kuzzle 2.59.0 → 2.60.0-beta.2

package/dist/lib/kuzzle/dumpGenerator.js

@@ -35,13 +35,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };

package/dist/lib/kuzzle/event/KuzzleEventEmitter.d.ts

@@ -39,7 +39,7 @@ declare class KuzzleEventEmitter extends EventEmitter {
      *
      * @warning Critical section of code
      */
-    emit(event: string | symbol, ...args: any[]): boolean;
+    emit(event: string | symbol, ...args: unknown[]): boolean;
     /**
      * Emits a pipe event, which triggers the following, in that order:
      * 1. Plugin pipes are invoked one after another (waterfall). Each plugin must
@@ -59,11 +59,11 @@ declare class KuzzleEventEmitter extends EventEmitter {
     /**
      * Emits an "ask" event to get information about the provided payload
      */
-    ask<TAskEventDefinition extends AskEventDefinition = AskEventDefinition>(event: TAskEventDefinition["name"], ...args: [payload?: TAskEventDefinition["payload"], ...rest: any]): Promise<TAskEventDefinition["result"]>;
+    ask<TAskEventDefinition extends AskEventDefinition = AskEventDefinition>(event: TAskEventDefinition["name"], ...args: [payload?: TAskEventDefinition["payload"], ...rest: unknown[]]): Promise<TAskEventDefinition["result"]>;
     /**
      * Calls a callback to get information about the provided payload
      */
-    call<TAskEventDefinition extends AskEventDefinition = AskEventDefinition>(event: TAskEventDefinition["name"], ...args: [payload?: TAskEventDefinition["payload"], ...rest: any]): TAskEventDefinition["result"];
+    call<TAskEventDefinition extends AskEventDefinition = AskEventDefinition>(event: TAskEventDefinition["name"], ...args: [payload?: TAskEventDefinition["payload"], ...rest: unknown[]]): TAskEventDefinition["result"];
     /**
      * Registers a plugin hook.
      * Catch any error in the handler and emit the hook:onError event.

package/dist/lib/kuzzle/event/KuzzleEventEmitter.js

@@ -35,13 +35,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };

package/dist/lib/kuzzle/event/pipeRunner.js

@@ -35,13 +35,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };

package/dist/lib/kuzzle/internalIndexHandler.js

@@ -35,13 +35,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -52,7 +62,7 @@ const storeScopeEnum_1 = require("../core/storage/storeScopeEnum");
 const specification_1 = require("../core/validation/specification");
 const kerror = __importStar(require("../kerror"));
 const debug_1 = __importDefault(require("../util/debug"));
-const mutex_1 = require("../util/mutex"); // NOSONAR: see init()
+const distributedLock_1 = require("../util/distributedLock");
 const debug = (0, debug_1.default)("kuzzle:bootstrap:internalIndex");
 const securitiesBootstrap = {
     profiles: {
@@ -112,32 +122,27 @@ class InternalIndexHandler extends store_1.Store {
     }
     async init() {
         await super.init(this.config.collections);
-        // NOSONAR: `Mutex` is deprecated in favour of `withLock`, but the two use
-        // incompatible acquisition/TTL formats and must not contend on the same
-        // key — swapping it is a behaviour change, deferred to #2894.
-        const lockOptions = { timeout: -1, ttl: 30000 };
-        const mutex = new mutex_1.Mutex("InternalIndexBootstrap", lockOptions); // NOSONAR
-        await mutex.lock();
-        try {
-            const bootstrapped = await this.exists("config", this._BOOTSTRAP_DONE_ID);
-            if (bootstrapped) {
-                await this._initSecret();
-                return;
+        // No retry limit: the node holding it is bootstrapping the internal
+        // index, and this one cannot start before that is done
+        await (0, distributedLock_1.withLock)("InternalIndexBootstrap", async () => {
+            try {
+                const bootstrapped = await this.exists("config", this._BOOTSTRAP_DONE_ID);
+                if (bootstrapped) {
+                    await this._initSecret();
+                    return;
+                }
+                await bluebird_1.default.resolve(this._bootstrapSequence()).timeout(this.timeout);
+                await this.create("config", { timestamp: Date.now() }, {
+                    id: this._BOOTSTRAP_DONE_ID,
+                });
             }
-            await bluebird_1.default.resolve(this._bootstrapSequence()).timeout(this.timeout);
-            await this.create("config", { timestamp: Date.now() }, {
-                id: this._BOOTSTRAP_DONE_ID,
-            });
-        }
-        catch (error) {
-            if (error instanceof bluebird_1.default.TimeoutError) {
-                throw kerror.get("services", "storage", "bootstrap_timeout", "internalIndex");
+            catch (error) {
+                if (error instanceof bluebird_1.default.TimeoutError) {
+                    throw kerror.get("services", "storage", "bootstrap_timeout", "internalIndex");
+                }
+                throw error;
             }
-            throw error;
-        }
-        finally {
-            await mutex.unlock();
-        }
+        }, { retryAttempts: Number.POSITIVE_INFINITY, ttl: 30000 });
     }
     /**
      * @override

