@harperfast/harper 5.0.25 → 5.1.0-beta.1

package/resources/tracked.ts

@@ -1,4 +1,4 @@
-import { ClientError } from '../utility/errors/hdbError.js';
+import { ClientError } from '../utility/errors/hdbError.ts';
 import * as crdtOperations from './crdt.ts';
 import { Blob } from './blob.ts';
 
@@ -193,12 +193,12 @@ export function assignTrackedAccessors(Target, typeDef, useFullPropertyProxy = f
 				configurable: true, // we need to be able to reconfigure these as schemas change (attributes can be added/removed at runtime)
 			};
 		}
-		descriptor.get.isAttribute = true;
+		(descriptor.get as any).isAttribute = true;
 		descriptors[name] = descriptor;
 		if (
 			!(name in prototype) ||
 			// this means that we are re-defining an attribute accessor (which is fine)
-			Object.getOwnPropertyDescriptor(prototype, name)?.get?.isAttribute
+			(Object.getOwnPropertyDescriptor(prototype, name)?.get as any)?.isAttribute
 		) {
 			Object.defineProperty(prototype, name, descriptor);
 		}
@@ -339,7 +339,7 @@ export class GenericTrackedObject<T extends object = any> {
 	constructor(sourceObject?: GenericTrackedObject<T> | T) {
 		if ((sourceObject as GenericTrackedObject<T>)?.getRecord)
 			throw new Error('Can not track an already tracked object, check for circular references');
-		this.#record = sourceObject;
+		this.#record = sourceObject as any;
 	}
 	getRecord(): T {
 		return this.#record;
@@ -486,11 +486,11 @@ class TrackedArray extends Array {
 	}
 	splice(...args) {
 		this[HAS_ARRAY_CHANGES] = true;
-		return super.splice(...args);
+		return (super.splice as any)(...args);
 	}
 	push(...args) {
 		this[HAS_ARRAY_CHANGES] = true;
-		return super.push(...args);
+		return (super.push as any)(...args);
 	}
 	pop() {
 		this[HAS_ARRAY_CHANGES] = true;
@@ -498,7 +498,7 @@ class TrackedArray extends Array {
 	}
 	unshift(...args) {
 		this[HAS_ARRAY_CHANGES] = true;
-		return super.unshift(...args);
+		return (super.unshift as any)(...args);
 	}
 	shift() {
 		this[HAS_ARRAY_CHANGES] = true;
@@ -508,7 +508,7 @@ class TrackedArray extends Array {
 TrackedArray.prototype.constructor = Array; // this makes type checks easier/faster (and we want it to be Array like too)
 
 // Copy a record into a resource, using copy-on-write for nested objects/arrays
-export function copyRecord(record, targetResource, attributes) {
+export function copyRecord(record, targetResource, attributes = Object.keys(record)) {
 	targetResource.setRecord(record);
 	for (const attribute of attributes) {
 		// do not override existing methods

package/resources/transaction.ts

@@ -3,10 +3,10 @@ import { _assignPackageExport } from '../globals.js';
 import { DatabaseTransaction, type Transaction, TRANSACTION_STATE } from './DatabaseTransaction.ts';
 import { AsyncLocalStorage } from 'async_hooks';
 
-export function transaction<T>(context: Context, callback: (transaction: Transaction) => T): T;
-export function transaction<T>(callback: (transaction: Transaction) => T): T;
 export const contextStorage = new AsyncLocalStorage<Context>();
 
+export function transaction<T>(context: Context, callback: (transaction: Transaction) => T): T;
+export function transaction<T>(callback: (transaction: Transaction) => T): T;
 /**
  * Start and run a new transaction. This can be called with a request to hold the transaction, or a new request object will be created
  * @param ctx
@@ -43,15 +43,15 @@ export function transaction<T>(
 	transaction.setContext(context);
 
