kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/cluster/workers/IDCardRenewer.d.ts

@@ -1,13 +1,44 @@
-export class IDCardRenewer {
-    redis: Redis;
-    refreshTimer: NodeJS.Timeout;
-    nodeIdKey: any;
+/// <reference types="node" />
+import Redis from "../../service/cache/redis";
+/**
+ * `redis.ts` uses `export =`, so it cannot also export this type. Deriving it
+ * from the constructor keeps it tied to the real signature instead of to a copy
+ * that can drift.
+ */
+type RedisServiceConfig = ConstructorParameters<typeof Redis>[0];
+export type IDCardRenewerConfig = {
+    nodeIdKey: string;
+    refreshDelay?: number;
+    refreshMultiplier: number;
+    redis?: {
+        config: RedisServiceConfig;
+        name: string;
+    };
+};
+/**
+ * The two commands this worker issues, and nothing else. A real `Redis` service
+ * satisfies it structurally; declaring the whole service here would make every
+ * test double carry twenty-odd members it never uses, and would hide a widening
+ * of what the worker touches.
+ */
+type IdCardStore = {
+    commands: {
+        pexpire(key: string, ttl: number): Promise<number>;
+        del(key: string): Promise<unknown>;
+    };
+};
+declare class IDCardRenewer {
+    redis: IdCardStore | null;
+    refreshTimer: NodeJS.Timeout | null;
+    nodeIdKey: string | null;
     refreshDelay: number;
+    /** Same default as `ClusterIdCardHandler`, which is what sends the real one. */
+    refreshMultiplier: number;
+    /** Disposed until `init()` says otherwise. */
     disposed: boolean;
-    init(config: any): Promise<void>;
-    refreshMultiplier: any;
-    initRedis(config: any, name: any): Promise<void>;
+    init(config: IDCardRenewerConfig): Promise<void>;
+    initRedis(config?: RedisServiceConfig, name?: string): Promise<void>;
     renewIDCard(): Promise<void>;
     dispose(): Promise<void>;
 }
-import Redis = require("../../service/cache/redis");
+export { IDCardRenewer };

