@nymphjs/tilmeld 1.0.0-beta.85 → 1.0.0-beta.87

package/dist/User.js

@@ -1,12 +1,13 @@
 import crypto from 'node:crypto';
 import { humanSecret, nanoid } from '@nymphjs/guid';
 import strtotime from 'locutus/php/datetime/strtotime.js';
-import { difference } from 'lodash-es';
+import { difference, xor } from 'lodash-es';
 import { TOTP, Secret } from 'otpauth';
 import { toDataURL } from 'qrcode';
+import { splitn } from '@sciactive/splitn';
 import { enforceTilmeld } from './enforceTilmeld.js';
 import AbleObject from './AbleObject.js';
-import { BadDataError, BadEmailError, BadUsernameError, EmailChangeRateLimitExceededError, } from './errors/index.js';
+import { AccessControlError, BadDataError, BadEmailError, BadUsernameError, EmailChangeRateLimitExceededError, } from './errors/index.js';
 /**
  * A user data model.
  *
@@ -73,6 +74,7 @@ export default class User extends AbleObject {
         'sendRecovery',
         'recover',
         'getClientConfig',
+        'getDomainUsers',
     ];
     $privateData = [...User.DEFAULT_PRIVATE_DATA];
     static searchRestrictedData = [...User.DEFAULT_PRIVATE_DATA];
@@ -105,6 +107,10 @@ export default class User extends AbleObject {
      * verification, don't set this.
      */
     $originalEmail;
+    /**
+     * Used to save the current username for domain admin permissions.
+     */
+    $originalUsername;
     static async factoryUsername(username) {
         const entity = new this();
         if (username != null) {
@@ -260,6 +266,7 @@ export default class User extends AbleObject {
             regFields: tilmeld.config.regFields,
             userFields: tilmeld.config.userFields,
             emailUsernames: tilmeld.config.emailUsernames,
+            domainSupport: tilmeld.config.domainSupport,
             allowRegistration: tilmeld.config.allowRegistration,
             allowUsernameChange: tilmeld.config.allowUsernameChange,
             pwRecovery: tilmeld.config.pwRecovery,
@@ -280,6 +287,51 @@ export default class User extends AbleObject {
         }
         return result;
     }
+    /**
+     * Get the users in a domain. This is only accessible to the domain's admins.
+     */
+    static async getDomainUsers(domain, options) {
+        const tilmeld = enforceTilmeld(this);
+        if (!tilmeld.config.domainSupport) {
+            throw new AccessControlError('Domain support is not enabled.');
+        }
+        if (!domain) {
+            throw new BadDataError('Domain is required.');
+        }
+        domain = domain.toLowerCase();
+        if (!tilmeld.config.validDomainRegex.test(domain)) {
+            throw new BadDataError(tilmeld.config.validDomainRegexNotice);
+        }
+        if (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+            throw new AccessControlError('You do not have the authority to manage this domain.');
+        }
+        return await this.nymph.getEntities({
+            class: this.nymph.getEntityClass(User),
+            ...(options?.limit != null
+                ? {
+                    limit: options.limit,
+                }
+                : {}),
+            ...(options?.offset != null
+                ? {
+                    offset: options.offset,
+                }
+                : {}),
+            ...(options?.sort != null
+                ? {
+                    sort: options.sort,
+                }
+                : {}),
+            ...(options?.reverse != null
+                ? {
+                    reverse: options.reverse,
+                }
+                : {}),
+        }, {
+            type: '&',
+            like: ['username', `%@${domain.replace(/([\\%_])/g, (s) => `\\${s}`)}`],
+        });
+    }
     constructor() {
         super();
         // Defaults.
