@nymphjs/tilmeld 1.0.0-beta.60 → 1.0.0-beta.62

package/src/Group.ts

@@ -1,4 +1,5 @@
-import {
+import type {
+  Nymph,
   EntityData,
   EntityJson,
   EntityPatch,
@@ -17,7 +18,8 @@ import {
   BadUsernameError,
   CouldNotChangeDefaultPrimaryGroupError,
 } from './errors';
-import User, { UserData } from './User';
+import type User from './User';
+import type { UserData } from './User';
 
 export type GroupData = {
   /**
@@ -110,9 +112,13 @@ export default class Group extends AbleObject<GroupData> {
   protected $allowlistTags?: string[] = [];
 
   /**
-   * This is explicitly used only during the registration proccess.
+   * This should only be used by the backend.
    */
   private $skipAcWhenSaving = false;
+  /**
+   * This should only be used by the backend.
+   */
+  private $skipAcWhenDeleting = false;
 
   static async factoryGroupname(
     groupname?: string,
@@ -135,15 +141,6 @@ export default class Group extends AbleObject<GroupData> {
     return entity;
   }
 
-  constructor() {
-    super();
-
-    // Defaults.
-    this.$data.enabled = true;
-    this.$data.abilities = [];
-    this.$updateDataProtection();
-  }
-
   /**
    * Get all the groups that can be assigned as primary groups.
    *
@@ -229,6 +226,42 @@ export default class Group extends AbleObject<GroupData> {
     return assignableGroups;
   }
 
+  constructor() {
+    super();
+
+    // Defaults.
+    this.$data.enabled = true;
+    this.$data.abilities = [];
+    this.$updateDataProtection();
+  }
+
+  $setNymph(nymph: Nymph) {
+    this.$nymph = nymph;
+    if (!this.$asleep()) {
+      if (this.$data.user && this.$data.user.$nymph !== nymph) {
+        this.$data.user.$setNymph(nymph);
+      }
+      if (this.$data.parent && this.$data.parent.$nymph !== nymph) {
+        this.$data.parent.$setNymph(nymph);
+      }
+    }
+  }
+
+  async $getUniques(): Promise<string[]> {
+    const tilmeld = enforceTilmeld(this);
+    const uniques = [`u:${this.$data.groupname}`];
+    if (
+      !tilmeld.config.emailUsernames &&
+      tilmeld.config.userFields.includes('email')
+    ) {
+      uniques.push(`e:${this.$data.email}`);
+    }
+    if (this.$data.defaultPrimary) {
+      uniques.push(`o:default-primary`);
+    }
+    return uniques;
+  }
+
   public $getAvatar() {
     if (this.$data.avatar != null && this.$data.avatar !== '') {
       return this.$data.avatar;
@@ -768,7 +801,11 @@ export default class Group extends AbleObject<GroupData> {
       );
       if (currentPrimary != null && !this.$is(currentPrimary)) {
         currentPrimary.defaultPrimary = false;
-        if (!(await currentPrimary.$save())) {
+        if (
+          this.$skipAcWhenSaving
+            ? !(await currentPrimary.$saveSkipAC())
+            : !(await currentPrimary.$save())
+        ) {
           throw new CouldNotChangeDefaultPrimaryGroupError(
             'Could not change new user primary group from ' +
               `${currentPrimary.groupname}.`,
@@ -798,23 +835,27 @@ export default class Group extends AbleObject<GroupData> {
 
   public async $delete() {
     let tilmeld = enforceTilmeld(this);
-    if (!tilmeld.gatekeeper('tilmeld/admin')) {
+    if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
       throw new BadDataError("You don't have the authority to delete groups.");
     }
 
     const transaction = 'tilmeld-delete-' + this.guid;
     const nymph = this.$nymph;
     const tnymph = await nymph.startTransaction(transaction);
-    this.$nymph = tnymph;
+    this.$setNymph(tnymph);
     tilmeld = enforceTilmeld(this);
 
     // Delete descendants.
     const descendants = await this.$getDescendants();
     if (descendants.length) {
       for (let curGroup of descendants) {
-        if (!(await curGroup.$delete())) {
+        if (
+          this.$skipAcWhenDeleting
+            ? !(await curGroup.$deleteSkipAC())
+            : !(await curGroup.$delete())
+        ) {
           await tnymph.rollback(transaction);
-          this.$nymph = nymph;
+          this.$setNymph(nymph);
           return false;
         }
       }
@@ -833,9 +874,13 @@ export default class Group extends AbleObject<GroupData> {
     );
     for (let user of primaryUsers) {
       delete user.group;
-      if (!(await user.$save())) {
+      if (
+        this.$skipAcWhenDeleting
+          ? !(await user.$saveSkipAC())
+          : !(await user.$save())
+      ) {
         await tnymph.rollback(transaction);
-        this.$nymph = nymph;
+        this.$setNymph(nymph);
         return false;
       }
     }
@@ -853,7 +898,11 @@ export default class Group extends AbleObject<GroupData> {
     );
     for (let user of secondaryUsers) {
       user.$delGroup(this);
-      if (!(await user.$save())) {
+      if (
+        this.$skipAcWhenDeleting
+          ? !(await user.$saveSkipAC())
+          : !(await user.$save())
+      ) {
         await tnymph.rollback(transaction);
         return false;
       }
@@ -866,7 +915,23 @@ export default class Group extends AbleObject<GroupData> {
     } else {
       await tnymph.rollback(transaction);
     }
-    this.$nymph = nymph;
+    this.$setNymph(nymph);
     return success;
   }
+
+  /*
+   * This should *never* be accessible on the client.
+   */
+  async $deleteSkipAC() {
+    this.$skipAcWhenDeleting = true;
+    return await this.$delete();
+  }
+
+  $tilmeldDeleteSkipAC() {
+    if (this.$skipAcWhenDeleting) {
+      this.$skipAcWhenDeleting = false;
+      return true;
+    }
+    return false;
+  }
 }

package/src/User.test.ts

@@ -1,5 +1,5 @@
 import { SQLite3Driver } from '@nymphjs/driver-sqlite3';
-import { Nymph } from '@nymphjs/nymph';
+import { Nymph, EntityUniqueConstraintError } from '@nymphjs/nymph';
 
 import Tilmeld from './Tilmeld';
 import defaults from './conf/defaults';
@@ -58,4 +58,80 @@ describe('User', () => {
       defaults.validatorUser({ config: defaults } as Tilmeld, invalidUser);
     }).toThrow('Invalid User:  "unknown" is not allowed');
   });
+
+  it("doesn't allow duplicate usernames", async () => {
+    const newUserA = await User.factory();
+
+    newUserA.username = 'new-user';
+    newUserA.email = 'newusera@localhost';
+    newUserA.nameFirst = 'New';
+    newUserA.nameLast = 'User';
+    newUserA.name = 'New User';
+    newUserA.$password('password');
+
+    const newUserB = await User.factory();
+
+    newUserB.username = 'new-user';
+    newUserB.email = 'newuserb@localhost';
+    newUserB.nameFirst = 'New';
+    newUserB.nameLast = 'User';
+    newUserB.name = 'New User';
+    newUserB.$password('password');
+
+    const promises = [newUserA.$saveSkipAC(), newUserB.$saveSkipAC()];
+
+    try {
+      await Promise.all(promises);
+
+      throw new Error("Shouldn't get here because of unique constraint.");
+    } catch (e: any) {
+      expect(e).toBeInstanceOf(EntityUniqueConstraintError);
+    }
+
+    await Promise.allSettled(promises);
+
+    for (const user of [newUserA, newUserB]) {
+      if (user.guid != null) {
+        expect(await user.$deleteSkipAC()).toEqual(true);
+      }
+    }
+  });
+
+  it("doesn't allow duplicate emails", async () => {
+    const newUserA = await User.factory();
+
+    newUserA.username = 'new-user-a';
+    newUserA.email = 'newuser@localhost';
+    newUserA.nameFirst = 'New';
+    newUserA.nameLast = 'User';
+    newUserA.name = 'New User';
+    newUserA.$password('password');
+
+    const newUserB = await User.factory();
+
+    newUserB.username = 'new-user-b';
+    newUserB.email = 'newuser@localhost';
+    newUserB.nameFirst = 'New';
+    newUserB.nameLast = 'User';
+    newUserB.name = 'New User';
+    newUserB.$password('password');
+
+    const promises = [newUserA.$saveSkipAC(), newUserB.$saveSkipAC()];
+
+    try {
+      await Promise.all(promises);
+
+      throw new Error("Shouldn't get here because of unique constraint.");
+    } catch (e: any) {
+      expect(e).toBeInstanceOf(EntityUniqueConstraintError);
+    }
+
+    await Promise.allSettled(promises);
+
+    for (const user of [newUserA, newUserB]) {
+      if (user.guid != null) {
+        expect(await user.$deleteSkipAC()).toEqual(true);
+      }
+    }
+  });
 });