kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/api/controllers/authController.d.ts

@@ -2,8 +2,9 @@ import Bluebird from "bluebird";
 import { KuzzleRequest } from "../request";
 import { NativeController } from "./baseController";
 import { User } from "../../model/security/user";
-import { Token } from "../../model/security/token";
-export default class AuthController extends NativeController {
+import type { JSONObject } from "../../types/JSONObject";
+import type { Token } from "../../model/security/token";
+declare class AuthController extends NativeController {
     private anonymousId;
     private readonly logger;
     /**
@@ -18,6 +19,17 @@ export default class AuthController extends NativeController {
      * @returns {Promise}
      */
     init(): Promise<any>;
+    /**
+     * The user and the token the funnel attached to the request.
+     *
+     * `RequestContext` starts every field at `null` and the funnel fills them —
+     * with the anonymous user and token when nothing authenticated. Every
+     * action below runs after that, and read them straight through: eleven
+     * unchecked dereferences, each of which would have raised a TypeError
+     * rather than the 401 this controller exists to produce.
+     */
+    private userOf;
+    private tokenOf;
     createToken(request: KuzzleRequest): Promise<{
         expiresAt: number;
         singleUse: boolean;
@@ -34,19 +46,25 @@ export default class AuthController extends NativeController {
      * Creates a new API key for the user
      * @param {KuzzleRequest} request
      */
-    createApiKey(request: KuzzleRequest): Promise<any>;
+    createApiKey(request: KuzzleRequest): Promise<{
+        _id: string | null;
+        _source: JSONObject;
+    }>;
     /**
      * Search in the user API keys
      */
     searchApiKeys(request: KuzzleRequest): Promise<{
-        hits: any[];
+        hits: {
+            _id: string | null;
+            _source: JSONObject;
+        }[];
         total: number;
     }>;
     /**
      * Deletes an API key
      */
     deleteApiKey(request: KuzzleRequest): Promise<{
-        _id: string;
+        _id: string | null;
     }>;
     /**
      * Logs the current user out
@@ -84,13 +102,13 @@ export default class AuthController extends NativeController {
      * @param {KuzzleRequest} request
      * @returns {Promise<object>}
      */
-    checkToken(request: any): Promise<{
+    checkToken(request: KuzzleRequest): Promise<{
         expiresAt: any;
         kuid: any;
         valid: boolean;
         state?: undefined;
     } | {
-        state: any;
+        state: string;
         valid: boolean;
         expiresAt?: undefined;
         kuid?: undefined;
@@ -101,7 +119,7 @@ export default class AuthController extends NativeController {
      * @param {KuzzleRequest} request
      * @returns {Promise<object>}
      */
-    updateSelf(request: any): Promise<import("../../types/core/auth/formatProcessing.type").Serialized<User>>;
+    updateSelf(request: KuzzleRequest): Promise<import("../../types/core/auth/formatProcessing.type").Serialized<User>>;
     /**
      * List authentication strategies
      *
@@ -112,35 +130,38 @@ export default class AuthController extends NativeController {
      * @param {KuzzleRequest} request
      * @returns {Promise.<Object>}
      */
-    createMyCredentials(request: any): any;
+    createMyCredentials(request: KuzzleRequest): Promise<JSONObject>;
     /**
      * @param {KuzzleRequest} request
      * @returns {Promise.<Object>}
      */
-    updateMyCredentials(request: any): any;
+    updateMyCredentials(request: KuzzleRequest): Promise<JSONObject>;
     /**
      * @param {KuzzleRequest} request
      * @returns {Promise.<Object>}
      */
-    credentialsExist(request: any): any;
+    credentialsExist(request: KuzzleRequest): Promise<JSONObject>;
     /**
      * @param {KuzzleRequest} request
      * @returns {Promise.<Object>}
      */
-    validateMyCredentials(request: any): any;
+    validateMyCredentials(request: KuzzleRequest): Promise<JSONObject>;
     /**
      * @param {KuzzleRequest} request
      * @returns {Promise.<Object>}
      */
-    deleteMyCredentials(request: any): any;
+    deleteMyCredentials(request: KuzzleRequest): Promise<{
+        acknowledged: boolean;
+    }>;
     /**
      * @param {KuzzleRequest} request
      * @returns {Promise.<Object>}
      */
-    getMyCredentials(request: any): any;
+    getMyCredentials(request: KuzzleRequest): Promise<JSONObject>;
     /**
      * @param {KuzzleRequest} request
      */
-    refreshToken(request: any): Promise<Token>;
-    assertIsAuthenticated(request: any): void;
+    refreshToken(request: KuzzleRequest): Promise<Token>;
+    assertIsAuthenticated(request: KuzzleRequest): void;
 }
+export = AuthController;

