kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/core/security/securityLoader.d.ts

@@ -1,24 +1,39 @@
-export = SecurityLoader;
+import type { JSONObject } from "../../types/JSONObject";
+import type { Logger } from "../../kuzzle/Logger";
+import "../../types/Global";
+/**
+ * A `{ _id: body }` map, as the security fixtures / import payloads express
+ * roles, profiles and users.
+ */
+type SecurityObjects = Record<string, JSONObject>;
+interface SecurityPermissions {
+    roles?: SecurityObjects;
+    profiles?: SecurityObjects;
+    users?: SecurityObjects;
+}
+/**
+ * How to react to users that already exist when importing.
+ */
+type OnExistingUsers = "fail" | "skip" | "overwrite";
+interface LoadOptions {
+    force?: boolean;
+    onExistingUsers?: OnExistingUsers;
+    onExistingUsersWarning?: boolean;
+    refresh?: string;
+    user?: JSONObject | null;
+}
 /**
  * @class SecurityLoader
  */
 declare class SecurityLoader {
-    logger: import("../../kuzzle/Logger").Logger;
+    logger: Logger;
+    constructor();
     init(): Promise<void>;
-    load(permissions?: {}, { force, onExistingUsers, onExistingUsersWarning, refresh, user, }?: {
-        force: any;
-        onExistingUsers?: string;
-        onExistingUsersWarning?: boolean;
-        refresh?: string;
-        user?: any;
-    }): Promise<void>;
-    _create(action: any, objects: any, collection: any, { force, refresh, user }?: {
-        force: any;
-        refresh: any;
-        user: any;
-    }): Promise<void>;
-    _getUsersToLoad(users: any, { onExistingUsers, warning }?: {
-        onExistingUsers: any;
-        warning: any;
-    }): Promise<any>;
+    load(permissions?: SecurityPermissions, { force, onExistingUsers, onExistingUsersWarning, refresh, user, }?: LoadOptions): Promise<void>;
+    _create(action: string, objects: SecurityObjects | undefined, collection: string, { force, refresh, user, }?: Pick<LoadOptions, "force" | "refresh" | "user">): Promise<void>;
+    _getUsersToLoad(users: SecurityObjects | undefined, { onExistingUsers, warning, }?: {
+        onExistingUsers?: OnExistingUsers;
+        warning?: boolean;
+    }): Promise<SecurityObjects | undefined>;
 }
+export = SecurityLoader;

package/dist/lib/core/security/securityLoader.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,12 +19,38 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const { isEmpty } = require("lodash");
-const Bluebird = require("bluebird");
-const { Request } = require("../../api/request");
-const { assertIsObject } = require("../../util/requestAssertions");
-const kerror = require("../../kerror");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const lodash_1 = require("lodash");
+const bluebird_1 = __importDefault(require("bluebird"));
+const request_1 = require("../../api/request");
+const requestAssertions_1 = require("../../util/requestAssertions");
+const kerror = __importStar(require("../../kerror"));
+require("../../types/Global");
 /**
  * @class SecurityLoader
  */
@@ -40,7 +67,7 @@ class SecurityLoader {
         global.kuzzle.onAsk("core:security:load", (json, opts) => this.load(json, opts));
     }
     async load(permissions = {}, { force, onExistingUsers = "fail", onExistingUsersWarning = false, refresh = "false", user = null, } = {}) {
-        assertIsObject(permissions);
+        (0, requestAssertions_1.assertIsObject)(permissions);
         await this._create("createOrReplaceRole", permissions.roles, "roles", {
             force,
             refresh,
@@ -53,15 +80,15 @@ class SecurityLoader {
         });
         await this._create("createUser", usersToLoad, "users", { refresh, user });
     }
-    async _create(action, objects, collection, { force, refresh, user } = {}) {
+    async _create(action, objects, collection, { force, refresh, user, } = {}) {
         if (!objects) {
             return;
         }
-        assertIsObject(objects);
+        (0, requestAssertions_1.assertIsObject)(objects);
         const promises = [];
         for (const [_id, body] of Object.entries(objects)) {
-            assertIsObject(body);
-            const request = new Request({
+            (0, requestAssertions_1.assertIsObject)(body);
+            const request = new request_1.Request({
                 _id,
                 action,
                 body,
@@ -71,15 +98,15 @@ class SecurityLoader {
             }, { user });
             promises.push(global.kuzzle.funnel.processRequest(request));
         }
-        await Bluebird.all(promises);
+        await bluebird_1.default.all(promises);
         await global.kuzzle.internalIndex.refreshCollection(collection);
     }
-    async _getUsersToLoad(users, { onExistingUsers, warning } = {}) {
-        if (isEmpty(users)) {
+    async _getUsersToLoad(users, { onExistingUsers, warning, } = {}) {
+        if ((0, lodash_1.isEmpty)(users)) {
             return users;
         }
         const ids = Object.keys(users);
-        const mGetUsers = new Request({
+        const mGetUsers = new request_1.Request({
             action: "mGetUsers",
             body: { ids },
             controller: "security",
@@ -107,7 +134,7 @@ class SecurityLoader {
             if (warning) {
                 this.logger.info(`Users overwritten during import: ${existingUserIds}`);
             }
-            const mDeleteUsers = new Request({
+            const mDeleteUsers = new request_1.Request({
                 action: "mDeleteUsers",
                 body: { ids: existingUserIds },
                 controller: "security",

