@nymphjs/tilmeld 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/User.js

@@ -3,12 +3,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const guid_1 = require("@nymphjs/guid");
 const strtotime_1 = __importDefault(require("locutus/php/datetime/strtotime"));
 const enc_base64_1 = __importDefault(require("crypto-js/enc-base64"));
 const sha256_1 = __importDefault(require("crypto-js/sha256"));
 const md5_1 = __importDefault(require("crypto-js/md5"));
 const lodash_1 = require("lodash");
-const guid_1 = require("@nymphjs/guid");
+const otpauth_1 = require("otpauth");
+const qrcode_1 = require("qrcode");
+const enforceTilmeld_1 = require("./enforceTilmeld");
 const AbleObject_1 = __importDefault(require("./AbleObject"));
 const errors_1 = require("./errors");
 class User extends AbleObject_1.default {
@@ -30,32 +33,32 @@ class User extends AbleObject_1.default {
         }
         return entity;
     }
-    static factorySync(guid) {
-        return super.factorySync(guid);
+    static factorySync() {
+        return super.factorySync();
     }
-    constructor(guid) {
-        super(guid);
+    constructor() {
+        super();
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
         this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
         this.$allowlistTags = [];
         this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$data.groups = [];
-            this.$data.inheritAbilities = true;
-            this.$updateDataProtection();
-        }
+        this.$data.enabled = true;
+        this.$data.abilities = [];
+        this.$data.groups = [];
+        this.$data.inheritAbilities = true;
+        this.$updateDataProtection();
     }
     static current(returnObjectIfNotExist) {
-        if (this.tilmeld.currentUser == null) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (tilmeld.currentUser == null) {
             return returnObjectIfNotExist ? this.factorySync() : null;
         }
-        return this.tilmeld.currentUser;
+        return tilmeld.currentUser;
     }
     static async sendRecovery(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
@@ -63,9 +66,8 @@ class User extends AbleObject_1.default {
         }
         let user;
         const options = {};
-        if (!this.tilmeld.config.emailUsernames &&
-            data.recoveryType === 'username') {
-            const getUser = await this.nymph.getEntity({ class: this.tilmeld.User, skipAc: true }, {
+        if (!tilmeld.config.emailUsernames && data.recoveryType === 'username') {
+            const getUser = await this.nymph.getEntity({ class: tilmeld.User, skipAc: true }, {
                 type: '&',
                 ilike: ['email', data.account.replace(/([\\%_])/g, (s) => `\\${s}`)],
             });
@@ -86,7 +88,7 @@ class User extends AbleObject_1.default {
             options.locals = {};
         }
         else if (data.recoveryType === 'password') {
-            const getUser = await this.tilmeld.User.factoryUsername(data.account);
+            const getUser = await tilmeld.User.factoryUsername(data.account);
             if (getUser.guid == null) {
                 return {
                     result: false,
@@ -108,13 +110,13 @@ class User extends AbleObject_1.default {
             };
             options.locals = {
                 recoverCode: getUser.recoverSecret,
-                timeLimit: this.tilmeld.config.pwRecoveryTimeLimit,
+                timeLimit: tilmeld.config.pwRecoveryTimeLimit,
             };
         }
         else {
             return { result: false, message: 'Invalid recovery type.' };
         }
-        if (await this.tilmeld.config.sendEmail(this.tilmeld, options, user)) {
+        if (await tilmeld.config.sendEmail(tilmeld, options, user)) {
             return {
                 result: true,
                 message: "We've sent an email to your registered address. Please " +
@@ -126,17 +128,18 @@ class User extends AbleObject_1.default {
         }
     }
     static async recover(data) {
-        if (!this.tilmeld.config.pwRecovery) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (!tilmeld.config.pwRecovery) {
             return {
                 result: false,
                 message: 'Account recovery is not allowed.',
             };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         if (user.guid == null ||
             user.recoverSecret == null ||
             data.secret !== user.recoverSecret ||
-            (0, strtotime_1.default)('+' + this.tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
+            (0, strtotime_1.default)('+' + tilmeld.config.pwRecoveryTimeLimit, Math.floor((user.recoverSecretDate ?? 0) / 1000)) *
                 1000 <
                 Date.now()) {
             return {
@@ -161,22 +164,24 @@ class User extends AbleObject_1.default {
