serverless-ircd 0.10.0 → 0.11.0

package/packages/irc-core/src/ports.ts

@@ -7,6 +7,12 @@
  */
 
 import { caseFold } from './case-fold.js';
+import {
+  CERT_FP_PREFIX,
+  type CertIdentity,
+  canonicalizeCertSubject,
+  certFingerprintId,
+} from './certfp.js';
 import {
   type HashedAccountCredential,
   hashAccountCredential,
@@ -15,6 +21,8 @@ import {
 import type { ChannelState } from './state/channel.js';
 import type { ConnId, ConnectionState } from './state/connection.js';
 
+export type { CertIdentity } from './certfp.js';
+
 /** Read-only wall clock, epoch milliseconds. */
 export interface Clock {
   now(): number;
@@ -132,6 +140,31 @@ export class SequentialIdFactory implements IdFactory {
   }
 }
 
+/**
+ * Constant-time string equality.
+ *
+ * Walks both inputs position by position (UTF-16 code units, a bijection
+ * with UTF-8 bytes for equality purposes) out to the longer input's length,
+ * XOR-accumulating every difference. The amount of work — and therefore the
+ * wall-clock profile — does not depend on where the first mismatch sits, so
+ * a remote timing attacker cannot recover a matching-prefix length the way a
+ * short-circuiting `===` would reveal. `charCodeAt` past the end yields
+ * `NaN`, which XOR-folds to 0, so a length mismatch is caught purely by the
+ * length-difference seed in `diff`.
+ *
+ * Deliberately free of `node:crypto` (pure arithmetic) so the same code
+ * runs unmodified on Node and Cloudflare Workers. Used for secret
+ * comparisons such as the server-password gate at registration.
+ */
+export function constantTimeEquals(a: string, b: string): boolean {
+  const maxLen = Math.max(a.length, b.length);
+  let diff = a.length ^ b.length;
+  for (let i = 0; i < maxLen; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
 /**
  * Port supplying the server's Message-of-the-Day text.
  *
@@ -187,9 +220,13 @@ export const EmptyMotdProvider: MotdProvider = new StaticMotdProvider([]);
  *
  * At the edge (CF API Shield mTLS, AWS API Gateway custom-domain mTLS) the
  * platform terminates TLS, validates the client certificate against the
- * configured trust store, and surfaces the certificate subject to the
+ * configured trust store, and surfaces the certificate identity to the
  * Worker/Lambda. The adapter captures this at connection-admission time
- * and stores it keyed by connection ID.
+ * and stores it keyed by connection ID as a {@link CertIdentity}: the raw
+ * subject string, its canonical DN, and — where the platform provides one
+ * (Cloudflare: `cf.tlsClientAuth.certFingerprintSHA256`) — the SHA-256
+ * fingerprint of the certificate DER, which is the preferred account
+ * binding. See `docs/SASL-EXTERNAL.md`.
  *
  * The method is **synchronous** — adapters pre-populate the identity at
  * admission time (before the first reducer runs), so the SASL EXTERNAL
@@ -199,26 +236,26 @@ export const EmptyMotdProvider: MotdProvider = new StaticMotdProvider([]);
  */
 export interface MtlsIdentityProvider {
   /**
-   * @returns the verified client-cert subject for `connId`, or `undefined`
+   * @returns the verified client-cert identity for `connId`, or `undefined`
    *   when no trusted certificate was presented.
    */
-  getIdentity(connId: string): string | undefined;
+  getIdentity(connId: string): CertIdentity | undefined;
 }
 
 /**
  * Reference in-memory {@link MtlsIdentityProvider} backed by a static map
- * of connection IDs to certificate subjects. Useful for tests and the
+ * of connection IDs to certificate identities. Useful for tests and the
  * local-cli adapter; cloud adapters replace this with a lookup keyed by
  * the platform's connection identifier.
  */
 export class InMemoryMtlsIdentityProvider implements MtlsIdentityProvider {
-  private readonly identities: ReadonlyMap<string, string>;
+  private readonly identities: ReadonlyMap<string, CertIdentity>;
 
-  constructor(entries: ReadonlyArray<{ connId: string; identity: string }>) {
+  constructor(entries: ReadonlyArray<{ connId: string; identity: CertIdentity }>) {
     this.identities = new Map(entries.map((e) => [e.connId, e.identity]));
   }
 
