@hilbras/keystone 1.1.0

package/src/services/zitadel.ts

@@ -0,0 +1,277 @@
+import { config, zitadelBaseUrl } from "../config.js";
+
+interface ServiceToken {
+  token: string;
+  expiresAt: number;
+}
+
+let cachedServiceToken: ServiceToken | null = null;
+let cachedJwksUrl: string | null = null;
+let cachedDiscovery: Record<string, unknown> | null = null;
+
+export async function getServiceToken(): Promise<string | undefined> {
+  if (config.ZITADEL_SERVICE_PAT) {
+    return config.ZITADEL_SERVICE_PAT;
+  }
+  if (!config.ZITADEL_SERVICE_CLIENT_ID || !config.ZITADEL_SERVICE_CLIENT_SECRET) {
+    return undefined;
+  }
+
+  const now = Date.now();
+  if (cachedServiceToken && cachedServiceToken.expiresAt > now + 60_000) {
+    return cachedServiceToken.token;
+  }
+
+  const params = new URLSearchParams();
+  params.set("grant_type", "client_credentials");
+  params.set("client_id", config.ZITADEL_SERVICE_CLIENT_ID);
+  params.set("client_secret", config.ZITADEL_SERVICE_CLIENT_SECRET);
+  params.set("scope", serviceAccountScope());
+
+  const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString(),
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Zitadel service token failed: ${res.status} ${text}`);
+  }
+
+  const data = (await res.json()) as { access_token: string; expires_in?: number };
+  cachedServiceToken = {
+    token: data.access_token,
+    expiresAt: now + (data.expires_in ?? 3600) * 1000,
+  };
+  return cachedServiceToken.token;
+}
+
+function serviceAccountScope(): string {
+  const scopes = ["urn:zitadel:iam:org:project:id:zitadel:aud"];
+  if (config.ZITADEL_ORG_ID) {
+    scopes.push(`urn:zitadel:iam:org:id:${config.ZITADEL_ORG_ID}:aud`);
+  }
+  return scopes.join(" ");
+}
+
+function orgHeader(): Record<string, string> {
+  const headers: Record<string, string> = {};
+  if (config.ZITADEL_ORG_ID) {
+    headers["x-zitadel-orgid"] = config.ZITADEL_ORG_ID;
+  }
+  return headers;
+}
+
+export interface CreateHumanUserInput {
+  userId?: string;
+  username: string;
+  email: string;
+  name: string;
+  password: string;
+}
+
+export async function createHumanUser(input: CreateHumanUserInput): Promise<string> {
+  const token = await getServiceToken();
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    ...orgHeader(),
+  };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+
+  const names = splitName(input.name || input.username);
+  const body: Record<string, unknown> = {
+    username: input.username,
+    profile: {
+      givenName: names.givenName,
+      familyName: names.familyName,
+    },
+    email: {
+      email: input.email,
+      isVerified: true,
+    },
+    password: {
+      password: input.password,
+      changeRequired: false,
+    },
+  };
+  if (input.userId) body.userId = input.userId;
+  if (config.ZITADEL_ORG_ID) {
+    body.organization = { orgId: config.ZITADEL_ORG_ID };
+  }
+
+  const res = await fetch(`${zitadelBaseUrl()}/v2/users/human`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Zitadel create user failed: ${res.status} ${text}`);
+  }
+
+  const data = (await res.json()) as { userId?: string; user?: { userId?: string } };
+  return data.userId ?? data.user?.userId ?? "";
+}
+
+export async function verifyPassword(email: string, password: string): Promise<boolean> {
+  const token = await getServiceToken();
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    ...orgHeader(),
+  };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+
+  const res = await fetch(`${zitadelBaseUrl()}/v2/sessions`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      checks: {
+        user: { loginName: email },
+        password: { password },
+      },
+      lifetime: "3600s",
+    }),
+  });
+
+  // Consume/close the session? Zitadel does not require explicit cleanup for short-lived sessions.
+  return res.ok;
+}
+
+export async function requestPasswordReset(zitadelUserId: string, redirectUrl: string): Promise<void> {
+  const token = await getServiceToken();
+  if (!token) throw new Error("Zitadel service token not available for password reset");
+
+  const res = await fetch(`${zitadelBaseUrl()}/v2/users/${zitadelUserId}/password_reset`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      ...orgHeader(),
+    },
+    body: JSON.stringify({
+      sendLink: {
+        notificationType: "NOTIFICATION_TYPE_Email",
+        urlTemplate: redirectUrl,
+      },
+    }),
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Zitadel password reset failed: ${res.status} ${text}`);
+  }
+}
+
+export async function setPassword(
+  zitadelUserId: string,
+  verificationCode: string,
+  newPassword: string
+): Promise<void> {
+  const token = await getServiceToken();
+  if (!token) throw new Error("Zitadel service token not available for password reset");
+
+  const res = await fetch(`${zitadelBaseUrl()}/v2/users/${zitadelUserId}/password`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      ...orgHeader(),
+    },
+    body: JSON.stringify({
+      newPassword: {
+        password: newPassword,
+        changeRequired: false,
+      },
+      verificationCode,
+    }),
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Zitadel set password failed: ${res.status} ${text}`);
+  }
+}
+
+export function buildAuthorizeUrl(provider: "google" | "github", state: string): string {
+  const redirectUri = `${configPublicUrl()}/auth/callback/${provider}`;
+  const params = new URLSearchParams({
+    client_id: config.ZITADEL_CLIENT_ID,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    scope: "openid profile email",
+    state,
+  });
+
+  const idpId = provider === "google" ? config.ZITADEL_GOOGLE_IDP_ID : config.ZITADEL_GITHUB_IDP_ID;
+  if (idpId) {
+    params.set("idp_hint", idpId);
+  }
+
+  return `${zitadelBaseUrl()}/oauth/v2/authorize?${params.toString()}`;
+}
+
+export async function exchangeOAuthCode(
+  provider: "google" | "github",
+  code: string
+): Promise<{ idToken: string; accessToken: string; refreshToken?: string }> {
+  const redirectUri = `${configPublicUrl()}/auth/callback/${provider}`;
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: config.ZITADEL_CLIENT_ID,
+    client_secret: config.ZITADEL_CLIENT_SECRET,
+    code,
+    redirect_uri: redirectUri,
+  });
+
+  const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString(),
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Zitadel token exchange failed: ${res.status} ${text}`);
+  }
+
+  const data = (await res.json()) as {
+    id_token: string;
+    access_token: string;
+    refresh_token?: string;
+  };
+  return {
+    idToken: data.id_token,
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+  };
+}
+
+export async function getZitadelJwksUrl(): Promise<string> {
+  if (cachedJwksUrl) return cachedJwksUrl;
+  const discovery = await getDiscovery();
+  const url = (discovery.jwks_uri as string) || `${zitadelBaseUrl()}/oauth/v2/keys`;
+  cachedJwksUrl = url;
+  return url;
+}
+
+export async function getDiscovery(): Promise<Record<string, unknown>> {
+  if (cachedDiscovery) return cachedDiscovery;
+  const res = await fetch(`${zitadelBaseUrl()}/.well-known/openid-configuration`);
+  if (!res.ok) {
+    throw new Error(`Zitadel discovery failed: ${res.status}`);
+  }
+  cachedDiscovery = (await res.json()) as Record<string, unknown>;
+  return cachedDiscovery;
+}
+
+function configPublicUrl(): string {
+  return process.env.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+}
+
+function splitName(name: string): { givenName: string; familyName: string } {
+  const parts = name.trim().split(/\s+/);
+  if (parts.length === 1) return { givenName: parts[0], familyName: "" };
+  return { givenName: parts[0], familyName: parts.slice(1).join(" ") };
+}

