kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/core/security/profileRepository.d.ts

@@ -1,12 +1,27 @@
-import { JSONObject } from "kuzzle-sdk";
+import type { JSONObject } from "../../types/JSONObject";
 import { Profile } from "../../model/security/profile";
 import { ObjectRepository } from "../shared/ObjectRepository";
 /** @internal */
+/**
+ * The two sibling repositories this one reaches through, the same shape
+ * `UserRepository` declares for its own side of the module.
+ */
+interface SecurityModule {
+    role: {
+        loadRoles(ids: string[]): Promise<unknown[]>;
+    };
+    user: {
+        scroll(scrollId: string, ttl?: string): Promise<JSONObject>;
+        search(query: JSONObject, options?: JSONObject): Promise<JSONObject>;
+        update(id: string | null, profileIds: string[], content: JSONObject, options: JSONObject): Promise<unknown>;
+    };
+}
+/** @internal */
 type CreateOrReplaceOptions = {
     method?: string;
     refresh?: string;
     strict?: boolean;
-    userId?: string;
+    userId?: string | null;
 };
 /** @internal */
 type ValidateAndSaveProfileOptions = {
@@ -27,11 +42,11 @@ type UpdateOptions = {
  * @extends ObjectRepository
  */
 export declare class ProfileRepository extends ObjectRepository<Profile> {
-    private module;
+    private readonly module;
     /**
      * @constructor
      */
-    constructor(securityModule: any);
+    constructor(securityModule: SecurityModule);
     init(): void;
     /**
      * Loads a Profile
@@ -109,9 +124,9 @@ export declare class ProfileRepository extends ObjectRepository<Profile> {
      * @override
      */
     delete(profile: Profile, { refresh, onAssignedUsers, userId }?: {
-        refresh?: string;
-        onAssignedUsers?: string;
-        userId?: string;
+        refresh?: string | undefined;
+        onAssignedUsers?: string | undefined;
+        userId?: string | undefined;
     }): Promise<void>;
     /**
      * From a Profile object, returns a serialized object ready to be persisted
@@ -160,17 +175,7 @@ export declare class ProfileRepository extends ObjectRepository<Profile> {
     private optimizePolicy;
     toDTO(dto: Profile): JSONObject;
     deleteFromDatabase(id: string, options: JSONObject): any;
-    search(searchBody: JSONObject, options: JSONObject): Promise<{
-        aggregations: any;
-        hits: any[];
-        scrollId: any;
-        total: any;
-    }>;
-    scroll(id: string, ttl: number): Promise<{
-        aggregations: any;
-        hits: any[];
-        scrollId: any;
-        total: any;
-    }>;
+    search(searchBody: JSONObject, options: JSONObject): Promise<import("../shared/ObjectRepository").ObjectRepositorySearchAnswer>;
+    scroll(id: string, ttl: number): Promise<import("../shared/ObjectRepository").ObjectRepositorySearchAnswer>;
 }
 export {};

package/dist/lib/core/security/profileRepository.js

@@ -195,10 +195,16 @@ class ProfileRepository extends ObjectRepository_1.ObjectRepository {
      */
     async loadOneFromDatabase(id) {
         try {
-            return await super.loadOneFromDatabase(id);
+            const profile = await super.loadOneFromDatabase(id);
+            // The base resolves `null` for a document with no `_id`; for a profile
+            // that is the same "not found" as a 404.
+            if (profile === null) {
+                throw kerror.get("security", "profile", "not_found", id);
+            }
+            return profile;
         }
         catch (err) {
-            if (err.status === 404) {
+            if (err instanceof Error && "status" in err && err.status === 404) {
                 throw kerror.get("security", "profile", "not_found", id);
             }
             throw err;
@@ -297,7 +303,7 @@ class ProfileRepository extends ObjectRepository_1.ObjectRepository {
      * @override
      */
     async delete(profile, { refresh = "false", onAssignedUsers = "fail", userId = "-1" } = {}) {
-        if (["admin", "default", "anonymous"].includes(profile._id)) {
+        if (["admin", "default", "anonymous"].includes(this.idOf(profile))) {
             throw kerror.get("security", "profile", "cannot_delete");
         }
         const query = {
@@ -334,8 +340,9 @@ class ProfileRepository extends ObjectRepository_1.ObjectRepository {
                 throw kerror.get("security", "profile", "in_use");
             }
         }
-        await this.deleteFromDatabase(profile._id, { refresh });
-        await this.deleteFromCache(profile._id);
+        const profileId = this.idOf(profile);
+        await this.deleteFromDatabase(profileId, { refresh });
+        await this.deleteFromCache(profileId);
     }
     /**
      * From a Profile object, returns a serialized object ready to be persisted
@@ -370,13 +377,15 @@ class ProfileRepository extends ObjectRepository_1.ObjectRepository {
             policiesRoles.indexOf("anonymous") === -1) {
             throw kerror.get("security", "profile", "missing_anonymous_role");
         }
-        profile.optimizedPolicies = undefined; // Remove optimized policies
+        // Remove optimized policies. `undefined!`: declared as always present,
+        // see Profile.optimizedPolicies.
+        profile.optimizedPolicies = undefined;
         await super.persistToDatabase(profile, {
             method,
             refresh,
             retryOnConflict,
         });
-        const updatedProfile = await this.loadOneFromDatabase(profile._id);
+        const updatedProfile = await this.loadOneFromDatabase(this.idOf(profile));
         await this.persistToCache(updatedProfile);
         // Recompute optimized policies based on new policies
         updatedProfile.optimizedPolicies = this.optimizePolicies(updatedProfile.policies);
@@ -392,13 +401,17 @@ class ProfileRepository extends ObjectRepository_1.ObjectRepository {
         if (!profile.policies || profile.policies.length === 0) {
             profile.policies = [{ roleId: "default" }];
         }
-        if (profile.constructor._hash("") === false) {
-            profile.constructor._hash = (obj) => global.kuzzle.hash(obj);
+        // `Profile._hash` ships as a stub returning `false`; that return value is
+        // the probe for "not patched yet". Typed through `typeof Profile` rather
+        // than `any`, which is what the overload declared on the stub is for.
+        const profileClass = profile.constructor;
+        if (profileClass._hash("") === false) {
+            profileClass._hash = (obj) => global.kuzzle.hash(obj);
         }
         const policiesRoles = profile.policies.map((p) => p.roleId);
         const roles = await this.module.role.loadRoles(policiesRoles);
         // Fail if not all roles are found
-        if (roles.some((r) => r === null)) {
+        if (roles.some((role) => !role)) {
             throw kerror.get("security", "profile", "cannot_hydrate");
         }
         return profile;

package/dist/lib/core/security/roleRepository.d.ts

@@ -1,18 +1,40 @@
-export = RoleRepository;
+import { Role } from "../../model/security/role";
+import { ObjectRepository } from "../shared/ObjectRepository";
+import type { JSONObject } from "../../types/JSONObject";
+import type { Logger } from "../../kuzzle/Logger";
+import "../../types/Global";
+import type { ProfileRepository } from "./profileRepository";
+interface SecurityModule {
+    profile: ProfileRepository;
+}
+/**
+ * Who is performing the write, and how eagerly the change must be visible.
+ */
+interface WriteOptions {
+    force?: boolean;
+    method?: string;
+    refresh?: string;
+    retryOnConflict?: number;
+    userId?: string | null;
+}
 /**
  * @class RoleRepository
  * @extends ObjectRepository
  */
-declare class RoleRepository extends ObjectRepository<any> {
+declare class RoleRepository extends ObjectRepository<Role> {
+    protected module: SecurityModule;
+    /**
+     * Role cache. It holds an in-flight `Promise<Role>` while a role is being
+     * loaded (see `loadRoles`), which is what de-duplicates concurrent loads —
+     * hence the union rather than plain `Role`.
