Rework user types: create AuthenticatedUser and AnonymousUser class

Both are subclasses of an abstract User class which contains almost everything
interesting.

express/types.ts

@@ -8,12 +8,7 @@ import { z } from "zod";
 import type { Session } from "./auth/types";
 import type { ContentType } from "./content-types";
 import type { HttpCode } from "./http-codes";
-import {
-    AnonymousUser,
-    type MaybeUser,
-    type Permission,
-    type User,
-} from "./user";
+import type { Permission, User } from "./user";
 
 const methodParser = z.union([
     z.literal("GET"),
@@ -36,7 +31,7 @@ export type Call = {
     method: Method;
     parameters: object;
     request: ExpressRequest;
-    user: MaybeUser;
+    user: User;
     session: Session;
 };
 
@@ -102,7 +97,7 @@ export class AuthorizationDenied extends Error {
 
 // Helper for handlers to require authentication
 export function requireAuth(call: Call): User {
-    if (call.user === AnonymousUser) {
+    if (call.user.isAnonymous()) {
         throw new AuthenticationRequired();
     }
     return call.user;