@@ -507,59 +559,84 @@ export default class User extends AbleObject {
     $jsonAcceptData(input, allowConflict = false) {
         const tilmeld = enforceTilmeld(this);
         this.$check();
-        if ('abilities' in input.data &&
-            input.data.abilities?.includes('system/admin') !==
-                this.$data.abilities?.includes('system/admin') &&
-            (!tilmeld.currentUser ||
-                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
-            throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
-        }
-        if ('abilities' in input.data &&
-            input.data.abilities?.includes('tilmeld/admin') !==
-                this.$data.abilities?.includes('tilmeld/admin') &&
-            (!tilmeld.currentUser ||
-                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
-            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        if ('abilities' in input.data) {
+            this.$checkIncomingAbilities(input.data.abilities);
+        }
+        // If the user is a new domain user, the data protection needs to be updated
+        // before the data is accepted, or else some things won't be accepted
+        // correctly (enabled, passwordTemp).
+        let reloadDataProtection = false;
+        if (tilmeld.config.domainSupport) {
+            let [_username, domain] = splitn(input.data.username ?? '', '@', 2);
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+            }
+            const user = tilmeld.User.current();
+            const isCurrentUser = user != null && user.$is(this);
+            // While loading, accessing abilities on the current user will infinitely
+            // loop, but if this is the current user, we can use its abilities.
+            const abilities = (isCurrentUser || user == null
+                ? this.$data.abilities
+                : user?.abilities) ?? [];
+            const isNewUser = input.guid == null;
+            const isDomainUser = !isCurrentUser &&
+                user != null &&
+                domain &&
+                abilities.includes(`tilmeld/domain/${domain}/admin`);
+            reloadDataProtection = !!(isNewUser && isDomainUser);
         }
-        if ('abilities' in input.data &&
-            input.data.abilities?.includes('tilmeld/switch') !==
-                this.$data.abilities?.includes('tilmeld/switch') &&
-            (!tilmeld.currentUser ||
-                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
-            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
-        }
-        this.$originalEmail = this.$data.email;
         super.$jsonAcceptData(input, allowConflict);
+        if (reloadDataProtection) {
+            // Load it again after data protection is run.
+            this.$updateDataProtection();
+            super.$jsonAcceptData(input, allowConflict);
+        }
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = enforceTilmeld(this);
         this.$check();
-        if ('abilities' in patch.set &&
-            patch.set.abilities?.includes('system/admin') !==
-                this.$data.abilities?.includes('system/admin') &&
+        if ('abilities' in patch.set) {
+            this.$checkIncomingAbilities(patch.set.abilities);
+        }
+        super.$jsonAcceptPatch(patch, allowConflict);
+    }
+    $checkIncomingAbilities(incoming) {
+        const tilmeld = enforceTilmeld(this);
+        if (!Array.isArray(incoming) ||
+            incoming.find((ability) => typeof ability !== 'string')) {
+            throw new BadDataError('Abilities must be an array of strings.');
+        }
+        if (incoming.includes('system/admin') !==
+            this.$data.abilities?.includes('system/admin') &&
             (!tilmeld.currentUser ||
                 !tilmeld.currentUser.abilities?.includes('system/admin'))) {
             throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
         }
-        if ('abilities' in patch.set &&
-            patch.set.abilities?.includes('tilmeld/admin') !==
-                this.$data.abilities?.includes('tilmeld/admin') &&
+        if (incoming.includes('tilmeld/admin') !==
+            this.$data.abilities?.includes('tilmeld/admin') &&
             (!tilmeld.currentUser ||
                 !tilmeld.currentUser.abilities?.includes('system/admin'))) {
             throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
         }
-        if ('abilities' in patch.set &&
-            patch.set.abilities?.includes('tilmeld/switch') !==
-                this.$data.abilities?.includes('tilmeld/switch') &&
+        if (incoming.includes('tilmeld/switch') !==
+            this.$data.abilities?.includes('tilmeld/switch') &&
             (!tilmeld.currentUser ||
                 !tilmeld.currentUser.abilities?.includes('system/admin'))) {
             throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
         }
-        this.$originalEmail = this.$data.email;
-        super.$jsonAcceptPatch(patch, allowConflict);
+        if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.$data.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ?? []).length &&
+            (!tilmeld.currentUser ||
+                (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+                    !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
+            throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
+        }
     }
-    $putData(data, sdata) {
-        super.$putData(data, sdata);
+    $putData(data, sdata, source) {
+        super.$putData(data, sdata, source);
+        if (source === 'server') {
+            this.$originalEmail = this.$data.email;
+            this.$originalUsername = this.$data.username;
+        }
         this.$updateDataProtection();
     }
     /**
@@ -570,6 +647,13 @@ export default class User extends AbleObject {
     $updateDataProtection(givenUser) {
         const tilmeld = enforceTilmeld(this);
         let user = givenUser ?? tilmeld.User.current();
+        let [_username, domain] = tilmeld.config.domainSupport
+            ? splitn(this.$data.username ?? '', '@', 2)
+            : [this.$data.username, null];
+        // Lowercase the domain part.