package/dist/lib/api/controllers/authController.js

@@ -25,7 +25,6 @@ var __importStar = (this && this.__importStar) || function (mod) {
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-Object.defineProperty(exports, "__esModule", { value: true });
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -47,6 +46,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * limitations under the License.
  */
 const node_http_1 = require("node:http");
+const node_net_1 = require("node:net");
+const node_util_1 = require("node:util");
 const Cookie = __importStar(require("cookie"));
 const bluebird_1 = __importDefault(require("bluebird"));
 const lodash_1 = require("lodash");
@@ -60,6 +61,9 @@ const user_1 = require("../../model/security/user");
 const apiKey_1 = __importDefault(require("../../model/storage/apiKey"));
 const securityController_1 = __importDefault(require("./securityController"));
 const securityError = kerror.wrap("security", "token");
+function isStored(user) {
+    return user._id !== null;
+}
 class AuthController extends baseController_1.NativeController {
     /**
      * @param {Kuzzle} kuzzle
@@ -100,6 +104,29 @@ class AuthController extends baseController_1.NativeController {
         const anonymous = await globalThis.kuzzle.ask("core:security:user:anonymous:get");
         this.anonymousId = anonymous._id;
     }
+    /**
+     * The user and the token the funnel attached to the request.
+     *
+     * `RequestContext` starts every field at `null` and the funnel fills them —
+     * with the anonymous user and token when nothing authenticated. Every
+     * action below runs after that, and read them straight through: eleven
+     * unchecked dereferences, each of which would have raised a TypeError
+     * rather than the 401 this controller exists to produce.
+     */
+    userOf(request) {
+        const user = request.context.user;
+        if (user === null || !isStored(user)) {
+            throw kerror.get("security", "rights", "unauthorized", request.input.controller, request.input.action);
+        }
+        return user;
+    }
+    tokenOf(request) {
+        const token = request.context.token;
+        if (token === null) {
+            throw securityError.get("invalid");
+        }
+        return token;
+    }
     async createToken(request) {
         const singleUse = request.getBoolean("singleUse");
         if (`${request.input.args.expiresIn}` === "-1") {
@@ -127,7 +154,7 @@ class AuthController extends baseController_1.NativeController {
         if (typeof requestPayload.action !== "string") {
             throw kerror.get("api", "assert", "missing_argument", "body.action");
         }
-        const user = request.context.user;
+        const user = this.userOf(request);
         const allowed = await user.isActionAllowed(new request_1.KuzzleRequest(requestPayload));
         return {
             allowed,
@@ -142,7 +169,7 @@ class AuthController extends baseController_1.NativeController {
         const refresh = request.getRefresh("wait_for");
         const apiKeyId = request.getId({ ifMissing: "generate" });
         const description = request.getBodyString("description");
-        const user = request.context.user;
+        const user = this.userOf(request);
         const apiKey = await apiKey_1.default.create(user, expiresIn, description, {
             apiKeyId,
             creatorId: user._id,
@@ -157,7 +184,7 @@ class AuthController extends baseController_1.NativeController {
         let query = request.getBody({});
         const { from, size } = request.getSearchParams();
         const lang = request.getLangParam();
-        const user = request.context.user;
+        const user = this.userOf(request);
         if (lang === "koncorde") {
             query = await this.translateKoncorde(query);
         }
@@ -179,11 +206,11 @@ class AuthController extends baseController_1.NativeController {
      * Deletes an API key
      */
     async deleteApiKey(request) {
-        const apiKeyId = request.getId();
+        const userId = this.userOf(request)._id;
         const refresh = request.getRefresh();
-        const apiKey = await apiKey_1.default.load(request.context.user._id, apiKeyId);
+        const apiKey = await apiKey_1.default.loadFromRequest(userId, request);
         await apiKey.delete({ refresh });
-        return { _id: apiKeyId };
+        return { _id: apiKey._id };
     }
     /**
      * Logs the current user out
@@ -196,24 +223,29 @@ class AuthController extends baseController_1.NativeController {
             !request.getBoolean("cookieAuth")) {
             this.assertIsAuthenticated(request);
         }
-        if (globalThis.kuzzle.config.internal.notifiableProtocols.includes(request.context.connection.protocol)) {
+        const { id: connectionId, protocol } = request.context.connection;
+        const token = request.context.token;
+        if (connectionId !== null &&
+            protocol !== null &&
+            globalThis.kuzzle.config.internal.notifiableProtocols.includes(protocol)) {
             // Unlink connection so the connection will not be notified when the token expires.