 	// create a resource cache so that multiple requests to the same resource return the same resource
-	if (!context.resourceCache) context.resourceCache = [];
+	if (!context.resourceCache) context.resourceCache = new Map();
 	let result;
 	try {
 		result =
-			context.isExplicit || asyncStorageContext
+			(context as any).isExplicit || asyncStorageContext
 				? callback(transaction)
 				: contextStorage.run(context, () => callback(transaction));
-		if (result?.then) {
-			return result.then(onComplete, onError);
+		if ((result as any)?.then) {
+			return (result as any).then(onComplete, onError);
 		}
 	} catch (error) {
 		onError(error);
@@ -60,8 +60,8 @@ export function transaction<T>(
 	// when the transaction function completes, run this to commit the transaction
 	function onComplete(result) {
 		const committed = transaction.commit({ doneWriting: true });
-		if (committed.then) {
-			return committed.then(() => {
+		if ((committed as any).then) {
+			return (committed as any).then(() => {
 				return result;
 			});
 		} else {

package/resources/transactionBroadcast.ts

@@ -77,7 +77,7 @@ export function addSubscription(table, key, listener?: (key) => any, startTime?:
 	key = keyArrayToString(key);
 	const subscription = new Subscription(listener);
 	subscription.startTime = startTime;
-	let subscriptions: any[] = tableSubscriptions.get(key);
+	let subscriptions: any = tableSubscriptions.get(key);
 
 	if (subscriptions) subscriptions.push(subscription);
 	else {
@@ -96,7 +96,7 @@ export function addSubscription(table, key, listener?: (key) => any, startTime?:
  */
 class Subscription extends IterableEventQueue {
 	listener: (recordId: Id, auditEntry: any, localTime: number, beginTxn: boolean) => void;
-	subscriptions: [];
+	subscriptions: any;
 	startTime?: number;
 	includeDescendants?: boolean;
 	supportsTransactions?: boolean;
@@ -134,7 +134,7 @@ const ACTIONS_OF_INTEREST = ['put', 'patch', 'delete', 'message', 'invalidate'];
 // Sized to keep per-batch wall time within a few ms on commodity hardware while keeping the
 // scheduling overhead amortized; tune if profiling shows different shapes.
 const NOTIFY_BATCH_SIZE = 256;
-function notifyFromTransactionData(subscriptions, auditLogIterable, allowYield = false) {
+function notifyFromTransactionData(subscriptions, auditLogIterable?, allowYield = false) {
 	if (!subscriptions) return; // if no subscriptions to this env path, don't need to read anything
 	// If no real subscribers are attached, skip the iteration. The reusable iterator preserves its
 	// position and will pick up from where we left it once a subscriber is added.

package/security/auth.ts

@@ -2,16 +2,16 @@ import { getSuperUser } from './user.ts';
 import { server } from '../server/Server.ts';
 import { resources } from '../resources/Resources.ts';
 import { validateOperationToken, validateRefreshToken } from './tokenAuthentication.ts';
-import { table } from '../resources/databases.ts';
+import { table, type Table } from '../resources/databases.ts';
 import { v4 as uuid } from 'uuid';
-import * as env from '../utility/environment/environmentManager.js';
+import * as env from '../utility/environment/environmentManager.ts';
 import { CONFIG_PARAMS, AUTH_AUDIT_STATUS, AUTH_AUDIT_TYPES } from '../utility/hdbTerms.ts';
-import harperLogger from '../utility/logging/harper_logger.js';
+import harperLogger from '../utility/logging/harper_logger.ts';
 const { forComponent, AuthAuditLog } = harperLogger;
 import serverHandlers from '../server/itc/serverHandlers.js';
 const { user } = serverHandlers;
 import { Headers } from '../server/serverHelpers/Headers.ts';
-import { convertToMS } from '../utility/common_utils.js';
+import { convertToMS } from '../utility/common_utils.ts';
 import { verifyCertificate } from './certificateVerification/index.ts';
 import { serializeMessage } from '../server/serverHelpers/contentTypes.ts';
 const authLogger = forComponent('authentication');
@@ -24,11 +24,14 @@ const appsCors = env.get(CONFIG_PARAMS.HTTP_CORS);
 const operationsCorsAccesslist = env.get(CONFIG_PARAMS.OPERATIONSAPI_NETWORK_CORSACCESSLIST);
 const operationsCors = env.get(CONFIG_PARAMS.OPERATIONSAPI_NETWORK_CORS);
 
