kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/api/funnel.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,31 +19,75 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const Bluebird = require("bluebird");
-const Deque = require("denque");
-const Cookie = require("cookie");
-const kuzzleStateEnum = require("../kuzzle/kuzzleStateEnum");
-const { KuzzleError } = require("../kerror/errors");
-const { AdminController, AuthController, BulkController, ClusterController, CollectionController, DebugController, DocumentController, IndexController, MemoryStorageController, RealtimeController, SecurityController, ServerController, } = require("./controllers");
-const { documentEventAliases } = require("../config/documentEventAliases");
-const DocumentExtractor = require("./documentExtractor");
-const sdkCompatibility = require("../config/sdkCompatibility");
-const RateLimiter = require("./rateLimiter");
-const kerror = require("../kerror");
-const debug = require("../util/debug")("kuzzle:funnel");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const bluebird_1 = __importDefault(require("bluebird"));
+const denque_1 = __importDefault(require("denque"));
+const Cookie = __importStar(require("cookie"));
+const get_1 = __importDefault(require("lodash/get"));
+const kuzzleStateEnum_1 = __importDefault(require("../kuzzle/kuzzleStateEnum"));
+const errors_1 = require("../kerror/errors");
+const controllers_1 = __importDefault(require("./controllers"));
+const documentEventAliases_1 = require("../config/documentEventAliases");
+const documentExtractor_1 = __importDefault(require("./documentExtractor"));
+const sdkCompatibility_json_1 = __importDefault(require("../config/sdkCompatibility.json"));
+const rateLimiter_1 = __importDefault(require("./rateLimiter"));
+const kerror = __importStar(require("../kerror"));
+const debug_1 = __importDefault(require("../util/debug"));
+const thrown_1 = require("../util/thrown");
+const safeObject_1 = require("../util/safeObject");
+const types_1 = require("../types");
+const { AdminController, AuthController, BulkController, ClusterController, CollectionController, DebugController, DocumentController, IndexController, MemoryStorageController, RealtimeController, SecurityController, ServerController, } = controllers_1.default;
+const debug = (0, debug_1.default)("kuzzle:funnel");
 const processError = kerror.wrap("api", "process");
-const { has } = require("../util/safeObject");
-const { HttpStream } = require("../types");
-const get = require("lodash/get");
 // Actions of the auth controller that does not necessite to verify the token
 // when cookie auth is active
-const SKIP_TOKEN_VERIF_ACTIONS = ["login", "checkToken", "logout"];
+const SKIP_TOKEN_VERIF_ACTIONS = new Set(["login", "checkToken", "logout"]);
+/**
+ * The controller and action a request names.
+ *
+ * `RequestInput` leaves both `null` until they are set, and ten sites below
+ * — the event names, the document alias table, the `Reflect.get` that
+ * dispatches — read them as strings. A request naming neither is what
+ * `controller_not_found` has always been for, and it was raised at the bottom
+ * of `getController` and nowhere else.
+ */
+function targetOf(request) {
+    const { action, controller } = request.input;
+    if (controller === null) {
+        throw processError.get("controller_not_found", controller);
+    }
+    if (action === null) {
+        throw processError.get("action_not_found", controller, action);
+    }
+    return { action, controller };
+}
 /**
  * @class PendingRequest
- * @param {Request} request
- * @param {Function} fn
- * @param {Object} context
  */
 class PendingRequest {
     constructor(request, fn, context) {
@@ -59,15 +104,15 @@ class Funnel {
         this.overloaded = false;
         this.concurrentRequests = 0;
         this.controllers = new Map();
-        this.pendingRequestsQueue = new Deque();
+        this.pendingRequestsQueue = new denque_1.default();
         this.pendingRequestsById = new Map();
         this.lastOverloadTime = 0;
         this.overloadWarned = false;
         this.lastWarningTime = 0;
-        this.rateLimiter = new RateLimiter();
+        this.rateLimiter = new rateLimiter_1.default();
         this.lastDumpedErrors = {};
-        this.loadDocumentEventAliases();
-        this.sdkCompatibility = sdkCompatibility;
+        this.sdkCompatibility = sdkCompatibility_json_1.default;
+        this.documentEventAliases = this.loadDocumentEventAliases();
         this.logger = global.kuzzle.log.child("api:funnel");
     }
     init() {
@@ -85,7 +130,7 @@ class Funnel {
          */
         global.kuzzle.onAsk("kuzzle:api:funnel:metrics", () => this.metrics());
         this.rateLimiter.init();
-        this.controllers.set("auth", new AuthController.default());
+        this.controllers.set("auth", new AuthController());
         this.controllers.set("bulk", new BulkController());
         this.controllers.set("cluster", new ClusterController());
         this.controllers.set("collection", new CollectionController());
@@ -93,23 +138,46 @@ class Funnel {
         this.controllers.set("document", new DocumentController());
         this.controllers.set("index", new IndexController());
         this.controllers.set("realtime", new RealtimeController());
-        this.controllers.set("security", new SecurityController.default());
+        this.controllers.set("security", new SecurityController());
         this.controllers.set("server", new ServerController());
-        this.controllers.set("admin", new AdminController.default());
+        this.controllers.set("admin", new AdminController());
         const msController = new MemoryStorageController();
         this.controllers.set("memoryStorage", msController);
         this.controllers.set("ms", msController);
-        const initPromises = Array.from(this.controllers.keys()).map((ctrl) => this.controllers.get(ctrl).init());
-        return Bluebird.all(initPromises);
+        const initPromises = Array.from(this.controllers.values()).map((controller) => controller.init());
+        return bluebird_1.default.all(initPromises);
     }
+    /**
+     * Answers the table rather than assigning it: a field set by a method the
+     * constructor calls is not one the compiler can see being initialised.
