kuzzle 2.60.0-beta.4 → 2.60.0-beta.6

package/dist/lib/api/controllers/adminController.d.ts

@@ -44,7 +44,13 @@ declare class AdminController extends NativeController {
     shutdown(): Promise<{
         acknowledge: boolean;
     }>;
-    loadFixtures(request: KuzzleRequest): Promise<any>;
+    /**
+     * Always waits for the import, so that a failure is reported to the caller:
+     * `refresh=false` only skips waiting for the documents to be indexed.
+     */
+    loadFixtures(request: KuzzleRequest): Promise<{
+        acknowledge: boolean;
+    }>;
     loadMappings(request: KuzzleRequest): Promise<{
         acknowledge: boolean;
     }>;

package/dist/lib/api/controllers/adminController.js

@@ -161,15 +161,22 @@ class AdminController extends baseController_1.NativeController {
         if (this.shuttingDown) {
             throw kerror.get("api", "process", "action_locked", "Kuzzle is already shutting down.");
         }
+        this.shuttingDown = true;
         global.kuzzle.shutdown();
         return { acknowledge: true };
     }
-    loadFixtures(request) {
+    /**
+     * Always waits for the import, so that a failure is reported to the caller:
+     * `refresh=false` only skips waiting for the documents to be indexed.
+     */
+    async loadFixtures(request) {
         const fixtures = request.getBody();
         const refresh = request.getRefresh("wait_for");
-        return global.kuzzle.ask("core:storage:public:document:import", fixtures, {
+        await global.kuzzle.ask("core:storage:public:document:import", fixtures, {
             refresh,
         });
+        // The documented answer. 2.17.6 to 2.59 answered `null` instead.
+        return { acknowledge: true };
     }
     loadMappings(request) {
         const mappings = request.getBody();

package/dist/lib/api/funnel.js

@@ -664,13 +664,24 @@ class Funnel {
             catch (e) {
                 error = e;
                 debug("Error processing request %s: %a", request.id, error);
+                // processRequest does not dump: do it as the event-less path does.
+                // Rethrown, never falling through to the event-less execution below,
+                // which ran a failed (or pipe-rejected) request a second time.
+                this.handleErrorDump((0, thrown_1.causeOf)(e));
+                throw e;
             }
             finally {
-                global.kuzzle.pipe("request:afterExecution", {
+                // Not awaited, as it always was: the caller's result does not depend
+                // on it. Its rejection is logged instead of left unhandled.
+                global.kuzzle
+                    .pipe("request:afterExecution", {
                     error: error,
                     request: request,
                     result: res,
                     success: error === undefined,
+                })
+                    ?.catch((pipeError) => {
+                    this.logger.error(pipeError, `request:afterExecution pipe failed for plugin request ${request.id}`);
                 });
             }
         }