package/src/setup-server.ts

@@ -0,0 +1,71 @@
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import fs from "node:fs/promises";
+import fastify from "fastify";
+import cors from "@fastify/cors";
+import { config } from "./config.js";
+import { generateSetupToken, printSetupToken } from "./services/setup/token.js";
+import setupRoutes from "./routes/setup.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+async function buildSetupApp() {
+  const app = fastify({
+    logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
+    trustProxy: true,
+    genReqId: () => crypto.randomUUID(),
+  });
+
+  await app.register(cors, {
+    origin: true,
+    credentials: true,
+  });
+
+  await app.register(setupRoutes, { prefix: "/setup" });
+
+  // Serve the built setup frontend if available.
+  const frontendDist = path.resolve(__dirname, "../frontend/dist");
+  try {
+    const stat = await fs.stat(frontendDist);
+    if (stat.isDirectory()) {
+      app.register(import("@fastify/static"), {
+        root: frontendDist,
+        wildcard: true,
+      });
+    }
+  } catch {
+    // Built frontend not present; the Vite dev server should be used instead.
+  }
+
+  app.get("/health", async () => ({ status: "setup" }));
+
+  app.setErrorHandler((error: unknown, request, reply) => {
+    if (error && typeof error === "object" && "validation" in error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return reply.status(400).send({ error: "Invalid input", details: message });
+    }
+    request.log.error({ err: error }, "Unhandled error");
+    const message = config.NODE_ENV === "production" ? "Internal server error" : String(error);
+    return reply.status(500).send({ error: message });
+  });
+
+  return app;
+}
+
+async function start() {
+  generateSetupToken();
+  printSetupToken();
+
+  const app = await buildSetupApp();
+  try {
+    await app.listen({ port: config.PORT, host: config.HOST });
+    app.log.info(`Hilbras Keystone setup server running on http://${config.HOST}:${config.PORT}`);
+  } catch (err) {
+    app.log.error(err);
+    process.exit(1);
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  start();
+}

