@openwop/openwop-conformance 1.153.0 → 1.154.0

package/src/lib/grpc-framing.test.ts

@@ -1,96 +0,0 @@
-/**
- * Unit tests for `grpc-framing.ts` — gRPC HTTP/2 message framing.
- *
- * @see grpc-framing.ts
- */
-
-import { describe, it, expect } from 'vitest';
-import { frameMessage, unframeMessages } from './grpc-framing.js';
-
-describe('grpc-framing: frameMessage', () => {
-  it('prepends a 5-byte header to a single payload', () => {
-    const payload = new Uint8Array([0xab, 0xcd, 0xef]);
-    const framed = frameMessage(payload);
-    expect(framed.byteLength).toBe(8);
-    expect(framed[0]).toBe(0); // identity compression
-    expect(framed[1]).toBe(0);
-    expect(framed[2]).toBe(0);
-    expect(framed[3]).toBe(0);
-    expect(framed[4]).toBe(3); // length = 3
-    expect(framed[5]).toBe(0xab);
-    expect(framed[6]).toBe(0xcd);
-    expect(framed[7]).toBe(0xef);
-  });
-
-  it('frames a zero-length payload as a 5-byte header alone', () => {
-    const framed = frameMessage(new Uint8Array(0));
-    expect(framed.byteLength).toBe(5);
-    expect(framed[0]).toBe(0);
-    expect(framed[4]).toBe(0);
-  });
-
-  it('encodes lengths > 256 in big-endian order', () => {
-    const payload = new Uint8Array(300);
-    const framed = frameMessage(payload);
-    // length = 300 = 0x0000012C, big-endian: 00 00 01 2C
-    expect(framed[1]).toBe(0);
-    expect(framed[2]).toBe(0);
-    expect(framed[3]).toBe(1);
-    expect(framed[4]).toBe(0x2c);
-  });
-});
-
-describe('grpc-framing: unframeMessages', () => {
-  it('parses a single frame', () => {
-    const payload = new Uint8Array([0x01, 0x02, 0x03, 0x04]);
-    const framed = frameMessage(payload);
-    const messages = unframeMessages(framed);
-    expect(messages.length).toBe(1);
-    expect(Array.from(messages[0]!)).toEqual([0x01, 0x02, 0x03, 0x04]);
-  });
-
-  it('parses multiple concatenated frames', () => {
-    const a = frameMessage(new Uint8Array([0xaa, 0xab]));
-    const b = frameMessage(new Uint8Array([0xbb]));
-    const c = frameMessage(new Uint8Array([0xcc, 0xcd, 0xce, 0xcf]));
-    const combined = new Uint8Array(a.byteLength + b.byteLength + c.byteLength);
-    combined.set(a, 0);
-    combined.set(b, a.byteLength);
-    combined.set(c, a.byteLength + b.byteLength);
-    const messages = unframeMessages(combined);
-    expect(messages.length).toBe(3);
-    expect(Array.from(messages[0]!)).toEqual([0xaa, 0xab]);
-    expect(Array.from(messages[1]!)).toEqual([0xbb]);
-    expect(Array.from(messages[2]!)).toEqual([0xcc, 0xcd, 0xce, 0xcf]);
-  });
-
-  it('parses an empty buffer as zero frames', () => {
-    expect(unframeMessages(new Uint8Array(0))).toEqual([]);
-  });
-
-  it('throws on truncated header', () => {
-    // Only 3 bytes of a 5-byte header.
-    const buf = new Uint8Array([0, 0, 0]);
-    expect(() => unframeMessages(buf)).toThrow(/frame truncated/i);
-  });
-
-  it('throws on truncated payload', () => {
-    // 5-byte header declares 10 bytes of payload but only 4 follow.
-    const buf = new Uint8Array([0, 0, 0, 0, 10, 1, 2, 3, 4]);
-    expect(() => unframeMessages(buf)).toThrow(/payload truncated/i);
-  });
-
-  it('throws on unsupported compression flag', () => {
-    // Flag = 1 → compression negotiated, which we don't implement.
-    const buf = new Uint8Array([1, 0, 0, 0, 0]);
-    expect(() => unframeMessages(buf)).toThrow(/compression flag/i);
-  });
-
-  it('round-trips: frame → unframe yields original payload', () => {
-    const original = new Uint8Array([0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]); // protobuf "hello"
-    const framed = frameMessage(original);
-    const unframed = unframeMessages(framed);
-    expect(unframed.length).toBe(1);
-    expect(Array.from(unframed[0]!)).toEqual(Array.from(original));
-  });
-});

package/src/lib/oidc-issuer.test.ts

@@ -1,328 +0,0 @@
-/**
- * Server-free unit tests for the synthetic OIDC issuer harness.
- *
- * The harness is real cryptographic code (RS256 + ES256 JWS signing,
- * JWKS export, JWT compact serialization). If the signing or encoding
- * is wrong, every scenario that uses the harness silently misreports —
- * the OIDC validation scenarios soft-skip behavior portions when the
- * host doesn't trust the harness, so a malformed token would simply
- * cause the host to reject and the test to "pass" via soft-skip path.
- *
- * These unit tests round-trip every token through `node:crypto.createVerify`
- * to confirm the harness output is parseable by an independent verifier.
- * Run server-free; doesn't depend on OPENWOP_BASE_URL.
- *
- * @see conformance/src/lib/oidc-issuer.ts
- * @see RFCS/0010-auth-profile-conformance.md §E
- */
-
-import { describe, it, expect } from 'vitest';
-import { createPublicKey, createVerify, type JsonWebKey } from 'node:crypto';
-import { createSyntheticOIDCIssuer } from './oidc-issuer.js';
-
-function base64UrlDecode(input: string): Buffer {
-  const pad = input.length % 4 === 0 ? 0 : 4 - (input.length % 4);
-  const padded = input + '='.repeat(pad);
-  const std = padded.replace(/-/g, '+').replace(/_/g, '/');
-  return Buffer.from(std, 'base64');
-}
-
-function decodeJwt(token: string): {
-  header: Record<string, unknown>;
-  payload: Record<string, unknown>;
-  signature: Buffer;
-  signingInput: string;
-} {
-  const parts = token.split('.');
-  if (parts.length !== 3) throw new Error(`malformed JWT: ${parts.length} segments`);
-  const [h, p, s] = parts;
-  return {
-    header: JSON.parse(base64UrlDecode(h).toString('utf8')) as Record<string, unknown>,
-    payload: JSON.parse(base64UrlDecode(p).toString('utf8')) as Record<string, unknown>,
-    signature: base64UrlDecode(s),
-    signingInput: `${h}.${p}`,
-  };
-}
-
-function verifyToken(
-  token: string,
-  jwksJson: string,
-  algorithm: 'RS256' | 'ES256',
-): boolean {
-  const decoded = decodeJwt(token);
-  const jwks = JSON.parse(jwksJson) as { keys: JsonWebKey[] };
-  const kid = decoded.header.kid;
-  const key = jwks.keys.find((k) => k.kid === kid);
-  if (!key) throw new Error(`no JWKS key matches kid=${String(kid)}`);
-
-  const publicKey = createPublicKey({ key, format: 'jwk' });
-  const digest = algorithm === 'RS256' ? 'RSA-SHA256' : 'SHA256';
-  const verifier = createVerify(digest);
-  verifier.update(decoded.signingInput);
-  verifier.end();
-  return verifier.verify(
-    algorithm === 'RS256'
-      ? publicKey
-      : { key: publicKey, dsaEncoding: 'ieee-p1363' },
-    decoded.signature,
-  );
-}
-
-describe('oidc-issuer: harness construction', () => {
-  it('requires issuer and audience', () => {
-    expect(() =>
-      createSyntheticOIDCIssuer({ issuer: '', audience: 'openwop' }),
-    ).toThrow(/issuer and audience/);
-    expect(() =>
-      createSyntheticOIDCIssuer({ issuer: 'https://x', audience: '' }),
-    ).toThrow(/issuer and audience/);
-  });
-
-  it('defaults to RS256 + canonical keyId', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    expect(issuer.algorithm).toBe('RS256');
-    expect(issuer.keyId).toBe('openwop-conformance-key-1');
-    expect(issuer.issuer).toBe('https://harness.example');
-    expect(issuer.audience).toBe('openwop');
-  });
-
-  it('rejects unsupported algorithm at runtime (defensive)', () => {
-    expect(() =>
-      createSyntheticOIDCIssuer({
-        issuer: 'https://x',
-        audience: 'y',
-        algorithm: 'HS256',
-      }),
-    ).toThrow(/unsupported algorithm/);
-  });
-});
-
-describe('oidc-issuer: JWKS + discovery shape', () => {
-  it('publishes a well-formed JWKS for RS256', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const jwks = JSON.parse(issuer.jwksJson) as { keys: JsonWebKey[] };
-    expect(Array.isArray(jwks.keys)).toBe(true);
-    expect(jwks.keys.length).toBe(1);
-    const key = jwks.keys[0];
-    expect(key.kty).toBe('RSA');
-    expect(key.alg).toBe('RS256');
-    expect(key.use).toBe('sig');
-    expect(key.kid).toBe(issuer.keyId);
-    // RSA JWK MUST have n (modulus) and e (exponent).
-    expect(typeof key.n).toBe('string');
-    expect(typeof key.e).toBe('string');
-  });
-
-  it('publishes a well-formed JWKS for ES256', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'ES256',
-    });
-    const jwks = JSON.parse(issuer.jwksJson) as { keys: JsonWebKey[] };
-    const key = jwks.keys[0];
-    expect(key.kty).toBe('EC');
-    expect(key.alg).toBe('ES256');
-    expect(key.crv).toBe('P-256');
-    expect(typeof key.x).toBe('string');
-    expect(typeof key.y).toBe('string');
-  });
-
-  it('publishes OIDC discovery doc with correct shape', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example/oauth',
-      audience: 'openwop',
-    });
-    const disco = JSON.parse(issuer.discoveryJson) as {
-      issuer: string;
-      jwks_uri: string;
-      response_types_supported: string[];
-      subject_types_supported: string[];
-      id_token_signing_alg_values_supported: string[];
-    };
-    expect(disco.issuer).toBe('https://harness.example/oauth');
-    expect(disco.jwks_uri).toBe('https://harness.example/oauth/.well-known/jwks.json');
-    expect(disco.id_token_signing_alg_values_supported).toContain('RS256');
-  });
-
-  it('discovery doc strips trailing slash before appending jwks path', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example/',
-      audience: 'openwop',
-    });
-    const disco = JSON.parse(issuer.discoveryJson) as { jwks_uri: string };
-    expect(disco.jwks_uri).toBe('https://harness.example/.well-known/jwks.json');
-  });
-});
-
-describe('oidc-issuer: mint defaults', () => {
-  it('fills iss / aud / iat / exp when not supplied', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const before = Math.floor(Date.now() / 1000);
-    const { claims } = issuer.mint({ sub: 'test-sub' });
-    const after = Math.floor(Date.now() / 1000);
-
-    expect(claims.iss).toBe('https://harness.example');
-    expect(claims.aud).toBe('openwop');
-    expect(claims.sub).toBe('test-sub');
-    expect(typeof claims.iat).toBe('number');
-    expect(typeof claims.exp).toBe('number');
-    expect(claims.iat).toBeGreaterThanOrEqual(before);
-    expect(claims.iat).toBeLessThanOrEqual(after);
-    // Default lifetime is 300s.
-    expect((claims.exp as number) - (claims.iat as number)).toBe(300);
-  });
-
-  it('caller claims override defaults', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const { claims } = issuer.mint({
-      iss: 'override-issuer',
-      aud: 'override-audience',
-      sub: 'test-sub',
-    });
-    expect(claims.iss).toBe('override-issuer');
-    expect(claims.aud).toBe('override-audience');
-  });
-
-  it('negative expiresInSeconds mints already-expired token', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const now = Math.floor(Date.now() / 1000);
-    const { claims } = issuer.mint(
-      { sub: 'test-sub' },
-      { expiresInSeconds: -3600 },
-    );
-    expect((claims.exp as number) < now).toBe(true);
-  });
-});
-
-describe('oidc-issuer: signature round-trip', () => {
-  it('RS256 token verifies against published JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'RS256',
-    });
-    const { token } = issuer.mint({ sub: 'test-sub' });
-    const verified = verifyToken(token, issuer.jwksJson, 'RS256');
-    expect(verified).toBe(true);
-  });
-
-  it('ES256 token verifies against published JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'ES256',
-    });
-    const { token } = issuer.mint({ sub: 'test-sub' });
-    const verified = verifyToken(token, issuer.jwksJson, 'ES256');
-    expect(verified).toBe(true);
-  });
-
-  it('header alg matches issuer algorithm by default', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'ES256',
-    });
-    const { token } = issuer.mint({ sub: 'test-sub' });
-    const decoded = decodeJwt(token);
-    expect(decoded.header.alg).toBe('ES256');
-  });
-
-  it('mint opts.algorithm override appears in header (alg-spoof scenario)', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'RS256',
-    });
-    const { token } = issuer.mint(
-      { sub: 'test-sub' },
-      { algorithm: 'HS256' },
-    );
-    const decoded = decodeJwt(token);
-    expect(decoded.header.alg).toBe('HS256');
-    // The signature is still RS256-bytes (the harness doesn't actually
-    // honor the alg override for the signature itself — that's the spoof:
-    // the header lies, the bytes don't match). Verification with RS256
-    // succeeds, which is the test scenario's correct behavior: it lets
-    // the OAuth2-CC negative-case scenario assert the host rejects
-    // because the header claims HS256 outside supportedAlgorithms.
-    const verified = verifyToken(
-      // Pull alg from header for verification — but the verify path
-      // is RS256 because that's the actual key. Re-decode and verify
-      // by extracting the alg-from-issuer rather than alg-from-header.
-      token,
-      issuer.jwksJson,
-      'RS256',
-    );
-    expect(verified).toBe(true);
-  });
-
-  it('keyId override sets header.kid without changing signing key (unknown-kid scenario)', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const { token } = issuer.mint(
-      { sub: 'test-sub' },
-      { keyId: 'never-published-kid' },
-    );
-    const decoded = decodeJwt(token);
-    expect(decoded.header.kid).toBe('never-published-kid');
-    // The JWKS doesn't publish this kid; verifyToken throws.
-    expect(() => verifyToken(token, issuer.jwksJson, 'RS256')).toThrow(/no JWKS key/);
-  });
-});
-
-describe('oidc-issuer: key rotation', () => {
-  it('rotateKey() changes the published keyId', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const firstKid = issuer.keyId;
-    issuer.rotateKey();
-    expect(issuer.keyId).not.toBe(firstKid);
-    expect(issuer.keyId).toBe('openwop-conformance-key-2');
-  });
-
-  it('tokens minted before rotation no longer verify against new JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const beforeRotation = issuer.mint({ sub: 'test-sub' });
-    issuer.rotateKey();
-    // The JWKS now publishes a different key. The old token's header
-    // kid still references the pre-rotation kid, which isn't published.
-    expect(() =>
-      verifyToken(beforeRotation.token, issuer.jwksJson, 'RS256'),
-    ).toThrow(/no JWKS key/);
-  });
-
-  it('tokens minted after rotation verify against new JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    issuer.rotateKey();
-    const afterRotation = issuer.mint({ sub: 'test-sub' });
-    const verified = verifyToken(afterRotation.token, issuer.jwksJson, 'RS256');
-    expect(verified).toBe(true);
-  });
-});

package/src/lib/otel-collector-grpc.test.ts

@@ -1,191 +0,0 @@
-/**
- * End-to-end OTLP/gRPC collector tests — Track 11.
- *
- * Boots an `OtelCollector` with `startGrpc()`, sends a hand-rolled
- * OTLP trace request over h2c HTTP/2 with gRPC framing, and asserts
- * the collector captured the span. Validates that the framing
- * primitive + protobuf decoder + ingest pipeline compose end-to-end.
- *
- * @see otel-collector.ts §_handleGrpcStream
- * @see grpc-framing.ts
- * @see otlp-protobuf.ts
- */
-
-import { afterEach, beforeEach, describe, it, expect } from 'vitest';
-import { connect, type ClientHttp2Session } from 'node:http2';
-import { OtelCollector } from './otel-collector.js';
-import { frameMessage, unframeMessages } from './grpc-framing.js';
-
-// ─── Minimal OTLP/protobuf encoder ────────────────────────────────────────
-// Inlined rather than imported from `otlp-protobuf.test.ts` so this file
-// stays self-contained. Same builder shape; smaller surface (just what
-// the e2e test needs).
-
-const WIRE_LEN = 2;
-const WIRE_I64 = 1;
-
-class PbWriter {
-  private readonly chunks: number[] = [];
-  bytes(): Uint8Array {
-    return new Uint8Array(this.chunks);
-  }
-  private writeVarint(v: number): void {
-    let n = v >>> 0;
-    while (n >= 0x80) {
-      this.chunks.push((n & 0x7f) | 0x80);
-      n = n >>> 7;
-    }
-    this.chunks.push(n & 0x7f);
-  }
-  writeTag(fieldNumber: number, wireType: number): void {
-    this.writeVarint((fieldNumber << 3) | wireType);
-  }
-  writeString(fieldNumber: number, s: string): void {
-    const enc = new TextEncoder().encode(s);
-    this.writeTag(fieldNumber, WIRE_LEN);
-    this.writeVarint(enc.length);
-    for (const b of enc) this.chunks.push(b);
-  }
-  writeBytesHex(fieldNumber: number, hex: string): void {
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < bytes.length; i++) {
-      bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
-    }
-    this.writeTag(fieldNumber, WIRE_LEN);
-    this.writeVarint(bytes.length);
-    for (const b of bytes) this.chunks.push(b);
-  }
-  writeFixed64(fieldNumber: number, v: bigint): void {
-    this.writeTag(fieldNumber, WIRE_I64);
-    let big = v;
-    for (let i = 0; i < 8; i++) {
-      this.chunks.push(Number(big & 0xffn));
-      big = big >> 8n;
-    }
-  }
-  writeMessage(fieldNumber: number, body: Uint8Array): void {
-    this.writeTag(fieldNumber, WIRE_LEN);
-    this.writeVarint(body.length);
-    for (const b of body) this.chunks.push(b);
-  }
-}
-
-function buildSpan(traceId: string, spanId: string, name: string): Uint8Array {
-  const w = new PbWriter();
-  w.writeBytesHex(1, traceId);
-  w.writeBytesHex(2, spanId);
-  w.writeString(5, name);
-  w.writeFixed64(7, BigInt(1700000000) * 1_000_000_000n);
-  w.writeFixed64(8, BigInt(1700000001) * 1_000_000_000n);
-  return w.bytes();
-}
-
-function buildExportTrace(spanBytes: Uint8Array): Uint8Array {
-  // ResourceSpans → ScopeSpans (field 2) → Span (field 2)
-  const scopeSpans = new PbWriter();
-  scopeSpans.writeMessage(2, spanBytes);
-  const resourceSpans = new PbWriter();