-            globalThis.kuzzle.tokenManager.unlink(request.context.token, request.context.connection.id);
+            globalThis.kuzzle.tokenManager.unlink(token, connectionId);
         }
-        if (request.context.user._id !== this.anonymousId) {
+        if (this.userOf(request)._id !== this.anonymousId) {
             if (request.getBoolean("global")) {
                 await globalThis.kuzzle.ask("core:security:token:deleteByKuid", request.getKuid(), { keepApiKeys: true });
             }
-            else if (request.context.token &&
-                request.context.token.type !== "apiKey") {
-                await globalThis.kuzzle.ask("core:security:token:delete", request.context.token);
+            else if (token && token.type !== "apiKey") {
+                await globalThis.kuzzle.ask("core:security:token:delete", token);
             }
         }
         if (globalThis.kuzzle.config.http.cookieAuthentication &&
             request.getBoolean("cookieAuth")) {
             request.response.configure({
                 headers: {
-                    "Set-Cookie": Cookie.serialize("authToken", null, {
+                    // The empty string, not `null`: `cookie.serialize` stringifies its
+                    // value, so this header used to read `authToken=null`.
+                    "Set-Cookie": Cookie.serialize("authToken", "", {
                         httpOnly: true,
                         path: "/",
                         sameSite: "strict",
@@ -240,6 +272,13 @@ class AuthController extends baseController_1.NativeController {
             // Here we are not sending auth token when cookieAuth is set to true
             // This allow us to detect if kuzzle does support cookie as auth token directly from the SDK
             // or that the version of kuzzle doesn't support the feature Browser Cookie as Authentication Token
+            // `jwt` and `expiresAt` are null on a Token that has not been issued
+            // (TD-62). One that reaches the cookie has been, and the alternative to
+            // saying so here is a cookie reading `authToken=null` with an
+            // `Invalid Date` expiry.
+            if (token.jwt === null || token.expiresAt === null) {
+                throw securityError.get("generation_failed", "the issued token carries no JWT");
+            }
             request.response.configure({
                 headers: {
                     "Set-Cookie": Cookie.serialize("authToken", token.jwt, {
@@ -263,7 +302,10 @@ class AuthController extends baseController_1.NativeController {
      */
     async login(request) {
         const strategy = request.getString("strategy");
-        const passportRequest = new node_http_1.IncomingMessage(null);
+        // An unconnected socket rather than `null`: `IncomingMessage` only reads
+        // `readableHighWaterMark` off it, `net.Socket` opens no descriptor until
+        // it is connected, and the parameter is not optional.
+        const passportRequest = new node_http_1.IncomingMessage(new node_net_1.Socket());
         // Even in http, the url and the method are not pushed back to the request object
         // set some arbitrary values to get a pseudo-valid object.
         passportRequest.url = `/login?strategy=${strategy}`;
@@ -301,7 +343,8 @@ class AuthController extends baseController_1.NativeController {
         if (request.input.args.expiresIn) {
             options.expiresIn = request.input.args.expiresIn;
         }
-        const existingToken = globalThis.kuzzle.tokenManager.getConnectedUserToken(authResponse.content._id, request.context.connection.id);
+        const { id: connectionId, protocol } = request.context.connection;
+        const existingToken = globalThis.kuzzle.tokenManager.getConnectedUserToken(authResponse.content._id, connectionId);
         /**
          * If a previous token from the same User is linked to this connection
          * and the token is either an API Key or an infinite duration token
@@ -309,16 +352,19 @@ class AuthController extends baseController_1.NativeController {
          * to avoid breaking changes.
          */
         if (existingToken &&
-            (existingToken.type === "apiKey" || existingToken.ttl < 0)) {
+            (existingToken.type === "apiKey" ||
+                (existingToken.ttl !== null && existingToken.ttl < 0))) {
             return this._sendToken(existingToken, request);
         }
         const token = await this.ask("core:security:token:create", authResponse.content, options);
         if (existingToken) {
             globalThis.kuzzle.tokenManager.refresh(existingToken, token);
         }
-        if (globalThis.kuzzle.config.internal.notifiableProtocols.includes(request.context.connection.protocol)) {
+        if (connectionId !== null &&
+            protocol !== null &&
+            globalThis.kuzzle.config.internal.notifiableProtocols.includes(protocol)) {
             // Link the connection with the token, this way the connection can be notified when the token has expired.
-            globalThis.kuzzle.tokenManager.link(token, request.context.connection.id);
