serverless-ircd 0.10.0 → 0.11.0

package/packages/irc-core/tests/commands/join.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { handleJoinZero, isValidChannelName, joinReducer } from '../../src/commands/join';
+import { handleJoinZero, joinReducer } from '../../src/commands/join';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import {
@@ -12,6 +12,7 @@ import {
   type ServicesStore,
   type StoredMessage,
 } from '../../src/ports';
+import { isValidChannelName } from '../../src/protocol/channel-name';
 import { type ChannelState, createChannel } from '../../src/state/channel';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
@@ -107,6 +108,30 @@ describe('isValidChannelName', () => {
     expect(isValidChannelName('#foo:bar', 50)).toBe(false);
   });
 
+  it('rejects a name containing NUL', () => {
+    expect(isValidChannelName('#foo\0bar', 50)).toBe(false);
+  });
+
+  it('rejects a name containing a control character', () => {
+    expect(isValidChannelName('#foo\x01bar', 50)).toBe(false);
+  });
+
+  it('rejects a multi-byte name whose UTF-8 byte size exceeds the cap', () => {
+    expect(isValidChannelName(`#${'é'.repeat(25)}`, 50)).toBe(false); // 51 bytes, 26 UTF-16 units
+  });
+
+  it('accepts a multi-byte name at exactly the UTF-8 byte cap', () => {
+    expect(isValidChannelName(`#${'é'.repeat(24)}x`, 50)).toBe(true); // 1 + 48 + 1 = 50 bytes
+  });
+
+  it('continues to accept ! in a channel name', () => {
+    expect(isValidChannelName('#foo!bar', 50)).toBe(true);
+  });
+
+  it('continues to accept @ in a channel name', () => {
+    expect(isValidChannelName('#foo@bar', 50)).toBe(true);
+  });
+
   it('rejects a name exceeding the length cap', () => {
     expect(isValidChannelName(`#${'a'.repeat(50)}`, 50)).toBe(false);
   });
@@ -395,6 +420,58 @@ describe('joinReducer — rejections', () => {
     ]);
   });
 
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing NUL', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: ['#foo\0bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\0bar :No such channel')]),
+    ]);
+    expect(out.state.members.has('c1')).toBe(false);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing a control character', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: ['#foo\x01bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\x01bar :No such channel')]),
+    ]);
+    expect(out.state.members.has('c1')).toBe(false);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name whose UTF-8 byte size exceeds the cap', () => {
+    const long = `#${'é'.repeat(25)}`; // 51 UTF-8 bytes, only 26 UTF-16 units
+    const chan = makeChan(long);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: [long], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(`:irc.example.com 403 alice ${long} :No such channel`)]),
+    ]);
+    expect(out.state.members.has('c1')).toBe(false);
+  });
+
+  it('joins a multi-byte channel name at exactly the 50-byte cap', () => {
+    const name = `#${'é'.repeat(24)}x`; // 1 + 48 + 1 = 50 UTF-8 bytes
+    const chan = makeChan(name);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: [name], tags: {} }, ctx);
+
+    expect(out.state.members.has('c1')).toBe(true);
+    expect(conn.joinedChannels.has(name.toLowerCase())).toBe(true);
+  });
+
   it('emits 405 ERR_TOOMANYCHANNELS when the connection is at the max-channels limit', () => {
     const chan = makeChan('#newchan');
     const conn = makeConn();

package/packages/irc-core/tests/commands/names.test.ts

@@ -3,6 +3,7 @@ import { namesReducer } from '../../src/commands/names';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import { byteLength } from '../../src/protocol/bytes';
 import { type ChannelState, createChannel } from '../../src/state/channel';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
@@ -238,6 +239,43 @@ describe('namesReducer — rejections', () => {
     ]);
   });
 
