ldap-authentication 4.2.1 → 4.3.0

package/AGENTS.md

@@ -0,0 +1,97 @@
+# AGENTS.md - guidance for AI coding agents working in this repo
+
+## What this repo is
+
+`ldap-authentication` - a small Node.js library that authenticates users against an
+LDAP/AD server. It is a thin wrapper around `ldapts` (its only runtime dependency).
+
+There is **no build step**. The package is published as-is:
+
+- `index.js` - CJS implementation (all runtime logic lives here)
+- `index.mjs` - ESM re-export entry point
+- `index.d.ts` - hand-written TypeScript types (keep in sync with `index.js` and the README)
+- `test/` - jasmine integration specs (require a running LDAP server)
+- `example/` - runnable usage examples (require a running LDAP server)
+- `docker/` + `docker-compose.yml` - the seeded OpenLDAP test server
+- `dist/` - **stale legacy build (gitignored, not referenced by package.json, not
+  published). Ignore it; do not edit or "fix" it.**
+
+## Running the tests
+
+The specs are integration tests against a seeded OpenLDAP container:
+
+1. `docker compose -f docker-compose.yml up -d` - LDAP on `ldap://localhost:1389`,
+   LDAPS on `ldaps://localhost:1636`
+2. Wait until an admin bind succeeds (server is ready when this works)
+3. `INGITHUB=true npm test` - the `INGITHUB` env var switches the specs from the
+   docker-internal URL (`ldap://ldap:1389`) to `ldap://localhost:1389`
+4. `docker compose -f docker-compose.yml down`
+
+Or all of the above in one shot: `npm run test:local` (`scripts/test-local.sh`).
+
+Seeded data (see `docker/ldap/*.ldif`): domain `dc=example,dc=com`; users
+`cn=gauss` and `cn=einstein` in `ou=users` (both with password `password`); group
+`cn=科学A部` in `ou=groups` containing gauss; admin
+`cn=read-only-admin,dc=example,dc=com` (password `password`).
+`test/binary.spec.js` MUTATES the directory (adds `jpegPhoto` to gauss), so spec
+order matters - keep the deterministic order: in jasmine 7 the env options
+(`random`, `seed`, `stopSpecOnExpectationFailure`) must be nested under the `env`
+key in `loadConfig` (see `test/jasmine.js`).
+
+## Code style
+
+Prettier (`.prettierrc`): no semicolons, single quotes, 2-space indent, trailing
+commas in `es5`. Match the existing style when editing `index.js`.
+
+## Version control - IMPORTANT: this is a Jujutsu (jj) repo
+
+This repo is managed with **jj** (see `.jj/`). Do NOT use `git commit` for commits;
+use jj:
+
+1. `jj describe -m "<message>"` - commits the current working-copy changes
+   (after `jj describe`, jj may warn that the commit became immutable and create an
+   empty working-copy commit on top - that is normal and harmless)
+2. `jj bookmark move master` - move the local `master` bookmark to the new commit
+   (defaults to the working copy, `@`)
+3. `jj git push --bookmark master` - push to `origin`
+   (`git@github.com:shaozi/ldap-authentication.git`). The remote prints a
+   "Bypassed rule violations ... Changes must be made through a pull request"
+   notice on master - that is expected (maintainer bypass) and not an error.
+
+The maintainer works detached (no branch); commits go on the `master` bookmark
+with a single descriptive message, e.g.
+`"Add fetchUsers() to search all users via paged admin-bound lookup (#3); bump to 4.1.0"`.
+
+## Releases
+
+1. Bump `version` in **both** `package.json` and `package-lock.json` (the lockfile
+   has it twice: top-level and under `packages."").version`). Follow semver
+   (new feature = e.g. 4.1.0, docs/deps-only = patch).
+2. Commit + push as above.
+3. `jj tag set vN.N.N -r @-` (tag the just-pushed master commit), then
+   `git push origin vN.N.N` (jj has no tag push in this version).
+4. `gh release create vN.N.N --title "vN.N.N" --notes "..."` - creating the
+   release triggers `.github/workflows/npm-publish.yml` (OIDC), which runs
+   `npm ci && npm publish`.
+5. Verify: `gh run list` (the `Publish Package` run should succeed) and
+   `npm view ldap-authentication@N.N.N`. Note that the npm registry's packument
+   can lag the publish by a couple of minutes - check the
+   `https://registry.npmjs.org/ldap-authentication` `time`/`versions` before
+   re-publishing. The legacy `publish.yml` workflow also triggers on release and
+   its `npm publish` step fails with E404 because it duplicates the other
+   workflow - that failure is expected/harmless; `publish.yml` is a candidate
+   for deletion.
+
+## CI
+
+`integration-test.yml` runs on push/PR to `master`: builds the LDAP container from
+`docker-compose.yml`, runs `npm ci` + `npm run test` with `INGITHUB=true` on a
+Node 22.x/24.x matrix. Release events additionally trigger the publish workflows.
+
+## When adding a new option
+
+Update all of: the validation in `index.js` (`authenticateResult` /
+`fetchUsers`), the JSDoc in `index.js`, `index.d.ts` (`AuthenticationOptions` and
+/ or `FetchUsersOptions`), and the README (Parameters list, the
+options-by-mode table, and an example if the option changes behavior). Add or
+extend the specs in `test/` (integration specs run against the seeded container).

