kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/core/validation/validation.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,120 +19,263 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const Bluebird = require("bluebird");
-const _ = require("lodash");
-const { Koncorde } = require("koncorde");
-const debug = require("../../util/debug")("core:validation");
-const kerror = require("../../kerror");
-const { KuzzleError } = require("../../kerror/errors");
-const { has, isPlainObject, get } = require("../../util/safeObject");
-const { koncordeTest, toKoncordeIndex } = require("../../util/koncordeCompat");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_util_1 = require("node:util");
+const bluebird_1 = __importDefault(require("bluebird"));
+const koncorde_1 = require("koncorde");
+const lodash_1 = require("lodash");
+const kerror = __importStar(require("../../kerror"));
+const errors_1 = require("../../kerror/errors");
+const debug_1 = __importDefault(require("../../util/debug"));
+const koncordeCompat_1 = require("../../util/koncordeCompat");
+const safeObject_1 = require("../../util/safeObject");
+const validationUtils_1 = require("./validationUtils");
+const anything_1 = __importDefault(require("./types/anything"));
+const boolean_1 = __importDefault(require("./types/boolean"));
+const date_1 = __importDefault(require("./types/date"));
+const email_1 = __importDefault(require("./types/email"));
+const enum_1 = __importDefault(require("./types/enum"));
+const geoPoint_1 = __importDefault(require("./types/geoPoint"));
+const geoShape_1 = __importDefault(require("./types/geoShape"));
+const integer_1 = __importDefault(require("./types/integer"));
+const ipAddress_1 = __importDefault(require("./types/ipAddress"));
+const numeric_1 = __importDefault(require("./types/numeric"));
+const object_1 = __importDefault(require("./types/object"));
+const string_1 = __importDefault(require("./types/string"));
+const url_1 = __importDefault(require("./types/url"));
+const debug = (0, debug_1.default)("core:validation");
 const assertionError = kerror.wrap("validation", "assert");
 /**
- * @class Validation
+ * The 13 built-in types, in the order `init` registers them.
+ *
+ * They were loaded by `require(`./types/${typeFile}`)` over a list of names.
+ * That is a runtime `require` in a function body, which is the third spelling
+ * of the defect TD-49 catalogued: a bundler cannot see it, so the module is
+ * unloadable from a runner that resolves the import graph itself. Naming the
+ * constructors statically also lets `addType`'s contract be checked at compile
+ * time for the built-ins, where before only the runtime assertions in `addType`
+ * stood between a typo and a broken boot.
+ */
+const BUILT_IN_TYPES = [
+    anything_1.default,
+    boolean_1.default,
+    date_1.default,
+    email_1.default,
+    enum_1.default,
+    geoPoint_1.default,
+    geoShape_1.default,
+    integer_1.default,
+    ipAddress_1.default,
+    numeric_1.default,
+    object_1.default,
+    string_1.default,
+    url_1.default,
+];
+/**
+ * The message of whatever was thrown.
+ *
+ * `catch` answers `unknown`, and the values that reach these handlers are not
+ * all Errors: a plugin's validation type may throw anything, and the code has
+ * always simply read `.message` off it. Narrowing to `Error` here would change
+ * what those messages say, which the specs pin.
+ */
+function messageOf(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    if (typeof error === "object" && error !== null) {
+        const message = "message" in error ? error.message : undefined;
+        // `inspect`, not `String`: an object stringifies to "[object Object]".
+        return typeof message === "string" ? message : (0, node_util_1.inspect)(error);
+    }
+    // A primitive. The strictness marker used to be a thrown string, and
+    // reading it back verbatim is what recognises it.
+    return typeof error === "string" ? error : (0, node_util_1.inspect)(error);
+}
+/**
+ * The marker `recurseFieldValidation` throws when a document holds a field its
+ * specification does not declare and the specification is strict.
+ *
+ * It is caught by message — `error.message !== "strictness"` — at two levels,
+ * and carries the offending field name for the message the catcher builds. It
+ * was a plain `Error` with an untyped `details` property bolted on.
+ */
+/**
+ * The field name a strictness marker carries, read off whatever was thrown for
+ * the same reason `messageOf` exists.
  */
+function detailedField(error) {
+    if (error instanceof StrictnessError) {
+        return error.details.field;
+    }
+    if (typeof error === "object" && error !== null && "details" in error) {
+        const details = error.details;
+        if (typeof details === "object" && details !== null && "field" in details) {
+            // A field name is a string; anything else is not one to report.
+            return typeof details.field === "string" ? details.field : undefined;
+        }
+    }
+    return undefined;
+}
+class StrictnessError extends Error {
+    constructor(field) {
+        super("strictness");
+        this.details = { field };
+    }
+}
+/**
+ * Narrows the "a curated value, or a report of why it could not be curated"
+ * pair that four of the curation methods answer with.
+ *
+ * The pair is not a discriminated union — the success branch is the curated
+ * value itself and carries no tag — so the discriminator has to be the failure
+ * shape. `"isValid" in result` is what makes this a guard rather than a cast,
+ * and TD-43's `casts` ratchet is the reason it matters.
+ */
+function isCurationFailure(result) {
+    return "isValid" in result && result.isValid === false;
+}
 class Validation {
     constructor() {
-        /** @type {...ValidationType} */
         this.types = {};
-        /** @type {string[]} */
         this.typeAllowsChildren = [];
-        /** @type {DocumentSpecification} */
         this.specification = {};
-        /** @type {Koncorde} */
-        this.koncorde = new Koncorde();
+        this.koncorde = new koncorde_1.Koncorde();
         this.rawConfiguration = {};
         this.logger = global.kuzzle.log.child("core:validation");
     }
     /**
-     * Walks through all types in "defaultTypesFiles" initializes all types
+     * Registers every built-in validation type.