package/dist/lib/kuzzle/kuzzle.d.ts

@@ -95,8 +95,12 @@ declare class Kuzzle extends KuzzleEventEmitter {
      * @param {Object} - Additional options (import, installations, plugins, secretsFile, support, vaultKey)
      *
      * @this {Kuzzle}
+     *
+     * The public signature takes `unknown`, which every call that compiled with
+     * v2.56.0's `any` still satisfies. `Backend.start()` is the one caller, and
+     * it hands the application wrapper the implementation reads.
      */
-    start(application: any, options?: StartOptions): Promise<void>;
+    start(application: unknown, options?: StartOptions): Promise<void>;
     /**
      * Generates the node ID.
      *
@@ -121,18 +125,19 @@ declare class Kuzzle extends KuzzleEventEmitter {
      * @returns {Promise<void>}
      */
     install(installations?: InstallationConfig[]): Promise<void>;
-    ask(event: string, ...args: [payload?: any, ...rest: any]): Promise<any>;
-    emit(event: string, ...args: any[]): boolean;
-    pipe(event: string, ...args: any[]): Promise<any>;
+    ask(event: string, ...args: [payload?: unknown, ...rest: unknown[]]): Promise<any>;
+    emit(event: string, ...args: unknown[]): boolean;
+    pipe(event: string, ...args: unknown[]): Promise<any>;
     private importUserMappings;
     private importMappings;
     private importFixtures;
     private importPermissions;
+    private isConfigsEmpty;
     /**
-     * Check if every import has been done, if one of them is not finished yet, wait for it
+     * Records the hash of the payload just imported (or found already imported)
+     * in both Redis and `%kuzzle.imports`, so that the next node or the next
+     * start can tell the import is done for this very payload
      */
-    private _waitForImportToFinish;
-    private isConfigsEmpty;
     private persistHashedImport;
     /**
      * Load into the app several imports
@@ -144,7 +149,7 @@ declare class Kuzzle extends KuzzleEventEmitter {
      */
     loadInitialState(toImport?: ImportConfig, toSupport?: SupportConfig): Promise<void>;
     dump(suffix: string): Promise<string>;
-    hash(input: any): number;
+    hash(input: unknown): number;
     get state(): kuzzleStateEnum;
     set state(value: kuzzleStateEnum);
     /**

