serverless-ircd 0.1.0 → 0.2.0

package/packages/irc-core/tests/commands/sasl.test.ts

@@ -0,0 +1,536 @@
+import { describe, expect, it } from 'vitest';
+import { getLsString } from '../../src/caps/capabilities';
+import { capReducer } from '../../src/commands/cap';
+import { authenticateReducer } from '../../src/commands/sasl';
+import { Effect } from '../../src/effects';
+import type { Effect as EffectType, RawLine } from '../../src/effects';
+import type { AccountStore, SaslPayload, SaslResult } from '../../src/ports';
+import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import { encodeBase64 } from '../../src/protocol/base64';
+import type { IrcMessage } from '../../src/protocol/messages';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const serverConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+const L = (text: string): RawLine => ({ text });
+
+const SV = 'irc.example.com';
+
+/** Standard SASL-over-CAP negotiation state: cap requested, nick set. */
+function saslReadyState(): ConnectionState {
+  const s = createConnection({ id: 'c1', connectedSince: 0 });
+  s.nick = 'alice';
+  s.user = 'alice';
+  s.host = 'example.com';
+  s.realname = 'Alice';
+  s.registration = 'registering';
+  s.capNegotiating = true;
+  s.caps.add('sasl');
+  return s;
+}
+
+function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock: new FakeClock(1_000),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    ...(accounts !== undefined ? { accounts } : {}),
+  });
+}
+
+/** A capture-and-respond fake AccountStore. */
+class FakeAccountStore implements AccountStore {
+  readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
+  constructor(private readonly result: SaslResult) {}
+  verify(mech: string, payload: SaslPayload): SaslResult {
+    this.calls.push({ mech, payload });
+    return this.result;
+  }
+}
+
+/** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
+function plainPayload(authcid: string, password: string, authzid = ''): string {
+  return encodeBase64(`${authzid}\0${authcid}\0${password}`);
+}
+
+function authenticate(param: string): IrcMessage {
+  return { command: 'AUTHENTICATE', params: [param], tags: {} };
+}
+
+function sendLinesOf(effect: EffectType | undefined): RawLine[] {
+  if (effect === undefined) return [];
+  if (effect.tag !== 'Send') return [];
+  return effect.lines;
+}
+
+/** Returns the text of the first line emitted by `effect`, or `''`. */
+function firstLineText(effect: EffectType | undefined): string {
+  return sendLinesOf(effect)[0]?.text ?? '';
+}
+
+// ============================================================================
+// AUTHENTICATE PLAIN — happy path
+// ============================================================================
+
+describe('authenticateReducer — PLAIN success', () => {
+  it('requests the payload with `AUTHENTICATE +` when PLAIN is selected', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('PLAIN'), ctx);
+    expect(out.effects).toEqual<EffectType[]>([Effect.send('c1', [L('AUTHENTICATE +')])]);
+  });
+
+  it('records the selected mechanism on the connection', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    expect(state.saslMech).toBe('PLAIN');
+  });
+
+  it('completes with 900 and 903 when the AccountStore accepts the credentials', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    const lines = sendLinesOf(out.effects[0]);
+    expect(lines).toEqual<RawLine[]>([
+      L(`:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`),
+      L(`:${SV} 903 alice :SASL authentication successful`),
+    ]);
+  });
+
+  it('records the authenticated account name on the connection', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(state.account).toBe('alice');
+  });
+
+  it('clears the in-progress mechanism after a successful authentication', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(state.saslMech).toBeUndefined();
+  });
+
+  it('forwards parsed PLAIN credentials to the AccountStore', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(accounts.calls).toEqual([
+      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'secret' } },
+    ]);
+  });
+
+  it('ignores the authorization identity field in the PLAIN payload', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret', 'bob')), ctx);
+
+    expect(accounts.calls[0]?.payload).toEqual({
+      kind: 'PLAIN',
+      username: 'alice',
+      password: 'secret',
+    });
+  });
+
+  it('targets `*` with an empty hostmask when the client has no nick yet', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.capNegotiating = true;
+    state.caps.add('sasl');
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 900 * * alice :You are now logged in as alice`),
+      L(`:${SV} 903 * :SASL authentication successful`),
+    ]);
+    expect(state.account).toBe('alice');
