@nymphjs/tilmeld 1.0.0-beta.8 → 1.0.0-beta.81

package/dist/Tilmeld.js

@@ -10,104 +10,220 @@ const conf_1 = require("./conf");
 const errors_1 = require("./errors");
 const Group_1 = __importDefault(require("./Group"));
 const User_1 = __importDefault(require("./User"));
+const enforceTilmeld_1 = require("./enforceTilmeld");
+/**
+ * A user and group system for Nymph.js.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@gmail.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
 class Tilmeld {
+    /**
+     * The Nymph instance.
+     */
+    nymph = {};
+    /**
+     * The Tilmeld config.
+     */
+    config;
+    /**
+     * The currently logged in user.
+     */
+    currentUser = null;
+    /**
+     * The user class for this instance of Tilmeld.
+     */
+    User = User_1.default;
+    /**
+     * The group class for this instance of Tilmeld.
+     */
+    Group = Group_1.default;
+    /**
+     * If you will be performing authentication functions (logging in/out), you
+     * should set these so Tilmeld can read and write cookies and headers.
+     *
+     * If you want the user to be authenticated with the cookie and/or header they
+     * provide, you should set at least the request. It's better to set both, so
+     * the JWT can be updated if needed.
+     *
+     * After you set these, call `authenticate()` to read user authentication data
+     * from them and fill the user's session.
+     *
+     * If you want to support cookie based authentication (which still requires an
+     * XSRF token for security), you should enable the cookie parser middleware.
+     */
+    request = null;
+    response = null;
+    /**
+     * Used to avoid infinite loop.
+     */
+    alreadyLoggedOutSwitch = false;
+    /**
+     * Gatekeeper ability cache.
+     *
+     * Gatekeeper will cache the user's abilities that it calculates, so it can
+     * check faster if that user has been checked before.
+     */
+    gatekeeperCache = null;
+    /**
+     * Create a new instance of Tilmeld.
+     *
+     * @param config The Tilmeld configuration.
+     */
     constructor(config) {
-        this.nymph = {};
-        this.currentUser = null;
-        this.User = User_1.default;
-        this.Group = Group_1.default;
-        this.request = null;
-        this.response = null;
-        this.skipAuthenticate = false;
         this.config = { ...conf_1.ConfigDefaults, ...config };
+        if (this.config.emailUsernames &&
+            (!this.config.userFields.includes('email') ||
+                !this.config.regFields.includes('email'))) {
+            throw new Error('You must include email in userFields and regFields if you use emailUsernames.');
+        }
+        for (let field of this.config.regFields) {
+            if (!this.config.userFields.includes(field)) {
+                throw new Error(`All fields in regFields must also be in userFields: ${field}`);
+            }
+        }
     }
+    /**
+     * This is used internally by Nymph. Don't call it yourself.
+     *
+     * @returns A clone of this instance.
+     */
     clone() {
         const tilmeld = new Tilmeld(this.config);
         tilmeld.request = this.request;
         tilmeld.response = this.response;
         tilmeld.currentUser = this.currentUser;
-        tilmeld.skipAuthenticate = true;
+        tilmeld.gatekeeperCache = this.gatekeeperCache;
         return tilmeld;
     }
+    /**
+     * Initialize Tilmeld.
+     *
+     * This is meant to be called internally by Nymph. Don't call this directly.
+     *
+     * @param nymph The Nymph instance.
+     */
     init(nymph) {
         this.nymph = nymph;
-        const tilmeld = this;
         if (this.nymph.driver == null) {
             throw new Error("Tilmeld can't be configured before Nymph.");
         }
-        class NymphUser extends User_1.default {
+        // Configure the classes.
+        if (nymph.parent) {
+            // This is a cloned Nymph, it should have classes already.
+            this.User = this.nymph.getEntityClass(User_1.default);
+            this.Group = this.nymph.getEntityClass(Group_1.default);
         }
-        NymphUser.nymph = nymph;
-        NymphUser.tilmeld = tilmeld;
-        NymphUser.skipOnClone = true;
-        this.User = this.nymph.addEntityClass(NymphUser);
-        class NymphGroup extends Group_1.default {
-        }
-        NymphGroup.nymph = nymph;
-        NymphGroup.tilmeld = tilmeld;
-        NymphUser.skipOnClone = true;
-        this.Group = this.nymph.addEntityClass(NymphGroup);
+        else {
+            // This is a new Nymph, add the classes.
+            this.User = this.nymph.addEntityClass(User_1.default);
+            this.Group = this.nymph.addEntityClass(Group_1.default);
+        }
+        // Clone the current user so its Nymph instance is correct.
+        if (this.currentUser) {
+            const currentUserGUID = this.currentUser.guid;
+            const currentUserCDate = this.currentUser.cdate;
+            const currentUserMDate = this.currentUser.mdate;
+            const currentUserTags = this.currentUser.tags;
+            const currentUserData = this.currentUser.$getData();
+            const currentUserSData = this.currentUser.$getSData();
+            const user = this.User.factorySync();
+            user.guid = currentUserGUID;
+            user.cdate = currentUserCDate;
+            user.mdate = currentUserMDate;
+            user.tags = currentUserTags;
+            user.$putData(currentUserData, currentUserSData);
+            this.currentUser = user;
+            this.currentUser.$updateDataProtection();
+            this.currentUser.$updateGroupDataProtection();
+        }
+        // Set up access control hooks when Nymph is called.