-const sessionTable = table({
+const _sessionTable = table<Table>({
 	table: 'hdb_session',
 	database: 'system',
 	attributes: [{ name: 'id', isPrimaryKey: true }, { name: 'user' }],
 });
+function getSessionTable() {
+	return _sessionTable;
+}
 const ENABLE_SESSIONS = env.get(CONFIG_PARAMS.AUTHENTICATION_ENABLESESSIONS) ?? true;
 // check the environment for a flag to bypass authentication (for testing) since it doesn't necessarily get set on child threads
 let AUTHORIZE_LOCAL =
@@ -45,8 +48,10 @@ server.onInvalidatedUser(() => {
 	// TODO: Eventually we probably want to be able to invalidate individual users
 	authorizationCache = new Map();
 });
+let bypassUser: any;
 export function bypassAuth() {
 	AUTHORIZE_LOCAL = true;
+	bypassUser = { username: 'bypass', role: { role: 'super_user', permission: { super_user: true } } };
 }
 
 // TODO: Make this not return a promise if it can be fulfilled synchronously (from cache)
@@ -98,7 +103,7 @@ export async function authentication(request, nextHandler) {
 				if (cookie.startsWith(cookiePrefix)) {
 					const end = cookie.indexOf(';');
 					sessionId = cookie.slice(cookiePrefix.length, end === -1 ? cookie.length : end);
-					session = await sessionTable.get(sessionId);
+					session = await getSessionTable().get(sessionId);
 					break;
 				}
 			}
@@ -114,10 +119,10 @@ export async function authentication(request, nextHandler) {
 				request.method,
 				request.pathname
 			);
-			log.auth_strategy = strategy;
-			if (sessionId) log.session_id = sessionId;
-			if (headers['referer']) log.referer = headers['referer'];
-			if (headers['origin']) log.origin = headers['origin'];
+			(log as any).auth_strategy = strategy;
+			if (sessionId) (log as any).session_id = sessionId;
+			if (headers['referer']) (log as any).referer = headers['referer'];
+			if (headers['origin']) (log as any).origin = headers['origin'];
 
 			if (status === AUTH_AUDIT_STATUS.SUCCESS) authEventLog.info?.(log);
 			else authEventLog.error?.(log);
@@ -242,10 +247,13 @@ export async function authentication(request, nextHandler) {
 			// or should this be cached in the session?
 			request.user = await server.getUser(session.user, null, request);
 		} else if (
+			(AUTHORIZE_LOCAL && bypassUser) || // explicit bypass (test mode); also covers ::ffff:127.x addresses
 			(AUTHORIZE_LOCAL && (request.ip?.includes('127.0.0.') || request.ip == '::1')) ||
-			(request?._nodeRequest?.socket?.server?._pipeName && request.ip === undefined) // allow socket domain
+			(request?._nodeRequest?.socket?.server?._pipeName &&
+				request?._nodeRequest?.socket?.server?.bypassLocalAuth &&
+				request.ip === undefined) // allow operations API domain socket
 		) {
-			request.user = await getSuperUser();
+			request.user = bypassUser ?? (await getSuperUser());
 		}
 		if (ENABLE_SESSIONS) {
 			request.session.update = function (updatedSession) {
@@ -303,7 +311,7 @@ export async function authentication(request, nextHandler) {
 					}
 				}
 				updatedSession.id = sessionId;
-				return sessionTable.put(updatedSession, {
+				return getSessionTable().put(updatedSession, {
 					expiresAt: expires ? Date.now() + convertToMS(expires) : undefined,
 				});
 			};
@@ -344,20 +352,21 @@ export async function authentication(request, nextHandler) {
 		return response;
 	}
 }
-let started;
-export function start({ server, port, securePort }) {
-	server.http(authentication, port || securePort ? { port, securePort } : { port: 'all' });
-	// keep it cleaned out periodically
-	if (!started) {
-		started = true;
-		setInterval(() => {
-			authorizationCache = new Map();
-		}, env.get(CONFIG_PARAMS.AUTHENTICATION_CACHETTL)).unref();
-		user.addListener(() => {
-			authorizationCache = new Map();
-		});
-	}
+setInterval(() => {
+	authorizationCache = new Map();
+}, env.get(CONFIG_PARAMS.AUTHENTICATION_CACHETTL)).unref();
+user.addListener(() => {
+	authorizationCache = new Map();
+});
+let started = false;
+export function handleApplication(scope: import('../components/Scope.ts').Scope) {
+	if (started) return;
+	started = true;
+	const { port, securePort }: any = scope.options.getAll() as { port?: number; securePort?: number };
+	const httpOpts = port || securePort ? ({ port, securePort } as any) : ({ port: 'all' } as any);
+	scope.server.http(authentication, httpOpts);
 }
+
 // operations
 export async function login(loginObject) {
 	if (!loginObject.baseRequest?.login) throw new Error('No session for login');