+     */
     loadDocumentEventAliases() {
-        this.documentEventAliases = documentEventAliases;
-        this.documentEventAliases.mirrorList = {};
-        Object.keys(documentEventAliases.list).forEach((alias) => {
-            documentEventAliases.list[alias].forEach((aliasOf) => {
-                this.documentEventAliases.mirrorList[aliasOf] = alias;
-            });
-        });
+        const aliases = documentEventAliases_1.documentEventAliases;
+        aliases.mirrorList = {};
+        for (const [alias, aliasedActions] of Object.entries(documentEventAliases_1.documentEventAliases.list)) {
+            for (const aliasOf of aliasedActions) {
+                aliases.mirrorList[aliasOf] = alias;
+            }
+        }
+        return aliases;
+    }
+    /**
+     * Emits the "core:overload" event and logs a warning when the pending-request
+     * queue crosses its warning threshold — rate-limited to once per 500ms.
+     */
+    _warnOverload() {
+        const now = Date.now();
+        if (this.pendingRequestsQueue.length <=
+            global.kuzzle.config.limits.requestsBufferWarningThreshold ||
+            (this.lastWarningTime !== 0 && this.lastWarningTime >= now - 500)) {
+            return;
+        }
+        const overloadPercentage = Math.round((10000 * this.pendingRequestsQueue.length) /
+            global.kuzzle.config.limits.requestsBufferSize) / 100;
+        global.kuzzle.emit("core:overload", overloadPercentage);
+        this.logger.warn(`[!WARNING!] Kuzzle overloaded: ${overloadPercentage}%. Delaying requests...`);
+        this.overloadWarned = true;
+        this.lastWarningTime = now;
     }
     /**
      * Asks the overload-protection system for an execution slot.
@@ -137,25 +205,15 @@ class Funnel {
      *                      immediately executed or not.
      */
     throttle(fn, context, request) {
-        if (global.kuzzle.state === kuzzleStateEnum.SHUTTING_DOWN) {
+        if (global.kuzzle.state === kuzzleStateEnum_1.default.SHUTTING_DOWN) {
             throw processError.get("shutting_down");
         }
-        if (global.kuzzle.state === kuzzleStateEnum.NOT_ENOUGH_NODES) {
+        if (global.kuzzle.state === kuzzleStateEnum_1.default.NOT_ENOUGH_NODES) {
             throw processError.get("not_enough_nodes");
         }
-        const isRequestFromDebugSession = get(request, "context.connection.misc.internal.debugSession", false);
+        const isRequestFromDebugSession = (0, get_1.default)(request, "context.connection.misc.internal.debugSession", false);
         if (this.overloaded) {
-            const now = Date.now();
-            if (this.pendingRequestsQueue.length >
-                global.kuzzle.config.limits.requestsBufferWarningThreshold &&
-                (this.lastWarningTime === 0 || this.lastWarningTime < now - 500)) {
-                const overloadPercentage = Math.round((10000 * this.pendingRequestsQueue.length) /
-                    global.kuzzle.config.limits.requestsBufferSize) / 100;
-                global.kuzzle.emit("core:overload", overloadPercentage);
-                this.logger.warn(`[!WARNING!] Kuzzle overloaded: ${overloadPercentage}%. Delaying requests...`);
-                this.overloadWarned = true;
-                this.lastWarningTime = now;
-            }
+            this._warnOverload();
         }
         if (this.concurrentRequests < global.kuzzle.config.limits.concurrentRequests) {
             if (this.pendingRequestsById.has(request.internalId)) {
@@ -223,11 +281,11 @@ class Funnel {
      * @returns {Number} -1: request delayed, 0: request processing, 1: error
      */
     execute(request, callback) {
-        if (!request.input.controller || !request.input.controller.length) {
+        if (!request.input.controller?.length) {
             callback(kerror.get("api", "assert", "missing_argument", "controller"), request);
             return 1;
         }
-        if (!request.input.action || !request.input.action.length) {
+        if (!request.input.action?.length) {
             callback(kerror.get("api", "assert", "missing_argument", "action"), request);
             return 1;
         }
@@ -243,88 +301,107 @@ class Funnel {
             return 1;
         }
         if (request.input.headers &&
-            has(request.input.headers, "origin") &&
+            (0, safeObject_1.has)(request.input.headers, "origin") &&
             !this._isOriginAuthorized(request.input.headers.origin)) {
             debug("Reject request, unauthorized origin %s", request.input.headers.origin);
             return this._executeError(kerror.get("api", "process", "unauthorized_origin", request.input.headers.origin), request, true, callback);
         }
         try {
-            const executing = this.throttle((req) => {
-                // if the connection is closed there is no need to execute the request
-                // => discarding it
-                if (!global.kuzzle.router.isConnectionAlive(req.context)) {
-                    debug("Client connection dead: dropping request: %a", req.input);
-                    callback(processError.get("connection_dropped"), req);
-                    return;
-                }
