@nymphjs/tilmeld 1.0.0-beta.85 → 1.0.0-beta.87

package/src/Group.ts

@@ -8,11 +8,13 @@ import type {
   Selector,
   SerializedEntityData,
 } from '@nymphjs/nymph';
-import { difference } from 'lodash-es';
+import { difference, xor } from 'lodash-es';
+import { splitn } from '@sciactive/splitn';
 
 import { enforceTilmeld } from './enforceTilmeld.js';
 import AbleObject from './AbleObject.js';
 import {
+  AccessControlError,
   BadDataError,
   BadEmailError,
   BadUsernameError,
@@ -119,6 +121,10 @@ export default class Group extends AbleObject<GroupData> {
    * This should only be used by the backend.
    */
   private $skipAcWhenDeleting = false;
+  /**
+   * Used to save the current groupname for domain admin permissions.
+   */
+  public $originalGroupname?: string;
 
   static async factoryGroupname(
     groupname?: string,
@@ -281,55 +287,37 @@ export default class Group extends AbleObject<GroupData> {
   }
 
   public $jsonAcceptData(input: EntityJson, allowConflict = false) {
-    const tilmeld = enforceTilmeld(this);
     this.$check();
 
-    if (
-      'abilities' in input.data &&
-      input.data.abilities?.includes('system/admin') !==
-        this.$data.abilities?.includes('system/admin') &&
-      (!tilmeld.currentUser ||
-        !tilmeld.currentUser.abilities?.includes('system/admin'))
-    ) {
-      throw new BadDataError(
-        "You don't have the authority to grant or revoke system/admin.",
-      );
+    if ('abilities' in input.data) {
+      this.$checkIncomingAbilities(input.data.abilities);
     }
 
-    if (
-      'abilities' in input.data &&
-      input.data.abilities?.includes('tilmeld/admin') !==
-        this.$data.abilities?.includes('tilmeld/admin') &&
-      (!tilmeld.currentUser ||
-        !tilmeld.currentUser.abilities?.includes('system/admin'))
-    ) {
-      throw new BadDataError(
-        "You don't have the authority to grant or revoke tilmeld/admin.",
-      );
-    }
+    super.$jsonAcceptData(input, allowConflict);
+  }
 
-    if (
-      'abilities' in input.data &&
-      input.data.abilities?.includes('tilmeld/switch') !==
-        this.$data.abilities?.includes('tilmeld/switch') &&
-      (!tilmeld.currentUser ||
-        !tilmeld.currentUser.abilities?.includes('system/admin'))
-    ) {
-      throw new BadDataError(
-        "You don't have the authority to grant or revoke tilmeld/switch.",
-      );
+  public $jsonAcceptPatch(patch: EntityPatch, allowConflict = false) {
+    this.$check();
+
+    if ('abilities' in patch.set) {
+      this.$checkIncomingAbilities(patch.set.abilities);
     }
 
-    super.$jsonAcceptData(input, allowConflict);
+    super.$jsonAcceptPatch(patch, allowConflict);
   }
 
-  public $jsonAcceptPatch(patch: EntityPatch, allowConflict = false) {
+  private $checkIncomingAbilities(incoming: any) {
     const tilmeld = enforceTilmeld(this);
-    this.$check();
 
     if (
-      'abilities' in patch.set &&
-      patch.set.abilities?.includes('system/admin') !==
+      !Array.isArray(incoming) ||
+      incoming.find((ability) => typeof ability !== 'string')
+    ) {
+      throw new BadDataError('Abilities must be an array of strings.');
+    }
+
+    if (
+      incoming.includes('system/admin') !==
         this.$data.abilities?.includes('system/admin') &&
       (!tilmeld.currentUser ||
         !tilmeld.currentUser.abilities?.includes('system/admin'))
@@ -340,8 +328,7 @@ export default class Group extends AbleObject<GroupData> {
     }
 
     if (
-      'abilities' in patch.set &&
-      patch.set.abilities?.includes('tilmeld/admin') !==
+      incoming.includes('tilmeld/admin') !==
         this.$data.abilities?.includes('tilmeld/admin') &&
       (!tilmeld.currentUser ||
         !tilmeld.currentUser.abilities?.includes('system/admin'))
@@ -352,8 +339,7 @@ export default class Group extends AbleObject<GroupData> {
     }
 
     if (
-      'abilities' in patch.set &&
-      patch.set.abilities?.includes('tilmeld/switch') !==
+      incoming.includes('tilmeld/switch') !==
         this.$data.abilities?.includes('tilmeld/switch') &&
       (!tilmeld.currentUser ||
         !tilmeld.currentUser.abilities?.includes('system/admin'))
@@ -363,11 +349,32 @@ export default class Group extends AbleObject<GroupData> {
       );
     }
 