package/README.md

@@ -212,6 +212,18 @@ auth()
 - For `ldaps://` URLs, omit `starttls` and the connection will use TLS from the start
 - TLS options like `rejectUnauthorized`, `minVersion`, and `servername` can be specified in `ldapOpts.tlsOptions`
 
+#### Runnable examples
+
+The [example/](example/) directory contains complete, runnable scripts: admin auth, self auth, group lookup,
+`fetchUsers`, `verifyUserExists`, and StartTLS. They run against the bundled seeded test server
+(start it via `docker compose up -d`, or point `LDAP_URL` at your own server):
+
+```sh
+docker compose up -d               # seeded OpenLDAP on localhost:1389 / 1636
+node example/fetch-users.mjs       # or any other script in example/
+docker compose down
+```
+
 ## Parameters
 
 - `ldapOpts`: This is passed to `ldapts` client directly
@@ -254,6 +266,15 @@ auth()
 - `groupMemberAttribute`: if specified with groupClass and groupsSearchBase, will be used as member name (if not specified this defaults to `member`) in search filter for authenticated user groups
 - `groupMemberUserAttribute`: if specified with groupClass and groupsSearchBase, will be used as the attribute on the user object (if not specified this defaults to `dn`) in search filter for authenticated user groups
 
+### Which options for which mode?
+
+| Mode (call) | Required | Commonly used in addition |
+|---|---|---|
+| Admin authenticate (`authenticate`) | `ldapOpts`, `adminDn`, `adminPassword`, `userPassword`, `userSearchBase`, `usernameAttribute` or `usernameFilter`, `username` | `attributes`, `groupsSearchBase`, `groupClass`, `starttls` |
+| Self authenticate (`authenticate`) | `ldapOpts`, `userDn`, `userPassword` | `userSearchBase`, `usernameAttribute`, `attributes`, `groupsSearchBase`, `starttls` |
+| Verify user exists (`authenticate` with `verifyUserExists: true`) | `ldapOpts`, `adminDn`, `adminPassword`, `userSearchBase`, `usernameAttribute` or `usernameFilter`, `username` | `attributes`, `groupsSearchBase`, `starttls` |
+| Fetch all users (`fetchUsers`) | `ldapOpts`, `adminDn`, `adminPassword`, `userSearchBase` | `userFilter`, `attributes`, `pageSize`, `starttls` |
+
 ## Returns
 
 The user object if `authenticate()` is success.
@@ -279,6 +300,30 @@ AuthenticationResult object has the following fields:
 - `message`: authentication message array, which contains server messages
 - `client`: ldapClient instance
 
