@nymphjs/tilmeld 1.0.0-beta.9 → 1.0.0-beta.90

package/dist/Group.js

@@ -1,16 +1,57 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const md5_1 = __importDefault(require("crypto-js/md5"));
-const lodash_1 = require("lodash");
-const AbleObject_1 = __importDefault(require("./AbleObject"));
-const errors_1 = require("./errors");
-class Group extends AbleObject_1.default {
-    static async factory(guid) {
-        return (await super.factory(guid));
-    }
+import crypto from 'node:crypto';
+import { difference, xor } from 'lodash-es';
+import { splitn } from '@sciactive/splitn';
+import { enforceTilmeld } from './enforceTilmeld.js';
+import AbleObject from './AbleObject.js';
+import { AccessControlError, BadDataError, BadEmailError, BadUsernameError, CouldNotChangeDefaultPrimaryGroupError, } from './errors/index.js';
+import UserClass from './User.js';
+/**
+ * A user group data model.
+ *
+ * Written by Hunter Perrin for SciActive.
+ *
+ * @author Hunter Perrin <hperrin@gmail.com>
+ * @copyright SciActive Inc
+ * @see http://nymph.io/
+ */
+export default class Group extends AbleObject {
+    /**
+     * The instance of Tilmeld to use for queries.
+     */
+    static ETYPE = 'tilmeld_group';
+    static class = 'Group';
+    static DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
+    static DEFAULT_ALLOWLIST_DATA = [];
+    $tags = [];
+    $clientEnabledMethods = [
+        '$checkGroupname',
+        '$checkEmail',
+        '$getAvatar',
+        '$getChildren',
+        '$getDescendants',
+        '$getLevel',
+        '$isDescendant',
+    ];
+    static clientEnabledStaticMethods = [
+        'getPrimaryGroups',
+        'getSecondaryGroups',
+    ];
+    $privateData = [...Group.DEFAULT_PRIVATE_DATA];
+    static searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
+    $allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
+    $allowlistTags = [];
+    /**
+     * This should only be used by the backend.
+     */
+    $skipAcWhenSaving = false;
+    /**
+     * This should only be used by the backend.
+     */
+    $skipAcWhenDeleting = false;
+    /**
+     * Used to save the current groupname for domain admin permissions.
+     */
+    $originalGroupname;
     static async factoryGroupname(groupname) {
         const entity = new this();
         if (groupname != null) {
@@ -26,63 +67,89 @@ class Group extends AbleObject_1.default {
         }
         return entity;
     }
-    static factorySync(guid) {
-        return super.factorySync(guid);
-    }
-    constructor(guid) {
-        super(guid);
-        this.$tags = [];
-        this.$clientEnabledMethods = [
-            '$checkGroupname',
-            '$checkEmail',
-            '$getAvatar',
-            '$getChildren',
-            '$getDescendants',
-            '$getLevel',
-            '$isDescendant',
-        ];
-        this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
-        this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
-        this.$allowlistTags = [];
-        this.$skipAcWhenSaving = false;
-        if (this.guid == null) {
-            this.$data.enabled = true;
-            this.$data.abilities = [];
-            this.$updateDataProtection();
-        }
-    }
+    /**
+     * Get all the groups that can be assigned as primary groups.
+     *
+     * @param options The options for an optional search query.
+     * @param selectors The selectors for an optional search query.
+     * @returns An array of the assignable primary groups.
+     */
     static async getPrimaryGroups(options, selectors) {
-        if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
+        const tilmeld = enforceTilmeld(this);
+        if (!tilmeld.gatekeeper('tilmeld/admin')) {
             throw new Error("You don't have permission to do that.");
         }
-        return await this.getAssignableGroups(this.tilmeld.config.highestPrimary, { ...options, class: this.tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        return await this.getAssignableGroups(tilmeld.config.highestPrimary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
     }
+    /**
+     * Get all the groups that can be assigned as secondary groups.
+     *
+     * @param options The options for an optional search query.
+     * @param selectors The selectors for an optional search query.
+     * @returns An array of the assignable secondary groups.
