@hilbras/keystone 1.6.0 → 1.9.0

package/src/services/zitadel.ts

@@ -1,277 +0,0 @@
-import { config, zitadelBaseUrl } from "../config.js";
-
-interface ServiceToken {
-  token: string;
-  expiresAt: number;
-}
-
-let cachedServiceToken: ServiceToken | null = null;
-let cachedJwksUrl: string | null = null;
-let cachedDiscovery: Record<string, unknown> | null = null;
-
-export async function getServiceToken(): Promise<string | undefined> {
-  if (config.ZITADEL_SERVICE_PAT) {
-    return config.ZITADEL_SERVICE_PAT;
-  }
-  if (!config.ZITADEL_SERVICE_CLIENT_ID || !config.ZITADEL_SERVICE_CLIENT_SECRET) {
-    return undefined;
-  }
-
-  const now = Date.now();
-  if (cachedServiceToken && cachedServiceToken.expiresAt > now + 60_000) {
-    return cachedServiceToken.token;
-  }
-
-  const params = new URLSearchParams();
-  params.set("grant_type", "client_credentials");
-  params.set("client_id", config.ZITADEL_SERVICE_CLIENT_ID);
-  params.set("client_secret", config.ZITADEL_SERVICE_CLIENT_SECRET);
-  params.set("scope", serviceAccountScope());
-
-  const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: params.toString(),
-  });
-
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Zitadel service token failed: ${res.status} ${text}`);
-  }
-
-  const data = (await res.json()) as { access_token: string; expires_in?: number };
-  cachedServiceToken = {
-    token: data.access_token,
-    expiresAt: now + (data.expires_in ?? 3600) * 1000,
-  };
-  return cachedServiceToken.token;
-}
-
-function serviceAccountScope(): string {
-  const scopes = ["urn:zitadel:iam:org:project:id:zitadel:aud"];
-  if (config.ZITADEL_ORG_ID) {
-    scopes.push(`urn:zitadel:iam:org:id:${config.ZITADEL_ORG_ID}:aud`);
-  }
-  return scopes.join(" ");
-}
-
-function orgHeader(): Record<string, string> {
-  const headers: Record<string, string> = {};
-  if (config.ZITADEL_ORG_ID) {
-    headers["x-zitadel-orgid"] = config.ZITADEL_ORG_ID;
-  }
-  return headers;
-}
-
-export interface CreateHumanUserInput {
-  userId?: string;
-  username: string;
-  email: string;
-  name: string;
-  password: string;
-}
-
-export async function createHumanUser(input: CreateHumanUserInput): Promise<string> {
-  const token = await getServiceToken();
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-    ...orgHeader(),
-  };
-  if (token) headers["Authorization"] = `Bearer ${token}`;
-
-  const names = splitName(input.name || input.username);
-  const body: Record<string, unknown> = {
-    username: input.username,
-    profile: {
-      givenName: names.givenName,
-      familyName: names.familyName,
-    },
-    email: {
-      email: input.email,
-      isVerified: true,
-    },
-    password: {
-      password: input.password,
-      changeRequired: false,
-    },
-  };
-  if (input.userId) body.userId = input.userId;
-  if (config.ZITADEL_ORG_ID) {
-    body.organization = { orgId: config.ZITADEL_ORG_ID };
-  }
-
-  const res = await fetch(`${zitadelBaseUrl()}/v2/users/human`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(body),
-  });
-
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Zitadel create user failed: ${res.status} ${text}`);
-  }
-
-  const data = (await res.json()) as { userId?: string; user?: { userId?: string } };
-  return data.userId ?? data.user?.userId ?? "";
-}
-
-export async function verifyPassword(email: string, password: string): Promise<boolean> {
-  const token = await getServiceToken();
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-    ...orgHeader(),
-  };
-  if (token) headers["Authorization"] = `Bearer ${token}`;
-
-  const res = await fetch(`${zitadelBaseUrl()}/v2/sessions`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({
-      checks: {
-        user: { loginName: email },
-        password: { password },
-      },
-      lifetime: "3600s",
-    }),
-  });
-
-  // Consume/close the session? Zitadel does not require explicit cleanup for short-lived sessions.
-  return res.ok;
-}
-