package/security/certificateVerification/crlVerification.ts

@@ -20,7 +20,6 @@ import {
 import { ERROR_CACHE_TTL, CRL_DEFAULT_VALIDITY_PERIOD, CRL_USER_AGENT } from './verificationConfig.ts';
 import type {
 	CertificateVerificationResult,
-	CertificateVerificationContext,
 	CertificateCacheEntry,
 	CRLCheckResult,
 	CRLConfig,
@@ -83,6 +82,10 @@ class CertificateRevocationListSource extends Resource {
 		} catch (error) {
 			logger.error?.(`CRL fetch error for: ${distributionPoint} - ${error}`);
 
+			if (error instanceof CRLSignatureVerificationError) {
+				throw error;
+			}
+
 			// Check failure mode
 			if (config.failureMode === 'fail-closed') {
 				// Cache the error for faster recovery
@@ -228,12 +231,12 @@ export async function verifyCRL(
 		const cacheKey = createCacheKey(certPemStr, issuerPemStr, 'crl');
 
 		// Pass certificate data as context - Harper will make it available as requestContext in the source
-		const cacheEntry = await (getCertificateCacheTable() as any).get(cacheKey, {
+		const cacheEntry = await (getCertificateCacheTable() as any).get(cacheKey, undefined, {
 			certPem: certPemStr,
 			issuerPem: issuerPemStr,
 			distributionPoint: distributionPoints[0], // Use first distribution point for CRL fetch
 			config: { crl: config ?? {} },
-		} as CertificateVerificationContext);
+		} as any);
 
 		if (!cacheEntry) {
 			// This should not happen if the source is configured correctly but handle it gracefully
@@ -259,6 +262,10 @@ export async function verifyCRL(
 	} catch (error) {
 		logger.error?.(`CRL verification error: ${error}`);
 
+		if (error instanceof CRLSignatureVerificationError) {
+			return { valid: false, status: 'error', error: (error as Error).message, method: 'crl' };
+		}
+
 		// Check failure mode
 		if (config.failureMode === 'fail-closed') {
 			return { valid: false, status: 'error', error: (error as Error).message, method: 'crl' };
@@ -488,7 +495,7 @@ async function downloadAndParseCRL(
 		}
 
 		// Parse and validate the CRL
-		const crl = pkijs.CertificateRevocationList.fromBER(crlDerBuffer);
+		const crl = pkijs.CertificateRevocationList.fromBER(crlDerBuffer as any);
 
 		// Verify CRL signature
 		const issuerCert = pkijs.Certificate.fromBER(pemToBuffer(issuerPemStr));

package/security/{cryptoHash.js → cryptoHash.ts}

@@ -1,6 +1,6 @@
 'use strict';
 
-const crypto = require('crypto');
+import * as crypto from 'crypto';
 
 const CRYPTO_ALGORITHM = 'aes-256-cbc';
 const KEY_BYTE_LENGTH = 32;
@@ -9,12 +9,7 @@ const KEY_STRING_LENGTH = 64;
 const IV_STRING_LENGTH = 32;
 const ENCRYPTED_STRING_START = KEY_STRING_LENGTH + IV_STRING_LENGTH;
 
-module.exports = {
-	encrypt,
-	decrypt,
-};
-
-function encrypt(text) {
+export function encrypt(text: string): string {
 	let key = crypto.randomBytes(KEY_BYTE_LENGTH);
 	let iv = crypto.randomBytes(IV_BYTE_LENGTH);
 