package/dist/lib/kuzzle/kuzzle.js

@@ -35,13 +35,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -73,6 +83,7 @@ const validation_1 = __importDefault(require("../core/validation/validation"));
 const kerror = __importStar(require("../kerror"));
 const asyncStore_1 = __importDefault(require("../util/asyncStore"));
 const crypto_1 = require("../util/crypto");
+const distributedLock_1 = require("../util/distributedLock");
 const mutex_1 = require("../util/mutex");
 const dumpGenerator_1 = __importDefault(require("./dumpGenerator"));
 const KuzzleEventEmitter_1 = __importDefault(require("./event/KuzzleEventEmitter"));
@@ -138,15 +149,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             userMappings: this.importUserMappings.bind(this),
         };
     }
-    /**
-     * Initializes all the needed components of Kuzzle.
-     *
-     * @param {Application} - Application Plugin instance
-     * @param {Object} - Additional options (import, installations, plugins, secretsFile, support, vaultKey)
-     *
-     * @this {Kuzzle}
-     */
-    async start(application, options = { import: {} }) {
+    async start(application, options) {
         this.registerSignalHandlers();
         try {
             this.log.info(`[ℹ] Starting Kuzzle ${this.version} ...`);
@@ -164,7 +167,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             await new security_1.default().init();
             // This will init the cluster module if enabled
             await this.initKuzzleNode();
-            this.vault = vault_1.default.load(options.vaultKey, options.secretsFile, this.config.vault?.newAlgorithm);
+            this.vault = vault_1.default.load(options?.vaultKey, options?.secretsFile, this.config.vault?.newAlgorithm);
             this.validation.init();
             await this.tokenManager.init();
             await this.funnel.init();
@@ -175,15 +178,15 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             await this.entryPoint.init();
             await this.debugger.init();
             this.pluginsManager.application = application;
-            const pluginImports = await this.pluginsManager.init(options.plugins);
-            const imports = lodash_1.default.merge({}, pluginImports, options.import);
+            const pluginImports = await this.pluginsManager.init(options?.plugins);
+            const imports = lodash_1.default.merge({}, pluginImports, options?.import);
             // Authentification plugins must be loaded before users import to avoid
             // credentials related error which would prevent Kuzzle from starting
-            await this.loadInitialState(imports, options.support);
+            await this.loadInitialState(imports, options?.support);
             await this.ask("core:security:verify");
             this.router.init();
             this.log.info("[✔] Core components loaded");
-            await this.install(options.installations);
+            await this.install(options?.installations);
             // `application` is the very wrapper handed to the plugins manager six
             // lines up, so reading the name back off the manager was a round trip
             // through a getter that can answer `undefined`.
@@ -241,7 +244,10 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         }
         // The other nodes may be waiting on a lock this one holds: a node leaving
         // mid-startup is often in the middle of one (F-13).
-        await mutex_1.Mutex.releaseAllBeforeExit(); // NOSONAR: frees locks taken through the deprecated API
+        await Promise.all([
+            (0, distributedLock_1.releaseAllLocksBeforeExit)(),
+            mutex_1.Mutex.releaseAllBeforeExit(), // NOSONAR: frees locks taken through the deprecated API
+        ]);
         this.log.info("Halted.");
         // flush both application and Kuzzle core loggers before leaving (Could happen even if some core/application components are not initialized)
         await this?.log?.flush?.();
@@ -266,9 +272,9 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         if (!installations?.length) {
             return;
         }
-        const mutex = new mutex_1.Mutex("backend:installations");
-        await mutex.lock();
-        try {
+        // No retry limit: another node is running the installations, and this
+        // one must not start before they are recorded
+        await (0, distributedLock_1.withLock)("backend:installations", async () => {
             for (const installation of installations) {
                 const isAlreadyInstalled = await this.ask("core:storage:private:document:exist", "kuzzle", "installations", installation.id);
                 if (!isAlreadyInstalled) {
@@ -286,10 +292,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
                     this.log.info(`[✔] Install code "${installation.id}" successfully executed`);
                 }
             }
-        }
-        finally {
-            await mutex.unlock();
-        }
+        }, { retryAttempts: Number.POSITIVE_INFINITY });
     }
     // For testing purpose
     async ask(event, ...args) {
@@ -322,11 +325,8 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         }
         else if (!lodash_1.default.isEmpty(toSupport.mappings)) {
             await this.ask("core:storage:public:mappings:import", toSupport.mappings, {
-                /**
-                 * If it's the first time the mapping are loaded and another node is already importing the mapping into the database
-                 * we just want to load the mapping in our own index cache and not in the database.
-                 */
-                indexCacheOnly: status.initialized || !status.locked,
+                // Already imported (by this node or another one): only fill the cache
+                indexCacheOnly: status.initialized,
                 propagate: false, // Each node needs to do the import themselves
                 rawMappings: true,
                 refresh: true,