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE PLAIN — wrong password
+// ============================================================================
+
+describe('authenticateReducer — PLAIN failure', () => {
+  it('emits 904 ERR_SASLFAIL when the AccountStore rejects the credentials', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+  });
+
+  it('does not record an account on failure', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
+
+    expect(state.account).toBeUndefined();
+  });
+
+  it('clears the in-progress mechanism after a failure', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
+
+    expect(state.saslMech).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE PLAIN — no AccountStore wired
+// ============================================================================
+
+describe('authenticateReducer — no AccountStore configured', () => {
+  it('emits 904 when the PLAIN payload arrives but no AccountStore is wired', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE EXTERNAL — stubbed
+// ============================================================================
+
+describe('authenticateReducer — EXTERNAL stubbed', () => {
+  it('rejects EXTERNAL immediately with 904 (not yet supported)', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+  });
+
+  it('does not enter the payload phase for EXTERNAL', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    expect(state.saslMech).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE <unknown mechanism>
+// ============================================================================
+
+describe('authenticateReducer — unknown mechanism', () => {
+  it('emits 908 ERR_SASLMECHS listing the available mechanisms', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 908 alice PLAIN,EXTERNAL :are the available SASL mechanisms`),
+    ]);
+  });
+
+  it('does not enter the payload phase for an unknown mechanism', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
+    expect(state.saslMech).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE abort path (907)
+// ============================================================================
+
+describe('authenticateReducer — abort / already-authenticated', () => {
+  it('emits 907 ERR_SASLALREADY when sent after CAP END', () => {
+    const state = saslReadyState();
+    state.capNegotiating = false;
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('PLAIN'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 907 alice :You have already authenticated using SASL`),
+    ]);
+  });
+
+  it('emits 907 when sent after a successful SASL authentication', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+    expect(state.account).toBe('alice');
+
+    const out = authenticateReducer(state, authenticate('PLAIN'), ctx);
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 907 alice :You have already authenticated using SASL`),
+    ]);
+  });
+
+  it('emits 907 when no CAP negotiation is in progress', () => {
+    const state = saslReadyState();
+    state.capNegotiating = false;
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('PLAIN'), ctx);
+    expect(firstLineText(out.effects[0])).toContain(' 907 ');
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE * — client abort (906)
+// ============================================================================
+
+describe('authenticateReducer — client abort', () => {
+  it('emits 906 ERR_SASLABORT when the client sends AUTHENTICATE *', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate('*'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 906 alice :SASL authentication aborted`),
+    ]);
+  });
+
+  it('clears the in-progress mechanism on client abort', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate('*'), ctx);
+    expect(state.saslMech).toBeUndefined();
+  });
+
+  it('ignores AUTHENTICATE * when no SASL exchange is in progress', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('*'), ctx);
+    expect(out.effects).toEqual([]);
+    expect(state.saslMech).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE + — empty payload marker
+// ============================================================================
+
+describe('authenticateReducer — empty payload (`+`)', () => {
+  it('treats `AUTHENTICATE +` as the final (empty) chunk and rejects malformed PLAIN', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'empty' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(accounts.calls).toEqual([]);
+    expect(firstLineText(out.effects[0])).toContain(' 904 ');
+    expect(state.saslMech).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE — multi-line (chunked) payload
+// ============================================================================
+
+describe('authenticateReducer — chunked payload', () => {
+  it('buffers chunks of exactly 400 bytes and verifies on the short final chunk', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    const longPassword = 'p'.repeat(320);
+    const payload = plainPayload('alice', longPassword);
+    expect(payload.length).toBeGreaterThan(400);
+
+    const first = payload.slice(0, 400);
+    const rest = payload.slice(400);
+    expect(rest.length).toBeGreaterThan(0);
+    expect(rest.length).toBeLessThan(400);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const buffered = authenticateReducer(state, authenticate(first), ctx);
+    expect(buffered.effects).toEqual([]);
+    expect(state.saslMech).toBe('PLAIN');
+    expect(accounts.calls).toEqual([]);
+
+    authenticateReducer(state, authenticate(rest), ctx);
+    expect(accounts.calls).toEqual([
+      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: longPassword } },
+    ]);
+    expect(state.account).toBe('alice');
+  });
+
+  it('rejects an oversized payload with 905 ERR_SASLTOOLONG', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(`${'A'.repeat(8193)}`), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 905 alice :SASL message too long`),
+    ]);
+    expect(state.saslMech).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE — malformed PLAIN payload
+// ============================================================================
+
+describe('authenticateReducer — malformed PLAIN', () => {
+  it('emits 904 when the base64 payload does not decode to three NUL-separated fields', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(encodeBase64('onlyonefield')), ctx);
+
+    expect(firstLineText(out.effects[0])).toContain(' 904 ');
+    expect(accounts.calls).toEqual([]);
+  });
+
+  it('emits 904 when the payload is not valid base64', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate('!!!notbase64!!!'), ctx);
+
+    expect(firstLineText(out.effects[0])).toContain(' 904 ');
+    expect(accounts.calls).toEqual([]);
+  });
+
+  it('emits 908 when the first AUTHENTICATE frame is not a recognized mechanism', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(firstLineText(out.effects[0])).toContain(' 908 ');
+    expect(accounts.calls).toEqual([]);
+  });
+});
+
+// ============================================================================
+// AUTHENTICATE — casing & missing parameters
+// ============================================================================
+
+describe('authenticateReducer — casing and params', () => {
+  it('accepts a lowercase mechanism name', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('plain'), ctx);
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([L('AUTHENTICATE +')]);
+    expect(state.saslMech).toBe('PLAIN');
+  });
+
+  it('emits 461 when AUTHENTICATE is sent with no parameter', () => {
+    const state = saslReadyState();
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, { command: 'AUTHENTICATE', params: [], tags: {} }, ctx);
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 461 alice AUTHENTICATE :Not enough parameters`),
+    ]);
+  });
+
+  it('targets `*` before the client has a nick', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.capNegotiating = true;
+    state.caps.add('sasl');
+    const ctx = makeCtx(state);
+    const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
+    expect(firstLineText(out.effects[0])).toContain(' 908 * ');
+  });
+});
+
+// ============================================================================
+// CAP REQ sasl → AUTHENTICATE integration (acceptance criterion)
+// ============================================================================
+
+describe('authenticateReducer — CAP REQ sasl integration', () => {
+  it('completes the full CAP REQ sasl → AUTHENTICATE PLAIN flow', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.host = 'example.com';
+    state.registration = 'registering';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    capReducer(state, { command: 'CAP', params: ['REQ', 'sasl'], tags: {} }, ctx);
+    expect(state.caps.has('sasl')).toBe(true);
+
+    const mechOut = authenticateReducer(state, authenticate('PLAIN'), ctx);
+    expect(sendLinesOf(mechOut.effects[0])).toEqual<RawLine[]>([L('AUTHENTICATE +')]);
+
+    const finalOut = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+    const lines = sendLinesOf(finalOut.effects[0]);
+    expect(lines.map((l) => l.text)).toEqual([
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+      `:${SV} 903 alice :SASL authentication successful`,
+    ]);
+    expect(state.account).toBe('alice');
+  });
+
+  it('does not affect the advertised sasl cap value (PLAIN,EXTERNAL)', () => {
+    const advertised = getLsString();
+    expect(advertised).toContain('sasl=PLAIN,EXTERNAL');
+  });
+});