serverless-ircd 0.10.0 → 0.11.0

package/packages/cf-adapter/tests/counter-do.test.ts

@@ -0,0 +1,181 @@
+/**
+ * `CounterDO` — global live-connection admission counter.
+ *
+ * TDD outline:
+ *   "Red on admit-under-cap / reject-at-cap; green; then TTL reap,
+ *    heartbeat refresh, and the lazy reconcile on admit."
+ *
+ * Tests address the single global counter instance directly over RPC,
+ * driving every branch of admit / release / heartbeat / sweep with
+ * explicit timestamps so the TTL boundary is deterministic (no wall
+ * clock dependence). Each test gets an isolated storage namespace, so
+ * the shared `global` instance never bleeds state across tests.
+ */
+
+import { env, reset } from 'cloudflare:test';
+import { afterEach, describe, expect, it } from 'vitest';
+import { COUNTER_INSTANCE_NAME, DEFAULT_CONNECTION_TTL_MS } from '../src/counter-do';
+import type { CounterRpc } from '../src/env';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      COUNTER_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+// DO storage persists across tests in the same file; reset between each so
+// admission entries from one test never leak into the next. Every test
+// addresses the same `global` counter instance, so this is essential.
+afterEach(async () => {
+  await reset();
+});
+
+/** Fixed epoch base for deterministic TTL arithmetic. */
+const T0 = 1_700_000_000_000;
+/** Alias for readability in the TTL-boundary tests. */
+const TTL = DEFAULT_CONNECTION_TTL_MS;
+
+/** RPC handle on the single global counter instance. */
+function counter(): CounterRpc {
+  const stub = env.COUNTER_DO.get(env.COUNTER_DO.idFromName(COUNTER_INSTANCE_NAME));
+  return stub as unknown as CounterRpc;
+}
+
+// ---------------------------------------------------------------------------
+// admit
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — admit', () => {
+  it('admits when under the cap and reports the live count', async () => {
+    const c = counter();
+    expect(await c.admit('conn-a', 2, T0)).toEqual({ admitted: true, live: 1 });
+  });
+
+  it('admits a second connection while still under the cap', async () => {
+    const c = counter();
+    await c.admit('conn-b1', 2, T0);
+    expect(await c.admit('conn-b2', 2, T0)).toEqual({ admitted: true, live: 2 });
+  });
+
+  it('rejects once the cap is reached', async () => {
+    const c = counter();
+    await c.admit('conn-c1', 1, T0);
+    expect(await c.admit('conn-c2', 1, T0)).toEqual({ admitted: false, live: 1 });
+  });
+
+  it('a rejected admission registers no entry', async () => {
+    const c = counter();
+    await c.admit('conn-d1', 1, T0);
+    await c.admit('conn-d2', 1, T0);
+    expect(await c.liveCount()).toBe(1);
+  });
+
+  it('re-admits after the capped connection is released', async () => {
+    const c = counter();
+    await c.admit('conn-e1', 1, T0);
+    await c.release('conn-e1');
+    expect(await c.admit('conn-e2', 1, T0)).toEqual({ admitted: true, live: 1 });
+  });
+
+  it('exactly one of two concurrent admissions wins at cap 1', async () => {
+    // Two worker-edge fetches race on the single counter instance. The
+    // DO's serialized event loop linearises the admits; exactly one
+    // reservation survives. Mirrors the RegistryDO concurrency suite.
+    const c = counter();
+    const [r1, r2] = await Promise.all([c.admit('race-1', 1, T0), c.admit('race-2', 1, T0)]);
+    const results = [r1, r2];
+    expect(results.filter((r) => r.admitted).length).toBe(1);
+    expect(results.filter((r) => !r.admitted).length).toBe(1);
+    expect(await c.liveCount()).toBe(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// release
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — release', () => {
+  it('removes the entry so the slot frees', async () => {
+    const c = counter();
+    await c.admit('rel-a', 5, T0);
+    await c.release('rel-a');
+    expect(await c.liveCount()).toBe(0);
+  });
+
+  it('is idempotent for an unknown connection id', async () => {
+    const c = counter();
+    await c.release('never-registered');
+    expect(await c.liveCount()).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// TTL reap — housekeeping for DO instances that crashed without a close
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — TTL reap (housekeeping)', () => {
+  it('sweep reaps entries older than the TTL and keeps fresh ones', async () => {
+    const c = counter();
+    await c.admit('stale', 5, T0);
+    await c.admit('fresh', 5, T0 + 60_000);
+    const result = await c.sweep(T0 + TTL + 60_000);
+    expect(result.reaped).toBe(1);
+    expect(result.live).toBe(1);
+    expect(await c.liveCount()).toBe(1);
+  });
+
+  it('an entry aged exactly the TTL is still live (only strictly-older reaps)', async () => {
+    const c = counter();
+    await c.admit('boundary', 5, T0);
+    expect(await c.sweep(T0 + TTL)).toEqual({ reaped: 0, live: 1 });
+  });
+
+  it('admit lazily reaps stale entries first (a crashed DO frees its slot)', async () => {
+    // The production failure mode: a ConnectionDO isolate is dropped
+    // without ever delivering a close event, so `release` never fires and
+    // the entry goes stale. The next admission must sweep it out instead
+    // of rejecting the newcomer.
+    const c = counter();
+    await c.admit('crashed', 1, T0);
+    expect(await c.admit('newcomer', 1, T0 + TTL + 1)).toEqual({ admitted: true, live: 1 });
+    expect(await c.liveCount()).toBe(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// heartbeat — keeps live connections safe from the TTL reap
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — heartbeat', () => {
+  it('refreshes the entry so a live connection survives the TTL reap', async () => {
+    const c = counter();
+    await c.admit('beat', 5, T0);
+    // The ConnectionDO's PING alarm refreshes the entry well inside the
+    // TTL window; by T0+TTL+60s the lastSeen has moved past the original
+    // admission stamp, so the sweep at T0+TTL+60s+1ms must keep it.
+    await c.heartbeat('beat', T0 + TTL + 60_000);
+    expect(await c.sweep(T0 + TTL + 60_001)).toEqual({ reaped: 0, live: 1 });
+  });
+
+  it('does not resurrect a released entry', async () => {
+    // A late heartbeat (e.g. racing the close handler) must not re-create
+    // a slot that was already released — that would overcount.
+    const c = counter();
+    await c.admit('gone', 5, T0);
+    await c.release('gone');
+    await c.heartbeat('gone', T0 + 1000);
+    expect(await c.liveCount()).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// liveCount
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — liveCount', () => {
+  it('reports zero for a fresh counter', async () => {
+    expect(await counter().liveCount()).toBe(0);
+  });
+});