+        this.nymph.config.debugInfo('tilmeld', 'Initializing access controls.');
         this.initAccessControl();
-        if (this.request != null && !this.skipAuthenticate) {
-            this.authenticate();
-        }
-        this.skipAuthenticate = false;
     }
+    /**
+     * Check to see if the current user has an ability.
+     *
+     * If `ability` is undefined, it will check to see if a user is currently
+     * logged in.
+     *
+     * @param ability The ability.
+     * @returns Whether the user has the given ability.
+     */
     gatekeeper(ability) {
-        if (this.currentUser == null) {
+        if (this.currentUser == null || this.gatekeeperCache == null) {
             return false;
         }
-        return this.currentUser.$gatekeeper(ability);
+        if (ability == null) {
+            return true;
+        }
+        return ((ability in this.gatekeeperCache && !!this.gatekeeperCache[ability]) ||
+            !!this.currentUser.abilities?.includes('system/admin'));
     }
     initAccessControl() {
+        // Check for the skip access control option and add AC selectors.
         const handleQuery = function (nymph, options, selectors) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             if (!options ||
                 !('skipAc' in options) ||
                 !options.skipAc ||
                 options.source === 'client') {
                 if (options?.source === 'client') {
-                    if (!tilmeld.gatekeeper('tilmeld/admin') &&
+                    if ((!tilmeld.currentUser ||
+                        (!tilmeld.currentUser.abilities?.includes('tilmeld/admin') &&
+                            !tilmeld.currentUser.abilities?.includes('system/admin'))) && // The user is not an admin.
                         ((!tilmeld.config.enableUserSearch &&
-                            options.class?.factorySync() instanceof User_1.default) ||
+                            options.class?.factorySync() instanceof User_1.default) || // The use is searching for a user and searching is disabled.
                             (!tilmeld.config.enableGroupSearch &&
-                                options.class?.factorySync() instanceof Group_1.default)) &&
-                        (selectors[0] == null ||
-                            selectors[0].type !== '&' ||
-                            (!('guid' in selectors[0]) && !('equal' in selectors[0])) ||
+                                options.class?.factorySync() instanceof Group_1.default)) && // Or the same, but for a group.
+                        (selectors[0] == null || // No selector specified.
+                            selectors[0].type !== '&' || // Or the type is not and.
+                            (!('guid' in selectors[0]) && !('equal' in selectors[0])) || // Or they're searching for something other than guid or equal.
                             ('guid' in selectors[0] &&
                                 (!selectors[0].guid?.length ||
-                                    !selectors[0].guid?.[0]?.length)) ||
+                                    !selectors[0].guid?.[0]?.length)) || // Or they're not searching for a specific guid.
                             ('equal' in selectors[0] &&
                                 selectors[0].equal?.[0]?.[0] !== 'username' &&
-                                selectors[0].equal?.[0]?.[0] !== 'groupname'))) {
+                                selectors[0].equal?.[0]?.[0] !== 'groupname')) // Or they're not searching for a specific username/groupname.
+                    ) {
+                        // If the user is not specifically searching for a GUID or username,
+                        // and they're not allowed to search, it should fail.
                         throw new errors_1.AccessControlError('No permission to search.');
                     }
                 }
+                // Add access control selectors
                 tilmeld.addAccessControlSelectors(options, selectors);
             }
         };
         handleQuery.skipOnClone = true;
+        // Filter entities being deleted for user permissions.
         const checkPermissionsDelete = async function (nymph, entity) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             if (typeof entity.$tilmeldDeleteSkipAC === 'function' &&
                 entity.$tilmeldDeleteSkipAC()) {
                 return;
             }
+            // Test for permissions.
             if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.FULL_ACCESS)) {
                 throw new errors_1.AccessControlError('No permission to delete.');
             }
         };
         checkPermissionsDelete.skipOnClone = true;
+        // Filter entities being deleted for user permissions.
         const checkPermissionsDeleteByID = async function (nymph, guid, className) {
-            const entity = nymph.driver.getEntitySync({ class: nymph.getEntityClass(className ?? 'Entity') }, { type: '&', guid: guid });
+            const entity = await nymph.getEntity({ class: nymph.getEntityClass(className ?? 'Entity') }, { type: '&', guid: guid });
             if (entity != null) {
                 checkPermissionsDelete(nymph, entity);
             }
         };
         checkPermissionsDeleteByID.skipOnClone = true;
+        // Filter entities being saved for user permissions, and filter any
+        // disallowed changes to AC properties.
         const checkPermissionsSaveAndFilterAcChanges = async function (nymph, entity) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             if (!entity) {
                 return;
             }
@@ -116,29 +232,10 @@ class Tilmeld {
                 return;
             }
             if (entity.guid != null) {
+                // If the entity is not new, check that the user has full access before
+                // allowing a change to ac properties.
