@harperfast/harper 5.0.25 → 5.1.0-beta.1

package/security/jsLoader.ts

@@ -2,18 +2,19 @@ import { Resource } from '../resources/Resource.ts';
 import { contextStorage, transaction } from '../resources/transaction.ts';
 import { RequestTarget } from '../resources/RequestTarget.ts';
 import { tables, databases } from '../resources/databases.ts';
+import { models as harperModelsSingleton } from '../resources/models/Models.ts';
 import { readFile } from 'node:fs/promises';
 import { dirname, isAbsolute } from 'node:path';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { SourceTextModule, SyntheticModule, createContext, runInContext, runInThisContext } from 'node:vm';
 import { ApplicationScope } from '../components/ApplicationScope.ts';
-import logger from '../utility/logging/harper_logger.js';
+import logger from '../utility/logging/harper_logger.ts';
 import { createRequire } from 'node:module';
 import * as env from '../utility/environment/environmentManager';
 import * as child_process from 'node:child_process';
 import { CONFIG_PARAMS } from '../utility/hdbTerms.ts';
 import { contentTypes } from '../server/serverHelpers/contentTypes.ts';
-import type { CompartmentOptions } from 'ses';
+import type {} from 'ses';
 import {
 	mkdirSync,
 	readFileSync,
@@ -39,6 +40,13 @@ const HARPER_MODULE_IDS = new Set([
 	'@harperfast/harper-pro',
 ]);
 
+// `harper.models` (consumed by `getHarperExports`) and the top-level
+// `models` package export both point at the same process-wide `Models`
+// singleton declared in `resources/models/Models.ts`. The Models class has
+// no per-Scope or per-ApplicationScope state (registry + analytics writer
+// are process-singletons), so one shared instance is observationally
+// identical to the per-Scope instances built in `components/Scope.ts`.
+
 let lockedDown = false;
 /**
  * This is the main entry point for loading plugin and application modules that may be executed in a
@@ -95,6 +103,7 @@ export async function scopedImport(filePath: string | URL, scope?: ApplicationSc
 			// is hidden behind a private symbol (arrowMessagePrivateSymbol)
 			// on the error object and the only way to access it is to use the
 			// internal util.decorateErrorStack() function
+			// @ts-ignore
 			const util = await import('internal/util');
 			util.default.decorateErrorStack(err);
 		} catch {
@@ -640,7 +649,7 @@ async function loadModuleWithVM(moduleUrl: string, scope: ApplicationScope, useC
 async function getCompartment(scope: ApplicationScope, globals) {
 	const { StaticModuleRecord } = await import('@endo/static-module-record');
 	require('ses');
-	const compartment: CompartmentOptions = new (Compartment as typeof CompartmentOptions)(
+	const compartment: any = new (Compartment as any)(
 		globals,
 		{
 			//harperdb: { Resource, tables, databases }
@@ -774,6 +783,11 @@ function getHarperExports(scope: ApplicationScope) {
 		Resource,
 		tables,
 		databases,
+		// `harper.models` — same singleton that's surfaced as the top-level
+		// `models` package export (see `resources/models/Models.ts`).  The
+		// registry it reads from is populated at boot by
+		// `resources/models/bootstrap.ts`.
+		models: harperModelsSingleton,
 		createBlob,
 		RequestTarget,
 		getContext,
@@ -813,7 +827,7 @@ const ALLOWED_NODE_BUILTIN_MODULES = env.get(CONFIG_PARAMS.APPLICATIONS_ALLOWEDB
 			},
 		};
 const ALLOWED_COMMANDS = new Set(env.get(CONFIG_PARAMS.APPLICATIONS_ALLOWEDSPAWNCOMMANDS) ?? []);
-const child_processConstrained = {
+const child_processConstrained: any = {
 	exec: createSpawn(child_process.exec),
 	execFile: createSpawn(child_process.execFile),
 	fork: createSpawn(child_process.fork, true), // this is launching node, so deemed safe
@@ -1036,14 +1050,14 @@ function createSpawn(spawnFunction: (...args: any) => child_process.ChildProcess
  */
 function checkAllowedModulePath(moduleUrl: string, allowedPath?: string): boolean {
 	if (moduleUrl.startsWith('file:')) {
-		let path = moduleUrl.slice(7);
+		let path = fileURLToPath(moduleUrl);
 		try {
 			path = realpathSync(path);
 		} catch {}
 		if (!allowedPath || path.startsWith(allowedPath)) {
 			return;
 		}
-		throw new Error(`Can not load module outside of allowed path`);
+		throw new Error(`Can not load module at ${path} outside of allowed path ${allowedPath}`);
 	}
 	let simpleName = moduleUrl.startsWith('node:') ? moduleUrl.slice(5) : moduleUrl;
 	simpleName = simpleName.split('/')[0];
@@ -1058,7 +1072,7 @@ export function getUser() {
 	return contextStorage.getStore()?.user;
 }
 export function getResponse() {
-	return contextStorage.getStore()?.response;
+	return (contextStorage.getStore() as any)?.response;
 }
 