      */
     init() {
-        for (const typeFile of [
-            "anything",
-            "boolean",
-            "date",
-            "email",
-            "enum",
-            "geoPoint",
-            "geoShape",
-            "integer",
-            "ipAddress",
-            "numeric",
-            "object",
-            "string",
-            "url",
-        ]) {
-            const TypeConstructor = require(`./types/${typeFile}`);
+        for (const TypeConstructor of BUILT_IN_TYPES) {
             this.addType(new TypeConstructor());
         }
     }
-    /**
-     * Validates a document against its collection specifications
-     *
-     * @param {Request} request
-     * @param {boolean} [verbose]
-     * @returns {Promise.<{documentBody: *, errorMessages:string[], valid: boolean}|KuzzleRequest>}
-     */
     async validate(request, verbose = false) {
-        const { _id, index, collection } = request.input.resource, collectionSpec = (isPlainObject(this.specification) &&
-            has(this.specification, index) &&
-            get(this.specification[index], collection)) ||
+        // Read from `input.args`, which is what the deprecated `input.resource`
+        // getters return: same values, typed as those getters declare them.
+        const { args } = request.input;
+        const _id = args._id;
+        const index = args.index;
+        const collection = args.collection;
+        // `has` rather than a plain lookup: `index` and `collection` come from the
+        // request, so an inherited property must not answer for a specification.
+        const indexSpec = index !== null && (0, safeObject_1.has)(this.specification, index)
+            ? this.specification[index]
+            : undefined;
+        const collectionSpec = ((0, safeObject_1.isPlainObject)(this.specification) &&
+            indexSpec !== undefined &&
+            collection !== null &&
+            (0, safeObject_1.has)(indexSpec, collection) &&
+            indexSpec[collection]) ||
             {};
-        let isUpdate = false, body = request.input.body;
-        if (request.input.controller === "document" &&
-            request.input.action === "update") {
-            isUpdate = true;
-            const document = await global.kuzzle.ask("core:storage:public:document:get", index, collection, _id);
-            // Avoid side effects on the request during the update validation
-            body = _.cloneDeep(request.input.body);
-            _.defaultsDeep(body, document._source);
-        }
+        const { body, isUpdate } = await this.resolveValidationBody(request, index, collection, _id);
         const errorMessages = verbose ? {} : [];
         let isValid = true;
-        if (collectionSpec) {
-            if (collectionSpec.fields && collectionSpec.fields.children) {
-                try {
-                    isValid = this.recurseFieldValidation(body, collectionSpec.fields.children, collectionSpec.strict, errorMessages, verbose);
-                }
-                catch (error) {
-                    // The strictness message can be received here only if it happens at
-                    // the validation of the document's root
-                    if (error.message !== "strictness") {
-                        throw error;
-                    }
-                    isValid = false;
-                    manageErrorMessage("document", errorMessages, `The document validation is strict. Cannot add unspecified sub-field "${error.details.field}"`, verbose);
-                }
-            }
-            if (collectionSpec.validators) {
-                const filters = koncordeTest(this.koncorde, index, collection, body, _id);
-                if (filters.length === 0 || filters[0] !== collectionSpec.validators) {
-                    isValid = false;
-                    manageErrorMessage("document", errorMessages, "The document does not match validation filters.", verbose);
-                }
-            }
+        // `collectionSpec` is always truthy — it falls back to `{}` above — so the
+        // enclosing `if (collectionSpec)` the JavaScript had was dead.
+        const children = collectionSpec.fields?.children;
+        if (children) {
+            isValid = this.checkDocumentFields(body, children, 
+            // Truthiness, as in v2.56.0: curation stores `spec.strict || false`
+            // unchecked, so a stored `"true"` or `1` has always meant strict.
+            Boolean(collectionSpec.strict), errorMessages, verbose);
+        }
+        if (collectionSpec.validators && index !== null && collection !== null) {
+            isValid =
+                this.checkValidators(index, collection, _id, body, collectionSpec.validators, errorMessages, verbose) && isValid;
         }
         if (!verbose) {
             // We only modify the request if the validation succeeds
-            if (collectionSpec.fields && collectionSpec.fields.children) {
-                request.input.body = this.recurseApplyDefault(isUpdate, request.input.body, collectionSpec.fields.children);
+            if (children) {
+                request.input.body = this.recurseApplyDefault(isUpdate, request.input.body ?? {}, children);
             }
             return request;
         }
         return { errorMessages, valid: isValid };
     }
     /**
-     * @param {boolean} isUpdate
-     * @param {*} documentSubset
-     * @param {...StructuredFieldSpecification} collectionSpecSubset
+     * The body validation runs against: the request's own, or — on an update —
+     * a copy merged over the stored document, so that a partial update is
+     * validated as the document it will produce.
+     */
+    async resolveValidationBody(request, index, collection, _id) {
+        if (request.input.controller !== "document" ||
+            request.input.action !== "update") {
+            return { body: request.input.body, isUpdate: false };
+        }
+        const document = await global.kuzzle.ask("core:storage:public:document:get", index, collection, _id);
+        // Avoid side effects on the request during the update validation
+        const body = (0, lodash_1.cloneDeep)(request.input.body ?? {}); // NOSONAR structuredClone is not equivalent here: specifications and documents are user data, and a conversion does not get to change clone semantics
+        (0, lodash_1.defaultsDeep)(body, document._source);
+        return { body, isUpdate: true };
+    }
+    /**
+     * Walks the document against the collection's field tree, turning a
+     * root-level strictness breach into a message rather than an exception.
+     */
+    checkDocumentFields(body, children, strict, errorMessages, verbose) {
+        try {
+            return this.recurseFieldValidation(body, children, strict, errorMessages, verbose);
+        }
+        catch (error) {
+            // The strictness message can be received here only if it happens at
+            // the validation of the document's root. Matched on the message, not on
+            // `instanceof StrictnessError`: a validation type is plugin code and may
+            // throw its own object, which is what the specs feed this.