-                debug("Starting request %s:%s [%s]: %j", req.input.controller, req.input.action, req.id, req.input);
-                global.kuzzle.asyncStore.run(() => {
-                    global.kuzzle.asyncStore.set("REQUEST", req);
-                    global.kuzzle
-                        .pipe("request:beforeExecution", req)
-                        .then((modifiedRequest) => {
-                        let _request;
-                        return this.checkRights(modifiedRequest)
-                            .then((newModifiedRequest) => {
-                            _request = newModifiedRequest;
-                            return this.rateLimiter.isAllowed(_request);
-                        })
-                            .then((allowed) => {
-                            if (!allowed) {
-                                if (request.input.controller === "auth" &&
-                                    request.input.action === "login") {
-                                    throw processError.get("too_many_logins_requests");
-                                }
-                                throw processError.get("too_many_requests");
-                            }
-                            return this.processRequest(_request);
-                        })
-                            .then((processResult) => {
-                            debug("Request %s successfully executed. Result: %a", modifiedRequest.id, processResult);
-                            return global.kuzzle
-                                .pipe("request:afterExecution", {
-                                request: _request,
-                                result: processResult,
-                                success: true,
-                            })
-                                .then((pipeEvent) => {
-                                callback(null, pipeEvent.result);
-                                // disables a bluebird warning in dev. mode triggered when
-                                // a promise is created and not returned
-                                return null;
-                            });
-                        })
-                            .catch((err) => {
-                            debug("Error processing request %s: %a", modifiedRequest.id, err);
-                            return global.kuzzle
-                                .pipe("request:afterExecution", {
-                                error: err,
-                                request: modifiedRequest,
-                                success: false,
-                            })
-                                .then((pipeEvent) => this._executeError(pipeEvent.error, pipeEvent.request, true, callback));
-                        });
-                    })
-                        .catch((err) => {
-                        debug("Error processing request %s: %a", req.id, err);
-                        return global.kuzzle
-                            .pipe("request:afterExecution", {
-                            error: err,
-                            request: req,
-                            success: false,
-                        })
-                            .then((pipeEvent) => this._executeError(pipeEvent.error, pipeEvent.request, true, callback));
-                    });
-                });
-            }, this, request);
+            const executing = this.throttle((req) => this._executeThrottled(req, callback), this, request);
             return executing ? 0 : -1;
         }
         catch (error) {
-            request.setError(error);
-            callback(error, request);
+            const cause = (0, thrown_1.causeOf)(error);
+            request.setError(cause);
+            callback(cause, request);
             return 1;
         }
     }
+    /**
+     * Runs a request that has been granted an execution slot by the
+     * overload-protection system. Extracted from `execute` verbatim.
+     *
+     * @param request - the very request `execute` handed to `throttle`
+     */
+    _executeThrottled(request, callback) {
+        // if the connection is closed there is no need to execute the request
+        // => discarding it
+        if (!global.kuzzle.router.isConnectionAlive(request.context)) {
+            debug("Client connection dead: dropping request: %a", request.input);
+            callback(processError.get("connection_dropped"), request);
+            return;
+        }
+        debug("Starting request %s:%s [%s]: %j", request.input.controller, request.input.action, request.id, request.input);
+        global.kuzzle.asyncStore.run(() => {
+            global.kuzzle.asyncStore.set("REQUEST", request);
+            global.kuzzle
+                .pipe("request:beforeExecution", request)
+                .then((modifiedRequest) => this._dispatch(request, modifiedRequest, callback))
+                .catch((err) => {
+                debug("Error processing request %s: %a", request.id, err);
+                return this._reportExecutionError(err, request, callback);
+            });
+        });
+    }
+    /**
+     * Rights check -> rate limit -> controller action, then reports the outcome
+     * through `callback`. Extracted from `execute` verbatim.