+            globalThis.kuzzle.tokenManager.link(token, connectionId);
         }
         return this._sendToken(token, request);
     }
@@ -330,15 +376,16 @@ class AuthController extends baseController_1.NativeController {
      */
     async getCurrentUser(request) {
         const promises = [];
-        const userId = request.context.token.userId;
+        const userId = this.tokenOf(request).userId;
         const formattedUser = {
-            ...formatProcessing_1.default.serializeUser(request.context.user),
+            ...formatProcessing_1.default.serializeUser(this.userOf(request)),
             strategies: [],
         };
-        if (this.anonymousId === userId) {
-            promises.push(bluebird_1.default.resolve([]));
-        }
-        else {
+        // The anonymous user has no credentials on any strategy. The branch this
+        // replaces pushed `Bluebird.resolve([])` into the list, so `strategies`
+        // came back as `[[]]` and the response carried a `strategies` array whose
+        // one entry was an empty array.
+        if (this.anonymousId !== userId) {
             for (const strategy of globalThis.kuzzle.pluginsManager.listStrategies()) {
                 const existsMethod = globalThis.kuzzle.pluginsManager.getStrategyMethod(strategy, "exists");
                 promises.push(existsMethod(request, userId, strategy)
@@ -347,9 +394,7 @@ class AuthController extends baseController_1.NativeController {
             }
         }
         const strategies = await bluebird_1.default.all(promises);
-        if (strategies.length > 0) {
-            formattedUser.strategies = strategies.filter((item) => item !== null);
-        }
+        formattedUser.strategies = strategies.filter((item) => item !== null);
         return formattedUser;
     }
     /**
@@ -359,10 +404,12 @@ class AuthController extends baseController_1.NativeController {
      * @returns {Promise<object>}
      */
     getMyRights(request) {
-        return request.context.user
+        return (this.userOf(request)
             .getRights()
-            .then((rights) => Object.keys(rights).reduce((array, item) => array.concat(rights[item]), []))
-            .then((rights) => ({ hits: rights, total: rights.length }));
+            // `Object.values`: the reduce it replaces concatenated each key's value
+            // into an array, one level deep, which is what that is.
+            .then((rights) => Object.values(rights))
+            .then((rights) => ({ hits: rights, total: rights.length })));
     }
     /**
      * Checks the validity of a token.
@@ -371,7 +418,7 @@ class AuthController extends baseController_1.NativeController {
      * @returns {Promise<object>}
      */
     async checkToken(request) {
-        let token = "";
+        let token;
         if (globalThis.kuzzle.config.http.cookieAuthentication &&
             request.getBoolean("cookieAuth")) {
             token = request.input.jwt;
@@ -384,7 +431,8 @@ class AuthController extends baseController_1.NativeController {
             return { expiresAt, kuid: userId, valid: true };
         }
         catch (error) {
-            if (error.status === 401) {
+            // A 401 is the answer, not a failure: the token is simply not valid.
+            if (error instanceof errors_1.KuzzleError && error.status === 401) {
                 return { state: error.message, valid: false };
             }
             throw error;
@@ -520,23 +568,24 @@ class AuthController extends baseController_1.NativeController {
                 this.logger.error(`Error while refreshing the token with the strategy ${strategy} with ERROR: ${err}`);
                 // Adding some debug information to better known our target here.
                 this.logger.debug(`Error when refreshing token with request: ${JSON.stringify(request)}`);
-                throw securityError.get("refresh_forbidden", request.context.token.jwt);
+                throw securityError.get("refresh_forbidden", this.tokenOf(request).jwt);
             }
         }
         const token = await this.ask("core:security:token:refresh", request.context.user, request.context.token, expiresIn);
         return this._sendToken(token, request);
     }
     assertIsAuthenticated(request) {
-        if (request.context.user._id === this.anonymousId) {
+        if (this.userOf(request)._id === this.anonymousId) {
             throw kerror.get("security", "rights", "unauthorized", request.input.controller, request.input.action);
         }
     }
 }
-exports.default = AuthController;
 function wrapPluginError(error) {
-    if (!(error instanceof errors_1.KuzzleError)) {
-        throw kerror.getFrom(error, "plugin", "runtime", "unexpected_error", error.message);
+    if (error instanceof errors_1.KuzzleError) {
+        throw error;
     }
-    throw error;
+    const cause = error instanceof Error ? error : new Error((0, node_util_1.inspect)(error));
+    throw kerror.getFrom(cause, "plugin", "runtime", "unexpected_error", cause.message);
 }
+module.exports = AuthController;
 //# sourceMappingURL=authController.js.map