+        if (domain) {
+            domain = domain.toLowerCase();
+        }
         this.$clientEnabledMethods = [...User.DEFAULT_CLIENT_ENABLED_METHODS];
         this.$privateData = [...User.DEFAULT_PRIVATE_DATA];
         this.$allowlistData = [...User.DEFAULT_ALLOWLIST_DATA];
@@ -583,6 +667,11 @@ export default class User extends AbleObject {
             ? this.$data.abilities
             : user?.abilities) ?? [];
         const isNewUser = this.guid == null;
+        const isDomainUser = tilmeld.config.domainSupport &&
+            !isCurrentUser &&
+            user != null &&
+            domain &&
+            abilities.includes(`tilmeld/domain/${domain}/admin`);
         if (isCurrentUser) {
             // Users can check to see what abilities they have.
             this.$clientEnabledMethods.push('$gatekeeper');
@@ -595,6 +684,16 @@ export default class User extends AbleObject {
             this.$clientEnabledMethods.push('$saveTOTPSecret');
             this.$clientEnabledMethods.push('$removeTOTPSecret');
         }
+        if (isDomainUser) {
+            // Domain admins can check to see what abilities their users have.
+            this.$clientEnabledMethods.push('$gatekeeper');
+            this.$clientEnabledMethods.push('$changePassword');
+            this.$clientEnabledMethods.push('$revokeCurrentTokens');
+            this.$clientEnabledMethods.push('$hasTOTPSecret');
+            this.$clientEnabledMethods.push('$getNewTOTPSecret');
+            this.$clientEnabledMethods.push('$saveTOTPSecret');
+            this.$clientEnabledMethods.push('$removeTOTPSecret');
+        }
         if (user != null &&
             (abilities.includes('tilmeld/admin') ||
                 abilities.includes('system/admin'))) {
@@ -604,6 +703,56 @@ export default class User extends AbleObject {
             this.$clientEnabledMethods.push('$removeTOTPSecret');
             this.$allowlistData = undefined;
         }
+        else if (isDomainUser) {
+            // Domain admins can see their users' data, and edit some of it.
+            if (tilmeld.config.allowUsernameChange || isNewUser) {
+                this.$allowlistData.push('username');
+            }
+            this.$allowlistData.push('avatar');
+            if (tilmeld.config.userFields.includes('name')) {
+                this.$allowlistData.push('nameFirst');
+                this.$allowlistData.push('nameMiddle');
+                this.$allowlistData.push('nameLast');
+                this.$allowlistData.push('name');
+            }
+            if (tilmeld.config.userFields.includes('email')) {
+                this.$allowlistData.push('email');
+            }
+            if (tilmeld.config.userFields.includes('phone')) {
+                this.$allowlistData.push('phone');
+            }
+            this.$allowlistData.push('enabled');
+            this.$allowlistData.push('passwordTemp');
+            this.$privateData = [
+                // The things commented are there to show what is _not_ private.