package/dist/lib/api/httpRoutes.js

@@ -184,12 +184,6 @@ const routes = [
         controller: "admin",
         action: "resetDatabase",
     },
-    {
-        verb: "post",
-        path: "/admin/_resetKuzzleData",
-        controller: "admin",
-        action: "resetKuzzleData",
-    },
     { verb: "post", path: "/admin/_dump", controller: "admin", action: "dump" },
     {
         verb: "post",
@@ -251,12 +245,6 @@ const routes = [
         controller: "index",
         action: "exists",
     },
-    {
-        verb: "get",
-        path: "/:index/_autoRefresh",
-        controller: "index",
-        action: "getAutoRefresh",
-    },
     { verb: "get", path: "/_list", controller: "index", action: "list" },
     { verb: "get", path: "/_storageStats", controller: "index", action: "stats" },
     {
@@ -1133,13 +1121,6 @@ const routes = [
         controller: "ms",
         action: "append",
     },
-    {
-        verb: "post",
-        path: "/ms/_bgrewriteaof",
-        controller: "ms",
-        action: "bgrewriteaof",
-    },
-    { verb: "post", path: "/ms/_bgsave", controller: "ms", action: "bgsave" },
     { verb: "post", path: "/ms/_bitop/:_id", controller: "ms", action: "bitop" },
     { verb: "post", path: "/ms/_decr/:_id", controller: "ms", action: "decr" },
     {
@@ -1514,7 +1495,7 @@ const routes = [
         controller: "security",
         action: "deleteApiKey",
         openapi: {
-            description: "Deletes a user API key, identified by its clear-text `key` or its `fingerprint` instead of its `_id`. Exactly one of `key` or `fingerprint` must be provided. If you are looking to manage your own API keys, use the `auth` controller instead.",
+            description: "Deletes a user API key, identified by its clear-text `key` or its `fingerprint` instead of its `_id`. One of them must be provided; if several are given, `_id` is used first, then `key`, then `fingerprint`, and the others are ignored. A `key` in the query string is a secret written in the URL: prefer the `fingerprint`. If you are looking to manage your own API keys, use the `auth` controller instead.",
             parameters: [
                 {
                     in: "path",
@@ -1572,6 +1553,57 @@ const routes = [
         controller: "auth",
         action: "deleteApiKey",
     },
+    {
+        verb: "delete",
+        path: "/api-keys",
+        controller: "auth",
+        action: "deleteApiKey",
+        openapi: {
+            description: "Deletes an API key of the current user, identified by its clear-text `key` or its `fingerprint` instead of its `_id`. One of them must be provided; if several are given, `_id` is used first, then `key`, then `fingerprint`, and the others are ignored. A `key` in the query string is a secret written in the URL: prefer the `fingerprint`.",
+            parameters: [
+                {
+                    in: "query",
+                    name: "key",
+                    schema: { type: "string" },
+                    required: false,
+                    description: "Clear-text API key to delete",
+                },
+                {
+                    in: "query",
+                    name: "fingerprint",
+                    schema: { type: "string" },
+                    required: false,
+                    description: "SHA256 fingerprint of the API key to delete",
+                },
+                {
+                    in: "query",
+                    name: "refresh",
+                    schema: {
+                        type: "string",
+                        enum: ["wait_for", "false"],
+                        default: "wait_for",
+                    },
+                    required: false,
+                    description: "If set to `wait_for`, waits for the deletion to be indexed before responding",
+                },
+            ],
+            responses: {
+                200: {
+                    description: "The deleted API key ID",
+                    content: {
+                        "application/json": {
+                            schema: {
+                                type: "object",
+                                properties: {
+                                    _id: { type: "string" },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    },
     // PUT (idempotent)
     { verb: "put", path: "/_me", controller: "auth", action: "updateSelf" },
     {

package/dist/lib/api/request/kuzzleRequest.d.ts

@@ -385,12 +385,17 @@ export declare class KuzzleRequest {
      */
     getDate(name: string, format?: string): string;
     /**
-     * Gets a parameter from a request arguments and returns it to timestamp format.
+     * Gets a parameter from a request arguments and checks that it is an integer
+     * timestamp (e.g. milliseconds since Epoch).
+     *
+     * An integer string, such as an HTTP query string value, is accepted and
+     * converted. A date string (e.g. `"2026-10-27"`) is rejected.
      *
      * @param name parameter name.
      * @throws {api.assert.missing_argument} If parameter not found and no default
      *                                       value provided
-     * @throws {api.assert.invalid_type} If parameter value is not a valid date.
+     * @throws {api.assert.invalid_type} If parameter value is not an integer
+     *                                   timestamp.
      */
     getTimestamp(name: string): number;
     /**

package/dist/lib/api/request/kuzzleRequest.js

@@ -676,31 +676,41 @@ class KuzzleRequest {
         if (args[name] === undefined) {
             throw assertionError.get("missing_argument", name);
         }
-        if (format && !(0, moment_1.default)(args[name], format, true).isValid()) {
-            throw assertionError.get("invalid_type", name, "date");
-        }
-        if (!(0, moment_1.default)(args[name], moment_1.default.ISO_8601).isValid()) {
+        // A custom format replaces the ISO 8601 check: applying both rejected
+        // every value of a format that is not ISO 8601.
+        const isValid = format
+            ? (0, moment_1.default)(args[name], format, true).isValid()
+            : (0, moment_1.default)(args[name], moment_1.default.ISO_8601).isValid();
+        if (!isValid) {
             throw assertionError.get("invalid_type", name, "date");
         }
         return this.getString(name);
     }
     /**
-     * Gets a parameter from a request arguments and returns it to timestamp format.
+     * Gets a parameter from a request arguments and checks that it is an integer
+     * timestamp (e.g. milliseconds since Epoch).
+     *
+     * An integer string, such as an HTTP query string value, is accepted and
+     * converted. A date string (e.g. `"2026-10-27"`) is rejected.
      *
      * @param name parameter name.
      * @throws {api.assert.missing_argument} If parameter not found and no default
      *                                       value provided
-     * @throws {api.assert.invalid_type} If parameter value is not a valid date.
+     * @throws {api.assert.invalid_type} If parameter value is not an integer
+     *                                   timestamp.
      */
     getTimestamp(name) {
-        const args = this.input.args;
-        if (args[name] === undefined) {
+        const value = this.input.args[name];
+        if (value === undefined) {
             throw assertionError.get("missing_argument", name);
         }
-        if ((0, moment_1.default)(args[name], true).isValid() === false) {
+        const timestamp = typeof value === "string" && /^-?\d+$/.test(value)
+            ? Number(value)
+            : value;
+        if (!Number.isSafeInteger(timestamp)) {
             throw assertionError.get("invalid_type", name, "date");
         }
-        return this.getInteger(name);
+        return timestamp;
     }
     /**
      * Returns the index specified in the request

package/dist/lib/api/request/requestContext.d.ts

@@ -19,7 +19,7 @@ export type ContextMisc = {
      */
     path?: string;
     /**
-     * HTTP headers
+     * HTTP method, uppercase (e.g. `GET`)
      */
     verb?: string;
     /**

package/dist/lib/api/request/requestResponse.js

@@ -127,7 +127,8 @@ class Headers {
             case "host":
             case "if-modified-since":
             case "if-unmodified-since":
-            case "last-modified, location":
+            case "last-modified":
+            case "location":
             case "max-forwards":
             case "proxy-authorization":
             case "referer":

package/dist/lib/config/index.js

@@ -28,21 +28,27 @@ const assert_1 = __importDefault(require("assert"));
 const node_util_1 = require("node:util");
 const rc_1 = __importDefault(require("rc"));
 const default_config_1 = __importDefault(require("./default.config"));
+const authTokenSettings_1 = require("../core/security/authTokenSettings");
 const package_json_1 = __importDefault(require("../../package.json"));
 const kerror_1 = require("../kerror");
 const safeObject_1 = require("../util/safeObject");
 const bytes_1 = __importDefault(require("../util/bytes"));
 const wrapped = (0, kerror_1.wrap)("core", "configuration");
 function loadConfig() {
-    let loaded;
+    let raw;
     try {
-        loaded = (0, rc_1.default)("kuzzle", default_config_1.default);
+        raw = (0, rc_1.default)("kuzzle", withoutTokenDefaults(default_config_1.default));
     }
     catch (e) {
         throw wrapped.get("cannot_parse", e instanceof Error ? e.message : (0, node_util_1.inspect)(e));
     }
     // In place: what `unstringify` answers is the object it was given.
-    unstringify(loaded);
+    unstringify(raw);
+    const { authToken, deprecatedSettings, jwt } = resolveTokenSettings(raw.security);
+    const loaded = {
+        ...raw,
+        security: { ...raw.security, authToken, jwt },
+    };
     checkLimitsConfig(loaded);
     checkHttpOptions(loaded);
     checkWebSocketOptions(loaded);
@@ -56,6 +62,7 @@ function loadConfig() {
             hash: {
                 seed: Buffer.from("^m&mOISKBvb1xpl1mRsrylaQXpjb&IJX"),
             },
+            deprecatedSettings,
             notifiableProtocols: [],
         },
         version: package_json_1.default.version,
@@ -66,6 +73,56 @@ function loadConfig() {
     preprocessRedisOptions(config.services.memoryStorage);
     return config;
 }
+/**
+ * The packaged defaults, minus the values of `security.authToken` and of its
+ * deprecated spelling `security.jwt`: both sections ship the same non-null
+ * defaults, so once `rc` has merged them nothing tells a user's
+ * `jwt.expiresIn` from the packaged one. Left empty here, they hold only what
+ * the user set, and {@link resolveTokenSettings} applies the defaults after.
+ *
+ * A shallow copy: the other sections stay the packaged objects `rc` merges
+ * into, as before.
+ */
+function withoutTokenDefaults(defaults) {
+    const authToken = {};
+    const jwt = {};
+    return { ...defaults, security: { ...defaults.security, authToken, jwt } };
+}
+/**
+ * Resolves the authentication token settings: for each one, the value set
+ * under `security.authToken` wins, then the one set under the deprecated
+ * `security.jwt`, then the packaged default. A `null` counts as unset, as the
+ * readers' `authToken.x ?? jwt.x` always did. Exception: `gracePeriod` set in
+ * both sections keeps the `jwt` one, as it always did (see
+ * {@link LEGACY_FIRST}).
+ *
+ * Both sections get the resolved values, so a reader of either — a plugin
+ * may still read `jwt` — sees the settings in effect. `deprecatedSettings`
+ * lists the `security.jwt.*` keys the user set, for the deprecation warning.
+ */
+function resolveTokenSettings(security) {
+    const packaged = default_config_1.default.security.authToken;
+    const fromPackage = packaged;
+    const fromAuthToken = (0, safeObject_1.isPlainObject)(security.authToken)
+        ? security.authToken
+        : {};
+    const fromJwt = (0, safeObject_1.isPlainObject)(security.jwt) ? security.jwt : {};
+    const resolved = {};
+    for (const key of new Set([
+        ...Object.keys(packaged),
+        ...Object.keys(fromJwt),
+        ...Object.keys(fromAuthToken),
+    ])) {
+        resolved[key] = authTokenSettings_1.LEGACY_FIRST.has(key)
+            ? (fromJwt[key] ?? fromAuthToken[key] ?? fromPackage[key])
+            : (fromAuthToken[key] ?? fromJwt[key] ?? fromPackage[key]);
+    }
+    return {
+        authToken: { ...packaged, ...resolved },
+        deprecatedSettings: Object.keys(fromJwt).map((key) => `security.jwt.${key}`),
+        jwt: { ...resolved },
+    };
+}
 /**
  * RC params can be overriden using environment variables,
  * in which case all values are passed as strings.

package/dist/lib/core/backend/backend.d.ts

@@ -99,13 +99,14 @@ export declare class Backend {
      */
     plugin: BackendPlugin;
     /**
-     * InternalLogger
+     * Application logger
      *
+     * @method trace
      * @method debug
      * @method info
      * @method warn
      * @method error
-     * @method verbose
+     * @method fatal
      */
     log: Logger;
     /**

package/dist/lib/core/backend/internalLogger.d.ts

@@ -1,4 +1,10 @@
 import { ApplicationManager } from "./index";
+/**
+ * Kuzzle no longer creates instances of this class: `Backend.log` is a
+ * `Logger` since 2.45.0.
+ *
+ * @deprecated Use `Logger` (`app.log`) instead.
+ */
 export declare class InternalLogger extends ApplicationManager {
     /**
      * Logs a trace message

package/dist/lib/core/backend/internalLogger.js

@@ -26,6 +26,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InternalLogger = void 0;
 const util_1 = __importDefault(require("util"));
 const index_1 = require("./index");
+/**
+ * Kuzzle no longer creates instances of this class: `Backend.log` is a
+ * `Logger` since 2.45.0.
+ *
+ * @deprecated Use `Logger` (`app.log`) instead.
+ */
 class InternalLogger extends index_1.ApplicationManager {
     /**
      * Logs a trace message

package/dist/lib/core/network/router.d.ts

@@ -32,9 +32,27 @@ declare class Router {
      * Transmit HTTP requests to the funnel controller and forward its response
      * back to the client
      *
+     * Triggers the `http:<verb>` pipe with the verb lowercased, as documented.
+     * A route declared with another case (e.g. `verb: 'GET'`) also triggers the
+     * event under the declared case (`http:GET`), which is the one it used to
+     * trigger: see docs/v3-breaking-changes.md.
+     *
+     * @param verb - the route's HTTP verb, as declared
      * @param request - includes URL and POST query data
      * @param cb - callback to invoke with the result
      */
     _executeFromHttp(verb: string, request: Request, cb: RouteCallback): void;
+    /**
+     * Triggers an `http:<verb>` pipe, and answers its error through `cb` or
+     * hands the piped request over to `next`.
+     *
+     * Callbacks rather than promises: this runs before the funnel.
+     */
+    private _pipeHttpEvent;
+    /**
+     * Executes the piped request in the funnel and answers its result through
+     * `cb`, falling back on the original request when there is none.
+     */
+    private _executeInFunnel;
 }
 export = Router;

package/dist/lib/core/network/router.js

@@ -190,25 +190,59 @@ class Router {
      * Transmit HTTP requests to the funnel controller and forward its response
      * back to the client
      *
+     * Triggers the `http:<verb>` pipe with the verb lowercased, as documented.
+     * A route declared with another case (e.g. `verb: 'GET'`) also triggers the
+     * event under the declared case (`http:GET`), which is the one it used to
+     * trigger: see docs/v3-breaking-changes.md.
+     *
+     * @param verb - the route's HTTP verb, as declared
      * @param request - includes URL and POST query data
      * @param cb - callback to invoke with the result
      */
     _executeFromHttp(verb, request, cb) {
-        global.kuzzle.pipe(`http:${verb}`, request, (error, mutatedRequest) => {
+        const event = `http:${verb.toLowerCase()}`;
+        const declaredEvent = `http:${verb}`;
+        this._pipeHttpEvent(event, request, cb, (pipedRequest) => {
+            if (declaredEvent === event) {
+                this._executeInFunnel(pipedRequest, request, cb);
+                return;
+            }
+            // @deprecated - declared-case event, to drop in v3
+            this._pipeHttpEvent(declaredEvent, pipedRequest, cb, (legacyRequest) => {
+                this._executeInFunnel(legacyRequest, request, cb);
+            });
+        });
+    }
+    /**
+     * Triggers an `http:<verb>` pipe, and answers its error through `cb` or
+     * hands the piped request over to `next`.
+     *
+     * Callbacks rather than promises: this runs before the funnel.
+     */
+    _pipeHttpEvent(event, request, cb, next) {
+        // callback form: the outcome, error included, goes through the callback
+        void global.kuzzle.pipe(event, request, (error, mutatedRequest) => {
             if (error) {
                 request.setError(error);
                 cb(request);
                 return;
             }
-            global.kuzzle.funnel.execute(mutatedRequest, (err, result) => {
-                const _res = result || request;
-                if (err && !_res.error) {
-                    _res.setError(err);
-                }
-                // no sanitisation here: `_res` is a KuzzleRequest, and the stack
-                // is stripped by the protocols, on the serialized response
-                cb(_res);
-            });
+            next(mutatedRequest);
+        });
+    }
+    /**
+     * Executes the piped request in the funnel and answers its result through
+     * `cb`, falling back on the original request when there is none.
+     */
+    _executeInFunnel(pipedRequest, request, cb) {
+        global.kuzzle.funnel.execute(pipedRequest, (err, result) => {
+            const _res = result || request;
+            if (err && !_res.error) {
+                _res.setError(err);
+            }
+            // no sanitisation here: `_res` is a KuzzleRequest, and the stack
+            // is stripped by the protocols, on the serialized response
+            cb(_res);
         });
     }
 }