package/dist/lib/api/controllers/baseController.d.ts

@@ -1,5 +1,10 @@
-import { JSONObject } from "kuzzle-sdk";
-import { KuzzleRequest } from "../request";
+import type { JSONObject } from "../../types/JSONObject";
+import type { KuzzleRequest } from "../request";
+/**
+ * Handler of a controller action. Returns the action result, or a promise of
+ * it — the funnel awaits whatever comes back.
+ */
+export type ControllerAction = (request: KuzzleRequest) => unknown;
 /**
  * Base class for all controllers
  */
@@ -7,7 +12,7 @@ export declare class BaseController {
     protected __actions: Set<string>;
     constructor();
     get _actions(): Set<string>;
-    _addAction(name: any, fn: any): void;
+    _addAction(name: string, fn: ControllerAction): void;
     /**
      * Check if the provided action name exists within that controller.
      * This check's purpose is to prevent actions leak by making actions exposure
@@ -20,7 +25,7 @@ export declare class BaseController {
 export declare class NativeController extends BaseController {
     protected ask: (event: string, ...args: any[]) => Promise<any>;
     protected pipe: (event: string, ...args: any[]) => Promise<any>;
-    constructor(actions?: any[]);
+    constructor(actions?: string[]);
     /**
      * Controller optional initialization method.
      * Used to perform asynchronous initialization safely: the funnel will wait
@@ -54,7 +59,7 @@ export declare class NativeController extends BaseController {
         index: string;
         collections?: string[];
     }>, { allowEmptyCollections }?: {
-        allowEmptyCollections?: boolean;
+        allowEmptyCollections?: boolean | undefined;
     }): void;
     _hasMultiTargets(str: string): boolean;
     /**

package/dist/lib/api/controllers/baseController.js

@@ -47,6 +47,13 @@ exports.NativeController = exports.BaseController = void 0;
 const kerror = __importStar(require("../../kerror"));
 const safeObject_1 = require("../../util/safeObject");
 const assertionError = kerror.wrap("api", "assert");
+/** What `QueryTranslator` throws for a Koncorde keyword it cannot translate. */
+function isKeywordError(thrown) {
+    return (typeof thrown === "object" &&
+        thrown !== null &&
+        "keyword" in thrown &&
+        (0, safeObject_1.isPlainObject)(thrown.keyword));
+}
 /**
  * Base class for all controllers
  */
@@ -59,7 +66,11 @@ class BaseController {
     }
     _addAction(name, fn) {
         this.__actions.add(name);
-        this[name] = fn;
+        // `name` is a runtime-built key, so a plain `this[name] = fn` cannot be
+        // typed without opening the whole class to an index signature — the same
+        // trade-off TD-28 (#2704) settled in `memoryStorageController` with
+        // `Reflect.set`, kept consistent here.
+        Reflect.set(this, name, fn);
     }
     /**
      * Check if the provided action name exists within that controller.
@@ -99,10 +110,15 @@ class NativeController extends BaseController {
             return await this.ask("core:storage:public:translate", koncordeFilters);
         }
         catch (error) {
-            if (!error.keyword) {
+            // `QueryTranslator` raises a `KeywordError`, which carries the keyword
+            // it could not translate. Anything else is not this method's to
+            // reinterpret — duck-typed, as it was, since that class is not
+            // exported.
+            const keyword = isKeywordError(error) ? error.keyword : undefined;
+            if (keyword === undefined) {
                 throw error;
             }
-            throw assertionError.get("koncorde_restricted_keyword", error.keyword.type, error.keyword.name);
+            throw assertionError.get("koncorde_restricted_keyword", keyword.type, keyword.name);
         }
     }
     /**
@@ -140,29 +156,34 @@ class NativeController extends BaseController {
      * @param options.allowEmptyCollections
      */
     assertTargetsAreValid(targets, { allowEmptyCollections = false } = {}) {
-        for (let i = 0; i < targets.length; i++) {
-            const target = targets[i];
+        for (const [i, target] of targets.entries()) {
             if (!target.index) {
                 throw kerror.get("api", "assert", "missing_argument", `targets[${i}].index`);
             }
             if (this._hasMultiTargets(target.index)) {
                 throw kerror.get("services", "storage", "invalid_target_format", `targets[${i}].index`, target.index);
             }
-            if (!allowEmptyCollections && !target.collections) {
-                throw kerror.get("api", "assert", "missing_argument", `targets[${i}].collections`);
+            // Read once, and the two "nothing to check" cases answered where they
+            // are decided: the chain this replaces dereferenced `target.collections`
+            // twice past the guards that had established it, which is what the
+            // `allowEmptyCollections` branch made unprovable.
+            const collections = target.collections;
+            if (collections === undefined) {
+                if (!allowEmptyCollections) {
+                    throw kerror.get("api", "assert", "missing_argument", `targets[${i}].collections`);
+                }
+                continue;
             }
-            if (target.collections && !Array.isArray(target.collections)) {
+            if (!Array.isArray(collections)) {
                 throw kerror.get("api", "assert", "invalid_type", `targets[${i}].collections`, "array");
             }
-            if (!allowEmptyCollections && target.collections.length === 0) {
-                throw kerror.get("api", "assert", "empty_argument", `targets[${i}].collections`);
-            }
-            if (allowEmptyCollections &&
-                (!target.collections || target.collections.length === 0)) {
+            if (collections.length === 0) {
+                if (!allowEmptyCollections) {
+                    throw kerror.get("api", "assert", "empty_argument", `targets[${i}].collections`);
+                }
                 continue;
             }
-            for (let j = 0; j < target.collections.length; j++) {
-                const collection = target.collections[j];
+            for (const [j, collection] of collections.entries()) {
                 if (typeof collection !== "string") {
                     throw kerror.get("api", "assert", "invalid_type", `targets[${i}].collections[${j}]`, "string");
                 }