 export function preventFunctionConstructor() {
@@ -1099,7 +1113,7 @@ function freezeIntrinsics() {
 		FinalizationRegistry,
 	]) {
 		Object.freeze(Intrinsic);
-		Object.freeze(Intrinsic.prototype);
+		Object.freeze((Intrinsic as any).prototype);
 	}
 	Object.freeze(Function);
 }

package/security/{keys.js → keys.ts}

@@ -1,64 +1,48 @@
 'use strict';
 
-const path = require('path');
-const { watch } = require('chokidar');
-const fs = require('fs-extra');
-const forge = require('node-forge');
-const net = require('net');
-let { generateKeyPair, X509Certificate, createPrivateKey, randomBytes } = require('node:crypto');
-const util = require('util');
-generateKeyPair = util.promisify(generateKeyPair);
+import * as path from 'path';
+import { watch } from 'chokidar';
+import * as fs from 'fs-extra';
+import * as forge from 'node-forge';
+import * as net from 'net';
+import { generateKeyPair as generateKeyPairOrig, X509Certificate, createPrivateKey, randomBytes } from 'node:crypto';
+
+import * as util from 'util';
+const generateKeyPair = util.promisify(generateKeyPairOrig);
+
 const pki = forge.pki;
-const { v4: uuidv4 } = require('uuid');
-const { forComponent } = require('../utility/logging/harper_logger.js');
-const envManager = require('../utility/environment/environmentManager.js');
-const hdbTerms = require('../utility/hdbTerms.ts');
-const { CONFIG_PARAMS } = hdbTerms;
-const certificatesTerms = require('../utility/terms/certificates.js');
+import { v4 as uuidv4 } from 'uuid';
+import { forComponent } from '../utility/logging/harper_logger.ts';
+import * as envManager from '../utility/environment/environmentManager.ts';
+import * as hdbTerms from '../utility/hdbTerms.ts';
+
+import * as certificatesTerms from '../utility/terms/certificates.js';
 const tls = require('node:tls');
-const { relative, join } = require('node:path');
-const { CERTIFICATE_VALUES } = certificatesTerms;
-const assignCmdenvVars = require('../utility/assignCmdEnvVariables.js');
-const configUtils = require('../config/configUtils.js');
-const { table, getDatabases, databases } = require('../resources/databases.ts');
+import { relative, join } from 'node:path';
+
+import assignCmdenvVars from '../utility/assignCmdEnvVariables.ts';
+import * as configUtils from '../config/configUtils.js';
+import { table, getDatabases, databases } from '../resources/databases.ts';
 const logger = forComponent('tls').conditional;
-const { getThisNodeName, getThisNodeUrl, urlToNodeName, clearThisNodeName } = require('../server/nodeName.ts');
-
-exports.generateKeys = generateKeys;
-exports.updateConfigCert = updateConfigCert;
-exports.setCertTable = setCertTable;
-exports.getCertTable = getCertTable;
-exports.loadCertificates = loadCertificates;
-exports.reviewSelfSignedCert = reviewSelfSignedCert;
-exports.createTLSSelector = createTLSSelector;
-exports.listCertificates = listCertificates;
-exports.generateCertsKeys = generateCertsKeys;
-exports.getReplicationCert = getReplicationCert;
-exports.getReplicationCertAuth = getReplicationCertAuth;
-exports.renewSelfSigned = renewSelfSigned;
-exports.hostnamesFromCert = hostnamesFromCert;
-exports.getHostnamesFromCertificate = getHostnamesFromCertificate;
-exports.getPrimaryHostName = getPrimaryHostName;
-exports.generateSerialNumber = generateSerialNumber;
-exports.getPrivateKeys = () => privateKeys;
-exports.getCertAuthority = getCertAuthority;
-exports.certExtensions = certExtensions;
-exports.getCommonName = getCommonName;
-
-const { readFileSync, statSync } = require('node:fs');
-const { getTicketKeys, onMessageFromWorkers } = require('../server/threads/manageThreads.js');
-const { isMainThread } = require('worker_threads');
-const { TLSSocket } = require('node:tls');
+const { CONFIG_PARAMS } = hdbTerms;
+const { CERTIFICATE_VALUES } = certificatesTerms;
+import { getThisNodeName, getThisNodeUrl, urlToNodeName, clearThisNodeName } from '../server/nodeName.ts';
+
+export const getPrivateKeys = () => privateKeys;
+
+import { readFileSync, statSync } from 'node:fs';
+import { getTicketKeys, onMessageFromWorkers } from '../server/threads/manageThreads.js';
+import { isMainThread } from 'worker_threads';
+import { TLSSocket } from 'node:tls';
 
