kuzzle 2.60.0-beta.2 → 2.60.0-beta.4

package/dist/bin/start-kuzzle-server

@@ -69,6 +69,7 @@ const helpers_1 = require("yargs/helpers");
  * own `main`. Keep it that way.
  */
 const index_1 = require("../index");
+const exitOnFailure_1 = require("../lib/kuzzle/exitOnFailure");
 /**
  * Parses one of the JSON files the command line points at. The type parameter
  * is a *claim about the file*, not a check: `JSON.parse` answers `any` and this
@@ -226,7 +227,7 @@ const run = async () => {
     }
     catch (error) {
         console.error(`[x] [ERROR] ${error instanceof Error ? error.stack : String(error)}`);
-        process.exit(1);
+        await (0, exitOnFailure_1.exitOnFailure)();
     }
 };
 run();

package/dist/lib/api/controllers/documentController.d.ts

@@ -77,7 +77,7 @@ declare class DocumentController extends NativeController {
         errors: any;
         successes: any;
     }>;
-    export(request: KuzzleRequest): Promise<import("../../..").HttpStream>;
+    export(request: KuzzleRequest): Promise<import("../../types").HttpStream>;
     /**
      * @param {Request} request
      * @returns {Promise<Object>}

package/dist/lib/cluster/command.d.ts

@@ -21,6 +21,8 @@ type CommandingNode = {
     };
     ip: string;
     nodeId: string;
+    /** Whether `nodeId` can be read: false until the handshake sets it. */
+    hasNodeId: boolean;
     activity: Activity[];
     /** Only `serialize()`: the command layer never mutates the state. */
     fullState: {
@@ -102,6 +104,11 @@ declare class ClusterCommand {
      * This method can (and should) never return a rejected promise.
      */
     listen(): Promise<void>;
+    /**
+     * Answers one request. Every request gets exactly one reply: REP/REQ
+     * requires it, and a request left unanswered wedges the peer's socket.
+     */
+    private answer;
     /**
      * Closes opened sockets and marks this server as closed.
      */