+            if (messageOf(error) !== "strictness") {
+                throw error;
+            }
+            (0, validationUtils_1.manageErrorMessage)("document", errorMessages, `The document validation is strict. Cannot add unspecified sub-field "${detailedField(error)}"`, verbose);
+            return false;
+        }
+    }
+    /**
+     * Checks the document against the collection's Koncorde validator filter.
+     */
+    checkValidators(index, collection, _id, body, validators, errorMessages, verbose) {
+        const filters = (0, koncordeCompat_1.koncordeTest)(this.koncorde, index, collection, body ?? {}, _id ?? undefined);
+        if (filters.length === 0 || filters[0] !== validators) {
+            (0, validationUtils_1.manageErrorMessage)("document", errorMessages, "The document does not match validation filters.", verbose);
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Fills a document subset in with the default values its specification
+     * declares, recursing through the fields that allow children.
      */
     recurseApplyDefault(isUpdate, documentSubset, collectionSpecSubset) {
-        Object.keys(collectionSpecSubset).forEach((fieldName) => {
-            const specSubset = collectionSpecSubset[fieldName], field = documentSubset[fieldName];
-            if (has(documentSubset, fieldName) &&
-                this.types[specSubset.type].allowChildren &&
+        Object.entries(collectionSpecSubset).forEach(([fieldName, specSubset]) => {
+            const field = documentSubset[fieldName];
+            if ((0, safeObject_1.has)(documentSubset, fieldName) &&
+                this.typeOf(specSubset.type).allowChildren &&
                 specSubset.children) {
                 if (Array.isArray(field)) {
                     for (let i = 0; i < field.length; i++) {
@@ -143,134 +287,156 @@ class Validation {
                 }
             }
             else if (specSubset.defaultValue &&
-                (field === null || (!isUpdate && !has(documentSubset, fieldName)))) {
+                (field === null || (!isUpdate && !(0, safeObject_1.has)(documentSubset, fieldName)))) {
                 documentSubset[fieldName] = specSubset.defaultValue;
             }
         });
         return documentSubset;
     }
     /**
-     * @param {*} documentSubset
-     * @param {StructuredFieldSpecification} collectionSpecSubset
-     * @param {boolean} strictness
-     * @param {string[]} errorMessages
-     * @param {boolean} verbose
+     * Validates every field of a document subset against its specification.
+     *
+     * @throws {StrictnessError} when `strictness` holds and the subset declares a
+     * field the specification does not — caught by the two callers, which turn it
+     * into a message naming the field.
      */
     recurseFieldValidation(documentSubset, collectionSpecSubset, strictness, errorMessages, verbose) {
         if (strictness) {
-            for (const field of Object.keys(documentSubset)) {
+            for (const field of Object.keys(documentSubset ?? {})) {
                 if (!collectionSpecSubset[field]) {
-                    const error = new Error("strictness");
-                    error.details = { field };
-                    throw error;
+                    throw new StrictnessError(field);
                 }
             }
         }
         if (!verbose) {
             // We stop as soon as one field is not valid
-            return Object.keys(collectionSpecSubset).every((fieldName) => this.isValidField(fieldName, documentSubset, collectionSpecSubset, strictness, errorMessages, verbose));
+            return Object.keys(collectionSpecSubset).every((fieldName) => this.isValidField(fieldName, documentSubset ?? {}, collectionSpecSubset, strictness, errorMessages, verbose));
         }
         // We try to validate every field in order to get all error messages if any
-        return Object.keys(collectionSpecSubset).reduce((reductionResult, fieldName) => this.isValidField(fieldName, documentSubset, collectionSpecSubset, strictness, errorMessages, verbose) && reductionResult, true);
+        return Object.keys(collectionSpecSubset).reduce((reductionResult, fieldName) => this.isValidField(fieldName, documentSubset ?? {}, collectionSpecSubset, strictness, errorMessages, verbose) && reductionResult, true);
     }
     /**
-     * @param {string} fieldName
-     * @param {*} documentSubset
-     * @param {StructuredFieldSpecification} collectionSpecSubset
-     * @param {boolean} strictness
-     * @param {string[]} errorMessages
-     * @param {boolean} verbose
-     * @returns {boolean}
+     * Validates one field of a document subset against its specification.
      */
     isValidField(fieldName, documentSubset, collectionSpecSubset, strictness, errorMessages, verbose) {
-        /** @type StructuredFieldSpecification */
         const field = collectionSpecSubset[fieldName];
-        let result = true;
+        // Both callers drive this from the map's own keys; a name that is not in
+        // it has no specification to check the document against.
+        if (field === undefined) {
+            return true;
+        }
         if (field.mandatory &&
-            !has(field, "defaultValue") &&
-            _.isNil(documentSubset[fieldName])) {
-            manageErrorMessage(field.path, errorMessages, "The field is mandatory.", verbose);
+            !(0, safeObject_1.has)(field, "defaultValue") &&
+            (0, lodash_1.isNil)(documentSubset[fieldName])) {
+            (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, "The field is mandatory.", verbose);
             return false;
         }
-        if (!_.isNil(documentSubset[fieldName])) {
-            let nestedStrictness = false, fieldValues;
-            if (field.multivalued.value) {
-                if (!Array.isArray(documentSubset[fieldName])) {
-                    manageErrorMessage(field.path, errorMessages, "The field must be multivalued, unary value provided.", verbose);
-                    return false;
-                }
-                if (has(field.multivalued, "minCount") &&
-                    documentSubset[fieldName].length < field.multivalued.minCount) {
-                    manageErrorMessage(field.path, errorMessages, `Not enough elements. Minimum count is set to ${field.multivalued.minCount}.`, verbose);
-                    return false;
-                }
-                if (has(field.multivalued, "maxCount") &&
-                    documentSubset[fieldName].length > field.multivalued.maxCount) {
-                    manageErrorMessage(field.path, errorMessages, `Too many elements. Maximum count is set to ${field.multivalued.maxCount}.`, verbose);
-                    return false;
-                }
-                fieldValues = documentSubset[fieldName];
+        if ((0, lodash_1.isNil)(documentSubset[fieldName])) {
+            return true;
+        }
+        const fieldValues = this.resolveFieldValues(field, documentSubset[fieldName], errorMessages, verbose);
+        if (fieldValues === null) {
+            return false;
+        }
+        const type = this.typeOf(field.type);
+        const nestedStrictness = type.allowChildren
+            ? type.getStrictness(field.typeOptions, strictness)
+            : false;
+        let result = true;
+        for (const val of fieldValues) {
+            if (!this.validateFieldValue(field, val, errorMessages, verbose)) {
+                return false;
             }
-            else {
-                if (Array.isArray(documentSubset[fieldName])) {
-                    manageErrorMessage(field.path, errorMessages, "The field is not a multivalued field; Multiple values provided.", verbose);
-                    return false;
-                }
-                fieldValues = [documentSubset[fieldName]];
+            if (type.allowChildren && field.children) {
+                result =
+                    this.validateFieldChildren(field, val, nestedStrictness, errorMessages, verbose) && result;
             }
-            if (this.types[field.type].allowChildren) {
-                nestedStrictness = this.types[field.type].getStrictness(field.typeOptions, strictness);
+        }
+        return result;
+    }
+    /**
+     * Answers the values to validate — the array itself for a multivalued field,
+     * a single-element list otherwise — or `null` once it has filed the reason
+     * the field's arity is wrong.
+     */
+    resolveFieldValues(field, value, errorMessages, verbose) {
+        if (!field.multivalued.value) {
+            if (Array.isArray(value)) {
+                (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, "The field is not a multivalued field; Multiple values provided.", verbose);
+                return null;
             }
-            for (const val of fieldValues) {
-                const fieldErrors = [];
-                if (!this.types[field.type].validate(field.typeOptions, val, fieldErrors)) {
-                    if (fieldErrors.length === 0) {
-                        // We still want to trigger an error, even if no message is provided
-                        manageErrorMessage(field.path, errorMessages, "An error has occurred during validation.", verbose);
-                    }
-                    else {
-                        fieldErrors.forEach((message) => manageErrorMessage(field.path, errorMessages, message, verbose));
-                    }
-                    return false;
-                }
-                if (this.types[field.type].allowChildren && field.children) {
-                    try {
-                        if (!this.recurseFieldValidation(val, field.children, nestedStrictness, errorMessages, verbose)) {
-                            result = false;
-                        }
-                    }
-                    catch (error) {
-                        if (error.message === "strictness") {
-                            manageErrorMessage(field.path, errorMessages, `The field is set to "strict"; cannot add unspecified sub-field "${error.details.field}".`, verbose);
-                        }
-                        else if (verbose) {
-                            manageErrorMessage(field.path, errorMessages, error.message, verbose);
-                        }
-                        else {
-                            throw error;
-                        }
-                        result = false;
-                    }
-                }
+            return [value];
+        }
+        if (!Array.isArray(value)) {
+            (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, "The field must be multivalued, unary value provided.", verbose);
+            return null;
+        }
+        const { minCount, maxCount } = field.multivalued;
+        if (minCount !== undefined && value.length < minCount) {
+            (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, `Not enough elements. Minimum count is set to ${minCount}.`, verbose);
+            return null;
+        }
+        if (maxCount !== undefined && value.length > maxCount) {
+            (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, `Too many elements. Maximum count is set to ${maxCount}.`, verbose);
+            return null;
+        }
+        return value;
+    }
+    /**
+     * Hands one value to the field's registered type.
+     */
+    validateFieldValue(field, val, errorMessages, verbose) {
+        const fieldErrors = [];
+        if (this.typeOf(field.type).validate(field.typeOptions, val, fieldErrors)) {
+            return true;
+        }
+        if (fieldErrors.length === 0) {
+            // We still want to trigger an error, even if no message is provided
+            (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, "An error has occurred during validation.", verbose);
+        }
+        else {
+            fieldErrors.forEach((message) => (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, message, verbose));
+        }
+        return false;
+    }
+    /**
+     * Recurses into a value's children, turning this field's strictness breach
+     * into a message rather than an exception.
+     */
+    validateFieldChildren(field, val, nestedStrictness, errorMessages, verbose) {
+        try {
+            return this.recurseFieldValidation(val, field.children ?? {}, nestedStrictness, errorMessages, verbose);
+        }
+        catch (error) {
+            if (messageOf(error) === "strictness") {
+                (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, `The field is set to "strict"; cannot add unspecified sub-field "${detailedField(error)}".`, verbose);
+            }
+            else if (verbose) {
+                (0, validationUtils_1.manageErrorMessage)(field.path, errorMessages, messageOf(error), verbose);
             }
+            else {
+                throw error;
+            }
+            return false;
         }
-        return result;
     }
     /**
-     * @returns {Promise.<T>}
+     * Loads every stored specification, curates it, and swaps the result in.
+     *
+     * A collection whose specification does not curate is logged and skipped, so
+     * one bad specification cannot keep the others from being applied.
      */
     curateSpecification() {
-        const promises = [], specification = {};
-        return getValidationConfiguration().then((validation) => {
+        const promises = [];
+        const specification = {};
+        return (0, validationUtils_1.getValidationConfiguration)().then((validation) => {
             this.rawConfiguration = validation;
-            for (const indexName of Object.keys(this.rawConfiguration)) {
-                for (const collectionName of Object.keys(this.rawConfiguration[indexName])) {
-                    const promise = this.curateCollectionSpecification(indexName, collectionName, this.rawConfiguration[indexName][collectionName])
+            for (const [indexName, collections] of Object.entries(this.rawConfiguration)) {
+                for (const [collectionName, collectionSpec] of Object.entries(collections)) {
+                    const promise = this.curateCollectionSpecification(indexName, collectionName, collectionSpec)
                         .then((curatedSpec) => {
-                        if (!has(specification, indexName)) {
-                            specification[indexName] = {};
-                        }
-                        specification[indexName][collectionName] = curatedSpec;
+                        const indexSpec = (specification[indexName] ?? (specification[indexName] = {}));
+                        indexSpec[collectionName] = curatedSpec;
                         return null;
                     })
                         .catch((error) => {
@@ -281,24 +447,20 @@ class Validation {
                     promises.push(promise);
                 }
             }
-            return Bluebird.all(promises).then(() => {
+            return bluebird_1.default.all(promises).then(() => {
                 this.specification = specification;
             });
         });
     }
     /**
-     * @param {string} indexName
-     * @param {string} collectionName
-     * @param {CollectionSpecification} collectionSpec
-     * @param {boolean} [verboseErrors]
-     * @returns {Promise<object>}
+     * Reports whether a specification would curate, without registering it.
      */
     validateFormat(indexName, collectionName, collectionSpec, verboseErrors = false) {
         // We make a deep clone to avoid side effects
-        const specification = _.cloneDeep(collectionSpec);
+        const specification = (0, lodash_1.cloneDeep)(collectionSpec); // NOSONAR structuredClone is not equivalent here: specifications and documents are user data, and a conversion does not get to change clone semantics
         return (this.curateCollectionSpecification(indexName, collectionName, specification, true, verboseErrors)
             .then((result) => {
-            if (verboseErrors && result.isValid === false) {
+            if (verboseErrors && isCurationFailure(result)) {
                 return result;
             }
             return { isValid: true };
@@ -307,24 +469,15 @@ class Validation {
             // to know what is going wrong with the given spec
             .catch((error) => ({ errors: [error], isValid: false })));
     }
-    /**
-     * @param {string} index
-     * @param {string} collection
-     * @param {CollectionSpecification} spec
-     * @param {boolean} [dryRun]
-     * @param {boolean} [verbose]
-     * @returns {Promise<CollectionSpecification>}
-     * @rejects PreconditionError
-     */
     async curateCollectionSpecification(index, collection, spec, dryRun = false, verbose = false) {
-        let error = "";
+        let error;
         const processed = {
             fields: {},
             strict: spec.strict || false,
             validators: null,
         };
         const allowed = ["strict", "fields", "validators"];
-        if (!checkAllowedProperties(spec, allowed)) {
+        if (!(0, validationUtils_1.checkAllowedProperties)(spec, allowed)) {
             error = assertionError.get("unexpected_properties", `${index}.${collection}`, allowed.join(", "));
             if (verbose) {
                 return { errors: [error.message], isValid: false };
@@ -333,50 +486,68 @@ class Validation {
         }
         if (spec.fields) {
             const result = this.structureCollectionValidation(spec, index, collection, verbose);
-            if (result.isValid === false) {
+            if (isCurationFailure(result)) {
                 if (verbose) {
                     // do not fail fast if we need verbose errors
                     return result;
                 }
-                throw assertionError.get("invalid_specifications", result.errors.join("\n\t- "));
+                throw assertionError.get("invalid_specifications", (result.errors ?? []).join("\n\t- "));
             }
             processed.fields = result;
         }
         if (spec.validators && Array.isArray(spec.validators)) {
-            try {
-                const filterId = this.curateValidatorFilter(index, collection, spec.validators, dryRun);
-                processed.validators = filterId;
-            }
-            catch (e) {
-                this.logger.error(e);
-                throw assertionError.getFrom(e, "invalid_filters", e.message);
-            }
+            processed.validators = this.curateValidators(index, collection, spec.validators, dryRun);
         }
         return processed;
     }
+    /**
+     * Registers a specification's validator filter and answers its id.
+     *
+     * The wrapping is what `curateCollectionSpecification` did inline: a filter
+     * Koncorde refuses is an `invalid_filters` assertion, logged on the way
+     * past.
+     */
+    curateValidators(index, collection, validators, dryRun) {
+        try {
+            return this.curateValidatorFilter(index, collection, validators, dryRun);
+        }
+        catch (e) {
+            this.logger.error(e);
+            throw assertionError.getFrom(e instanceof Error ? e : new Error(messageOf(e)), "invalid_filters", messageOf(e));
+        }
+    }
+    /**
+     * Curates every field of a specification, then assembles them into a tree.
+     */
     structureCollectionValidation(collectionSpec, indexName, collectionName, verboseErrors = false) {
+        var _a;
         const fields = {};
-        let errors = [], maxDepth = 0;
-        for (const fieldName of Object.keys(collectionSpec.fields)) {
+        let errors = [];
+        let maxDepth = 0;
+        for (const [fieldName, fieldSpec] of Object.entries(collectionSpec.fields ?? {})) {
             const // We deep clone the field because we will modify it
-            fieldSpecClone = _.cloneDeep(collectionSpec.fields[fieldName]);
+            fieldSpecClone = (0, lodash_1.cloneDeep)(fieldSpec); // NOSONAR structuredClone is not equivalent here: specifications and documents are user data, and a conversion does not get to change clone semantics
             try {
                 const result = this.curateFieldSpecification(fieldSpecClone, indexName, collectionName, fieldName, verboseErrors);
-                if (result.isValid === false) {
-                    errors = _.concat(errors, result.errors);
-                    this.logger.error(result.errors.join("\n"));
+                if (result.isValid === false || result.fieldSpec === undefined) {
+                    const resultErrors = result.errors ?? [];
+                    errors = errors.concat(resultErrors);
+                    this.logger.error(resultErrors.join("\n"));
                 }
                 else {
-                    const field = result.fieldSpec;
-                    field.path = fieldName.split("/");
-                    field.depth = field.path.length;
+                    // `curateFieldSpecification` answers everything but the field's
+                    // place in the tree; the key it was filed under is what gives it one.
