serverless-ircd 0.1.0 → 0.2.0

package/packages/irc-core/src/commands/join.ts

@@ -17,12 +17,14 @@
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import type { StoredMessage } from '../ports.js';
 import { wrapBatch } from '../protocol/batch.js';
 import { Numerics } from '../protocol/numerics.js';
 import { type ChanName, type ChannelState, prefixOf } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
+import { CHATHISTORY_CAP, buildChathistoryBatch } from './chathistory.js';
 
 /**
  * RFC 1459/2812 channel-name grammar. The first character must be a channel
@@ -64,16 +66,13 @@ function buildNamesList(state: ChannelState): string {
 
 /**
  * Formats a single numeric error line addressed to the connection's current
- * nick (or `*` when unregistered). Optional `middle` is emitted before the
- * trailing `:`-prefixed text.
+ * nick (or `*` when unregistered). `middle` is emitted before the trailing
+ * `:`-prefixed text.
  */
-function numericErr(ctx: Ctx, code: number, trailing: string, middle?: string): RawLine {
+function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
   const nick = ctx.connection.nick ?? '*';
   const codeStr = code.toString().padStart(3, '0');
-  const parts = [`:${ctx.serverName}`, codeStr, nick];
-  if (middle !== undefined) parts.push(middle);
-  parts.push(`:${trailing}`);
-  return { text: parts.join(' ') };
+  return { text: [`:${ctx.serverName}`, codeStr, nick, middle, `:${trailing}`].join(' ') };
 }
 
 /**
@@ -107,6 +106,44 @@ function joinerHostmask(conn: ConnectionState): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';
 }
 
+/** Default backlog depth replayed on JOIN when ServerConfig omits a value. */
+const DEFAULT_CHATHISTORY_PLAYBACK_LIMIT = 50;
+
+/**
+ * Builds the IRCv3 `draft/chathistory` auto-playback BATCH for a cap-enabled
+ * joiner and computes the next "last read" marker.
+ *
+ * Returns `{ effects: [], marker: undefined }` when playback is disabled (cap
+ * not negotiated, no MessageStore bound, or no messages newer than the
+ * marker); otherwise a single `Send` carrying the BATCH frame and the msgid
+ * of the newest replayed message. The caller is responsible for prepending
+ * the effects before the JOIN broadcast and for advancing the per-connection
+ * marker so a PART/re-JOIN cycle with no new activity replays nothing.
+ */
+function buildChathistoryPlayback(
+  state: ChannelState,
+  ctx: Ctx,
+): { effects: EffectType[]; marker: string | undefined } {
+  if (!ctx.connection.caps.has(CHATHISTORY_CAP)) {
+    return { effects: [], marker: undefined };
+  }
+  if (ctx.messages === undefined) {
+    return { effects: [], marker: undefined };
+  }
+  const limit = ctx.serverConfig.chatHistoryPlaybackLimit ?? DEFAULT_CHATHISTORY_PLAYBACK_LIMIT;
+  const previousMarker = ctx.connection.lastReadMarkers?.get(state.nameLower);
+  const recent = ctx.messages.recent(state.nameLower, previousMarker, limit);
+  if (recent.length === 0) {
+    return { effects: [], marker: undefined };
+  }
+  // `recent` is non-empty here, so the last entry is defined; the assertion
+  // only satisfies the type-checker under `noUncheckedIndexedAccess` (no
+  // runtime branch, no `!` token).
+  const newest = recent[recent.length - 1] as StoredMessage;
+  const effects = buildChathistoryBatch(ctx, state.name, recent);
+  return { effects, marker: newest.msgid };
+}
+
 /**
  * Handles `JOIN <chan> [<key>]` for a single channel.
  *
@@ -244,6 +281,21 @@ export const joinReducer: Reducer<ChannelState> = (state, msg, ctx) => {
     }),
   );
 