package/dist/lib/cluster/command.js

@@ -159,32 +159,9 @@ class ClusterCommand {
         while (this.state === stateEnum.RUNNING) {
             try {
                 const [type, data] = await this.server.receive();
-                // A REQ frame carries a topic and, for a handshake, a payload. A
-                // request missing either is answered with DISCARDED, which is what
-                // this socket owes every REQ — the two frames were read unchecked.
-                switch (type?.toString()) {
-                    case commandMessages_1.commandTopic.FULLSTATE:
-                        await this.sendFullState();
-                        break;
-                    case commandMessages_1.commandTopic.HANDSHAKE:
-                        if (data === undefined) {
-                            await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
-                            break;
-                        }
-                        await this.handleHandshake(data);
-                        break;
-                    case commandMessages_1.commandTopic.RETRANSMIT:
-                        if (data === undefined) {
-                            await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
-                            break;
-                        }
-                        await this.handleRetransmit(data);
-                        break;
-                    default:
-                        // REP/REQ sockets expect a reply to each request made, so we have
-                        // to send some kind of response on an invalid request received
-                        await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
-                }
+                // NOSONAR (S9382): a REP socket strictly alternates receive and send,
+                // so a request must be answered before the next one can be read.
+                await this.answer(type, data); // NOSONAR
             }
             catch (e) {
                 if (this.state !== stateEnum.CLOSED) {
@@ -193,6 +170,47 @@ class ClusterCommand {
             }
         }
     }
+    /**
+     * Answers one request. Every request gets exactly one reply: REP/REQ
+     * requires it, and a request left unanswered wedges the peer's socket.
+     */
+    async answer(type, data) {
+        // The socket is bound before the handshake sets this node's id, and a
+        // peer still talking to a dead node on this IP can reach it (#3031). A
+        // node with no id yet has no state to serve and cannot take a peer in:
+        // every request is answered DISCARDED, which the requester treats as no
+        // answer.
+        if (!this.node.hasNodeId) {
+            await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
+            return;
+        }
+        // A REQ frame carries a topic and, for a handshake, a payload. A request
+        // missing either is answered with DISCARDED, which is what this socket
+        // owes every REQ — the two frames were read unchecked.
+        switch (type?.toString()) {
+            case commandMessages_1.commandTopic.FULLSTATE:
+                await this.sendFullState();
+                break;
+            case commandMessages_1.commandTopic.HANDSHAKE:
+                if (data === undefined) {
+                    await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
+                    break;
+                }
+                await this.handleHandshake(data);
+                break;
+            case commandMessages_1.commandTopic.RETRANSMIT:
+                if (data === undefined) {
+                    await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
+                    break;
+                }
+                await this.handleRetransmit(data);
+                break;
+            default:
+                // REP/REQ sockets expect a reply to each request made, so we have
+                // to send some kind of response on an invalid request received
+                await this.server.send([commandMessages_1.commandTopic.DISCARDED, null]);
+        }
+    }
     /**
      * Closes opened sockets and marks this server as closed.
      */
@@ -339,7 +357,19 @@ class ClusterCommand {
             // No payload message for a full state request
             await req.send([commandMessages_1.commandTopic.FULLSTATE, null]);
             try {
-                [, fullState = null] = await req.receive();
+                // NOSONAR (S9382): one node at a time by design, the loop stops at
+                // the first one that serves a full state.
+                const [topic, payload] = await req.receive(); // NOSONAR
+                // DISCARDED carries an empty frame, which would decode as an empty
+                // full state: a node that cannot serve one (#3031) is skipped like
+                // one that does not answer.
+                if (topic?.toString() === commandMessages_1.commandTopic.FULLSTATE && payload) {
+                    fullState = payload;
+                }
+                else {
+                    this.logger.warn(`Unable to fetch a full state from node ${id} (request discarded)`);
+                    idx = (idx + 1) % nodes.length;
+                }
             }
             catch {
                 // no response from the remote node in a timely fashion... retrying
@@ -403,7 +433,16 @@ class ClusterCommand {
         await req.send([commandMessages_1.commandTopic.HANDSHAKE, payload]);
         let response = null;
         try {
-            [, response = null] = await req.receive();
+            const [topic, answer] = await req.receive();
+            // DISCARDED carries an empty frame, which would decode as a handshake
+            // answer with nothing in it: a node that refused the handshake (#3031)
+            // is one that did not answer.
+            if (topic?.toString() === commandMessages_1.commandTopic.HANDSHAKE && answer) {
+                response = answer;
+            }
+            else {
+                this.logger.warn(`Couldn't complete handshake with node ${id}: request discarded`);
+            }
         }
         catch {
             this.logger.warn(`Couldn't complete handshake with node ${id}: no response received`);

package/dist/lib/cluster/idCardHandler.d.ts

@@ -87,6 +87,10 @@ export declare class ClusterIdCardHandler {
     private disposed;
     private readonly logger;
     constructor(node: ClusterNode);
+    /**
+     * How long an ID card outlives the last renewal of its node, in ms
+     */
+    get ttl(): number;
     /**
      * Generates and reserves a unique ID for this node instance.
      * Makes sure that the ID is not already taken by another node instance.