+     */
     static async getSecondaryGroups(options, selectors) {
-        if (!this.tilmeld.gatekeeper('tilmeld/admin')) {
+        const tilmeld = enforceTilmeld(this);
+        if (!tilmeld.gatekeeper('tilmeld/admin')) {
             throw new Error("You don't have permission to do that.");
         }
-        return await this.getAssignableGroups(this.tilmeld.config.highestSecondary, { ...options, class: this.tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
+        return await this.getAssignableGroups(tilmeld.config.highestSecondary, { ...options, class: tilmeld.Group, return: 'entity' }, [...(selectors ?? [])]);
     }
     static async getAssignableGroups(highestParent, options, selectors) {
+        const tilmeld = enforceTilmeld(this);
         let assignableGroups = [];
         if (highestParent === false) {
             return assignableGroups;
         }
-        assignableGroups = await this.nymph.getEntities({ ...options, class: this.tilmeld.Group }, ...selectors);
+        assignableGroups = await this.nymph.getEntities({ ...options, class: tilmeld.Group }, ...selectors);
         if (highestParent !== true) {
-            assignableGroups = assignableGroups.filter((group) => {
+            assignableGroups = (await Promise.all(assignableGroups.map(async (group) => {
                 let curGroup = group;
-                while (curGroup.parent != null && curGroup.parent.cdate != null) {
-                    if (curGroup.parent.guid === highestParent) {
-                        return true;
+                let parent = curGroup.parent;
+                await parent?.$wake();
+                while (parent != null && parent?.cdate != null) {
+                    if (parent?.guid === highestParent) {
+                        return group;
                     }
-                    curGroup = curGroup.parent;
+                    curGroup = parent;
+                    parent = curGroup.parent;
+                    await parent?.$wake();
                 }
-                return false;
-            });
+                return null;
+            }))).filter((group) => group != null);
         }
         return assignableGroups;
     }
+    constructor() {
+        super();
+        // Defaults.
+        this.$data.enabled = true;
+        this.$data.abilities = [];
+        this.$updateDataProtection();
+    }
+    $setNymph(nymph) {
+        this.$nymph = nymph;
+        if (!this.$asleep()) {
+            if (this.$data.user && this.$data.user.$nymph !== nymph) {
+                this.$data.user.$setNymph(nymph);
+            }
+            if (this.$data.parent && this.$data.parent.$nymph !== nymph) {
+                this.$data.parent.$setNymph(nymph);
+            }
+        }
+    }
+    async $getUniques() {
+        const tilmeld = enforceTilmeld(this);
+        const uniques = [`u:${this.$data.groupname}`];
+        if (!tilmeld.config.emailUsernames &&
+            tilmeld.config.userFields.includes('email')) {
+            uniques.push(`e:${this.$data.email}`);
+        }
+        if (this.$data.defaultPrimary) {
+            uniques.push(`o:default-primary`);
+        }
+        return uniques;
+    }
     $getAvatar() {
         if (this.$data.avatar != null && this.$data.avatar !== '') {
             return this.$data.avatar;
@@ -91,60 +158,117 @@ class Group extends AbleObject_1.default {
             return 'https://secure.gravatar.com/avatar/?d=mm&s=40';
         }
         return ('https://secure.gravatar.com/avatar/' +
-            (0, md5_1.default)(this.$data.email.trim().toLowerCase()).toString() +
+            crypto
+                .createHash('sha256')
+                .update(this.$data.email.trim().toLowerCase())
+                .digest('hex')
+                .toLowerCase() +
             '?d=identicon&s=40');
     }
     $jsonAcceptData(input, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (input.data.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this group a system admin.");
+        this.$check();
+        if ('abilities' in input.data) {
+            this.$checkIncomingAbilities(input.data.abilities);
         }
         super.$jsonAcceptData(input, allowConflict);
     }
     $jsonAcceptPatch(patch, allowConflict = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        this.$referenceWake();
-        if (patch.set.abilities?.indexOf('system/admin') !== -1 &&
-            this.$data.abilities?.indexOf('system/admin') === -1 &&
-            tilmeld.gatekeeper('tilmeld/admin') &&
-            !tilmeld.gatekeeper('system/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to make this group a system admin.");
+        this.$check();
+        if ('abilities' in patch.set) {
+            this.$checkIncomingAbilities(patch.set.abilities);
         }
         super.$jsonAcceptPatch(patch, allowConflict);
     }
-    $putData(data, sdata) {
-        super.$putData(data, sdata);
+    $checkIncomingAbilities(incoming) {