-  getIdentity(connId: string): string | undefined {
+  getIdentity(connId: string): CertIdentity | undefined {
     return this.identities.get(connId);
   }
 }
@@ -638,12 +675,21 @@ export type NickEnforcePolicy = 'none' | 'ghost' | 'kill';
  * the returned `nick` / `account` preserve the original spelling so the
  * wire renders the user's preferred casing.
  *
- * `certSubjects` is the list of mTLS client-certificate subjects (e.g.
- * `CN=alice`) attached to the account via {@link ServicesStore.addCertFP}.
- * SASL EXTERNAL resolves the verified edge subject against this list
- * (byte-exact comparison; subjects are NOT case-folded). Defaults to an
- * empty array on a fresh registration; an upcoming NickServ `CERT` command
- * surfaces the mutators to the user (Atheme parity).
+ * `certSubjects` is the list of mTLS client-certificate bindings attached
+ * to the account via {@link ServicesStore.addCertFP} /
+ * {@link ServicesStore.addCertFingerprint}. An entry is either a DER
+ * SHA-256 fingerprint binding (`fp:<hex>`, the preferred identifier where
+ * the platform surfaces a fingerprint) or a subject DN. SASL EXTERNAL
+ * resolves the verified edge identity against this list via
+ * {@link ServicesStore.verifyCertFP}: the fingerprint arm matches
+ * byte-exactly, DN entries compare on the canonical DN (values
+ * case-sensitive), and legacy verbatim subject spellings are rewritten to
+ * their canonical form on first use. Defaults to an empty array on a
+ * fresh registration; an upcoming NickServ `CERT` command (Atheme parity)
+ * will surface the mutators to the user. Until then bindings are attached
+ * out-of-band via {@link ServicesStore.addCertFP} /
+ * {@link ServicesStore.addCertFingerprint} (seed tooling or direct
+ * backend access) — the seam is the store API, not the wire.
  */
 export interface RegisteredNick {
   /** Display spelling stored at registration. */
@@ -657,9 +703,11 @@ export interface RegisteredNick {
   /** Per-account nick-enforcement policy. */
   enforce: NickEnforcePolicy;
   /**
-   * Client-certificate subjects attached to this account for SASL EXTERNAL
-   * (CertFP). Byte-exact comparisons; never case-folded. Empty on a fresh
-   * registration; populated via {@link ServicesStore.addCertFP}.
+   * Client-certificate bindings attached to this account for SASL EXTERNAL
+   * (CertFP): `fp:<hex>` DER SHA-256 fingerprint bindings and/or subject
+   * DNs (compared via their canonical form; values never case-folded).
+   * Empty on a fresh registration; populated via
+   * {@link ServicesStore.addCertFP} / {@link ServicesStore.addCertFingerprint}.
    */
   certSubjects: string[];
 }
@@ -835,6 +883,11 @@ export interface ServicesStore {
    * `{ ok: true, account }` on a match (the canonical spelling), or
    * `{ ok: false, reason }` when the nick is unknown or the password is
    * wrong.
+   *
+   * Timing contract: implementations MUST cost the unknown-nick and
+   * wrong-password paths equally (one scrypt verify each — see
+   * {@link VERIFY_NICK_PRECOMPUTED_DUMMY}) so latency never reveals
+   * whether a nick is registered.
    */
   verifyNick(nick: string, password: string): ServicesAuthResult;
   /**
@@ -871,30 +924,90 @@ export interface ServicesStore {
   getNick(nick: string): RegisteredNick | undefined;
 