-export async function requestPasswordReset(zitadelUserId: string, redirectUrl: string): Promise<void> {
-  const token = await getServiceToken();
-  if (!token) throw new Error("Zitadel service token not available for password reset");
-
-  const res = await fetch(`${zitadelBaseUrl()}/v2/users/${zitadelUserId}/password_reset`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${token}`,
-      ...orgHeader(),
-    },
-    body: JSON.stringify({
-      sendLink: {
-        notificationType: "NOTIFICATION_TYPE_Email",
-        urlTemplate: redirectUrl,
-      },
-    }),
-  });
-
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Zitadel password reset failed: ${res.status} ${text}`);
-  }
-}
-
-export async function setPassword(
-  zitadelUserId: string,
-  verificationCode: string,
-  newPassword: string
-): Promise<void> {
-  const token = await getServiceToken();
-  if (!token) throw new Error("Zitadel service token not available for password reset");
-
-  const res = await fetch(`${zitadelBaseUrl()}/v2/users/${zitadelUserId}/password`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${token}`,
-      ...orgHeader(),
-    },
-    body: JSON.stringify({
-      newPassword: {
-        password: newPassword,
-        changeRequired: false,
-      },
-      verificationCode,
-    }),
-  });
-
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Zitadel set password failed: ${res.status} ${text}`);
-  }
-}
-
-export function buildAuthorizeUrl(provider: "google" | "github", state: string): string {
-  const redirectUri = `${configPublicUrl()}/auth/callback/${provider}`;
-  const params = new URLSearchParams({
-    client_id: config.ZITADEL_CLIENT_ID,
-    redirect_uri: redirectUri,
-    response_type: "code",
-    scope: "openid profile email",
-    state,
-  });
-
-  const idpId = provider === "google" ? config.ZITADEL_GOOGLE_IDP_ID : config.ZITADEL_GITHUB_IDP_ID;
-  if (idpId) {
-    params.set("idp_hint", idpId);
-  }
-
-  return `${zitadelBaseUrl()}/oauth/v2/authorize?${params.toString()}`;
-}
-
-export async function exchangeOAuthCode(
-  provider: "google" | "github",
-  code: string
-): Promise<{ idToken: string; accessToken: string; refreshToken?: string }> {
-  const redirectUri = `${configPublicUrl()}/auth/callback/${provider}`;
-  const params = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: config.ZITADEL_CLIENT_ID,
-    client_secret: config.ZITADEL_CLIENT_SECRET,
-    code,
-    redirect_uri: redirectUri,
-  });
-
-  const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: params.toString(),
-  });
-
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Zitadel token exchange failed: ${res.status} ${text}`);
-  }
-
-  const data = (await res.json()) as {
-    id_token: string;
-    access_token: string;
-    refresh_token?: string;
-  };
-  return {
-    idToken: data.id_token,
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-  };
-}
-
-export async function getZitadelJwksUrl(): Promise<string> {
-  if (cachedJwksUrl) return cachedJwksUrl;
-  const discovery = await getDiscovery();
-  const url = (discovery.jwks_uri as string) || `${zitadelBaseUrl()}/oauth/v2/keys`;
-  cachedJwksUrl = url;
-  return url;
-}
-
-export async function getDiscovery(): Promise<Record<string, unknown>> {
-  if (cachedDiscovery) return cachedDiscovery;
-  const res = await fetch(`${zitadelBaseUrl()}/.well-known/openid-configuration`);
-  if (!res.ok) {
-    throw new Error(`Zitadel discovery failed: ${res.status}`);
-  }
-  cachedDiscovery = (await res.json()) as Record<string, unknown>;
-  return cachedDiscovery;
-}
-
-function configPublicUrl(): string {
-  return process.env.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
-}
-
-function splitName(name: string): { givenName: string; familyName: string } {
-  const parts = name.trim().split(/\s+/);
-  if (parts.length === 1) return { givenName: parts[0], familyName: "" };
-  return { givenName: parts[0], familyName: parts.slice(1).join(" ") };
-}