-  resourceSpans.writeMessage(2, scopeSpans.bytes());
-  const root = new PbWriter();
-  root.writeMessage(1, resourceSpans.bytes()); // ExportTraceServiceRequest.resource_spans
-  return root.bytes();
-}
-
-// ─── Test fixture ─────────────────────────────────────────────────────────
-
-describe('otel-collector OTLP/gRPC: end-to-end capture', () => {
-  let collector: OtelCollector;
-
-  beforeEach(async () => {
-    collector = new OtelCollector();
-    await collector.startGrpc(0);
-  });
-
-  afterEach(async () => {
-    await collector.stopGrpc();
-  });
-
-  it('captures a span sent over gRPC framing', async () => {
-    const TRACE_ID = '0102030405060708090a0b0c0d0e0f10';
-    const SPAN_ID = '1112131415161718';
-    const SPAN_NAME = 'openwop.run';
-
-    const span = buildSpan(TRACE_ID, SPAN_ID, SPAN_NAME);
-    const exportReq = buildExportTrace(span);
-    const framed = frameMessage(exportReq);
-
-    const session: ClientHttp2Session = connect(collector.grpcEndpoint());
-    try {
-      await new Promise<void>((resolve, reject) => {
-        const req = session.request({
-          ':method': 'POST',
-          ':path': '/opentelemetry.proto.collector.trace.v1.TraceService/Export',
-          'content-type': 'application/grpc+proto',
-          te: 'trailers',
-        });
-        let respStatus = '';
-        let trailerStatus = '';
-        const chunks: Buffer[] = [];
-        req.on('response', (headers) => {
-          respStatus = String(headers[':status'] ?? '');
-        });
-        req.on('trailers', (trailers) => {
-          trailerStatus = String(trailers['grpc-status'] ?? '');
-        });
-        req.on('data', (c: Buffer) => chunks.push(c));
-        req.on('end', () => {
-          try {
-            expect(respStatus).toBe('200');
-            expect(trailerStatus).toBe('0');
-            // Response body MUST be a 5-byte frame with a zero-length payload.
-            const respBody = Buffer.concat(chunks);
-            const unframed = unframeMessages(
-              new Uint8Array(respBody.buffer, respBody.byteOffset, respBody.byteLength),
-            );
-            expect(unframed.length).toBe(1);
-            expect(unframed[0]!.byteLength).toBe(0);
-            resolve();
-          } catch (err) {
-            reject(err);
-          }
-        });
-        req.on('error', reject);
-        req.end(Buffer.from(framed));
-      });
-    } finally {
-      session.close();
-    }
-
-    // Collector captured the span exactly once.
-    const spans = collector.spans();
-    expect(spans.length).toBe(1);
-    expect(spans[0]!.name).toBe(SPAN_NAME);
-    expect(spans[0]!.traceId).toBe(TRACE_ID);
-    expect(spans[0]!.spanId).toBe(SPAN_ID);
-  });
-
-  it('returns INVALID_ARGUMENT trailer for unsupported content-type', async () => {
-    const session: ClientHttp2Session = connect(collector.grpcEndpoint());
-    try {
-      await new Promise<void>((resolve, reject) => {
-        const req = session.request({
-          ':method': 'POST',
-          ':path': '/opentelemetry.proto.collector.trace.v1.TraceService/Export',
-          'content-type': 'text/plain',
-        });
-        req.on('response', (headers) => {
-          try {
-            expect(headers['grpc-status']).toBe('3'); // INVALID_ARGUMENT
-            resolve();
-          } catch (err) {
-            reject(err);
-          }
-        });
-        req.on('error', reject);
-        req.end();
-      });
-    } finally {
-      session.close();
-    }
-  });
-});