   /**
-   * Verifies a client-certificate subject (CertFP) for SASL EXTERNAL.
-   * Returns `{ ok: true, account }` for the account whose
-   * {@link RegisteredNick.certSubjects} contains `subject` (byte-exact,
-   * case-sensitive comparison — cert subjects are NOT folded), or
-   * `{ ok: false, reason }` when no registered nick carries `subject`.
+   * Records a failed `IDENTIFY` attempt against `nick`: appends the
+   * current clock timestamp to the sliding-window failure list and bumps
+   * the pending owner-notice counter. No-op when the nick is not
+   * registered. Called by the NickServ IDENTIFY reducer AFTER a failed
+   * `verifyNick` (frozen rejections never reach this method — they are
+   * short-circuited before scrypt runs).
+   */
+  recordIdentifyFailure(nick: string): void;
+  /**
+   * Returns `true` iff `nick` is identify-frozen: at least
+   * `opts.maxFailures` failed identifies were recorded within the last
+   * `opts.windowMs` milliseconds. Prunes expired timestamps from the
+   * stored list in place (the sliding window), so the freeze lifts once
+   * the failures age out of the window. Returns `false` for an unknown
+   * nick. Called BEFORE `verifyNick` so a frozen attempt never runs
+   * scrypt.
+   */
+  isNickIdentifyFrozen(nick: string, opts: { maxFailures: number; windowMs: number }): boolean;
+  /**
+   * Clears the failed-identify state for `nick` (the sliding-window
+   * timestamps and the pending owner-notice counter) and returns the
+   * number of failed identifies that were queued for the owner NOTICE
+   * (`0` when none were pending, including for an unknown nick). Called
+   * by the NickServ IDENTIFY reducer on a SUCCESSFUL `verifyNick` — a
+   * successful login both resets the freeze counter and delivers the
+   * queued owner notice.
+   */
+  clearIdentifyFailures(nick: string): number;
+
+  /**
+   * Verifies a client-certificate identity (CertFP) for SASL EXTERNAL.
+   *
+   * Matching arms, in preference order:
+   * 1. **Fingerprint (primary):** when `identity.fingerprint` is present
+   *    (Cloudflare surfaces the DER SHA-256), the normalised
+   *    `fp:<hex>` form is matched byte-exactly against the account's
+   *    {@link RegisteredNick.certSubjects} entries.
+   * 2. **Canonical DN (fallback):** each stored DN entry is canonicalised
+   *    (lowercased attribute types, sorted RDNs/AVAs, collapsed
+   *    whitespace — values stay case-sensitive) and compared to
+   *    `identity.canonicalDn`. This is the only arm available on
+   *    platforms that surface just the subject DN (AWS API Gateway).
+   *
+   * First-use migration: a stored DN entry kept in a legacy verbatim
+   * spelling is rewritten to its canonical form, and — when the platform
+   * supplied a fingerprint — the `fp:<hex>` binding is pinned alongside
+   * it, so subsequent verifies hit the fingerprint arm. Both rewrites
+   * notify {@link onCertBindingsChanged} (write-behind subclasses
+   * re-persist the nick row).
    *
    * The edge (CF API Shield / AWS APIGW mTLS) still resolves the verified
-   * subject via {@link MtlsIdentityProvider}; only the subject→account
+   * identity via {@link MtlsIdentityProvider}; only the identity→account
    * lookup lives here.
+   *
+   * @returns `{ ok: true, account }` on a match, or `{ ok: false, reason }`
+   *   when no registered nick carries a binding for the certificate.
    */
-  verifyCertFP(subject: string): ServicesAuthResult;
+  verifyCertFP(identity: CertIdentity): ServicesAuthResult;
   /**
-   * Attaches a client-certificate subject to `nick` for SASL EXTERNAL.
+   * Attaches a client-certificate subject DN to `nick` for SASL EXTERNAL.
    * No-op (and returns `false`) when the nick is not registered.
    * Byte-exact: a duplicate subject (case-sensitive) is a no-op (idempotent
-   * returns `true`). Future NickServ `CERT ADD` will surface this.
-   * Returns `true` when the subject was newly attached (or already
+   * returns `true`). Canonicalisation happens at verify time (with the
+   * first-use migration above). Future NickServ `CERT ADD` will surface
+   * this. Returns `true` when the subject was newly attached (or already
    * present), `false` when the nick is unknown.
    */
   addCertFP(nick: string, subject: string): boolean;
   /**
-   * Detaches a client-certificate subject from `nick`. Returns `true` when
-   * a subject was removed, `false` when the nick is unknown or the subject
-   * was not attached. Future NickServ `CERT DEL` will surface this.
+   * Attaches a DER SHA-256 fingerprint binding (`fp:<hex>` — the primary
+   * CertFP identifier where the platform surfaces a fingerprint) to
+   * `nick`. The fingerprint is normalised (lowercased, colon-free) before
+   * storing, so `AA:11` and `aa11` are the same binding. Idempotent.
+   * Returns `true` when the binding was newly attached (or already
+   * present), `false` when the nick is unknown.
+   */
+  addCertFingerprint(nick: string, fingerprint: string): boolean;
+  /**
+   * Detaches a client-certificate binding from `nick`. `subject` matches
+   * the stored entry byte-exactly — pass either a stored DN entry or a
+   * stored `fp:<hex>` entry as read from {@link RegisteredNick.certSubjects}.
+   * Returns `true` when an entry was removed, `false` when the nick is
+   * unknown or the entry was not attached. Future NickServ `CERT DEL` will
+   * surface this.
    */
   removeCertFP(nick: string, subject: string): boolean;
 