-    super.$jsonAcceptPatch(patch, allowConflict);
+    if (
+      xor(
+        incoming.filter((ability: string) => ability.startsWith('tilmeld/')),
+        this.$data.abilities?.filter((ability: string) =>
+          ability.startsWith('tilmeld/'),
+        ) ?? [],
+      ).length &&
+      (!tilmeld.currentUser ||
+        (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+          !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke Tilmeld abilities.",
+      );
+    }
   }
 
-  public $putData(data: EntityData, sdata?: SerializedEntityData) {
-    super.$putData(data, sdata);
+  public $putData(
+    data: EntityData,
+    sdata?: SerializedEntityData,
+    source?: 'server',
+  ) {
+    super.$putData(data, sdata, source);
+    if (source === 'server') {
+      this.$originalGroupname = this.$data.groupname;
+    }
     this.$updateDataProtection();
   }
 
@@ -379,6 +386,13 @@ export default class Group extends AbleObject<GroupData> {
   public $updateDataProtection(givenUser?: User & UserData) {
     const tilmeld = enforceTilmeld(this);
     let user = givenUser ?? tilmeld.User.current();
+    let [_groupname, domain] = tilmeld.config.domainSupport
+      ? splitn(this.$data.groupname ?? '', '@', 2)
+      : [this.$data.groupname, null];
+    // Lowercase the domain part.
+    if (domain) {
+      domain = domain.toLowerCase();
+    }
 
     this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
     this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
@@ -402,6 +416,14 @@ export default class Group extends AbleObject<GroupData> {
     ) {
       // Users can see their group's data.
       this.$privateData = [];
+    } else if (
+      user != null &&
+      tilmeld.config.domainSupport &&
+      domain &&
+      user.abilities?.includes(`tilmeld/domain/${domain}/admin`)
+    ) {
+      // Domain admins can see their groups' data.
+      this.$privateData = [];
     }
   }
 
@@ -567,10 +589,25 @@ export default class Group extends AbleObject<GroupData> {
   }> {
     const tilmeld = enforceTilmeld(this);
     if (!tilmeld.config.emailUsernames) {
-      if (this.$data.groupname == null || !this.$data.groupname.length) {
+      let [groupname, domain] = tilmeld.config.domainSupport
+        ? splitn(this.$data.groupname ?? '', '@', 2)
+        : [this.$data.groupname, null];
+
+      // Lowercase the domain part.
+      if (domain) {
+        domain = domain.toLowerCase();
+        this.$data.groupname = `${groupname}@${domain}`;
+      }
+
+      if (
+        this.$data.groupname == null ||
+        !this.$data.groupname.length ||
+        groupname == null ||
+        !groupname.length
+      ) {
         return { result: false, message: 'Please specify a groupname.' };
       }
-      if (this.$data.groupname.length < tilmeld.config.minUsernameLength) {
+      if (groupname.length < tilmeld.config.minUsernameLength) {
         return {
           result: false,
           message:
@@ -579,7 +616,7 @@ export default class Group extends AbleObject<GroupData> {
             ' characters.',
         };
       }
-      if (this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
+      if (groupname.length > tilmeld.config.maxUsernameLength) {
         return {
           result: false,
           message:
@@ -589,22 +626,38 @@ export default class Group extends AbleObject<GroupData> {
         };
       }
       if (
-        difference(
-          this.$data.groupname.split(''),
-          tilmeld.config.validChars.split(''),
-        ).length
+        difference(groupname.split(''), tilmeld.config.validChars.split(''))
+          .length
       ) {
         return {
           result: false,
           message: tilmeld.config.validCharsNotice,
         };
       }
-      if (!tilmeld.config.validRegex.test(this.$data.groupname)) {
+      if (!tilmeld.config.validRegex.test(groupname)) {
         return {
           result: false,
           message: tilmeld.config.validRegexNotice,
         };
       }
+      if (domain != null) {
+        if (!tilmeld.config.validDomainRegex.test(domain)) {
+          return {
+            result: false,
+            message: tilmeld.config.validDomainRegexNotice,
+          };
+        }
+        if (
+          !this.$is(tilmeld.currentUser?.group) &&
+          !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)
+        ) {
+          return {
+            result: false,
+            message:
+              "You don't have the authority to manage groups on this domain.",
+          };
+        }
+      }
 
       const selector: Selector = {
         type: '&',
@@ -707,6 +760,59 @@ export default class Group extends AbleObject<GroupData> {
       return false;
     }
 