         }
     }
     static getClientConfig() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         return {
-            regFields: this.tilmeld.config.regFields,
-            userFields: this.tilmeld.config.userFields,
-            emailUsernames: this.tilmeld.config.emailUsernames,
-            allowRegistration: this.tilmeld.config.allowRegistration,
-            allowUsernameChange: this.tilmeld.config.allowUsernameChange,
-            pwRecovery: this.tilmeld.config.pwRecovery,
-            verifyEmail: this.tilmeld.config.verifyEmail,
-            unverifiedAccess: this.tilmeld.config.unverifiedAccess,
+            regFields: tilmeld.config.regFields,
+            userFields: tilmeld.config.userFields,
+            emailUsernames: tilmeld.config.emailUsernames,
+            allowRegistration: tilmeld.config.allowRegistration,
+            allowUsernameChange: tilmeld.config.allowUsernameChange,
+            pwRecovery: tilmeld.config.pwRecovery,
+            verifyEmail: tilmeld.config.verifyEmail,
+            unverifiedAccess: tilmeld.config.unverifiedAccess,
         };
     }
     static async loginUser(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!('username' in data) || !data.username.length) {
             return { result: false, message: 'Incorrect login/password.' };
         }
-        const user = await this.tilmeld.User.factoryUsername(data.username);
+        const user = await tilmeld.User.factoryUsername(data.username);
         const result = await user.$login(data);
         if (result.result) {
             user.$updateDataProtection();
@@ -185,19 +190,33 @@ class User extends AbleObject_1.default {
         return result;
     }
     async $login(data) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.guid == null) {
             return { result: false, message: 'Incorrect login/password.' };
         }
         if (!this.$data.enabled) {
             return { result: false, message: 'This user is disabled.' };
         }
-        if (this.$gatekeeper()) {
+        if (await this.$gatekeeper()) {
             return { result: true, message: 'You are already logged in.' };
         }
         if (!this.$checkPassword(data.password)) {
             return { result: false, message: 'Incorrect login/password.' };
         }
+        if (this.$data.totpSecret != null) {
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return {
+                    result: false,
+                    needTOTP: true,
+                    message: 'You need to provide a 2FA code.',
+                };
+            }
+            if (!this.$checkTOTPCode(data.code)) {
+                return { result: false, message: 'Incorrect 2FA code.' };
+            }
+        }
         try {
             for (let callback of this.constructor
                 .beforeLoginCallbacks) {
@@ -212,7 +231,62 @@ class User extends AbleObject_1.default {
                 message: e.message,
             };
         }
-        if (!tilmeld.login(this, true)) {
+        if (!(await tilmeld.login(this, true))) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        for (let callback of this.constructor
+            .afterLoginCallbacks) {
+            if (callback) {
+                await callback(this);
+            }
+        }
+        return { result: true, message: 'You are logged in.' };
+    }
+    async $switchUser(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (this.guid == null) {
+            return { result: false, message: 'Incorrect login/password.' };
+        }
+        let user = tilmeld.User.current();
+        if (!user || user.guid == null) {
+            return { result: false, message: "You're not logged in." };
+        }
+        const isCurrentUser = user != null && user.$is(this);
+        if (isCurrentUser) {
+            return { result: false, message: "You can't switch to yourself." };
+        }
+        const toAbilities = this.$data.abilities || [];
+        const fromAbilities = user.abilities || [];
+        if (fromAbilities.indexOf('tilmeld/switch') === -1 &&
+            fromAbilities.indexOf('system/admin') === -1) {
+            return {
+                result: false,
+                message: "You don't have permission to switch users.",
+            };
+        }
+        if (toAbilities.indexOf('system/admin') !== -1 ||
+            toAbilities.indexOf('tilmeld/admin') !== -1) {
+            return { result: false, message: "You can't switch to an admin." };
+        }
+        try {
+            for (let callback of this.constructor
+                .beforeLoginCallbacks) {
+                if (callback) {
+                    await callback(this, {
+                        username: this.$data.username || '',
+                        password: '',
+                        ...(data || {}),