 const CERT_VALIDITY_DAYS = 3650;
 const CERT_DOMAINS = ['127.0.0.1', 'localhost', '::1'];
-const CERT_ATTRIBUTES = [
+export const CERT_ATTRIBUTES = [
 	{ name: 'countryName', value: 'USA' },
 	{ name: 'stateOrProvinceName', value: 'Colorado' },
 	{ name: 'localityName', value: 'Denver' },
 	{ name: 'organizationName', value: 'HarperDB, Inc.' },
 ];
-exports.CERT_ATTRIBUTES = CERT_ATTRIBUTES;
 
 /**
  * Generates a cryptographically secure serial number for X.509 certificates.
@@ -68,7 +52,7 @@ exports.CERT_ATTRIBUTES = CERT_ATTRIBUTES;
  *
  * @returns {string} 16-character hex string
  */
-function generateSerialNumber() {
+export function generateSerialNumber() {
 	const bytes = randomBytes(8);
 	bytes[0] = (bytes[0] & 0x7f) | 0x01; // Clear high bit with bitmask 0x7F (01111111) and ensure that it is non-zero
 	return bytes.toString('hex');
@@ -83,9 +67,9 @@ onMessageFromWorkers(async (message) => {
 });
 
 let certificateTable;
-function getCertTable() {
+export function getCertTable() {
 	if (!certificateTable) {
-		certificateTable = getDatabases()['system']['hdb_certificate'];
+		certificateTable = getDatabases()['system']?.['hdb_certificate'];
 		if (!certificateTable) {
 			certificateTable = table({
 				table: 'hdb_certificate',
@@ -124,13 +108,13 @@ function getCertTable() {
 	return certificateTable;
 }
 
-async function getReplicationCert() {
-	const SNICallback = createTLSSelector('replication');
+export async function getReplicationCert() {
+	const SNICallback = createTLSSelector('replication', undefined);
 	const secureTarget = {
 		secureContexts: null,
 		setSecureContext: (_ctx) => {},
 	};
-	await SNICallback.initialize(secureTarget);
+	await (SNICallback as any).initialize(secureTarget);
 	const cert = secureTarget.secureContexts.get(getThisNodeName());
 	if (!cert) return;
 	const certParsed = new X509Certificate(cert.options.cert);
@@ -140,7 +124,7 @@ async function getReplicationCert() {
 	return cert;
 }
 