+     *
+     * @param request - the original request (the rate-limit branch inspects it,
+     *                  not the pipe-modified one)
+     * @param modifiedRequest - the "request:beforeExecution" pipe result
+     */
+    _dispatch(request, modifiedRequest, callback) {
+        let _request;
+        return this.checkRights(modifiedRequest)
+            .then((newModifiedRequest) => {
+            _request = newModifiedRequest;
+            return this.rateLimiter.isAllowed(_request);
+        })
+            .then((allowed) => {
+            if (!allowed) {
+                if (request.input.controller === "auth" &&
+                    request.input.action === "login") {
+                    throw processError.get("too_many_logins_requests");
+                }
+                throw processError.get("too_many_requests");
+            }
+            return this.processRequest(_request);
+        })
+            .then((processResult) => {
+            debug("Request %s successfully executed. Result: %a", modifiedRequest.id, processResult);
+            return global.kuzzle
+                .pipe("request:afterExecution", {
+                request: _request,
+                result: processResult,
+                success: true,
+            })
+                .then((pipeEvent) => {
+                callback(null, pipeEvent.result);
+                // disables a bluebird warning in dev. mode triggered when
+                // a promise is created and not returned
+                return null;
+            });
+        })
+            .catch((err) => {
+            debug("Error processing request %s: %a", modifiedRequest.id, err);
+            return this._reportExecutionError(err, modifiedRequest, callback);
+        });
+    }
+    /**
+     * Fires "request:afterExecution" in failure mode, then reports the (possibly
+     * pipe-rewritten) error through `callback`. Extracted from `execute` verbatim
+     * — both of its catch blocks did exactly this.
+     */
+    _reportExecutionError(error, request, callback) {
+        return global.kuzzle
+            .pipe("request:afterExecution", {
+            error,
+            request,
+            success: false,
+        })
+            .then((pipeEvent) => this._executeError(pipeEvent.error, pipeEvent.request, true, callback));
+    }
     /**
      * Checks if an error is worth dumping Kuzzle. If so,
      * creates a dump.
@@ -336,27 +413,36 @@ class Funnel {
         if (global.kuzzle.config.dump.enabled && handledErrors.enabled) {
             setImmediate(() => {
                 const errorType = typeof err === "object" && err.name ? err.name : typeof err;
-                if (handledErrors.whitelist.indexOf(errorType) > -1) {
+                if (handledErrors.whitelist.includes(errorType)) {
                     const now = Date.now();
                     // JSON.stringify(new NativeError()) === '{}'
                     // i.e. Error, SyntaxError, TypeError, ReferenceError, etc.
-                    this.logger.error(err instanceof Error && !(err instanceof KuzzleError)
+                    this.logger.error(err instanceof Error && !(err instanceof errors_1.KuzzleError)
                         ? `${err.message}\n${err.stack}`
                         : err);
-                    if (!this.lastDumpedErrors[errorType] ||
-                        this.lastDumpedErrors[errorType] < now - handledErrors.minInterval) {
+                    const lastDumped = this.lastDumpedErrors[errorType];
+                    if (!lastDumped || lastDumped < now - handledErrors.minInterval) {
                         // simplify error message to use it in folder dump name
-                        let errorMessage = err.message;
-                        if (errorMessage.indexOf("\n") > -1) {
-                            errorMessage = errorMessage.split("\n")[0];
-                        }
-                        errorMessage = errorMessage
+                        //
+                        // `split()[0]` of a string that contains a "\n" is a string; the
+                        // `includes` guard was the only thing saying so.
+                        const errorMessage = err.message.split("\n")[0] ?? err.message;
+                        // The dump generator only accepts `^[A-Za-z0-9_-]{0,64}$` (#2665),
+                        // so the error type is slugified with the message, and the whole
+                        // suffix is capped: an error message is usually longer than that.
+                        const suffix = `handled-${errorType}-${errorMessage}`
                             .toLowerCase()
-                            .replace(/[^a-zA-Z0-9-_]/g, "-")
+                            .replace(/[^a-z0-9-_]/g, "-")
                             .split("-")
                             .filter((value) => value !== "")
-                            .join("-");
-                        global.kuzzle.dump(`handled-${errorType.toLocaleLowerCase()}-${errorMessage}`);
+                            .join("-")
+                            .slice(0, 64);
+                        // Nothing awaits this dump: a failure has to be handled here, or
+                        // it surfaces as an unhandled rejection, which stops Kuzzle in
+                        // development mode.
