kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/core/network/protocols/httpwsProtocol.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,20 +19,47 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const querystring = require("querystring");
-const url = require("url");
-const zlib = require("zlib");
-const uWS = require("uWebSockets.js");
-const { HttpStream } = require("../../../types");
-const { Request } = require("../../../api/request");
-const { KuzzleError } = require("../../../kerror/errors");
-const Protocol = require("./protocol");
-const ClientConnection = require("../clientConnection");
-const { removeStacktrace } = require("../../../util/stackTrace");
-const debug = require("../../../util/debug");
-const kerror = require("../../../kerror");
-const HttpMessage = require("./httpMessage");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_querystring_1 = __importDefault(require("node:querystring"));
+const node_url_1 = __importDefault(require("node:url"));
+const node_zlib_1 = __importDefault(require("node:zlib"));
+const uWebSockets_js_1 = __importDefault(require("uWebSockets.js"));
+const request_1 = require("../../../api/request");
+const kerror = __importStar(require("../../../kerror"));
+const errors_1 = require("../../../kerror/errors");
+const types_1 = require("../../../types");
+const debug_1 = __importDefault(require("../../../util/debug"));
+const stackTrace_1 = require("../../../util/stackTrace");
+const thrown_1 = require("../../../util/thrown");
+const clientConnection_1 = __importDefault(require("../clientConnection"));
+const httpMessage_1 = __importDefault(require("./httpMessage"));
+const protocol_1 = __importDefault(require("./protocol"));
+const debug = debug_1.default;
 const kerrorWS = kerror.wrap("network", "websocket");
 const kerrorHTTP = kerror.wrap("network", "http");
 const debugWS = debug("kuzzle:network:protocols:websocket");
@@ -65,7 +93,7 @@ const HTTP_ALLOWED_CONTENT_TYPES = [
     "application/x-www-form-urlencoded",
     "multipart/form-data",
 ];
-const HTTP_SKIPPED_HEADERS = ["content-length", "set-cookie"];
+const HTTP_SKIPPED_HEADERS = new Set(["content-length", "set-cookie"]);
 const HTTP_HEADER_CONNECTION = Buffer.from("Connection");
 const HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN = Buffer.from("Access-Control-Allow-Origin");
 const HTTP_HEADER_SET_COOKIE = Buffer.from("Set-Cookie");
@@ -76,15 +104,33 @@ const X_KUZZLE_REQUEST_ID = Buffer.from("X-Kuzzle-Request-Id");
 const CLOSE = Buffer.from("close");
 const CHARSET_REGEX = /charset=([\w-]+)/i;
 /**
- * @class HTTPWS
- * Handles both HTTP and WebSocket connections
+ * Whatever failed parsing a WebSocket payload, as the error sent back.
+ *
+ * Always `network.websocket.unexpected_error`, even for a `KuzzleError`: that
+ * is what the `protocol:websocket:afterParsingPayload` pipe and `JSON.parse`
+ * have always answered, and the pipe hands over what a plugin threw already
+ * wrapped as `plugin.runtime.unexpected_error`.
+ */
+function parsingError(thrown) {
+    const error = (0, thrown_1.causeOf)(thrown);
+    return kerrorWS.getFrom(error, "unexpected_error", error.message);
+}
+/**
+ * What `new Request()` threw, as the error sent back: a `KuzzleError`
+ * (`BadRequestError`) in every in-tree path, forwarded as is.
  */
-class HttpWsProtocol extends Protocol {
+function asKuzzleError(thrown) {
+    if (thrown instanceof errors_1.KuzzleError) {
+        return thrown;
+    }
+    return parsingError(thrown);
+}
+class HttpWsProtocol extends protocol_1.default {
     constructor() {
         super("websocket");
-        this.server = null;
-        this.wsConfig = null;
-        this.httpConfig = null;
+        this._server = null;
+        this._wsConfig = null;
+        this._httpConfig = null;
         // Used to limit the rate of messages on websocket
         this.now = Date.now();
         this.nowInterval = setInterval(() => {
@@ -98,16 +144,49 @@ class HttpWsProtocol extends Protocol {
         this.socketByConnectionId = new Map();
         this.logger = global.kuzzle.log.child("core:network:protocols:httpws");
     }
-    async init(entrypoint) {
-        super.init(null, entrypoint);
+    /**
+     * The uWebSockets application and the two parsed configuration blocks.