+  // IRCv3 draft/chathistory auto-playback: a cap-enabled joiner with a
+  // bound MessageStore receives the recent backlog as a BATCH *before*
+  // the JOIN broadcast, then the per-(connection, channel) "last read"
+  // marker advances to the newest replayed msgid. PART/re-JOIN cycles
+  // only replay messages newer than the marker, so a re-join with no
+  // new activity emits nothing.
+  const playback = buildChathistoryPlayback(state, ctx);
+  if (playback.marker !== undefined) {
+    if (ctx.connection.lastReadMarkers === undefined) {
+      ctx.connection.lastReadMarkers = new Map<string, string>();
+    }
+    ctx.connection.lastReadMarkers.set(state.nameLower, playback.marker);
+  }
+  effects.push(...playback.effects);
+
   const legacyJoin: RawLine = { text: `:${hostmask} JOIN ${state.name}` };
   const realname = ctx.connection.realname;
   if (realname !== undefined) {

package/packages/irc-core/src/commands/privmsg.ts

@@ -173,6 +173,30 @@ function buildChannelReducer(command: MessageCommand): Reducer<ChannelState> {
       }
     }
 
+    // All checks passed: persist the message for chathistory playback when a
+    // MessageStore is bound. The msgid/time are generated once here and travel
+    // on the StoredMessage; the live broadcast line stays bare (per-recipient
+    // server-time/msgid decoration is the dispatch layer's job). Recording is
+    // gated on ctx.messages so deployments with chathistory disabled see no
+    // change whatsoever.
+    //
+    // By this point the sender's hostmask has already been computed and used
+    // in the `+b` ban check above, so the connection's nick/user/host are all
+    // defined for any registered PRIVMSG (registration sets all three); the
+    // fallbacks mirror `senderHostmask` purely for the type-checker.
+    if (ctx.messages !== undefined) {
+      ctx.messages.record({
+        msgid: ctx.ids.nonce(),
+        time: ctx.clock.now(),
+        chan: state.nameLower,
+        command,
+        nick: ctx.connection.nick as string,
+        user: ctx.connection.user as string,
+        host: ctx.connection.host as string,
+        text,
+      });
+    }
+
     // All checks passed: broadcast to the channel, excluding the sender.
     const line: RawLine = { text: `:${hostmask} ${command} ${state.name} :${text}` };
     effects.push(Effect.broadcast(state.name, [line], ctx.connId));

package/packages/irc-core/src/commands/registration.ts

@@ -13,6 +13,7 @@
  * numeric on `{ ok: false }`.
  */
 
+import { cloakHost } from '../cloak.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import { Numerics } from '../protocol/numerics.js';
@@ -25,7 +26,7 @@ import { generateIsupport } from './isupport.js';
  * Server version reported in `002` / `004`. Placeholder until a config-driven
  * version lands.
  */
-const SERVER_VERSION = '0.1.0';
+const SERVER_VERSION = '0.2.0';
 
 /** "Created" text for `003 RPL_CREATED`. Placeholder. */
 const CREATED_TEXT = 'Phase 1';
@@ -88,21 +89,79 @@ export function buildWelcomeLines(state: ConnectionState, ctx: Ctx): RawLine[] {
 }
 
 /**
- * Attempts to finalize registration: if both `nick` and `user` are present
- * and the connection is not yet registered, transitions `state.registration`
- * to `'registered'` and returns a `Send` effect carrying the welcome block.
- * Otherwise returns `null` and leaves state untouched.
+ * Attempts to finalize registration: if both `nick` and `user` are present,
+ * the connection is not yet registered, and CAP negotiation is not in
+ * flight, transitions `state.registration` to `'registered'` and returns
+ * a `Send` effect carrying the welcome block.
+ *
+ * Side effects are returned as an array so the caller can `push(...)` them
+ * onto its own effect list. An empty array means "not ready / no work".
+ *
+ * Enforces the deployment's server-password gate (configured via
+ * `serverConfig.serverPassword`) before completing registration:
+ *   - No password configured (undefined or empty) → gate skipped.
+ *   - SASL already authenticated (`state.account` set) → gate satisfied.
+ *   - Otherwise `state.passAttempt` must equal the configured password.
+ *
+ * On gate failure the connection is NOT registered; the returned effects
+ * are `[Send(464 ERR_PASSWDMISMATCH), Disconnect("Bad Password")]` per
+ * RFC 2812 §5.1 (numerics 464 + the canonical close reason used by
+ * mainstream IRC daemons).
  *
  * Reused by the CAP `END` handler.
  */
-export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType | null {
-  if (state.registration === 'registered') return null;
-  if (state.nick === undefined || state.user === undefined) return null;
-  if (state.capNegotiating) return null;
+export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType[] {
+  if (state.registration === 'registered') return [];
+  if (state.nick === undefined || state.user === undefined) return [];
+  if (state.capNegotiating) return [];
+
+  const gateFailure = passwordGateFailure(state, ctx);
+  if (gateFailure !== null) return gateFailure;
+
+  // Apply hostmask cloaking (if enabled) before emitting the welcome block
+  // so the `001` hostmask and every downstream message uses the cloak.
+  applyCloakIfEnabled(state, ctx);
+
   state.registration = 'registered';
-  return Effect.send(ctx.connId, buildWelcomeLines(state, ctx));
+  return [Effect.send(ctx.connId, buildWelcomeLines(state, ctx))];
+}
+
+/**
+ * Replaces `state.host` with a deterministic cloak derived from the
+ * deployment's cloaking secret + the current (real) host. No-op when
+ * cloaking is disabled or no host is set yet (e.g. transport didn't supply
+ * one, or the connection sets it later via CHGHOST).
+ */
+function applyCloakIfEnabled(state: ConnectionState, ctx: Ctx): void {
+  const cloaking = ctx.serverConfig.cloaking;
+  if (cloaking === undefined || !cloaking.enabled) return;
+  if (state.host === undefined) return;
+  state.host = cloakHost(state.host, cloaking, ctx.networkName);
 }
 
+/**
+ * Returns the password-gate failure effects (`[Send 464, Disconnect]`) when
+ * the connection has not satisfied the deployment's server-password, or
+ * `null` when the gate is satisfied / disabled.
+ *
+ * Pulling this out as a named helper keeps {@link emitWelcomeIfReady}
+ * readable and gives tests a direct handle on the gate logic.
+ */
+function passwordGateFailure(state: ConnectionState, ctx: Ctx): EffectType[] | null {
+  const configured = ctx.serverConfig.serverPassword;
+  if (configured === undefined || configured === '') return null;
+  // SASL success satisfies the password gate.
+  if (state.account !== undefined) return null;
+  if (state.passAttempt === configured) return null;
+  return [
+    Effect.send(ctx.connId, [numericErr(ctx, Numerics.ERR_PASSWDMISMATCH, 'Password mismatch')]),
+    Effect.disconnect(ctx.connId, PASSWORD_MISMATCH_REASON),
+  ];
+}
+
+/** Canonical disconnect reason paired with the 464 numeric. */
+const PASSWORD_MISMATCH_REASON = 'Bad Password';
+
 /**
  * Formats a single numeric error line addressed to the connection's current
  * nick (or `*` when unregistered). Optional `middle` param is emitted before
@@ -166,8 +225,7 @@ export const nickReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
   }
   effects.push(Effect.reserveNick(nick, ctx.connId));
 
-  const welcome = emitWelcomeIfReady(state, ctx);
-  if (welcome !== null) effects.push(welcome);
+  effects.push(...emitWelcomeIfReady(state, ctx));
 
   return { state, effects };
 };
@@ -209,8 +267,7 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
     state.registration = 'registering';
   }
 
-  const welcome = emitWelcomeIfReady(state, ctx);
-  if (welcome !== null) effects.push(welcome);
+  effects.push(...emitWelcomeIfReady(state, ctx));
 
   return { state, effects };
 };