package/dist/lib/cluster/idCardHandler.js

@@ -94,6 +94,12 @@ class ClusterIdCardHandler {
         this.ip = node.ip;
         this.refreshDelay = node.heartbeatDelay;
     }
+    /**
+     * How long an ID card outlives the last renewal of its node, in ms
+     */
+    get ttl() {
+        return this.refreshDelay * this.refreshMultiplier;
+    }
     /**
      * Generates and reserves a unique ID for this node instance.
      * Makes sure that the ID is not already taken by another node instance.
@@ -139,7 +145,8 @@ class ClusterIdCardHandler {
         const refreshWorker = this.constructWorker(`${__dirname}/workers/IDCardRenewer${(0, node_path_1.extname)(__filename)}`);
         this.refreshWorker = refreshWorker;
         refreshWorker.on("message", async (message) => {
-            if (message.error) {
+            // A renewal racing the disposal finds the card deleted: not a failure
+            if (message.error && !this.disposed) {
                 await this.node.evictSelf(message.error);
             }
         });
@@ -228,6 +235,20 @@ class ClusterIdCardHandler {
                 // It could happens that the worker has been killed before the dispose causing send to fail
             }
         }
+        clearInterval(this.refreshTimer ?? undefined);
+        this.refreshTimer = null;
+        // The worker deletes the card too, but nothing waits for it: the process
+        // usually exits first, and the card then outlives it by a TTL, long
+        // enough for a node restarted on this IP to take it for a live duplicate
+        if (this.nodeIdKey !== null) {
+            try {
+                await global.kuzzle.ask("core:cache:internal:del", this.nodeIdKey);
+                await global.kuzzle.ask("core:cache:internal:execute", "srem", REDIS_ID_CARDS_INDEX, this.nodeIdKey);
+            }
+            catch (error) {
+                this.logger.warn(`Could not delete the ID card ${this.nodeIdKey}: it expires in ${this.ttl}ms (${error instanceof Error ? error.message : String(error)})`);
+            }
+        }
     }
     /**
      * Retrieves the ID cards from other nodes
@@ -309,7 +330,7 @@ class ClusterIdCardHandler {
         if (!this.idCard) {
             return false;
         }
-        return global.kuzzle.ask("core:cache:internal:store", this.nodeIdKey, JSON.stringify(this.idCard.serialize()), { onlyIfNew: creation, ttl: this.refreshDelay * this.refreshMultiplier });
+        return global.kuzzle.ask("core:cache:internal:store", this.nodeIdKey, JSON.stringify(this.idCard.serialize()), { onlyIfNew: creation, ttl: this.ttl });
     }
 }
 exports.ClusterIdCardHandler = ClusterIdCardHandler;

package/dist/lib/cluster/node.d.ts

@@ -41,10 +41,21 @@ declare class ClusterNode {
      * The id of the ID card this node reserved during `handshake()`.
      *
      * Null until the handshake gets that far, and read as a `string` at
-     * seventeen sites here plus `subscriber.ts` and `command.ts` — all of which
-     * run after it. The accessor says once where that can fail.
+     * seventeen sites here plus `subscriber.ts` and `command.ts`. The accessor
+     * says once where that can fail: an internal read before the handshake is a
+     * bug, and it throws.
+     *
+     * Network input is not internal: the command socket is bound before the
+     * handshake, and a node restarted on the IP of a dead one can be reached by
+     * peers still talking to that dead node (#3031). The paths network input
+     * reaches check `hasNodeId` first.
      */
     get nodeId(): string;
+    /**
+     * Whether the handshake has set this node's id yet: the non-throwing check
+     * for the paths network input reaches before it has (#3031).
+     */
+    get hasNodeId(): boolean;
     set nodeId(id: string);
     private heartbeatTimer;
     readonly idCardHandler: ClusterIdCardHandler;
@@ -143,16 +154,28 @@ declare class ClusterNode {
      *
      * Extracted from `handshake()` unchanged.
      *
-     * @returns false when the caller must stop — the cluster is split and this
-     *          node is shutting down
+     * @throws {cluster.join.full_state_unavailable} on the second failure: the
+     *         cluster is split
      */
     private retryFullState;
+    /**
+     * The ID cards of the other nodes, none of which has this node's IP.
+     *
+     * A card with this IP may be the stale one of a previous run of this node
+     * (a process killed, a container restarted at once): it expires within a
+     * TTL, so it is only a real duplicate if it is still there after that.
+     *
+     * @throws {cluster.join.duplicate_ip} if it is
+     */
+    private discoverNodes;
     /**
      * Discovers other active nodes from the cluster and, if other nodes exist,
      * starts a handshake procedure to sync this node and to make it able to
      * handle new client requests
      *
-     * @return {void}
+     * Rejects with a `cluster.join.*` error, and shuts the node down, when it
+     * cannot join: the node must not go on starting as if it had (a duplicate
+     * IP, a split cluster, `joinTimeout` reached).
      */
     handshake(): Promise<void>;
     /**