@@ -28,7 +23,7 @@ function encrypt(text) {
 	return keyString + ivString + encryptedString;
 }
 
-function decrypt(text) {
+export function decrypt(text: string): string {
 	let keyString = text.substr(0, KEY_STRING_LENGTH);
 	let ivString = text.substr(KEY_STRING_LENGTH, IV_STRING_LENGTH);
 	let encrptedString = text.substr(ENCRYPTED_STRING_START, text.length);

package/security/data_objects/{PermissionAttributeResponseObject.js → PermissionAttributeResponseObject.ts}

@@ -1,15 +1,15 @@
 'use strict';
 
-class PermissionAttributeResponseObject {
+export default class PermissionAttributeResponseObject {
+	attribute_name: string;
+	required_permissions: any[];
 	/**
 	 * Used to track role-based, attribute-level permission issues related to an incoming API request/operation
 	 * @param attrName {String} name of the attribute with a permission restriction
 	 * @param requiredPerms {Array} array of CRU perms that are required on attr for operation
 	 */
-	constructor(attrName, requiredPerms = []) {
+	constructor(attrName: string, requiredPerms: any[] = []) {
 		this.attribute_name = attrName;
 		this.required_permissions = requiredPerms;
 	}
 }
-
-module.exports = PermissionAttributeResponseObject;

package/security/data_objects/{PermissionResponseObject.js → PermissionResponseObject.ts}

@@ -1,14 +1,17 @@
 'use strict';
 
-const PermissionTableResponseObject = require('./PermissionTableResponseObject.js');
-const PermissionAttributeResponseObject = require('./PermissionAttributeResponseObject.js');
-const { HDB_ERROR_MSGS } = require('../../utility/errors/commonErrors.js');
+import PermissionTableResponseObject from './PermissionTableResponseObject.ts';
+import PermissionAttributeResponseObject from './PermissionAttributeResponseObject.ts';
+import { HDB_ERROR_MSGS } from '../../utility/errors/commonErrors.ts';
 
 /**
  * This object organizes permission checks into a cohesive response object that will be returned to
  * the user in the case of a failed permissions check.
  */
-class PermissionResponseObject {
+export default class PermissionResponseObject {
+	error: string;
+	unauthorized_access: any;
+	invalid_schema_items: any[];
 	constructor() {
 		this.error = HDB_ERROR_MSGS.OP_AUTH_PERMS_ERROR;
 		this.unauthorized_access = {};
@@ -21,7 +24,7 @@ class PermissionResponseObject {
 	 * @param errMsg
 	 * @returns { PermissionResponseObject }
 	 */
-	handleUnauthorizedItem(errMsg) {
+	handleUnauthorizedItem(errMsg: string) {
 		this.invalid_schema_items = [];
 		this.unauthorized_access = [errMsg];
 		return this;
@@ -34,7 +37,7 @@ class PermissionResponseObject {
 	 * @param errMsg
 	 * @returns { PermissionResponseObject }
 	 */
-	handleInvalidItem(errMsg) {
+	handleInvalidItem(errMsg: string) {
 		this.invalid_schema_items = [errMsg];
 		this.unauthorized_access = [];
 		return this;
@@ -48,7 +51,7 @@ class PermissionResponseObject {
 	 * @param schema - schema that the item is a part of
 	 * @param table - table that the item is a part of
 	 */
-	addInvalidItem(item, schema, table) {
+	addInvalidItem(item: any, schema: string, table: string) {
 		if (schema && table) {
 			const schemaTable = `${schema}_${table}`;
 			if (this.unauthorized_access[schemaTable]) {
@@ -64,7 +67,7 @@ class PermissionResponseObject {
 	 * @param table - table name that user does not have correct perms on
 	 * @param requiredPerms - permission/s that user does not have on the table to complete the operation
 	 */
-	addUnauthorizedTable(schema, table, requiredTablePerms) {
+	addUnauthorizedTable(schema: string, table: string, requiredTablePerms: any[]) {
 		const failedTable = new PermissionTableResponseObject(schema, table, requiredTablePerms);
 