+    // Lowercase the domain part.
+    if (tilmeld.config.domainSupport) {
+      const [groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+      if (domain) {
+        this.$data.groupname = `${groupname}@${domain.toLowerCase()}`;
+      }
+    }
+
+    if (tilmeld.config.domainSupport) {
+      const [_groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+      const [_originalGroupname, originalDomain] = splitn(
+        this.$originalGroupname ?? '',
+        '@',
+        2,
+      );
+
+      if (
+        this.guid != null &&
+        ((originalDomain == null && domain != null) ||
+          (domain == null && originalDomain != null))
+      ) {
+        throw new AccessControlError(
+          "Groups can't switch to or from having a domain once created.",
+        );
+      }
+
+      if (
+        !this.$skipAcWhenSaving &&
+        !tilmeld.gatekeeper('tilmeld/admin') &&
+        !tilmeld.gatekeeper('system/admin')
+      ) {
+        if (
+          domain != null &&
+          !this.$is(tilmeld.currentUser) &&
+          !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)
+        ) {
+          throw new AccessControlError(
+            "You don't have the authority to modify groups on this domain.",
+          );
+        }
+        if (
+          originalDomain != null &&
+          originalDomain !== domain &&
+          (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+            !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))
+        ) {
+          throw new AccessControlError(
+            "You don't have the authority to modify groups on this domain.",
+          );
+        }
+      }
+    }
+
     // Formatting.
     this.$data.groupname = this.$data.groupname.trim();
     if (tilmeld.config.emailUsernames) {
@@ -752,15 +858,23 @@ export default class Group extends AbleObject<GroupData> {
       delete this.$data.unverifiedSecondary;
     }
 
-    // Groups should never have 'system/admin', 'tilmeld/admin', or
-    // 'tilmeld/switch' abilities.
-    this.$data.abilities = difference(this.$data.abilities ?? [], [
-      'system/admin',
-      'tilmeld/admin',
-      'tilmeld/switch',
-      null,
-      undefined,
-    ]) as string[];
+    // Groups should never have 'system/admin', 'tilmeld/admin',
+    // 'tilmeld/switch', or domain admin abilities.
+    this.$data.abilities = (this.$data.abilities ?? []).filter((ability) => {
+      if (
+        ['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
+        -1
+      ) {
+        return false;
+      }
+      if (ability == null) {
+        return false;
+      }
+      if (ability.startsWith('tilmeld/domain/') && ability.endsWith('/admin')) {
+        return false;
+      }
+      return true;
+    }) as string[];
 
     // Verification.
     const unCheck = await this.$checkGroupname();
@@ -818,7 +932,11 @@ export default class Group extends AbleObject<GroupData> {
       }
     }
 
-    return await super.$save();
+    const ret = await super.$save();
+    if (ret) {
+      this.$originalGroupname = this.$data.groupname;
+    }
+    return ret;
   }
 
   /*
@@ -840,7 +958,14 @@ export default class Group extends AbleObject<GroupData> {
   public async $delete() {
     let tilmeld = enforceTilmeld(this);
     if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
-      throw new BadDataError("You don't have the authority to delete groups.");
+      throw new AccessControlError(
+        "You don't have the authority to delete groups.",
+      );
+    }
+    if (this.$data.groupname !== this.$originalGroupname) {
+      throw new AccessControlError(
+        "You can't delete a group while switching its groupname.",
+      );
     }
 
     const transaction = 'tilmeld-delete-' + this.guid;
@@ -913,9 +1038,9 @@ export default class Group extends AbleObject<GroupData> {
     }
 
     // Delete the group.
-    const success = await super.$delete();
+    let success = await super.$delete();
     if (success) {
-      await tnymph.commit(transaction);
+      success = await tnymph.commit(transaction);
     } else {
       await tnymph.rollback(transaction);
     }

package/src/Tilmeld.ts

@@ -10,10 +10,11 @@ import {
 } from '@nymphjs/nymph';
 import { Request, Response } from 'express';
 import { xor } from 'lodash-es';
+import { splitn } from '@sciactive/splitn';
 
 import { Config, ConfigDefaults as defaults } from './conf/index.js';
 import { AccessControlError } from './errors/index.js';
-import Group from './Group.js';
+import Group, { GroupData } from './Group.js';
 import User, { UserData } from './User.js';
 import { AccessControlData } from './Tilmeld.types.js';
 import { enforceTilmeld } from './enforceTilmeld.js';
@@ -108,6 +109,12 @@ export default class Tilmeld implements TilmeldInterface {
         );
       }
     }
+
+    if (this.config.emailUsernames && this.config.domainSupport) {
+      throw new Error(
+        'Email usernames and domain support cannot both be enabled.',
+      );
+    }
   }
 