package/src/tests/errors.test.ts

@@ -0,0 +1,74 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+
+process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
+
+const { classifyOAuthError, buildOAuthErrorRedirect, buildOAuthErrorResponse } = await import("../lib/errors.js");
+
+describe("OAuth error sanitization", () => {
+  it("classifies state mismatches as access_denied", () => {
+    const result = classifyOAuthError(new Error("Invalid OAuth state"));
+    assert.strictEqual(result.code, "access_denied");
+    assert.strictEqual(result.statusCode, 400);
+  });
+
+  it("classifies unknown clients as invalid_client", () => {
+    const result = classifyOAuthError(new Error("Unknown client"));
+    assert.strictEqual(result.code, "invalid_client");
+    assert.strictEqual(result.statusCode, 400);
+  });
+
+  it("classifies token exchange failures as invalid_grant", () => {
+    const result = classifyOAuthError(new Error("Token exchange failed: invalid code"));
+    assert.strictEqual(result.code, "invalid_grant");
+    assert.strictEqual(result.statusCode, 400);
+  });
+
+  it("classifies provider communication failures as identity_broker_failure", () => {
+    const result = classifyOAuthError(new Error("Federation callback failed"));
+    assert.strictEqual(result.code, "identity_broker_failure");
+    assert.strictEqual(result.statusCode, 502);
+  });
+
+  it("classifies configuration errors as server_error", () => {
+    const result = classifyOAuthError(new Error("Connector not configured"));
+    assert.strictEqual(result.code, "server_error");
+    assert.strictEqual(result.statusCode, 500);
+  });
+
+  it("classifies generic errors as server_error", () => {
+    const result = classifyOAuthError(new Error("Something went wrong"));
+    assert.strictEqual(result.code, "server_error");
+    assert.strictEqual(result.statusCode, 500);
+  });
+
+  it("builds a redirect URL with a sanitized code and state", () => {
+    const url = buildOAuthErrorRedirect(new Error("secret details"), "http://example.com/cb?foo=bar", {
+      state: "xyz",
+      includeDescription: false,
+    });
+    assert.ok(url.startsWith("http://example.com/cb"));
+    assert.ok(url.includes("error=server_error"));
+    assert.ok(url.includes("state=xyz"));
+    assert.ok(url.includes("foo=bar"));
+    assert.ok(!url.includes("secret"));
+  });
+
+  it("includes descriptions in development mode", () => {
+    const { statusCode, body } = buildOAuthErrorResponse(new Error("detailed message"), {
+      includeDescription: true,
+    });
+    assert.strictEqual(statusCode, 500);
+    assert.strictEqual(body.error, "server_error");
+    assert.strictEqual(body.error_description, "detailed message");
+  });
+
+  it("omits descriptions outside development mode", () => {
+    const { statusCode, body } = buildOAuthErrorResponse(new Error("detailed message"), {
+      includeDescription: false,
+    });
+    assert.strictEqual(statusCode, 500);
+    assert.strictEqual(body.error, "server_error");
+    assert.strictEqual(body.error_description, undefined);
+  });
+});