+                    const path = fieldName.split("/");
+                    const field = {
+                        ...result.fieldSpec,
+                        depth: path.length,
+                        path,
+                    };
                     if (field.depth > maxDepth) {
                         maxDepth = field.depth;
                     }
-                    if (!fields[field.depth]) {
-                        fields[field.depth] = [];
-                    }
-                    fields[field.depth].push(field);
+                    const sameDepth = (fields[_a = field.depth] ?? (fields[_a] = []));
+                    sameDepth.push(field);
                 }
             }
             catch (error) {
@@ -388,18 +559,15 @@ class Validation {
             return { errors, isValid: false };
         }
         if (Object.keys(fields).length > 0) {
-            return curateStructuredFields(this.typeAllowsChildren, fields, maxDepth);
+            return (0, validationUtils_1.curateStructuredFields)(this.typeAllowsChildren, fields, maxDepth);
         }
         return {};
     }
     /**
-     * @param {FieldSpecification} fieldSpec
-     * @param {string} indexName
-     * @param {string} collectionName
-     * @param {string} fieldName
-     * @param {boolean} [verboseErrors]
-     * @returns {object}
-     * @throws PreconditionError
+     * Fills a field specification's defaults in and hands its `typeOptions` to
+     * the type that owns them.
+     *
+     * @throws {PreconditionError}
      */
     curateFieldSpecification(fieldSpec, indexName, collectionName, fieldName, verboseErrors = false) {
         const errors = [];
@@ -407,45 +575,42 @@ class Validation {
         if (result.isValid === false) {
             return result;
         }
-        _.defaultsDeep(fieldSpec, {
-            mandatory: false,
-            multivalued: {
-                value: false,
-            },
-        });
-        if (!has(fieldSpec, "typeOptions")) {
-            fieldSpec.typeOptions = {};
-        }
-        const allowed = this.types[fieldSpec.type].allowedTypeOptions || [];
-        if (!checkAllowedProperties(fieldSpec.typeOptions, allowed)) {
+        // Built rather than `defaultsDeep`-ed in place: the defaults are what turn
+        // a submitted field into a curated one, and saying so is what lets the
+        // return type be `UnplacedCuratedField` instead of the submitted shape.
+        const curated = {
+            ...fieldSpec,
+            mandatory: fieldSpec.mandatory ?? false,
+            multivalued: { value: false, ...fieldSpec.multivalued },
+            typeOptions: fieldSpec.typeOptions ?? {},
+        };
+        const allowed = this.typeOf(curated.type).allowedTypeOptions || [];
+        if (!(0, validationUtils_1.checkAllowedProperties)(curated.typeOptions, allowed)) {
             throwOrStoreError(assertionError.get("unexpected_properties", `${indexName}.${collectionName}.${fieldName}`, allowed.join(", ")), verboseErrors, errors);
         }
         try {
-            fieldSpec.typeOptions = this.types[fieldSpec.type].validateFieldSpecification(fieldSpec.typeOptions);
+            curated.typeOptions = this.typeOf(curated.type).validateFieldSpecification(curated.typeOptions);
         }
         catch (e) {
+            const cause = e instanceof Error ? e : new Error(messageOf(e));
             if (!verboseErrors) {
-                if (e instanceof KuzzleError) {
+                if (e instanceof errors_1.KuzzleError) {
                     throw e;
                 }
-                throw kerror.getFrom(e, "plugin", "runtime", "unexpected_error", e.message);
+                throw kerror.getFrom(cause, "plugin", "runtime", "unexpected_error", cause.message);
             }
-            errors.push(e.message);
+            errors.push(cause.message);
         }
         if (errors.length > 0) {
             return { errors, isValid: false };
         }
-        debug("Loaded field validator: %s/%s/%s: %o", indexName, collectionName, fieldName, fieldSpec);
-        return { fieldSpec, isValid: true };
+        debug("Loaded field validator: %s/%s/%s: %o", indexName, collectionName, fieldName, curated);
+        return { fieldSpec: curated, isValid: true };
     }
     /**
-     * @param {FieldSpecification} fieldSpec
-     * @param {string} indexName
-     * @param {string} collectionName
-     * @param {string} fieldName
-     * @param {boolean} [verboseErrors]
-     * @returns {object}
-     * @throws PreconditionError
+     * Checks a field specification's shape, before any type is consulted.
