options, user)) {
       return {
         result: true,
         message:
@@ -421,22 +450,23 @@ export default class User extends AbleObject<UserData> {
     secret: string;
     password: string;
   }): Promise<{ result: boolean; message: string }> {
-    if (!this.tilmeld.config.pwRecovery) {
+    const tilmeld = enforceTilmeld(this);
+    if (!tilmeld.config.pwRecovery) {
       return {
         result: false,
         message: 'Account recovery is not allowed.',
       };
     }
 
-    const user = await this.tilmeld.User.factoryUsername(data.username);
+    const user = await tilmeld.User.factoryUsername(data.username);
 
     if (
       user.guid == null ||
       user.recoverSecret == null ||
       data.secret !== user.recoverSecret ||
       strtotime(
-        '+' + this.tilmeld.config.pwRecoveryTimeLimit,
-        Math.floor((user.recoverSecretDate ?? 0) / 1000)
+        '+' + tilmeld.config.pwRecoveryTimeLimit,
+        Math.floor((user.recoverSecretDate ?? 0) / 1000),
       ) *
         1000 <
         Date.now()
@@ -466,27 +496,30 @@ export default class User extends AbleObject<UserData> {
   }
 
   public static getClientConfig() {
+    const tilmeld = enforceTilmeld(this);
     return {
-      regFields: this.tilmeld.config.regFields,
-      userFields: this.tilmeld.config.userFields,
-      emailUsernames: this.tilmeld.config.emailUsernames,
-      allowRegistration: this.tilmeld.config.allowRegistration,
-      allowUsernameChange: this.tilmeld.config.allowUsernameChange,
-      pwRecovery: this.tilmeld.config.pwRecovery,
-      verifyEmail: this.tilmeld.config.verifyEmail,
-      unverifiedAccess: this.tilmeld.config.unverifiedAccess,
+      regFields: tilmeld.config.regFields,
+      userFields: tilmeld.config.userFields,
+      emailUsernames: tilmeld.config.emailUsernames,
+      allowRegistration: tilmeld.config.allowRegistration,
+      allowUsernameChange: tilmeld.config.allowUsernameChange,
+      pwRecovery: tilmeld.config.pwRecovery,
+      verifyEmail: tilmeld.config.verifyEmail,
+      unverifiedAccess: tilmeld.config.unverifiedAccess,
     };
   }
 
   public static async loginUser(data: {
     username: string;
     password: string;
+    code?: string;
     additionalData?: { [k: string]: any };
   }) {
+    const tilmeld = enforceTilmeld(this);
     if (!('username' in data) || !data.username.length) {
       return { result: false, message: 'Incorrect login/password.' };
     }
-    const user = await this.tilmeld.User.factoryUsername(data.username);
+    const user = await tilmeld.User.factoryUsername(data.username);
     const result: { result: boolean; message: string; user?: User & UserData } =
       await user.$login(data);
     if (result.result) {
@@ -499,22 +532,41 @@ export default class User extends AbleObject<UserData> {
   public async $login(data: {
     username: string;
     password: string;
+    code?: string;
     additionalData?: { [k: string]: any };
   }) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.guid == null) {
       return { result: false, message: 'Incorrect login/password.' };
     }
     if (!this.$data.enabled) {
       return { result: false, message: 'This user is disabled.' };
     }
-    if (this.$gatekeeper()) {
+    if (await this.$gatekeeper()) {
       return { result: true, message: 'You are already logged in.' };
     }
     if (!this.$checkPassword(data.password)) {
       return { result: false, message: 'Incorrect login/password.' };
     }
 
+    if (this.$data.totpSecret != null) {
+      if (
+        data.code == null ||
+        typeof data.code !== 'string' ||
+        data.code.length !== 6
+      ) {
+        return {
+          result: false,
+          needTOTP: true,
+          message: 'You need to provide a 2FA code.',
+        };
+      }
+
+      if (!this.$checkTOTPCode(data.code)) {
+        return { result: false, message: 'Incorrect 2FA code.' };
+      }
+    }
+
     try {
       for (let callback of (this.constructor as typeof User)
         .beforeLoginCallbacks) {
@@ -530,7 +582,79 @@ export default class User extends AbleObject<UserData> {
     }
 
     // Authentication was successful, attempt to login.
-    if (!tilmeld.login(this, true)) {
+    if (!(await tilmeld.login(this, true))) {
+      return { result: false, message: 'Incorrect login/password.' };
+    }
+
+    for (let callback of (this.constructor as typeof User)
+      .afterLoginCallbacks) {
+      if (callback) {
+        await callback(this);
+      }
+    }
+
+    // Login was successful.
+    return { result: true, message: 'You are logged in.' };
+  }
+
+  public async $switchUser(data?: { additionalData?: { [k: string]: any } }) {
+    const tilmeld = enforceTilmeld(this);
+    if (this.guid == null) {
+      return { result: false, message: 'Incorrect login/password.' };
+    }
+
+    let user = tilmeld.User.current();
+
+    if (!user || user.guid == null) {
+      return { result: false, message: "You're not logged in." };
+    }
+
+    const isCurrentUser = user != null && user.$is(this);
+
+    if (isCurrentUser) {
+      return { result: false, message: "You can't switch to yourself." };
+    }
+
+    const toAbilities = this.$data.abilities || [];
+    const fromAbilities = user.abilities || [];
+
+    if (
+      fromAbilities.indexOf('tilmeld/switch') === -1 &&
+      fromAbilities.indexOf('system/admin') === -1
+    ) {
+      return {
+        result: false,
+        message: "You don't have permission to switch users.",
+      };
+    }
+
+    if (
+      toAbilities.indexOf('system/admin') !== -1 ||
+      toAbilities.indexOf('tilmeld/admin') !== -1
+    ) {
+      return { result: false, message: "You can't switch to an admin." };
+    }
+
+    try {
+      for (let callback of (this.constructor as typeof User)
+        .beforeLoginCallbacks) {
+        if (callback) {
+          await callback(this, {
+            username: this.$data.username || '',
+            password: '',
+            ...(data || {}),
+          });
+        }
+      }
+    } catch (e: any) {
+      return {
+        result: false,
+        message: e.message,
+      };
+    }
+
+    // Authentication was successful, attempt to login.
+    if (!(await tilmeld.loginSwitch(this, true))) {
       return { result: false, message: 'Incorrect login/password.' };
     }
 
@@ -550,7 +674,7 @@ export default class User extends AbleObject<UserData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $logout() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
 
     try {
       for (let callback of (this.constructor as typeof User)
@@ -566,7 +690,7 @@ export default class User extends AbleObject<UserData> {
       };
     }
 
-    tilmeld.logout();
+    await tilmeld.logout();
 
     for (let callback of (this.constructor as typeof User)
       .afterLogoutCallbacks) {
@@ -592,36 +716,36 @@ export default class User extends AbleObject<UserData> {
     );
   }
 
-  /**
-   * Get the user's group descendants.
-   */
-  public async $getDescendantGroups(): Promise<(Group & GroupData)[]> {
-    if (this.$descendantGroups == null) {
-      this.$descendantGroups = [];
-      if (this.$data.group != null) {
-        this.$descendantGroups = await this.$data.group.$getDescendants();
-      }
-      for (let curGroup of this.$data.groups ?? []) {
-        this.$descendantGroups = this.$descendantGroups?.concat(
-          await curGroup.$getDescendants()
-        );
-      }
+  public $getGid() {
+    if (this.$data.group) {
+      return this.$data.group.guid;
     }
-    return this.$descendantGroups;
+    return null;
+  }
+
+  public $getGids() {
+    if (this.$data.groups) {
+      return this.$data.groups
+        .map((group) => group.guid)
+        .filter((guid) => guid != null) as string[];
+    }
+    return null;
   }
 
   /**
    * Get the user's group descendants.
    */
-  public $getDescendantGroupsSync(): (Group & GroupData)[] {
+  public async $getDescendantGroups(): Promise<(Group & GroupData)[]> {
     if (this.$descendantGroups == null) {
       this.$descendantGroups = [];
       if (this.$data.group != null) {
-        this.$descendantGroups = this.$data.group.$getDescendantsSync();
+        await this.$data.group.$wake();
+        this.$descendantGroups = await this.$data.group.$getDescendants();
       }
+      await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
       for (let curGroup of this.$data.groups ?? []) {
         this.$descendantGroups = this.$descendantGroups?.concat(
-          curGroup.$getDescendantsSync()
+          await curGroup.$getDescendants(),
         );
       }
     }
@@ -629,18 +753,42 @@ export default class User extends AbleObject<UserData> {
   }
 
   public $jsonAcceptData(input: EntityJson, allowConflict = false) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    this.$referenceWake();
+    const tilmeld = enforceTilmeld(this);
+    this.$check();
 
     if (
       'abilities' in input.data &&
-      input.data.abilities.indexOf('system/admin') !== -1 &&
-      this.$data.abilities?.indexOf('system/admin') === -1 &&
-      tilmeld.gatekeeper('tilmeld/admin') &&
-      !tilmeld.gatekeeper('system/admin')
+      input.data.abilities?.includes('system/admin') !==
+        this.$data.abilities?.includes('system/admin') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke system/admin.",
+      );
+    }
+
+    if (
+      'abilities' in input.data &&
+      input.data.abilities?.includes('tilmeld/admin') !==
+        this.$data.abilities?.includes('tilmeld/admin') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to make this user a system admin."
+        "You don't have the authority to grant or revoke tilmeld/admin.",
+      );
+    }
+
+    if (
+      'abilities' in input.data &&
+      input.data.abilities?.includes('tilmeld/switch') !==
+        this.$data.abilities?.includes('tilmeld/switch') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/switch.",
       );
     }
 
@@ -649,18 +797,42 @@ export default class User extends AbleObject<UserData> {
   }
 
   public $jsonAcceptPatch(patch: EntityPatch, allowConflict = false) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
-    this.$referenceWake();
+    const tilmeld = enforceTilmeld(this);
+    this.$check();
 
     if (
       'abilities' in patch.set &&
-      patch.set.abilities.indexOf('system/admin') !== -1 &&
-      this.$data.abilities?.indexOf('system/admin') === -1 &&
-      tilmeld.gatekeeper('tilmeld/admin') &&
-      !tilmeld.gatekeeper('system/admin')
+      patch.set.abilities?.includes('system/admin') !==
+        this.$data.abilities?.includes('system/admin') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke system/admin.",
+      );
+    }
+
+    if (
+      'abilities' in patch.set &&
+      patch.set.abilities?.includes('tilmeld/admin') !==
+        this.$data.abilities?.includes('tilmeld/admin') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke tilmeld/admin.",
+      );
+    }
+
+    if (
+      'abilities' in patch.set &&
+      patch.set.abilities?.includes('tilmeld/switch') !==
+        this.$data.abilities?.includes('tilmeld/switch') &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
     ) {
       throw new BadDataError(
-        "You don't have the authority to make this user a system admin."
+        "You don't have the authority to grant or revoke tilmeld/switch.",
       );
     }
 
@@ -679,7 +851,7 @@ export default class User extends AbleObject<UserData> {
    * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
    */
   public $updateDataProtection(givenUser?: User & UserData) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     let user = givenUser ?? tilmeld.User.current();
 
     this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
@@ -703,8 +875,13 @@ export default class User extends AbleObject<UserData> {
       // Users can check to see what abilities they have.
       this.$clientEnabledMethods.push('$gatekeeper');
       this.$clientEnabledMethods.push('$changePassword');
+      this.$clientEnabledMethods.push('$revokeCurrentTokens');
       this.$clientEnabledMethods.push('$logout');
       this.$clientEnabledMethods.push('$sendEmailVerification');
+      this.$clientEnabledMethods.push('$hasTOTPSecret');
+      this.$clientEnabledMethods.push('$getNewTOTPSecret');
+      this.$clientEnabledMethods.push('$saveTOTPSecret');
+      this.$clientEnabledMethods.push('$removeTOTPSecret');
     }
 
     if (
@@ -713,7 +890,9 @@ export default class User extends AbleObject<UserData> {
         abilities.indexOf('system/admin') !== -1)
     ) {
       // Users who can edit other users can see most of their data.
-      this.$privateData = ['password', 'salt'];
+      this.$privateData = ['password', 'salt', 'totpSecret'];
+      this.$clientEnabledMethods.push('$hasTOTPSecret');
+      this.$clientEnabledMethods.push('$removeTOTPSecret');
       this.$allowlistData = undefined;
     } else if (isCurrentUser || isNewUser) {
       // Users can see their own data, and edit some of it.
@@ -734,17 +913,56 @@ export default class User extends AbleObject<UserData> {
         this.$allowlistData.push('phone');
       }
       this.$privateData = [
+        // The things that are commented are there to show what is _not_ private.
+        // 'abilities',
+        // 'username',
+        // 'nameFirst',
+        // 'nameMiddle',
+        // 'nameLast',
+        // 'name',
+        // 'email',
+        // 'avatar',
+        // 'phone',
+        // 'group',
+        // 'groups',
+        // 'inheritAbilities',
+        'enabled',
         'secret',
+        'emailChangeDate',
         'newEmailSecret',
-        'cancelEmailAddress',
+        // 'newEmailAddress',
         'cancelEmailSecret',
-        'emailChangeDate',
+        'cancelEmailAddress',
         'recoverSecret',
         'recoverSecretDate',
-        'password',
         'salt',
+        'password',
+        'passwordTemp',
+        // 'revokeTokenDate',
+        'totpSecret',
       ];
     }
+
+    if (
+      user != null &&
+      !isCurrentUser &&
+      (abilities.indexOf('tilmeld/switch') !== -1 ||
+        abilities.indexOf('system/admin') !== -1)
+    ) {
+      // Users with this ability can switch to other users.
+      this.$clientEnabledMethods.push('$switchUser');
+    }
+  }
+
+  public $updateGroupDataProtection() {
+    if (this.$data.group != null && !this.$data.group.$asleep()) {
+      this.$data.group.$updateDataProtection();
+    }
+    for (let group of this.$data.groups ?? []) {
+      if (!group.$asleep()) {
+        group.$updateDataProtection();
+      }
+    }
   }
 
   /**
@@ -761,35 +979,43 @@ export default class User extends AbleObject<UserData> {
    * @param ability The ability.
    * @returns True or false.
    */
-  public $gatekeeper(ability?: string): boolean {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+  public async $gatekeeper(ability?: string): Promise<boolean> {
+    await this.$wake();
+    const tilmeld = enforceTilmeld(this);
     if (ability == null) {
       return tilmeld.User.current()?.$is(this) ?? false;
     }
     // Check the cache to see if we've already checked this user.
     if (this.$gatekeeperCache == null) {
-      let abilities = this.$data.abilities ?? [];
-      if (this.$data.inheritAbilities) {
-        for (let curGroup of this.$data.groups ?? []) {
-          if (curGroup.enabled) {
-            abilities = abilities.concat(curGroup.abilities ?? []);
-          }
-        }
-        if (
-          this.$data.group != null &&
-          this.$data.group.cdate != null &&
-          this.$data.group.enabled
-        ) {
-          abilities = abilities.concat(this.$data.group.abilities ?? []);
-        }
-      }
-      this.$gatekeeperCache = Object.fromEntries(
-        abilities.map((ability) => [ability, true])
-      );
+      this.$gatekeeperCache = await this.$getGatekeeperCache();
     }
     return (
       (ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-      !!this.$gatekeeperCache['system/admin']
+      !!this.$data.abilities?.includes('system/admin')
+    );
+  }
+
+  /**
+   * Build a gatekeeper cache object.
+   */
+  public async $getGatekeeperCache() {
+    await this.$wake();
+    let abilities = this.$data.abilities ?? [];
+    if (this.$data.inheritAbilities) {
+      await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+      for (let curGroup of this.$data.groups ?? []) {
+        if (curGroup.enabled) {
+          abilities = abilities.concat(curGroup.abilities ?? []);
+        }
+      }
+      await this.$data.group?.$wake();
+      const group = this.$data.group;
+      if (group != null && group.cdate != null && group.enabled) {
+        abilities = abilities.concat(group.abilities ?? []);
+      }
+    }
+    return Object.fromEntries(
+      abilities.map((ability) => [ability, true as true]),
     );
   }
 
