Guarantee granted always come in the right order

lib/handlers/subscribe.js

@@ -23,7 +23,7 @@ function handleSubscribe (client, packet, done) {
   var subs = packet.subscriptions
   var granted = []
 
-  broker._parallel(
+  broker._series(
     new SubscribeState(client, packet, done, granted),
     doSubscribe,
     subs,

lib/handlers/unsubscribe.js

@@ -37,7 +37,7 @@ function handleUnsubscribe (client, packet, done) {
 
 function actualUnsubscribe (client, packet, done) {
   var broker = client.broker
-  broker._parallel(
+  broker._series(
     new UnsubscribeState(client, packet, done, null),
     doUnsubscribe,
     packet.unsubscriptions,

test/auth.js

@@ -479,6 +479,71 @@ test('negate subscription', function (t) {
   })
 })
 
+test('negate multiple subscriptions', function (t) {
+  t.plan(5)
+
+  var s = connect(setup())
+
+  s.broker.authorizeSubscribe = function (client, sub, cb) {
+    t.ok(client, 'client exists')
+    cb(null, null)
+  }
+
+  s.inStream.write({
+    cmd: 'subscribe',
+    messageId: 24,
+    subscriptions: [{
+      topic: 'hello',
+      qos: 0
+    }, {
+      topic: 'world',
+      qos: 0
+    }]
+  })
+
+  s.outStream.once('data', function (packet) {
+    t.equal(packet.cmd, 'suback')
+    t.deepEqual(packet.granted, [128, 128])
+    t.equal(packet.messageId, 24)
+  })
+})
+
+test('negate multiple subscriptions random times', function (t) {
+  t.plan(5)
+
+  var s = connect(setup())
+
+  s.broker.authorizeSubscribe = function (client, sub, cb) {
+    t.ok(client, 'client exists')
+    if (sub.topic === 'hello') {
+      setTimeout(function () {
+        cb(null, sub)
+      }, 100)
+    } else {
+      cb(null, null)
+    }
+  }
+
+  s.inStream.write({
+    cmd: 'subscribe',
+    messageId: 24,
+    subscriptions: [{
+      topic: 'hello',
+      qos: 0
+    }, {
+      topic: 'world',
+      qos: 0
+    }]
+  })
+
+  s.outStream.once('data', function (packet) {
+    t.equal(packet.cmd, 'suback')
+    t.deepEqual(packet.granted, [0, 128])
+    t.equal(packet.messageId, 24)
+  })
+})
+
+
 test('failed authentication does not disconnect other client with same clientId', function (t) {
   t.plan(3)