+     * All three are built by `init` — the first from the other two, which are
+     * themselves parsed out of a configuration only the entry point has — and
+     * every one of the seventeen reads below happens in a handler that the
+     * server registered, so none of them can run before `init` returned.
+     *
+     * Declaring them nullable and dereferencing them anyway is the shape
+     * `Protocol.entryPoint` had; these accessors answer the same way, once,
+     * instead of at each call site.
+     */
+    get server() {
+        if (this._server === null) {
+            throw new Error("[http/websocket] no server: init() has not been called");
+        }
+        return this._server;
+    }
+    get wsConfig() {
+        if (this._wsConfig === null) {
+            throw new Error("[http/websocket] no websocket configuration: init() has not been called");
+        }
+        return this._wsConfig;
+    }
+    get httpConfig() {
+        if (this._httpConfig === null) {
+            throw new Error("[http/websocket] no http configuration: init() has not been called");
+        }
+        return this._httpConfig;
+    }
+    async init(...args) {
+        const entrypoint = protocol_1.default.entryPointOf(args);
+        // Awaited: the base sets `entryPoint` and `maxRequestSize`, which
+        // `parseWebSocketOptions` reads two lines down. It happened to work
+        // because that body has no `await` of its own.
+        await super.init(entrypoint);
         this.config = entrypoint.config.protocols;
-        this.wsConfig = this.parseWebSocketOptions();
-        this.httpConfig = this.parseHttpOptions();
+        this._wsConfig = this.parseWebSocketOptions();
+        this._httpConfig = this.parseHttpOptions();
         if (!this.wsConfig.enabled && !this.httpConfig.enabled) {
             return false;
         }
         // eslint-disable-next-line new-cap
-        this.server = uWS.App();
+        this._server = uWebSockets_js_1.default.App();
         if (this.wsConfig.enabled) {
             this.initWebSocket();
         }
@@ -168,8 +247,8 @@ class HttpWsProtocol extends Protocol {
             return;
         }
         const payload = data.payload;
-        for (let i = 0; i < data.channels.length; i++) {
-            payload.room = data.channels[i];
+        for (const channel of data.channels) {
+            payload.room = channel;
             this.wsSend(socket, Buffer.from(JSON.stringify(payload)));
         }
     }
@@ -204,13 +283,19 @@ class HttpWsProtocol extends Protocol {
             headers[header] = value;
         });
         res.upgrade({
+            // `last` and `count` are the rate limiter's bookkeeping. Seeding them
+            // here is what makes them non-optional on the socket: the limiter
+            // incremented `count` on a socket that had never been given one, and
+            // only ever read it in the branch that had just written it.
+            count: 0,
             headers,
             internal: {},
+            last: 0,
         }, req.getHeader("sec-websocket-key"), req.getHeader("sec-websocket-protocol"), req.getHeader("sec-websocket-extensions"), context);
     }
     wsOnOpenHandler(socket) {
         const ip = Buffer.from(socket.getRemoteAddressAsText()).toString();
-        const connection = new ClientConnection(this.name, [ip], socket.headers, socket.internal);
+        const connection = new clientConnection_1.default(this.name, [ip], socket.headers, socket.internal);
         this.entryPoint.newConnection(connection);
         this.connectionBySocket.set(socket, connection);
         this.socketByConnectionId.set(connection.id, socket);
@@ -221,7 +306,7 @@ class HttpWsProtocol extends Protocol {
         if (!connection) {
             return;
         }
-        const reason = Buffer.from(message || "").toString();
+        const reason = Buffer.from(message ?? new ArrayBuffer(0)).toString();
         // This hack is only here to indicate that uWebSockets killed the connection early
         // because the received payload exceeded the configured threshold.
         if (code === 1006 && reason.startsWith("Received too big message")) {
@@ -240,6 +325,12 @@ class HttpWsProtocol extends Protocol {
             return;
         }
         const connection = this.connectionBySocket.get(socket);
+        // A socket with no connection is one `wsOnCloseHandler` has already torn
+        // down: there is nothing left to answer on, not even a rate-limit error.
