serverless-ircd 0.10.0 → 0.11.0

package/packages/irc-core/tests/commands/chanserv.test.ts

@@ -2,9 +2,11 @@ import { describe, expect, it } from 'vitest';
 import {
   CHANSERV_NICK,
   DEFAULT_CHANNEL_LEVELS,
+  FOUNDER_RANK,
   SHORTHAND_LEVELS,
   chanservReducer,
   positiveMlockLetters,
+  rankOf,
   resolveMembershipTarget,
 } from '../../src/commands/chanserv';
 import { Effect } from '../../src/effects';
@@ -1670,6 +1672,29 @@ describe('SHORTHAND_LEVELS / DEFAULT_CHANNEL_LEVELS constants', () => {
   });
 });
 
+describe('rankOf / FOUNDER_RANK', () => {
+  it('maps positive access levels to themselves', () => {
+    expect(rankOf(SHORTHAND_LEVELS.VOP)).toBe(SHORTHAND_LEVELS.VOP);
+    expect(rankOf(SHORTHAND_LEVELS.SOP)).toBe(SHORTHAND_LEVELS.SOP);
+    expect(rankOf(7)).toBe(7);
+  });
+
+  it('clamps zero and negative levels to the minimum rank', () => {
+    expect(rankOf(0)).toBe(0);
+    expect(rankOf(-3)).toBe(0);
+  });
+
+  it('passes the founder rank through unchanged', () => {
+    expect(rankOf(FOUNDER_RANK)).toBe(Number.POSITIVE_INFINITY);
+  });
+
+  it('FOUNDER_RANK outranks every shorthand access level', () => {
+    for (const level of Object.values(SHORTHAND_LEVELS)) {
+      expect(FOUNDER_RANK).toBeGreaterThan(level);
+    }
+  });
+});
+
 // ============================================================================
 // OP / DEOP / VOICE / DEVOICE
 // ============================================================================
@@ -1895,6 +1920,109 @@ describe('chanservReducer — DEOP', () => {
       ':ChanServ!ChanServ@services NOTICE mallory :Permission denied.',
     );
   });
+
+  it('rejects DEOP of the channel founder by an AUTOOP-level access entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :You do not have sufficient privileges on #home to affect alice.',
+    );
+  });
+
+  it('allows peer-level DEOP between AUTOOP-level access entries', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerNick('dave', 'pw', 'd@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    services.setChannelAccess('#home', 'dave', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home dave'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Set mode -o on dave on #home.',
+    );
+  });
+
+  it('rejects DEOP of a higher-ranked access entry by a lower-ranked caller', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerNick('dave', 'pw', 'd@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    services.setChannelAccess('#home', 'dave', SHORTHAND_LEVELS.SOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home dave'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :You do not have sufficient privileges on #home to affect dave.',
+    );
+  });
+
+  it('allows an SOP-level entry to DEOP an AOP-level target', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerNick('dave', 'pw', 'd@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', SHORTHAND_LEVELS.SOP);
+    services.setChannelAccess('#home', 'dave', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home dave'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Set mode -o on dave on #home.',
+    );
+  });
+
+  it('allows the founder to DEOP themselves', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set mode -o on alice on #home.',
+    );
+  });
 });
 
 describe('chanservReducer — VOICE', () => {
@@ -2076,6 +2204,44 @@ describe('chanservReducer — KICK', () => {
       ':ChanServ!ChanServ@services NOTICE alice :Syntax: KICK <#channel> <nick> [:<reason>].',
     );
   });
+
+  it('rejects KICK of the channel founder by an AUTOOP-level caller', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Permission denied.',
+    );
+  });
+
+  it('allows the founder to KICK themselves (self-target through the rank guard)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Kicked alice from #home.',
+    );
+  });
 });
 
 // ============================================================================

package/packages/irc-core/tests/commands/chathistory.test.ts

@@ -1013,6 +1013,146 @@ describe('chathistoryReducer — TAGMSG replay', () => {
   });
 });
 