+     */
+    roles: Map<string, Role | Promise<Role>>;
+    logger: Logger;
     /**
      * @constructor
      * @param {SecurityModule} securityModule
      */
     constructor(securityModule: SecurityModule);
-    module: SecurityModule;
-    ObjectConstructor: typeof Role;
-    roles: Map<any, any>;
-    logger: import("../../kuzzle/Logger").Logger;
     init(): void;
     /**
      * From a list of role ids, retrieves the matching Role objects.
@@ -21,7 +43,7 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {Object} options - resetCache (false)
      * @returns {Promise.<Array.<Role>>}
      */
-    loadRoles(ids: any[]): Promise<Array<Role>>;
+    loadRoles(ids: string[]): Promise<Role[]>;
     /**
      * Creates a new role, or create/replace a role
      *
@@ -30,7 +52,7 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {Object} [opts]
      * @returns {Role}
      */
-    _createOrReplace(id: string, content: any, { force, method, refresh, userId }?: any): Role;
+    _createOrReplace(id: string, content: JSONObject, { force, method, refresh, userId, }?: WriteOptions): Promise<Role>;
     /**
      * Creates a new role
      *
@@ -39,7 +61,7 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {Object} [opts]
      * @returns {Role}
      */
-    create(id: string, content: any, opts?: any): Role;
+    create(id: string, content: JSONObject, opts?: WriteOptions): Promise<Role>;
     /**
      * Creates or replaces a role
      *
@@ -48,7 +70,7 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {Object} [opts]
      * @returns {Role}
      */
-    createOrReplace(id: string, content: any, opts?: any): Role;
+    createOrReplace(id: string, content: JSONObject, opts?: WriteOptions): Promise<Role>;
     /**
      * Updates a role (replaces the entire content)
      *
@@ -60,7 +82,7 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param  {Object} [opts]
      * @returns {Promise}
      */
-    update(id: string, content: any, { force, refresh, retryOnConflict, userId }?: any): Promise<any>;
+    update(id: string, content: JSONObject, { force, refresh, retryOnConflict, userId }?: WriteOptions): Promise<Role>;
     /**
      * Get from database the document that represent the role given in parameter
      *
@@ -72,12 +94,15 @@ declare class RoleRepository extends ObjectRepository<any> {
     /**
      * @override
      */
-    override loadOneFromDatabase(id: any): Promise<any>;
+    loadOneFromDatabase(id: string): Promise<Role>;
     /**
      * @param {Object} body Search body containing either "query" or "controllers"
      * @param {Object} options
      */
-    searchRole(body: any, { from, size }?: any): Promise<{
+    searchRole(body: JSONObject, { from, size }?: {
+        from?: number;
+        size?: number;
+    }): Promise<{
         hits: any[];
         total: any;
     }>;
@@ -88,7 +113,7 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {object} [options] The persistence options
      * @returns Promise
      */
-    validateAndSaveRole(role: Role, options?: object): Promise<any>;
+    validateAndSaveRole(role: Role, options?: WriteOptions): Promise<Role>;
     /**
      * Given a Role object, checks if its controllers and actions exist.
      *
@@ -101,7 +126,22 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {Role} role
      * @param {Force} force
      */
-    checkRolePluginsRights(role: Role, { force, forceWarn }?: Force): void;
+    checkRolePluginsRights(role: Role, { force, forceWarn, }?: {
+        force?: boolean;
+        forceWarn?: boolean;
+    }): void;
+    /**
+     * Verifies that a plugin controller referenced by a role exists. Extracted
+     * from `checkRolePluginsRights` verbatim.
+     *
+     * @returns whether the caller should keep inspecting that controller
+     */
+    private _checkPluginController;
+    /**
+     * Verifies every action a role grants on a plugin controller. Extracted from
+     * `checkRolePluginsRights` verbatim.
+     */
+    private _checkPluginActions;
     /**
      * Fetching roles and check for each of them for invalid plugin rights.
      * If there are some, Kuzzle will log a warning.