package/dist/lib/cluster/node.js

@@ -19,6 +19,39 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -37,6 +70,8 @@ const eventemitter3_1 = __importDefault(require("eventemitter3"));
 const intersection_1 = __importDefault(require("lodash/intersection"));
 const xor_1 = __importDefault(require("lodash/xor"));
 const long_1 = __importDefault(require("long"));
+const kerror = __importStar(require("../kerror"));
+const kuzzleError_1 = require("../kerror/errors/kuzzleError");
 const kuzzleStateEnum_1 = __importDefault(require("../kuzzle/kuzzleStateEnum"));
 const debug_1 = __importDefault(require("../util/debug"));
 const koncordeCompat_1 = require("../util/koncordeCompat");
@@ -47,6 +82,7 @@ const publisher_1 = __importDefault(require("./publisher"));
 const state_1 = __importDefault(require("./state"));
 const subscriber_1 = __importDefault(require("./subscriber"));
 const debug = (0, debug_1.default)("kuzzle:cluster:sync");
+const joinError = kerror.wrap("cluster", "join");
 /** Cluster-wide events carrying the collection write locks (see registerEvents) */
 const COLLECTION_LOCK_EVENT = "core:storage:collection:lock";
 const COLLECTION_UNLOCK_EVENT = "core:storage:collection:unlock";
@@ -164,8 +200,14 @@ class ClusterNode {
      * The id of the ID card this node reserved during `handshake()`.
      *
      * Null until the handshake gets that far, and read as a `string` at
-     * seventeen sites here plus `subscriber.ts` and `command.ts` — all of which
-     * run after it. The accessor says once where that can fail.
+     * seventeen sites here plus `subscriber.ts` and `command.ts`. The accessor
+     * says once where that can fail: an internal read before the handshake is a
+     * bug, and it throws.
+     *
+     * Network input is not internal: the command socket is bound before the
+     * handshake, and a node restarted on the IP of a dead one can be reached by
+     * peers still talking to that dead node (#3031). The paths network input
+     * reaches check `hasNodeId` first.
      */
     get nodeId() {
         if (this._nodeId === null) {
@@ -173,6 +215,13 @@ class ClusterNode {
         }
         return this._nodeId;
     }
+    /**
+     * Whether the handshake has set this node's id yet: the non-throwing check
+     * for the paths network input reaches before it has (#3031).
+     */
+    get hasNodeId() {
+        return this._nodeId !== null;
+    }
     set nodeId(id) {
         this._nodeId = id;
     }
@@ -332,7 +381,7 @@ class ClusterNode {
         //
         // Exit code 1: this is a failure, and a node that exits 0 is not restarted
         // by an `on-failure` policy (#2785).
-        global.kuzzle.shutdown(1);
+        void global.kuzzle.shutdown(1);
     }
     /**
      * Evicts a remote from the list
@@ -353,8 +402,11 @@ class ClusterNode {
         this.remoteNodes.delete(nodeId);
         this.fullState.removeNode(nodeId);
         subscriber.dispose();
-        if (broadcast) {
-            this.publisher.sendNodeEvicted(this.nodeId, nodeId, reason);
+        // A subscriber can evict its remote node (heartbeat lost, gap, invalid
+        // message) before this node's handshake: there is no evictor id to
+        // broadcast then, and the eviction stays local (#3031).
+        if (broadcast && this._nodeId !== null) {
+            this.publisher.sendNodeEvicted(this._nodeId, nodeId, reason);
         }
         if (this.countActiveNodes() < this.config.minimumNodes) {
             global.kuzzle.state = kuzzleStateEnum_1.default.NOT_ENOUGH_NODES;
@@ -388,14 +440,15 @@ class ClusterNode {
             const candidates = this.electShutdownCandidates(splits, idCards);
             if (candidates.includes(this.nodeId)) {
                 this.logger.error("[CLUSTER] Network split detected. This node is outside the cluster: shutting down.");
-                global.kuzzle.shutdown();
+                // A failure, like `evictSelf`'s: exit non-zero (#2785)
+                void global.kuzzle.shutdown(1);
                 return;
             }
         }
         catch (err) {
             this.logger.error("[CLUSTER] Unexpected exception caught during a cluster consistency check. Shutting down...");
             this.logger.error(err instanceof Error ? err.stack : (0, util_1.inspect)(err));
-            global.kuzzle.shutdown();
+            void global.kuzzle.shutdown(1);
         }
     }
     /**
@@ -523,8 +576,8 @@ class ClusterNode {
      *
      * Extracted from `handshake()` unchanged.
      *
-     * @returns false when the caller must stop — the cluster is split and this
-     *          node is shutting down
+     * @throws {cluster.join.full_state_unavailable} on the second failure: the
+     *         cluster is split
      */
     async retryFullState(retried) {
         // Uh oh... no node was able to give us the full state.
@@ -533,9 +586,7 @@ class ClusterNode {
         // means we're probably facing a network split, and we must then shut
         // down.
         if (retried) {
-            this.logger.error("[CLUSTER] Could not connect to discovered cluster nodes (network split detected). Shutting down.");
-            global.kuzzle.shutdown();
-            return false;
+            throw joinError.get("full_state_unavailable");
         }
         // Disposes all subscribers
         for (const subscriber of this.remoteNodes.values()) {