-async function getReplicationCertAuth() {
+export async function getReplicationCertAuth() {
 	getCertTable();
 	const certPem = (await getReplicationCert()).options.cert;
 	const repCert = new X509Certificate(certPem);
@@ -155,7 +139,7 @@ const privateKeys = new Map();
  * This is responsible for loading any certificates that are in the harperdb-config.yaml file and putting them into the hdbCertificate table.
  * @return {*}
  */
-function loadCertificates() {
+export function loadCertificates() {
 	if (configuredCertsLoaded) return;
 	configuredCertsLoaded = true;
 	// these are the sections of the config to check
@@ -170,9 +154,9 @@ function loadCertificates() {
 		if (configs) {
 			// the configs can be an array, so normalize to an array
 			if (!Array.isArray(configs)) {
-				configs = [configs];
+				configs = [configs] as any;
 			}
-			for (let config of configs) {
+			for (let config of configs as any) {
 				const privateKeyPath = config.privateKey;
 				// need to relativize the paths so they aren't exposed
 				let private_key_name = privateKeyPath && relative(join(rootPath, 'keys'), privateKeyPath);
@@ -300,7 +284,7 @@ function getHost() {
 	return urlToNodeName(url);
 }
 
-function getCommonName() {
+export function getCommonName() {
 	let node_name = getThisNodeName();
 	if (node_name == null) {
 		const host = CERT_DOMAINS[0];
@@ -310,7 +294,7 @@ function getCommonName() {
 	return node_name;
 }
 
-function certExtensions() {
+export function certExtensions() {
 	const altName = CERT_DOMAINS.includes(getCommonName()) ? CERT_DOMAINS : [...CERT_DOMAINS, getCommonName()];
 	if (!altName.includes(getHost())) altName.push(getHost());
 	return [
@@ -368,7 +352,7 @@ async function createCertificateTable(cert, caCert) {
 	});
 }
 
-async function setCertTable(certRecord) {
+export async function setCertTable(certRecord) {
 	let cert;
 	try {
 		cert = new X509Certificate(certRecord.certificate);
@@ -383,7 +367,7 @@ async function setCertTable(certRecord) {
 			`Invalid certificate format for ${certRecord.name}: ${error.message}. ` +
 				`This may be due to corrupted certificate data during transfer or encoding issues.`
 		);
-		certError.code = 'INVALID_CERTIFICATE_FORMAT';
+		(certError as any).code = 'INVALID_CERTIFICATE_FORMAT';
 		certError.cause = error;
 		throw certError;
 	}
@@ -401,7 +385,7 @@ async function setCertTable(certRecord) {
 	await certificateTable.patch(certRecord);
 }
 
-async function generateKeys() {
+export async function generateKeys() {
 	const keys = await generateKeyPair('rsa', {
 		modulusLength: 4096,
 		publicKeyEncoding: {
@@ -454,7 +438,7 @@ async function generateCertificates(caPrivateKey, publicKey, caCert) {
 	return pki.certificateToPem(publicCert);
 }
 
-async function getCertAuthority() {
+export async function getCertAuthority() {
 	const allCerts = await listCertificates();
 	let match;
 	for (let cert of allCerts) {
@@ -512,7 +496,7 @@ async function generateCertAuthority(private_key, publicKey, writeKey = true) {
 	return caCert;
 }
 
-async function generateCertsKeys() {
+export async function generateCertsKeys() {
 	const { privateKey, publicKey } = await generateKeys();
 	const caCert = await generateCertAuthority(privateKey, publicKey);
 	const publicCert = await generateCertificates(privateKey, publicKey, caCert);
@@ -524,7 +508,7 @@ async function generateCertsKeys() {
  * Delete any existing self-signed certs (including CA) and create new ones
  * @returns {Promise<void>}
  */
-async function renewSelfSigned() {
+export async function renewSelfSigned() {
 	getCertTable();
 	for await (const cert of certificateTable.search([{ attribute: 'is_self_signed', value: true }])) {
 		await certificateTable.delete(cert.name);
@@ -533,7 +517,7 @@ async function renewSelfSigned() {
 	await reviewSelfSignedCert();
 }
 