+## Active Directory notes
+
+- A typical admin bind DN is a service or admin account, e.g. `cn=Administrator,cn=users,dc=example,dc=com`,
+  or a dedicated LDAP sync account.
+- Username attributes: `sAMAccountName` for logins like `jdoe`, `userPrincipalName` for `jdoe@example.com`.
+  To look a user up by either at once, use
+  `usernameFilter: '(|(sAMAccountName={{username}})(userPrincipalName={{username}}))'`.
+- Set `userSearchBase` to the OU containing the users (e.g. `ou=users,dc=example,dc=com`):
+  the search is faster and avoids `AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS`.
+- `fetchUsers()` uses LDAP paged results, so Active Directory's usual 1000-entry limit per search
+  is not an issue (adjust the page size with `pageSize` if needed).
+- Binary attributes such as `thumbnailPhoto` should be requested as `thumbnailPhoto;binary`;
+  they are returned as base64-encoded strings.
+
+## Troubleshooting
+
+| Symptom | Likely cause / fix |
+|---|---|
+| `ECONNREFUSED`, `ETIMEDOUT`, or other connect errors | `ldapOpts.url` is wrong or the server is unreachable. Check the URL, the network/firewall, and `connectTimeout`. |
+| `LdapAuthenticationError` with `admin bind failed` / `user bind failed` | Wrong `adminDn`/`adminPassword`, or `userDn`/`userPassword` in self mode. Verify the bind manually, e.g. `ldapsearch -b dc=example,dc=com -D <dn> -w <password> dn`. |
+| `identity not found` (`AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND`) | The user does not exist under `userSearchBase`, or `usernameAttribute`/`username`/`usernameFilter` does not match the attribute(s) stored on the server. |
+| `identity ambiguous` (`AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS`) | The search matched multiple entries - narrow `userSearchBase` or make the filter more specific. |
+| `Invalid credentials` (`AUTH_RESULT_FAILURE_CREDENTIAL_INVALID`) | The user was found but the password is wrong. |
+| TLS certificate errors | For self-signed certificates use `tlsOptions: { rejectUnauthorized: false }`; add `servername` for SNI. Use `ldaps://` (without `starttls`) or `ldap://` with `starttls: true`. |
 
 ## Old Stuff
 

package/example/fetch-users.mjs

@@ -0,0 +1,36 @@
+// Fetch all users with the admin account - the search is paged, so more
+// than 1000 entries can be returned.
+// Requires the bundled seeded test server: `docker compose up -d`
+// (or set LDAP_URL to point at your own server).
+
+import { fetchUsers } from '../index.mjs'
+
+const ldapOpts = {
+  url: process.env.LDAP_URL || 'ldap://localhost:1389',
+}
+
+const baseOptions = {
+  ldapOpts,
+  adminDn: 'cn=read-only-admin,dc=example,dc=com',
+  adminPassword: 'password',
+  userSearchBase: 'dc=example,dc=com',
+}
+
+// 1. All users (default filter: entries with a uid or sAMAccountName), all attributes
+let users = await fetchUsers(baseOptions)
+console.log('all users ->', users.map((user) => user.uid ?? user.cn))
+
+// 2. Custom filter + attribute selection
+users = await fetchUsers({
+  ...baseOptions,
+  userFilter: '(uid=gauss)',
+  attributes: ['uid', 'sn'],
+})
+console.log('filtered  ->', users)
+
+// 3. Small page size (paged results are always on)
+users = await fetchUsers({
+  ...baseOptions,
+  pageSize: 1,
+})
+console.log('paged     ->', users.length, 'entries with pageSize 1')

package/example/index.js

@@ -1,58 +1,56 @@
+// Admin and self authentication, with group lookup.
+// Requires the bundled seeded test server: `docker compose up -d`
+// (or set LDAP_URL to point at your own server).
+
 const { authenticate } = require('../index')
 
+const url = process.env.LDAP_URL || 'ldap://localhost:1389'
+
 async function auth() {
-  // auth with admin
-  let options = {
-    ldapOpts: {
-      url: 'ldap://localhost:1389',
-      // tlsOptions: { rejectUnauthorized: false }
-    },
+  // 1. Admin mode: bind as admin, find the user, then bind as the user.
+  // Restrict `attributes` so the server does not return everything (including
+  // userPassword).
+  let user = await authenticate({
+    ldapOpts: { url },
     adminDn: 'cn=read-only-admin,dc=example,dc=com',
     adminPassword: 'password',
     userPassword: 'password',
     userSearchBase: 'dc=example,dc=com',
     usernameAttribute: 'uid',
     username: 'gauss',
-    // starttls: false
-  }
+    attributes: ['uid', 'sn', 'cn'],
+  })
+  console.log('admin mode     ->', JSON.stringify(user, null, 2))
 