   /**
@@ -165,6 +172,8 @@ export default class Tilmeld implements TilmeldInterface {
       user.mdate = currentUserMDate;
       user.tags = currentUserTags;
       user.$putData(currentUserData, currentUserSData);
+      user.$originalEmail = this.currentUser.$originalEmail;
+      user.$originalUsername = this.currentUser.$originalUsername;
       this.currentUser = user;
       this.currentUser.$updateDataProtection();
       this.currentUser.$updateGroupDataProtection();
@@ -738,6 +747,27 @@ export default class Tilmeld implements TilmeldInterface {
       return true;
     }
 
+    // Users and groups that belong to a domain are readable and editable by
+    // that domain's admins.
+    if (
+      this.config.domainSupport &&
+      (entity instanceof User || entity instanceof Group)
+    ) {
+      const [_local, domain] = splitn(
+        (entity instanceof User
+          ? (entity as User & UserData).username
+          : (entity as Group & GroupData).groupname) ?? '',
+        '@',
+        2,
+      );
+      if (
+        domain &&
+        userOrEmpty.abilities?.includes(`tilmeld/domain/${domain}/admin`)
+      ) {
+        return true;
+      }
+    }
+
     // Load access control, since we need it now...
     const acUser = acProperties.acUser ?? TilmeldAccessLevels.FULL_ACCESS;
     const acGroup = acProperties.acGroup ?? TilmeldAccessLevels.READ_ACCESS;

package/src/User.test.ts

@@ -3,6 +3,7 @@ import { Nymph, EntityUniqueConstraintError } from '@nymphjs/nymph';
 
 import Tilmeld from './Tilmeld.js';
 import defaults from './conf/defaults.js';
+import { AccessControlError } from './errors/index.js';
 
 const tilmeld = new Tilmeld({
   appName: 'My App',
@@ -11,6 +12,7 @@ const tilmeld = new Tilmeld({
   cookiePath: '/',
   setupPath: '/user',
   emailUsernames: false,
+  domainSupport: true,
   verifyRedirect: 'http://localhost:8080',
   verifyChangeRedirect: 'http://localhost:8080',
   cancelChangeRedirect: 'http://localhost:8080',
@@ -134,4 +136,83 @@ describe('User', () => {
       }
     }
   });
+
+  it('allows a domain user', async () => {
+    const domainAdmin = await User.factory();
+
+    domainAdmin.username = 'admin';
+    domainAdmin.email = 'admin@localhost';
+    domainAdmin.nameFirst = 'Admin';
+    domainAdmin.nameLast = 'User';
+    domainAdmin.name = 'Admin User';
+    domainAdmin.$password('password');
+    domainAdmin.$grant('tilmeld/domain/example.com/admin');
+
+    expect(await domainAdmin.$saveSkipAC()).toEqual(true);
+
+    // Log in the domain admin.
+    await tilmeld.fillSession(domainAdmin);
+
+    const domainUser = await User.factory();
+
+    domainUser.username = 'new-user@example.com';
+    domainUser.email = 'newuser@localhost';
+    domainUser.nameFirst = 'New';
+    domainUser.nameLast = 'User';
+    domainUser.name = 'New User';
+    domainUser.$password('password');
+
+    expect(await domainUser.$save()).toEqual(true);
+
+    tilmeld.clearSession();
+
+    for (const user of [domainAdmin, domainUser]) {
+      if (user.guid != null) {
+        expect(await user.$deleteSkipAC()).toEqual(true);
+      }
+    }
+  });
+
+  it('disallows a domain user with no admin permission', async () => {
+    const domainAdmin = await User.factory();
+
+    domainAdmin.username = 'admin';
+    domainAdmin.email = 'admin@localhost';
+    domainAdmin.nameFirst = 'Admin';
+    domainAdmin.nameLast = 'User';
+    domainAdmin.name = 'Admin User';
+    domainAdmin.$password('password');
+    domainAdmin.$grant('tilmeld/domain/example.com/admin');
+
+    expect(await domainAdmin.$saveSkipAC()).toEqual(true);
+
+    // Log in the domain admin.
+    await tilmeld.fillSession(domainAdmin);
+
+    const domainUser = await User.factory();
+
+    // The wrong domain name.
+    domainUser.username = 'new-user@example.net';
+    domainUser.email = 'newuser@localhost';
+    domainUser.nameFirst = 'New';
+    domainUser.nameLast = 'User';
+    domainUser.name = 'New User';
+    domainUser.$password('password');
+
+    try {
+      await domainUser.$save();
+
+      throw new Error("Shouldn't get here because of access control.");
+    } catch (e: any) {
+      expect(e).toBeInstanceOf(AccessControlError);
+    }
+
+    tilmeld.clearSession();
+
+    for (const user of [domainAdmin, domainUser]) {
+      if (user.guid != null) {
+        expect(await user.$deleteSkipAC()).toEqual(true);
+      }
+    }
+  });
 });