 		const schemaTable = `${schema}_${table}`;
@@ -79,7 +82,7 @@ class PermissionResponseObject {
 	 * @param table - table where attr restrictions exist
 	 * @param restrictedAttrs - the perms restrictions for each attr
 	 */
-	addUnauthorizedAttributes(attrKeys, schema, table, restrictedAttrs) {
+	addUnauthorizedAttributes(attrKeys: string[], schema: string, table: string, restrictedAttrs: any) {
 		const unauthorizedTableAttributes = [];
 		attrKeys.forEach((attr) => {
 			const attributeObject = new PermissionAttributeResponseObject(attr, restrictedAttrs[attr]);
@@ -111,5 +114,3 @@ class PermissionResponseObject {
 		return null;
 	}
 }
-
-module.exports = PermissionResponseObject;

package/security/data_objects/{PermissionTableResponseObject.js → PermissionTableResponseObject.ts}

@@ -1,6 +1,10 @@
 'use strict';
 
-class PermissionTableResponseObject {
+export default class PermissionTableResponseObject {
+	schema: string;
+	table: string;
+	required_table_permissions: any[];
+	required_attribute_permissions: any[];
 	/**
 	 * Organizes permission checks into a cohesive response object that will be returned to
 	 * the user in the case of a failed permissions check.
@@ -9,12 +13,10 @@ class PermissionTableResponseObject {
 	 * @param requiredTablePerms {Array}
 	 * @param requiredAttrPerms {Array}
 	 */
-	constructor(schema, table, requiredTablePerms = [], requiredAttrPerms = []) {
+	constructor(schema: string, table: string, requiredTablePerms: any[] = [], requiredAttrPerms: any[] = []) {
 		this.schema = schema;
 		this.table = table;
 		this.required_table_permissions = requiredTablePerms;
 		this.required_attribute_permissions = requiredAttrPerms;
 	}
 }
-
-module.exports = PermissionTableResponseObject;

package/security/{fastifyAuth.js → fastifyAuth.ts}

@@ -1,25 +1,26 @@
 'use strict';
 
-const validation = require('../validation/check_permissions.js');
-const passport = require('passport');
-const LocalStrategy = require('passport-local').Strategy;
-const BasicStrategy = require('passport-http').BasicStrategy;
-const util = require('util');
-const userFunctions = require('./user.ts');
+import * as validation from '../validation/check_permissions.ts';
+import passport from 'passport';
+import { Strategy as LocalStrategy } from 'passport-local';
+import { BasicStrategy } from 'passport-http';
+import * as util from 'util';
+import * as userFunctions from './user.ts';
 const cbFindValidateUsers = util.callbackify(userFunctions.findAndValidateUser);
-const hdbTerms = require('../utility/hdbTerms.ts');
-const tokenAuthentication = require('./tokenAuthentication.ts');
-const { AccessViolation } = require('../utility/errors/hdbError');
+import * as hdbTerms from '../utility/hdbTerms.ts';
+import * as tokenAuthentication from './tokenAuthentication.ts';
+import { AccessViolation } from '../utility/errors/hdbError.ts';
+import { authentication } from './auth.ts';
 
 passport.use(
 	new LocalStrategy(function (username, password, done) {
-		cbFindValidateUsers(username, password, done);
+		(cbFindValidateUsers as any)(username, password, done);
 	})
 );
 
 passport.use(
 	new BasicStrategy(function (username, password, done) {
-		cbFindValidateUsers(username, password, done);
+		(cbFindValidateUsers as any)(username, password, done);
 	})
 );
 
@@ -31,8 +32,83 @@ passport.deserializeUser(function (user, done) {
 	done(null, user);
 });
 