@@ -1122,6 +1235,29 @@ export interface ServicesStore {
   listJupes(): ReadonlyArray<JupeEntry>;
 }
 
+/**
+ * Per-account failed-IDENTIFY throttle state persisted on the nick row.
+ *
+ * Shape decision: a small append-only array of recent failure timestamps
+ * (`identifyFailures`, epoch-ms) plus a pending owner-notice counter. The
+ * timestamp array makes the sliding-window freeze test trivially correct
+ * (prune entries older than the configured window, then compare the
+ * surviving count against the threshold) without a separate "window
+ * start" bookkeeping field, and stays small in practice: once the
+ * threshold is reached the account is frozen (no further failures are
+ * recorded), so the array holds at most threshold + a handful of entries
+ * at any time.
+ */
+export interface IdentifyThrottleState {
+  /** Epoch-ms timestamps of recent failed IDENTIFY attempts. */
+  identifyFailures: number[];
+  /**
+   * Failed-identify count queued for the owner NOTICE delivered on the
+   * next successful identify. Reset to 0 once the notice is delivered.
+   */
+  pendingIdentifyFailureNotice: number;
+}
+
 /**
  * Snapshot row for a NickServ registration, persisted by adapter backends
  * (D1 / DynamoDB) and round-tripped through {@link ServicesSnapshot}.
@@ -1139,9 +1275,13 @@ export interface ServicesStore {
  * The credential never leaves the store via
  * {@link InMemoryServicesStore.getNick} (which returns a defensive copy
  * without it), but it MUST be present in the snapshot so the
- * `verifyNick` round-trip keeps working across a reload.
+ * `verifyNick` round-trip keeps working across a reload. The same holds
+ * for the {@link IdentifyThrottleState} fields: the failed-identify
+ * counter survives connections and deploys so a re-identify from a fresh
+ * connection still sees the freeze.
  */
-export type ServicesNickRow = RegisteredNick & { credential: HashedAccountCredential };
+export type ServicesNickRow = RegisteredNick &
+  IdentifyThrottleState & { credential: HashedAccountCredential };
 
 /**
  * Snapshot row for a ChanServ access entry: `(channel, account, level)`.
@@ -1279,6 +1419,77 @@ type StoredAkill = AkillEntry & { maskKey: string };
  */
 type StoredJupe = JupeEntry & { nameKey: string };
 