                 const originalAc = entity.$getOriginalAcValues();
-                const newAc = {
-                    user: entity.user ?? undefined,
-                    group: entity.group ?? undefined,
-                    acUser: entity.acUser ?? undefined,
-                    acGroup: entity.acGroup ?? undefined,
-                    acOther: entity.acOther ?? undefined,
-                    acRead: entity.acRead ?? undefined,
-                    acWrite: entity.acWrite ?? undefined,
-                    acFull: entity.acFull ?? undefined,
-                };
-                const setAcProperties = (acValues) => {
-                    for (let name in acValues) {
-                        const value = acValues[name];
-                        if (value == null) {
-                            delete entity[name];
-                        }
-                        else {
-                            entity[name] = value;
-                        }
-                    }
-                };
-                setAcProperties(originalAc);
+                const newAc = entity.$getCurrentAcValues();
                 function areAcPropertiesChanged(a, b) {
                     for (const name of ['user', 'group']) {
                         const aVal = a[name];
@@ -149,7 +246,7 @@ class Tilmeld {
                         else if (aVal == null || bVal == null) {
                             return true;
                         }
-                        if (!aVal.$is(bVal)) {
+                        if (aVal !== bVal) {
                             return true;
                         }
                     }
@@ -178,40 +275,55 @@ class Tilmeld {
                         if (aVal.length !== bVal.length) {
                             return true;
                         }
-                        if ((0, lodash_1.xor)(aVal.map((entity) => entity.guid), bVal.map((entity) => entity.guid)).length) {
+                        if ((0, lodash_1.xor)(aVal, bVal).length) {
                             return true;
                         }
                     }
                     return false;
                 }
                 if (areAcPropertiesChanged(originalAc, newAc)) {
-                    if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.FULL_ACCESS)) {
+                    if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.FULL_ACCESS, undefined, originalAc)) {
+                        // Only allow changes to AC properties if the user has full access.
                         throw new errors_1.AccessControlError('No permission to change access control properties.');
                     }
-                    if (((originalAc.user && !originalAc.user.$is(newAc.user)) ||
-                        (!originalAc.user &&
-                            newAc.user &&
-                            !newAc.user.$is(tilmeld.currentUser))) &&
-                        !tilmeld.gatekeeper('tilmeld/admin')) {
+                    if ((originalAc.user != null && originalAc.user !== newAc.user) ||
+                        (originalAc.user == null &&
+                            newAc.user != null &&
+                            newAc.user !== tilmeld.currentUser?.guid)) {
                         throw new errors_1.AccessControlError('No permission to assign to another user.');
                     }
-                    if (newAc.group &&
-                        !newAc.group.$is(originalAc.group) &&
-                        !(newAc.group.$is(tilmeld.currentUser?.group) ||
-                            newAc.group.$inArray(tilmeld.currentUser?.groups ?? [])) &&
-                        !tilmeld.gatekeeper('tilmeld/admin')) {
+                    if (newAc.group != null &&
+                        newAc.group !== originalAc.group &&
+                        !(newAc.group === tilmeld.currentUser?.$getGid() ||
+                            (tilmeld.currentUser?.$getGids() ?? []).includes(newAc.group))) {
                         throw new errors_1.AccessControlError('No permission to assign to another group.');
                     }
-                    setAcProperties(newAc);
                 }
             }
+            // Test for permissions.
             if (!tilmeld.checkPermissions(entity, nymph_1.TilmeldAccessLevels.WRITE_ACCESS)) {
                 throw new errors_1.AccessControlError('No permission to write.');
             }
         };
         checkPermissionsSaveAndFilterAcChanges.skipOnClone = true;
+        /*
+         * Add the current user's "user", "group", and access control to new entity.
+         *
+         * This occurs right before an entity is saved. It only alters the entity
+         * if:
+         *
+         * - There is a user logged in.
+         * - The entity is new (doesn't have a GUID.)
+         * - The entity is not a user or group.
+         *
+         * Default access control is
+         *
+         * - acUser = TilmeldAccessLevels.FULL_ACCESS
+         * - acGroup = TilmeldAccessLevels.READ_ACCESS
+         * - acOther = TilmeldAccessLevels.NO_ACCESS
+         */
         const addAccess = async function (nymph, entity) {
-            const tilmeld = nymph.tilmeld;
+            const tilmeld = (0, enforceTilmeld_1.enforceTilmeld)(nymph);
             const user = tilmeld.currentUser;
             if (user != null &&
                 entity.guid == null &&
@@ -220,10 +332,11 @@ class Tilmeld {
                 if (entity.user == null) {
                     entity.user = user;
                 }
-                if (entity.group == null &&
-                    user.group != null &&
-                    user.group.guid != null) {
-                    entity.group = user.group;
+                if (entity.group == null) {
+                    const group = user.group;
+                    if (group != null && group.guid != null) {
+                        entity.group = group;
+                    }
                 }
                 if (entity.acUser == null) {
                     entity.acUser = nymph_1.TilmeldAccessLevels.FULL_ACCESS;
@@ -303,24 +416,29 @@ class Tilmeld {
         this.nymph.on('beforeDeleteEntity', checkPermissionsDelete);
         this.nymph.on('beforeDeleteEntityByID', checkPermissionsDeleteByID);
     }
+    /**
+     * Add selectors to a list of options and selectors which will limit results
+     * to only entities the current user has access to.
+     *
+     * @param optionsAndSelectors The options and selectors of the query.