@@ -546,81 +597,110 @@ class ClusterNode {
         const retryDelay = this.heartbeatDelay * 1.5;
         this.logger.warn(`[CLUSTER] Unable to connect to discovered cluster nodes. Retrying in ${retryDelay}ms...`);
         await bluebird_1.default.delay(retryDelay);
-        return true;
+    }
+    /**
+     * The ID cards of the other nodes, none of which has this node's IP.
+     *
+     * A card with this IP may be the stale one of a previous run of this node
+     * (a process killed, a container restarted at once): it expires within a
+     * TTL, so it is only a real duplicate if it is still there after that.
+     *
+     * @throws {cluster.join.duplicate_ip} if it is
+     */
+    async discoverNodes() {
+        const nodes = await this.idCardHandler.getRemoteIdCards();
+        if (!nodes.some((node) => node.ip === this.ip)) {
+            return nodes;
+        }
+        // A heartbeat more than the TTL: the card's last renewal may be in flight
+        const delay = this.idCardHandler.ttl + this.heartbeatDelay;
+        this.logger.warn(`[CLUSTER] Another node has the same IP address as this one (${this.ip}). Waiting ${delay}ms for it to expire, in case it is a stale ID card...`);
+        await bluebird_1.default.delay(delay);
+        const remaining = await this.idCardHandler.getRemoteIdCards();
+        const duplicate = remaining.find((node) => node.ip === this.ip);
+        if (duplicate) {
+            throw joinError.get("duplicate_ip", this.ip, duplicate.id);
+        }
+        return remaining;
     }
     /**
      * Discovers other active nodes from the cluster and, if other nodes exist,
      * starts a handshake procedure to sync this node and to make it able to
      * handle new client requests
      *
-     * @return {void}
+     * Rejects with a `cluster.join.*` error, and shuts the node down, when it
+     * cannot join: the node must not go on starting as if it had (a duplicate
+     * IP, a split cluster, `joinTimeout` reached).
      */
     async handshake() {
-        const handshakeTimeout = setTimeout(() => {
-            this.logger.error(`[CLUSTER] Failed to join the cluster: timed out (joinTimeout: ${this.config.joinTimeout}ms)`);
-            global.kuzzle.shutdown();
-        }, this.config.joinTimeout);
+        let timedOut = false;
+        let handshakeTimeout;
+        const timeout = new Promise((_resolve, reject) => {
+            handshakeTimeout = setTimeout(() => {
+                timedOut = true;
+                reject(joinError.get("timeout", this.config.joinTimeout));
+            }, this.config.joinTimeout);
+        });
         // No retry limit: the handshakes are taken one at a time, and the
         // `joinTimeout` above is what gives up on a cluster that never lets this
         // node in.
+        const join = (0, distributedLock_1.withLock)("clusterHandshake", async () => {
+            // Given up on while waiting for the lock: do not join after all
+            if (timedOut) {
+                return;
+            }
+            // Create the ID Key AFTER the handshake lock is actually taken,
+            // to prevent race conditions (other nodes attempting to connect to this
+            // node while it's still initializing)
+            await this.idCardHandler.createIdCard();
+            debug("[CLUSTER] ID Card created");
+            const nodeId = this.idCardHandler.nodeId;
+            (0, assert_1.default)(nodeId !== null, "[CLUSTER] createIdCard() returned without reserving a node id");
+            this.nodeId = nodeId;
+            await this.startHeartbeat(); // NOSONAR: TD-26
+            debug("[CLUSTER] Start heartbeat");
+            let retried = false;
+            let fullState;
+            let nodes;
+            debug("[CLUSTER] Start retrieving full state..");
+            do {
+                nodes = await this.discoverNodes();
+                debug("[CLUSTER] %s remote nodes discovered", nodes.length);
+                // No other nodes detected = no handshake required
+                if (nodes.length === 0) {
+                    this.trackActivity(this.nodeId, this.ip, nodeActivityEnum.ADDED);
+                    return;
+                }
+                await this.subscribeToNodes(nodes);
+                debug("[CLUSTER] Successfully subscribed to nodes");
+                fullState = await this.command.getFullState(nodes);
+                if (fullState === null) {
+                    // Sequential by design: the retry waits for a heartbeat round
+                    await this.retryFullState(retried); // NOSONAR
+                    retried = true;
+                }
+            } while (fullState === null);
+            debug("[CLUSTER] Fullstate retrieved, loading into node..");
+            await this.fullState.loadFullState(fullState); // NOSONAR: TD-26
+            this.activity = fullState.activity ?? this.activity;
+            debug("[CLUSTER] Fullstate loaded.");
+            const handshakeResponses = await this.command.broadcastHandshake(nodes);
+            debug("[CLUSTER] Successful handshakes with other nodes.");
+            await this.syncWithPeers(handshakeResponses, fullState);
+            // `createIdCard()` adopts `global.nodeId`, so these are normally the same
+            // string and the line reads as one name (TD-59, #2764). They still differ