package/dist/lib/cluster/workers/IDCardRenewer.js

@@ -1,12 +1,37 @@
 "use strict";
-const Redis = require("../../service/cache/redis");
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDCardRenewer = void 0;
+const node_util_1 = require("node:util");
+// A default import, not `import Redis = require(...)`: the latter emits a real
+// `require()` that vite cannot resolve for a `.ts` path, so any vitest spec
+// reaching this module dies on "Cannot find module". It type-checks against
+// `export =` under `esModuleInterop`. See ADR-0001, TD-49 (#2739).
+const redis_1 = __importDefault(require("../../service/cache/redis"));
+/**
+ * What `idCardHandler.createIdCard()` sends this worker with `action: "start"`.
+ * It is a `child_process.fork()` child, so everything here crossed an IPC
+ * boundary and is plain JSON.
+ */
+/**
+ * The message of whatever was thrown. `catch` answers `unknown`, and this
+ * worker reports every failure it meets to its parent as text.
+ */
+function messageOf(thrown) {
+    return thrown instanceof Error ? thrown.message : (0, node_util_1.inspect)(thrown);
+}
 class IDCardRenewer {
     constructor() {
         this.redis = null;
         this.refreshTimer = null;
         this.nodeIdKey = null;
         this.refreshDelay = 2000;
-        this.disposed = true; // Disposed until initialized
+        /** Same default as `ClusterIdCardHandler`, which is what sends the real one. */
+        this.refreshMultiplier = 2;
+        /** Disposed until `init()` says otherwise. */
+        this.disposed = true;
     }
     async init(config) {
         if (!this.disposed) {
@@ -21,14 +46,24 @@ class IDCardRenewer {
          * so we need to have an instance of Redis similar to the one used in the Cache Engine
          */
         try {
-            const redisConf = config.redis || {};
-            await this.initRedis(redisConf.config, redisConf.name);
+            // `redis` is absent when the worker is started without one (the specs do
+            // it, and `initRedis` is then expected to reject) — the JS spelled this
+            // `config.redis || {}` and read two undefined fields off it.
+            const redisConf = config.redis;
+            await this.initRedis(redisConf?.config, redisConf?.name);
         }
         catch (error) {
             // eslint-disable-next-line no-console
-            console.error(`Failed to connect to redis, could not refresh ID card: ${error.message}`);
-            this.parentPort.postMessage({
-                error: `Failed to connect to redis, could not refresh ID card: ${error.message}`,
+            console.error(`Failed to connect to redis, could not refresh ID card: ${messageOf(error)}`);
+            // `process.send`, not `this.parentPort.postMessage`: this worker is a
+            // `child_process.fork()` child and has no `parentPort` — that is the
+            // `worker_threads` API, left behind by an earlier implementation, and the
+            // property was never assigned anywhere. The one path that exists to say
+            // *why* the ID card cannot be renewed used to raise a TypeError instead
+            // of sending `{ error }`, so the node was evicted by the `close` handler
+            // with a generic reason rather than this one. See TD-63 (#2770).
+            process.send?.({
+                error: `Failed to connect to redis, could not refresh ID card: ${messageOf(error)}`,
             });
             return;
         }
@@ -41,10 +76,17 @@ class IDCardRenewer {
             this.refreshTimer = setInterval(this.renewIDCard.bind(this), this.refreshDelay);
         }
         // Notify that the worker is running and updating the ID Card
-        process.send({ initialized: true });
+        process.send?.({ initialized: true });
     }
     async initRedis(config, name) {
-        const redis = new Redis(config, name);
+        // Rejecting here is what `init()` above reports: the worker is started
+        // without a redis configuration in the specs, and the JS read two fields
+        // off a `config.redis || {}` and handed `new Redis(undefined, undefined)`
+        // the result.
+        if (config === undefined || name === undefined) {
+            throw new Error("no redis configuration was sent to the ID card worker");
+        }
+        const redis = new redis_1.default(config, name);
         await redis.init();
         this.redis = redis;
     }
@@ -52,21 +94,26 @@ class IDCardRenewer {
         if (this.disposed) {
             return; // Do not refresh ID Card when worker has been disposed
         }
+        // Both are set by `init()`, which is the only thing that clears
+        // `disposed` above — but the timer it starts outlives a failed one.
+        if (this.redis === null || this.nodeIdKey === null) {
+            return;
+        }
         try {
             const refreshed = await this.redis.commands.pexpire(this.nodeIdKey, this.refreshDelay * this.refreshMultiplier);
             // Unable to refresh the key in time before it expires
             // => this node is too slow, we need to remove it from the cluster
             if (refreshed === 0) {
                 await this.dispose();
-                process.send({
+                process.send?.({
                     error: "Node too slow: ID card expired",
                 });
             }
         }
         catch (error) {
             await this.dispose();
-            process.send({
-                error: `Failed to refresh ID Card: ${error.message}`,
+            process.send?.({
+                error: `Failed to refresh ID Card: ${messageOf(error)}`,
             });
         }
     }
@@ -75,11 +122,11 @@ class IDCardRenewer {
             return; // Already disposed
         }
         this.disposed = true;
-        clearInterval(this.refreshTimer);
+        clearInterval(this.refreshTimer ?? undefined);
         this.refreshTimer = null;
         // If the worker is disposed before it had time to starts, redis service
         // may not have been initialized
-        if (!this.redis) {
+        if (!this.redis || this.nodeIdKey === null) {
             return;
         }
         try {
@@ -87,23 +134,42 @@ class IDCardRenewer {
         }
         catch (error) {
             // eslint-disable-next-line no-console
-            console.error(`Could not delete key '${this.nodeIdKey}' from redis: ${error.message}`);
+            console.error(`Could not delete key '${this.nodeIdKey}' from redis: ${messageOf(error)}`);
         }
     }
 }
+exports.IDCardRenewer = IDCardRenewer;
 const idCardRenewer = new IDCardRenewer();
 process.on("message", async (message) => {
     if (message.action === "start") {
         // Simulate basic global Kuzzle Context
         global.kuzzle = { ...message.kuzzle };
-        global.kuzzle.log = {
-            debug: console.debug, // eslint-disable-line no-console
-            error: console.error, // eslint-disable-line no-console
-            info: console.info, // eslint-disable-line no-console
-            warn: console.warn, // eslint-disable-line no-console
-        };
+        // A deliberately partial logger: this process is a `fork()` child with no
+        // Kuzzle instance, and the four console methods are all it needs. The
+        // codebase already knows — `redis.ts` branches on `global.kuzzle.log.child`
+        // being absent for exactly this case — but the type does not: `log` is
+        // declared `Logger`. Assigned through `Object.assign` rather than asserted
+        // with a cast, and reported rather than silenced: making the declaration
+        // admit a partial logger is a change to a widely-shared type, not part of
+        // a conversion.
+        Object.assign(global.kuzzle, {
+            log: {
+                debug: console.debug, // eslint-disable-line no-console
+                error: console.error, // eslint-disable-line no-console
+                info: console.info, // eslint-disable-line no-console
+                warn: console.warn, // eslint-disable-line no-console
+            },
+        });
         // Should never throw
-        await idCardRenewer.init(message);
+        // Named field by field rather than passed whole: this crossed an IPC
+        // boundary as plain JSON, and listing what is read is what keeps the
+        // worker's contract with `idCardHandler.createIdCard()` visible.
+        await idCardRenewer.init({
+            nodeIdKey: message.nodeIdKey,
+            redis: message.redis,
+            refreshDelay: message.refreshDelay,
+            refreshMultiplier: message.refreshMultiplier,
+        });
     }
     else if (message.action === "dispose") {
         // Should never throw
@@ -116,5 +182,4 @@ process.on("disconnect", async () => {
     await idCardRenewer.dispose();
     process.exit();
 });
-module.exports = { IDCardRenewer };
 //# sourceMappingURL=IDCardRenewer.js.map