package/dist/lib/api/controllers/bulkController.d.ts

@@ -1,4 +1,5 @@
-export = BulkController;
+import type { KuzzleRequest } from "../request";
+import { NativeController } from "./baseController";
 /**
  * @class BulkController
  */
@@ -10,11 +11,14 @@ declare class BulkController extends NativeController {
      * @param {Request} request
      * @returns {Promise}
      */
-    import(request: Request): Promise<any>;
+    import(request: KuzzleRequest): Promise<{
+        errors: any;
+        successes: any;
+    }>;
     /**
      * Write a document without adding metadata or performing data validation.
      */
-    write(request: any): Promise<{
+    write(request: KuzzleRequest): Promise<{
         _id: any;
         _source: any;
         _version: any;
@@ -22,7 +26,7 @@ declare class BulkController extends NativeController {
     /**
      * Write several documents without adding metadata or performing data validation.
      */
-    mWrite(request: any): Promise<{
+    mWrite(request: KuzzleRequest): Promise<{
         errors: any;
         successes: any;
     }>;
@@ -32,7 +36,7 @@ declare class BulkController extends NativeController {
      *  - fetching deleted documents
      *  - triggering realtime notifications
      */
-    deleteByQuery(request: any): Promise<{
+    deleteByQuery(request: KuzzleRequest): Promise<{
         deleted: any;
     }>;
     /**
@@ -41,6 +45,6 @@ declare class BulkController extends NativeController {
      *  - Injecting Kuzzle metadata
      *  - Triggering realtime notifications
      */
-    updateByQuery(request: any): Promise<any>;
+    updateByQuery(request: KuzzleRequest): Promise<any>;
 }
-import { NativeController } from "./baseController";
+export = BulkController;

package/dist/lib/api/controllers/bulkController.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,14 +19,36 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const { NativeController } = require("./baseController");
-const actionEnum = require("../../core/realtime/actionEnum");
-const kerror = require("../../kerror");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+const actionEnum = __importStar(require("../../core/realtime/actionEnum"));
+const kerror = __importStar(require("../../kerror"));
+const baseController_1 = require("./baseController");
 /**
  * @class BulkController
  */
-class BulkController extends NativeController {
+class BulkController extends baseController_1.NativeController {
     constructor() {
         super(["import", "write", "mWrite", "deleteByQuery", "updateByQuery"]);
     }

package/dist/lib/api/controllers/clusterController.d.ts

@@ -1,6 +1,6 @@
-export = ClusterController;
+import { NativeController } from "./baseController";
 declare class ClusterController extends NativeController {
     constructor();
     status(): Promise<any>;
 }
-import { NativeController } from "./baseController";
+export = ClusterController;