package/src/tests/events.test.ts

@@ -0,0 +1,52 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { validateEvent, normalizeEvent } from "../services/events/validate.js";
+import { emit, subscribe, buildEvent } from "../services/events/bus.js";
+
+describe("Event validation", () => {
+  it("accepts a valid event", () => {
+    const result = validateEvent(buildEvent("user_login", { userId: "1" }));
+    assert.strictEqual(result.valid, true);
+    assert.deepStrictEqual(result.errors, []);
+  });
+
+  it("rejects an unknown event type", () => {
+    const result = validateEvent(buildEvent("unknown_event", {}));
+    assert.strictEqual(result.valid, false);
+    assert.ok(result.errors.some((e) => e.includes("Unknown event type")));
+  });
+
+  it("rejects a missing payload", () => {
+    const result = validateEvent({ type: "user_login" } as never);
+    assert.strictEqual(result.valid, false);
+    assert.ok(result.errors.some((e) => e.includes("payload")));
+  });
+
+  it("rejects an invalid version", () => {
+    const result = validateEvent({ type: "user_login", version: 0, payload: {} } as never);
+    assert.strictEqual(result.valid, false);
+    assert.ok(result.errors.some((e) => e.includes("version")));
+  });
+
+  it("normalizes an event with version and timestamp", () => {
+    const event = normalizeEvent(buildEvent("user_login", { userId: "1" }));
+    assert.strictEqual(event.type, "user_login");
+    assert.strictEqual(event.version, 1);
+    assert.ok(event.timestamp instanceof Date);
+  });
+});
+
+describe("Event bus", () => {
+  it("delivers emitted events to subscribers", async () => {
+    const received: unknown[] = [];
+    const unsubscribe = subscribe("user_login", (event) => {
+      received.push(event.payload);
+    });
+
+    await emit(buildEvent("user_login", { userId: "42" }));
+    unsubscribe();
+
+    assert.strictEqual(received.length, 1);
+    assert.deepStrictEqual((received[0] as { userId: string }).userId, "42");
+  });
+});

package/src/tests/featureFlags.test.ts

@@ -0,0 +1,26 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { getConfigurationProfile, listConfigurationProfiles } from "../services/configuration/profiles.js";
+
+describe("Configuration profiles", () => {
+  it("lists all predefined profiles", () => {
+    const profiles = listConfigurationProfiles();
+    assert.ok(profiles.some((p) => p.id === "development"));
+    assert.ok(profiles.some((p) => p.id === "production"));
+    assert.ok(profiles.some((p) => p.id === "docker"));
+    assert.ok(profiles.some((p) => p.id === "docker-compose"));
+    assert.ok(profiles.some((p) => p.id === "kubernetes"));
+    assert.ok(profiles.some((p) => p.id === "high-availability"));
+  });
+
+  it("returns a profile with values", () => {
+    const profile = getConfigurationProfile("development");
+    assert.ok(profile);
+    assert.strictEqual(profile.values.NODE_ENV, "development");
+    assert.ok(profile.values.DATABASE_URL);
+  });
+
+  it("returns undefined for unknown profiles", () => {
+    assert.strictEqual(getConfigurationProfile("unknown"), undefined);
+  });
+});

package/src/tests/integration/queue.test.ts

@@ -0,0 +1,54 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import net from "node:net";
+
+process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
+
+function redisReachable(host = "localhost", port = 6379): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = net.createConnection({ host, port });
+    socket.on("connect", () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.on("error", () => resolve(false));
+    socket.setTimeout(1000, () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+}
+
+const redisAvailable = await redisReachable();
+const { BullMQQueue } = await import("../../services/queue/bullmq.js");
+
+describe("Background job queue", () => {
+  (redisAvailable ? it : it.skip)("processes a job through BullMQ", async () => {
+    const queue = new BullMQQueue(process.env.REDIS_URL || "redis://localhost:6379");
+    const payload = { hello: "world" };
+    let received: unknown;
+    const processed = new Promise<void>((resolve) => {
+      queue.process("integration_test", async (job) => {
+        received = job.payload;
+        resolve();
+      });
+    });
+
+    try {
+      await queue.enqueue({ id: `integration-test-${Date.now()}`, type: "integration_test", payload });
+
+      // Wait for the worker to pick up the job, bounded by a timeout so a slow
+      // or dead worker fails the test instead of hanging the process.
+      await Promise.race([
+        processed,
+        new Promise((resolve) => setTimeout(resolve, 5000)),
+      ]);
+
+      assert.deepStrictEqual(received, payload);
+    } finally {
+      // Always release the worker + Redis connection, even on assertion failure,
+      // or open handles keep the node:test process alive indefinitely.
+      await queue.close();
+    }
+  });
+});