package/packages/irc-core/src/commands/sasl.ts

@@ -0,0 +1,251 @@
+/**
+ * Pure reducer for the IRCv3 `AUTHENTICATE` command (SASL).
+ *
+ * PLAN §2.1 location-of-authority: SASL runs in the Connection entity.
+ * The reducer drives the multi-frame SASL exchange purely:
+ *
+ *   1. `AUTHENTICATE <MECH>` — selects a mechanism. `PLAIN` is supported and
+ *      answers with `AUTHENTICATE +` (requesting the payload). `EXTERNAL` is
+ *      recognized but stubbed to `904` until mTLS lands. Anything else gets
+ *      `908 ERR_SASLMECHS` listing what is available.
+ *   2. `AUTHENTICATE <b64>` / `AUTHENTICATE +` — delivers the payload (whole
+ *      or in `<=400`-byte chunks; `+` marks an empty/final chunk). The
+ *      decoded bytes are handed to the injected {@link AccountStore}; on
+ *      success the connection records the account name and the reducer emits
+ *      `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure `904 ERR_SASLFAIL`.
+ *   3. `AUTHENTICATE *` — client abort → `906 ERR_SASLABORT`.
+ *
+ * The `AccountStore` port is **synchronous** (see {@link AccountStore} docs):
+ * adapters pre-load credentials so the reducer stays pure. Async backends
+ * resolve their lookups before the actor invokes this reducer.
+ *
+ * State: {@link ConnectionState.saslMech} tracks the mechanism in flight;
+ * {@link ConnectionState.saslBuffer} accumulates chunked payloads. Both are
+ * cleared on every terminal outcome.
+ */
+
+import { Effect } from '../effects.js';
+import type { Effect as EffectType, RawLine } from '../effects.js';
+import { decodeBase64 } from '../protocol/base64.js';
+import { Numerics } from '../protocol/numerics.js';
+import { hostmaskOf } from '../state/connection.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx, Reducer } from '../types.js';
+
+/** Per-ircdocs.horse: a single `AUTHENTICATE` payload chunk is at most 400 bytes. */
+const SASL_CHUNK_BYTES = 400;
+
+/** Total decoded-payload cap before `905 ERR_SASLTOOLONG`. */
+const SASL_MAX_BYTES = 8192;
+
+/** Mechanisms this server will accept today (advertised verbatim by the cap). */
+const SUPPORTED_MECHS = 'PLAIN,EXTERNAL';
+
+/**
+ * Reducer for `AUTHENTICATE [<param>]`. See module docs for the state
+ * machine. Authority: the invoking connection's {@link ConnectionState}.
+ */
+export const authenticateReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  const param = msg.params[0];
+  if (param === undefined) {
+    return { state, effects: [Effect.send(ctx.connId, [needMoreParams(ctx)])] };
+  }
+
+  if (state.registration === 'registered' || !state.capNegotiating || state.account !== undefined) {
+    return { state, effects: [Effect.send(ctx.connId, [saslAlready(ctx)])] };
+  }
+
+  if (param === '*') {
+    return handleAbort(state, ctx);
+  }
+
+  if (state.saslMech === undefined) {
+    return handleMechanism(state, param, ctx);
+  }
+
+  return handlePayload(state, param, ctx);
+};
+
+/** `AUTHENTICATE *` — client-initiated abort. */
+function handleAbort(
+  state: ConnectionState,
+  ctx: Ctx,
+): { state: ConnectionState; effects: EffectType[] } {
+  if (state.saslMech === undefined) {
+    return { state, effects: [] };
+  }
+  clearSasl(state);
+  return { state, effects: [Effect.send(ctx.connId, [saslAbort(ctx)])] };
+}
+
+/** `AUTHENTICATE <MECH>` — first frame of an exchange. */
+function handleMechanism(
+  state: ConnectionState,
+  param: string,
+  ctx: Ctx,
+): { state: ConnectionState; effects: EffectType[] } {
+  const mech = param.toUpperCase();
+  if (mech === 'PLAIN') {
+    state.saslMech = 'PLAIN';
+    state.saslBuffer = '';
+    return { state, effects: [Effect.send(ctx.connId, [L('AUTHENTICATE +')])] };
+  }
+  if (mech === 'EXTERNAL') {
+    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+  }
+  return { state, effects: [Effect.send(ctx.connId, [saslMechs(ctx)])] };
+}
+
+/** `AUTHENTICATE <chunk>` / `AUTHENTICATE +` — payload delivery. */
+function handlePayload(
+  state: ConnectionState,
+  param: string,