+// ============================================================================
+// verifyNick timing equalisation — unknown-nick lookups must cost the same
+// scrypt work as a wrong-password verify so latency cannot enumerate
+// registered nicks. Mirrors the OPER_PRECOMPUTED_DUMMY_HASHED pattern in
+// commands/oper.ts (and the PASS-auth dummy verify in commands/account-auth.ts).
+// ============================================================================
+
+/**
+ * Fixed salt used to bake the precomputed dummy credential below. 16 bytes
+ * of `0x42` so the resulting scrypt derivation is deterministic across Node
+ * versions and test runs (the salt is never used to verify real traffic —
+ * only the dummy entry).
+ */
+const VERIFY_NICK_FIXTURE_SALT = new Uint8Array(16).fill(0x42);
+
+/**
+ * Nick baked into the precomputed dummy credential. Contains a NUL so it can
+ * never be a registered nick (registration rejects control characters) and
+ * the dummy verify never collides with a real credential.
+ */
+const VERIFY_NICK_DUMMY_NICK = '\u0000nick-verify-timing-dummy';
+
+/**
+ * Password baked into the precomputed dummy credential. Contains a NUL so
+ * the dummy verify always fails — its purpose is to spend the same scrypt
+ * work as the known-nick-wrong-password path, NOT to authenticate.
+ */
+const VERIFY_NICK_DUMMY_PASSWORD = '\u0000nick-verify-timing-dummy';
+
+/**
+ * Fixed random scrypt digest (precomputed once at module load from the
+ * NUL-prefixed dummy pair above — never derived from any real credential)
+ * used to equalise timing on the unknown-nick path of
+ * {@link InMemoryServicesStore.verifyNick}. Every caller of `verifyNick`
+ * (SASL PLAIN, PASS-based account auth, NickServ IDENTIFY/SETPASS) then
+ * costs exactly one scrypt verify whether the nick is known or not, so a
+ * remote attacker measuring latency cannot distinguish "nick exists, wrong
+ * password" from "nick unknown".
+ */
+export const VERIFY_NICK_PRECOMPUTED_DUMMY: HashedAccountCredential = hashAccountCredential(
+  VERIFY_NICK_DUMMY_NICK,
+  VERIFY_NICK_DUMMY_PASSWORD,
+  { salt: VERIFY_NICK_FIXTURE_SALT },
+);
+
+/**
+ * Indirection over {@link verifyHashedPassword} so tests can swap in a stub
+ * to assert call counts (timing-equalisation parity tests). Defaults to the
+ * real primitive; `null` restores the default.
+ */
+let verifyNickHashedPasswordFn: (password: string, entry: HashedAccountCredential) => boolean =
+  verifyHashedPassword;
+
+/**
+ * Test seam: replaces the verify primitive with `fn` (or restores the
+ * default when `fn === null`). Exported for tests; production callers MUST
+ * NOT use.
+ *
+ * @internal
+ */
+export function setVerifyNickHashedPassword(
+  fn: ((password: string, entry: HashedAccountCredential) => boolean) | null,
+): void {
+  verifyNickHashedPasswordFn = fn ?? verifyHashedPassword;
+}
+
+/** @internal test seam: clears any spy registered above. */
+export function resetVerifyNickTimingSpy(): void {
+  verifyNickHashedPasswordFn = verifyHashedPassword;
+}
+
 /**
  * Reference in-memory {@link ServicesStore} used by the local CLI,
  * integration tests, and any deployment that has not bound a distributed
@@ -1350,6 +1561,8 @@ export class InMemoryServicesStore implements ServicesStore {
       this.nicks.set(folded(row.nick), {
         ...row,
         certSubjects: [...(row.certSubjects ?? [])],
+        identifyFailures: [...(row.identifyFailures ?? [])],
+        pendingIdentifyFailureNotice: row.pendingIdentifyFailureNotice ?? 0,
         credential: { ...row.credential },
       });
     }
@@ -1426,6 +1639,7 @@ export class InMemoryServicesStore implements ServicesStore {
       nicks.push({
         ...rec,
         certSubjects: [...rec.certSubjects],
+        identifyFailures: [...rec.identifyFailures],
         credential: { ...rec.credential },
       });
     }
@@ -1505,6 +1719,8 @@ export class InMemoryServicesStore implements ServicesStore {
       createdAt: now,
       enforce: 'none',
       certSubjects: [],
+      identifyFailures: [],
+      pendingIdentifyFailureNotice: 0,
       credential,
     });
     return { ok: true, account: nick };
@@ -1513,9 +1729,15 @@ export class InMemoryServicesStore implements ServicesStore {
   verifyNick(nick: string, password: string): ServicesAuthResult {
     const rec = this.nicks.get(folded(nick));
     if (rec === undefined) {
+      // Equalise timing: unknown-nick must cost the same scrypt work as a
+      // wrong password so callers (SASL PLAIN, PASS auth, NickServ
+      // IDENTIFY/SETPASS) cannot leak nick existence via latency. The
+      // dummy verify runs against a fixed precomputed digest — the result
+      // is discarded, the cost is the point.
+      verifyNickHashedPasswordFn(password, VERIFY_NICK_PRECOMPUTED_DUMMY);
       return { ok: false, reason: 'invalid credentials' };
     }
-    if (!verifyHashedPassword(password, rec.credential)) {
+    if (!verifyNickHashedPasswordFn(password, rec.credential)) {
       return { ok: false, reason: 'invalid credentials' };
     }
     return { ok: true, account: rec.account };
@@ -1561,11 +1783,68 @@ export class InMemoryServicesStore implements ServicesStore {
     };
   }
 