+                    });
+                }
+            }
+        }
+        catch (e) {
+            return {
+                result: false,
+                message: e.message,
+            };
+        }
+        if (!(await tilmeld.loginSwitch(this, true))) {
             return { result: false, message: 'Incorrect login/password.' };
         }
         for (let callback of this.constructor
@@ -224,7 +298,7 @@ class User extends AbleObject_1.default {
         return { result: true, message: 'You are logged in.' };
     }
     async $logout() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         try {
             for (let callback of this.constructor
                 .beforeLogoutCallbacks) {
@@ -239,7 +313,7 @@ class User extends AbleObject_1.default {
                 message: e.message,
             };
         }
-        tilmeld.logout();
+        await tilmeld.logout();
         for (let callback of this.constructor
             .afterLogoutCallbacks) {
             if (callback) {
@@ -259,52 +333,84 @@ class User extends AbleObject_1.default {
             (0, md5_1.default)(this.$data.email.trim().toLowerCase()).toString() +
             '?d=identicon&s=40');
     }
+    $getGid() {
+        if (this.$data.group) {
+            return this.$data.group.guid;
+        }
+        return null;
+    }
+    $getGids() {
+        if (this.$data.groups) {
+            return this.$data.groups
+                .map((group) => group.guid)
+                .filter((guid) => guid != null);
+        }
+        return null;
+    }
     async $getDescendantGroups() {
         if (this.$descendantGroups == null) {
             this.$descendantGroups = [];
             if (this.$data.group != null) {
+                await this.$data.group.$wake();
                 this.$descendantGroups = await this.$data.group.$getDescendants();
             }
+            await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
             for (let curGroup of this.$data.groups ?? []) {
                 this.$descendantGroups = this.$descendantGroups?.concat(await curGroup.$getDescendants());
             }
         }
         return this.$descendantGroups;
     }
-    $getDescendantGroupsSync() {
-        if (this.$descendantGroups == null) {
-            this.$descendantGroups = [];
-            if (this.$data.group != null) {
-                this.$descendantGroups = this.$data.group.$getDescendantsSync();
-            }
-            for (let curGroup of this.$data.groups ?? []) {
-                this.$descendantGroups = this.$descendantGroups?.concat(curGroup.$getDescendantsSync());
-            }
-        }
-        return this.$descendantGroups;
-    }
     $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        this.$check();
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in input.data &&
+            input.data.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
         if ('abilities' in input.data &&
-            input.data.abilities.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+            input.data.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         this.$originalEmail = this.$data.email;
         super.$jsonAcceptData(input, allowConflict);
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        this.$check();
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('system/admin') !==
+                this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if ('abilities' in patch.set &&
+            patch.set.abilities?.includes('tilmeld/admin') !==
+                this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
         if ('abilities' in patch.set &&
-            patch.set.abilities.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this user a system admin.");
+            patch.set.abilities?.includes('tilmeld/switch') !==
+                this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new errors_1.BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
         this.$originalEmail = this.$data.email;
         super.$jsonAcceptPatch(patch, allowConflict);
@@ -314,7 +420,7 @@ class User extends AbleObject_1.default {
         this.$updateDataProtection();
     }
     $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         let user = givenUser ?? tilmeld.User.current();
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
@@ -330,13 +436,20 @@ class User extends AbleObject_1.default {
         if (isCurrentUser) {
             this.$clientEnabledMethods.push('$gatekeeper');
             this.$clientEnabledMethods.push('$changePassword');
+            this.$clientEnabledMethods.push('$revokeCurrentTokens');
             this.$clientEnabledMethods.push('$logout');
             this.$clientEnabledMethods.push('$sendEmailVerification');
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$getNewTOTPSecret');