@@ -806,7 +1032,7 @@ export default class User extends AbleObject<UserData> {
    * @returns True on success, false on failure.
    */
   public async $sendEmailVerification() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.guid == null) {
       return false;
     }
@@ -818,7 +1044,7 @@ export default class User extends AbleObject<UserData> {
 
     if (this.$data.secret != null) {
       const link = `${verifyUrl}?action=verify&id=${encodeURIComponent(
-        this.guid
+        this.guid,
       )}&secret=${encodeURIComponent(this.$data.secret)}`;
       success =
         success &&
@@ -836,13 +1062,13 @@ export default class User extends AbleObject<UserData> {
               verifyLink: link,
             },
           },
-          this
+          this,
         ));
     }
 
     if (this.$data.newEmailSecret != null) {
       const link = `${verifyUrl}?action=verifychange&id=${encodeURIComponent(
-        this.guid
+        this.guid,
       )}&secret=${encodeURIComponent(this.$data.newEmailSecret)}`;
       success =
         success &&
@@ -862,13 +1088,13 @@ export default class User extends AbleObject<UserData> {
               newEmail: this.$data.newEmailAddress,
             },
           },
-          this
+          this,
         ));
     }
 
     if (this.$data.cancelEmailSecret != null) {
       const link = `${verifyUrl}?action=cancelchange&id=${encodeURIComponent(
-        this.guid
+        this.guid,
       )}&secret=${encodeURIComponent(this.$data.cancelEmailSecret)}`;
       success =
         success &&
@@ -888,7 +1114,7 @@ export default class User extends AbleObject<UserData> {
               newEmail: this.$data.newEmailAddress ?? this.$data.email,
             },
           },
-          this
+          this,
         ));
     }
 
@@ -901,13 +1127,16 @@ export default class User extends AbleObject<UserData> {
    * @param group The group.
    * @returns True if the user is already in the group. The resulting array of groups if the user was not.
    */
-  public $addGroup(group: Group & GroupData) {
-    if (this.$data.groups == null) {
-      this.$data.groups = [];
+  public async $addGroup(group: Group & GroupData) {
+    await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+    let groups = this.$data.groups;
+    if (groups == null) {
+      groups = [];
     }
-    if (!group.$inArray(this.$data.groups)) {
-      this.$data.groups.push(group);
-      return this.$data.groups;
+    if (!group.$inArray(groups)) {
+      groups.push(group);
+      this.$data.groups = groups;
+      return groups;
     }
     return true;
   }
@@ -919,7 +1148,7 @@ export default class User extends AbleObject<UserData> {
    * @returns True if the passwords match, otherwise false.
    */
   public $checkPassword(password: string) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     switch (tilmeld.config.pwMethod) {
       case 'plain':
         return this.$data.password === password;
@@ -940,10 +1169,12 @@ export default class User extends AbleObject<UserData> {
    * @param group The group.
    * @returns True if the user wasn't in the group. The resulting array of groups if the user was.
    */
-  public $delGroup(group: Group & GroupData) {
-    if (this.$data.groups != null && group.$inArray(this.$data.groups)) {
+  public async $delGroup(group: Group & GroupData) {
+    await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+    let groups = this.$data.groups || [];
+    if (this.$data.groups != null && group.$inArray(groups)) {
       const newGroups: (Group & GroupData)[] = [];
-      for (let curGroup of this.$data.groups) {
+      for (let curGroup of groups) {
         if (!group.$is(curGroup)) {
           newGroups.push(curGroup);
         }
@@ -960,7 +1191,7 @@ export default class User extends AbleObject<UserData> {
    * @param group The group, or the group's GUID.
    * @returns True or false.
    */
-  public $inGroup(group: (Group & GroupData) | string) {
+  public async $inGroup(group: (Group & GroupData) | string) {
     if (typeof group === 'string') {
       if (this.$data.group?.guid === group) {
         return true;
@@ -983,16 +1214,19 @@ export default class User extends AbleObject<UserData> {
    * @param group The group, or the group's GUID.
    * @returns True or false.
    */
-  public $isDescendant(group: (Group & GroupData) | string) {
+  public async $isDescendant(group: (Group & GroupData) | string) {
     // Check to see if the user is in a descendant group of the given group.
+    await this.$data.group?.$wake();
     if (
+      this.$data.group != null &&
       this.$data.group?.cdate != null &&
-      this.$data.group.$isDescendant(group)
+      (await this.$data.group?.$isDescendant(group))
     ) {
       return true;
     }
+    await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
     for (let curGroup of this.$data.groups ?? []) {
-      if (curGroup.$isDescendant(group)) {
+      if (await curGroup.$isDescendant(group)) {
         return true;
       }
     }
@@ -1008,6 +1242,7 @@ export default class User extends AbleObject<UserData> {
   public async $changePassword(data: {
     newPassword: string;
     currentPassword: string;
+    revokeCurrentTokens?: boolean;
   }): Promise<{ result: boolean; message: string }> {
     if (!('newPassword' in data) || !data.newPassword.length) {
       return { result: false, message: 'Please specify a password.' };
@@ -1016,7 +1251,14 @@ export default class User extends AbleObject<UserData> {
       return { result: false, message: 'Incorrect password.' };
     }
     this.$data.passwordTemp = data.newPassword;
+    if (data.revokeCurrentTokens) {
+      this.$data.revokeTokenDate = Date.now();
+    }
     if (await this.$save()) {
+      if (data.revokeCurrentTokens) {
+        const tilmeld = enforceTilmeld(this);
+        await tilmeld.login(this, true);
+      }
       return { result: true, message: 'Your password has been changed.' };
     } else {
       return { result: false, message: "Couldn't save new password." };
@@ -1030,7 +1272,7 @@ export default class User extends AbleObject<UserData> {
    * @returns The resulting password or hash which is stored in the entity.
    */
   public $password(password: string) {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     switch (tilmeld.config.pwMethod) {
       case 'plain':
         delete this.$data.salt;
@@ -1044,28 +1286,244 @@ export default class User extends AbleObject<UserData> {
       default:
         this.$data.salt = nanoid();
         this.$data.password = sha256(password + this.$data.salt).toString(
-          Base64
+          Base64,
         );
         break;
     }
     return this.$data.password;
   }
 