package/packages/cf-adapter/tests/d1-services-store.test.ts

@@ -9,7 +9,11 @@
  */
 
 import { env } from 'cloudflare:test';
-import { FakeClock, type ServicesSnapshot } from '@serverless-ircd/irc-core';
+import {
+  FakeClock,
+  type ServicesSnapshot,
+  certIdentityFromSubject,
+} from '@serverless-ircd/irc-core';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import {
   CREATE_SERVICES_TABLES_SQL,
@@ -163,6 +167,119 @@ describe('D1ServicesStore — schema migration (password → algorithm/salt/hash
   });
 });
 
+describe('D1ServicesStore — schema migration (cert_subjects era → identify-throttle columns)', () => {
+  /** Pre-throttle schema: every current column except the two new ones. */
+  const CERT_ERA_NICKSERV_DDL =
+    "CREATE TABLE nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, cert_subjects TEXT NOT NULL DEFAULT '[]', algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)";
+
+  afterEach(async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+  });
+
+  it('adds the identify-throttle columns on load and keeps existing rows (defaults)', async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec(CERT_ERA_NICKSERV_DDL);
+    await env.ACCOUNTS_DB.prepare(
+      'INSERT INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+    )
+      .bind('alice', 'alice', 'alice', 'a@x', 1, 'none', '[]', 'scrypt', 'c2FsdA==', 'aGFzaA==')
+      .run();
+
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    expect(store).toBeDefined();
+
+    // The additive columns now exist.
+    const info = await env.ACCOUNTS_DB.prepare('PRAGMA table_info(nickserv_accounts)').all<{
+      name: string;
+    }>();
+    const cols = info.results.map((r) => r.name);
+    expect(cols).toContain('identify_failures');
+    expect(cols).toContain('pending_identify_notice');
+
+    // The pre-existing row survived and loads with empty throttle defaults.
+    expect(store?.isRegisteredNick('alice')).toBe(true);
+    expect(store?.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(store?.clearIdentifyFailures('alice')).toBe(0);
+  });
+
+  it('is idempotent — a second load does not re-add the columns or drop rows', async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec(CERT_ERA_NICKSERV_DDL);
+    const first = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    first?.registerNick('carol', 'pw', 'c@x');
+    await first?.flush();
+
+    const second = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW + 1));
+    expect(second?.isRegisteredNick('carol')).toBe(true);
+  });
+
+  it('adds the cert_subjects column too when migrating from the algorithm era', async () => {
+    // Schema after the credential unification but before cert_subjects:
+    // exercises the cert_subjects ALTER arm on its own.
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec(
+      'CREATE TABLE nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)',
+    );
+
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    const info = await env.ACCOUNTS_DB.prepare('PRAGMA table_info(nickserv_accounts)').all<{
+      name: string;
+    }>();
+    const cols = info.results.map((r) => r.name);
+    expect(cols).toContain('cert_subjects');
+    expect(cols).toContain('identify_failures');
+    expect(cols).toContain('pending_identify_notice');
+    expect(store).toBeDefined();
+  });
+
+  it('loads rows with malformed JSON columns as empty arrays (defensive)', async () => {
+    await resetDb();
+    const insert = async (
+      nick: string,
+      certSubjects: string,
+      identifyFailures: string,
+    ): Promise<void> => {
+      await env.ACCOUNTS_DB.prepare(
+        'INSERT INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, identify_failures, pending_identify_notice, algorithm, salt, hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+      )
+        .bind(
+          nick,
+          nick,
+          nick,
+          'x@x',
+          1,
+          'none',
+          certSubjects,
+          identifyFailures,
+          0,
+          'scrypt',
+          'c2FsdA==',
+          'aGFzaA==',
+        )
+        .run();
+    };
+    // Every degenerate column shape: malformed JSON, empty string,
+    // non-array JSON, and arrays with ill-typed entries.
+    await insert('a-malformed', 'not json', 'also not json');
+    await insert('b-empty', '', '');
+    await insert('c-nonarray', '{"a":1}', '{"a":1}');
+    await insert('d-illtyped', '["ok",7]', '[1,"x",2]');
+
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    for (const nick of ['a-malformed', 'b-empty', 'c-nonarray']) {
+      expect(store?.isRegisteredNick(nick)).toBe(true);
+      expect(store?.getNick(nick)?.certSubjects).toEqual([]);
+      expect(store?.isNickIdentifyFrozen(nick, { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    }
+    // Ill-typed entries are filtered; well-typed ones survive. The window
+    // reaches back to the epoch so the literal timestamps count.
+    expect(store?.getNick('d-illtyped')?.certSubjects).toEqual(['ok']);
+    expect(store?.isNickIdentifyFrozen('d-illtyped', { maxFailures: 2, windowMs: NOW + 1 })).toBe(
+      true,
+    );
+  });
+});
+
 describe('D1ServicesStore — NickServ round-trip across reload', () => {
   beforeEach(async () => {
     await resetDb();
@@ -207,6 +324,31 @@ describe('D1ServicesStore — NickServ round-trip across reload', () => {
     expect(reloaded?.verifyNick('alice', 'hunter2').ok).toBe(false);
   });
 
+  it('persists the identify-failure throttle and round-trips the freeze', async () => {
+    const clock = new FakeClock(NOW);
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, clock);
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    clock.advance(10);
+    store?.recordIdentifyFailure('alice');
+    clock.advance(10);
+    store?.recordIdentifyFailure('alice');
+    await store?.flush();
+
+    // Simulate a fresh connection (fresh store) after a deploy: the reload
+    // still sees the recorded failures and the queued owner-notice count.
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW + 20));
+    expect(reloaded?.isNickIdentifyFrozen('alice', { maxFailures: 2, windowMs: 300_000 })).toBe(
+      true,
+    );
+    expect(reloaded?.clearIdentifyFailures('alice')).toBe(2);
+
+    // The cleared state round-trips too.
+    await reloaded?.flush();
+    const after = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW + 20));
+    expect(after?.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(after?.clearIdentifyFailures('alice')).toBe(0);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
     store?.registerNick('alice', 'pw', 'a@x');
@@ -219,6 +361,55 @@ describe('D1ServicesStore — NickServ round-trip across reload', () => {
     const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
     expect(reloaded?.isRegisteredNick('alice')).toBe(false);
   });
+
+  it('round-trips a bound cert fingerprint and verifies EXTERNAL after reload', async () => {
+    // A cert binding attached before a deploy must still authenticate a
+    // SASL EXTERNAL client after the store rehydrates from D1 — the
+    // production path for certificate-backed login.
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.addCertFingerprint('alice', 'AA112233445566778899AABBCCDDEEFF');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // The fingerprint is normalised (lowercase, colon-free) on the round-trip.
+    expect(reloaded?.getNick('alice')?.certSubjects).toEqual([
+      'fp:aa112233445566778899aabbccddeeff',
+    ]);
+    expect(
+      reloaded?.verifyCertFP(
+        certIdentityFromSubject('CN=alice', 'aa112233445566778899aabbccddeeff'),
+      ),
+    ).toEqual({ ok: true, account: 'alice' });
+  });
+
+  it('round-trips a bound subject DN and verifies EXTERNAL via the canonical DN arm', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.addCertFP('alice', 'CN=alice,O=Example Inc');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // Platform-surfaced DN in a different RDN order still matches (canonical compare).
+    expect(reloaded?.verifyCertFP(certIdentityFromSubject('O=Example Inc,CN=alice'))).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('keeps EXTERNAL verify failing for an unbound cert after reload', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.addCertFingerprint('alice', 'aa112233445566778899aabbccddeeff');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    expect(
+      reloaded?.verifyCertFP(
+        certIdentityFromSubject('CN=alice', 'ffffffffffffffffffffffffffffffff'),
+      )?.ok,
+    ).toBe(false);
+  });
 });
 
 describe('D1ServicesStore — ChanServ round-trip across reload', () => {

package/packages/cf-adapter/tests/rate-limit-do.test.ts

@@ -0,0 +1,160 @@
+/**
+ * `RateLimitDO` — per-IP upgrade rate limiter.
+ *
+ * TDD outline:
+ *   "Red on allow-under-budget / reject-over-budget / window-decay;
+ *    green; then per-IP isolation and the concurrency linearisation."
+ *
+ * Tests address the single global limiter instance directly over RPC,
+ * driving every branch of `check` with explicit timestamps so the
+ * sliding-window boundary is deterministic (no wall clock dependence).
+ * Mirrors the CounterDO suite; each test gets isolated storage.
+ */
+
+import { env, reset } from 'cloudflare:test';
+import { afterEach, describe, expect, it } from 'vitest';
+import type { RateLimitRpc } from '../src/env';
+import { RATE_LIMIT_INSTANCE_NAME } from '../src/rate-limit-do';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      RATE_LIMIT_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+// DO storage persists across tests in the same file; reset between each so
+// rate entries from one test never leak into the next. Every test addresses
+// the same `global` limiter instance, so this is essential.
+afterEach(async () => {
+  await reset();
+});
+
+/** Fixed epoch base for deterministic window arithmetic. */
+const T0 = 1_700_000_000_000;
+/** Window used by every test (1 minute, the schema default order). */
+const WINDOW = 60_000;
+
+/** RPC handle on the single global limiter instance. */
+function limiter(): RateLimitRpc {
+  const stub = env.RATE_LIMIT_DO.get(env.RATE_LIMIT_DO.idFromName(RATE_LIMIT_INSTANCE_NAME));
+  return stub as unknown as RateLimitRpc;
+}
+
+// ---------------------------------------------------------------------------
+// check — allow / reject
+// ---------------------------------------------------------------------------
+
+describe('RateLimitDO — check', () => {
+  it('allows the first N upgrades from one IP and reports the count', async () => {
+    const rl = limiter();
+    expect(await rl.check('203.0.113.1', 2, WINDOW, T0)).toEqual({ allowed: true, count: 1 });
+    expect(await rl.check('203.0.113.1', 2, WINDOW, T0 + 1000)).toEqual({
+      allowed: true,
+      count: 2,
+    });
+  });
+
+  it('rejects the over-budget upgrade from the same IP', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.2', 1, WINDOW, T0);
+    expect(await rl.check('203.0.113.2', 1, WINDOW, T0 + 1000)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+  });
+
+  it('a rejected check does not append a timestamp (count stays at the cap)', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.3', 1, WINDOW, T0);
+    await rl.check('203.0.113.3', 1, WINDOW, T0 + 1000);
+    // Still rejected at the original count: the rejection itself must not
+    // consume budget (otherwise a blocked IP could never recover).
+    expect(await rl.check('203.0.113.3', 1, WINDOW, T0 + 2000)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+  });
+
+  it('keys budgets per IP (one saturated IP does not block another)', async () => {
+    const rl = limiter();
+    await rl.check('198.51.100.1', 1, WINDOW, T0);
+    expect(await rl.check('198.51.100.1', 1, WINDOW, T0 + 1000)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+    expect(await rl.check('198.51.100.2', 1, WINDOW, T0 + 1000)).toEqual({
+      allowed: true,
+      count: 1,
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// sliding window — decay after the window
+// ---------------------------------------------------------------------------
+
+describe('RateLimitDO — window reset', () => {
+  it('an entry aged past the window stops counting (budget recovers)', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.4', 1, WINDOW, T0);
+    // At T0 + WINDOW + 1 the T0 admission is strictly older than the
+    // cutoff (T0 + 1) → decayed out of the window.
+    expect(await rl.check('203.0.113.4', 1, WINDOW, T0 + WINDOW + 1)).toEqual({
+      allowed: true,
+      count: 1,
+    });
+  });
+
+  it('an entry exactly windowMs old still counts (boundary is inclusive)', async () => {
+    // Mirrors irc-core `recentAdmissions`: entries with t >= cutoff count,
+    // so an admission exactly one window old is still inside the window.
+    const rl = limiter();
+    await rl.check('203.0.113.5', 1, WINDOW, T0);
+    expect(await rl.check('203.0.113.5', 1, WINDOW, T0 + WINDOW)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+  });
+
+  it('prunes stale entries so a saturated IP recovers exactly one slot per decayed entry', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.6', 2, WINDOW, T0);
+    await rl.check('203.0.113.6', 2, WINDOW, T0 + 30_000);
+    // Cutoff at T0+45_000 is T0-15_000 → both entries still count.
+    expect(await rl.check('203.0.113.6', 2, WINDOW, T0 + 45_000)).toEqual({
+      allowed: false,
+      count: 2,
+    });
+    // At T0+WINDOW+1 the cutoff is T0+1: the T0 entry decayed, the
+    // T0+30_000 entry remains → one slot free → allowed (and this check
+    // itself consumes it).
+    expect(await rl.check('203.0.113.6', 2, WINDOW, T0 + WINDOW + 1)).toEqual({
+      allowed: true,
+      count: 2,
+    });
+    // Window members are now {T0+30_000, T0+WINDOW+1} → exhausted again.
+    expect(await rl.check('203.0.113.6', 2, WINDOW, T0 + WINDOW + 2)).toEqual({
+      allowed: false,
+      count: 2,
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// concurrency — the DO's serialized event loop linearises checks
+// ---------------------------------------------------------------------------
+
+describe('RateLimitDO — concurrency', () => {
+  it('exactly one of two concurrent checks wins at budget 1', async () => {
+    const rl = limiter();
+    const [r1, r2] = await Promise.all([
+      rl.check('203.0.113.7', 1, WINDOW, T0),
+      rl.check('203.0.113.7', 1, WINDOW, T0),
+    ]);
+    const results = [r1, r2];
+    expect(results.filter((r) => r.allowed).length).toBe(1);
+    expect(results.filter((r) => !r.allowed).length).toBe(1);
+  });
+});

package/packages/cf-adapter/tests/worker/main.ts

@@ -21,6 +21,8 @@
 import { ChannelDO } from '../../src/channel-do';
 import { ChannelRegistryDO } from '../../src/channel-registry-do';
 import { ConnectionDO } from '../../src/connection-do';
+import { CounterDO } from '../../src/counter-do';
+import { RateLimitDO } from '../../src/rate-limit-do';
 import { RegistryDO } from '../../src/registry-do';
 import { RecordingChannelDO } from './stubs/channel-stub';
 import { RecordingRegistryDO } from './stubs/registry-stub';
@@ -29,6 +31,8 @@ export {
   ChannelDO,
   ChannelRegistryDO,
   ConnectionDO,
+  CounterDO,
+  RateLimitDO,
   RegistryDO,
   RecordingRegistryDO,
   RecordingChannelDO,

package/packages/cf-adapter/wrangler.test.toml

@@ -49,6 +49,23 @@ class_name = "ChannelDO"
 name = "CHANNEL_REGISTRY_DO"
 class_name = "ChannelRegistryDO"
 
+# Global live-connection admission counter — single DO instance keyed by
+# the fixed name `global`. The worker edge reserves a slot per upgrade
+# (maxClients cap); ConnectionDO releases it on every teardown path and
+# heartbeats it from the PING alarm so the lazy TTL reap only evicts
+# entries from DOs that stopped heartbeating.
+[[durable_objects.bindings]]
+name = "COUNTER_DO"
+class_name = "CounterDO"
+
+# Per-IP upgrade rate limiter — single DO instance keyed by the fixed
+# name `global`, maintaining one sliding-window admission-timestamp list
+# per CF-Connecting-IP. The worker edge checks the budget before
+# forwarding an upgrade and rejects over-budget IPs with 429.
+[[durable_objects.bindings]]
+name = "RATE_LIMIT_DO"
+class_name = "RateLimitDO"
+
 # Recording stubs (kept under separate names for any test that wants to
 # assert "this exact RPC was emitted" rather than the end-to-end effect).
 [[durable_objects.bindings]]
@@ -71,4 +88,4 @@ class_name = "ChannelDO"
 
 [[migrations]]
 tag = "v1"
-new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO", "RecordingRegistryDO", "RecordingChannelDO"]
+new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO", "CounterDO", "RateLimitDO", "RecordingRegistryDO", "RecordingChannelDO"]

package/packages/in-memory-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/in-memory-runtime",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Single-process reference implementation of the IrcRuntime port, backed by Maps",
   "license": "BSD-3-Clause",

package/packages/in-memory-runtime/src/in-memory-runtime.ts

@@ -25,6 +25,7 @@ import {
   type ConnSnapshot,
   type ConnectionState,
   type Nick,
+  OperFailureStats,
   type RawLine,
   type ServerConfig,
   applyChannelDelta as applyDelta,
@@ -84,10 +85,20 @@ export class InMemoryRuntime implements IrcRuntime {
   private readonly admissionStats: AdmissionStats | undefined;
   private readonly admissionConfig: AdmissionConfig | undefined;
   private readonly configLoader: (() => Promise<ServerConfig>) | undefined;
+  /**
+   * Per-IP failed-`OPER` counter shared across every connection's actor
+   * (see `ctx.operFailures`). Bound to the runtime's clock so the OPER
+   * reducer's lockout window advances with the same time source the
+   * actors observe. Adapters hand `runtime.operFailures` to each
+   * `ConnectionActor`'s options; the counter is then per-IP across the
+   * whole process, not per-connection.
+   */
+  readonly operFailures: OperFailureStats;
 
   constructor(opts: InMemoryRuntimeOptions) {
     this.clock = opts.clock;
     this.configLoader = opts.configLoader;
+    this.operFailures = new OperFailureStats(opts.clock);
     if (opts.admission !== undefined) {
       this.admissionConfig = opts.admission;
       this.admissionStats = new AdmissionStats(this.clock);
@@ -270,6 +281,20 @@ export class InMemoryRuntime implements IrcRuntime {
     }
   }
 
+  /**
+   * Oper-only notice fanout — the recipient gate for the OPER reducer's
+   * per-IP lockout notice (`:<server> NOTICE * :OPER lockout triggered
+   * for <host>`). Identical enumeration to {@link broadcastWallops} but
+   * filtered on user mode `+o` instead of `+w`.
+   */
+  async broadcastOperNotice(lines: RawLine[], except?: ConnId): Promise<void> {
+    for (const [connId, tracked] of this.connections) {
+      if (connId === except) continue;
+      if (!tracked.state.userModes.oper) continue;
+      tracked.handlers.send(lines);
+    }
+  }
+
   // ------------------------------------------------------------------
   // IrcRuntime — nick registry
   // ------------------------------------------------------------------