+     *
+     * @throws {PreconditionError}
      */
     curateFieldSpecificationFormat(fieldSpec, indexName, collectionName, fieldName, verboseErrors = false) {
         const errors = [];
@@ -457,49 +622,24 @@ class Validation {
             "multivalued",
             "typeOptions",
         ];
-        if (!checkAllowedProperties(fieldSpec, props)) {
+        if (!(0, validationUtils_1.checkAllowedProperties)(fieldSpec, props)) {
             throwOrStoreError(assertionError.get("unexpected_properties", `${indexName}.${collectionName}.${fieldName}`, props.join(", ")), verboseErrors, errors);
         }
-        if (!has(fieldSpec, "type")) {
+        if (!(0, safeObject_1.has)(fieldSpec, "type")) {
             throwOrStoreError(assertionError.get("missing_type", `${indexName}.${collectionName}.${fieldName}`), verboseErrors, errors);
         }
-        if (!has(this.types, fieldSpec.type)) {
+        if (!(0, safeObject_1.has)(this.types, fieldSpec.type)) {
             throwOrStoreError(assertionError.get("unknown_type", `${indexName}.${collectionName}.${fieldName}`, fieldSpec.type), verboseErrors, errors);
         }
-        if (has(fieldSpec, "multivalued")) {
-            const multivaluedProps = ["value", "minCount", "maxCount"];
-            if (!checkAllowedProperties(fieldSpec.multivalued, multivaluedProps)) {
-                throwOrStoreError(assertionError.get("unexpected_properties", `${indexName}.${collectionName}.${fieldName}.multivalued`, multivaluedProps.join(", ")), verboseErrors, errors);
-            }
-            if (!has(fieldSpec.multivalued, "value")) {
-                throwOrStoreError(assertionError.get("missing_value", `${indexName}.${collectionName}.${fieldName}.multivalued`), verboseErrors, errors);
-            }
-            if (typeof fieldSpec.multivalued.value !== "boolean") {
-                throwOrStoreError(assertionError.get("invalid_type", `${indexName}.${collectionName}.${fieldName}.multivalued.value`, "boolean"), verboseErrors, errors);
-            }
-            for (const unexpected of ["minCount", "maxCount"]) {
-                if (!fieldSpec.multivalued.value &&
-                    has(fieldSpec.multivalued, unexpected)) {
-                    throwOrStoreError(assertionError.get("not_multivalued", `${indexName}.${collectionName}.${fieldName}`, unexpected), verboseErrors, errors);
-                }
-            }
-            if (has(fieldSpec.multivalued, "minCount") &&
-                has(fieldSpec.multivalued, "maxCount") &&
-                fieldSpec.multivalued.minCount > fieldSpec.multivalued.maxCount) {
-                throwOrStoreError(assertionError.get("invalid_range", `${indexName}.${collectionName}.${fieldName}`, "minCount", "maxCount"), verboseErrors, errors);
-            }
-        }
+        checkMultivaluedSpecification(fieldSpec, indexName, collectionName, fieldName, verboseErrors, errors);
         if (errors.length > 0) {
             return { errors, isValid: false };
         }
         return { isValid: true };
     }
     /**
-     * @param {string} indexName
-     * @param {string} collectionName
-     * @param {*} validatorFilter
-     * @param {boolean} dryRun
-     * @returns {string}
+     * Registers a collection's validators as a Koncorde filter and answers its
+     * id — or validates it and answers `null`, on a dry run.
      */
     curateValidatorFilter(indexName, collectionName, validatorFilter, dryRun) {
         const query = {
@@ -510,12 +650,17 @@ class Validation {
         this.koncorde.validate(query);
         if (!dryRun) {
             debug("Registering filter validator %s/%s: %O", indexName, collectionName, query);
-            return this.koncorde.register(query, toKoncordeIndex(indexName, collectionName));
+            return this.koncorde.register(query, (0, koncordeCompat_1.toKoncordeIndex)(indexName, collectionName));
         }
         return null;
     }
     /**
-     * @param {ValidationType} validationType
+     * Registers a validation type, built-in or plugin-provided.
+     *
+     * This is public API: `pluginContext` hands it to every plugin, so the
+     * runtime assertions below are the contract and stay exactly as they were —
+     * a plugin's type is not checked by the compiler.
+     *
      * @throws {PluginImplementationError}
      */
     addType(validationType) {
@@ -530,7 +675,7 @@ class Validation {
             typeof validationType.validateFieldSpecification !== "function") {
             throw kerror.get("validation", "types", "missing_function", validationType.typeName, "validateFieldSpecification");
         }
-        if (has(validationType, "allowChildren") && validationType.allowChildren) {
+        if ((0, safeObject_1.has)(validationType, "allowChildren") && validationType.allowChildren) {
             if (!validationType.getStrictness ||
                 typeof validationType.getStrictness !== "function") {
                 throw kerror.get("validation", "types", "missing_function", validationType.typeName, "getStrictness");
@@ -542,151 +687,64 @@ class Validation {
         }
         this.types[validationType.typeName] = validationType;
     }
-}
-/**
- * @param {*} object
- * @param {string[]} allowedProperties
- * @returns {boolean}
- */
-function checkAllowedProperties(object, allowedProperties) {
-    if (!isPlainObject(object)) {
-        return false;
+    /**
+     * The validation type a curated field declares.
+     *
+     * Every caller reaches this through a field that `curateFieldSpecification`
+     * has been through, and that method refuses a `type` the map does not hold —
+     * so the throw here is the invariant restated where the compiler can see it,
+     * not a new failure mode.
+     *
+     * @throws {PreconditionError} when the type is not registered
+     */
+    typeOf(typeName) {
+        const type = this.types[typeName];
+        if (type === undefined) {
+            throw kerror.get("validation", "types", "missing_type_name", typeName);
+        }
+        return type;
     }
-    return !Object.keys(object).some((propertyName) => !allowedProperties.includes(propertyName));
 }
 /**
- * @param {string[]} typeAllowsChildren
- * @param {StructuredFieldSpecification[][]} fields
- * @param {number} maxDepth : depth of the fields; counting starts at 1
- * @throws PreconditionError
+ * Checks a field's `multivalued` block. Lifted verbatim out of
+ * `curateFieldSpecificationFormat`, whose cognitive complexity the `.js` → `.ts`
+ * rename re-scored as new code.