+            // in the two cases the adoption cannot cover — a stale IdCard holding the
+            // key, and a Kuzzle running without a Backend — and those are exactly the
+            // cases where a reader needs to be told, so the line says both.
+            this.logger.info(global.nodeId && global.nodeId !== this.nodeId
+                ? `[CLUSTER] Successfully joined the cluster as "${this.nodeId}" (process node id: ${global.nodeId}).`
+                : `[CLUSTER] Successfully joined the cluster as "${this.nodeId}".`);
+            this.trackActivity(this.nodeId, this.ip, nodeActivityEnum.ADDED);
+        }, { retryAttempts: Number.POSITIVE_INFINITY });
         try {
-            await (0, distributedLock_1.withLock)("clusterHandshake", async () => {
-                // Create the ID Key AFTER the handshake lock is actually taken,
-                // to prevent race conditions (other nodes attempting to connect to this
-                // node while it's still initializing)
-                await this.idCardHandler.createIdCard();
-                debug("[CLUSTER] ID Card created");
-                const nodeId = this.idCardHandler.nodeId;
-                (0, assert_1.default)(nodeId !== null, "[CLUSTER] createIdCard() returned without reserving a node id");
-                this.nodeId = nodeId;
-                await this.startHeartbeat(); // NOSONAR: TD-26
-                debug("[CLUSTER] Start heartbeat");
-                let retried = false;
-                let fullState;
-                let nodes;
-                debug("[CLUSTER] Start retrieving full state..");
-                do {
-                    nodes = await this.idCardHandler.getRemoteIdCards();
-                    debug("[CLUSTER] %s remote nodes discovered", nodes.length);
-                    // No other nodes detected = no handshake required
-                    if (nodes.length === 0) {
-                        this.trackActivity(this.nodeId, this.ip, nodeActivityEnum.ADDED);
-                        return;
-                    }
-                    // Verify that no other node share the same IP address as this one
-                    const duplicate = nodes.filter((node) => node.ip === this.ip);
-                    if (duplicate.length > 0) {
-                        this.logger.error(`[CLUSTER] Another node share the same IP address as this one (${this.ip}): ${duplicate[0]?.id}. Shutting down.`);
-                        global.kuzzle.shutdown();
-                        return;
-                    }
-                    await this.subscribeToNodes(nodes);
-                    debug("[CLUSTER] Successfully subscribed to nodes");
-                    fullState = await this.command.getFullState(nodes);
-                    if (fullState === null) {
-                        if (!(await this.retryFullState(retried))) {
-                            return;
-                        }
-                        retried = true;
-                    }
-                } while (fullState === null);
-                debug("[CLUSTER] Fullstate retrieved, loading into node..");
-                await this.fullState.loadFullState(fullState); // NOSONAR: TD-26
-                this.activity = fullState.activity ?? this.activity;
-                debug("[CLUSTER] Fullstate loaded.");
-                const handshakeResponses = await this.command.broadcastHandshake(nodes);
-                debug("[CLUSTER] Successful handshakes with other nodes.");
-                await this.syncWithPeers(handshakeResponses, fullState);
-                // `createIdCard()` adopts `global.nodeId`, so these are normally the same
-                // string and the line reads as one name (TD-59, #2764). They still differ
-                // in the two cases the adoption cannot cover — a stale IdCard holding the
-                // key, and a Kuzzle running without a Backend — and those are exactly the
-                // cases where a reader needs to be told, so the line says both.
-                this.logger.info(global.nodeId && global.nodeId !== this.nodeId
-                    ? `[CLUSTER] Successfully joined the cluster as "${this.nodeId}" (process node id: ${global.nodeId}).`
-                    : `[CLUSTER] Successfully joined the cluster as "${this.nodeId}".`);
-                this.trackActivity(this.nodeId, this.ip, nodeActivityEnum.ADDED);
-            }, { retryAttempts: Number.POSITIVE_INFINITY });
+            // A timeout does not stop `join`: the node it settles later is shutting
+            // down already
+            await Promise.race([join, timeout]);
         }
         catch (error) {
             // The handshake cannot be stopped where it is: it may still introduce
@@ -628,7 +708,10 @@ class ClusterNode {
             // half-joined, whatever the application does with the failed startup.
             if (error instanceof distributedLock_1.MutexLockLostError) {
                 this.logger.error("[CLUSTER] Lost the handshake lock while joining the cluster. Shutting down.");
-                void global.kuzzle.shutdown();
+            }
+            if (error instanceof distributedLock_1.MutexLockLostError ||
+                (error instanceof kuzzleError_1.KuzzleError && error.id.startsWith("cluster.join."))) {
+                void global.kuzzle.shutdown(1);
             }
             throw error;
         }