+     */
     addAccessControlSelectors(options, selectors) {
         const user = this.currentUser;
-        if (user != null &&
-            (user.abilities?.indexOf('system/admin') ?? -1) !== -1) {
-            return;
-        }
         if (options == null) {
             throw new Error('No options in argument.');
         }
         else if ('class' in options &&
             (options.class?.factorySync() instanceof User_1.default ||
                 options.class?.factorySync() instanceof Group_1.default)) {
+            // They are requesting a user/group. Always accessible for reading.
             return;
         }
         if (user == null || user.guid == null) {
             selectors.push({
                 type: '|',
+                // Other access control is sufficient.
                 gte: [['acOther', nymph_1.TilmeldAccessLevels.READ_ACCESS]],
+                // The user and group are not set.
                 selector: [
                     {
                         type: '&',
@@ -335,6 +453,7 @@ class Tilmeld {
                     type: '&',
                     '!defined': [['user', 'group']],
                 },
+                // It is owned by the user.
                 {
                     type: '&',
                     ref: [['user', user.guid]],
@@ -343,28 +462,25 @@ class Tilmeld {
             ];
             const groupRefs = [];
             const acRefs = [];
-            if (user.group != null && user.group.guid != null) {
-                groupRefs.push(['group', user.group.guid]);
-                acRefs.push(['acRead', user.group.guid]);
-                acRefs.push(['acWrite', user.group.guid]);
-                acRefs.push(['acFull', user.group.guid]);
+            const gid = user.$getGid();
+            if (gid != null) {
+                // It belongs to the user's primary group.
+                groupRefs.push(['group', gid]);
+                // User's primary group is listed in acRead, acWrite, or acFull.
+                acRefs.push(['acRead', gid]);
+                acRefs.push(['acWrite', gid]);
+                acRefs.push(['acFull', gid]);
             }
-            for (let curSecondaryGroup of user.groups ?? []) {
-                if (curSecondaryGroup != null && curSecondaryGroup.guid != null) {
-                    groupRefs.push(['group', curSecondaryGroup.guid]);
-                    acRefs.push(['acRead', curSecondaryGroup.guid]);
-                    acRefs.push(['acWrite', curSecondaryGroup.guid]);
-                    acRefs.push(['acFull', curSecondaryGroup.guid]);
-                }
-            }
-            for (let curDescendantGroup of user.$getDescendantGroupsSync()) {
-                if (curDescendantGroup != null && curDescendantGroup.guid != null) {
-                    groupRefs.push(['group', curDescendantGroup.guid]);
-                    acRefs.push(['acRead', curDescendantGroup.guid]);
-                    acRefs.push(['acWrite', curDescendantGroup.guid]);
-                    acRefs.push(['acFull', curDescendantGroup.guid]);
-                }
+            const gids = user.$getGids();
+            for (let curGid of gids ?? []) {
+                // It belongs to the user's secondary group.
+                groupRefs.push(['group', curGid]);
+                // User's secondary group is listed in acRead, acWrite, or acFull.
+                acRefs.push(['acRead', curGid]);
+                acRefs.push(['acWrite', curGid]);
+                acRefs.push(['acFull', curGid]);
             }
+            // All the group refs.
             if (groupRefs.length) {
                 subSelectors.push({
                     type: '&',
@@ -377,6 +493,7 @@ class Tilmeld {
                     ],
                 });
             }
+            // All the acRead, acWrite, and acFull refs.
             if (acRefs.length) {
                 subSelectors.push({
                     type: '|',
@@ -385,8 +502,11 @@ class Tilmeld {
             }
             const selector = {
                 type: '|',
+                // Other access control is sufficient.
                 gte: [['acOther', nymph_1.TilmeldAccessLevels.READ_ACCESS]],
+                // The user and group are not set.
                 selector: subSelectors,
+                // The user is listed in acRead, acWrite, or acFull.
                 ref: [
                     ['acRead', user.guid],
                     ['acWrite', user.guid],
@@ -396,12 +516,76 @@ class Tilmeld {
             selectors.push(selector);
         }
     }
-    checkPermissions(entity, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user) {
-        if (typeof entity !== 'object' || typeof entity.$is !== 'function') {
-            return false;
+    /**
+     * Check an entity's permissions for a user.
+     *
+     * This will check the AC (Access Control) properties of the entity. These
+     * include the following properties:
+     *
+     * - acUser
+     * - acGroup
+     * - acOther
+     * - acRead
+     * - acWrite
+     * - acFull
+     *
+     * "acUser" refers to the entity's owner, "acGroup" refers to all users in the
+     * entity's group and all ancestor groups, and "acOther" refers to any user
+     * who doesn't fit these descriptions.
+     *
+     * Each of these properties should be either NO_ACCESS, READ_ACCESS,
+     * WRITE_ACCESS, or FULL_ACCESS.
+     *
+     * - NO_ACCESS - the user has no access to the entity.
+     * - READ_ACCESS, the user has read access to the entity.
+     * - WRITE_ACCESS, the user has read and write access to the entity, but can't
+     *   delete it, change its access controls, or change its ownership.
+     * - FULL_ACCESS, the user has read, write, and delete access to the entity,
+     *   as well as being able to manage its access controls and ownership.
+     *
+     * These properties default to:
+     *
+     * - acUser = TilmeldAccessLevels.FULL_ACCESS
+     * - acGroup = TilmeldAccessLevels.READ_ACCESS
+     * - acOther = TilmeldAccessLevels.NO_ACCESS
+     *
+     * "acRead", "acWrite", and "acFull" are arrays of users and/or groups that
+     * also have those permissions.