-  verifyCertFP(subject: string): ServicesAuthResult {
+  recordIdentifyFailure(nick: string): void {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return;
+    rec.identifyFailures.push(this.clock.now());
+    rec.pendingIdentifyFailureNotice += 1;
+  }
+
+  isNickIdentifyFrozen(nick: string, opts: { maxFailures: number; windowMs: number }): boolean {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return false;
+    // Sliding window: drop failures that have aged out (age >= windowMs),
+    // then freeze iff the surviving count still meets the threshold. The
+    // prune is in place, so the freeze lifts automatically as failures
+    // expire even if no further attempts arrive.
+    const cutoff = this.clock.now() - opts.windowMs;
+    rec.identifyFailures = rec.identifyFailures.filter((t) => t > cutoff);
+    return rec.identifyFailures.length >= opts.maxFailures;
+  }
+
+  clearIdentifyFailures(nick: string): number {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return 0;
+    const pending = rec.pendingIdentifyFailureNotice;
+    rec.pendingIdentifyFailureNotice = 0;
+    rec.identifyFailures = [];
+    return pending;
+  }
+
+  verifyCertFP(identity: CertIdentity): ServicesAuthResult {
+    // Arm 1 — fingerprint (primary identifier where the platform surfaces
+    // the DER SHA-256, e.g. Cloudflare's tlsClientAuth.certFingerprintSHA256).
+    const fpId =
+      identity.fingerprint !== undefined ? certFingerprintId(identity.fingerprint) : undefined;
+    if (fpId !== undefined) {
+      for (const rec of this.nicks.values()) {
+        if (rec.certSubjects.includes(fpId)) {
+          return { ok: true, account: rec.account };
+        }
+      }
+    }
+    // Arm 2 — canonical DN (the only arm on subject-DN-only platforms like
+    // API Gateway). Stored DN entries are canonicalised at compare time so
+    // legacy verbatim spellings still match; first use rewrites them (and
+    // pins the fingerprint, when available).
     for (const rec of this.nicks.values()) {
-      if (rec.certSubjects.includes(subject)) {
-        return { ok: true, account: rec.account };
+      const idx = rec.certSubjects.findIndex(
+        (entry) =>
+          !entry.startsWith(CERT_FP_PREFIX) &&
+          canonicalizeCertSubject(entry) === identity.canonicalDn,
+      );
+      if (idx === -1) continue;
+      let mutated = false;
+      if (rec.certSubjects[idx] !== identity.canonicalDn) {
+        rec.certSubjects[idx] = identity.canonicalDn;
+        mutated = true;
       }
+      if (fpId !== undefined && !rec.certSubjects.includes(fpId)) {
+        rec.certSubjects.push(fpId);
+        mutated = true;
+      }
+      if (mutated) this.onCertBindingsChanged(rec.nick);
+      return { ok: true, account: rec.account };
     }
     return { ok: false, reason: 'untrusted certificate' };
   }
@@ -1578,6 +1857,15 @@ export class InMemoryServicesStore implements ServicesStore {
     return true;
   }
 
+  addCertFingerprint(nick: string, fingerprint: string): boolean {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return false;
+    const fpId = certFingerprintId(fingerprint);
+    if (rec.certSubjects.includes(fpId)) return true;
+    rec.certSubjects.push(fpId);
+    return true;
+  }
+
   removeCertFP(nick: string, subject: string): boolean {
     const rec = this.nicks.get(folded(nick));
     if (rec === undefined) return false;
@@ -1587,6 +1875,17 @@ export class InMemoryServicesStore implements ServicesStore {
     return true;
   }
 