-async function reviewSelfSignedCert() {
+export async function reviewSelfSignedCert() {
 	// Clear any cached node name var
 	clearThisNodeName();
 	await loadCertificates();
@@ -632,7 +616,7 @@ async function reviewSelfSignedCert() {
 
 // Update the cert config in harperdb-config.yaml
 // If CLI or Env values are present it will use those values, else it will use default private key.
-function updateConfigCert() {
+export function updateConfigCert() {
 	const cliEnvArgs = assignCmdenvVars(Object.keys(hdbTerms.CONFIG_PARAM_MAP), true);
 	const keysPath = path.join(envManager.getHdbBasePath(), hdbTerms.LICENSE_KEY_DIR_NAME);
 	const private_key = path.join(keysPath, certificatesTerms.PRIVATEKEY_PEM_NAME);
@@ -668,7 +652,7 @@ function updateConfigCert() {
 	// Filter out any cert config keys already set by HARPER_SET_CONFIG so we don't overwrite them
 	// with defaults. On first boot, HARPER_SET_CONFIG values are written to the config file during
 	// createConfigFile(), but updateConfigCert() runs afterward without re-applying HARPER_SET_CONFIG.
-	const { filterArgsAgainstRuntimeConfig } = require('../config/harperConfigEnvVars.ts');
+	const { filterArgsAgainstRuntimeConfig } = require('../config/harperConfigEnvVars');
 	const filteredCerts = filterArgsAgainstRuntimeConfig(newCerts);
 
 	configUtils.updateConfigValue(undefined, undefined, filteredCerts, false, true);
@@ -679,37 +663,43 @@ function readPEM(path) {
 	return readFileSync(path, 'utf8');
 }
 // this horrifying hack is brought to you by https://github.com/nodejs/node/issues/36655
-const origCreateSecureContext = tls.createSecureContext;
-tls.createSecureContext = function (options) {
-	if (!options.cert || !options.key) {
-		return origCreateSecureContext(options);
-	}
-	let lessOptions = { ...options };
-	delete lessOptions.key;
-	delete lessOptions.cert;
-	let ctx = origCreateSecureContext(lessOptions);
-	ctx.context.setCert(options.cert);
-	ctx.context.setKey(options.key, undefined);
-	return ctx;
-};
-// Node.js SNI callbacks _add_ the certificate and don't replace it, and so we can't have a default certificate,
-// so we have to assign the default certificate during the cert callback, because the default SNI callback isn't
-// consistently called for all TLS connections (isn't called if no SNI server name is provided).
-// first we have interrupt the socket initialization to add our own cert callback
-const originalInit = TLSSocket.prototype._init;
-TLSSocket.prototype._init = function (socket, wrap) {
-	originalInit.call(this, socket, wrap);
-	let tlsSocket = this;
-	this._handle.oncertcb = function (info) {
-		const servername = info.servername;
-		tlsSocket._SNICallback(servername, (err, context) => {
-			this.sni_context = context?.context || context;
-			// note that this skips the checks for multiple callbacks and entirely skips OCSP, so if we ever need that, we
-			// need to call the original oncertcb
-			this.certCbDone();
-		});
+if (typeof globalThis.Bun === 'undefined') {
+	const origCreateSecureContext = tls.createSecureContext;
+	(tls as any).createSecureContext = function (options: any) {
+		if (!options.cert || !options.key) {
+			return origCreateSecureContext(options);
+		}
+		let lessOptions = { ...options };
+		delete lessOptions.key;
+		delete lessOptions.cert;
+		let ctx = origCreateSecureContext(lessOptions);
+		if (typeof ctx.context?.setCert !== 'function') {
+			// setCert is a Node.js internal — not available in all environments; fall back to default
+			return origCreateSecureContext(options);
+		}
+		ctx.context.setCert(options.cert);
+		ctx.context.setKey(options.key, undefined);
+		return ctx;
 	};
-};
+	// Node.js SNI callbacks _add_ the certificate and don't replace it, and so we can't have a default certificate,
+	// so we have to assign the default certificate during the cert callback, because the default SNI callback isn't
+	// consistently called for all TLS connections (isn't called if no SNI server name is provided).
+	// first we have interrupt the socket initialization to add our own cert callback
+	const originalInit = (TLSSocket as any).prototype._init;
+	(TLSSocket as any).prototype._init = function (socket: any, wrap: any) {
+		originalInit.call(this, socket, wrap);
+		let tlsSocket = this;
+		this._handle.oncertcb = function (info) {
+			const servername = info.servername;
+			tlsSocket._SNICallback(servername, (err, context) => {
+				this.sni_context = context?.context || context;
+				// note that this skips the checks for multiple callbacks and entirely skips OCSP, so if we ever need that, we
+				// need to call the original oncertcb
+				this.certCbDone();
+			});
+		};
+	};
+}
 