-  let user = await authenticate(options)
-  console.log(`user = ${JSON.stringify(user, null, 2)}`)
-
-  // auth with regular user
-  options = {
-    ldapOpts: {
-      url: 'ldap://ldap.forumsys.com',
-      // tlsOptions: { rejectUnauthorized: false }
-    },
-    userDn: 'uid=einstein,dc=example,dc=com',
+  // 2. Self mode: the user binds with its own DN and gets its details
+  user = await authenticate({
+    ldapOpts: { url },
+    userDn: 'cn=einstein,ou=users,dc=example,dc=com',
     userPassword: 'password',
     userSearchBase: 'dc=example,dc=com',
     usernameAttribute: 'uid',
     username: 'einstein',
-    // starttls: false
-  }
-
-  user = await authenticate(options)
-  console.log(`user = ${JSON.stringify(user, null, 2)}`)
+    attributes: ['uid', 'sn'],
+  })
+  console.log('self mode      ->', { uid: user.uid, sn: user.sn })
 
-  // Getting user group info
-  options = {
-    ldapOpts: {
-      url: 'ldap://ldap.forumsys.com',
-    },
-    userDn: 'uid=gauss,dc=example,dc=com',
+  // 3. Admin mode with group lookup
+  user = await authenticate({
+    ldapOpts: { url },
+    adminDn: 'cn=read-only-admin,dc=example,dc=com',
+    adminPassword: 'password',
     userPassword: 'password',
     userSearchBase: 'dc=example,dc=com',
     usernameAttribute: 'uid',
     username: 'gauss',
     groupsSearchBase: 'dc=example,dc=com',
-    groupClass: 'groupOfUniqueNames',
-    groupMemberAttribute: 'uniqueMember',
-  }
-
-  user = await authenticate(options)
-  console.log(`user = ${JSON.stringify(user, null, 2)}`)
+    groupClass: 'groupOfNames',
+    groupMemberAttribute: 'member',
+  })
+  console.log('with groups    ->', user.groups.map((group) => group.cn))
 }
 
-auth().then()
+auth().catch((error) => {
+  console.error(error)
+  process.exit(1)
+})

package/example/starttls.mjs

@@ -0,0 +1,40 @@
+// Authenticate over STARTTLS (ldap:// URL upgraded to TLS).
+// Requires an LDAP server that supports TLS certificates.
+// (The bundled test container generates TLS config but does not enable it,
+// so this script prints a notice instead of failing in that case.)
+
+import { authenticate } from '../index.mjs'
+
+const isTlsNotSupported = (error) =>
+  error instanceof Error &&
+  /secure TLS connection was established/i.test(error.message)
+
+// The bundled container uses a self-signed certificate, so the test
+// disables certificate verification. Do NOT do this in production;
+// provide your CA in tlsOptions.ca instead.
+try {
+  const user = await authenticate({
+    ldapOpts: {
+      url: process.env.LDAP_URL || 'ldap://localhost:1389',
+      tlsOptions: {
+        rejectUnauthorized: false, // self-signed certificate (test only)
+      },
+    },
+    starttls: true, // upgrade the ldap:// connection to TLS
+    adminDn: 'cn=read-only-admin,dc=example,dc=com',
+    adminPassword: 'password',
+    userPassword: 'password',
+    userSearchBase: 'dc=example,dc=com',
+    usernameAttribute: 'uid',
+    username: 'gauss',
+  })
+  console.log('starttls auth ->', user.uid)
+} catch (error) {
+  if (isTlsNotSupported(error)) {
+    console.log('This LDAP server does not support TLS - STARTTLS could not be established.')
+    console.log('Run this example against a server with TLS enabled (or use an ldaps:// URL).')
+  } else {
+    console.error(error)
+    process.exit(1)
+  }
+}