+                // 'abilities',
+                // 'username',
+                // 'nameFirst',
+                // 'nameMiddle',
+                // 'nameLast',
+                // 'name',
+                // 'email',
+                // 'avatar',
+                // 'phone',
+                // 'group',
+                // 'groups',
+                // 'inheritAbilities',
+                // 'enabled',
+                'secret',
+                'emailChangeDate',
+                'newEmailSecret',
+                // 'newEmailAddress',
+                'cancelEmailSecret',
+                'cancelEmailAddress',
+                'recoverSecret',
+                'recoverSecretDate',
+                'salt',
+                'password',
+                // 'passwordTemp',
+                // 'revokeTokenDate',
+                'totpSecret',
+            ];
+        }
         else if (isCurrentUser || isNewUser) {
             // Users can see their own data, and edit some of it.
             if (tilmeld.config.allowUsernameChange || isNewUser) {
@@ -623,7 +772,7 @@ export default class User extends AbleObject {
                 this.$allowlistData.push('phone');
             }
             this.$privateData = [
-                // The things that are commented are there to show what is _not_ private.
+                // The things commented are there to show what is _not_ private.
                 // 'abilities',
                 // 'username',
                 // 'nameFirst',
@@ -1135,10 +1284,21 @@ export default class User extends AbleObject {
         const tilmeld = enforceTilmeld(this);
         this.$nymph.config.debugInfo('tilmeld', `Username check "${this.$data.username}".`);
         if (!tilmeld.config.emailUsernames) {
-            if (this.$data.username == null || !this.$data.username.length) {
+            let [username, domain] = tilmeld.config.domainSupport
+                ? splitn(this.$data.username ?? '', '@', 2)
+                : [this.$data.username, null];
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+                this.$data.username = `${username}@${domain}`;
+            }
+            if (this.$data.username == null ||
+                !this.$data.username.length ||
+                username == null ||
+                !username.length) {
                 return { result: false, message: 'Please specify a username.' };
             }
-            if (this.$data.username.length < tilmeld.config.minUsernameLength) {
+            if (username.length < tilmeld.config.minUsernameLength) {
                 return {
                     result: false,
                     message: 'Usernames must be at least ' +
@@ -1146,7 +1306,7 @@ export default class User extends AbleObject {
                         ' characters.',
                 };
             }
-            if (this.$data.username.length > tilmeld.config.maxUsernameLength) {
+            if (username.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Usernames must not exceed ' +
@@ -1154,18 +1314,34 @@ export default class User extends AbleObject {
                         ' characters.',
                 };
             }
-            if (difference(this.$data.username.split(''), tilmeld.config.validChars.split('')).length) {
+            if (difference(username.split(''), tilmeld.config.validChars.split(''))
+                .length) {
                 return {
                     result: false,
                     message: tilmeld.config.validCharsNotice,
                 };
             }
-            if (!tilmeld.config.validRegex.test(this.$data.username)) {
+            if (!tilmeld.config.validRegex.test(username)) {
                 return {
                     result: false,
                     message: tilmeld.config.validRegexNotice,
                 };
             }
+            if (domain != null) {
+                if (!tilmeld.config.validDomainRegex.test(domain)) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validDomainRegexNotice,
+                    };
+                }
+                if (!this.$is(tilmeld.currentUser) &&
+                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                    return {
+                        result: false,
+                        message: "You don't have the authority to manage users on this domain.",
+                    };
+                }
+            }
             const selector = {
                 type: '&',
                 ilike: [
@@ -1487,7 +1663,38 @@ export default class User extends AbleObject {
             tilmeld.gatekeeper('tilmeld/admin') &&
             !tilmeld.gatekeeper('system/admin') &&
             this.$data.abilities?.includes('system/admin')) {
-            throw new BadDataError("You don't have the authority to modify system admins.");
+            throw new AccessControlError("You don't have the authority to modify system admins.");
+        }
+        // Lowercase the domain part.