package/src/tests/plugins.test.ts

@@ -0,0 +1,73 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import {
+  registerPlugin,
+  unregisterPlugin,
+  listRegisteredPlugins,
+  listExtensionPoints,
+  getConnectorFactory,
+  getPluginWorkflowStep,
+  getAuthenticationMethodFactory,
+} from "../services/plugins/registry.js";
+import type { KeystonePlugin } from "../services/plugins/types.js";
+import type { IdentityConnector } from "../services/connectors/types.js";
+
+describe("Plugin registry", () => {
+  it("registers a plugin with metadata and extension points", () => {
+    const plugin: KeystonePlugin = {
+      metadata: { name: "test-plugin", version: "1.0.0", description: "Test" },
+      connectors: {
+        test: () =>
+          ({
+            id: "test",
+            name: "Test",
+            type: "test",
+            getAuthorizeUrl: () => "",
+            exchangeCode: async () => ({ sub: "1", email: "test@example.com" }),
+          } satisfies IdentityConnector),
+      },
+      workflowSteps: {
+        testStep: () => ({ output: { done: "true" } }),
+      },
+      authenticationMethods: {
+        testAuth: () => ({
+          id: "testAuth",
+          name: "Test Auth",
+          authenticate: async () => ({ success: false, error: { code: "test", message: "test" } }),
+        }),
+      },
+    };
+
+    registerPlugin(plugin);
+
+    const plugins = listRegisteredPlugins();
+    assert.ok(plugins.some((p) => p.metadata.name === "test-plugin"));
+    assert.deepStrictEqual(plugins.find((p) => p.metadata.name === "test-plugin")?.extensionPoints.sort(), [
+      "authenticationMethods",
+      "connectors",
+      "workflowSteps",
+    ]);
+
+    assert.ok(getConnectorFactory("test"));
+    assert.ok(getPluginWorkflowStep("testStep"));
+    assert.ok(getAuthenticationMethodFactory("testAuth"));
+  });
+
+  it("lists extension points with registered entries", () => {
+    const points = listExtensionPoints();
+    assert.ok(points.some((p) => p.name === "connectors" && p.registered.includes("test")));
+    assert.ok(points.some((p) => p.name === "workflowSteps" && p.registered.includes("testStep")));
+  });
+
+  it("unregisters a plugin and removes its extension points", () => {
+    const removed = unregisterPlugin("test-plugin");
+    assert.strictEqual(removed, true);
+    assert.strictEqual(getConnectorFactory("test"), undefined);
+    assert.strictEqual(getPluginWorkflowStep("testStep"), undefined);
+    assert.strictEqual(getAuthenticationMethodFactory("testAuth"), undefined);
+  });
+
+  it("returns false when unregistering an unknown plugin", () => {
+    assert.strictEqual(unregisterPlugin("does-not-exist"), false);
+  });
+});

package/src/tests/result.test.ts

@@ -0,0 +1,52 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import { ok, err, errFromMessage, mapResult, flatMapResult } from "../lib/result.js";
+
+describe("Result<T> helpers", () => {
+  it("ok wraps data in a success result", () => {
+    const result = ok(42);
+    assert.strictEqual(result.success, true);
+    assert.strictEqual(result.data, 42);
+    assert.strictEqual(result.error, undefined);
+  });
+
+  it("err wraps an error in a failure result", () => {
+    const result = err<number>({ code: "FAIL", message: "failed" });
+    assert.strictEqual(result.success, false);
+    assert.strictEqual(result.error.code, "FAIL");
+    assert.strictEqual(result.error.message, "failed");
+  });
+
+  it("errFromMessage builds a failure result from code and message", () => {
+    const result = errFromMessage<number>("NOT_FOUND", "missing", 404);
+    assert.strictEqual(result.success, false);
+    assert.strictEqual(result.error.code, "NOT_FOUND");
+    assert.strictEqual(result.error.statusCode, 404);
+  });
+
+  it("mapResult transforms success data", async () => {
+    const mapped = mapResult(ok(2), (n) => n * 3);
+    assert.strictEqual(mapped.success, true);
+    assert.strictEqual(mapped.data, 6);
+  });
+
+  it("mapResult propagates errors", async () => {
+    const error = errFromMessage<number>("BAD", "bad");
+    const mapped = mapResult(error, (n) => n * 3);
+    assert.strictEqual(mapped.success, false);
+    assert.strictEqual(mapped.error.code, "BAD");
+  });
+
+  it("flatMapResult chains async results", async () => {
+    const chained = await flatMapResult(ok(2), async (n) => ok(n * 3));
+    assert.strictEqual(chained.success, true);
+    assert.strictEqual(chained.data, 6);
+  });
+
+  it("flatMapResult short-circuits on failure", async () => {
+    const error = errFromMessage<number>("BAD", "bad");
+    const chained = await flatMapResult(error, async () => ok(99));
+    assert.strictEqual(chained.success, false);
+    assert.strictEqual(chained.error.code, "BAD");
+  });
+});