+            this.$clientEnabledMethods.push('$saveTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
         }
         if (user != null &&
             (abilities.indexOf('tilmeld/admin') !== -1 ||
                 abilities.indexOf('system/admin') !== -1)) {
-            this.$privateData = ['password', 'salt'];
+            this.$privateData = ['password', 'salt', 'totpSecret'];
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
             this.$allowlistData = undefined;
         }
         else if (isCurrentUser || isNewUser) {
@@ -357,41 +470,66 @@ class User extends AbleObject_1.default {
                 this.$allowlistData.push('phone');
             }
             this.$privateData = [
+                'enabled',
                 'secret',
+                'emailChangeDate',
                 'newEmailSecret',
-                'cancelEmailAddress',
                 'cancelEmailSecret',
-                'emailChangeDate',
+                'cancelEmailAddress',
                 'recoverSecret',
                 'recoverSecretDate',
-                'password',
                 'salt',
+                'password',
+                'passwordTemp',
+                'totpSecret',
             ];
         }
+        if (user != null &&
+            !isCurrentUser &&
+            (abilities.indexOf('tilmeld/switch') !== -1 ||
+                abilities.indexOf('system/admin') !== -1)) {
+            this.$clientEnabledMethods.push('$switchUser');
+        }
+    }
+    $updateGroupDataProtection() {
+        if (this.$data.group != null && !this.$data.group.$asleep()) {
+            this.$data.group.$updateDataProtection();
+        }
+        for (let group of this.$data.groups ?? []) {
+            if (!group.$asleep()) {
+                group.$updateDataProtection();
+            }
+        }
     }
-    $gatekeeper(ability) {
-        const tilmeld = this.$nymph.tilmeld;
+    async $gatekeeper(ability) {
+        await this.$wake();
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (ability == null) {
             return tilmeld.User.current()?.$is(this) ?? false;
         }
         if (this.$gatekeeperCache == null) {
-            let abilities = this.$data.abilities ?? [];
-            if (this.$data.inheritAbilities) {
-                for (let curGroup of this.$data.groups ?? []) {
-                    if (curGroup.enabled) {
-                        abilities = abilities.concat(curGroup.abilities ?? []);
-                    }
-                }
-                if (this.$data.group != null &&
-                    this.$data.group.cdate != null &&
-                    this.$data.group.enabled) {
-                    abilities = abilities.concat(this.$data.group.abilities ?? []);
+            this.$gatekeeperCache = await this.$getGatekeeperCache();
+        }
+        return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
+            !!this.$data.abilities?.includes('system/admin'));
+    }
+    async $getGatekeeperCache() {
+        await this.$wake();
+        let abilities = this.$data.abilities ?? [];
+        if (this.$data.inheritAbilities) {
+            await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+            for (let curGroup of this.$data.groups ?? []) {
+                if (curGroup.enabled) {
+                    abilities = abilities.concat(curGroup.abilities ?? []);
                 }
             }
-            this.$gatekeeperCache = Object.fromEntries(abilities.map((ability) => [ability, true]));
+            await this.$data.group?.$wake();
+            const group = this.$data.group;
+            if (group != null && group.cdate != null && group.enabled) {
+                abilities = abilities.concat(group.abilities ?? []);
+            }
         }
-        return ((ability in this.$gatekeeperCache && !!this.$gatekeeperCache[ability]) ||
-            !!this.$gatekeeperCache['system/admin']);
+        return Object.fromEntries(abilities.map((ability) => [ability, true]));
     }
     $clearCache() {
         const ret = super.$clearCache();
@@ -400,7 +538,7 @@ class User extends AbleObject_1.default {
         return ret;
     }
     async $sendEmailVerification() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.guid == null) {
             return false;
         }
@@ -463,18 +601,21 @@ class User extends AbleObject_1.default {
         }
         return success;
     }
-    $addGroup(group) {
-        if (this.$data.groups == null) {
-            this.$data.groups = [];
+    async $addGroup(group) {
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+        let groups = this.$data.groups;
+        if (groups == null) {
+            groups = [];
         }
-        if (!group.$inArray(this.$data.groups)) {
-            this.$data.groups.push(group);