-function authorize(req, res, next) {
-	if (req.raw?.user !== undefined) return next(null, req.raw.user);
+const INTERNAL_USER_HEADER = 'x-harper-internal-pre-auth-user';
+
+export function authorize(req: any, res: any, next: any) {
+	if (req.raw?.user != undefined) {
+		return next(null, req.raw.user);
+	}
+	// On Bun, Harper's auth middleware passes pre-authenticated users via this internal header.
+	// bunDelegateToNodeServer strips it from real network requests before injecting into Fastify,
+	// so it is only safe to trust under Bun — on Node.js the raw socket path delivers headers
+	// directly to Fastify with no stripping, so a forged header could bypass auth.
+	if (typeof globalThis.Bun !== 'undefined') {
+		const preAuthUser = req.headers?.[INTERNAL_USER_HEADER];
+		if (preAuthUser) return next(null, JSON.parse(preAuthUser));
+		// No pre-auth header: auth.ts didn't run for this port (ops API). Mirror what Node.js does via
+		// baseRequest — build a shim request and call authentication() so AUTHORIZE_LOCAL can apply.
+		const shimRequest = {
+			headers: { asObject: Object.assign({}, req.headers) },
+			ip: req.socket?.remoteAddress ?? '',
+			isOperationsServer: true,
+			method: req.method,
+			url: req.url,
+			pathname: (req.url ?? '/').split('?')[0],
+			authorized: undefined,
+			mtlsConfig: undefined,
+			peerCertificate: { subject: null },
+			_nodeRequest: null,
+			_nodeResponse: null,
+		};
+		let nextCalled = false;
+		return authentication(shimRequest, (request) => {
+			nextCalled = true;
+			if (request.user) return next(null, request.user);
+			req.raw.user = null;
+			return authorize(req, res, next);
+		}).then(
+			(response) => {
+				if (nextCalled) return response;
+				if (response?.status === -1) {
+					req.raw.user = null;
+					return authorize(req, res, next);
+				}
+				const body = typeof response?.body === 'string' ? JSON.parse(response.body) : (response?.body ?? {});
+				return next(new Error(body.error ?? body));
+			},
+			(error) => next(error)
+		);
+	}
+	if (req.raw?.user === undefined && req.raw?.baseRequest) {
+		let nextCalled = false;
+		return authentication(req.raw?.baseRequest, (request: any) => {
+			nextCalled = true;
+			if (request.user) {
+				req.raw.user = request.user;
+				return next(null, req.raw.user);
+			} else {
+				req.raw.user = null; // don't fall in this branch again
+				return authorize(req, res, next);
+			}
+		}).then(
+			(response: any) => {
+				if (nextCalled) {
+					return response;
+				}
+				if (response?.status === -1) {
+					// authentication declined (e.g. refresh token) — fall through to the
+					// Bearer/Basic handling below
+					req.raw.user = null;
+					return authorize(req, res, next);
+				}
+				const body = JSON.parse(response.body);
+				return next(new Error(body.error ?? body));
+			},
+			(error: any) => {
+				return next(error);
+			}
+		);
+	}
 	let strategy;
 	let token;
 	if (req.headers?.authorization) {
@@ -87,8 +163,10 @@ function authorize(req, res, next) {
 	}
 }
 
-function checkPermissions(checkPermissionObj, callback) {
-	let validationResults = validation(checkPermissionObj);
+export function checkPermissions(checkPermissionObj: any, callback: any) {
+	let validationResults = (validation as any).default
+		? (validation as any).default(checkPermissionObj)
+		: (validation as any)(checkPermissionObj);
 
 	if (validationResults) {
 		callback(validationResults);
@@ -162,8 +240,3 @@ function checkPermissions(checkPermissionObj, callback) {
 
 	return callback(null, authoriziationObj);
 }
-
-module.exports = {
-	authorize,
-	checkPermissions,
-};

package/security/impersonation.ts

@@ -2,9 +2,9 @@ import type { User } from './user.ts';
 import type { ImpersonatePayload } from '../server/operationsServer.ts';
 import { getUsersWithRolesCache } from './user.ts';
 import { validateOperations } from '../utility/operationPermissions.ts';
-import { ClientError } from '../utility/errors/hdbError.js';
-import harperLogger from '../utility/logging/harper_logger.js';
-import { getRoleByName } from './role.js';
+import { ClientError } from '../utility/errors/hdbError.ts';
+import harperLogger from '../utility/logging/harper_logger.ts';
+import { getRoleByName } from './role.ts';
 
 /**
  * Applies impersonation to a request. The authenticated user must be a super_user.