+     *
+     * Only users with FULL_ACCESS have the ability to change any of the ac*,
+     * user, and group properties.
+     *
+     * The following conditions will result in different checks, which determine
+     * whether the check passes:
+     *
+     * - It is a user or group. (True for READ_ACCESS or Tilmeld admins.)
+     * - No user is logged in. (Check other AC.)
+     * - The entity is the user. (Always true.)
+     * - It is the user's primary group. (True for READ_ACCESS.)
+     * - The user or its groups are listed in "acRead". (True for READ_ACCESS.)
+     * - The user or its groups are listed in "acWrite". (True for READ_ACCESS and
+     *   WRITE_ACCESS.)
+     * - The user or its groups are listed in "acFull". (Always true.)
+     * - Its "user" is the user. (It is owned by the user.) (Check user AC.)
+     * - Its "group" is the user's primary group. (Check group AC.)
+     * - Its "group" is one of the user's secondary groups. (Check group AC.)
+     * - Its "group" is a descendant of one of the user's groups. (Check group
+     *   AC.)
+     * - None of the above. (Check other AC.)
+     *
+     * @param entity The entity to check.
+     * @param type The lowest level of permission to consider a pass.
+     * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
+     * @param acProperties The acProperties to use instead of getting them from the entity.
+     * @returns Whether the current user has at least `type` permission for the entity.
+     */
+    checkPermissions(entity, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user, acProperties) {
+        if (!acProperties) {
+            acProperties = entity.$getCurrentAcValues();
         }
         let userOrNull = null;
         let userOrEmpty = this.User.factorySync();
+        // Calculate the user.
         if (user == null) {
             userOrNull = this.currentUser;
             userOrEmpty = this.User.current(true);
@@ -410,131 +594,158 @@ class Tilmeld {
             userOrNull = user;
             userOrEmpty = user;
         }
-        if (userOrEmpty.$gatekeeper('system/admin')) {
-            return true;
-        }
+        // Users and groups are always readable. Editable by Tilmeld admins.
         if ((entity instanceof User_1.default || entity instanceof Group_1.default) &&
             (type === nymph_1.TilmeldAccessLevels.READ_ACCESS ||
-                userOrEmpty.$gatekeeper('tilmeld/admin'))) {
-            return true;
-        }
-        if (entity.user == null && entity.group == null) {
+                userOrEmpty.abilities?.includes('tilmeld/admin') ||
+                userOrEmpty.abilities?.includes('system/admin'))) {
             return true;
         }
-        const acUser = entity.acUser ?? nymph_1.TilmeldAccessLevels.FULL_ACCESS;
-        const acGroup = entity.acGroup ?? nymph_1.TilmeldAccessLevels.READ_ACCESS;
-        const acOther = entity.acOther ?? nymph_1.TilmeldAccessLevels.NO_ACCESS;
-        if (userOrNull === null) {
+        // Load access control, since we need it now...
+        const acUser = acProperties.acUser ?? nymph_1.TilmeldAccessLevels.FULL_ACCESS;
+        const acGroup = acProperties.acGroup ?? nymph_1.TilmeldAccessLevels.READ_ACCESS;
+        const acOther = acProperties.acOther ?? nymph_1.TilmeldAccessLevels.NO_ACCESS;
+        if (userOrNull == null) {
             return acOther >= type;
         }
+        // Check if the entity is the user.
         if (userOrEmpty.$is(entity)) {
             return true;
         }
-        if (userOrEmpty.group != null &&
-            typeof userOrEmpty.group.$is === 'function' &&
-            userOrEmpty.group.$is(entity) &&
+        // Check if the entity is the user's group. Always readable.
+        const gid = userOrEmpty.$getGid();
+        if (gid != null &&
+            entity.guid === gid &&
             type === nymph_1.TilmeldAccessLevels.READ_ACCESS) {
             return true;
         }
-        let allGroups = userOrEmpty.group == null ? [] : [userOrEmpty.group];
-        allGroups = allGroups.concat(userOrEmpty.groups ?? []);
-        allGroups = allGroups.concat(userOrEmpty.$getDescendantGroupsSync());
+        // Calculate all the groups the user belongs to.
+        let allGids = gid == null ? [] : [gid];
+        allGids = allGids.concat(userOrEmpty.$getGids() ?? []);
+        // Check access ac properties.
         const checks = [
             {
                 type: nymph_1.TilmeldAccessLevels.FULL_ACCESS,
-                array: [...(entity.acFull ?? [])],
+                array: [...(acProperties.acFull ?? [])],
             },
             {
                 type: nymph_1.TilmeldAccessLevels.WRITE_ACCESS,
-                array: [...(entity.acWrite ?? [])],
+                array: [...(acProperties.acWrite ?? [])],
             },
             {
                 type: nymph_1.TilmeldAccessLevels.READ_ACCESS,
-                array: [...(entity.acRead ?? [])],
+                array: [...(acProperties.acRead ?? [])],
             },
         ];
         for (let curCheck of checks) {
             if (type <= curCheck.type) {
-                if (userOrEmpty.$inArray(curCheck.array)) {
+                if (curCheck.array.includes(userOrEmpty.guid)) {
                     return true;
                 }
-                for (let curGroup of allGroups) {
-                    if (typeof curGroup.$inArray === 'function' &&
-                        curGroup.$inArray(curCheck.array)) {
+                for (let curGid of allGids) {
+                    if (curCheck.array.includes(curGid)) {
                         return true;
                     }
                 }
             }
         }
-        if (entity.user != null &&
-            typeof entity.user.$is === 'function' &&
-            entity.user.$is(userOrNull)) {
+        // Check ownership ac properties.