package/dist/lib/config/default.config.d.ts

@@ -1,4 +1,4 @@
-import { KuzzleConfiguration } from "../types/config/KuzzleConfiguration";
+import type { PackagedKuzzleConfiguration } from "../types/config/KuzzleConfiguration";
 /**
  * /!\ DO NOT MODIFY THIS FILE
  *
@@ -9,5 +9,5 @@ import { KuzzleConfiguration } from "../types/config/KuzzleConfiguration";
  *
  * @class KuzzleConfiguration
  */
-declare const defaultConfig: KuzzleConfiguration;
+declare const defaultConfig: PackagedKuzzleConfiguration;
 export default defaultConfig;

package/dist/lib/config/default.config.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const httpRoutes_js_1 = __importDefault(require("../api/httpRoutes.js"));
+const httpRoutes_1 = __importDefault(require("../api/httpRoutes"));
 /* eslint-disable sort-keys */
 /**
  * /!\ DO NOT MODIFY THIS FILE
@@ -42,7 +42,7 @@ const defaultConfig = {
          (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)
      */
     http: {
-        routes: httpRoutes_js_1.default,
+        routes: httpRoutes_1.default,
         accessControlAllowOrigin: "*",
         accessControlAllowOriginUseRegExp: false,
         accessControlAllowMethods: "GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD",
@@ -390,6 +390,7 @@ const defaultConfig = {
                             properties: {
                                 userId: { type: "keyword" },
                                 hash: { type: "keyword" },
+                                fingerprint: { type: "keyword" },
                                 description: { type: "text" },
                                 expiresAt: { type: "long" },
                                 ttl: { type: "keyword" },
@@ -451,15 +452,21 @@ const defaultConfig = {
             command: 7510,
             sync: 7511,
         },
+        retransmitBuffer: {
+            bytes: 16777216,
+            messages: 1000,
+        },
         syncTimeout: 5000,
     },
-    /** @type {DocumentSpecification} */
     validation: {},
     controllers: {
         definition: {
             allowAdditionalActionProperties: false,
         },
     },
+    vault: {
+        newAlgorithm: false,
+    },
 };
 exports.default = defaultConfig;
 //# sourceMappingURL=default.config.js.map

package/dist/lib/config/documentEventAliases.d.ts

@@ -1,5 +1,5 @@
 export interface EventAliases {
-    list: Record<string, unknown>;
+    list: Record<string, string[]>;
     namespace: string;
     notBefore: string[];
 }

package/dist/lib/config/index.d.ts

@@ -1,5 +1,2 @@
-/**
- * Loads, interprets and checks configuration files
- * @returns {object}
- */
-export declare function loadConfig(): any;
+import type { IKuzzleConfiguration } from "../types/config/KuzzleConfiguration";
+export declare function loadConfig(): IKuzzleConfiguration;

package/dist/lib/config/index.js

@@ -25,6 +25,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadConfig = void 0;
 const assert_1 = __importDefault(require("assert"));
+const node_util_1 = require("node:util");
 const rc_1 = __importDefault(require("rc"));
 const default_config_1 = __importDefault(require("./default.config"));
 const package_json_1 = __importDefault(require("../../package.json"));
@@ -32,17 +33,13 @@ const kerror_1 = require("../kerror");
 const safeObject_1 = require("../util/safeObject");
 const bytes_1 = __importDefault(require("../util/bytes"));
 const wrapped = (0, kerror_1.wrap)("core", "configuration");
-/**
- * Loads, interprets and checks configuration files
- * @returns {object}
- */
 function loadConfig() {
     let config;
     try {
         config = (0, rc_1.default)("kuzzle", default_config_1.default);
     }
     catch (e) {
-        throw wrapped.get("cannot_parse", e.message);
+        throw wrapped.get("cannot_parse", e instanceof Error ? e.message : (0, node_util_1.inspect)(e));
     }
     config = unstringify(config);
     checkLimitsConfig(config);
@@ -89,7 +86,7 @@ function unstringify(cfg) {
                 try {
                     cfg[k] = JSON.parse(cfg[k].replace(/^\*json:/, ""));
                 }
-                catch (e) {
+                catch {
                     throw wrapped.get("cannot_parse", `the key "${k}" does not contain a valid stringified JSON (${cfg[k]})`);
                 }
             }
@@ -131,24 +128,32 @@ function checkLimitsConfig(cfg) {
         "subscriptionRooms",
         "subscriptionDocumentTTL",
     ];
-    if (!(0, safeObject_1.isPlainObject)(cfg.limits)) {
+    const configured = cfg.limits;
+    if (!(0, safeObject_1.isPlainObject)(configured)) {
         throw wrapped.get("invalid_type", "limits", "object");
     }
-    for (const opt of limits) {
-        if (typeof cfg.limits[opt] !== "number") {
+    // One read per limit, validated where it is read: `isPlainObject` narrows
+    // to a record of `unknown`, which is the honest type for a configuration
+    // file, and the three comparisons below each re-read two of these.
+    const limit = (opt) => {
+        const value = configured[opt];
+        if (typeof value !== "number") {
             throw wrapped.get("invalid_type", `limits.${opt}`, "number");
         }
-        if (cfg.limits[opt] < 0 ||
-            (cfg.limits[opt] === 0 && !canBeZero.includes(opt))) {
+        return value;
+    };
+    for (const opt of limits) {
+        const value = limit(opt);
+        if (value < 0 || (value === 0 && !canBeZero.includes(opt))) {
             const allowed = `>= ${canBeZero.includes(opt) ? "0" : "1"}`;
             throw wrapped.get("out_of_range", `limits.${opt}`, allowed);
         }
     }
-    if (cfg.limits.concurrentRequests >= cfg.limits.requestsBufferSize) {
+    if (limit("concurrentRequests") >= limit("requestsBufferSize")) {
         throw wrapped.get("out_of_range", "limits.concurrentRequests", 'lower than "limits.requestsBufferSize"');
     }
-    if (cfg.limits.requestsBufferWarningThreshold < cfg.limits.concurrentRequests ||
-        cfg.limits.requestsBufferWarningThreshold > cfg.limits.requestsBufferSize) {
+    if (limit("requestsBufferWarningThreshold") < limit("concurrentRequests") ||
+        limit("requestsBufferWarningThreshold") > limit("requestsBufferSize")) {
         throw wrapped.get("out_of_range", "limits.requestsBufferWarningThreshold", "[limits.concurrentRequests, limits.requestsBufferSize]");
     }
 }
@@ -158,7 +163,9 @@ function checkWebSocketOptions(config) {
         return;
     }
     (0, assert_1.default)(typeof cfg.enabled === "boolean", `[websocket] "enabled" parameter: invalid value "${cfg.enabled}" (boolean expected)`);
-    (0, assert_1.default)(Number.isInteger(cfg.idleTimeout) && cfg.idleTimeout >= 0, `[websocket] "idleTimeout" parameter: invalid value "${cfg.idleTimeout}" (integer >= 1000 expected)`);
+    // The 1000 ms floor is the protocol's, not this check's: `httpwsProtocol`
+    // replaces a lower value (0 included) with its default, and warns.
+    (0, assert_1.default)(Number.isInteger(cfg.idleTimeout) && cfg.idleTimeout >= 0, `[websocket] "idleTimeout" parameter: invalid value "${cfg.idleTimeout}" (integer >= 0 expected)`);
     (0, assert_1.default)(Number.isInteger(cfg.rateLimit) && cfg.rateLimit >= 0, `[websocket] "rateLimit" parameter: invalid value "${cfg.rateLimit}" (integer >= 0 expected)`);
     (0, assert_1.default)(typeof cfg.compression === "boolean", `[websocket] "compression" parameter: invalid value "${cfg.compression}" (boolean expected)`);
     (0, assert_1.default)(typeof cfg.sendPingsAutomatically === "boolean", `[websocket] "sendPingsAutomatically" parameter: invalid value "${cfg.sendPingsAutomatically}" (boolean expected)`);
@@ -171,12 +178,14 @@ function checkHttpOptions(config) {
     }
     (0, assert_1.default)(typeof config.http.accessControlAllowOrigin === "string" ||
         Array.isArray(config.http.accessControlAllowOrigin), `[http] "accessControlAllowOrigin" parameter: invalid value "${config.http.accessControlAllowOrigin}" (array or string expected)`);
-    (0, assert_1.default)(typeof config.http.accessControlAllowOriginUseRegExp === "boolean", `[http] "accessControlAllowOriginUseRegExp" parameter: invalid value "${cfg.accessControlAllowOriginUseRegExp}" (boolean expected)`);
+    (0, assert_1.default)(typeof config.http.accessControlAllowOriginUseRegExp === "boolean", `[http] "accessControlAllowOriginUseRegExp" parameter: invalid value "${config.http.accessControlAllowOriginUseRegExp}" (boolean expected)`);
     (0, assert_1.default)(typeof cfg.enabled === "boolean", `[http] "enabled" parameter: invalid value "${cfg.enabled}" (boolean expected)`);
     (0, assert_1.default)(typeof cfg.allowCompression === "boolean", `[http] "allowCompression" parameter: invalid value "${cfg.allowCompression}" (boolean expected)`);
     (0, assert_1.default)(Number.isInteger(cfg.maxEncodingLayers) && cfg.maxEncodingLayers >= 1, `[http] "maxEncodingLayers" parameter: invalid value "${cfg.maxEncodingLayers}" (integer >= 1 expected)`);
     const maxFormFileSize = (0, bytes_1.default)(cfg.maxFormFileSize);
-    (0, assert_1.default)(Number.isInteger(maxFormFileSize) && maxFormFileSize >= 0, `[http] "maxFormFileSize" parameter: cannot parse "${cfg.maxFormFileSize}"`);
+    (0, assert_1.default)(maxFormFileSize !== null &&
+        Number.isInteger(maxFormFileSize) &&
+        maxFormFileSize >= 0, `[http] "maxFormFileSize" parameter: cannot parse "${cfg.maxFormFileSize}"`);
     cfg.maxFormFileSize = maxFormFileSize;
     (0, assert_1.default)(typeof config.http.cookieAuthentication === "boolean", `[http] "cookieAuthentication" parameter: invalid value "${config.http.cookieAuthentication}" (boolean expected)`);
     (0, assert_1.default)(Array.isArray(cfg.additionalContentTypes) &&
@@ -197,6 +206,10 @@ function checkClusterOptions(config) {
     for (const prop of ["command", "sync"]) {
         (0, assert_1.default)(typeof cfg.ports[prop] === "number" && cfg.ports[prop] > 0, `[CONFIG] kuzzlerc.cluster.ports.${prop}: value must be a number greater than 0`);
     }
+    for (const prop of ["messages", "bytes"]) {
+        (0, assert_1.default)(Number.isInteger(cfg.retransmitBuffer?.[prop]) &&
+            cfg.retransmitBuffer[prop] >= 0, `[CONFIG] kuzzlerc.cluster.retransmitBuffer.${prop}: integer >= 0 expected`);
+    }
     (0, assert_1.default)(typeof cfg.ipv6 === "boolean", "[CONFIG] kuzzlerc.cluster.ipv6: boolean expected");
     // If config is passed with env variable, ip cannot be the value null
     // but only blank string or the string "null"

package/dist/lib/core/auth/formatProcessing.d.ts

@@ -1,6 +1,6 @@
-import { Profile } from "../../model/security/profile";
-import { Role } from "../../model/security/role";
-import { User } from "../../model/security/user";
+import type { Profile } from "../../model/security/profile";
+import type { Role } from "../../model/security/role";
+import type { User } from "../../model/security/user";
 import type { Serialized } from "../../types/core/auth/formatProcessing.type";
 declare const _default: {
     /**

package/dist/lib/core/auth/passportResponse.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="node" />
-import { OutgoingHttpHeaders } from "http";
+import type { OutgoingHttpHeaders } from "http";
 /**
  * @class PassportResponse
  */

package/dist/lib/core/auth/passportWrapper.d.ts

@@ -1,4 +1,4 @@
-import { AuthenticateOptions, Strategy } from "passport";
+import type { AuthenticateOptions, Strategy } from "passport";
 /**
  * @class PassportWrapper
  */

package/dist/lib/core/auth/passportWrapper.js

@@ -72,14 +72,20 @@ class PassportWrapper {
             // Thus, despite the apparences, the promise can only be resolved once.
             // (Proof: HTTP redirection unit test)
             response.addEndListener(() => resolve(response));
+            // A strategy is plugin code and can fail with anything; so can passport,
+            // which reports what it decides itself (an unknown strategy name, first
+            // of all) through the middleware's `next`. All three paths end here.
+            const fail = (e) => {
+                if (e instanceof errors_1.KuzzleError) {
+                    reject(e);
+                    return;
+                }
+                const error = e instanceof Error ? e : new Error(String(e));
+                reject(kerror.getFrom(error, "plugin", "runtime", "unexpected_error", error.message));
+            };
             const authCB = (err, user, info) => {
                 if (err !== null) {
-                    if (err instanceof errors_1.KuzzleError) {
-                        reject(err);
-                    }
-                    else {
-                        reject(kerror.getFrom(err, "plugin", "runtime", "unexpected_error", err.message));
-                    }
+                    fail(err);
                 }
                 else if (!user) {
                     reject(kerror.get("plugin", "strategy", "missing_user", info.message));
@@ -89,15 +95,10 @@ class PassportWrapper {
                 }
             };
             try {
-                passport_1.default.authenticate(strategyName, this.options[strategyName] || {}, authCB)(request, response);
+                passport_1.default.authenticate(strategyName, this.options[strategyName] || {}, authCB)(request, response, fail);
             }
             catch (e) {
-                if (e instanceof errors_1.KuzzleError) {
-                    reject(e);
-                }
-                else {
-                    reject(kerror.getFrom(e, "plugin", "runtime", "unexpected_error", e.message));
-                }
+                fail(e);
             }
         });
     }

package/dist/lib/core/auth/tokenManager.d.ts

@@ -8,6 +8,7 @@ import { Token } from "../../model/security/token";
  */
 export declare class TokenManager {
     private tokens;
+    /** Read from the anonymous user by `init()`, and not before. */
     private anonymousUserId;
     /**
      * Map<connectionId, ManagedToken>
@@ -17,6 +18,14 @@ export declare class TokenManager {
     private readonly logger;
     constructor();
     init(): Promise<void>;
+    /**
+     * The managed token filed under `idx`, or undefined when none is.
+     *
+     * `search` answers a position or `-1`, and indexing `array` with it is
+     * `| undefined` for every position under `noUncheckedIndexedAccess` — so the
+     * callers test one value rather than a position and then an element.
+     */
+    private find;
     runTimer(): void;
     /**
      * Link a connection and a token.
@@ -31,7 +40,13 @@ export declare class TokenManager {
      * @param token
      * @param connectionId
      */
-    unlink(token: Token, connectionId: string): void;
+    /**
+     * `Token | null`: a request whose connection never authenticated carries no
+     * token, and the trace below is the deliberate answer to that. The
+     * non-nullable parameter made `authController.logout` — the one caller —
+     * look like it had checked.
+     */
+    unlink(token: Token | null, connectionId: string): void;
     /**
      * Remove token associated with a connection.
      */
@@ -54,9 +69,15 @@ export declare class TokenManager {
     refresh(oldToken: Token, newToken: Token): void;
     checkTokensValidity(): Promise<void>;
     /**
-     * Gets the token matching user & connection if any
+     * Gets the token matching user & connection if any.
+     *
+     * `string | null` on both: this is a query, and a request that carries
+     * neither a connection nor a stored user is answered — `null` misses the
+     * map, and a null kuid matches no token's `userId` — rather than being a
+     * caller error. `authController.login` asks it of every login, including
+     * the ones where the strategy has not yet produced either.
      */
-    getConnectedUserToken(userId: string, connectionId: string): Token | null;
+    getConnectedUserToken(userId: string | null, connectionId: string | null): Token | null;
     /**
      * Returns the kuid associated to a connection
      */