package/src/setup-server.ts

@@ -1,71 +0,0 @@
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import fs from "node:fs/promises";
-import fastify from "fastify";
-import cors from "@fastify/cors";
-import { config } from "./config.js";
-import { generateSetupToken, printSetupToken } from "./services/setup/token.js";
-import setupRoutes from "./routes/setup.js";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-async function buildSetupApp() {
-  const app = fastify({
-    logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
-    trustProxy: true,
-    genReqId: () => crypto.randomUUID(),
-  });
-
-  await app.register(cors, {
-    origin: true,
-    credentials: true,
-  });
-
-  await app.register(setupRoutes, { prefix: "/setup" });
-
-  // Serve the built setup frontend if available.
-  const frontendDist = path.resolve(__dirname, "../frontend/dist");
-  try {
-    const stat = await fs.stat(frontendDist);
-    if (stat.isDirectory()) {
-      app.register(import("@fastify/static"), {
-        root: frontendDist,
-        wildcard: true,
-      });
-    }
-  } catch {
-    // Built frontend not present; the Vite dev server should be used instead.
-  }
-
-  app.get("/health", async () => ({ status: "setup" }));
-
-  app.setErrorHandler((error: unknown, request, reply) => {
-    if (error && typeof error === "object" && "validation" in error) {
-      const message = error instanceof Error ? error.message : String(error);
-      return reply.status(400).send({ error: "Invalid input", details: message });
-    }
-    request.log.error({ err: error }, "Unhandled error");
-    const message = config.NODE_ENV === "production" ? "Internal server error" : String(error);
-    return reply.status(500).send({ error: message });
-  });
-
-  return app;
-}
-
-async function start() {
-  generateSetupToken();
-  printSetupToken();
-
-  const app = await buildSetupApp();
-  try {
-    await app.listen({ port: config.PORT, host: config.HOST });
-    app.log.info(`Hilbras Keystone setup server running on http://${config.HOST}:${config.PORT}`);
-  } catch (err) {
-    app.log.error(err);
-    process.exit(1);
-  }
-}
-
-if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
-  start();
-}

package/src/tests/errors.test.ts

@@ -1,74 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-
-process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
-
-const { classifyOAuthError, buildOAuthErrorRedirect, buildOAuthErrorResponse } = await import("../lib/errors.js");
-
-describe("OAuth error sanitization", () => {
-  it("classifies state mismatches as access_denied", () => {
-    const result = classifyOAuthError(new Error("Invalid OAuth state"));
-    assert.strictEqual(result.code, "access_denied");
-    assert.strictEqual(result.statusCode, 400);
-  });
-
-  it("classifies unknown clients as invalid_client", () => {
-    const result = classifyOAuthError(new Error("Unknown client"));
-    assert.strictEqual(result.code, "invalid_client");
-    assert.strictEqual(result.statusCode, 400);
-  });
-
-  it("classifies token exchange failures as invalid_grant", () => {
-    const result = classifyOAuthError(new Error("Token exchange failed: invalid code"));
-    assert.strictEqual(result.code, "invalid_grant");
-    assert.strictEqual(result.statusCode, 400);
-  });
-
-  it("classifies provider communication failures as identity_broker_failure", () => {
-    const result = classifyOAuthError(new Error("Federation callback failed"));
-    assert.strictEqual(result.code, "identity_broker_failure");
-    assert.strictEqual(result.statusCode, 502);
-  });
-
-  it("classifies configuration errors as server_error", () => {
-    const result = classifyOAuthError(new Error("Connector not configured"));
-    assert.strictEqual(result.code, "server_error");
-    assert.strictEqual(result.statusCode, 500);
-  });
-
-  it("classifies generic errors as server_error", () => {
-    const result = classifyOAuthError(new Error("Something went wrong"));
-    assert.strictEqual(result.code, "server_error");
-    assert.strictEqual(result.statusCode, 500);
-  });
-
-  it("builds a redirect URL with a sanitized code and state", () => {
-    const url = buildOAuthErrorRedirect(new Error("secret details"), "http://example.com/cb?foo=bar", {
-      state: "xyz",
-      includeDescription: false,
-    });
-    assert.ok(url.startsWith("http://example.com/cb"));
-    assert.ok(url.includes("error=server_error"));
-    assert.ok(url.includes("state=xyz"));
-    assert.ok(url.includes("foo=bar"));
-    assert.ok(!url.includes("secret"));
-  });
-
-  it("includes descriptions in development mode", () => {
-    const { statusCode, body } = buildOAuthErrorResponse(new Error("detailed message"), {
-      includeDescription: true,
-    });
-    assert.strictEqual(statusCode, 500);
-    assert.strictEqual(body.error, "server_error");
-    assert.strictEqual(body.error_description, "detailed message");
-  });
-
-  it("omits descriptions outside development mode", () => {
-    const { statusCode, body } = buildOAuthErrorResponse(new Error("detailed message"), {
-      includeDescription: false,
-    });
-    assert.strictEqual(statusCode, 500);
-    assert.strictEqual(body.error, "server_error");
-    assert.strictEqual(body.error_description, undefined);
-  });
-});

package/src/tests/events.test.ts

@@ -1,52 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import { validateEvent, normalizeEvent } from "../services/events/validate.js";
-import { emit, subscribe, buildEvent } from "../services/events/bus.js";
-
-describe("Event validation", () => {
-  it("accepts a valid event", () => {
-    const result = validateEvent(buildEvent("user_login", { userId: "1" }));
-    assert.strictEqual(result.valid, true);
-    assert.deepStrictEqual(result.errors, []);
-  });
-
-  it("rejects an unknown event type", () => {
-    const result = validateEvent(buildEvent("unknown_event", {}));
-    assert.strictEqual(result.valid, false);
-    assert.ok(result.errors.some((e) => e.includes("Unknown event type")));
-  });
-
-  it("rejects a missing payload", () => {
-    const result = validateEvent({ type: "user_login" } as never);
-    assert.strictEqual(result.valid, false);
-    assert.ok(result.errors.some((e) => e.includes("payload")));
-  });
-
-  it("rejects an invalid version", () => {
-    const result = validateEvent({ type: "user_login", version: 0, payload: {} } as never);
-    assert.strictEqual(result.valid, false);
-    assert.ok(result.errors.some((e) => e.includes("version")));
-  });
-
-  it("normalizes an event with version and timestamp", () => {
-    const event = normalizeEvent(buildEvent("user_login", { userId: "1" }));
-    assert.strictEqual(event.type, "user_login");
-    assert.strictEqual(event.version, 1);
-    assert.ok(event.timestamp instanceof Date);
-  });
-});
-
-describe("Event bus", () => {
-  it("delivers emitted events to subscribers", async () => {
-    const received: unknown[] = [];
-    const unsubscribe = subscribe("user_login", (event) => {
-      received.push(event.payload);
-    });
-
-    await emit(buildEvent("user_login", { userId: "42" }));
-    unsubscribe();
-
-    assert.strictEqual(received.length, 1);
-    assert.deepStrictEqual((received[0] as { userId: string }).userId, "42");
-  });
-});

package/src/tests/featureFlags.test.ts

@@ -1,26 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import { getConfigurationProfile, listConfigurationProfiles } from "../services/configuration/profiles.js";
-
-describe("Configuration profiles", () => {
-  it("lists all predefined profiles", () => {
-    const profiles = listConfigurationProfiles();
-    assert.ok(profiles.some((p) => p.id === "development"));
-    assert.ok(profiles.some((p) => p.id === "production"));
-    assert.ok(profiles.some((p) => p.id === "docker"));
-    assert.ok(profiles.some((p) => p.id === "docker-compose"));
-    assert.ok(profiles.some((p) => p.id === "kubernetes"));
-    assert.ok(profiles.some((p) => p.id === "high-availability"));
-  });
-
-  it("returns a profile with values", () => {
-    const profile = getConfigurationProfile("development");
-    assert.ok(profile);
-    assert.strictEqual(profile.values.NODE_ENV, "development");
-    assert.ok(profile.values.DATABASE_URL);
-  });
-
-  it("returns undefined for unknown profiles", () => {
-    assert.strictEqual(getConfigurationProfile("unknown"), undefined);
-  });
-});

package/src/tests/integration/queue.test.ts

@@ -1,54 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import net from "node:net";
-
-process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
-
-function redisReachable(host = "localhost", port = 6379): Promise<boolean> {
-  return new Promise((resolve) => {
-    const socket = net.createConnection({ host, port });
-    socket.on("connect", () => {
-      socket.destroy();
-      resolve(true);
-    });
-    socket.on("error", () => resolve(false));
-    socket.setTimeout(1000, () => {
-      socket.destroy();
-      resolve(false);
-    });
-  });
-}
-
-const redisAvailable = await redisReachable();
-const { BullMQQueue } = await import("../../services/queue/bullmq.js");
-
-describe("Background job queue", () => {
-  (redisAvailable ? it : it.skip)("processes a job through BullMQ", async () => {
-    const queue = new BullMQQueue(process.env.REDIS_URL || "redis://localhost:6379");
-    const payload = { hello: "world" };
-    let received: unknown;
-    const processed = new Promise<void>((resolve) => {
-      queue.process("integration_test", async (job) => {
-        received = job.payload;
-        resolve();
-      });
-    });
-
-    try {
-      await queue.enqueue({ id: `integration-test-${Date.now()}`, type: "integration_test", payload });
-
-      // Wait for the worker to pick up the job, bounded by a timeout so a slow
-      // or dead worker fails the test instead of hanging the process.
-      await Promise.race([
-        processed,
-        new Promise((resolve) => setTimeout(resolve, 5000)),
-      ]);
-
-      assert.deepStrictEqual(received, payload);
-    } finally {
-      // Always release the worker + Redis connection, even on assertion failure,
-      // or open handles keep the node:test process alive indefinitely.
-      await queue.close();
-    }
-  });
-});

package/src/tests/plugins.test.ts

@@ -1,73 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import {
-  registerPlugin,
-  unregisterPlugin,
-  listRegisteredPlugins,
-  listExtensionPoints,
-  getConnectorFactory,
-  getPluginWorkflowStep,
-  getAuthenticationMethodFactory,
-} from "../services/plugins/registry.js";
-import type { KeystonePlugin } from "../services/plugins/types.js";
-import type { IdentityConnector } from "../services/connectors/types.js";
-
-describe("Plugin registry", () => {
-  it("registers a plugin with metadata and extension points", () => {
-    const plugin: KeystonePlugin = {
-      metadata: { name: "test-plugin", version: "1.0.0", description: "Test" },
-      connectors: {
-        test: () =>
-          ({
-            id: "test",
-            name: "Test",
-            type: "test",
-            getAuthorizeUrl: () => "",
-            exchangeCode: async () => ({ sub: "1", email: "test@example.com" }),
-          } satisfies IdentityConnector),
-      },
-      workflowSteps: {
-        testStep: () => ({ output: { done: "true" } }),
-      },
-      authenticationMethods: {
-        testAuth: () => ({
-          id: "testAuth",
-          name: "Test Auth",
-          authenticate: async () => ({ success: false, error: { code: "test", message: "test" } }),
-        }),
-      },
-    };
-
-    registerPlugin(plugin);
-
-    const plugins = listRegisteredPlugins();
-    assert.ok(plugins.some((p) => p.metadata.name === "test-plugin"));
-    assert.deepStrictEqual(plugins.find((p) => p.metadata.name === "test-plugin")?.extensionPoints.sort(), [
-      "authenticationMethods",
-      "connectors",
-      "workflowSteps",
-    ]);
-
-    assert.ok(getConnectorFactory("test"));
-    assert.ok(getPluginWorkflowStep("testStep"));
-    assert.ok(getAuthenticationMethodFactory("testAuth"));
-  });
-
-  it("lists extension points with registered entries", () => {
-    const points = listExtensionPoints();
-    assert.ok(points.some((p) => p.name === "connectors" && p.registered.includes("test")));
-    assert.ok(points.some((p) => p.name === "workflowSteps" && p.registered.includes("testStep")));
-  });
-
-  it("unregisters a plugin and removes its extension points", () => {
-    const removed = unregisterPlugin("test-plugin");
-    assert.strictEqual(removed, true);
-    assert.strictEqual(getConnectorFactory("test"), undefined);
-    assert.strictEqual(getPluginWorkflowStep("testStep"), undefined);
-    assert.strictEqual(getAuthenticationMethodFactory("testAuth"), undefined);
-  });
-
-  it("returns false when unregistering an unknown plugin", () => {
-    assert.strictEqual(unregisterPlugin("does-not-exist"), false);
-  });
-});

package/src/tests/result.test.ts

@@ -1,52 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import { ok, err, errFromMessage, mapResult, flatMapResult } from "../lib/result.js";
-
-describe("Result<T> helpers", () => {
-  it("ok wraps data in a success result", () => {
-    const result = ok(42);
-    assert.strictEqual(result.success, true);
-    assert.strictEqual(result.data, 42);
-    assert.strictEqual(result.error, undefined);
-  });
-
-  it("err wraps an error in a failure result", () => {
-    const result = err<number>({ code: "FAIL", message: "failed" });
-    assert.strictEqual(result.success, false);
-    assert.strictEqual(result.error.code, "FAIL");
-    assert.strictEqual(result.error.message, "failed");
-  });
-
-  it("errFromMessage builds a failure result from code and message", () => {
-    const result = errFromMessage<number>("NOT_FOUND", "missing", 404);
-    assert.strictEqual(result.success, false);
-    assert.strictEqual(result.error.code, "NOT_FOUND");
-    assert.strictEqual(result.error.statusCode, 404);
-  });
-
-  it("mapResult transforms success data", async () => {
-    const mapped = mapResult(ok(2), (n) => n * 3);
-    assert.strictEqual(mapped.success, true);
-    assert.strictEqual(mapped.data, 6);
-  });
-
-  it("mapResult propagates errors", async () => {
-    const error = errFromMessage<number>("BAD", "bad");
-    const mapped = mapResult(error, (n) => n * 3);
-    assert.strictEqual(mapped.success, false);
-    assert.strictEqual(mapped.error.code, "BAD");
-  });
-
-  it("flatMapResult chains async results", async () => {
-    const chained = await flatMapResult(ok(2), async (n) => ok(n * 3));
-    assert.strictEqual(chained.success, true);
-    assert.strictEqual(chained.data, 6);
-  });
-
-  it("flatMapResult short-circuits on failure", async () => {
-    const error = errFromMessage<number>("BAD", "bad");
-    const chained = await flatMapResult(error, async () => ok(99));
-    assert.strictEqual(chained.success, false);
-    assert.strictEqual(chained.error.code, "BAD");
-  });
-});