+                        global.kuzzle.dump(suffix).catch((error) => {
+                            this.logger.error(`Unable to dump after a handled error: ${(0, thrown_1.causeOf)(error).message}`);
+                        });
                     }
                     this.lastDumpedErrors[errorType] = now;
                 }
@@ -374,34 +460,7 @@ class Funnel {
             request.getBoolean("cookieAuth")) {
             throw kerror.get("security", "cookie", "unsupported");
         }
-        let skipTokenVerification = false;
-        // When the Support of Cookie as Authentication Token is enabled we check if an auth token cookie is present
-        // When a request is made with cookieAuth set to true
-        // We try to use the auth token cookie if present as auth token
-        // otherwise check for auth token as input
-        if (request.input.headers && has(request.input.headers, "cookie")) {
-            let cookie;
-            try {
-                cookie = Cookie.parse(request.input.headers.cookie);
-            }
-            catch (error) {
-                throw kerror.get("security", "cookie", "invalid");
-            }
-            // if cookie is present and not null, and a token is present we should throw because we don't know which one to use
-            if (cookie.authToken && cookie.authToken !== "null") {
-                if (!global.kuzzle.config.http.cookieAuthentication) {
-                    throw kerror.get("security", "cookie", "unsupported");
-                }
-                if (request.input.jwt) {
-                    throw kerror.get("security", "token", "verification_error", "Both token and cookie are present, could not decide which one to use");
-                }
-                request.input.jwt = cookie.authToken;
-                skipTokenVerification =
-                    request.getBoolean("cookieAuth") &&
-                        request.input.controller === "auth" &&
-                        SKIP_TOKEN_VERIF_ACTIONS.includes(request.input.action);
-            }
-        }
+        const skipTokenVerification = this._applyCookieAuthToken(request);
         try {
             // If the verification should be skipped, we pass a null token,
             // this way the verification will be made as anonymous
@@ -412,29 +471,78 @@ class Funnel {
             await global.kuzzle.pipe("request:onUnauthorized", request);
             throw error;
         }
-        const userId = request.context.token.userId;
-        request.context.user = await global.kuzzle.ask("core:security:user:get", userId);
+        // `request.context` is a getter, so a check on `request.context.token`
+        // does not narrow the next read of it. Both are read once here instead.
+        const token = request.context.token;
+        const userId = token === null ? null : token.userId;
+        const user = await global.kuzzle.ask("core:security:user:get", userId);
+        request.context.user = user;
         // If we have a token, link the connection with the token,
         // this way the connection can be notified when the token has expired.
-        if (global.kuzzle.config.internal.notifiableProtocols.includes(request.context.connection.protocol)) {
-            global.kuzzle.tokenManager.link(request.context.token, request.context.connection.id);
+        const { id: connectionId, protocol } = request.context.connection;
+        if (token !== null &&
+            connectionId !== null &&
+            protocol !== null &&
+            global.kuzzle.config.internal.notifiableProtocols.includes(protocol)) {
+            global.kuzzle.tokenManager.link(token, connectionId);
         }
-        if (!(await request.context.user.isActionAllowed(request))) {
+        if (!(await user.isActionAllowed(request))) {
             // anonymous user => 401 (Unauthorized) error
             // logged-in user with insufficient permissions => 403 (Forbidden) error
-            const error = kerror.get("security", "rights", userId === "-1" ? "unauthorized" : "forbidden", request.input.controller, request.input.action, request.context.user._id);
+            const error = kerror.get("security", "rights", userId === "-1" ? "unauthorized" : "forbidden", request.input.controller, request.input.action, user._id);
             request.setError(error);
             await global.kuzzle.pipe("request:onUnauthorized", request);
             throw error;
         }
         if (global.kuzzle.config.plugins.common.failsafeMode &&
             !this._isLogin(request) &&
-            !request.context.user.profileIds.includes("admin")) {
+            !user.profileIds.includes("admin")) {
             await global.kuzzle.pipe("request:onUnauthorized", request);
             throw kerror.get("security", "rights", "failsafe_mode_admin_only");
         }
         return global.kuzzle.pipe("request:onAuthorized", request);
     }
+    /**
+     * When cookie authentication is enabled, promotes the request's auth-token
+     * cookie to `request.input.jwt`. Extracted from `checkRights` verbatim.
+     *
+     * @returns whether token verification must be skipped (anonymous check)
+     */
+    _applyCookieAuthToken(request) {
+        // When the Support of Cookie as Authentication Token is enabled we check if an auth token cookie is present
+        // When a request is made with cookieAuth set to true
+        // We try to use the auth token cookie if present as auth token
+        // otherwise check for auth token as input
+        if (!request.input.headers || !(0, safeObject_1.has)(request.input.headers, "cookie")) {
+            return false;
+        }
+        let cookie;
+        try {
+            cookie = Cookie.parse(request.input.headers.cookie);
+        }
+        catch {
+            throw kerror.get("security", "cookie", "invalid");
+        }
+        // if cookie is present and not null, and a token is present we should throw because we don't know which one to use
+        //
+        // `"null"` is the literal string, not a missing value: `auth:logout` used
+        // to clear the cookie by serialising `null` into it. It sends an empty
+        // value now, and this stays for the cookies already in browsers.