+        const tilmeld = enforceTilmeld(this);
+        if (!Array.isArray(incoming) ||
+            incoming.find((ability) => typeof ability !== 'string')) {
+            throw new BadDataError('Abilities must be an array of strings.');
+        }
+        if (incoming.includes('system/admin') !==
+            this.$data.abilities?.includes('system/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new BadDataError("You don't have the authority to grant or revoke system/admin.");
+        }
+        if (incoming.includes('tilmeld/admin') !==
+            this.$data.abilities?.includes('tilmeld/admin') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/admin.");
+        }
+        if (incoming.includes('tilmeld/switch') !==
+            this.$data.abilities?.includes('tilmeld/switch') &&
+            (!tilmeld.currentUser ||
+                !tilmeld.currentUser.abilities?.includes('system/admin'))) {
+            throw new BadDataError("You don't have the authority to grant or revoke tilmeld/switch.");
+        }
+        if (xor(incoming.filter((ability) => ability.startsWith('tilmeld/')), this.$data.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ?? []).length &&
+            (!tilmeld.currentUser ||
+                (!tilmeld.currentUser.abilities?.includes('system/admin') &&
+                    !tilmeld.currentUser.abilities?.includes('tilmeld/admin')))) {
+            throw new BadDataError("You don't have the authority to grant or revoke Tilmeld abilities.");
+        }
+    }
+    $putData(data, sdata, source) {
+        super.$putData(data, sdata, source);
+        if (source === 'server') {
+            this.$originalGroupname = this.$data.groupname;
+        }
         this.$updateDataProtection();
     }
+    /**
+     * Update the data protection arrays for a user.
+     *
+     * @param givenUser User to update protection for. If undefined, will use the currently logged in user.
+     */
     $updateDataProtection(givenUser) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         let user = givenUser ?? tilmeld.User.current();
+        let [_groupname, domain] = tilmeld.config.domainSupport
+            ? splitn(this.$data.groupname ?? '', '@', 2)
+            : [this.$data.groupname, null];
+        // Lowercase the domain part.
+        if (domain) {
+            domain = domain.toLowerCase();
+        }
         this.$privateData = [...Group.DEFAULT_PRIVATE_DATA];
         this.$allowlistData = [...Group.DEFAULT_ALLOWLIST_DATA];
         if (tilmeld.config.emailUsernames) {
             this.$privateData.push('groupname');
         }
         if (user != null &&
-            ((user.abilities?.indexOf('tilmeld/admin') ?? -1) !== -1 ||
-                (user.abilities?.indexOf('system/admin') ?? -1) !== -1)) {
+            (user.abilities?.includes('tilmeld/admin') ||
+                user.abilities?.includes('system/admin'))) {
+            // Users who can edit groups can see their data.
             this.$privateData = [];
             this.$allowlistData = undefined;
         }
         else if (this.$data.user != null &&
             user != null &&
-            this.$data.user.$is(user)) {
+            this.$data.user.guid === user.guid) {
+            // Users can see their group's data.
+            this.$privateData = [];
+        }
+        else if (user != null &&
+            tilmeld.config.domainSupport &&
+            domain &&
+            user.abilities?.includes(`tilmeld/domain/${domain}/admin`)) {
+            // Domain admins can see their groups' data.
             this.$privateData = [];
         }
     }
-    $isDescendant(givenGroup) {
-        const tilmeld = this.$nymph.tilmeld;
+    /**
+     * Check whether the group is a descendant of a group.
+     *
+     * @param group The group, or the group's GUID.
+     * @returns True or false.
+     */
+    async $isDescendant(givenGroup) {
+        const tilmeld = enforceTilmeld(this);
         let group;
         if (typeof givenGroup === 'string') {
-            group = tilmeld.Group.factorySync(givenGroup);
+            group = await tilmeld.Group.factory(givenGroup);
         }
         else {
             group = givenGroup;
@@ -152,27 +276,41 @@ class Group extends AbleObject_1.default {
         if (group.guid == null) {
             return false;
         }
-        if (this.$data.parent == null) {
+        // Check to see if the group is a descendant of the given group.
+        const parent = this.$data.parent;
+        await parent?.$wake();
+        if (parent == null) {
             return false;
         }
-        if (this.$data.parent.$is(group)) {
+        if (parent.$is(group)) {
             return true;
         }
-        if (this.$data.parent.$isDescendant(group)) {
+        if (await parent.$isDescendant(group)) {
             return true;
         }
         return false;
     }
+    /**
+     * Gets an array of the group's child groups.
+     *
+     * @returns An array of groups.
+     */
     async $getChildren() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         return await this.$nymph.getEntities({ class: tilmeld.Group }, {
             type: '&',
             equal: ['enabled', true],
             ref: ['parent', this],
         });
     }
+    /**
+     * Gets an array of the group's descendant groups.
+     *
+     * @param andSelf Include this group in the returned array.
+     * @returns An array of groups.
+     */
     async $getDescendants(andSelf = false) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         let groups = [];
         const entities = await this.$nymph.getEntities({ class: tilmeld.Group }, {
             type: '&',
@@ -187,39 +325,41 @@ class Group extends AbleObject_1.default {
         }
         return groups;
     }
-    $getDescendantsSync(andSelf = false) {
-        const tilmeld = this.$nymph.tilmeld;
-        let groups = [];
-        let entity;
-        let offset = 0;
-        do {
-            entity = this.$nymph.driver.getEntitySync({ class: tilmeld.Group, offset }, {
-                type: '&',
-                equal: ['enabled', true],
-                ref: ['parent', this],
-            });
-            if (entity != null) {
-                groups = entity.$getDescendantsSync(true).concat(groups);
-            }
-            offset++;
-        } while (entity != null);
-        if (andSelf) {
-            groups.push(this);
-        }
-        return groups;
-    }
-    $getLevel() {
-        const tilmeld = this.$nymph.tilmeld;
-        let group = tilmeld.Group.factorySync(this.guid ?? undefined);
+    /**
+     * Get the number of parents the group has.
+     *
+     * If the group is a top level group, this will return 0. If it is a child of
+     * a top level group, this will return 1. If it is a grandchild of a top level
+     * group, this will return 2, and so on.
+     *
+     * Levels will max out at 1024 to avoid recursive loops.
+     *
+     * @returns The level of the group.
+     */
+    async $getLevel() {
+        const tilmeld = enforceTilmeld(this);
+        let group = await tilmeld.Group.factory(this.guid ?? undefined);
+        let parent = group.parent;
+        await parent?.$wake();
         let level = 0;
-        while (group.parent != null && group.parent.cdate != null && level < 1024) {
+        while (parent != null && parent.cdate != null && level < 1024) {
             level++;
-            group = group.parent;
+            group = parent;
+            parent = group.parent;
+            await parent?.$wake();
         }
         return level;
     }
+    /**
+     * Gets an array of users in the group.
+     *
+     * @param descendants Include users in all descendant groups too.
+     * @param limit The limit for the query.
+     * @param offset The offset for the query.
+     * @returns An array of users.
+     */
     async $getUsers(descendants = false, limit, offset) {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         let groups = [];
         if (descendants) {
             groups = await this.$getDescendants();
@@ -247,14 +387,37 @@ class Group extends AbleObject_1.default {
             ],
         });
     }
+    /**
+     * Check that a groupname is valid.
+     *
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $checkGroupname() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         if (!tilmeld.config.emailUsernames) {
-            if (this.$data.groupname == null || !this.$data.groupname.length) {
+            let [groupname, domain] = tilmeld.config.domainSupport
+                ? splitn(this.$data.groupname ?? '', '@', 2)
+                : [this.$data.groupname, null];
+            // Lowercase the domain part.
+            if (domain) {
+                domain = domain.toLowerCase();
+                this.$data.groupname = `${groupname}@${domain}`;
+            }
+            if (this.$data.groupname == null ||
+                !this.$data.groupname.length ||
+                groupname == null ||
+                !groupname.length) {
                 return { result: false, message: 'Please specify a groupname.' };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
+            if (groupname.length < tilmeld.config.minUsernameLength) {
+                return {
+                    result: false,
+                    message: 'Groupnames must be at least ' +
+                        tilmeld.config.minUsernameLength +
+                        ' characters.',
+                };
+            }
+            if (groupname.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Groupnames must not exceed ' +
@@ -262,18 +425,34 @@ class Group extends AbleObject_1.default {
                         ' characters.',
                 };
             }
-            if ((0, lodash_1.difference)(this.$data.groupname.split(''), tilmeld.config.validChars.split('')).length) {
+            if (difference(groupname.split(''), tilmeld.config.validChars.split(''))
+                .length) {
                 return {
                     result: false,
                     message: tilmeld.config.validCharsNotice,
                 };
             }
-            if (!tilmeld.config.validRegex.test(this.$data.groupname)) {
+            if (!tilmeld.config.validRegex.test(groupname)) {
                 return {
                     result: false,
                     message: tilmeld.config.validRegexNotice,
                 };
             }
+            if (domain != null) {
+                if (!tilmeld.config.validDomainRegex.test(domain)) {
+                    return {
+                        result: false,
+                        message: tilmeld.config.validDomainRegexNotice,
+                    };
+                }
+                if (!this.$is(tilmeld.currentUser?.group) &&
+                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                    return {
+                        result: false,
+                        message: "You don't have the authority to manage groups on this domain.",
+                    };
+                }
+            }
             const selector = {
                 type: '&',
                 ilike: [
@@ -298,8 +477,15 @@ class Group extends AbleObject_1.default {
             if (this.$data.groupname == null || !this.$data.groupname.length) {
                 return { result: false, message: 'Please specify an email.' };
             }
-            if (tilmeld.config.maxUsernameLength > 0 &&
-                this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
+            if (this.$data.groupname.length < tilmeld.config.minUsernameLength) {
+                return {
+                    result: false,
+                    message: 'Emails must be at least ' +
+                        tilmeld.config.minUsernameLength +
+                        ' characters.',
+                };
+            }
+            if (this.$data.groupname.length > tilmeld.config.maxUsernameLength) {
                 return {
                     result: false,
                     message: 'Emails must not exceed ' +
@@ -310,8 +496,13 @@ class Group extends AbleObject_1.default {
             return await this.$checkEmail();
         }
     }
+    /**
+     * Check that an email is unique.
+     *
+     * @returns An object with a boolean 'result' entry and a 'message' entry.
+     */
     async $checkEmail() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         if (this.$data.email === '') {
             return { result: true, message: '' };
         }
@@ -344,10 +535,42 @@ class Group extends AbleObject_1.default {
         };
     }
     async $save() {
-        const tilmeld = this.$nymph.tilmeld;
+        const tilmeld = enforceTilmeld(this);
         if (this.$data.groupname == null || !this.$data.groupname.trim().length) {
             return false;
         }
+        // Lowercase the domain part.
+        if (tilmeld.config.domainSupport) {
+            const [groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+            if (domain) {
+                this.$data.groupname = `${groupname}@${domain.toLowerCase()}`;
+            }
+        }
+        if (tilmeld.config.domainSupport) {
+            const [_groupname, domain] = splitn(this.$data.groupname ?? '', '@', 2);
+            const [_originalGroupname, originalDomain] = splitn(this.$originalGroupname ?? '', '@', 2);
+            if (this.guid != null &&
+                ((originalDomain == null && domain != null) ||
+                    (domain == null && originalDomain != null))) {
+                throw new AccessControlError("Groups can't switch to or from having a domain once created.");
+            }
+            if (!this.$skipAcWhenSaving &&
+                !tilmeld.gatekeeper('tilmeld/admin') &&
+                !tilmeld.gatekeeper('system/admin')) {
+                if (domain != null &&
+                    !this.$is(tilmeld.currentUser) &&
+                    !tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`)) {
+                    throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+                }
+                if (originalDomain != null &&
+                    originalDomain !== domain &&
+                    (!tilmeld.gatekeeper(`tilmeld/domain/${domain}/admin`) ||
+                        !tilmeld.gatekeeper(`tilmeld/domain/${originalDomain}/admin`))) {
+                    throw new AccessControlError("You don't have the authority to modify groups on this domain.");
+                }
+            }
+        }
+        // Formatting.
         this.$data.groupname = this.$data.groupname.trim();
         if (tilmeld.config.emailUsernames) {
             this.$data.email = this.$data.groupname;
@@ -356,16 +579,19 @@ class Group extends AbleObject_1.default {
         this.$data.name = (this.$data.name ?? '').trim();
         this.$data.phone = (this.$data.phone ?? '').trim();
         this.$data.enabled = !!this.$data.enabled;
-        if (this.$data.name === '') {
+        // Clear empty values.
+        if (this.$data.name === '' || !tilmeld.config.userFields.includes('name')) {
             delete this.$data.name;
         }
-        if (this.$data.email === '') {
+        if (this.$data.email === '' ||
+            !tilmeld.config.userFields.includes('email')) {
             delete this.$data.email;
         }
         if (this.$data.avatar === '') {
             delete this.$data.avatar;
         }
-        if (this.$data.phone === '') {
+        if (this.$data.phone === '' ||
+            !tilmeld.config.userFields.includes('phone')) {
             delete this.$data.phone;
         }
         if (this.$data.parent == null) {
@@ -383,46 +609,70 @@ class Group extends AbleObject_1.default {
         if (!this.$data.unverifiedSecondary) {
             delete this.$data.unverifiedSecondary;
         }
-        this.$data.abilities = (0, lodash_1.difference)(this.$data.abilities ?? [], [
-            'system/admin',
-            'tilmeld/admin',
-            null,
-            undefined,
-        ]);
+        // Groups should never have 'system/admin', 'tilmeld/admin',
+        // 'tilmeld/switch', or domain admin abilities.
+        this.$data.abilities = (this.$data.abilities ?? []).filter((ability) => {
+            if (['system/admin', 'tilmeld/admin', 'tilmeld/switch'].indexOf(ability) !==
+                -1) {
+                return false;
+            }
+            if (ability == null) {
+                return false;
+            }
+            if (ability.startsWith('tilmeld/domain/') && ability.endsWith('/admin')) {
+                return false;
+            }
+            return true;
+        });
+        // Verification.
         const unCheck = await this.$checkGroupname();
         if (!unCheck.result) {
-            throw new errors_1.BadUsernameError(unCheck.message);
+            throw new BadUsernameError(unCheck.message);
         }
-        if (!tilmeld.config.emailUsernames) {
+        if (!tilmeld.config.emailUsernames &&
+            tilmeld.config.userFields.includes('email')) {
             const emCheck = await this.$checkEmail();
             if (!emCheck.result) {
-                throw new errors_1.BadEmailError(emCheck.message);
+                throw new BadEmailError(emCheck.message);
             }
         }
-        if (this.$data.parent &&
-            (this.$data.parent.cdate == null ||
-                this.$is(this.$data.parent) ||
-                this.$data.parent.$isDescendant(this))) {
-            throw new errors_1.BadDataError("Group parent can't be itself or descendant of itself.");
+        // Validate group parent. Make sure it's not a descendant of this group.
+        const parent = this.$data.parent;
+        await parent?.$wake();
+        if (parent &&
+            (parent.cdate == null ||
+                this.$is(parent) ||
+                (await parent.$isDescendant(this)))) {
+            throw new BadDataError("Group parent can't be itself or descendant of itself.");
         }
         try {
-            tilmeld.config.validatorGroup(this);
+            tilmeld.config.validatorGroup(tilmeld, this);
         }
         catch (e) {
-            throw new errors_1.BadDataError(e?.message);
+            throw new BadDataError(e?.message);
         }
+        // Only one default primary group is allowed.
         if (this.$data.defaultPrimary) {
             const currentPrimary = await this.$nymph.getEntity({ class: tilmeld.Group }, { type: '&', truthy: 'defaultPrimary' });
             if (currentPrimary != null && !this.$is(currentPrimary)) {
                 currentPrimary.defaultPrimary = false;
-                if (!(await currentPrimary.$save())) {
-                    throw new errors_1.CouldNotChangeDefaultPrimaryGroupError('Could not change new user primary group from ' +
+                if (this.$skipAcWhenSaving
+                    ? !(await currentPrimary.$saveSkipAC())
+                    : !(await currentPrimary.$save())) {
+                    throw new CouldNotChangeDefaultPrimaryGroupError('Could not change new user primary group from ' +
                         `${currentPrimary.groupname}.`);
                 }
             }
         }
-        return await super.$save();
+        const ret = await super.$save();
+        if (ret) {
+            this.$originalGroupname = this.$data.groupname;
+        }
+        return ret;
     }
+    /*
+     * This should *never* be accessible on the client.
+     */
     async $saveSkipAC() {
         this.$skipAcWhenSaving = true;
         return await this.$save();
@@ -435,73 +685,98 @@ class Group extends AbleObject_1.default {
         return false;
     }
     async $delete() {
-        let tilmeld = this.$nymph.tilmeld;
-        if (!tilmeld.gatekeeper('tilmeld/admin')) {
-            throw new errors_1.BadDataError("You don't have the authority to delete groups.");
+        let tilmeld = enforceTilmeld(this);
+        if (!this.$skipAcWhenDeleting && !tilmeld.gatekeeper('tilmeld/admin')) {
+            throw new AccessControlError("You don't have the authority to delete groups.");
+        }
+        if (this.$data.groupname !== this.$originalGroupname) {
+            throw new AccessControlError("You can't delete a group while switching its groupname.");
         }
         const transaction = 'tilmeld-delete-' + this.guid;
         const nymph = this.$nymph;
         const tnymph = await nymph.startTransaction(transaction);
-        this.$nymph = tnymph;
-        tilmeld = this.$nymph.tilmeld;
-        const descendants = await this.$getDescendants();
-        if (descendants.length) {
-            for (let curGroup of descendants) {
-                if (!(await curGroup.$delete())) {
+        this.$setNymph(tnymph);
+        tilmeld = enforceTilmeld(this);
+        const User = tnymph.getEntityClass(UserClass);
+        try {
+            // Delete descendants.