@@ -335,11 +335,8 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         }
         else if (!lodash_1.default.isEmpty(toImport.mappings)) {
             await this.ask("core:storage:public:mappings:import", toImport.mappings, {
-                /**
-                 * If it's the first time the mapping are loaded and another node is already importing the mapping into the database
-                 * we just want to load the mapping in our own index cache and not in the database.
-                 */
-                indexCacheOnly: status.initialized || !status.locked,
+                // Already imported (by this node or another one): only fill the cache
+                indexCacheOnly: status.initialized,
                 propagate: false, // Each node needs to do the import themselves
                 refresh: true,
             });
@@ -392,19 +389,6 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             this.log.info("[✔] Permissions import successful");
         }
     }
-    /**
-     * Check if every import has been done, if one of them is not finished yet, wait for it
-     */
-    async _waitForImportToFinish() {
-        const importTypes = Object.keys(this.importTypes);
-        for (const importType of importTypes) {
-            // If the import is done, we pop it from the queue to check the next one
-            if (await this.ask("core:cache:internal:get", `backend:init:import:${importType}`)) {
-                return;
-            }
-            await bluebird_1.default.delay(1000);
-        }
-    }
     isConfigsEmpty(importConfig, supportConfig) {
         if (lodash_1.default.isEmpty(importConfig.mappings) &&
             lodash_1.default.isEmpty(importConfig.profiles) &&
@@ -418,10 +402,16 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         }
         return false;
     }
-    async persistHashedImport({ existingRedisHash, existingESHash, importPayloadHash, type, }) {
-        if (!existingRedisHash && !existingESHash) {
-            // If the import is not initialized in the redis cache and in the ES, we initialize it
-            this.log.info(`${type} import is not initialized, initializing...`);
+    /**
+     * Records the hash of the payload just imported (or found already imported)
+     * in both Redis and `%kuzzle.imports`, so that the next node or the next
+     * start can tell the import is done for this very payload
+     */
+    async persistHashedImport({ existingRedisHash, existingESHash, importPayloadHash, initialized, type, }) {
+        // Not initialized: the payload was just imported, and a hash left by a
+        // previous payload must be replaced, or every start would import it again
+        if (!initialized || !existingESHash) {
+            this.log.info(`Recording the ${type} import in %kuzzle.imports...`);
             // `createOrReplace`, not `create`: this document has a fixed id, so a
             // conflict on it means another node initialized the same import — an
             // outcome to converge on, not an error to die on. `create` made that
@@ -429,24 +419,9 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             await this.ask("core:storage:private:document:createOrReplace", "kuzzle", "imports", `backend:init:import:${type}`, {
                 hash: importPayloadHash,
             });
-            await this.ask("core:cache:internal:store", `backend:init:import:${type}`, importPayloadHash);
         }
-        else if (existingRedisHash && !existingESHash) {
-            // If the import is initialized in the redis cache but not in the ES
-            // We initialize it in the ES
-            this.log.info(`${type} import is not initialized in %kuzzle.imports, initializing...`);
-            const redisCache = await this.ask("core:cache:internal:get", `backend:init:import:${type}`);
-            // Same reasoning as above: a fixed id, so a conflict is convergence.
-            await this.ask("core:storage:private:document:createOrReplace", "kuzzle", "imports", `backend:init:import:${type}`, {
-                hash: redisCache,
-            });
-        }
-        else if (!existingRedisHash && existingESHash) {
-            // If the import is initialized in the ES but not in the redis cache
-            // We initialize it in the redis cache
-            this.log.info(`${type} import is not initialized in the redis cache, initializing...`);
-            const esDocument = await this.ask("core:storage:private:document:get", "kuzzle", "imports", `backend:init:import:${type}`);
-            await this.ask("core:cache:internal:store", `backend:init:import:${type}`, esDocument._source.hash);
+        if (!initialized || !existingRedisHash) {
+            await this.ask("core:cache:internal:store", `backend:init:import:${type}`, importPayloadHash);
         }
     }
     /**
@@ -461,42 +436,37 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         if (this.isConfigsEmpty(toImport, toSupport)) {
             return;
         }
-        const lockedMutex = [];
-        try {
-            for (const [type, importMethod] of Object.entries(this.importTypes)) {
-                const importPayload = {};
-                switch (type) {
-                    case "fixtures":
-                        lodash_1.default.set(importPayload, "toSupport.fixtures", toSupport.fixtures);
-                        break;
-                    case "mappings":
-                        lodash_1.default.set(importPayload, "toSupport.mappings", toSupport.mappings);
-                        lodash_1.default.set(importPayload, "toImport.mappings", toImport.mappings);
-                        break;
-                    case "permissions":
-                        lodash_1.default.set(importPayload, "toSupport.securities", toSupport.securities);
-                        lodash_1.default.set(importPayload, "toImport.profiles", toImport.profiles);
-                        lodash_1.default.set(importPayload, "toImport.roles", toImport.roles);