+  /**
+   * A frontend accessible method to revoke all currently issued tokens.
+   *
+   * @param data The input data from the client.
+   * @returns An object with a boolean 'result' entry and a 'message' entry.
+   */
+  public async $revokeCurrentTokens(data: {
+    password: string;
+  }): Promise<{ result: boolean; message: string }> {
+    if (!this.$checkPassword(data.password ?? '')) {
+      return { result: false, message: 'Incorrect password.' };
+    }
+
+    this.$data.revokeTokenDate = Date.now();
+
+    if (await this.$save()) {
+      const tilmeld = enforceTilmeld(this);
+      await tilmeld.login(this, true);
+      return {
+        result: true,
+        message: 'You have logged out of all other sessions.',
+      };
+    } else {
+      return { result: false, message: "Couldn't save revocation date." };
+    }
+  }
+
+  public async $hasTOTPSecret() {
+    return this.$data.totpSecret != null;
+  }
+
+  /**
+   * Check the given code against the user's TOTP secret.
+   *
+   * @param code The code in question.
+   * @returns True if the code is valid, otherwise false.
+   */
+  public $checkTOTPCode(code: string) {
+    if (this.$data.totpSecret == null) {
+      return false;
+    }
+
+    const tilmeld = enforceTilmeld(this);
+
+    const totp = new TOTP({
+      issuer: tilmeld.config.appName,
+      label: this.$data.username,
+      algorithm: 'SHA1',
+      digits: 6,
+      period: 30,
+      secret: this.$data.totpSecret,
+    });
+
+    return totp.validate({ token: code, window: 2 }) != null;
+  }
+
+  /**
+   * A frontend accessible method to generate a new TOTP secret.
+   *
+   * @returns An object with 'uri', 'qrcode', and 'secret'.
+   */
+  public async $getNewTOTPSecret() {
+    const tilmeld = enforceTilmeld(this);
+
+    if (this.$data.totpSecret != null) {
+      throw new BadDataError('You already have a 2FA secret.');
+    }
+
+    const secret = new Secret();
+
+    const totp = new TOTP({
+      issuer: tilmeld.config.appName,
+      label: this.$data.username,
+      algorithm: 'SHA1',
+      digits: 6,
+      period: 30,
+      secret,
+    });
+
+    const uri = totp.toString();
+
+    const qrcode = await toDataURL(uri);
+
+    return {
+      uri,
+      qrcode,
+      secret: secret.base32,
+    };
+  }
+
+  /**
+   * A frontend accessible method to save a TOTP secret into the user's account.
+   *
+   * @param data The input data from the client.
+   * @returns An object with a boolean 'result' entry and a 'message' entry.
+   */
+  public async $saveTOTPSecret(data: {
+    password: string;
+    secret: string;
+    code: string;
+  }): Promise<{ result: boolean; message: string }> {
+    if (!this.$checkPassword(data.password ?? '')) {
+      return { result: false, message: 'Incorrect password.' };
+    }
+
+    if (this.$data.totpSecret != null) {
+      return { result: false, message: 'You already have a 2FA secret.' };
+    }
+
+    if (
+      data.secret == null ||
+      typeof data.secret !== 'string' ||
+      data.secret === ''
+    ) {
+      return { result: false, message: '2FA secret is invalid.' };
+    }
+
+    if (
+      data.code == null ||
+      typeof data.code !== 'string' ||
+      data.code.length !== 6
+    ) {
+      return { result: false, message: '2FA code is invalid.' };
+    }
+
+    const tilmeld = enforceTilmeld(this);
+
+    const totp = new TOTP({
+      issuer: tilmeld.config.appName,
+      label: this.$data.username,
+      algorithm: 'SHA1',
+      digits: 6,
+      period: 30,
+      secret: data.secret,
+    });
+
+    if (totp.validate({ token: data.code, window: 2 }) == null) {
+      return { result: false, message: '2FA code is incorrect.' };
+    }
+
+    this.$data.totpSecret = data.secret;
+
+    if (await this.$save()) {
+      return { result: true, message: 'Your two factor secret is now set.' };
+    } else {
+      return { result: false, message: "Couldn't save two factor secret." };
+    }
+  }
+
+  /**
+   * A frontend accessible method to remove the TOTP secret from the user's
+   * account.
+   *
+   * @param data The input data from the client.
+   * @returns An object with a boolean 'result' entry and a 'message' entry.
+   */
+  public async $removeTOTPSecret(data?: {
+    password: string;
+    code: string;
+  }): Promise<{ result: boolean; message: string }> {
+    const tilmeld = enforceTilmeld(this);
+
+    if (data) {
+      if (!this.$checkPassword(data.password ?? '')) {
+        return { result: false, message: 'Incorrect password.' };
+      }
+
+      if (
+        data.code == null ||
+        typeof data.code !== 'string' ||
+        data.code.length !== 6
+      ) {
+        return { result: false, message: '2FA code is invalid.' };
+      }
+
+      if (this.$data.totpSecret == null) {
+        return { result: false, message: "You don't have a 2FA secret." };
+      }
+
+      const totp = new TOTP({
+        issuer: tilmeld.config.appName,
+        label: this.$data.username,
+        algorithm: 'SHA1',
+        digits: 6,
+        period: 30,
+        secret: this.$data.totpSecret,
+      });
+
+      if (totp.validate({ token: data.code, window: 2 }) == null) {
+        return { result: false, message: '2FA code is incorrect.' };
+      }
+    } else if (!tilmeld.gatekeeper('tilmeld/admin')) {
+      return {
+        result: false,
+        message: 'You must provide your password and 2FA code.',
+      };
+    }
+
+    delete this.$data.totpSecret;
+
+    if (await this.$save()) {
+      return {
+        result: true,
+        message: 'Two factor secret has been removed.',
+      };
+    } else {
+      return { result: false, message: "Couldn't remove two factor secret." };
+    }
+  }
+
   /**
    * Check that a username is valid.
    *
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkUsername(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (!tilmeld.config.emailUsernames) {
       if (this.$data.username == null || !this.$data.username.length) {
         return { result: false, message: 'Please specify a username.' };
       }
-      if (
-        tilmeld.config.maxUsernameLength > 0 &&
-        this.$data.username.length > tilmeld.config.maxUsernameLength
-      ) {
+      if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+        return {
+          result: false,
+          message:
+            'Usernames must be at least ' +
+            tilmeld.config.minUsernameLength +
+            ' characters.',
+        };
+      }
+      if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -1078,7 +1536,7 @@ export default class User extends AbleObject<UserData> {
       if (
         difference(
           this.$data.username.split(''),
-          tilmeld.config.validChars.split('')
+          tilmeld.config.validChars.split(''),
         ).length
       ) {
         return {
@@ -1105,12 +1563,24 @@ export default class User extends AbleObject<UserData> {
       }
       const test = await this.$nymph.getEntity(
         { class: tilmeld.User, skipAc: true },
-        selector
+        selector,
       );
       if (test != null) {
         return { result: false, message: 'That username is taken.' };
       }
 
+      for (let callback of (this.constructor as typeof User)
+        .checkUsernameCallbacks) {
+        if (callback) {
+          const result = await callback(this, {
+            username: this.$data.username,
+          });
+          if (!result.result) {
+            return { message: 'Username is not available.', ...result };
+          }
+        }
+      }
+
       return {
         result: true,
         message:
@@ -1121,10 +1591,16 @@ export default class User extends AbleObject<UserData> {
       if (this.$data.username == null || !this.$data.username.length) {
         return { result: false, message: 'Please specify an email.' };
       }
-      if (
-        tilmeld.config.maxUsernameLength > 0 &&
-        this.$data.username.length > tilmeld.config.maxUsernameLength
-      ) {
+      if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+        return {
+          result: false,
+          message:
+            'Emails must be at least ' +
+            tilmeld.config.minUsernameLength +
+            ' characters.',
+        };
+      }
+      if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -1144,7 +1620,7 @@ export default class User extends AbleObject<UserData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkEmail(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.$data.email == null || !this.$data.email.length) {
       if (tilmeld.config.verifyEmail) {
         return { result: false, message: 'Please specify an email.' };
@@ -1167,7 +1643,7 @@ export default class User extends AbleObject<UserData> {
     }
     const test = await this.$nymph.getEntity(
       { class: tilmeld.User, skipAc: true },
-      selector
+      selector,
     );
     if (test != null) {
       return {
@@ -1189,7 +1665,7 @@ export default class User extends AbleObject<UserData> {
    * @returns An object with a boolean 'result' entry and a 'message' entry.
    */
   public async $checkPhone(): Promise<{ result: boolean; message: string }> {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (this.$data.phone == null || !this.$data.phone.length) {
       return { result: false, message: 'Please specify a phone number.' };
     }
@@ -1211,7 +1687,7 @@ export default class User extends AbleObject<UserData> {
     }
     const test = await this.$nymph.getEntity(
       { class: tilmeld.User, skipAc: true },
-      selector
+      selector,
     );
     if (test != null) {
       return { result: false, message: 'Phone number is in use.' };
@@ -1228,7 +1704,7 @@ export default class User extends AbleObject<UserData> {
     password: string;
     additionalData?: { [k: string]: any };
   }): Promise<{ result: boolean; loggedin: boolean; message: string }> {
-    let tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = enforceTilmeld(this);
     if (!tilmeld.config.allowRegistration) {
       return {
         result: false,
@@ -1244,21 +1720,6 @@ export default class User extends AbleObject<UserData> {
       };
     }
 
-    try {
-      for (let callback of (this.constructor as typeof User)
-        .beforeRegisterCallbacks) {
-        if (callback) {
-          await callback(this, data);
-        }
-      }
-    } catch (e: any) {
-      return {
-        result: false,
-        loggedin: false,
-        message: e.message,
-      };
-    }
-
     if (!('password' in data) || !data.password.length) {
       return {
         result: false,
@@ -1290,9 +1751,29 @@ export default class User extends AbleObject<UserData> {
     const nymph = this.$nymph;
     const tnymph = await this.$nymph.startTransaction(transaction);
     this.$nymph = tnymph;
-    tilmeld = this.$nymph.tilmeld as Tilmeld;
+    tilmeld = enforceTilmeld(this);
+
+    let message = '';
+    let loggedin = false;
 
     try {
+      try {
+        for (let callback of (this.constructor as typeof User)
+          .beforeRegisterCallbacks) {
+          if (callback) {
+            await callback(this, data);
+          }
+        }
+      } catch (e: any) {
+        await tnymph.rollback(transaction);
+        this.$nymph = nymph;
+        return {
+          result: false,
+          loggedin: false,
+          message: e.message,
+        };
+      }
+
       // Add primary group.
       let generatedPrimaryGroup: (Group & GroupData) | null = null;
       if (tilmeld.config.generatePrimary) {
@@ -1307,7 +1788,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['defaultPrimary', true],
-          }
+          },
         );
         if (parent != null) {
           generatedPrimaryGroup.parent = parent;
@@ -1329,7 +1810,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['defaultPrimary', true],
-          }
+          },
         );
         if (group != null) {
           this.$data.group = group;
@@ -1344,7 +1825,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['unverifiedSecondary', true],
-          }
+          },
         );
       } else {
         // Add the default secondaries.
@@ -1353,7 +1834,7 @@ export default class User extends AbleObject<UserData> {
           {
             type: '&',
             equal: ['defaultSecondary', true],
-          }
+          },
         );
       }
 
@@ -1403,13 +1884,10 @@ export default class User extends AbleObject<UserData> {
                 userPhone: this.$data.phone,
               },
             },
-            this
+            this,
           );
         }
 
-        let message = '';
-        let loggedin = false;
-
         // Save the primary group.
         if (generatedPrimaryGroup != null) {
           generatedPrimaryGroup.user = this;
@@ -1439,7 +1917,7 @@ export default class User extends AbleObject<UserData> {
           tilmeld.config.unverifiedAccess &&
           !madeAdmin
         ) {
-          if (!tilmeld.login(this, true)) {
+          if (!(await tilmeld.login(this, true))) {
             throw new Error('An error occurred trying to log you in.');
           }
           message +=
@@ -1448,7 +1926,7 @@ export default class User extends AbleObject<UserData> {
             'registration.';
           loggedin = true;
         } else {
-          if (!tilmeld.login(this, true)) {
+          if (!(await tilmeld.login(this, true))) {
             throw new Error('An error occurred trying to log you in.');
           }
           message += "You're now registered and logged in!";
@@ -1464,20 +1942,6 @@ export default class User extends AbleObject<UserData> {
             });
           }
         }
-
-        try {
-          await tnymph.commit(transaction);
-          this.$nymph = nymph;
-          this.$nymph.tilmeld?.fillSession(this);
-        } catch (e: any) {
-          throw e;
-        }
-
-        return {
-          result: true,
-          loggedin,
-          message,
-        };
       } else {
         await tnymph.rollback(transaction);
         this.$nymph = nymph;
@@ -1492,10 +1956,24 @@ export default class User extends AbleObject<UserData> {
       this.$nymph = nymph;
       throw e;
     }
+
+    try {
+      await tnymph.commit(transaction);
+      this.$nymph = nymph;
+      await this.$nymph.tilmeld?.fillSession(this);
+    } catch (e: any) {
+      throw e;
+    }
+
+    return {
+      result: true,
+      loggedin,
+      message,
+    };
   }
 
   public async $save() {
-    let tilmeld = this.$nymph.tilmeld as Tilmeld;
+    let tilmeld = enforceTilmeld(this);
     if (this.$data.username == null || !this.$data.username.trim().length) {
       return false;
     }
@@ -1503,10 +1981,10 @@ export default class User extends AbleObject<UserData> {
     if (
       tilmeld.gatekeeper('tilmeld/admin') &&
       !tilmeld.gatekeeper('system/admin') &&
-      this.$gatekeeper('system/admin')
+      this.$data.abilities?.includes('system/admin')
     ) {
       throw new BadDataError(
-        "You don't have the authority to modify system admins."
+        "You don't have the authority to modify system admins.",
       );
     }
 
@@ -1624,10 +2102,10 @@ export default class User extends AbleObject<UserData> {
                 new Date(
                   strtotime(
                     '+' + tilmeld.config.emailRateLimit,
-                    Math.floor(this.$data.emailChangeDate / 1000)
-                  ) * 1000
+                    Math.floor(this.$data.emailChangeDate / 1000),
+                  ) * 1000,
                 ).toString() +
-                ' to change your email address again.'
+                ' to change your email address again.',
             );
           } else {
             if (
@@ -1693,21 +2171,20 @@ export default class User extends AbleObject<UserData> {
     const nymph = this.$nymph;
     const tnymph = await this.$nymph.startTransaction(transaction);
     this.$nymph = tnymph;
-    tilmeld = this.$nymph.tilmeld as Tilmeld;
+    tilmeld = enforceTilmeld(this);
 
-    if (
-      this.$data.group != null &&
-      this.$data.group.user != null &&
-      this.$is(this.$data.group.user)
-    ) {
+    const group = this.$data.group;
+    await group?.$wake();
+    if (group != null && group.user != null && this.$is(group.user)) {
       try {
         // Update the user's generated primary group.
-        this.$data.group.groupname = this.$data.username;
-        this.$data.group.avatar = this.$data.avatar;
-        this.$data.group.email = this.$data.email;
-        this.$data.group.name = this.$data.name;
-        this.$data.group.phone = this.$data.phone;
-        await this.$data.group.$saveSkipAC();
+        group.groupname = this.$data.username;
+        group.avatar = this.$data.avatar;
+        group.email = this.$data.email;
+        group.name = this.$data.name;
+        group.phone = this.$data.phone;
+        await group.$saveSkipAC();
+        this.$data.group = group;
       } catch (e: any) {
         await tnymph.rollback(transaction);
         this.$nymph = nymph;
@@ -1744,9 +2221,11 @@ export default class User extends AbleObject<UserData> {
       this.$gatekeeperCache = undefined;
       await tnymph.commit(transaction);
 
-      if ((nymph.tilmeld as Tilmeld).User.current(true).$is(this)) {
+      const tilmeld = enforceTilmeld(nymph);
+
+      if (tilmeld.User.current(true).$is(this)) {
         // Update the user in the session cache.
-        (nymph.tilmeld as Tilmeld).fillSession(this);
+        await tilmeld.fillSession(this);
       }
     } else {
       await tnymph.rollback(transaction);
@@ -1772,16 +2251,16 @@ export default class User extends AbleObject<UserData> {
   }
 
   public async $delete() {
-    const tilmeld = this.$nymph.tilmeld as Tilmeld;
+    const tilmeld = enforceTilmeld(this);
     if (!tilmeld.gatekeeper('tilmeld/admin')) {
       throw new BadDataError("You don't have the authority to delete users.");
     }
     if (
       !tilmeld.gatekeeper('system/admin') &&
-      this.$gatekeeper('system/admin')
+      this.$data.abilities?.includes('system/admin')
     ) {
       throw new BadDataError(
-        "You don't have the authority to delete system admins."
+        "You don't have the authority to delete system admins.",
       );
     }
     if (tilmeld.User.current(true).$is(this)) {
@@ -1792,7 +2271,9 @@ export default class User extends AbleObject<UserData> {
 
   public static on<T extends EventType>(
     event: T,
-    callback: T extends 'beforeRegister'
+    callback: T extends 'checkUsername'
+      ? TilmeldCheckUsernameCallback
+      : T extends 'beforeRegister'
       ? TilmeldBeforeRegisterCallback
       : T extends 'afterRegister'
       ? TilmeldAfterRegisterCallback
@@ -1804,9 +2285,11 @@ export default class User extends AbleObject<UserData> {
       ? TilmeldBeforeLogoutCallback
       : T extends 'afterLogout'
       ? TilmeldAfterLogoutCallback
-      : never
+      : never,
   ) {
-    const prop = (event + 'Callbacks') as T extends 'beforeRegister'
+    const prop = (event + 'Callbacks') as T extends 'checkUsername'
+      ? 'checkUsernameCallbacks'
+      : T extends 'beforeRegister'
       ? 'beforeRegisterCallbacks'
       : T extends 'afterRegister'
       ? 'afterRegisterCallbacks'
@@ -1829,7 +2312,9 @@ export default class User extends AbleObject<UserData> {
 
   public static off<T extends EventType>(
     event: T,
-    callback: T extends 'beforeRegister'
+    callback: T extends 'checkUsername'
+      ? TilmeldCheckUsernameCallback
+      : T extends 'beforeRegister'
       ? TilmeldBeforeRegisterCallback
       : T extends 'afterRegister'
       ? TilmeldAfterRegisterCallback
@@ -1841,9 +2326,11 @@ export default class User extends AbleObject<UserData> {
       ? TilmeldBeforeLogoutCallback
       : T extends 'afterLogout'
       ? TilmeldAfterLogoutCallback
-      : never
+      : never,
   ) {
-    const prop = (event + 'Callbacks') as T extends 'beforeRegister'
+    const prop = (event + 'Callbacks') as T extends 'checkUsername'
+      ? 'checkUsernameCallbacks'
+      : T extends 'beforeRegister'
       ? 'beforeRegisterCallbacks'
       : T extends 'afterRegister'
       ? 'afterRegisterCallbacks'