package/dist/lib/core/security/tokenRepository.d.ts

@@ -1,6 +1,6 @@
-import { JSONObject } from "kuzzle-sdk";
+import type { JSONObject } from "../../types/JSONObject";
 import { Token } from "../../model/security/token";
-import { User } from "../../model/security/user";
+import type { User } from "../../model/security/user";
 import { ObjectRepository } from "../shared/ObjectRepository";
 export declare class TokenRepository extends ObjectRepository<Token> {
     private tokenGracePeriod;
@@ -45,17 +45,31 @@ export declare class TokenRepository extends ObjectRepository<Token> {
         ttl: number;
         singleUse: boolean;
     }): Promise<Token>;
+    /**
+     * Verifies a JWT's signature and answers its payload.
+     *
+     * Extracted from `verifyToken` unchanged: its three `catch` branches were
+     * most of that method's cognitive complexity, and none of them is about
+     * what the token then means.
+     */
+    private decodeToken;
+    /**
+     * `loadForUser`, with the wrapping every caller of `verifyToken` expects:
+     * an `UnauthorizedError` is the answer, anything else is a verification
+     * failure.
+     */
+    private loadVerifiedToken;
     verifyToken(token: string): Promise<Token>;
-    _verifyApiKey(decoded: any, token: string): Promise<Token>;
+    _verifyApiKey(decoded: JSONObject, token: string): Promise<Token>;
     removeTokenPrefix(token: string): string;
-    loadForUser(userId: string, encodedToken: string): Promise<Token>;
-    hydrate(userToken: any, data: any): Promise<any>;
-    serializeToDatabase(token: any): any;
+    loadForUser(userId: string, encodedToken: string): Promise<Token | null>;
+    hydrate(userToken: Token, data: JSONObject): Promise<Token>;
+    serializeToDatabase(token: Token): any;
     /**
      * Deletes tokens affiliated to the provided user identifier
      */
     deleteByKuid(kuid: string, { keepApiKeys }?: {
-        keepApiKeys?: boolean;
+        keepApiKeys?: boolean | undefined;
     }): Promise<void>;
     /**
      * The repository main class refreshes automatically the TTL