package/example/verify-user-exists.js

@@ -0,0 +1,45 @@
+// Verify that a user exists (without checking the password).
+// Requires the bundled seeded test server: `docker compose up -d`
+// (or set LDAP_URL to point at your own server).
+
+const { authenticate, LdapAuthenticationError } = require('../index')
+
+const url = process.env.LDAP_URL || 'ldap://localhost:1389'
+
+async function verify() {
+  // Existing user
+  let user = await authenticate({
+    ldapOpts: { url },
+    adminDn: 'cn=read-only-admin,dc=example,dc=com',
+    adminPassword: 'password',
+    verifyUserExists: true,
+    userSearchBase: 'dc=example,dc=com',
+    usernameAttribute: 'uid',
+    username: 'gauss',
+  })
+  console.log('gauss exists ->', user.uid)
+
+  // Non-existing user throws LdapAuthenticationError
+  try {
+    await authenticate({
+      ldapOpts: { url },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'does-not-exist',
+    })
+  } catch (error) {
+    if (error instanceof LdapAuthenticationError) {
+      console.log('does-not-exist ->', error.message)
+    } else {
+      throw error
+    }
+  }
+}
+
+verify().catch((error) => {
+  console.error(error)
+  process.exit(1)
+})

package/index.d.ts

@@ -37,6 +37,29 @@ declare module 'ldap-authentication' {
     readonly client: any
   }
 
+  /**
+   * A single group entry returned on `user.groups` when group lookup is
+   * enabled (`groupsSearchBase` + `groupClass`). `objectName` mirrors `dn`
+   * for backward compatibility with the old ldapjs-based API.
+   */
+  export interface LdapGroupEntry {
+    dn: string
+    objectName?: string
+    [attr: string]: any
+  }
+
+  /**
+   * A single user object returned by `authenticate()` / `fetchUsers()`.
+   * Always contains the entry's `dn`; other attribute values are
+   * `string`/`string[]` (or a base64 string for `;binary` attributes), and
+   * `groups` is present when group lookup is enabled.
+   */
+  export interface LdapUserEntry {
+    dn: string
+    groups?: LdapGroupEntry[]
+    [attr: string]: any
+  }
+
   export interface FetchUsersOptions {
     ldapOpts: ClientOptions
     adminDn: string
@@ -58,15 +81,23 @@ declare module 'ldap-authentication' {
     starttls?: boolean
   }
 
+  /**
+   * Authenticate a user against the LDAP server. Kept as `Promise<any>` for
+   * backward compatibility; the resolved value has the shape of
+   * {@link LdapUserEntry}. Throws {@link LdapAuthenticationError} on failure.
+   */
   export function authenticate(options: AuthenticationOptions): Promise<any>
+  /** Same options as {@link authenticate} but never throws on failure; returns an {@link AuthenticationResult}. */
   export function authenticateResult(options: AuthenticationOptions): Promise<AuthenticationResult>
 
   /**
    * Bind with the admin account and search all users under `userSearchBase`.
    * The search always uses paged results, so results are not limited by the
    * common server-side limit of 1000 entries.
+   *
+   * Returns an empty array if no user matches the filter.
    */
-  export function fetchUsers(options: FetchUsersOptions): Promise<any[]>
+  export function fetchUsers(options: FetchUsersOptions): Promise<LdapUserEntry[]>
 
   export class LdapAuthenticationError extends Error {
     constructor(message: any)

package/index.js

@@ -48,6 +48,10 @@ const AUTH_RESULT_FAILURE_UNCATEGORIZED = -4
 const DEFAULT_FETCH_USERS_FILTER = '(|(uid=*)(sAMAccountName=*))'
 const DEFAULT_FETCH_USERS_PAGE_SIZE = 1000
 
+/**
+ * Result object returned by {@link authenticateResult}. Inspect `code` (one
+ * of the AUTH_RESULT_* constants) and `messages` to classify failures.
+ */
 class AuthenticationResult {
   #authCode = AUTH_RESULT_FAILURE_UNCATEGORIZED
   #identity
@@ -613,9 +617,20 @@ async function verifyUserExists(
   )
 }
 