-                        lodash_1.default.set(importPayload, "toImport.users", toImport.users);
-                        break;
-                }
-                // `?? ""`: `json-stable-stringify` answers undefined for a value it
-                // cannot serialise, and the payload is built right above.
-                const importPayloadHash = (0, crypto_1.sha256)((0, json_stable_stringify_1.default)(importPayload) ?? "");
-                // `timeout: 0` means a single acquisition attempt: exactly one node
-                // runs the import and the others carry on with `locked: false`.
-                // The TTL has to outlive the import itself, because this lock is held
-                // until the `finally` below — across every import type and the wait
-                // that follows. It is still an upper bound rather than a guarantee,
-                // which is why the bookkeeping write below is idempotent (TD-69).
-                // NOSONAR: `Mutex` is deprecated in favour of `withLock`, but the two
-                // use incompatible acquisition/TTL formats and must not contend on the
-                // same key — every other node still takes this lock with `Mutex`, so
-                // swapping one site would remove the exclusion it exists for. Deferred
-                // to #2894, like the remaining call sites.
-                const lockOptions = { timeout: 0, ttl: 60000 };
-                const mutex = new mutex_1.Mutex(`backend:import:${type}`, lockOptions); // NOSONAR
-                const locked = await mutex.lock();
+        const importTypes = Object.entries(this.importTypes);
+        // Imports the types from `index` on. Each type's lock is taken around the
+        // remaining types, so that every lock taken is held until all the imports
+        // are done: a node waiting for the first lock starts only once the node
+        // ahead of it has imported everything.
+        const importFrom = async (index) => {
+            const next = importTypes[index];
+            if (!next) {
+                return;
+            }
+            const [type, importMethod] = next;
+            const importPayload = {};
+            switch (type) {
+                case "fixtures":
+                    lodash_1.default.set(importPayload, "toSupport.fixtures", toSupport.fixtures);
+                    break;
+                case "mappings":
+                    lodash_1.default.set(importPayload, "toSupport.mappings", toSupport.mappings);
+                    lodash_1.default.set(importPayload, "toImport.mappings", toImport.mappings);
+                    break;
+                case "permissions":
+                    lodash_1.default.set(importPayload, "toSupport.securities", toSupport.securities);
+                    lodash_1.default.set(importPayload, "toImport.profiles", toImport.profiles);
+                    lodash_1.default.set(importPayload, "toImport.roles", toImport.roles);
+                    lodash_1.default.set(importPayload, "toImport.users", toImport.users);
+                    break;
+            }
+            // `?? ""`: `json-stable-stringify` answers undefined for a value it
+            // cannot serialise, and the payload is built right above.
+            const importPayloadHash = (0, crypto_1.sha256)((0, json_stable_stringify_1.default)(importPayload) ?? "");
+            const importType = async () => {
                 // Read the bookkeeping *after* the lock, never before: a read taken
                 // before acquiring it is not protected by it, and the holder that
                 // acted on a stale "not initialized" used to create a document the
@@ -515,26 +485,31 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
                     initialized = esDocument._source.hash === importPayloadHash;
                 }
                 await importMethod({ toImport, toSupport }, {
-                    firstCall: !initialized && locked,
-                    initialized: initialized,
-                    locked,
+                    firstCall: !initialized,
+                    initialized,
                 });
-                if (locked) {
-                    lockedMutex.push(mutex);
-                    await this.persistHashedImport({
-                        existingESHash,
-                        existingRedisHash,
-                        importPayloadHash,
-                        type,
-                    });
-                }
-            }
-            await this._waitForImportToFinish();
-            this.log.info("[✔] Import successful");
-        }
-        finally {
-            await Promise.all(lockedMutex.map((mutex) => mutex.unlock()));
-        }
+                await this.persistHashedImport({
+                    existingESHash,
+                    existingRedisHash,
+                    importPayloadHash,
+                    initialized,
+                    type,
+                });
+                await importFrom(index + 1);
+            };
+            // No retry limit: the node holding it is running this import, and this
+            // one must not start before it is done. Once it gets the lock, it finds
+            // the import done for this payload and only fills its cache; if the
+            // node ahead died mid-import, it runs the import itself. The lock is
+            // refreshed while held; a lost lock fails the startup with
+            // `MutexLockLostError` (the bookkeeping write stays idempotent, TD-69).
+            await (0, distributedLock_1.withLock)(`backend:import:${type}`, importType, {
+                retryAttempts: Number.POSITIVE_INFINITY,
+                ttl: 60000,
+            });
+        };
+        await importFrom(0);
+        this.log.info("[✔] Import successful");
     }
     dump(suffix) {
         return this.dumpGenerator.dump(suffix);

package/dist/lib/model/security/profile.js

@@ -35,13 +35,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };