@nymphjs/tilmeld 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/Tilmeld.js

@@ -10,6 +10,7 @@ const conf_1 = require("./conf");
 const errors_1 = require("./errors");
 const Group_1 = __importDefault(require("./Group"));
 const User_1 = __importDefault(require("./User"));
+const enforceTilmeld_1 = require("./enforceTilmeld");
 class Tilmeld {
     constructor(config) {
         this.nymph = {};
@@ -18,7 +19,8 @@ class Tilmeld {
         this.Group = Group_1.default;
         this.request = null;
         this.response = null;
-        this.skipAuthenticate = false;
+        this.alreadyLoggedOutSwitch = false;
+        this.gatekeeperCache = null;
         this.config = { ...conf_1.ConfigDefaults, ...config };
     }
     clone() {
@@ -26,7 +28,7 @@ class Tilmeld {
         tilmeld.request = this.request;
         tilmeld.response = this.response;
         tilmeld.currentUser = this.currentUser;
-        tilmeld.skipAuthenticate = true;
+        tilmeld.gatekeeperCache = this.gatekeeperCache;
         return tilmeld;
     }
     init(nymph) {
@@ -34,41 +36,54 @@ class Tilmeld {
         if (this.nymph.driver == null) {
             throw new Error("Tilmeld can't be configured before Nymph.");
         }
-        class NymphUser extends User_1.default {
+        if (nymph.parent) {
+            this.User = this.nymph.getEntityClass(User_1.default);
+            this.Group = this.nymph.getEntityClass(Group_1.default);
         }
-        NymphUser.nymph = this.nymph;
-        NymphUser.tilmeld = this;
-        NymphUser.skipOnClone = true;
-        this.User = NymphUser;
-        this.nymph.addEntityClass(NymphUser);
-        class NymphGroup extends Group_1.default {
+        else {
+            this.User = this.nymph.addEntityClass(User_1.default);
+            this.Group = this.nymph.addEntityClass(Group_1.default);
+        }
+        if (this.currentUser) {
+            const currentUserGUID = this.currentUser.guid;
+            const currentUserCDate = this.currentUser.cdate;
+            const currentUserMDate = this.currentUser.mdate;
+            const currentUserTags = this.currentUser.tags;
+            const currentUserData = this.currentUser.$getData();
+            const currentUserSData = this.currentUser.$getSData();
+            const user = this.User.factorySync();
+            user.guid = currentUserGUID;
+            user.cdate = currentUserCDate;
+            user.mdate = currentUserMDate;
+            user.tags = currentUserTags;
+            user.$putData(currentUserData, currentUserSData);
+            this.currentUser = user;
+            this.currentUser.$updateDataProtection();
+            this.currentUser.$updateGroupDataProtection();
         }
-        NymphGroup.nymph = this.nymph;
-        NymphGroup.tilmeld = this;
-        NymphUser.skipOnClone = true;
-        this.Group = NymphGroup;
-        this.nymph.addEntityClass(NymphGroup);
         this.initAccessControl();
-        if (this.request != null && !this.skipAuthenticate) {
-            this.authenticate();
-        }
-        this.skipAuthenticate = false;
     }
     gatekeeper(ability) {
-        if (this.currentUser == null) {
+        if (this.currentUser == null || this.gatekeeperCache == null) {
             return false;
         }
-        return this.currentUser.$gatekeeper(ability);
+        if (ability == null) {
+            return true;
+        }
+        return ((ability in this.gatekeeperCache && !!this.gatekeeperCache[ability]) ||
+            !!this.currentUser.abilities?.includes('system/admin'));
     }
     initAccessControl() {
         const handleQuery = function (nymph, options, selectors) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             if (!options ||
                 !('skipAc' in options) ||
                 !options.skipAc ||
                 options.source === 'client') {
                 if (options?.source === 'client') {
-                    if (!tilmeld.gatekeeper('tilmeld/admin') &&
+                    if ((!tilmeld.currentUser ||
+                        (!tilmeld.currentUser.abilities?.includes('tilmeld/admin') &&
+                            !tilmeld.currentUser.abilities?.includes('system/admin'))) &&
                         ((!tilmeld.config.enableUserSearch &&
                             options.class?.factorySync() instanceof User_1.default) ||
                             (!tilmeld.config.enableGroupSearch &&
@@ -90,7 +105,7 @@ class Tilmeld {
         };
         handleQuery.skipOnClone = true;
         const checkPermissionsDelete = async function (nymph, entity) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             if (typeof entity.$tilmeldDeleteSkipAC === 'function' &&
                 entity.$tilmeldDeleteSkipAC()) {
                 return;
@@ -101,14 +116,14 @@ class Tilmeld {
         };
         checkPermissionsDelete.skipOnClone = true;
         const checkPermissionsDeleteByID = async function (nymph, guid, className) {
-            const entity = nymph.driver.getEntitySync({ class: nymph.getEntityClass(className ?? 'Entity') }, { type: '&', guid: guid });
+            const entity = await nymph.getEntity({ class: nymph.getEntityClass(className ?? 'Entity') }, { type: '&', guid: guid });
             if (entity != null) {
                 checkPermissionsDelete(nymph, entity);
             }
         };
         checkPermissionsDeleteByID.skipOnClone = true;
         const checkPermissionsSaveAndFilterAcChanges = async function (nymph, entity) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             if (!entity) {
                 return;
             }
@@ -118,28 +133,7 @@ class Tilmeld {
             }
             if (entity.guid != null) {
                 const originalAc = entity.$getOriginalAcValues();
-                const newAc = {
-                    user: entity.user ?? undefined,
-                    group: entity.group ?? undefined,
-                    acUser: entity.acUser ?? undefined,
-                    acGroup: entity.acGroup ?? undefined,
-                    acOther: entity.acOther ?? undefined,
-                    acRead: entity.acRead ?? undefined,
-                    acWrite: entity.acWrite ?? undefined,
-                    acFull: entity.acFull ?? undefined,
-                };
-                const setAcProperties = (acValues) => {
-                    for (let name in acValues) {
-                        const value = acValues[name];
-                        if (value == null) {
-                            delete entity[name];
-                        }
-                        else {
-                            entity[name] = value;
-                        }
-                    }
-                };
-                setAcProperties(originalAc);
+                const newAc = entity.$getCurrentAcValues();
                 function areAcPropertiesChanged(a, b) {
                     for (const name of ['user', 'group']) {
                         const aVal = a[name];
@@ -150,7 +144,7 @@ class Tilmeld {
                         else if (aVal == null || bVal == null) {
                             return true;
                         }
-                        if (!aVal.$is(bVal)) {
+                        if (aVal !== bVal) {
                             return true;
                         }
                     }
@@ -179,31 +173,29 @@ class Tilmeld {
                         if (aVal.length !== bVal.length) {
                             return true;
                         }
-                        if ((0, lodash_1.xor)(aVal.map((entity) => entity.guid), bVal.map((entity) => entity.guid)).length) {
+                        if ((0, lodash_1.xor)(aVal, bVal).length) {
                             return true;
                         }
                     }
                     return false;
                 }
                 if (areAcPropertiesChanged(originalAc, newAc)) {
-                    if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.FULL_ACCESS)) {
+                    if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.FULL_ACCESS, undefined, originalAc)) {
                         throw new errors_1.AccessControlError('No permission to change access control properties.');
                     }
-                    if (((originalAc.user && !originalAc.user.$is(newAc.user)) ||
+                    if ((originalAc.user && originalAc.user !== newAc.user) ||
                         (!originalAc.user &&
                             newAc.user &&
-                            !newAc.user.$is(tilmeld.currentUser))) &&
-                        !tilmeld.gatekeeper('tilmeld/admin')) {
+                            newAc.user !== tilmeld.currentUser)) {
                         throw new errors_1.AccessControlError('No permission to assign to another user.');
                     }
                     if (newAc.group &&
-                        !newAc.group.$is(originalAc.group) &&
-                        !(newAc.group.$is(tilmeld.currentUser?.group) ||
-                            newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])) &&
-                        !tilmeld.gatekeeper('tilmeld/admin')) {
+                        newAc.group !== originalAc.group &&
+                        !(newAc.group =
+                            tilmeld.currentUser?.$getGid() ||
+                                (tilmeld.currentUser?.$getGids() ?? []).includes(newAc.group))) {
                         throw new errors_1.AccessControlError('No permission to assign to another group.');
                     }
-                    setAcProperties(newAc);
                 }
             }
             if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.WRITE_ACCESS)) {
@@ -212,7 +204,7 @@ class Tilmeld {
         };
         checkPermissionsSaveAndFilterAcChanges.skipOnClone = true;
         const addAccess = async function (nymph, entity) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             const user = tilmeld.currentUser;
             if (user != null &&
                 entity.guid == null &&
@@ -221,10 +213,11 @@ class Tilmeld {
                 if (entity.user == null) {
                     entity.user = user;
                 }
-                if (entity.group == null &&
-                    user.group != null &&
-                    user.group.guid != null) {
-                    entity.group = user.group;
+                if (entity.group == null) {
+                    const group = user.group;
+                    if (group != null && group.guid != null) {
+                        entity.group = group;
+                    }
                 }
                 if (entity.acUser == null) {
                     entity.acUser = nymph_1.TilmeldAccessLevels.FULL_ACCESS;
@@ -306,10 +299,6 @@ class Tilmeld {
     }
     addAccessControlSelectors(options, selectors) {
         const user = this.currentUser;
-        if (user != null &&
-            (user.abilities?.indexOf('system/admin') ?? -1) !== -1) {
-            return;
-        }
         if (options == null) {
             throw new Error('No options in argument.');
         }
@@ -344,27 +333,19 @@ class Tilmeld {
             ];
             const groupRefs = [];
             const acRefs = [];
-            if (user.group != null && user.group.guid != null) {
-                groupRefs.push(['group', user.group.guid]);
-                acRefs.push(['acRead', user.group.guid]);
-                acRefs.push(['acWrite', user.group.guid]);
-                acRefs.push(['acFull', user.group.guid]);
-            }
-            for (let curSecondaryGroup of user.groups ?? []) {
-                if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
-                    groupRefs.push(['group', curSecondaryGroup.guid]);
-                    acRefs.push(['acRead', curSecondaryGroup.guid]);
-                    acRefs.push(['acWrite', curSecondaryGroup.guid]);
-                    acRefs.push(['acFull', curSecondaryGroup.guid]);
-                }
+            const gid = user.$getGid();
+            if (gid != null) {
+                groupRefs.push(['group', gid]);
+                acRefs.push(['acRead', gid]);
+                acRefs.push(['acWrite', gid]);
+                acRefs.push(['acFull', gid]);
             }
-            for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
-                if (curDescendantGroup != null && curDescendantGroup.guid != null) {
-                    groupRefs.push(['group', curDescendantGroup.guid]);
-                    acRefs.push(['acRead', curDescendantGroup.guid]);
-                    acRefs.push(['acWrite', curDescendantGroup.guid]);
-                    acRefs.push(['acFull', curDescendantGroup.guid]);
-                }
+            const gids = user.$getGids();
+            for (let curGid of gids ?? []) {
+                groupRefs.push(['group', curGid]);
+                acRefs.push(['acRead', curGid]);
+                acRefs.push(['acWrite', curGid]);
+                acRefs.push(['acFull', curGid]);
             }
             if (groupRefs.length) {
                 subSelectors.push({
@@ -397,9 +378,9 @@ class Tilmeld {
             selectors.push(selector);
         }
     }
-    checkPermissions(entity, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user) {
-        if (typeof entity !== 'object' || typeof entity.$is !== 'function') {
-            return false;
+    checkPermissions(entity, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user, acProperties) {
+        if (!acProperties) {
+            acProperties = entity.$getCurrentAcValues();
         }
         let userOrNull = null;
         let userOrEmpty = this.User.factorySync();
@@ -411,75 +392,64 @@ class Tilmeld {
             userOrNull = user;
             userOrEmpty = user;
         }
-        if (userOrEmpty.$gatekeeper('system/admin')) {
-            return true;
-        }
         if ((entity instanceof User_1.default || entity instanceof Group_1.default) &&
             (type === nymph_1.TilmeldAccessLevels.READ_ACCESS ||
-                userOrEmpty.$gatekeeper('tilmeld/admin'))) {
-            return true;
-        }
-        if (entity.user == null && entity.group == null) {
+                userOrEmpty.abilities?.includes('tilmeld/admin') ||
+                userOrEmpty.abilities?.includes('system/admin'))) {
             return true;
         }
-        const acUser = entity.acUser ?? nymph_1.TilmeldAccessLevels.FULL_ACCESS;
-        const acGroup = entity.acGroup ?? nymph_1.TilmeldAccessLevels.READ_ACCESS;
-        const acOther = entity.acOther ?? nymph_1.TilmeldAccessLevels.NO_ACCESS;
-        if (userOrNull === null) {
+        const acUser = acProperties.acUser ?? nymph_1.TilmeldAccessLevels.FULL_ACCESS;
+        const acGroup = acProperties.acGroup ?? nymph_1.TilmeldAccessLevels.READ_ACCESS;
+        const acOther = acProperties.acOther ?? nymph_1.TilmeldAccessLevels.NO_ACCESS;
+        if (userOrNull == null) {
             return acOther >= type;
         }
         if (userOrEmpty.$is(entity)) {
             return true;
         }
-        if (userOrEmpty.group != null &&
-            typeof userOrEmpty.group.$is === 'function' &&
-            userOrEmpty.group.$is(entity) &&
+        const gid = userOrEmpty.$getGid();
+        if (gid != null &&
+            entity.guid === gid &&
             type === nymph_1.TilmeldAccessLevels.READ_ACCESS) {
             return true;
         }
-        let allGroups = userOrEmpty.group == null ? [] : [userOrEmpty.group];
-        allGroups = allGroups.concat(userOrEmpty.groups ?? []);
-        allGroups = allGroups.concat(userOrEmpty.$getDescendantGroupsSync());
+        let allGids = gid == null ? [] : [gid];
+        allGids = allGids.concat(userOrEmpty.$getGids() ?? []);
         const checks = [
             {
                 type: nymph_1.TilmeldAccessLevels.FULL_ACCESS,
-                array: [...(entity.acFull ?? [])],
+                array: [...(acProperties.acFull ?? [])],
             },
             {
                 type: nymph_1.TilmeldAccessLevels.WRITE_ACCESS,
-                array: [...(entity.acWrite ?? [])],
+                array: [...(acProperties.acWrite ?? [])],
             },
             {
                 type: nymph_1.TilmeldAccessLevels.READ_ACCESS,
-                array: [...(entity.acRead ?? [])],
+                array: [...(acProperties.acRead ?? [])],
             },
         ];
         for (let curCheck of checks) {
             if (type <= curCheck.type) {
-                if (userOrEmpty.$inArray(curCheck.array)) {
+                if (curCheck.array.includes(userOrEmpty.guid)) {
                     return true;
                 }
-                for (let curGroup of allGroups) {
-                    if (typeof curGroup.$inArray === 'function' &&
-                        curGroup.$inArray(curCheck.array)) {
+                for (let curGid of allGids) {
+                    if (curCheck.array.includes(curGid)) {
                         return true;
                     }
                 }
             }
         }
-        if (entity.user != null &&
-            typeof entity.user.$is === 'function' &&
-            entity.user.$is(userOrNull)) {
+        if (acProperties.user != null && acProperties.user === userOrNull.guid) {
             return acUser >= type;
         }
-        if (entity.group != null &&
-            typeof entity.group.$inArray === 'function' &&
-            entity.group.$inArray(allGroups)) {
+        if (acProperties.group != null && allGids.includes(acProperties.group)) {
             return acGroup >= type;
         }
         return acOther >= type;
     }
-    checkClientUIDPermissions(name, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user) {
+    async checkClientUIDPermissions(name, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user) {
         let userOrEmpty = this.User.factorySync();
         if (user == null) {
             userOrEmpty = this.User.current(true);
@@ -487,52 +457,42 @@ class Tilmeld {
         else if (user !== false) {
             userOrEmpty = user;
         }
-        if (userOrEmpty.$gatekeeper('system/admin')) {
+        if (userOrEmpty.abilities?.includes('system/admin')) {
             return true;
         }
         if (type === nymph_1.TilmeldAccessLevels.FULL_ACCESS) {
             return (this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-                userOrEmpty.$gatekeeper(`uid/set/${name}`));
+                (await userOrEmpty.$gatekeeper(`uid/set/${name}`)));
         }
         else if (type === nymph_1.TilmeldAccessLevels.WRITE_ACCESS) {
             return (this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
                 this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-                userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
-                userOrEmpty.$gatekeeper(`uid/set/${name}`));
+                (await userOrEmpty.$gatekeeper(`uid/new/${name}`)) ||
+                (await userOrEmpty.$gatekeeper(`uid/set/${name}`)));
         }
         else if (type === nymph_1.TilmeldAccessLevels.READ_ACCESS) {
             return (this.config.clientReadableUIDs.indexOf(name) !== -1 ||
                 this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
                 this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-                userOrEmpty.$gatekeeper(`uid/get/${name}`) ||
-                userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
-                userOrEmpty.$gatekeeper(`uid/set/${name}`));
+                (await userOrEmpty.$gatekeeper(`uid/get/${name}`)) ||
+                (await userOrEmpty.$gatekeeper(`uid/new/${name}`)) ||
+                (await userOrEmpty.$gatekeeper(`uid/set/${name}`)));
         }
         return false;
     }
-    fillSession(user) {
-        const _group = user.group;
-        const _groups = user.groups;
+    async fillSession(user) {
         this.currentUser = user;
+        this.gatekeeperCache = await user.$getGatekeeperCache();
         this.currentUser.$updateDataProtection();
-        if (this.currentUser.group != null) {
-            this.currentUser.group.$updateDataProtection();
-        }
-        for (let group of this.currentUser.groups ?? []) {
-            group.$updateDataProtection();
-        }
+        this.currentUser.$updateGroupDataProtection();
     }
     clearSession() {
         const user = this.currentUser;
         this.currentUser = null;
+        this.gatekeeperCache = null;
         if (user) {
             user.$updateDataProtection();
-            if (user.group != null) {
-                user.group.$updateDataProtection();
-            }
-            for (let group of user.groups ?? []) {
-                group.$updateDataProtection();
-            }
+            user.$updateGroupDataProtection();
         }
     }
     async extractToken(token) {
@@ -545,89 +505,190 @@ class Tilmeld {
             type: '&',
             guid: guid,
         });
-        if (!user || !user.guid || !user.enabled) {
+        if (!user || !user.guid) {
             return null;
         }
         return user;
     }
-    authenticate(skipXsrfToken = false) {
+    async authenticate(skipXsrfToken = false) {
         if (this.request == null) {
             return false;
         }
+        if (this.response &&
+            this.response.locals.user &&
+            this.response.locals.user instanceof this.User) {
+            const user = this.response.locals.user;
+            await this.fillSession(user);
+            return true;
+        }
         const cookies = this.request.cookies ?? {};
         let fromAuthHeader = false;
         let authToken;
+        let switchToken;
         if (this.request.header('x-tilmeldauth') != null) {
             fromAuthHeader = true;
             authToken = this.request.header('x-tilmeldauth');
+            switchToken =
+                this.request.header('x-tilmeldswitch') ||
+                    'TILMELDSWITCH' in cookies
+                    ? cookies.TILMELDSWITCH
+                    : null;
         }
         else if ('TILMELDAUTH' in cookies) {
             fromAuthHeader = false;
             authToken = cookies.TILMELDAUTH;
+            switchToken = 'TILMELDSWITCH' in cookies ? cookies.TILMELDSWITCH : null;
         }
         else {
             return false;
         }
-        let extract;
+        let authExtract;
+        let switchExtract;
         if (skipXsrfToken ||
             this.request.originalUrl.startsWith(this.config.setupPath)) {
-            extract = this.config.jwtExtract(this.config, authToken);
+            authExtract = this.config.jwtExtract(this.config, authToken);
+            switchExtract = switchToken
+                ? this.config.jwtExtract(this.config, switchToken)
+                : null;
         }
         else {
             const xsrfToken = this.request.header('x-xsrf-token');
             if (xsrfToken == null && !fromAuthHeader) {
                 return false;
             }
-            extract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+            authExtract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+            switchExtract = switchToken
+                ? this.config.jwtExtract(this.config, switchToken)
+                : null;
         }
-        if (extract == null) {
-            this.logout();
+        if (authExtract == null) {
+            await this.logout();
             return false;
         }
-        const { guid, expire } = extract;
-        const user = this.User.factorySync(guid);
-        if (user.guid == null || !user.enabled) {
-            this.logout();
+        const { guid, issued, expire } = authExtract;
+        const { guid: switchGuid, expire: switchExpire } = switchExtract || {
+            guid: null,
+            expire: null,
+        };
+        const user = await this.User.factory(guid);
+        if (user.guid == null ||
+            !user.enabled ||
+            expire.getTime() <= Date.now() ||
+            issued.getTime() > Date.now() ||
+            (user.revokeTokenDate != null && issued.getTime() <= user.revokeTokenDate)) {
+            await this.logout();
             return false;
         }
-        if (expire.valueOf() < Date.now() + this.config.jwtRenew * 1000) {
-            this.login(user, fromAuthHeader);
+        if (switchGuid && switchExpire && switchExpire.getTime() > Date.now()) {
+            const switchUser = await this.User.factory(switchGuid);
+            if (switchUser.guid == null) {
+                await this.logoutSwitch();
+            }
+            else {
+                await this.fillSession(switchUser);
+                if (this.response) {
+                    this.response.locals.user = switchUser;
+                }
+                return true;
+            }
+        }
+        if (expire.getTime() < Date.now() + this.config.jwtRenew * 1000) {
+            await this.login(user, fromAuthHeader);
         }
         else {
-            this.fillSession(user);
+            await this.fillSession(user);
+        }
+        if (this.response) {
+            this.response.locals.user = user;
         }
         return true;
     }
-    login(user, sendAuthHeader) {
+    async login(user, sendAuthHeader, sendCookie = true) {
         if (user.guid != null && user.enabled) {
-            if (this.response && !this.response.headersSent) {
-                const token = this.config.jwtBuilder(this.config, user);
-                const appUrl = new url_1.URL(this.config.appUrl);
-                this.response.cookie('TILMELDAUTH', token, {
-                    domain: this.config.cookieDomain,
-                    path: this.config.cookiePath,
-                    maxAge: this.config.jwtExpire * 1000,
-                    secure: appUrl.protocol === 'https',
-                    httpOnly: false,
-                    sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
-                });
-                if (sendAuthHeader) {
-                    this.response.set('X-TILMELDAUTH', token);
+            if (this.response) {
+                if (!this.response.headersSent) {
+                    const token = this.config.jwtBuilder(this.config, user);
+                    if (sendCookie) {
+                        const appUrl = new url_1.URL(this.config.appUrl);
+                        this.response.cookie('TILMELDAUTH', token, {
+                            domain: this.config.cookieDomain,
+                            path: this.config.cookiePath,
+                            maxAge: this.config.jwtExpire * 1000,
+                            secure: appUrl.protocol === 'https:',
+                            httpOnly: false,
+                            sameSite: appUrl.protocol === 'https:' ? 'lax' : 'strict',
+                        });
+                    }
+                    if (sendAuthHeader) {
+                        this.response.set('X-TILMELDAUTH', token);
+                    }
+                }
+                this.response.locals.user = user;
+            }
+            await this.fillSession(user);
+            return true;
+        }
+        return false;
+    }
+    async loginSwitch(user, sendAuthHeader, sendCookie = true) {
+        if (user.guid != null) {
+            if (this.response) {
+                if (!this.response.headersSent) {
+                    const token = this.config.jwtBuilder(this.config, user, true);
+                    if (sendCookie) {
+                        const appUrl = new url_1.URL(this.config.appUrl);
+                        this.response.cookie('TILMELDSWITCH', token, {
+                            domain: this.config.cookieDomain,
+                            path: this.config.cookiePath,
+                            maxAge: this.config.jwtSwitchExpire * 1000,
+                            secure: appUrl.protocol === 'https:',
+                            httpOnly: false,
+                            sameSite: appUrl.protocol === 'https:' ? 'lax' : 'strict',
+                        });
+                    }
+                    if (sendAuthHeader) {
+                        this.response.set('X-TILMELDSWITCH', token);
+                    }
                 }
+                this.response.locals.user = user;
             }
-            this.fillSession(user);
+            await this.fillSession(user);
             return true;
         }
         return false;
     }
-    logout() {
+    async logout(clearCookie = true) {
+        if (this.request && !this.alreadyLoggedOutSwitch) {
+            const cookies = this.request.cookies ?? {};
+            if ('TILMELDSWITCH' in cookies) {
+                this.alreadyLoggedOutSwitch = true;
+                return await this.logoutSwitch(clearCookie);
+            }
+        }
         this.clearSession();
-        if (this.response && !this.response.headersSent) {
-            this.response.clearCookie('TILMELDAUTH', {
-                domain: this.config.cookieDomain,
-                path: this.config.cookiePath,
-            });
-            this.response.set('X-TILMELDAUTH', '');
+        if (this.response) {
+            if (clearCookie && !this.response.headersSent) {
+                this.response.clearCookie('TILMELDAUTH', {
+                    domain: this.config.cookieDomain,
+                    path: this.config.cookiePath,
+                });
+                this.response.set('X-TILMELDAUTH', '');
+            }
+            this.response.locals.user = null;
+        }
+    }
+    async logoutSwitch(clearCookie = true) {
+        this.clearSession();
+        if (this.response) {
+            if (clearCookie && !this.response.headersSent) {
+                this.response.clearCookie('TILMELDSWITCH', {
+                    domain: this.config.cookieDomain,
+                    path: this.config.cookiePath,
+                });
+                this.response.set('X-TILMELDSWITCH', '');
+            }
+            this.response.locals.user = null;
+            await this.authenticate();
         }
     }
 }