 let caCerts = new Map();
 
@@ -719,17 +709,17 @@ let caCerts = new Map();
  * @param mtlsOptions
  * @return {(function(*, *): (*|undefined))|*}
  */
-function createTLSSelector(type, mtlsOptions) {
+export function createTLSSelector(type, mtlsOptions?): any {
 	let secureContexts = new Map();
 	let defaultContext;
 	let hasWildcards = false;
-	SNICallback.initialize = (server) => {
-		if (SNICallback.ready) return SNICallback.ready;
+	(SNICallback as any).initialize = (server: any) => {
+		if ((SNICallback as any).ready) return (SNICallback as any).ready;
 		if (server) {
 			server.secureContexts = secureContexts;
 			server.secureContextsListeners = [];
 		}
-		return (SNICallback.ready = new Promise((resolve, reject) => {
+		return ((SNICallback as any).ready = new Promise<void>((resolve, reject) => {
 			function updateTLS() {
 				try {
 					secureContexts.clear();
@@ -743,7 +733,7 @@ function createTLSSelector(type, mtlsOptions) {
 						const certificate = cert.certificate;
 						const certParsed = new X509Certificate(certificate);
 						if (cert.is_authority) {
-							certParsed.asString = certificate;
+							(certParsed as any).asString = certificate;
 							caCerts.set(certParsed.subject, certificate);
 						}
 					}
@@ -754,11 +744,13 @@ function createTLSSelector(type, mtlsOptions) {
 								continue;
 							}
 							let quality = cert.is_self_signed ? 1 : 3;
+							// normalize: stored as scalar in legacy/manual entries, expected array
+							const uses = Array.isArray(cert.uses) ? cert.uses : cert.uses ? [cert.uses] : [];
 							// prefer operations certificates for operations API
-							if (cert.uses?.includes(type)) quality += 3;
-							else if (cert.uses?.includes('https'))
+							if (uses.includes(type)) quality += 3;
+							else if (uses.includes('https'))
 								quality += 0.5; // this was a legacy generic general use type
-							else quality -= (cert.uses?.length ?? 0) / 5; // if there are designed uses for this that don't match, dock points
+							else quality -= uses.length / 5; // if there are designed uses for this that don't match, dock points
 
 							const private_key = getPrivateKeyByName(cert.private_key_name);
 