-            return this.$data.groups;
+        if (!group.$inArray(groups)) {
+            groups.push(group);
+            this.$data.groups = groups;
+            return groups;
         }
         return true;
     }
     $checkPassword(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 return this.$data.password === password;
@@ -486,10 +627,12 @@ class User extends AbleObject_1.default {
                     (0, sha256_1.default)(password + this.$data.salt).toString(enc_base64_1.default));
         }
     }
-    $delGroup(group) {
-        if (this.$data.groups != null && group.$inArray(this.$data.groups)) {
+    async $delGroup(group) {
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
+        let groups = this.$data.groups || [];
+        if (this.$data.groups != null && group.$inArray(groups)) {
             const newGroups = [];
-            for (let curGroup of this.$data.groups) {
+            for (let curGroup of groups) {
                 if (!group.$is(curGroup)) {
                     newGroups.push(curGroup);
                 }
@@ -499,7 +642,7 @@ class User extends AbleObject_1.default {
         }
         return true;
     }
-    $inGroup(group) {
+    async $inGroup(group) {
         if (typeof group === 'string') {
             if (this.$data.group?.guid === group) {
                 return true;
@@ -513,13 +656,16 @@ class User extends AbleObject_1.default {
         }
         return (group.$is(this.$data.group) || group.$inArray(this.$data.groups ?? []));
     }
-    $isDescendant(group) {
-        if (this.$data.group?.cdate != null &&
-            this.$data.group.$isDescendant(group)) {
+    async $isDescendant(group) {
+        await this.$data.group?.$wake();
+        if (this.$data.group != null &&
+            this.$data.group?.cdate != null &&
+            (await this.$data.group?.$isDescendant(group))) {
             return true;
         }
+        await Promise.all(this.$data.groups?.map((e) => e.$wake()) || []);
         for (let curGroup of this.$data.groups ?? []) {
-            if (curGroup.$isDescendant(group)) {
+            if (await curGroup.$isDescendant(group)) {
                 return true;
             }
         }
@@ -533,7 +679,14 @@ class User extends AbleObject_1.default {
             return { result: false, message: 'Incorrect password.' };
         }
         this.$data.passwordTemp = data.newPassword;
+        if (data.revokeCurrentTokens) {
+            this.$data.revokeTokenDate = Date.now();
+        }
         if (await this.$save()) {
+            if (data.revokeCurrentTokens) {
+                const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+                await tilmeld.login(this, true);
+            }
             return { result: true, message: 'Your password has been changed.' };
         }
         else {
@@ -541,7 +694,7 @@ class User extends AbleObject_1.default {
         }
     }
     $password(password) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         switch (tilmeld.config.pwMethod) {
             case 'plain':
                 delete this.$data.salt;
@@ -559,14 +712,158 @@ class User extends AbleObject_1.default {
         }
         return this.$data.password;
     }
+    async $revokeCurrentTokens(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        this.$data.revokeTokenDate = Date.now();
+        if (await this.$save()) {
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+            await tilmeld.login(this, true);
+            return {
+                result: true,
+                message: 'You have logged out of all other sessions.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't save revocation date." };
+        }
+    }
+    async $hasTOTPSecret() {
+        return this.$data.totpSecret != null;
+    }
+    $checkTOTPCode(code) {
+        if (this.$data.totpSecret == null) {
+            return false;
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: this.$data.totpSecret,
+        });
+        return totp.validate({ token: code, window: 2 }) != null;
+    }
+    async $getNewTOTPSecret() {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (this.$data.totpSecret != null) {
+            throw new errors_1.BadDataError('You already have a 2FA secret.');
+        }
+        const secret = new otpauth_1.Secret();
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret,
+        });
+        const uri = totp.toString();
+        const qrcode = await (0, qrcode_1.toDataURL)(uri);
+        return {
+            uri,
+            qrcode,
+            secret: secret.base32,
+        };
+    }
+    async $saveTOTPSecret(data) {
+        if (!this.$checkPassword(data.password ?? '')) {
+            return { result: false, message: 'Incorrect password.' };
+        }
+        if (this.$data.totpSecret != null) {