package/dist/lib/core/security/tokenRepository.js

@@ -57,6 +57,14 @@ const apiKey_1 = __importDefault(require("../../model/storage/apiKey"));
 const ObjectRepository_1 = require("../shared/ObjectRepository");
 const crypto_1 = require("../../util/crypto");
 const securityError = kerror.wrap("security", "token");
+/**
+ * The deprecated `security.jwt` section, which the `authToken` settings fall
+ * back to. The packaged defaults always ship it; the type says optional only
+ * because v2.56.0's did (see SecurityConfiguration.jwt).
+ */
+function legacyJwtConfig() {
+    return global.kuzzle.config.security.jwt; // NOSONAR: the deprecated section is read on purpose, as the documented fallback
+}
 class TokenRepository extends ObjectRepository_1.ObjectRepository {
     constructor(opts = {}) {
         super();
@@ -65,7 +73,7 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
         if (opts.ttl !== undefined) {
             this.ttl = opts.ttl;
         }
-        this.tokenGracePeriod = Math.floor(global.kuzzle.config.security.jwt.gracePeriod);
+        this.tokenGracePeriod = Math.floor(legacyJwtConfig().gracePeriod);
         this.anonymousToken = new token_1.Token({ userId: "-1" });
     }
     async init() {
@@ -130,7 +138,9 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
             }
             catch (e) {
                 // ? seed has changed
-                if (e.id === "security.token.invalid") {
+                if (e instanceof Error &&
+                    "id" in e &&
+                    e.id === "security.token.invalid") {
                     await global.kuzzle.ask("core:cache:internal:del", existingTokens);
                 }
             }
@@ -158,7 +168,7 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
             throw securityError.get("invalid");
         }
         // do not refresh API Keys or token that have an infinite TTL
-        if (token.type === "apiKey" || token.ttl < 0) {
+        if (token.type === "apiKey" || (token.ttl ?? 0) < 0) {
             throw securityError.get("refresh_forbidden", token.type === "apiKey" ? "API Key" : "Token with infinite TTL");
         }
         const refreshed = await this.generateToken(user, { expiresIn });
@@ -175,8 +185,8 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
      * @returns {Promise.<Object>} { _id, jwt, userId, ttl, expiresAt }
      */
     async generateToken(user, { algorithm = global.kuzzle.config.security.authToken.algorithm ??
-        global.kuzzle.config.security.jwt.algorithm, expiresIn = global.kuzzle.config.security.authToken.expiresIn ??
-        global.kuzzle.config.security.jwt.expiresIn, bypassMaxTTL = false, type = "authToken", singleUse = false, } = {}) {
+        legacyJwtConfig().algorithm, expiresIn = global.kuzzle.config.security.authToken.expiresIn ??
+        legacyJwtConfig().expiresIn, bypassMaxTTL = false, type = "authToken", singleUse = false, } = {}) {
         if (!user || user._id === null) {
             throw securityError.get("unknown_user");
         }
@@ -184,7 +194,7 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
         const maxTTL = type === "apiKey"
             ? global.kuzzle.config.security.apiKey.maxTTL
             : (global.kuzzle.config.security.authToken.maxTTL ??
-                global.kuzzle.config.security.jwt.maxTTL);
+                legacyJwtConfig().maxTTL);
         if (!bypassMaxTTL &&
             maxTTL > -1 &&
             (parsedExpiresIn > maxTTL || parsedExpiresIn === -1)) {
@@ -204,7 +214,7 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
             encodedToken = jsonwebtoken_1.default.sign({ _id: user._id }, global.kuzzle.secret, signOptions);
         }
         catch (err) {
-            throw securityError.getFrom(err, "generation_failed", err.message);