+// ============================================================================
+// Limit ceiling (L9)
+//
+// The client-supplied limit is capped at a deployment-configurable ceiling
+// (ServerConfig.chathistory.maxLimit, default 100) so an oversized request
+// like `CHATHISTORY LATEST #chan 999999999` cannot ask a future higher-
+// capacity store to materialize a huge result set. The cap is silent: the
+// client simply receives at most the ceiling worth of replay lines.
+// ============================================================================
+
+describe('chathistoryReducer — limit ceiling', () => {
+  /** Number of replay lines inside the emitted BATCH frame (0 when elided). */
+  function replayCount(effects: EffectType[]): number {
+    if (effects.length === 0) return 0;
+    const send = effects[0] as { lines: RawLine[] };
+    return send.lines.length - 2; // minus BATCH start + BATCH end
+  }
+
+  /** Ctx over a store that retains more than the default ceiling. */
+  function makeCappedCtx(conn: ConnectionState, store: MessageStore, config: ServerConfig): Ctx {
+    return buildCtx({
+      serverConfig: config,
+      clock: new FakeClock(10_000),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      messages: store,
+      connection: conn,
+    });
+  }
+
+  it('caps an oversized limit at the default ceiling of 100', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, serverConfig);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '999999999'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(100);
+  });
+
+  it('honors a limit at exactly the ceiling (100 passes through uncapped)', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, serverConfig);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '100'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(100);
+  });
+
+  it('passes a below-ceiling limit through unchanged', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, serverConfig);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '5'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(5);
+  });
+
+  it('caps at a configured lower ceiling via serverConfig.chathistory.maxLimit', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, {
+      ...serverConfig,
+      chathistory: { maxLimit: 3 },
+    });
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '999999999'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(3);
+  });
+
+  it('caps the default (omitted) limit at a configured lower ceiling', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, {
+      ...serverConfig,
+      chathistory: { maxLimit: 3 },
+    });
+
+    const out = chathistoryReducer(
+      chan,
+      // No limit param — the default 50 must still respect the ceiling of 3.
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(3);
+  });
+
+  it('returns 461 for a negative limit', () => {
+    const store = new InMemoryMessageStore();
+    seed(store, '#foo', 3);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCtx(conn, store);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '-5'], tags: {} },
+      ctx,
+    );
+
+    expect((out.effects[0] as { lines: RawLine[] }).lines[0]?.text).toContain('461');
+  });
+});
+
 // ============================================================================
 // No MessageStore bound (deployment disabled chathistory persistence)
 // ============================================================================

package/packages/irc-core/tests/commands/hostserv.test.ts

@@ -37,6 +37,7 @@ const queueServerConfig: ServerConfig = {
 const autoApproveServerConfig: ServerConfig = {
   ...serverConfig,
   hostservAutoApproveVhosts: true,
+  hostservAutoApproveAllowlist: ['cool.example.net', 'one.example.net', 'two.example.net'],
 };
 
 function makeConn(id = 'c1', nick = 'alice'): ConnectionState {
@@ -548,6 +549,321 @@ describe('hostservReducer — REQUEST (auto-approve knob explicitly on)', () =>
   });
 });
 