package/dist/lib/cluster/subscriber.d.ts

@@ -15,6 +15,8 @@ type SubscribingNode = {
     config: IKuzzleConfiguration["cluster"];
     heartbeatDelay: number;
     nodeId: string;
+    /** Whether `nodeId` can be read: false until the handshake sets it. */
+    hasNodeId: boolean;
     fullState: State;
     eventEmitter: {
         emit(event: string, payload: unknown): void;

package/dist/lib/cluster/subscriber.js

@@ -383,6 +383,12 @@ class ClusterSubscriber {
      * @param message - decoded NodeEvicted protobuf message
      */
     async handleNodeEviction(message) {
+        // Before the handshake this node has no id to compare, and is not part of
+        // the cluster the eviction is about: the message is ignored (#3031).
+        if (!this.localNode.hasNodeId) {
+            debug("[CLUSTER] Eviction of node %s by %s ignored: the handshake has not run", message.nodeId, message.evictor);
+            return;
+        }
         if (message.nodeId === this.localNode.nodeId) {
             this.logger.error(`[CLUSTER] Node evicted by ${message.evictor}. Reason: ${message.reason}`);
             // A failure, like `evictSelf`'s: exit non-zero (#2785).

package/dist/lib/cluster/workers/IDCardRenewer.d.ts

@@ -38,6 +38,12 @@ declare class IDCardRenewer {
     init(config: IDCardRenewerConfig): Promise<void>;
     initRedis(config?: RedisServiceConfig, name?: string): Promise<void>;
     renewIDCard(): Promise<void>;
+    /**
+     * Disposes the worker and tells the parent why, once: the renewals queued
+     * behind a stalled redis all fail together, and each report evicts the node
+     * again (#3017)
+     */
+    private reportFailure;
     dispose(): Promise<void>;
 }
 export { IDCardRenewer };