  */
-function curateStructuredFields(typeAllowsChildren, fields, maxDepth) {
-    const /** @type StructuredFieldSpecification */ structuredFields = {
-        children: {},
-        root: true,
-    };
-    for (let i = 1; i <= maxDepth; i++) {
-        if (!has(fields, i)) {
-            throw assertionError.get("missing_nested_spec");
-        }
-        fields[i].forEach((field) => {
-            const parent = getParent(structuredFields, field.path), childKey = field.path[field.path.length - 1];
-            if (!parent.root && typeAllowsChildren.indexOf(parent.type) === -1) {
-                throw assertionError.get("unexpected_children", parent.type);
-            }
-            if (!has(parent, "children")) {
-                parent.children = {};
-            }
-            parent.children[childKey] = field;
-        });
+function checkMultivaluedSpecification(fieldSpec, indexName, collectionName, fieldName, verboseErrors, errors) {
+    const multivalued = fieldSpec.multivalued;
+    if (multivalued === undefined) {
+        return;
     }
-    return structuredFields;
-}
-/**
- * @param {StructuredFieldSpecification} structuredFields
- * @param {string[]}fieldPath
- * @returns {StructuredFieldSpecification}
- */
-function getParent(structuredFields, fieldPath) {
-    if (fieldPath.length === 1) {
-        return structuredFields;
+    const multivaluedProps = ["value", "minCount", "maxCount"];
+    if (!(0, validationUtils_1.checkAllowedProperties)(multivalued, multivaluedProps)) {
+        throwOrStoreError(assertionError.get("unexpected_properties", `${indexName}.${collectionName}.${fieldName}.multivalued`, multivaluedProps.join(", ")), verboseErrors, errors);
     }
-    let pointer = structuredFields;
-    for (let i = 0; i < fieldPath.length - 1; i++) {
-        if (!has(pointer.children, fieldPath[i])) {
-            throw assertionError.get("missing_parent", fieldPath.join("."));
+    if (!(0, safeObject_1.has)(multivalued, "value")) {
+        throwOrStoreError(assertionError.get("missing_value", `${indexName}.${collectionName}.${fieldName}.multivalued`), verboseErrors, errors);
+    }
+    if (typeof multivalued.value !== "boolean") {
+        throwOrStoreError(assertionError.get("invalid_type", `${indexName}.${collectionName}.${fieldName}.multivalued.value`, "boolean"), verboseErrors, errors);
+    }
+    for (const unexpected of ["minCount", "maxCount"]) {
+        if (!multivalued.value && (0, safeObject_1.has)(multivalued, unexpected)) {
+            throwOrStoreError(assertionError.get("not_multivalued", `${indexName}.${collectionName}.${fieldName}`, unexpected), verboseErrors, errors);
         }
-        pointer = pointer.children[fieldPath[i]];
     }
-    return pointer;
+    if (multivalued.minCount !== undefined &&
+        multivalued.maxCount !== undefined &&
+        multivalued.minCount > multivalued.maxCount) {
+        throwOrStoreError(assertionError.get("invalid_range", `${indexName}.${collectionName}.${fieldName}`, "minCount", "maxCount"), verboseErrors, errors);
+    }
 }
 /**
- * @param {KuzzleError} error
- * @param {boolean} doNotThrow
- * @param {string[]} errors
+ * Rethrows, or collects the message — the single place the verbose/fail-fast
+ * choice is made during curation.
  */
 function throwOrStoreError(error, doNotThrow, errorMessages) {
     if (!doNotThrow) {
         throw error;
     }
-    errorMessages.push(error.message);
-}
-/**
- * @param {string|string[]} errorContext
- * @param {string[]|{documentScope:string[], fieldScope: {children: ...*}}} errorHolder
- * @param {string} message
- * @param {boolean} structured
- */
-function manageErrorMessage(errorContext, errorHolder, message, structured) {
-    if (structured) {
-        if (errorContext === "document") {
-            if (!errorHolder.documentScope) {
-                errorHolder.documentScope = [];
-            }
-            errorHolder.documentScope.push(message);
-        }
-        else {
-            if (!errorHolder.fieldScope) {
-                errorHolder.fieldScope = {};
-            }
-            let pointer = errorHolder.fieldScope;
-            for (let i = 0; i < errorContext.length; i++) {
-                if (!pointer.children) {
-                    pointer.children = {};
-                }
-                if (!has(pointer.children, errorContext[i])) {
-                    pointer.children[errorContext[i]] = {};
-                }
-                pointer = pointer.children[errorContext[i]];
-            }
-            if (!has(pointer, "messages")) {
-                pointer.messages = [];
-            }
-            pointer.messages.push(message);
-        }
-    }
-    else if (errorContext === "document") {
-        throw kerror.get("validation", "check", "failed_document", message);
-    }
-    else {
-        throw kerror.get("validation", "check", "failed_field", errorContext.join("."), message);
-    }
-}
-/**
- * Retrieve the plugins list from the database and returns it,
- * along with their configuration
- *
- * @returns {Promise}
- */
-function getValidationConfiguration() {
-    return global.kuzzle.internalIndex
-        .search("validations", {}, { from: 0, size: 1000 })
-        .then((result) => {
-        let validation = {};
-        if (result && Array.isArray(result.hits) && result.hits.length > 0) {
-            for (const { _source, _id } of result.hits) {
-                const collectionName = `${_id.split("#")[0]}/${_id.split("#")[1]}`;
-                if (!get(_source, "index")) {
-                    throw assertionError.get("incorrect_validation_format", collectionName, "index");
-                }
-                if (!get(_source, "collection")) {
-                    throw assertionError.get("incorrect_validation_format", collectionName, "collection");
-                }
-                if (!get(_source, "validation")) {
-                    throw assertionError.get("incorrect_validation_format", collectionName, "validation");
-                }
-                if (!has(validation, _source.index)) {
-                    validation[_source.index] = {};
-                }
-                validation[_source.index][_source.collection] = _source.validation;
-            }
-        }
-        else if (global.kuzzle.config.validation) {
-            // We can't wait prepareDb as it runs outside of the rest of the start
-            validation = global.kuzzle.config.validation;
-        }
-        return validation;
-    });
+    errorMessages.push(messageOf(error));
 }
 module.exports = Validation;
 //# sourceMappingURL=validation.js.map