+        if (!cookie.authToken || cookie.authToken === "null") {
+            return false;
+        }
+        if (!global.kuzzle.config.http.cookieAuthentication) {
+            throw kerror.get("security", "cookie", "unsupported");
+        }
+        if (request.input.jwt) {
+            throw kerror.get("security", "token", "verification_error", "Both token and cookie are present, could not decide which one to use");
+        }
+        request.input.jwt = cookie.authToken;
+        return (request.getBoolean("cookieAuth") &&
+            request.input.controller === "auth" &&
+            request.input.action !== null &&
+            SKIP_TOKEN_VERIF_ACTIONS.has(request.input.action));
+    }
     _isLogin(request) {
         return (request.input.controller === "auth" && request.input.action === "login");
     }
@@ -451,24 +559,32 @@ class Funnel {
         this.concurrentRequests++;
         let _request = request;
         try {
-            await this._checkSdkVersion(_request);
+            this._checkSdkVersion(_request);
             _request = await global.kuzzle.pipe("request:onExecution", _request);
             _request = await this.performDocumentAlias(_request, "before");
             _request = await global.kuzzle.pipe(this.getEventName(_request, "before"), _request);
-            const responseData = await doAction(controller, _request);
-            _request.setResult(responseData, {
-                status: _request.status === 102 ? 200 : _request.status,
-            });
+            let responseData;
+            try {
+                responseData = await doAction(controller, _request);
+            }
+            catch (e) {
+                // Only here is the error known to come from the controller itself:
+                // `_wrapError` sits downstream of the pipes too and cannot tell the
+                // two apart (TD-27).
+                throw this._wrapControllerError(_request, (0, thrown_1.causeOf)(e));
+            }
+            // No status: a pending 102 becomes 200, any other is kept.
+            _request.response.configure({ result: responseData });
             if (!this.isNativeController(_request.input.controller) &&
                 !_request.response.raw) {
                 // check if the plugin response can be serialized
                 try {
-                    if (!(responseData instanceof HttpStream)) {
+                    if (!(responseData instanceof types_1.HttpStream)) {
                         JSON.stringify(responseData);
                     }
                 }
-                catch (e) {
-                    _request.setResult(null);
+                catch {
+                    _request.response.configure({ result: null, status: 200 });
                     throw kerror.get("plugin", "controller", "unserializable_response");
                 }
             }
@@ -478,7 +594,7 @@ class Funnel {
             global.kuzzle.statistics.completedRequest(_request);
         }
         catch (error) {
-            return this.handleProcessRequestError(_request, _request, error);
+            return this.handleProcessRequestError(_request, _request, (0, thrown_1.causeOf)(error));
         }
         finally {
             this.concurrentRequests--;
@@ -497,16 +613,20 @@ class Funnel {
      */
     async performDocumentAlias(request, prefix) {
         const { controller, action } = request.input;
-        const mustTrigger = controller === "document" &&
-            this.documentEventAliases.mirrorList[action] &&
-            (prefix !== "before" ||
-                !this.documentEventAliases.notBefore.includes(action));
-        if (!mustTrigger) {
+        if (controller !== "document" || action === null) {
             return request;
         }
+        // One lookup: the alias is what decides whether to trigger and what to
+        // name the event, and it was read twice with the table indexed by a
+        // possibly-null action.
         const alias = this.documentEventAliases.mirrorList[action];
+        if (!alias ||
+            (prefix === "before" &&
+                this.documentEventAliases.notBefore.includes(action))) {
+            return request;
+        }
         const event = `${this.documentEventAliases.namespace}:${prefix}${capitalize(alias)}`;
-        const extractor = new DocumentExtractor(request);
+        const extractor = new documentExtractor_1.default(request);
         const documents = await global.kuzzle.pipe(event, extractor.extract(), request);
         return extractor.insert(documents);
     }
@@ -540,7 +660,7 @@ class Funnel {
                     error: error,
                     request: request,
                     result: res,
-                    success: error === undefined ? true : false,
+                    success: error === undefined,
                 });
             }
         }
@@ -548,7 +668,7 @@ class Funnel {
             return await doAction(this.getController(request), request);
         }
         catch (e) {
-            this.handleErrorDump(e);
+            this.handleErrorDump((0, thrown_1.causeOf)(e));
             throw e;
         }
     }
@@ -566,7 +686,7 @@ class Funnel {
             return updated;
         }
         catch (err) {
-            _error = this._wrapError(request, err);
+            _error = this._wrapError(request, (0, thrown_1.causeOf)(err));
         }
         // Handling the error thrown by the error pipe
         modifiedRequest.setError(_error);
@@ -579,7 +699,7 @@ class Funnel {
             return updated;
         }
         catch (err) {
-            throw this._wrapError(request, err);
+            throw this._wrapError(request, (0, thrown_1.causeOf)(err));
         }
     }
     /**
@@ -591,10 +711,9 @@ class Funnel {
      * @returns {string} event name
      */
     getEventName(request, prefix) {
-        const event = request.input.controller === "memoryStorage"
-            ? "ms"
-            : request.input.controller;
-        return `${event}:${prefix}${capitalize(request.input.action)}`;
+        const { action, controller } = targetOf(request);
+        const event = controller === "memoryStorage" ? "ms" : controller;
+        return `${event}:${prefix}${capitalize(action)}`;
     }
     /**
      * Returns the number of remaining requests
@@ -612,13 +731,18 @@ class Funnel {
      * @throws {BadRequestError} If the asked controller or action is unknown
      */
     getController(request) {
-        for (const controllers of [
+        // `BaseController`, not `NativeController`: the second map holds plugin
+        // controllers, which extend the base and not the native one. The narrower
+        // return type described half of what this returns.