+        if (acProperties.user != null && acProperties.user === userOrNull.guid) {
             return acUser >= type;
         }
-        if (entity.group != null &&
-            typeof entity.group.$inArray === 'function' &&
-            entity.group.$inArray(allGroups)) {
+        if (acProperties.group != null && allGids.includes(acProperties.group)) {
             return acGroup >= type;
         }
         return acOther >= type;
     }
-    checkClientUIDPermissions(name, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user) {
+    /**
+     * Check a UID's permissions for a user.
+     *
+     * ## THIS ONLY CHECKS AUTOMATICALLY FOR CLIENT REQUESTS.
+     *
+     * UID functions on the Node.js side are not checked automatically. This
+     * function is only run automatically for UID functions run from the client.
+     * You should call this function manually if you're running a UID function on
+     * the Node.js side and you want it gated.
+     *
+     * This will check the Tilmeld config and the user's abilities.
+     *
+     * - READ_ACCESS, the UID is listed in clientReadableUIDs or the user has the
+     *   "uid/get/nameofuid" ability.
+     * - WRITE_ACCESS, the UID is listed in clientEnabledUIDs or the user has the
+     *   "uid/new/nameofuid" ability.
+     * - FULL_ACCESS, the UID is listed in clientSetabledUIDs or the user has the
+     *   "uid/set/nameofuid" ability.
+     *
+     * @param name The UID to check.
+     * @param type The lowest level of permission to consider a pass.
+     * @param user The user to check permissions for. If null, uses the current user. If false, checks for public access.
+     * @returns Whether the current user has at least `type` permission for the UID.
+     */
+    async checkClientUIDPermissions(name, type = nymph_1.TilmeldAccessLevels.READ_ACCESS, user) {
         let userOrEmpty = this.User.factorySync();
+        // Calculate the user.
         if (user == null) {
             userOrEmpty = this.User.current(true);
         }
         else if (user !== false) {
             userOrEmpty = user;
         }
-        if (userOrEmpty.$gatekeeper('system/admin')) {
+        if (userOrEmpty.abilities?.includes('system/admin')) {
             return true;
         }
         if (type === nymph_1.TilmeldAccessLevels.FULL_ACCESS) {
-            return (this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-                userOrEmpty.$gatekeeper(`uid/set/${name}`));
+            return (this.config.clientSetabledUIDs.includes(name) ||
+                (await userOrEmpty.$gatekeeper(`uid/set/${name}`)));
         }
         else if (type === nymph_1.TilmeldAccessLevels.WRITE_ACCESS) {
-            return (this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
-                this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-                userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
-                userOrEmpty.$gatekeeper(`uid/set/${name}`));
+            return (this.config.clientEnabledUIDs.includes(name) ||
+                this.config.clientSetabledUIDs.includes(name) ||
+                (await userOrEmpty.$gatekeeper(`uid/new/${name}`)) ||
+                (await userOrEmpty.$gatekeeper(`uid/set/${name}`)));
         }
         else if (type === nymph_1.TilmeldAccessLevels.READ_ACCESS) {
-            return (this.config.clientReadableUIDs.indexOf(name) !== -1 ||
-                this.config.clientEnabledUIDs.indexOf(name) !== -1 ||
-                this.config.clientSetabledUIDs.indexOf(name) !== -1 ||
-                userOrEmpty.$gatekeeper(`uid/get/${name}`) ||
-                userOrEmpty.$gatekeeper(`uid/new/${name}`) ||
-                userOrEmpty.$gatekeeper(`uid/set/${name}`));
+            return (this.config.clientReadableUIDs.includes(name) ||
+                this.config.clientEnabledUIDs.includes(name) ||
+                this.config.clientSetabledUIDs.includes(name) ||
+                (await userOrEmpty.$gatekeeper(`uid/get/${name}`)) ||
+                (await userOrEmpty.$gatekeeper(`uid/new/${name}`)) ||
+                (await userOrEmpty.$gatekeeper(`uid/set/${name}`)));
         }
         return false;
     }
-    fillSession(user) {
-        const _group = user.group;
-        const _groups = user.groups;
+    /**
+     * Fill session user data.
+     *
+     * @param user The user.
+     */
+    async fillSession(user) {
         this.currentUser = user;
+        this.gatekeeperCache = await user.$getGatekeeperCache();
+        // Now update the data protection on the user and all the groups.
         this.currentUser.$updateDataProtection();
-        if (this.currentUser.group != null) {
-            this.currentUser.group.$updateDataProtection();
-        }
-        for (let group of this.currentUser.groups ?? []) {
-            group.$updateDataProtection();
-        }
+        this.currentUser.$updateGroupDataProtection();
     }
+    /**
+     * Clear session user data.
+     */
     clearSession() {
         const user = this.currentUser;
         this.currentUser = null;
+        this.gatekeeperCache = null;
         if (user) {
             user.$updateDataProtection();
-            if (user.group != null) {
-                user.group.$updateDataProtection();
-            }
-            for (let group of user.groups ?? []) {
-                group.$updateDataProtection();
-            }
+            user.$updateGroupDataProtection();
         }
     }
+    /**
+     * Validate and extract the user from a token.