+  /**
+   * Hook fired when a `verifyCertFP` call rewrote the account's stored
+   * cert bindings (legacy-spelling migration and/or fingerprint pinning).
+   * No-op in the plain in-memory store; the write-behind
+   * {@link PersistentServicesStore} subclass overrides it to re-persist
+   * the nick row so the migration survives a backend reload.
+   */
+  protected onCertBindingsChanged(nick: string): void {
+    void nick;
+  }
+
   /**
    * Returns the full stored nick row (including the scrypt-hashed
    * credential), or `undefined` when the nick is not registered. Defensive
@@ -1606,6 +1905,7 @@ export class InMemoryServicesStore implements ServicesStore {
       : {
           ...rec,
           certSubjects: [...rec.certSubjects],
+          identifyFailures: [...rec.identifyFailures],
           credential: { ...rec.credential },
         };
   }
@@ -2090,6 +2390,38 @@ export abstract class PersistentServicesStore extends InMemoryServicesStore {
     this.enqueue({ kind: 'upsertNick', row });
   }
 
+  override recordIdentifyFailure(nick: string): void {
+    if (!this.isRegisteredNick(nick)) return;
+    super.recordIdentifyFailure(nick);
+    // Re-persist the full row so the failure timestamps + pending owner
+    // notice survive a deploy: a re-identify from a fresh connection (or
+    // store) must still see the freeze.
+    const row = this.getStoredNick(nick) as ServicesNickRow;
+    this.enqueue({ kind: 'upsertNick', row });
+  }
+
+  override clearIdentifyFailures(nick: string): number {
+    if (!this.isRegisteredNick(nick)) return 0;
+    // Suppress the spurious write when there is no throttle state queued
+    // (the common case on an unmolested account). The `isRegisteredNick`
+    // guard above guarantees the stored row is defined.
+    const before = this.getStoredNick(nick) as ServicesNickRow;
+    if (before.identifyFailures.length === 0 && before.pendingIdentifyFailureNotice === 0) {
+      return 0;
+    }
+    const pending = super.clearIdentifyFailures(nick);
+    const row = this.getStoredNick(nick) as ServicesNickRow;
+    this.enqueue({ kind: 'upsertNick', row });
+    return pending;
+  }
+
+  // NOTE: `isNickIdentifyFrozen` is intentionally NOT overridden. Its only
+  // mutation is pruning timestamps that have aged out of the window — a
+  // deterministic function of the stored timestamps and the clock, so a
+  // reloaded backend row re-prunes to the same state on the next check.
+  // Skipping its write keeps every read-only IDENTIFY attempt off the
+  // write-behind queue.
+
   override addCertFP(nick: string, subject: string): boolean {
     if (!this.isRegisteredNick(nick)) return false;
     // Suppress the spurious write on an idempotent re-add (the subject is
@@ -2107,6 +2439,22 @@ export abstract class PersistentServicesStore extends InMemoryServicesStore {
     return attached;
   }
 
+  override addCertFingerprint(nick: string, fingerprint: string): boolean {
+    if (!this.isRegisteredNick(nick)) return false;
+    // Suppress the spurious write on an idempotent re-add (the normalised
+    // fingerprint is already attached → super is a no-op). Mirrors the
+    // addCertFP override above.
+    const before = this.getNick(nick);
+    const fpId = certFingerprintId(fingerprint);
+    const alreadyPresent = before?.certSubjects.includes(fpId) === true;
+    const attached = super.addCertFingerprint(nick, fingerprint);
+    if (attached && !alreadyPresent) {
+      const row = this.getStoredNick(nick) as ServicesNickRow;
+      this.enqueue({ kind: 'upsertNick', row });
+    }
+    return attached;
+  }
+
   override removeCertFP(nick: string, subject: string): boolean {
     const removed = super.removeCertFP(nick, subject);
     if (removed) {
@@ -2116,6 +2464,17 @@ export abstract class PersistentServicesStore extends InMemoryServicesStore {
     return removed;
   }
 
+  /**
+   * Re-persists the nick row after a `verifyCertFP` first-use migration
+   * (legacy DN spelling rewrite and/or fingerprint pinning) so the
+   * upgraded binding survives a backend reload. The hook only fires for
+   * a record `verifyCertFP` just iterated, so `getStoredNick` is defined.
+   */
+  protected override onCertBindingsChanged(nick: string): void {
+    const row = this.getStoredNick(nick) as ServicesNickRow;
+    this.enqueue({ kind: 'upsertNick', row });
+  }
+
   // ----- ChanServ -----
 
   override registerChannel(channel: string, founder: string): ChannelRegisterResult {