@@ -114,24 +154,22 @@ declare class RoleRepository extends ObjectRepository<any> {
      * @param {object} [options]
      * @returns Promise
      */
-    deleteById(id: string, options?: object): Promise<void>;
+    deleteById(id: string, options?: JSONObject): Promise<void>;
     /**
      * @override
      */
-    override delete(role: any, { refresh }?: {
-        refresh?: string;
-    }): Promise<void>;
+    delete(role: Role, { refresh }?: WriteOptions): Promise<void>;
     /**
      * From a Role object, returns an object ready to be persisted
      *
      * @param {Role} role
      * @returns {object}
      */
-    serializeToDatabase(role: Role): object;
+    serializeToDatabase(role: Role): JSONObject;
     /**
      * @override
      */
-    override truncate(opts: any): Promise<void>;
+    truncate(opts: JSONObject): Promise<number>;
     /**
      * Invalidate the cache entries for the given role. If none is provided,
      * the entire cache is emptied.
@@ -139,5 +177,4 @@ declare class RoleRepository extends ObjectRepository<any> {
      */
     invalidate(roleId?: string): void;
 }
-import { ObjectRepository } from "../shared/ObjectRepository";
-import { Role } from "../../model/security/role";
+export = RoleRepository;

package/dist/lib/core/security/roleRepository.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,32 +19,58 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const Bluebird = require("bluebird");
-const kuzzleStateEnum = require("../../kuzzle/kuzzleStateEnum");
-const { Role } = require("../../model/security/role");
-const { ObjectRepository } = require("../shared/ObjectRepository");
-const kerror = require("../../kerror");
-const didYouMean = require("../../util/didYouMean");
-const { cacheDbEnum } = require("../cache/cacheDbEnum");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const bluebird_1 = __importDefault(require("bluebird"));
+const kuzzleStateEnum_1 = __importDefault(require("../../kuzzle/kuzzleStateEnum"));
+const role_1 = require("../../model/security/role");
+const ObjectRepository_1 = require("../shared/ObjectRepository");
+const kerror = __importStar(require("../../kerror"));
+const didYouMean_1 = __importDefault(require("../../util/didYouMean"));
+const cacheDbEnum_1 = require("../cache/cacheDbEnum");
+require("../../types/Global");
 const roleRightsError = kerror.wrap("security", "role");
 /**
  * @class RoleRepository
  * @extends ObjectRepository
  */
-class RoleRepository extends ObjectRepository {
+class RoleRepository extends ObjectRepository_1.ObjectRepository {
     /**
      * @constructor
      * @param {SecurityModule} securityModule
      */
     constructor(securityModule) {
         super({
-            cache: cacheDbEnum.INTERNAL,
+            cache: cacheDbEnum_1.cacheDbEnum.INTERNAL,
             store: global.kuzzle.internalIndex,
         });
         this.module = securityModule;
         this.collection = "roles";
-        this.ObjectConstructor = Role;
+        this.ObjectConstructor = role_1.Role;
         this.roles = new Map();
         this.logger = global.kuzzle.log.child("core:security:roleRepository");
     }
@@ -142,7 +169,7 @@ class RoleRepository extends ObjectRepository {
             }
             roles.push(role);
         }
-        return Bluebird.all(roles);
+        return bluebird_1.default.all(roles);
     }
     /**
      * Creates a new role, or create/replace a role
@@ -152,7 +179,7 @@ class RoleRepository extends ObjectRepository {
      * @param {Object} [opts]
      * @returns {Role}
      */
-    async _createOrReplace(id, content, { force = false, method, refresh = "false", userId = null } = {}) {
+    async _createOrReplace(id, content, { force = false, method, refresh = "false", userId = null, } = {}) {
         const dto = {
             ...content,
             // Always last, in case content contains these keys
@@ -232,11 +259,12 @@ class RoleRepository extends ObjectRepository {
      * @throws {NotFoundError} If the corresponding role doesn't exist
      */
     async load(id) {
-        if (this.roles.has(id)) {
-            return this.roles.get(id);
+        const cached = this.roles.get(id);
+        if (cached !== undefined) {
+            return cached;
         }
         const role = await this.loadOneFromDatabase(id);
-        await this.roles.set(role._id, role);
+        this.roles.set(role._id, role);
         return role;
     }
     /**
@@ -244,10 +272,16 @@ class RoleRepository extends ObjectRepository {
      */
     async loadOneFromDatabase(id) {
         try {
-            return await super.loadOneFromDatabase(id);
+            const role = await super.loadOneFromDatabase(id);
+            // The base resolves `null` for a document with no `_id`; a role always
+            // has one, and its absence is the same "not found" as a 404.
+            if (role === null) {
+                throw kerror.get("security", "role", "not_found", id);
+            }
+            return role;
         }
         catch (err) {
-            if (err.status === 404) {
+            if (err instanceof Error && "status" in err && err.status === 404) {
                 throw kerror.get("security", "role", "not_found", id);
             }
             throw err;
@@ -289,7 +323,7 @@ class RoleRepository extends ObjectRepository {
         this.checkRolePluginsRights(role, options);
         await this.persistToDatabase(role, options);
         const updatedRole = await this.loadOneFromDatabase(role._id);
-        await this.roles.set(role._id, updatedRole);
+        this.roles.set(role._id, updatedRole);
         return updatedRole;
     }
     /**
@@ -303,8 +337,12 @@ class RoleRepository extends ObjectRepository {
                 !global.kuzzle.funnel.isNativeController(roleController)) {
                 return;
             }
+            const roleControllerRights = role.controllers[roleController];
+            if (roleControllerRights === undefined) {
+                return;
+            }
             if (roleController === "*") {
-                Object.keys(role.controllers["*"].actions).forEach((action) => {
+                Object.keys(roleControllerRights.actions ?? {}).forEach((action) => {
                     if (action !== "*") {
                         throw roleRightsError.get("unknown_action", role._id, action, "*");
                     }
@@ -312,10 +350,16 @@ class RoleRepository extends ObjectRepository {
             }
             else {
                 const controller = global.kuzzle.funnel.controllers.get(roleController);
-                const actions = Object.keys(role.controllers[roleController].actions);
+                const actions = Object.keys(roleControllerRights.actions ?? {});
                 actions.forEach((action) => {
-                    if (action !== "*" && !controller._isAction(action)) {
-                        throw roleRightsError.get("unknown_action", role._id, action, roleController, didYouMean(action, controller.__actions));
+                    if (action !== "*" &&
+                        controller !== undefined &&
+                        !controller._isAction(action)) {
+                        throw roleRightsError.get("unknown_action", role._id, action, roleController, 
+                        // `_actions` is a Set. didyoumean@1.2.1 walks `list.length`,
+                        // which a Set does not have, so this suggestion had always been
+                        // empty — the new declaration for the module is what said so.
+                        (0, didYouMean_1.default)(action, Array.from(controller?._actions ?? [])));
                     }
                 });
             }
@@ -327,38 +371,59 @@ class RoleRepository extends ObjectRepository {
      * @param {Role} role
      * @param {Force} force
      */
-    checkRolePluginsRights(role, { force = false, forceWarn = false } = {}) {
-        const plugins = global.kuzzle.pluginsManager;
+    checkRolePluginsRights(role, { force = false, forceWarn = false, } = {}) {
         for (const roleController of Object.keys(role.controllers)) {
             if (roleController === "*" ||
                 global.kuzzle.funnel.isNativeController(roleController)) {
                 return;
             }
-            if (!plugins.isController(roleController)) {
-                if (!force) {
-                    throw roleRightsError.get("unknown_controller", role._id, roleController, didYouMean(roleController, plugins.getControllerNames()));
-                }
-                // Do not print any warning if Kuzzle is not started or if warn is not forced.
-                // We need this to load rights without displaying warning at startup
-                // because plugins controllers are loaded after default roles
-                // then we need to display non-existing controllers with the sanity check
-                // made after plugins controllers loading.