+            return { result: false, message: 'You already have a 2FA secret.' };
+        }
+        if (data.secret == null ||
+            typeof data.secret !== 'string' ||
+            data.secret === '') {
+            return { result: false, message: '2FA secret is invalid.' };
+        }
+        if (data.code == null ||
+            typeof data.code !== 'string' ||
+            data.code.length !== 6) {
+            return { result: false, message: '2FA code is invalid.' };
+        }
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const totp = new otpauth_1.TOTP({
+            issuer: tilmeld.config.appName,
+            label: this.$data.username,
+            algorithm: 'SHA1',
+            digits: 6,
+            period: 30,
+            secret: data.secret,
+        });
+        if (totp.validate({ token: data.code, window: 2 }) == null) {
+            return { result: false, message: '2FA code is incorrect.' };
+        }
+        this.$data.totpSecret = data.secret;
+        if (await this.$save()) {
+            return { result: true, message: 'Your two factor secret is now set.' };
+        }
+        else {
+            return { result: false, message: "Couldn't save two factor secret." };
+        }
+    }
+    async $removeTOTPSecret(data) {
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        if (data) {
+            if (!this.$checkPassword(data.password ?? '')) {
+                return { result: false, message: 'Incorrect password.' };
+            }
+            if (data.code == null ||
+                typeof data.code !== 'string' ||
+                data.code.length !== 6) {
+                return { result: false, message: '2FA code is invalid.' };
+            }
+            if (this.$data.totpSecret == null) {
+                return { result: false, message: "You don't have a 2FA secret." };
+            }
+            const totp = new otpauth_1.TOTP({
+                issuer: tilmeld.config.appName,
+                label: this.$data.username,
+                algorithm: 'SHA1',
+                digits: 6,
+                period: 30,
+                secret: this.$data.totpSecret,
+            });
+            if (totp.validate({ token: data.code, window: 2 }) == null) {
+                return { result: false, message: '2FA code is incorrect.' };
+            }
+        }
+        else if (!tilmeld.gatekeeper('tilmeld/admin')) {
+            return {
+                result: false,
+                message: 'You must provide your password and 2FA code.',
+            };
+        }
+        delete this.$data.totpSecret;
+        if (await this.$save()) {
+            return {
+                result: true,
+                message: 'Two factor secret has been removed.',
+            };
+        }
+        else {
+            return { result: false, message: "Couldn't remove two factor secret." };
+        }
+    }
     async $checkUsername() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.emailUsernames) {
             if (this.$data.username == null || !this.$data.username.length) {
                 return { result: false, message: 'Please specify a username.' };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.username.length > tilmeld.config.maxUsernameLength) {
+            if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+                return {
+                    result: false,
+                    message: 'Usernames must be at least ' +
+                        tilmeld.config.minUsernameLength +
+                        ' characters.',
+                };
+            }
+            if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Usernames must not exceed ' +
@@ -600,6 +897,17 @@ class User extends AbleObject_1.default {
             if (test != null) {
                 return { result: false, message: 'That username is taken.' };
             }
+            for (let callback of this.constructor
+                .checkUsernameCallbacks) {
+                if (callback) {
+                    const result = await callback(this, {
+                        username: this.$data.username,
+                    });
+                    if (!result.result) {
+                        return { message: 'Username is not available.', ...result };
+                    }
+                }
+            }
             return {
                 result: true,
                 message: this.guid != null ? 'Username is valid.' : 'Username is available!',
@@ -610,8 +918,15 @@ class User extends AbleObject_1.default {
             if (this.$data.username == null || !this.$data.username.length) {
                 return { result: false, message: 'Please specify an email.' };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.username.length > tilmeld.config.maxUsernameLength) {