package/dist/lib/core/security/authTokenSettings.d.ts

@@ -0,0 +1,21 @@
+import type { SecurityConfiguration } from "../../types/config/SecurityConfiguration";
+type AuthTokenSettings = SecurityConfiguration["authToken"];
+/**
+ * The settings for which a value set under the deprecated `security.jwt`
+ * wins over one set under `security.authToken`: `gracePeriod` used to be
+ * read from `jwt` only, so a configuration setting both keeps working as it
+ * did. To drop in v3 (docs/v3-breaking-changes.md).
+ */
+export declare const LEGACY_FIRST: ReadonlySet<string>;
+/**
+ * Reads one authentication token setting: the value set under
+ * `security.authToken` wins, then the one set under its deprecated spelling
+ * `security.jwt`, then the packaged default (except for {@link LEGACY_FIRST}).
+ *
+ * `loadConfig()` already resolves both sections from what the configuration
+ * files and the environment set. This covers a change made afterwards, e.g.
+ * `app.config.set("security.jwt.expiresIn", "2h")` before `app.start()`: a
+ * value that differs from the packaged default is one somebody set.
+ */
+export declare function authTokenSetting<K extends keyof AuthTokenSettings>(key: K): AuthTokenSettings[K];
+export {};

package/dist/lib/core/security/authTokenSettings.js

@@ -0,0 +1,61 @@
+"use strict";
+/*
+ * Kuzzle, a backend software, self-hostable and ready to use
+ * to power modern apps
+ *
+ * Copyright 2015-2022 Kuzzle
+ * mailto: support AT kuzzle.io
+ * website: http://kuzzle.io
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_FIRST = void 0;
+exports.authTokenSetting = authTokenSetting;
+const default_config_1 = __importDefault(require("../../config/default.config"));
+/**
+ * The settings for which a value set under the deprecated `security.jwt`
+ * wins over one set under `security.authToken`: `gracePeriod` used to be
+ * read from `jwt` only, so a configuration setting both keeps working as it
+ * did. To drop in v3 (docs/v3-breaking-changes.md).
+ */
+exports.LEGACY_FIRST = new Set(["gracePeriod"]);
+function isSet(value) {
+    return value !== undefined && value !== null;
+}
+/**
+ * Reads one authentication token setting: the value set under
+ * `security.authToken` wins, then the one set under its deprecated spelling
+ * `security.jwt`, then the packaged default (except for {@link LEGACY_FIRST}).
+ *
+ * `loadConfig()` already resolves both sections from what the configuration
+ * files and the environment set. This covers a change made afterwards, e.g.
+ * `app.config.set("security.jwt.expiresIn", "2h")` before `app.start()`: a
+ * value that differs from the packaged default is one somebody set.
+ */
+function authTokenSetting(key) {
+    const { authToken, jwt } = global.kuzzle.config.security; // NOSONAR: the deprecated section is read on purpose, as the documented fallback
+    const packaged = default_config_1.default.security.authToken[key];
+    const current = authToken?.[key];
+    const legacy = jwt?.[key]; // NOSONAR
+    const candidates = exports.LEGACY_FIRST.has(key)
+        ? [legacy, current]
+        : [current, legacy];
+    return (candidates.find((value) => isSet(value) && value !== packaged) ??
+        candidates.find(isSet) ??
+        packaged);
+}
+//# sourceMappingURL=authTokenSettings.js.map