+        const controllerMaps = [
             this.controllers,
             global.kuzzle.pluginsManager.controllers,
-        ]) {
-            const controller = controllers.get(request.input.controller);
+        ];
+        const { action, controller: name } = targetOf(request);
+        for (const controllers of controllerMaps) {
+            const controller = controllers.get(name);
             if (controller) {
-                if (controller._isAction(request.input.action)) {
+                if (controller._isAction(action)) {
                     return controller;
                 }
                 throw processError.get("action_not_found", request.input.controller, request.input.action);
@@ -631,8 +755,13 @@ class Funnel {
      * @param  {String}  controller
      * @returns {Boolean}
      */
+    /**
+     * `string | null`: the two callers ask it of `request.input.controller`,
+     * which is null until set. A request naming no controller is not a native
+     * one, which is the answer the map already gave.
+     */
     isNativeController(controller) {
-        return this.controllers.has(controller);
+        return controller !== null && this.controllers.has(controller);
     }
     /**
      * Returns inner metrics from the Funnel
@@ -656,8 +785,8 @@ class Funnel {
         if (!global.kuzzle.config.server.strictSdkVersion) {
             return;
         }
-        const sdkVersion = request.input.volatile && request.input.volatile.sdkVersion;
-        const sdkName = request.input.volatile && request.input.volatile.sdkName;
+        const sdkVersion = request.input.volatile?.sdkVersion;
+        const sdkName = request.input.volatile?.sdkName;
         // sdkVersion property is only used by Kuzzle v1 SDKs
         if (sdkVersion) {
             throw processError.get("incompatible_sdk_version", sdkVersion, "Kuzzle v2");
@@ -665,7 +794,7 @@ class Funnel {
         if (!sdkName || typeof sdkName !== "string") {
             return;
         }
-        const separatorIdx = sdkName.indexOf("@"), name = sdkName.substr(0, separatorIdx), version = sdkName.substr(separatorIdx + 1);
+        const separatorIdx = sdkName.indexOf("@"), name = sdkName.substring(0, separatorIdx), version = sdkName.substring(separatorIdx + 1);
         if (name.length === 0 || version.length === 0) {
             return;
         }
@@ -699,6 +828,34 @@ class Funnel {
         }
         return null;
     }
+    /**
+     * Plays the request at the front of the pending queue.
+     *
+     * @returns whether the loop should carry on — false when the queue has
+     *          nothing playable at its head, when the throttle refuses the
+     *          slot, or when it throws.
+     */
+    _playOnePendingRequest() {
+        const pendingId = this.pendingRequestsQueue.peekFront();
+        const pendingItem = pendingId === undefined
+            ? undefined
+            : this.pendingRequestsById.get(pendingId);
+        // `quantityToInject` is capped by the queue's length, so the queue has an
+        // id and the map has its item. Both were dereferenced on that reasoning.
+        if (pendingItem === undefined) {
+            return false;
+        }
+        try {
+            if (!this.throttle(pendingItem.fn, pendingItem.context, pendingItem.request)) {
+                return false;
+            }
+        }
+        catch {
+            return false;
+        }
+        this.pendingRequestsQueue.shift();
+        return true;
+    }
     /**
      * Background task. Checks if there are any requests in cache, and replay them
      * if Kuzzle is not overloaded anymore,
@@ -706,20 +863,9 @@ class Funnel {
     _playPendingRequests() {
         // If there is room to play bufferized requests, do it now. If not, retry later
         const quantityToInject = Math.min(this.pendingRequestsQueue.length, global.kuzzle.config.limits.concurrentRequests - this.concurrentRequests);
-        if (quantityToInject > 0) {
-            for (let i = 0; i < quantityToInject; i++) {
-                const pendingItem = this.pendingRequestsById.get(this.pendingRequestsQueue.peekFront());
-                try {
-                    if (this.throttle(pendingItem.fn, pendingItem.context, pendingItem.request)) {
-                        this.pendingRequestsQueue.shift();
-                    }
-                    else {
-                        break;
-                    }
-                }
-                catch (error) {
-                    break;
-                }
+        for (let i = 0; i < quantityToInject; i++) {
+            if (!this._playOnePendingRequest()) {
+                break;
             }
         }
         if (this.pendingRequestsQueue.length > 0) {
@@ -738,16 +884,49 @@ class Funnel {
         }
     }
     /**
-     * Eventually wrap an error into a PluginImplementationError
+     * Eventually wrap an error into a PluginImplementationError.
+     *
+     * Everything that reaches this method comes out of a pipe — the error pipes
+     * of `handleProcessRequestError`, or `processRequest`'s own
+     * `request:onExecution` / before / after pipes — i.e. out of plugin code. A
+     * controller's error is wrapped at its source by `_wrapControllerError` and
+     * arrives here already a KuzzleError, so there is nothing left to guard on:
+     * see TD-27 (https://github.com/kuzzleio/kuzzle/issues/2703), which is why
+     * the previous guard on the controller name is gone rather than fixed.