+  ctx: Ctx,
+): { state: ConnectionState; effects: EffectType[] } {
+  const mech = state.saslMech as string;
+  const buffer = state.saslBuffer as string;
+
+  if (param === '+') {
+    return finalize(state, buffer, mech, ctx);
+  }
+
+  const next = buffer + param;
+  if (next.length > SASL_MAX_BYTES) {
+    clearSasl(state);
+    return { state, effects: [Effect.send(ctx.connId, [saslTooLong(ctx)])] };
+  }
+
+  if (param.length === SASL_CHUNK_BYTES) {
+    state.saslBuffer = next;
+    return { state, effects: [] };
+  }
+
+  return finalize(state, next, mech, ctx);
+}
+
+/** Decodes the accumulated payload and runs it through the AccountStore. */
+function finalize(
+  state: ConnectionState,
+  payloadB64: string,
+  mech: string,
+  ctx: Ctx,
+): { state: ConnectionState; effects: EffectType[] } {
+  const parsed = parsePlain(payloadB64);
+
+  if (parsed === null) {
+    clearSasl(state);
+    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+  }
+
+  const store = ctx.accounts;
+  if (store === undefined) {
+    clearSasl(state);
+    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+  }
+
+  const result = store.verify(mech, {
+    kind: 'PLAIN',
+    username: parsed.username,
+    password: parsed.password,
+  });
+
+  clearSasl(state);
+
+  if (result.ok) {
+    state.account = result.account;
+    return {
+      state,
+      effects: [Effect.send(ctx.connId, [loggedIn(ctx, result.account), saslSuccess(ctx)])],
+    };
+  }
+  return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+}
+
+/**
+ * Decodes a base64 PLAIN payload (`authzid\0authcid\0passwd`) and returns the
+ * authcid/password pair. Returns `null` on any decode or shape failure.
+ */
+function parsePlain(payloadB64: string): { username: string; password: string } | null {
+  let decoded: string;
+  try {
+    decoded = decodeBase64(payloadB64);
+  } catch {
+    return null;
+  }
+  const parts = decoded.split('\0');
+  if (parts.length !== 3) return null;
+  const [, username, password] = parts as [string, string, string];
+  return { username, password };
+}
+
+/** Clears every SASL-related scratch field on the connection. */
+function clearSasl(state: ConnectionState): void {
+  // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+  delete state.saslMech;
+  // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+  delete state.saslBuffer;
+}
+
+function loggedIn(ctx: Ctx, account: string): RawLine {
+  const nick = nickOf(ctx);
+  const hostmask = hostmaskOf(ctx.connection) ?? nick;
+  return L(
+    `:${ctx.serverName} ${code(Numerics.RPL_LOGGEDIN)} ${nick} ${hostmask} ${account} :You are now logged in as ${account}`,
+  );
+}
+
+function saslSuccess(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.RPL_SASLSUCCESS)} ${nickOf(ctx)} :SASL authentication successful`,
+  );
+}
+
+function saslFail(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.ERR_SASLFAIL)} ${nickOf(ctx)} :SASL authentication failed`,
+  );
+}
+
+function saslTooLong(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.ERR_SASLTOOLONG)} ${nickOf(ctx)} :SASL message too long`,
+  );
+}
+
+function saslAbort(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.ERR_SASLABORT)} ${nickOf(ctx)} :SASL authentication aborted`,
+  );
+}
+
+function saslAlready(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.ERR_SASLALREADY)} ${nickOf(ctx)} :You have already authenticated using SASL`,
+  );
+}
+
+function saslMechs(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.ERR_SASLMECHS)} ${nickOf(ctx)} ${SUPPORTED_MECHS} :are the available SASL mechanisms`,
+  );
+}
+
+function needMoreParams(ctx: Ctx): RawLine {
+  return L(
+    `:${ctx.serverName} ${code(Numerics.ERR_NEEDMOREPARAMS)} ${nickOf(ctx)} AUTHENTICATE :Not enough parameters`,
+  );
+}
+
+function nickOf(ctx: Ctx): string {
+  return ctx.connection.nick ?? '*';
+}
+
+function code(n: number): string {
+  return n.toString().padStart(3, '0');
+}
+
+function L(text: string): RawLine {
+  return { text };
+}