+        // The six reads below took that on trust.
+        if (connection === undefined) {
+            return;
+        }
         // enforce rate limits
         if (this.wsConfig.rateLimit > 0) {
             if (socket.last === this.now) {
@@ -269,7 +360,7 @@ class HttpWsProtocol extends Protocol {
              So... the error is forwarded to the client, hoping they know
              what to do with it.
              */
-            this.wsSendError(socket, connection, kerrorWS.getFrom(e, "unexpected_error", e.message));
+            this.wsSendError(socket, connection, parsingError(e));
             return;
         }
         if (parsed.p && parsed.p === 1 && Object.keys(parsed).length === 1) {
@@ -279,10 +370,10 @@ class HttpWsProtocol extends Protocol {
         }
         let request;
         try {
-            request = new Request(parsed, { connection });
+            request = new request_1.Request(parsed, { connection });
         }
         catch (e) {
-            this.wsSendError(socket, connection, e, parsed.requestId);
+            this.wsSendError(socket, connection, asKuzzleError(e), parsed.requestId);
             return;
         }
         this.entryPoint.execute(connection, request, (result) => {
@@ -304,9 +395,16 @@ class HttpWsProtocol extends Protocol {
     wsOnDrainHandler(socket) {
         socket.cork(() => {
             const buffer = this.backpressureBuffer.get(socket);
-            while (buffer.length > 0 &&
-                socket.getBufferedAmount() < WS_PER_SOCKET_BACKPRESSURE_BUFFER_SIZE) {
+            if (buffer === undefined) {
+                return;
+            }
+            // Drain until the socket fills up again, or until there is nothing left
+            // to drain — which is what `shift()` answering `undefined` means.
+            while (socket.getBufferedAmount() < WS_PER_SOCKET_BACKPRESSURE_BUFFER_SIZE) {
                 const payload = buffer.shift();
+                if (payload === undefined) {
+                    break;
+                }
                 socket.send(payload);
             }
         });
@@ -320,10 +418,10 @@ class HttpWsProtocol extends Protocol {
      * @param  {String} requestId @optional
      */
     wsSendError(socket, connection, error, requestId) {
-        const request = new Request({}, { connection, error });
+        const request = new request_1.Request({}, { connection, error });
         // If a requestId is provided we use it instead of the generated one
         request.id = requestId || request.id;
-        const sanitized = removeStacktrace(request.response.toJSON()).content;
+        const sanitized = (0, stackTrace_1.removeStacktrace)(request.response.toJSON()).content;
         this.wsSend(socket, Buffer.from(JSON.stringify(sanitized)));
     }
     /**
@@ -334,14 +432,19 @@ class HttpWsProtocol extends Protocol {
      * @param  {Buffer} payload
      */
     wsSend(socket, payload) {
-        if (!this.connectionBySocket.has(socket)) {
+        // The three socket maps are written by `wsOnOpenHandler` and cleared by
+        // `wsOnCloseHandler`, together: a socket with no backpressure buffer is a
+        // socket with no connection. Asking the map that is about to be read
+        // answers both questions at once, and replaces a `has()`-then-`get()`
+        // pair on two different maps.
+        const buffer = this.backpressureBuffer.get(socket);
+        if (buffer === undefined) {
             return;
         }
         if (socket.getBufferedAmount() < WS_PER_SOCKET_BACKPRESSURE_BUFFER_SIZE) {
             socket.cork(() => socket.send(payload));
         }
         else {
-            const buffer = this.backpressureBuffer.get(socket);
             buffer.push(payload);
             /**
              * Client socket too slow: we need to close it
@@ -361,10 +464,17 @@ class HttpWsProtocol extends Protocol {
      * @param  {uWS.HttpRequest} request
      */
     httpOnMessageHandler(response, request) {
-        const connection = new ClientConnection("HTTP/1.1", getHttpIps(response, request), request.headers);
-        const message = new HttpMessage(connection, request);
+        // Collected once, here, and handed to both: a uWS `HttpRequest` has no
+        // `headers` property, so the JavaScript's `request.headers` was `undefined`
+        // and every HTTP connection carried `{}` — despite `ClientConnection`'s own
+        // doc promising the request headers (TD-52).
+        const headers = getRequestHeaders(request);
+        const connection = new clientConnection_1.default("HTTP/1.1", getHttpIps(response, request), headers);
+        const message = new httpMessage_1.default(connection, request, headers);
         debugHTTP("[%s] Received HTTP request: %a", connection.id, message);
-        if (message.headers["content-length"] > this.maxRequestSize) {
+        // `Number(...)`: a header value is a string, and the JavaScript relied on
+        // `>` coercing it. Same comparison, spelled.
+        if (Number(message.headers["content-length"]) > this.maxRequestSize) {
             this.httpSendError(message, response, HTTP_REQUEST_TOO_LARGE_ERROR);
             return;
         }
@@ -374,15 +484,19 @@ class HttpWsProtocol extends Protocol {
             const contentType = contentTypeParamIndex !== -1
                 ? contentTypeHeader.slice(0, contentTypeParamIndex).trim()
                 : contentTypeHeader.trim();
-            if (!this.httpConfig.opts.allowedContentTypes.some((allowed) => contentType === allowed)) {
+            if (!this.httpConfig.opts.allowedContentTypes.includes(contentType)) {
                 this.httpSendError(message, response, kerrorHTTP.get("unsupported_content", contentType));
                 return;
             }
-        }
-        const encoding = CHARSET_REGEX.exec(contentTypeHeader);
-        if (encoding !== null && encoding[1].toLowerCase() !== "utf-8") {
-            this.httpSendError(message, response, kerrorHTTP.get("unsupported_charset", encoding[1].toLowerCase()));
-            return;
+            // Inside the branch now: a charset is declared by the content-type
+            // header, so with no header there is nothing to read one out of. The
+            // regex used to be run against `undefined`, which stringifies to
+            // "undefined" and matches nothing — the same answer, by accident.
+            const charset = CHARSET_REGEX.exec(contentTypeHeader)?.[1];
+            if (charset !== undefined && charset.toLowerCase() !== "utf-8") {
+                this.httpSendError(message, response, kerrorHTTP.get("unsupported_charset", charset.toLowerCase()));
+                return;
+            }
         }
         this.httpReadData(message, response, (err) => {
             if (err) {
@@ -424,7 +538,7 @@ class HttpWsProtocol extends Protocol {
                 return;
             }
             let resolve;
-            let promise = new Promise((res) => (resolve = res));
+            const promise = new Promise((res) => (resolve = res));
             this.httpUncompress(message, payload, async (err, inflated) => {
                 if (err) {
                     cb(err);
@@ -446,44 +560,62 @@ class HttpWsProtocol extends Protocol {
     async httpParseContent(message, content, cb) {
         const type = message.headers["content-type"] || "";
         if (type.includes("multipart/form-data")) {
-            const parts = uWS.getParts(content, message.headers["content-type"]);
-            message.content = {};
-            if (!parts) {
-                cb();
+            if (!this.httpParseMultipart(message, content, type)) {
+                cb(HTTP_FILE_TOO_LARGE_ERROR);
                 return;
             }
-            for (const part of parts) {
-                if (part.data.byteLength > this.maxFormFileSize) {
-                    cb(HTTP_FILE_TOO_LARGE_ERROR);
-                    return;
-                }
-                if (part.filename) {
-                    message.content[part.name] = {
-                        encoding: part.type,
-                        file: Buffer.from(part.data).toString("base64"),
-                        filename: part.filename,
-                    };
-                }
-                else {
-                    message.content[part.name] = Buffer.from(part.data).toString();
-                }
-            }
         }
         else if (type.includes("application/x-www-form-urlencoded")) {
-            message.content = querystring.parse(content.toString());
+            message.content = node_querystring_1.default.parse(content.toString());
         }
         else {
             try {
                 const { payload } = await global.kuzzle.pipe("protocol:http:afterParsingPayload", { message, payload: JSON.parse(content.toString()) });
                 message.content = payload;
             }
-            catch (e) {
+            catch {
+                // The parser error is deliberately dropped: `body_parse_failed` already
+                // carries the offending payload, and the raw message leaks internals of
+                // whichever parser ran to the client.
                 cb(kerrorHTTP.get("body_parse_failed", content.toString().slice(0, 50)));
                 return;
             }
         }
         cb();
     }
+    /**
+     * Fills `message.content` from a multipart/form-data payload, file parts
+     * base64-encoded and the rest read as text.
+     *
+     * Returns false when a part is over the configured `maxFormFileSize`, leaving
+     * the caller to raise the error — a boolean rather than a throw so
+     * `httpParseContent` keeps answering through its callback, and split out of
+     * it to stay under the cognitive complexity ceiling the `.js` → `.ts` rename
+     * re-scores as new code.
+     */
+    httpParseMultipart(message, content, contentType) {
+        // Handed down rather than read off the message again: the caller only
+        // reaches here because it read that header and found "multipart/form-data"
+        // in it.
+        const parts = uWebSockets_js_1.default.getParts(content, contentType);
+        message.content = {};
+        if (!parts) {
+            return true;
+        }
+        for (const part of parts) {
+            if (part.data.byteLength > this.httpConfig.opts.maxFormFileSize) {
+                return false;
+            }
+            message.content[part.name] = part.filename
+                ? {
+                    encoding: part.type,
+                    file: Buffer.from(part.data).toString("base64"),
+                    filename: part.filename,
+                }
+                : Buffer.from(part.data).toString();
+        }
+        return true;
+    }
     httpProcessRequest(response, message) {
         debugHTTP("[%s] httpProcessRequest: %a", message.connection.id, message);
         if (response.aborted) {
@@ -496,7 +628,7 @@ class HttpWsProtocol extends Protocol {
             if (response.aborted) {
                 return;
             }
-            if (request.result instanceof HttpStream) {
+            if (request.result instanceof types_1.HttpStream) {
                 this.httpSendStream(request, response, request.result, message);
                 return;
             }
@@ -539,8 +671,7 @@ class HttpWsProtocol extends Protocol {
         }
         // Access-Control-Allow-Origin Logic
         if (request.response.headers["Access-Control-Allow-Origin"] === undefined &&
-            message.headers &&
-            message.headers.origin) {
+            message.headers?.origin) {
             response.writeHeader(HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, Buffer.from(message.headers.origin));
             response.writeHeader(HTTP_HEADER_VARY, ORIGIN);
         }
@@ -551,7 +682,7 @@ class HttpWsProtocol extends Protocol {
         }
         for (const [key, value] of Object.entries(request.response.headers)) {
             // Skip some headers that are not allowed to be sent or modified
-            if (HTTP_SKIPPED_HEADERS.includes(key.toLowerCase())) {
+            if (HTTP_SKIPPED_HEADERS.has(key.toLowerCase())) {
                 continue;
             }
             response.writeHeader(Buffer.from(key), Buffer.from(value.toString()));
@@ -574,8 +705,12 @@ class HttpWsProtocol extends Protocol {
             this.httpSendError(message, response, kerror.get("network", "http", "stream_closed"));
             return;
         }
-        // Remove Content-Length header to avoid conflic with Transfer-Encoding header
-        request.response.setHeader("Content-Length", null);
+        // Remove Content-Length header to avoid a conflict with the
+        // Transfer-Encoding header. `setHeader(name, null)` was the spelling, and
+        // it sets the header to the string "null" — `String(value)` — rather than
+        // removing anything. It went unnoticed because `httpWriteRequestHeaders`
+        // skips content-length on its way to the wire.
+        request.response.removeHeader("Content-Length");
         // Send Headers in one go
         response.cork(() => {
             this.httpWriteRequestHeaders(request, response, message);
@@ -584,7 +719,7 @@ class HttpWsProtocol extends Protocol {
             // Make a copy of the array buffer
             const arrayBuffer = chunk.buffer.slice(chunk.byteOffset, chunk.byteOffset + chunk.byteLength);
             const arrayBufferOffset = response.getWriteOffset();
-            let backpressure = false;
+            let backpressure;
             /**
              * Switch method of writing data to the response
              * based on the size of the stream.
@@ -616,7 +751,7 @@ class HttpWsProtocol extends Protocol {
                         httpStream.stream.resume();
                         return true;
                     }
-                    let retryBackpressure = false;
+                    let retryBackpressure;
                     const remainingChunkData = response.arrayBuffer.slice(offset - response.arrayBufferOffset);
                     if (streamSizeFixed) {
                         const [success] = response.tryEnd(remainingChunkData, httpStream.totalBytes);
@@ -647,7 +782,7 @@ class HttpWsProtocol extends Protocol {
             if (httpStream.destroy()) {
                 response.end();
             }
-            debugHTTP("[%s] httpSendStream: %s", httpStream.connection.id, err.message);
+            debugHTTP("[%s] httpSendStream: %s", message.connection.id, err.message);
         });
         response.onAborted(() => {
             httpStream.destroy();
@@ -661,12 +796,12 @@ class HttpWsProtocol extends Protocol {
      * @param {Error} error
      */
     httpSendError(message, response, error) {
-        const kerr = error instanceof KuzzleError
+        const kerr = error instanceof errors_1.KuzzleError
             ? error
             : kerrorHTTP.getFrom(error, "unexpected_error", error.message);
-        const content = Buffer.from(JSON.stringify(removeStacktrace(kerr)));
+        const content = Buffer.from(JSON.stringify((0, stackTrace_1.removeStacktrace)(kerr)));
         debugHTTP("[%s] httpSendError: %a", message.connection.id, kerr);
-        this.entryPoint.logAccess(message.connection, new Request(message, {
+        this.entryPoint.logAccess(message.connection, new request_1.Request(message, {
             connectionId: message.connection.id,
             error: kerr,
         }), message);
@@ -680,7 +815,7 @@ class HttpWsProtocol extends Protocol {
                 response.writeHeader(header[0], header[1]);
             }
             // Access-Control-Allow-Origin Logic
-            if (message.headers && message.headers.origin) {
+            if (message.headers?.origin) {
                 if (global.kuzzle.config.internal.allowAllOrigins) {
                     response.writeHeader(HTTP_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, WILDCARD);
                 }
@@ -701,7 +836,7 @@ class HttpWsProtocol extends Protocol {
      * @returns {Buffer}
      */
     httpRequestToResponse(request, message) {
-        let data = removeStacktrace(request.response.toJSON());
+        const data = (0, stackTrace_1.removeStacktrace)(request.response.toJSON());
         if (message.requestId !== data.requestId) {
             data.requestId = message.requestId;
             if (!data.raw) {
@@ -709,39 +844,44 @@ class HttpWsProtocol extends Protocol {
             }
         }
         debugHTTP("HTTP request response: %a", data);
-        if (data.raw) {
-            if (data.content === null || data.content === undefined) {
-                data = "";
-            }
-            else if (typeof data.content === "object") {
-                /*
-                 This object can be either a Buffer object, a stringified Buffer object,
-                 or anything else.
-                 In the former two cases, we create a new Buffer object, and in the
-                 latter, we stringify t he content.
-                 */
-                if (data.content instanceof Buffer ||
-                    (data.content.type === "Buffer" && Array.isArray(data.content.data))) {
-                    data = data.content;
-                }
-                else {
-                    data = JSON.stringify(data.content);
-                }
-            }
-            else {
-                // scalars are sent as strings
-                data = data.content.toString();
-            }
-        }
-        else {
+        // Early returns rather than reassigning `data` from the response object to
+        // a string or a Buffer: the variable changed type under itself, which is
+        // what the conversion could not express. Each branch is the original one.
+        if (!data.raw) {
             let indent = 0;
-            const parsedUrl = url.parse(message.url, true);
-            if (parsedUrl.query && parsedUrl.query.pretty !== undefined) {
+            // `url.parse` is legacy, but `message.url` is a path with no origin, so
+            // the WHATWG parser needs a base, and it throws where this one tolerates
+            // a malformed URL. Swapping them changes what a bad request does, which
+            // is not a decision the conversion gets to make.
+            const parsedUrl = node_url_1.default.parse(message.url, true); // NOSONAR
+            if (parsedUrl.query?.pretty !== undefined) {
                 indent = 2;
             }
-            data = JSON.stringify(data.content, undefined, indent);
+            return Buffer.from(JSON.stringify(data.content, undefined, indent));
+        }
+        const content = data.content;
+        if (content === null || content === undefined) {
+            return Buffer.from("");
+        }
+        if (typeof content !== "object") {
+            // scalars are sent as strings
+            return Buffer.from(content.toString());
         }
-        return Buffer.from(data);
+        /*
+         This object can be either a Buffer object, a stringified Buffer object,
+         or anything else.
+         In the former two cases, we create a new Buffer object, and in the
+         latter, we stringify the content.
+         */
+        if (content instanceof Buffer) {
+            return Buffer.from(content);
+        }
+        if (content.type === "Buffer" && Array.isArray(content.data)) {
+            // `Buffer.from(content)` and `Buffer.from(content.data)` build the same
+            // bytes for the JSON form of a Buffer; the latter is the one that types.
+            return Buffer.from(content.data);
+        }
+        return Buffer.from(JSON.stringify(content));
     }
     /**
      * Compress an outgoing message according to the
@@ -756,12 +896,16 @@ class HttpWsProtocol extends Protocol {
             const encodings = message.headers["accept-encoding"]
                 .split(",")
                 .map((e) => e.trim().toLowerCase());
+            // Undefined until a gzip or deflate encoding is seen: the list may hold
+            // neither, which is the `identity` answer at the bottom of the method.
             let algorithm;
             let priority = -1;
             for (const encoding of encodings) {
                 if (encoding.startsWith("gzip") || encoding.startsWith("deflate")) {
-                    let [_algorithm, _priority = "q=0"] = encoding.split(";");
-                    _priority = Number.parseFloat(_priority.split("=")[1] || 0);
+                    const [_algorithm, rawPriority = "q=0"] = encoding.split(";");
+                    // `|| 0` was a number falling into `parseFloat`, which stringifies it
+                    // back; `"0"` is the same value without the round trip.
+                    const _priority = Number.parseFloat(rawPriority.split("=")[1] || "0");
                     if (_priority > priority) {
                         algorithm = _algorithm;
                         priority = _priority;
@@ -774,14 +918,14 @@ class HttpWsProtocol extends Protocol {
                 }
             }
             if (algorithm === "gzip") {
-                zlib.gzip(data, (err, compressed) => callback({
+                node_zlib_1.default.gzip(data, (err, compressed) => callback({
                     compressed: !err ? compressed : data,
                     encoding: !err ? "gzip" : "identity",
                 }));
                 return;
             }
             else if (algorithm === "deflate") {
-                zlib.deflate(data, (err, compressed) => callback({
+                node_zlib_1.default.deflate(data, (err, compressed) => callback({
                     compressed: !err ? compressed : data,
                     encoding: !err ? "deflate" : "identity",
                 }));
@@ -794,12 +938,14 @@ class HttpWsProtocol extends Protocol {
         });
     }
     httpUncompress(message, payload, cb) {
-        let encodings = message.headers["content-encoding"];
-        if (!encodings) {
+        const header = message.headers["content-encoding"];
+        if (!header) {
             cb(null, payload);
             return;
         }
-        encodings = encodings.split(",").map((e) => e.trim().toLowerCase());
+        // A separate name for the list: the JavaScript reassigned the header string
+        // to the array parsed out of it.
+        const encodings = header.split(",").map((e) => e.trim().toLowerCase());
         if (encodings.length > this.httpConfig.opts.maxEncodingLayers) {
             cb(kerrorHTTP.get("too_many_encodings"));
             return;
@@ -820,7 +966,7 @@ class HttpWsProtocol extends Protocol {
             this.httpUncompressStep(encodings, payload, cb, index + 1);
         }
         else if (encoding === "gzip" || encoding === "deflate") {
-            const fn = encoding === "gzip" ? zlib.gunzip : zlib.inflate;
+            const fn = encoding === "gzip" ? node_zlib_1.default.gunzip : node_zlib_1.default.inflate;
             fn(payload, (err, inflated) => {
                 if (err) {
                     cb(err);
@@ -840,7 +986,7 @@ class HttpWsProtocol extends Protocol {
             return { enabled: false };
         }
         let idleTimeout = cfg.idleTimeout;
-        const compression = cfg.compression ? uWS.SHARED_COMPRESSOR : uWS.DISABLED;
+        const compression = cfg.compression ? uWebSockets_js_1.default.SHARED_COMPRESSOR : uWebSockets_js_1.default.DISABLED;
         if (idleTimeout === 0 || idleTimeout < 1000) {
             idleTimeout = DEFAULT_IDLE_TIMEOUT;
             this.logger.warn(`[websocket] The "idleTimeout" parameter can neither be deactivated or be set with a value lower than 1000. Defaulted to ${DEFAULT_IDLE_TIMEOUT}.`);
@@ -872,16 +1018,17 @@ class HttpWsProtocol extends Protocol {
         }
         // precomputes default headers
         const httpCfg = global.kuzzle.config.http;
-        const headers = [
+        // uWS writes Buffers, and the raw name is kept in a third slot for the
+        // lookup that follows. Built as that triplet rather than rewritten into
+        // one in place: the loop read back the slots it was overwriting, so every
+        // row was `string | Buffer | undefined` to the compiler and the widened
+        // element type was the only thing holding the shape together.
+        const rawHeaders = [
             ["Access-Control-Allow-Headers", httpCfg.accessControlAllowHeaders],
             ["Access-Control-Allow-Methods", httpCfg.accessControlAllowMethods],
             ["Content-Type", "application/json"],
         ];
-        for (const header of headers) {
-            header[2] = header[0]; // Save the raw header name in the third slot
-            header[0] = Buffer.from(header[0]);
-            header[1] = Buffer.from(header[1]);
-        }
+        const headers = rawHeaders.map(([name, value]) => [Buffer.from(name), Buffer.from(value), name]);
         return {
             enabled: cfg.enabled,
             headers,
@@ -904,6 +1051,14 @@ class HttpWsProtocol extends Protocol {
  * @param {uWS.HttpRequest} request
  * @return {Array.<string>}
  */
+/**
+ * Collects a uWS request's headers, which are only reachable through `forEach`.
+ */
+function getRequestHeaders(request) {
+    const headers = {};
+    request.forEach((name, value) => (headers[name] = value));
+    return headers;
+}
 function getHttpIps(response, request) {
     const ips = [Buffer.from(response.getRemoteAddressAsText()).toString()];
     const forwardHeader = request.getHeader("x-forwarded-for");