+            const descendants = await this.$getDescendants();
+            if (descendants.length) {
+                for (let curGroup of descendants) {
+                    if (this.$skipAcWhenDeleting
+                        ? !(await curGroup.$deleteSkipAC())
+                        : !(await curGroup.$delete())) {
+                        await tnymph.rollback(transaction);
+                        this.$setNymph(nymph);
+                        return false;
+                    }
+                }
+            }
+            // Remove users from this primary group.
+            const primaryUsers = await tnymph.getEntities({
+                class: User,
+                skipAc: true,
+            }, {
+                type: '&',
+                ref: ['group', this],
+            });
+            for (let user of primaryUsers) {
+                delete user.group;
+                if (this.$skipAcWhenDeleting
+                    ? !(await user.$saveSkipAC())
+                    : !(await user.$save())) {
                     await tnymph.rollback(transaction);
-                    this.$nymph = nymph;
+                    this.$setNymph(nymph);
                     return false;
                 }
             }
-        }
-        const primaryUsers = await tnymph.getEntities({
-            class: tilmeld.User,
-            skipAc: true,
-        }, {
-            type: '&',
-            ref: ['group', this],
-        });
-        for (let user of primaryUsers) {
-            delete user.group;
-            if (!(await user.$save())) {
-                await tnymph.rollback(transaction);
-                this.$nymph = nymph;
-                return false;
+            // Remove users from this secondary group.
+            const secondaryUsers = await tnymph.getEntities({
+                class: User,
+                skipAc: true,
+            }, {
+                type: '&',
+                ref: ['groups', this],
+            });
+            for (let user of secondaryUsers) {
+                user.$delGroup(this);
+                if (this.$skipAcWhenDeleting
+                    ? !(await user.$saveSkipAC())
+                    : !(await user.$save())) {
+                    await tnymph.rollback(transaction);
+                    return false;
+                }
             }
-        }
-        const secondaryUsers = await tnymph.getEntities({
-            class: tilmeld.User,
-            skipAc: true,
-        }, {
-            type: '&',
-            ref: ['groups', this],
-        });
-        for (let user of secondaryUsers) {
-            user.$delGroup(this);
-            if (!(await user.$save())) {
+            // Delete the group.
+            let success = await super.$delete();
+            if (success) {
+                success = await tnymph.commit(transaction);
+            }
+            else {
                 await tnymph.rollback(transaction);
-                return false;
             }
+            this.$setNymph(nymph);
+            return success;
         }
-        const success = await super.$delete();
-        if (success) {
-            await tnymph.commit(transaction);
-        }
-        else {
+        catch (e) {
             await tnymph.rollback(transaction);
+            this.$setNymph(nymph);
+            throw e;
         }
-        this.$nymph = nymph;
-        return success;
+    }
+    /*
+     * This should *never* be accessible on the client.
+     */
+    async $deleteSkipAC() {
+        this.$skipAcWhenDeleting = true;
+        return await this.$delete();
+    }
+    $tilmeldDeleteSkipAC() {
+        if (this.$skipAcWhenDeleting) {
+            this.$skipAcWhenDeleting = false;
+            return true;
+        }
+        return false;
     }
 }
-exports.default = Group;
-Group.ETYPE = 'tilmeld_group';
-Group.class = 'Group';
-Group.DEFAULT_PRIVATE_DATA = ['email', 'phone', 'abilities', 'user'];
-Group.DEFAULT_ALLOWLIST_DATA = [];
-Group.clientEnabledStaticMethods = [
-    'getPrimaryGroups',
-    'getSecondaryGroups',
-];
-Group.searchRestrictedData = [...Group.DEFAULT_PRIVATE_DATA];
 //# sourceMappingURL=Group.js.map