-// fetch all users under the search base, using the admin account to search.
-// the search always uses paged results so the common server-side limit of
-// 1000 entries does not apply.
+/**
+ * Fetch all users under `userSearchBase`, using the admin account to search.
+ * No individual username or password is required. The search always uses
+ * LDAP paged results, so the common server-side limit of 1000 entries does
+ * not apply. Returns an empty array if no user matches.
+ *
+ * @param {FetchUsersOptions} options - required: `ldapOpts` (with `url`),
+ *   `adminDn`, `adminPassword`, `userSearchBase`; optional: `userFilter`,
+ *   `attributes`, `explicitBufferAttributes`, `pageSize`, `starttls`.
+ *   See the types in index.d.ts and the README for details.
+ * @returns {Promise<LdapUserEntry[]>} one entry per matched user, each with
+ *   its `dn` and the returned attributes.
+ * @throws {LdapAuthenticationError} if the admin bind or the search fails.
+ */
 async function fetchUsers(options) {
   assert(
     options.ldapOpts && options.ldapOpts.url,
@@ -658,6 +673,22 @@ async function fetchUsers(options) {
   }
 }
 
+/**
+ * Authenticate a user against the LDAP server.
+ *
+ * Modes (see the README for a full option reference):
+ * - Admin mode: `adminDn` + `adminPassword` + `userSearchBase` +
+ *   `usernameAttribute` (or `usernameFilter`) + `username` + `userPassword`.
+ *   The library binds as admin, finds the user's DN, then binds as the user.
+ * - Self mode: `userDn` + `userPassword`. Optionally `userSearchBase` and
+ *   `usernameAttribute` to also return the user's details.
+ * - Verify mode: `verifyUserExists: true` with admin credentials; verifies
+ *   that the user exists without checking the password.
+ *
+ * @param {AuthenticationOptions} options
+ * @returns {Promise<any>} the user object if authentication succeeded.
+ * @throws {LdapAuthenticationError} if authentication failed.
+ */
 async function authenticate(options) {
   const result = await authenticateResult(options)
 
@@ -670,6 +701,15 @@ async function authenticate(options) {
   return result.user
 }
 
+/**
+ * Same options and behavior as {@link authenticate}, but never throws on
+ * authentication failure - it returns an {@link AuthenticationResult} whose
+ * `code` identifies the outcome (useful for custom error handling).
+ *
+ * @param {AuthenticationOptions} options
+ * @returns {Promise<AuthenticationResult>}
+ * @throws {LdapAuthenticationError|Error} only on invalid options or network errors.
+ */
 async function authenticateResult(options) {
   if (!options.userDn) {
     assert(options.adminDn, 'Admin mode adminDn must be provided')
@@ -756,6 +796,7 @@ async function authenticateResult(options) {
   )
 }
 
+/** Thrown by authenticate()/authenticateResult()/fetchUsers() on failure; `message` describes the failure. */
 class LdapAuthenticationError extends Error {
   constructor(message) {
     super(message)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "4.2.1",
+  "version": "4.3.0",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
@@ -17,7 +17,8 @@
     "node": ">=22.0.0"
   },
   "scripts": {
-    "test": "node test/jasmine.js"
+    "test": "node test/jasmine.js",
+    "test:local": "bash scripts/test-local.sh"
   },
   "repository": {
     "type": "git",

package/scripts/test-local.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# One-shot local integration test: start the seeded LDAP test container
+# (docker-compose.yml), wait until it accepts an admin bind, run `npm test`,
+# then stop the container again.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+
+cleanup() {
+  docker compose -f docker-compose.yml down
+}
+trap cleanup EXIT
+
+docker compose -f docker-compose.yml up -d
+
+for i in $(seq 1 30); do
+  if node -e "
+const ldapts = require('ldapts')
+const c = new ldapts.Client({ url: 'ldap://localhost:1389', connectTimeout: 2000 })
+c.bind('cn=read-only-admin,dc=example,dc=com', 'password')
+  .then(() => { c.unbind(); process.exit(0) })
+  .catch(() => process.exit(1))
+"
+  then
+    break
+  fi
+  if [ "$i" -eq 30 ]; then
+    echo 'LDAP server did not become ready in time' >&2
+    exit 1
+  fi
+  sleep 2
+done
+
+INGITHUB=true npm test