+            if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+                return {
+                    result: false,
+                    message: 'Emails must be at least ' +
+                        tilmeld.config.minUsernameLength +
+                        ' characters.',
+                };
+            }
+            if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Emails must not exceed ' +
@@ -623,7 +938,7 @@ class User extends AbleObject_1.default {
         }
     }
     async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.email == null || !this.$data.email.length) {
             if (tilmeld.config.verifyEmail) {
                 return { result: false, message: 'Please specify an email.' };
@@ -658,7 +973,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $checkPhone() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.phone == null || !this.$data.phone.length) {
             return { result: false, message: 'Please specify a phone number.' };
         }
@@ -686,7 +1001,7 @@ class User extends AbleObject_1.default {
         };
     }
     async $register(data) {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.config.allowRegistration) {
             return {
                 result: false,
@@ -701,21 +1016,6 @@ class User extends AbleObject_1.default {
                 message: 'This is already a registered user.',
             };
         }
-        try {
-            for (let callback of this.constructor
-                .beforeRegisterCallbacks) {
-                if (callback) {
-                    await callback(this, data);
-                }
-            }
-        }
-        catch (e) {
-            return {
-                result: false,
-                loggedin: false,
-                message: e.message,
-            };
-        }
         if (!('password' in data) || !data.password.length) {
             return {
                 result: false,
@@ -744,8 +1044,27 @@ class User extends AbleObject_1.default {
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        let message = '';
+        let loggedin = false;
         try {
+            try {
+                for (let callback of this.constructor
+                    .beforeRegisterCallbacks) {
+                    if (callback) {
+                        await callback(this, data);
+                    }
+                }
+            }
+            catch (e) {
+                await tnymph.rollback(transaction);
+                this.$nymph = nymph;
+                return {
+                    result: false,
+                    loggedin: false,
+                    message: e.message,
+                };
+            }
             let generatedPrimaryGroup = null;
             if (tilmeld.config.generatePrimary) {
                 generatedPrimaryGroup = await tilmeld.Group.factory();
@@ -831,8 +1150,6 @@ class User extends AbleObject_1.default {
                         },
                     }, this);
                 }
-                let message = '';
-                let loggedin = false;
                 if (generatedPrimaryGroup != null) {
                     generatedPrimaryGroup.user = this;
                     if (!(await generatedPrimaryGroup.$saveSkipAC())) {
@@ -855,7 +1172,7 @@ class User extends AbleObject_1.default {
                 else if (tilmeld.config.verifyEmail &&
                     tilmeld.config.unverifiedAccess &&
                     !madeAdmin) {
-                    if (!tilmeld.login(this, true)) {
+                    if (!(await tilmeld.login(this, true))) {
                         throw new Error('An error occurred trying to log you in.');
                     }
                     message +=
@@ -865,7 +1182,7 @@ class User extends AbleObject_1.default {
                     loggedin = true;
                 }
                 else {
-                    if (!tilmeld.login(this, true)) {
+                    if (!(await tilmeld.login(this, true))) {
                         throw new Error('An error occurred trying to log you in.');
                     }
                     message += "You're now registered and logged in!";
@@ -880,19 +1197,6 @@ class User extends AbleObject_1.default {
                         });
                     }
                 }
-                try {
-                    await tnymph.commit(transaction);
-                    this.$nymph = nymph;
-                    this.$nymph.tilmeld?.fillSession(this);
-                }
-                catch (e) {
-                    throw e;
-                }
-                return {
-                    result: true,
-                    loggedin,
-                    message,
-                };
             }
             else {
                 await tnymph.rollback(transaction);