+            throw securityError.getFrom(err instanceof Error ? err : new Error(String(err)), "generation_failed", err instanceof Error ? err.message : String(err));
         }
         if (type === "apiKey") {
             encodedToken = token_1.Token.APIKEY_PREFIX + encodedToken;
@@ -247,22 +257,24 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
             return await this.persistToCache(token, { ttl: redisTTL });
         }
         catch (err) {
-            throw kerror.getFrom(err, "services", "cache", "write_failed", err.message);
+            throw kerror.getFrom(err instanceof Error ? err : new Error(String(err)), "services", "cache", "write_failed", err instanceof Error ? err.message : String(err));
         }
     }
-    async verifyToken(token) {
-        if (token === null) {
-            return this.anonymousToken;
-        }
-        const isApiKey = token.startsWith(token_1.Token.APIKEY_PREFIX);
-        const tokenWithoutPrefix = this.removeTokenPrefix(token);
-        let decoded = null;
+    /**
+     * Verifies a JWT's signature and answers its payload.
+     *
+     * Extracted from `verifyToken` unchanged: its three `catch` branches were
+     * most of that method's cognitive complexity, and none of them is about
+     * what the token then means.
+     */
+    decodeToken(tokenWithoutPrefix) {
         try {
-            decoded = jsonwebtoken_1.default.verify(tokenWithoutPrefix, global.kuzzle.secret);
+            const decoded = jsonwebtoken_1.default.verify(tokenWithoutPrefix, global.kuzzle.secret);
             // probably forged token => throw without providing any information
             if (!decoded._id) {
                 throw new jsonwebtoken_1.default.JsonWebTokenError("Invalid token");
             }
+            return decoded;
         }
         catch (err) {
             if (err instanceof jsonwebtoken_1.default.JsonWebTokenError) {
@@ -271,21 +283,36 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
             if (err instanceof jsonwebtoken_1.default.TokenExpiredError) {
                 throw securityError.get("expired");
             }
-            throw securityError.getFrom(err, "verification_error", err.message);
-        }
-        if (isApiKey) {
-            return this._verifyApiKey(decoded, token);
+            throw securityError.getFrom(err instanceof Error ? err : new Error(String(err)), "verification_error", err instanceof Error ? err.message : String(err));
         }
-        let userToken;
+    }
+    /**
+     * `loadForUser`, with the wrapping every caller of `verifyToken` expects:
+     * an `UnauthorizedError` is the answer, anything else is a verification
+     * failure.
+     */
+    async loadVerifiedToken(userId, token) {
         try {
-            userToken = await this.loadForUser(decoded._id, token);
+            return await this.loadForUser(userId, token);
         }
         catch (err) {
             if (err instanceof errors_1.UnauthorizedError) {
                 throw err;
             }
-            throw securityError.getFrom(err, "verification_error", err.message);
+            throw securityError.getFrom(err instanceof Error ? err : new Error(String(err)), "verification_error", err instanceof Error ? err.message : String(err));
+        }
+    }
+    async verifyToken(token) {
+        if (token === null) {
+            return this.anonymousToken;
+        }
+        const isApiKey = token.startsWith(token_1.Token.APIKEY_PREFIX);
+        const tokenWithoutPrefix = this.removeTokenPrefix(token);
+        const decoded = this.decodeToken(tokenWithoutPrefix);
+        if (isApiKey) {
+            return this._verifyApiKey(decoded, token);
         }
+        const userToken = await this.loadVerifiedToken(decoded._id, token);
         if (userToken === null) {
             throw securityError.get("invalid");
         }

package/dist/lib/core/security/userRepository.d.ts

@@ -1,17 +1,46 @@
-export = UserRepository;
+import type { JSONObject } from "../../types/JSONObject";
+import { ObjectRepository } from "../shared/ObjectRepository";
+import { User } from "../../model/security/user";
+import "../../types/Global";
+import type { ProfileRepository } from "./profileRepository";
+import type { TokenRepository } from "./tokenRepository";
+interface SecurityModule {
+    profile: ProfileRepository;
+    token: TokenRepository;
+}
+/**
+ * Who is performing the write, and how eagerly the change must be visible.
+ * `userId` ends up in `_kuzzle_info.author`.
+ */
+interface WriteOptions {
+    userId?: string | null;
+    refresh?: string;
+    retryOnConflict?: number;
+}
+/**
+ * Per-backend options forwarded to `ObjectRepository.persistToDatabase` and
+ * `persistToCache`.
+ */
+interface PersistOptions {
+    database?: JSONObject;
+    cache?: JSONObject;
+}
 /**
  * @class UserRepository
  * @extends ObjectRepository
  */
-declare class UserRepository extends ObjectRepository<any> {
+declare class UserRepository extends ObjectRepository<User> {
+    protected module: SecurityModule;
+    /**
+     * Built by `init()` and read nowhere before it — the `null` the constructor
+     * used to write was never observed. See ADR-0001, TD-62.
+     */
+    anonymousUser: User;
     /**
      * @param {SecurityModule} securityModule
      * @constructor
      */
     constructor(securityModule: SecurityModule);
-    module: SecurityModule;
-    ObjectConstructor: typeof User;
-    anonymousUser: User;
     init(): Promise<void>;
     /**
      * Creates a user
@@ -20,7 +49,7 @@ declare class UserRepository extends ObjectRepository<any> {
      * @param {Object} content
      * @param {Object} [opts]
      */
-    create(id: string, profileIds: any[], content: any, { userId, refresh }?: any): Promise<any>;
+    create(id: string, profileIds: string[], content: JSONObject, { userId, refresh }?: WriteOptions): Promise<User>;
     /**
      * Updates a user's content
      * @param  {String} id
@@ -29,7 +58,7 @@ declare class UserRepository extends ObjectRepository<any> {
      * @param  {Object} [opts]
      * @returns {Promise}
      */
-    update(id: string, profileIds: any[], content: any, { refresh, retryOnConflict, userId }?: any): Promise<any>;
+    update(id: string, profileIds: string[], content: JSONObject, { refresh, retryOnConflict, userId }?: WriteOptions): Promise<User>;
     /**
      * Replaces a user's content
      * @param  {String} id
@@ -37,10 +66,7 @@ declare class UserRepository extends ObjectRepository<any> {
      * @param  {Object} [opts]
      * @returns {Promise}
      */
-    replace(id: string, profileIds: any, content: any, { refresh, userId }?: {
-        refresh?: string;
-        userId: any;
-    }): Promise<any>;
+    replace(id: string, profileIds: string[], content: JSONObject, { refresh, userId }?: WriteOptions): Promise<User>;
     /**
      * Loads a user
      *
@@ -49,12 +75,12 @@ declare class UserRepository extends ObjectRepository<any> {
      * @throws {NotFoundError} If the user is not found
      */
     load(id: string): Promise<User>;
-    persist(user: any, options?: {}): Promise<any>;
+    persist(user: User, options?: PersistOptions): Promise<User>;
     /**
      * @param dto
      * @returns {Promise<User>}
      */
-    fromDTO(dto: any): Promise<User>;
+    fromDTO(dto: JSONObject): Promise<User>;
     /**
      * Deletes a user from memory and database, along with its related tokens and
      * strategies.
@@ -63,19 +89,16 @@ declare class UserRepository extends ObjectRepository<any> {
      * @param {Object} [options]
      * @returns {Promise}
      */
-    deleteById(id: string, opts: any): Promise<any>;
+    deleteById(id: string, opts?: JSONObject): Promise<void>;
     /**
      * @override
      */
-    override delete(user: any, { refresh }?: {
-        refresh?: string;
-    }): Promise<void>;
-    _removeUserStrategies(user: any): Promise<void>;
+    delete(user: User, { refresh }?: WriteOptions): Promise<void>;
+    _removeUserStrategies(user: User): Promise<void>;
     /**
      * @override
      */
-    override loadOneFromDatabase(id: any): Promise<any>;
+    loadOneFromDatabase(id: string): Promise<User>;
     adminExists(): Promise<boolean>;
 }
-import { ObjectRepository } from "../shared/ObjectRepository";
-import { User } from "../../model/security/user";
+export = UserRepository;

package/dist/lib/core/security/userRepository.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,18 +19,45 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const { Request } = require("../../api/request");
-const debug = require("../../util/debug")("kuzzle:core:security:users");
-const { ObjectRepository } = require("../shared/ObjectRepository");
-const kerror = require("../../kerror");
-const { User } = require("../../model/security/user");
-const ApiKey = require("../../model/storage/apiKey");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const request_1 = require("../../api/request");
+const debug_1 = __importDefault(require("../../util/debug"));
+const debug = (0, debug_1.default)("kuzzle:core:security:users");
+const ObjectRepository_1 = require("../shared/ObjectRepository");
+const kerror = __importStar(require("../../kerror"));
+const user_1 = require("../../model/security/user");
+const apiKey_1 = __importDefault(require("../../model/storage/apiKey"));
+require("../../types/Global");
 /**
  * @class UserRepository
  * @extends ObjectRepository
  */
-class UserRepository extends ObjectRepository {
+class UserRepository extends ObjectRepository_1.ObjectRepository {
     /**
      * @param {SecurityModule} securityModule
      * @constructor
@@ -38,8 +66,7 @@ class UserRepository extends ObjectRepository {
         super({ store: global.kuzzle.internalIndex });
         this.module = securityModule;
         this.collection = "users";
-        this.ObjectConstructor = User;
-        this.anonymousUser = null;
+        this.ObjectConstructor = user_1.User;
     }
     async init() {
         this.anonymousUser = await this.fromDTO({
@@ -153,7 +180,9 @@ class UserRepository extends ObjectRepository {
             });
         }
         catch (error) {
-            if (error.id === "services.storage.document_already_exists") {
+            if (error instanceof Error &&
+                "id" in error &&
+                error.id === "services.storage.document_already_exists") {
                 throw kerror.get("security", "user", "already_exists", id);
             }
             throw error;
@@ -231,13 +260,20 @@ class UserRepository extends ObjectRepository {
         if (id === "anonymous" || id === "-1") {
             return this.anonymousUser;
         }
-        return super.load(id);
+        const user = await super.load(id);
+        // The base resolves `null` for a user it could not build; `fromDTO` and
+        // `loadOneFromDatabase` both already turn that into a not_found, so this
+        // is the same answer stated where the return type can see it.
+        if (user === null) {
+            throw kerror.get("security", "user", "not_found", id);
+        }
+        return user;
     }
     async persist(user, options = {}) {
         const databaseOptions = options.database || {};
         const cacheOptions = options.cache || {};
         if (user._id === this.anonymousUser._id &&
-            user.profileIds.indexOf("anonymous") === -1) {
+            !user.profileIds.includes("anonymous")) {
             throw kerror.get("security", "user", "anonymous_profile_required");
         }
         await this.persistToDatabase(user, databaseOptions);
@@ -263,7 +299,7 @@ class UserRepository extends ObjectRepository {
         }
         const profiles = await this.module.profile.loadProfiles(user.profileIds);
         // Fail if not all profiles are found
-        if (profiles.some((p) => p === null)) {
+        if (profiles.some((profile) => !profile)) {
             throw kerror.get("security", "user", "cannot_hydrate", dto._id);
         }
         return user;
@@ -286,14 +322,14 @@ class UserRepository extends ObjectRepository {
     async delete(user, { refresh = "false" } = {}) {
         debug("Delete user: %s", user);
         await this._removeUserStrategies(user);
-        await ApiKey.deleteByUser(user, { refresh });
-        await this.module.token.deleteByKuid(user._id);
+        await apiKey_1.default.deleteByUser(user, { refresh });
+        await this.module.token.deleteByKuid(this.idOf(user));
         await super.delete(user, { refresh });
     }
     async _removeUserStrategies(user) {
         const availableStrategies = global.kuzzle.pluginsManager.listStrategies();
         const userStrategies = [];
-        const request = new Request({ _id: user._id });
+        const request = new request_1.Request({ _id: user._id });
         for (const strategy of availableStrategies) {
             const existStrategy = global.kuzzle.pluginsManager.getStrategyMethod(strategy, "exists");
             if (await existStrategy(request, user._id, strategy)) {
@@ -324,10 +360,14 @@ class UserRepository extends ObjectRepository {
      */
     async loadOneFromDatabase(id) {
         try {
-            return await super.loadOneFromDatabase(id);
+            const user = await super.loadOneFromDatabase(id);
+            if (user === null) {
+                throw kerror.get("security", "user", "not_found", id);
+            }
+            return user;
         }
         catch (err) {
-            if (err.status === 404) {
+            if (err instanceof Error && "status" in err && err.status === 404) {
                 throw kerror.get("security", "user", "not_found", id);
             }
             throw err;

package/dist/lib/core/shared/KoncordeWrapper.d.ts

@@ -1,4 +1,4 @@
-import { JSONObject } from "kuzzle-sdk";
+import type { JSONObject } from "../../types/JSONObject";
 /**
  * Emulates the normalized object returned by Koncorde v3
  */