+        if (tilmeld.config.domainSupport) {
+            const [username, domain] = splitn(this.$data.username ?? '', '@', 2);
+            if (domain) {
+                this.$data.username = `${username}@${domain.toLowerCase()}`;
+            }
+        }
+        if (tilmeld.config.domainSupport) {
+            const [_username, domain] = splitn(this.$data.username ?? '', '@', 2);
+            const [_originalUsername, originalDomain] = splitn(this.$originalUsername ?? '', '@', 2);
+            if (this.guid != null &&
+                ((originalDomain == null && domain != null) ||
+                    (domain == null && originalDomain != null))) {
+                throw new AccessControlError("Users can't switch to or from having a domain once created.");
+            }
+            if (!this.$skipAcWhenSaving &&
+                !tilmeld.gatekeeper('tilmeld/admin') &&
+                !tilmeld.gatekeeper('system/admin')) {
+                if (domain != null &&
+                    !this.$is(tilmeld.currentUser) &&
+                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                    throw new AccessControlError("You don't have the authority to modify users on this domain.");
+                }
+                if (originalDomain != null &&
+                    originalDomain !== domain &&
+                    (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+                        !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
+                    throw new AccessControlError("You don't have the authority to modify users on this domain.");
+                }
+            }
         }
         let sendVerification = false;
         // Formatting.
@@ -1761,7 +1968,7 @@ export default class User extends AbleObject {
             this.$setNymph(nymph);
             throw e;
         }
-        let ret;
+        let ret = false;
         let preGuid = this.guid;
         let preCdate = this.cdate;
         let preMdate = this.mdate;
@@ -1783,6 +1990,9 @@ export default class User extends AbleObject {
         }
         catch (e) {
             await tnymph.rollback(transaction);
+            this.guid = preGuid;
+            this.cdate = preCdate;
+            this.mdate = preMdate;
             this.$setNymph(nymph);
             throw e;
         }
@@ -1800,17 +2010,21 @@ export default class User extends AbleObject {
             }
             this.$descendantGroups = undefined;
             this.$gatekeeperCache = undefined;
-            await tnymph.commit(transaction);
+            ret = await tnymph.commit(transaction);
+        }
+        else {
+            await tnymph.rollback(transaction);
+        }
+        this.$setNymph(nymph);
+        if (ret) {
+            this.$originalEmail = this.$data.email;
+            this.$originalUsername = this.$data.username;
             const tilmeld = enforceTilmeld(nymph);
             if (tilmeld.User.current(true).$is(this)) {
                 // Update the user in the session cache.
                 await tilmeld.fillSession(this);
             }
         }
-        else {
-            await tnymph.rollback(transaction);
-        }
-        this.$setNymph(nymph);
         return ret;
     }
     /**
@@ -1830,17 +2044,49 @@ export default class User extends AbleObject {
     async $delete() {
         const tilmeld = enforceTilmeld(this);
         if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new BadDataError("You don't have the authority to delete users.");
+            throw new AccessControlError("You don't have the authority to delete users.");
         }
         if (!this.$skipAcWhenDeleting &&
             !tilmeld.gatekeeper('system/admin') &&
             this.$data.abilities?.includes('system/admin')) {
-            throw new BadDataError("You don't have the authority to delete system admins.");
+            throw new AccessControlError("You don't have the authority to delete system admins.");
+        }
+        if (this.$data.username !== this.$originalUsername) {
+            throw new AccessControlError("You can't delete a user while switching their username.");
         }
         if (tilmeld.User.current(true).$is(this)) {
             await this.$logout();
         }
-        return await super.$delete();
+        if (this.$data.group != null && this.$is(this.$data.group.user)) {
+            const transaction = 'tilmeld-delete-' + this.guid;
+            const nymph = this.$nymph;
+            const tnymph = await nymph.startTransaction(transaction);
+            this.$setNymph(tnymph);
+            // Read the skip ac value here, because super.$delete changes it.
+            const $skipAcWhenDeleting = this.$skipAcWhenDeleting;
+            // Delete the user.
+            let success = await super.$delete();
+            if (!success) {
+                await tnymph.rollback(transaction);
+                this.$setNymph(nymph);
+                return success;
+            }
+            // Delete the generated group.
+            success = $skipAcWhenDeleting
+                ? await this.$data.group.$deleteSkipAC()
+                : await this.$data.group.$delete();
+            if (success) {
+                success = await tnymph.commit(transaction);
+            }
+            else {
+                await tnymph.rollback(transaction);
+            }
+            this.$setNymph(nymph);
+            return success;
+        }
+        else {
+            return await super.$delete();
+        }
     }
     /*
      * This should *never* be accessible on the client.