package/dist/lib/core/security/tokenRepository.js

@@ -66,15 +66,8 @@ const token_1 = require("../../model/security/token");
 const apiKey_1 = __importDefault(require("../../model/storage/apiKey"));
 const ObjectRepository_1 = require("../shared/ObjectRepository");
 const crypto_1 = require("../../util/crypto");
+const authTokenSettings_1 = require("./authTokenSettings");
 const securityError = kerror.wrap("security", "token");
-/**
- * The deprecated `security.jwt` section, which the `authToken` settings fall
- * back to. The packaged defaults always ship it; the type says optional only
- * because v2.56.0's did (see SecurityConfiguration.jwt).
- */
-function legacyJwtConfig() {
-    return global.kuzzle.config.security.jwt; // NOSONAR: the deprecated section is read on purpose, as the documented fallback
-}
 class TokenRepository extends ObjectRepository_1.ObjectRepository {
     constructor(opts = {}) {
         super();
@@ -83,7 +76,11 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
         if (opts.ttl !== undefined) {
             this.ttl = opts.ttl;
         }
-        this.tokenGracePeriod = Math.floor(legacyJwtConfig().gracePeriod);
+        this.tokenGracePeriod = Math.floor((0, authTokenSettings_1.authTokenSetting)("gracePeriod"));
+        const deprecated = global.kuzzle.config.internal?.deprecatedSettings;
+        if (deprecated?.length) {
+            global.kuzzle.log.warn(`[DEPRECATED] The configuration section "security.jwt" is deprecated, use "security.authToken" instead (set: ${deprecated.join(", ")}). A value set under "security.authToken" takes precedence.`);
+        }
         this.anonymousToken = new token_1.Token({ userId: "-1" });
     }
     async init() {
@@ -194,17 +191,14 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
      *
      * @returns {Promise.<Object>} { _id, jwt, userId, ttl, expiresAt }
      */
-    async generateToken(user, { algorithm = global.kuzzle.config.security.authToken.algorithm ??
-        legacyJwtConfig().algorithm, expiresIn = global.kuzzle.config.security.authToken.expiresIn ??
-        legacyJwtConfig().expiresIn, bypassMaxTTL = false, type = "authToken", singleUse = false, } = {}) {
+    async generateToken(user, { algorithm = (0, authTokenSettings_1.authTokenSetting)("algorithm"), expiresIn = (0, authTokenSettings_1.authTokenSetting)("expiresIn"), bypassMaxTTL = false, type = "authToken", singleUse = false, } = {}) {
         if (!user || user._id === null) {
             throw securityError.get("unknown_user");
         }
         const parsedExpiresIn = parseTimespan(expiresIn);
         const maxTTL = type === "apiKey"
             ? global.kuzzle.config.security.apiKey.maxTTL
-            : (global.kuzzle.config.security.authToken.maxTTL ??
-                legacyJwtConfig().maxTTL);
+            : (0, authTokenSettings_1.authTokenSetting)("maxTTL");
         if (!bypassMaxTTL &&
             maxTTL > -1 &&
             (parsedExpiresIn > maxTTL || parsedExpiresIn === -1)) {

package/dist/lib/core/shared/KoncordeWrapper.d.ts

@@ -29,6 +29,15 @@ export declare class NormalizedFilterV3 {
     normalized: JSONObject[][];
     constructor(index: string, collection: string, normalized: JSONObject);
 }
+/**
+ * Exposes Koncorde v4 through an interface emulating Koncorde v3, to prevent
+ * breaking changes in Kuzzle.
+ *
+ * This class should either be removed entirely in the next major version, or
+ * perhaps proposed in a compatibility mode to help clients migrate smoothly.
+ *
+ * @deprecated Use the `koncorde` package (v4) directly.
+ */
 export declare class Koncorde {
     private filterIdIndexMap;
     private koncorde;