-                if (global.kuzzle.state === kuzzleStateEnum.RUNNING || forceWarn) {
-                    this.logger.warn(`The role "${role._id}" gives access to the non-existing controller "${roleController}".`);
-                }
+            if (!this._checkPluginController(role, roleController, { force, forceWarn })) {
                 return;
             }
-            const roleActions = Object.keys(role.controllers[roleController].actions);
-            for (const action of roleActions) {
-                if (action !== "*" && !plugins.isAction(roleController, action)) {
-                    if (!force) {
-                        throw roleRightsError.get("unknown_action", role._id, action, roleController, didYouMean(action, plugins.getActions(roleController)));
-                    }
-                    // see the other comment
-                    if (global.kuzzle.state === kuzzleStateEnum.RUNNING || forceWarn) {
-                        this.logger.warn(`The role "${role._id}" gives access to the non-existing action "${action}" for the controller "${roleController}".`);
-                    }
-                }
+            this._checkPluginActions(role, roleController, { force, forceWarn });
+        }
+    }
+    /**
+     * Verifies that a plugin controller referenced by a role exists. Extracted
+     * from `checkRolePluginsRights` verbatim.
+     *
+     * @returns whether the caller should keep inspecting that controller
+     */
+    _checkPluginController(role, roleController, { force, forceWarn }) {
+        const plugins = global.kuzzle.pluginsManager;
+        if (plugins.isController(roleController)) {
+            return true;
+        }
+        if (!force) {
+            throw roleRightsError.get("unknown_controller", role._id, roleController, (0, didYouMean_1.default)(roleController, plugins.getControllerNames()));
+        }
+        // Do not print any warning if Kuzzle is not started or if warn is not forced.
+        // We need this to load rights without displaying warning at startup
+        // because plugins controllers are loaded after default roles
+        // then we need to display non-existing controllers with the sanity check
+        // made after plugins controllers loading.
+        if (global.kuzzle.state === kuzzleStateEnum_1.default.RUNNING || forceWarn) {
+            this.logger.warn(`The role "${role._id}" gives access to the non-existing controller "${roleController}".`);
+        }
+        return false;
+    }
+    /**
+     * Verifies every action a role grants on a plugin controller. Extracted from
+     * `checkRolePluginsRights` verbatim.
+     */
+    _checkPluginActions(role, roleController, { force, forceWarn }) {
+        const plugins = global.kuzzle.pluginsManager;
+        const roleActions = Object.keys(role.controllers[roleController]?.actions ?? {});
+        for (const action of roleActions) {
+            if (action === "*" || plugins.isAction(roleController, action)) {
+                continue;
+            }
+            if (!force) {
+                throw roleRightsError.get("unknown_action", role._id, action, roleController, (0, didYouMean_1.default)(action, plugins.getActions(roleController)));
+            }
+            // see the other comment
+            if (global.kuzzle.state === kuzzleStateEnum_1.default.RUNNING || forceWarn) {
+                this.logger.warn(`The role "${role._id}" gives access to the non-existing action "${action}" for the controller "${roleController}".`);
             }
         }
     }
@@ -387,7 +452,7 @@ class RoleRepository extends ObjectRepository {
      * @override
      */
     async delete(role, { refresh = "false" } = {}) {
-        if (["admin", "default", "anonymous"].indexOf(role._id) > -1) {
+        if (["admin", "default", "anonymous"].includes(role._id)) {
             throw kerror.get("security", "role", "cannot_delete");
         }
         const query = { term: { "policies.roleId": role._id } };
@@ -409,11 +474,11 @@ class RoleRepository extends ObjectRepository {
      */
     serializeToDatabase(role) {
         const serializedRole = {};
-        Object.keys(role).forEach((key) => {
+        for (const [key, value] of Object.entries(role)) {
             if (key !== "_id" && key !== "restrictedTo") {
-                serializedRole[key] = role[key];
+                serializedRole[key] = value;
             }
-        });
+        }
         return serializedRole;
     }
     /**
@@ -421,7 +486,11 @@ class RoleRepository extends ObjectRepository {
      */
     async truncate(opts) {
         try {
-            await super.truncate(opts);
+            // `return await`, not `await` then fall through: the base answers the
+            // number of deleted roles and this override used to drop it, which is
+            // why `admin:resetSecurity` reported `deletedRoles: undefined` next to
+            // two real counts.
+            return await super.truncate(opts);
         }
         finally {
             this.invalidate();