+// ============================================================================
+// REQUEST — auto-approve hardening (denylist + allowlist)
+// ============================================================================
+
+describe('hostservReducer — REQUEST (auto-approve denylist)', () => {
+  /**
+   * Auto-approve config whose allowlist deliberately contains every probed
+   * vhost: each test proves the built-in denylist is enforced regardless
+   * of (and ahead of) the allowlist.
+   */
+  const denyConfig: ServerConfig = {
+    ...serverConfig,
+    hostservAutoApproveVhosts: true,
+    hostservAutoApproveAllowlist: [
+      'admin.example.net',
+      'oper.example.net',
+      'staff.example.net',
+      'irc.example.net',
+      'www.example.net',
+      'root.example.net',
+      'security.example.net',
+      'user.admin.example.net',
+      'example.net.staff',
+      'ADMIN.example.net',
+      'hub.example.net',
+      'user.hub.example.net',
+      'clean.example.net',
+    ],
+  };
+
+  /** Same hardening config on a serverName free of reserved labels, so the
+   * own-hostname suffix check is probed in isolation. */
+  const suffixConfig: ServerConfig = { ...denyConfig, serverName: 'hub.example.net' };
+
+  it.each(['admin', 'oper', 'staff', 'irc', 'www', 'root', 'security'])(
+    'denies a vhost whose first label is the reserved label %s (even when allowlisted)',
+    (label) => {
+      const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+      const conn = identifiedConn('alice');
+      const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+      const out = hostservReducer(conn, privmsg(`REQUEST ${label}.example.net`), ctx);
+
+      expect(services.getVhost('alice')).toBeUndefined();
+      expect(sentTexts(out.effects)).toContain(
+        `:HostServ!HostServ@services NOTICE alice :Vhost ${label}.example.net is not permitted (reserved label or this server's hostname).`,
+      );
+    },
+  );
+
+  it('denies a vhost with a reserved label in a middle position', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST user.admin.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost user.admin.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it('denies a vhost with a reserved label in the last position', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST example.net.staff'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost example.net.staff is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it('matches reserved labels case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST ADMIN.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost ADMIN.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it("denies the server's own hostname exactly (even when allowlisted)", () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), suffixConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST hub.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost hub.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it("denies a vhost ending with the server's own hostname", () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), suffixConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST user.hub.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost user.hub.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it("denies the server's own hostname case-insensitively", () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), {
+      ...suffixConfig,
+      serverName: 'HUB.example.net',
+    });
+
+    hostservReducer(conn, privmsg('REQUEST hub.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+  });
+});
+
+describe('hostservReducer — REQUEST (auto-approve allowlist)', () => {
+  const allowConfig: ServerConfig = {
+    ...serverConfig,
+    hostservAutoApproveVhosts: true,
+    hostservAutoApproveAllowlist: ['users.example.net', '*.vhosts.example.net'],
+  };
+
+  it('approves a vhost that exactly matches an allowlist entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST users.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('users.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost users.example.net has been requested and approved.',
+    );
+  });
+
+  it('matches an exact allowlist entry case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    hostservReducer(conn, privmsg('REQUEST USERS.Example.NET'), ctx);
+
+    expect(services.getVhost('alice')).toBe('USERS.Example.NET');
+  });
+
+  it('denies a vhost with no allowlist entry (nothing recorded)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST other.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(services.getPendingVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost other.example.net is not in the auto-approve allowlist.',
+    );
+  });
+
+  it('approves a vhost covered by a wildcard entry (*.suffix)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST a.vhosts.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('a.vhosts.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost a.vhosts.example.net has been requested and approved.',
+    );
+  });
+
+  it('approves a vhost at any depth beneath a wildcard entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    hostservReducer(conn, privmsg('REQUEST x.y.vhosts.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('x.y.vhosts.example.net');
+  });
+
+  it('matches a wildcard entry case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    hostservReducer(conn, privmsg('REQUEST A.VHOSTS.Example.NET'), ctx);
+
+    expect(services.getVhost('alice')).toBe('A.VHOSTS.Example.NET');
+  });
+
+  it('does NOT match the bare suffix of a wildcard entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST vhosts.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost vhosts.example.net is not in the auto-approve allowlist.',
+    );
+  });
+
+  it('checks every allowlist entry until one matches', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const cfg: ServerConfig = {
+      ...serverConfig,
+      hostservAutoApproveVhosts: true,
+      hostservAutoApproveAllowlist: ['first.example.net', 'users.example.net'],
+    };
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), cfg);
+
+    hostservReducer(conn, privmsg('REQUEST users.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('users.example.net');
+  });
+
+  it('fails closed when the allowlist is missing entirely (inline literal)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    // A booted server can never reach this shape (config parsing refuses
+    // auto-approve without an allowlist); the reducer must still deny
+    // everything rather than approve everything.
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), {
+      ...serverConfig,
+      hostservAutoApproveVhosts: true,
+    });
+
+    const out = hostservReducer(conn, privmsg('REQUEST clean.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost clean.example.net is not in the auto-approve allowlist.',
+    );
+  });
+});
+
+describe('hostservReducer — hardening does not apply to oper review', () => {
+  it('queues a reserved-label vhost in queue mode (opers vet it)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), queueServerConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST admin.example.net'), ctx);
+
+    expect(services.getPendingVhost('alice')).toBe('admin.example.net');
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost admin.example.net is pending oper approval.',
+    );
+  });
+
+  it('queues a vhost outside the allowlist in queue mode', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const cfg: ServerConfig = {
+      ...queueServerConfig,
+      hostservAutoApproveAllowlist: ['users.example.net'],
+    };
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), cfg);
+
+    const out = hostservReducer(conn, privmsg('REQUEST other.example.net'), ctx);
+
+    expect(services.getPendingVhost('alice')).toBe('other.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost other.example.net is pending oper approval.',
+    );
+  });
+
+  it('lets an oper APPROVE a reserved-label vhost from the queue', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.requestVhost('alice', 'admin.example.net');
+    const conn = operConn('admin');
+    const ctx = makeCtx(conn, services);
+
+    const out = hostservReducer(conn, privmsg('APPROVE alice'), ctx);
+
+    expect(services.getVhost('alice')).toBe('admin.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE admin :Vhost admin.example.net for alice has been approved and activated.',
+    );
+  });
+
+  it('lets an oper SET a reserved-label vhost directly', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = operConn('admin');
+    const ctx = makeCtx(conn, services);
+
+    const out = hostservReducer(conn, privmsg('SET alice staff.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('staff.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE admin :Vhost for alice is now set to staff.example.net.',
+    );
+  });
+});
+
 // ============================================================================
 // APPROVE / ACTIVATE (oper-only)
 // ============================================================================