@@ -780,19 +772,19 @@ function createTLSSelector(type, mtlsOptions) {
 								key_file: cert.private_key_name,
 								is_self_signed: cert.is_self_signed,
 							};
-							if (server) secureOptions.sessionIdContext = server.sessionIdContext;
+							if (server) (secureOptions as any).sessionIdContext = server.sessionIdContext;
 							let hostnames = cert.hostnames ?? hostnamesFromCert(certParsed);
 							if (!Array.isArray(hostnames)) hostnames = [hostnames];
 							for (let hostname of hostnames) {
 								if (hostname === getHost()) quality += 0.1; // prefer a certificate that has our hostname in the SANs
 							}
 							let secureContext = tls.createSecureContext(secureOptions);
-							secureContext.name = cert.name;
-							secureContext.options = secureOptions;
-							secureContext.quality = quality;
-							secureContext.certificateAuthorities = Array.from(caCerts);
+							(secureContext as any).name = cert.name;
+							(secureContext as any).options = secureOptions;
+							(secureContext as any).quality = quality;
+							(secureContext as any).certificateAuthorities = Array.from(caCerts);
 							// we store the first 100 bytes of the certificate just for debug logging
-							secureContext.certStart = certificate.toString().slice(0, 100);
+							(secureContext as any).certStart = certificate.toString().slice(0, 100);
 							// we want to configure SNI handling to pick the right certificate based on all the registered SANs
 							// in the certificate
 							for (let hostname of hostnames) {
@@ -808,12 +800,12 @@ function createTLSSelector(type, mtlsOptions) {
 										secureContexts.set(hostname, secureContext);
 									}
 								} else {
-									logger.error?.('No hostname found for certificate at', tls.certificate);
+									logger.error?.('No hostname found for certificate at', (tls as any).certificate);
 								}
 							}
 							logger.trace?.(
 								'Adding TLS',
-								secureContext.name,
+								(secureContext as any).name,
 								'for',
 								server.ports || 'client',
 								'cert named',
@@ -827,7 +819,7 @@ function createTLSSelector(type, mtlsOptions) {
 							);
 							if (quality > bestQuality /* && hasIpAddress*/) {
 								// we use this certificate as the default if it has a higher quality than the existing one
-								SNICallback.defaultContext = defaultContext = secureContext;
+								(SNICallback as any).defaultContext = defaultContext = secureContext;
 								bestQuality = quality;
 								if (server) {
 									server.defaultContext = secureContext;
@@ -850,7 +842,7 @@ function createTLSSelector(type, mtlsOptions) {
 			databases?.system.hdb_certificate.subscribe({
 				listener: () => setTimeout(() => updateTLS(), 1500).unref(),
 				omitCurrent: true,
-			});
+			} as any);
 			updateTLS();
 		}));
 	};
@@ -900,7 +892,7 @@ function getPrivateKeyByName(private_key_name) {
  * List all the records in hdbCertificate table
  * @returns {Promise<*[]>}
  */
-async function listCertificates() {
+export async function listCertificates() {
 	getCertTable();
 	let response = [];
 	for await (const cert of certificateTable.search([])) {
@@ -909,13 +901,13 @@ async function listCertificates() {
 	return response;
 }
 
-function getPrimaryHostName(cert /*X509Certificate*/) {
+export function getPrimaryHostName(cert /*X509Certificate*/) {
 	const commonName = cert.subject?.match(/CN=(.*)/)?.[1];
 	if (commonName) return commonName;
 	return hostnamesFromCert(cert)[0];
 }
 
-function hostnamesFromCert(cert /*X509Certificate*/) {
+export function hostnamesFromCert(cert /*X509Certificate*/) {
 	if (cert.subjectAltName) {
 		return cert.subjectAltName
 			.split(',')
@@ -946,7 +938,7 @@ function hostnamesFromCert(cert /*X509Certificate*/) {
 	return commonName ? [commonName] : [];
 }
 
-function getHostnamesFromCertificate(certificate) {
+export function getHostnamesFromCertificate(certificate) {
 	return [
 		certificate.subject?.CN, // use the subject if it exists
 		...certificate.subjectaltname // otherwise use the subject alternative names

package/security/permissionsTranslator.js

@@ -2,9 +2,9 @@
 
 const _ = require('lodash');
 const terms = require('../utility/hdbTerms.ts');
-const { handleHDBError, hdbErrors } = require('../utility/errors/hdbError.js');
+const { handleHDBError, hdbErrors } = require('../utility/errors/hdbError.ts');
 const { HDB_ERROR_MSGS, HTTP_STATUS_CODES } = hdbErrors;
-const logger = require('../utility/logging/harper_logger.js');
+const logger = require('../utility/logging/harper_logger.ts');
 
 module.exports = {
 	getRolePermissions,