@@ -909,15 +1213,28 @@ class User extends AbleObject_1.default {
             this.$nymph = nymph;
             throw e;
         }
+        try {
+            await tnymph.commit(transaction);
+            this.$nymph = nymph;
+            await this.$nymph.tilmeld?.fillSession(this);
+        }
+        catch (e) {
+            throw e;
+        }
+        return {
+            result: true,
+            loggedin,
+            message,
+        };
     }
     async $save() {
-        let tilmeld = this.$nymph.tilmeld;
+        let tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (this.$data.username == null || !this.$data.username.trim().length) {
             return false;
         }
         if (tilmeld.gatekeeper('tilmeld/admin') &&
             !tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
+            this.$data.abilities?.includes('system/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to modify system admins.");
         }
         let sendVerification = false;
@@ -1064,17 +1381,18 @@ class User extends AbleObject_1.default {
         const nymph = this.$nymph;
         const tnymph = await this.$nymph.startTransaction(transaction);
         this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        if (this.$data.group != null &&
-            this.$data.group.user != null &&
-            this.$is(this.$data.group.user)) {
+        tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
+        const group = this.$data.group;
+        await group?.$wake();
+        if (group != null && group.user != null && this.$is(group.user)) {
             try {
-                this.$data.group.groupname = this.$data.username;
-                this.$data.group.avatar = this.$data.avatar;
-                this.$data.group.email = this.$data.email;
-                this.$data.group.name = this.$data.name;
-                this.$data.group.phone = this.$data.phone;
-                await this.$data.group.$saveSkipAC();
+                group.groupname = this.$data.username;
+                group.avatar = this.$data.avatar;
+                group.email = this.$data.email;
+                group.name = this.$data.name;
+                group.phone = this.$data.phone;
+                await group.$saveSkipAC();
+                this.$data.group = group;
             }
             catch (e) {
                 await tnymph.rollback(transaction);
@@ -1108,8 +1426,9 @@ class User extends AbleObject_1.default {
             this.$descendantGroups = undefined;
             this.$gatekeeperCache = undefined;
             await tnymph.commit(transaction);
-            if (nymph.tilmeld.User.current(true).$is(this)) {
-                nymph.tilmeld.fillSession(this);
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
+            if (tilmeld.User.current(true).$is(this)) {
+                await tilmeld.fillSession(this);
             }
         }
         else {
@@ -1130,12 +1449,12 @@ class User extends AbleObject_1.default {
         return false;
     }
     async $delete() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(this);
         if (!tilmeld.gatekeeper('tilmeld/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to delete users.");
         }
         if (!tilmeld.gatekeeper('system/admin') &&
-            this.$gatekeeper('system/admin')) {
+            this.$data.abilities?.includes('system/admin')) {
             throw new errors_1.BadDataError("You don't have the authority to delete system admins.");
         }
         if (tilmeld.User.current(true).$is(this)) {
@@ -1163,9 +1482,9 @@ class User extends AbleObject_1.default {
         return true;
     }
 }
-exports.default = User;
 User.ETYPE = 'tilmeld_user';
 User.class = 'User';
+User.checkUsernameCallbacks = [];
 User.beforeRegisterCallbacks = [];
 User.afterRegisterCallbacks = [];
 User.beforeLoginCallbacks = [];
@@ -1180,23 +1499,26 @@ User.DEFAULT_CLIENT_ENABLED_METHODS = [
     '$register',
 ];
 User.DEFAULT_PRIVATE_DATA = [
+    'abilities',
     'email',
-    'originalEmail',
     'phone',
     'group',
     'groups',
-    'abilities',
     'inheritAbilities',
-    'recoverSecret',
-    'recoverSecretDate',
-    'password',
-    'salt',
+    'enabled',
     'secret',
-    'newEmailAddress',
+    'emailChangeDate',
     'newEmailSecret',
-    'cancelEmailAddress',
+    'newEmailAddress',
     'cancelEmailSecret',
-    'emailChangeDate',
+    'cancelEmailAddress',
+    'recoverSecret',
+    'recoverSecretDate',
+    'salt',
+    'password',
+    'passwordTemp',
+    'revokeTokenDate',
+    'totpSecret',
 ];
 User.DEFAULT_ALLOWLIST_DATA = [];
 User.clientEnabledStaticMethods = [
@@ -1207,4 +1529,5 @@ User.clientEnabledStaticMethods = [
     'getClientConfig',
 ];
 User.searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
+exports.default = User;
 //# sourceMappingURL=User.js.map