+     *
+     * @param token The authentication token.
+     * @returns The user on success, null on failure.
+     */
     async extractToken(token) {
+        this.nymph.config.debugInfo('tilmeld', 'Extracting and validating token.');
         const extract = this.config.jwtExtract(this.config, token);
         if (extract == null) {
             return null;
@@ -544,89 +755,246 @@ class Tilmeld {
             type: '&',
             guid: guid,
         });
-        if (!user || !user.guid || !user.enabled) {
+        if (!user || !user.guid) {
             return null;
         }
         return user;
     }
-    authenticate(skipXsrfToken = false) {
+    /**
+     * Check for TILMELDAUTH and TILMELDSWITCH tokens, and, if set, authenticate
+     * from it/them.
+     *
+     * You can also call this function after setting `response.locals.user` to the
+     * user you want to authenticate. You *should* check for `user.enabled` before
+     * setting this variable, unless you explicitly want to log in as a disabled
+     * user. (The user must be an instance of the User class for this Tilmeld
+     * instance.)
+     *
+     * This function will set `response.locals.user` to the logged in user on
+     * successful authentication.
+     *
+     * @param skipXsrfToken Skip the XSRF token check.
+     * @param skipRenew Skip the token renewal step, even if the token is close to expiration.
+     * @returns True if a user was authenticated, false on any failure.
+     */
+    async authenticate(skipXsrfToken = false, skipRenew = false) {
         if (this.request == null) {
             return false;
         }
+        if (this.response &&
+            this.response.locals.user &&
+            this.response.locals.user instanceof this.User) {
+            // The user has already been authenticated through some other means.
+            const user = this.response.locals.user;
+            await this.fillSession(user);
+            return true;
+        }
         const cookies = this.request.cookies ?? {};
+        // If a client does't support cookies, they can use the X-TILMELDAUTH header
+        // to provide the auth token.
         let fromAuthHeader = false;
         let authToken;
+        let switchToken;
         if (this.request.header('x-tilmeldauth') != null) {
             fromAuthHeader = true;
             authToken = this.request.header('x-tilmeldauth');
+            switchToken =
+                this.request.header('x-tilmeldswitch') ||
+                    'TILMELDSWITCH' in cookies
+                    ? cookies.TILMELDSWITCH
+                    : null;
         }
         else if ('TILMELDAUTH' in cookies) {
             fromAuthHeader = false;
             authToken = cookies.TILMELDAUTH;
+            switchToken = 'TILMELDSWITCH' in cookies ? cookies.TILMELDSWITCH : null;
         }
         else {
             return false;
         }
-        let extract;
+        let authExtract;
+        let switchExtract;
         if (skipXsrfToken ||
             this.request.originalUrl.startsWith(this.config.setupPath)) {
-            extract = this.config.jwtExtract(this.config, authToken);
+            // The request is for the setup app, or we were told to skip the XSRF
+            // check, so don't check for the XSRF token.
+            authExtract = this.config.jwtExtract(this.config, authToken);
+            switchExtract = switchToken
+                ? this.config.jwtExtract(this.config, switchToken)
+                : null;
         }
         else {
+            // The request is for something else, so check for a valid XSRF token,
+            // unless the auth token is provided by a header (instead of a cookie).
             const xsrfToken = this.request.header('x-xsrf-token');
             if (xsrfToken == null && !fromAuthHeader) {
                 return false;
             }
-            extract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+            authExtract = this.config.jwtExtract(this.config, authToken, xsrfToken);
+            switchExtract = switchToken
+                ? this.config.jwtExtract(this.config, switchToken)
+                : null;
         }
-        if (extract == null) {
-            this.logout();
+        if (authExtract == null) {
+            await this.logout();
             return false;
         }
-        const { guid, expire } = extract;
-        const user = this.User.factorySync(guid);
-        if (user.guid == null || !user.enabled) {
-            this.logout();
+        const { guid, issued, expire } = authExtract;
+        const { guid: switchGuid, expire: switchExpire } = switchExtract || {
+            guid: null,
+            expire: null,
+        };
+        const user = await this.User.factory(guid);
+        if (user.guid == null ||
+            !user.enabled ||
+            expire.getTime() <= Date.now() ||
+            issued.getTime() > Date.now() ||
+            (user.revokeTokenDate != null && issued.getTime() <= user.revokeTokenDate)) {
+            await this.logout();
             return false;
         }
-        if (expire.valueOf() < Date.now() + this.config.jwtRenew * 1000) {
-            this.login(user, fromAuthHeader);
+        if (switchGuid && switchExpire && switchExpire.getTime() > Date.now()) {
+            // Load the switch user.
+            const switchUser = await this.User.factory(switchGuid);
+            if (switchUser.guid == null) {
+                await this.logoutSwitch();
+            }
+            else {
+                await this.fillSession(switchUser);
+                if (this.response) {
+                    this.response.locals.user = switchUser;
+                }
+                return true;
+            }
+        }
+        if (!skipRenew &&
+            expire.getTime() < Date.now() + this.config.jwtRenew * 1000) {
+            // If the user is less than renew time from needing a new token, give them
+            // a new one.