+     *
      * @param  {Request} request
      * @param  {Error} error
      * @returns {KuzzleError}
      */
     _wrapError(request, error) {
-        if (!this.isNativeController(request) && !(error instanceof KuzzleError)) {
-            return kerror.getFrom(error, "plugin", "runtime", "unexpected_error", error.message);
+        if (error instanceof errors_1.KuzzleError) {
+            return error;
+        }
+        return kerror.getFrom(error, "plugin", "runtime", "unexpected_error", error.message);
+    }
+    /**
+     * Normalizes an error thrown by a controller action into a KuzzleError.
+     *
+     * A native controller throwing something that is not a KuzzleError is a
+     * Kuzzle bug, and it is reported as one (`core.fatal.unexpected_error`).
+     * Reporting it as `plugin.runtime.unexpected_error` — which is what happened
+     * for as long as `_wrapError`'s guard was dead — names the wrong culprit,
+     * and letting it through raw is worse still: `KuzzleRequest.setError` then
+     * builds an InternalError with no `id` and no `code`, on a 500 sent to a
+     * client. See TD-27 (https://github.com/kuzzleio/kuzzle/issues/2703).
+     *
+     * @param  {Request} request
+     * @param  {Error} error
+     * @returns {KuzzleError}
+     */
+    _wrapControllerError(request, error) {
+        if (error instanceof errors_1.KuzzleError) {
+            return error;
         }
-        return error;
+        const [domain, subdomain] = this.isNativeController(request.input.controller)
+            ? ["core", "fatal"]
+            : ["plugin", "runtime"];
+        return kerror.getFrom(error, domain, subdomain, "unexpected_error", error.message);
     }
     /**
      * Verifies if requests sent from a specific origin are allowed
@@ -762,17 +941,27 @@ class Funnel {
         if (global.kuzzle.config.internal.allowAllOrigins) {
             return true;
         }
+        const allowed = loadedOrigins(httpConfig);
         if (httpConfig.accessControlAllowOriginUseRegExp) {
-            for (const re of httpConfig.accessControlAllowOrigin) {
+            for (const re of allowed) {
                 if (re.test(origin)) {
                     return true;
                 }
             }
             return false;
         }
-        return httpConfig.accessControlAllowOrigin.includes(origin);
+        return allowed.includes(origin);
     }
 }
+/**
+ * What `http.accessControlAllowOrigin` holds once the configuration is
+ * loaded. It is declared `string` (see HttpConfiguration); the parameter's
+ * wider type is what lets the caller say so without a cast, and without the
+ * narrowing an annotated local would get from its initializer.
+ */
+function loadedOrigins(httpConfig) {
+    return httpConfig.accessControlAllowOrigin;
+}
 /**
  * @param {string} string
  * @returns {string}
@@ -792,8 +981,21 @@ function capitalize(string) {
  * @returns {Promise}
  */
 function doAction(controller, request) {
-    const ret = controller[request.input.action](request);
-    if (!ret || typeof ret.then !== "function") {
+    // `Reflect.apply(Reflect.get(...))`, not `controller[action](...)`: the
+    // action is a runtime-built key and `BaseController` deliberately has no
+    // index signature (TD-28). `apply` rather than calling the result of `get`
+    // keeps the receiver — losing it is the exact bug sprint 5's Build and Run
+    // job caught.
+    const { action } = targetOf(request);
+    const ret = Reflect.apply(Reflect.get(controller, action), controller, [
+        request,
+    ]);
+    // Same duck-type check as before, spelled so it narrows: a truthy non-object
+    // used to reach `ret.then` and read `undefined`, which took this branch too.
+    if (!ret ||
+        typeof ret !== "object" ||
+        !("then" in ret) ||
+        typeof ret.then !== "function") {
         return kerror.reject("plugin", "controller", "invalid_action_response", request.input.controller, request.input.action);
     }
     return ret;
@@ -809,11 +1011,20 @@ function doAction(controller, request) {
  */
 function satisfiesMajor(version, requirements) {
     let maxRequirement = true, minRequirement = true;
+    // The major digit. A version string with none satisfies no requirement,
+    // either way round — `undefined >= "2"` and `undefined <= "2"` are both
+    // false, because a relational comparison against `undefined` is NaN. That
+    // is what the explicit check preserves; defaulting the digit to `""` would
+    // have turned a string comparison on, and an empty version would then
+    // satisfy every `max`.
+    const major = version[0];
     if (requirements.min) {
-        minRequirement = version[0] >= requirements.min.toString();
+        minRequirement =
+            major !== undefined && major >= requirements.min.toString();
     }
     if (requirements.max) {
-        maxRequirement = version[0] <= requirements.max.toString();
+        maxRequirement =
+            major !== undefined && major <= requirements.max.toString();
     }
     return maxRequirement && minRequirement;
 }