+            await this.login(user, fromAuthHeader);
         }
         else {
-            this.fillSession(user);
+            await this.fillSession(user);
+        }
+        if (this.response) {
+            this.response.locals.user = user;
         }
         return true;
     }
-    login(user, sendAuthHeader) {
+    /**
+     * Logs the given user into the system.
+     *
+     * @param user The user.
+     * @param sendAuthHeader Send the auth token as a custom header.
+     * @param sendCookie Send the auth token as a cookie.
+     * @returns True on success, false on failure.
+     */
+    async login(user, sendAuthHeader, sendCookie = true) {
         if (user.guid != null && user.enabled) {
-            if (this.response && !this.response.headersSent) {
-                const token = this.config.jwtBuilder(this.config, user);
-                const appUrl = new url_1.URL(this.config.appUrl);
-                this.response.cookie('TILMELDAUTH', token, {
-                    domain: this.config.cookieDomain,
-                    path: this.config.cookiePath,
-                    maxAge: this.config.jwtExpire * 1000,
-                    secure: appUrl.protocol === 'https',
-                    httpOnly: false,
-                    sameSite: appUrl.protocol === 'https' ? 'lax' : 'strict',
-                });
-                if (sendAuthHeader) {
-                    this.response.set('X-TILMELDAUTH', token);
+            if (this.response) {
+                if (!this.response.headersSent) {
+                    const token = this.config.jwtBuilder(this.config, user);
+                    if (sendCookie) {
+                        const appUrl = new url_1.URL(this.config.appUrl);
+                        this.response.cookie('TILMELDAUTH', token, {
+                            domain: this.config.cookieDomain,
+                            path: this.config.cookiePath,
+                            maxAge: this.config.jwtExpire * 1000,
+                            secure: appUrl.protocol === 'https:',
+                            httpOnly: false, // Allow JS access (for CSRF protection).
+                            sameSite: appUrl.protocol === 'https:' ? 'lax' : 'strict',
+                        });
+                    }
+                    if (sendAuthHeader) {
+                        this.response.set('X-TILMELDAUTH', token);
+                    }
+                }
+                this.response.locals.user = user;
+            }
+            await this.fillSession(user);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Adds a switch auth token for the given user.
+     *
+     * This effectively logs the current user in to the system as the given user.
+     *
+     * @param user The user.
+     * @param sendAuthHeader Send the auth token as a custom header.
+     * @param sendCookie Send the auth token as a cookie.
+     * @returns True on success, false on failure.
+     */
+    async loginSwitch(user, sendAuthHeader, sendCookie = true) {
+        if (user.guid != null) {
+            if (this.response) {
+                if (!this.response.headersSent) {
+                    const token = this.config.jwtBuilder(this.config, user, true);
+                    if (sendCookie) {
+                        const appUrl = new url_1.URL(this.config.appUrl);
+                        this.response.cookie('TILMELDSWITCH', token, {
+                            domain: this.config.cookieDomain,
+                            path: this.config.cookiePath,
+                            maxAge: this.config.jwtSwitchExpire * 1000,
+                            secure: appUrl.protocol === 'https:',
+                            httpOnly: false, // Allow JS access (for PubSub auth token).
+                            sameSite: appUrl.protocol === 'https:' ? 'lax' : 'strict',
+                        });
+                    }
+                    if (sendAuthHeader) {
+                        this.response.set('X-TILMELDSWITCH', token);
+                    }
                 }
+                this.response.locals.user = user;
             }
-            this.fillSession(user);
+            await this.fillSession(user);
             return true;
         }
         return false;
     }
-    logout() {
+    /**
+     * Logs the current user out of the system.
+     *
+     * @param clearCookie Clear the auth cookie. (Also send a header.)
+     */
+    async logout(clearCookie = true) {
+        if (this.request && !this.alreadyLoggedOutSwitch) {
+            const cookies = this.request.cookies ?? {};
+            if ('TILMELDSWITCH' in cookies) {
+                this.alreadyLoggedOutSwitch = true;
+                return await this.logoutSwitch(clearCookie);
+            }
+        }
         this.clearSession();
-        if (this.response && !this.response.headersSent) {
-            this.response.clearCookie('TILMELDAUTH', {
-                domain: this.config.cookieDomain,
-                path: this.config.cookiePath,
-            });
-            this.response.set('X-TILMELDAUTH', '');
+        if (this.response) {
+            if (clearCookie && !this.response.headersSent) {
+                this.response.clearCookie('TILMELDAUTH', {
+                    domain: this.config.cookieDomain,
+                    path: this.config.cookiePath,
+                });
+                this.response.set('X-TILMELDAUTH', '');
+            }
+            this.response.locals.user = null;
+        }
+    }
+    /**
+     * Clears the switch user out of the system.
+     *
+     * @param clearCookie Clear the auth cookie. (Also send a header.)
+     */
+    async logoutSwitch(clearCookie = true) {
+        this.clearSession();
+        if (this.response) {
+            if (clearCookie && !this.response.headersSent) {
+                this.response.clearCookie('TILMELDSWITCH', {
+                    domain: this.config.cookieDomain,
+                    path: this.config.cookiePath,
+                });
+                this.response.set('X-TILMELDSWITCH', '');
+            }
+            this.response.locals.user = null;
+            await this.authenticate(false, true);
         }
     }
 }