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing NUL', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo\0bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\0bar :No such channel')]),
+    ]);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing a control character', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo\x1fbar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\x1fbar :No such channel')]),
+    ]);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name whose UTF-8 byte size exceeds the cap', () => {
+    const long = `#${'é'.repeat(25)}`; // 51 UTF-8 bytes, only 26 UTF-16 units
+    const chan = makeChan(long);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: [long], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(`:irc.example.com 403 alice ${long} :No such channel`)]),
+    ]);
+  });
+
   it('emits 403 ERR_NOSUCHCHANNEL for an empty channel name', () => {
     const chan = makeChan('#foo');
     const conn = makeConn();
@@ -340,3 +378,158 @@ describe('namesReducer — rejections', () => {
     ]);
   });
 });
+
+// ============================================================================
+// namesReducer — long NAMES list splitting (RFC 2812 §3.2.5)
+// ============================================================================
+
+/** RFC 1459 §2.3: 512-byte line budget minus the trailing CRLF pair. */
+const MAX_TEXT_BYTES = 510;
+
+describe('namesReducer — long NAMES list splitting', () => {
+  /** Returns the Send effect's lines, or [] when the first effect is not a Send. */
+  function sentLines(out: { effects: EffectType[] }): RawLine[] {
+    const send = out.effects[0];
+    return send?.tag === 'Send' ? send.lines : [];
+  }
+
+  /** Returns the trailing parameter of a formatted numeric line (after the last ` :`). */
+  function trailingOf(text: string): string {
+    const idx = text.lastIndexOf(' :');
+    return idx === -1 ? '' : text.slice(idx + 2);
+  }
+
+  /** Returns only the 353 RPL_NAMREPLY lines, in order. */
+  function namReplyLines(lines: RawLine[]): RawLine[] {
+    return lines.filter((l) => l.text.includes(' 353 '));
+  }
+
+  function pad(i: number): string {
+    return i.toString().padStart(3, '0');
+  }
+
+  it('splits a 100-member roster across multiple complete 353 lines within the byte budget', () => {
+    const chan = makeChan('#foo');
+    const expected: string[] = [];
+    for (let i = 1; i <= 100; i++) {
+      const nick = `user${pad(i)}`;
+      addMember(chan, `c${i}`, nick);
+      expected.push(nick);
+    }
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    const replies = namReplyLines(lines);
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    // No mid-nick truncation: the roster survives intact, in order, across lines.
+    expect(replies.map((l) => trailingOf(l.text)).join(' ')).toBe(expected.join(' '));
+    // Exactly one 366 terminator, emitted after the final 353.
+    const endLines = lines.filter((l) => l.text.includes(' 366 '));
+    expect(endLines.length).toBe(1);
+    expect(lines[lines.length - 1]?.text).toBe(
+      ':irc.example.com 366 alice #foo :End of /NAMES list.',
+    );
+  });
+
+  it('counts @/+ prefix bytes in the budget: no non-final 353 could have taken the next member', () => {
+    const chan = makeChan('#foo');
+    const expected: string[] = [];
+    for (let i = 1; i <= 100; i++) {
+      const nick = `user${pad(i)}`;
+      // Alternating op (`@userNNN`, 8 bytes) and op+voice (`@+userNNN`, 9 bytes).
+      addMember(chan, `c${i}`, nick, true, i % 2 === 0);
+      expected.push(i % 2 === 0 ? `@+${nick}` : `@${nick}`);
+    }
+    const conn = makeConn();
+    conn.caps.add('multi-prefix');
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    const replies = namReplyLines(lines);
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    // Roster intact with prefixes.
+    expect(replies.map((l) => trailingOf(l.text)).join(' ')).toBe(expected.join(' '));
+    // Greedy maximality: appending the next line's first (prefixed) member to
+    // any non-final line would blow the budget — proof the prefix bytes were
+    // counted, not just the bare nicks.
+    for (let i = 0; i + 1 < replies.length; i++) {
+      const cur = replies[i]?.text ?? '';
+      const nextFirst = trailingOf(replies[i + 1]?.text ?? '').split(' ')[0] ?? '';
+      expect(nextFirst.length).toBeGreaterThan(0);
+      expect(byteLength(`${cur} ${nextFirst}`)).toBeGreaterThan(MAX_TEXT_BYTES);
+    }
+  });
+
+  it('measures the budget in UTF-8 bytes: multi-byte nicks split even when UTF-16 units fit', () => {
+    const chan = makeChan('#foo');
+    const nick = 'é'.repeat(60); // 60 UTF-16 units but 120 UTF-8 bytes per nick
+    for (let i = 1; i <= 7; i++) {
+      addMember(chan, `c${i}`, nick);
+    }
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    const replies = namReplyLines(lines);
+    // Names alone: 7*120 + 6 = 846 bytes (but only 426 UTF-16 units) — a
+    // code-unit-based packer would emit one 881-byte line.
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    expect(replies.map((l) => trailingOf(l.text)).join(' ')).toBe(
+      Array<string>(7).fill(nick).join(' '),
+    );
+  });
+
+  it('emits exactly one 353 with an empty trailing + the 366 for a zero-member channel', () => {
+    const chan = makeChan('#foo'); // roster is completely empty
+    const conn = makeConn(); // requester is not a member either
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    expect(sentLines(out)).toEqual<RawLine[]>([
+      L(':irc.example.com 353 alice = #foo :'),
+      L(':irc.example.com 366 alice #foo :End of /NAMES list.'),
+    ]);
+  });
+
+  it('wraps every split 353 line plus the 366 inside one BATCH frame when batch is negotiated', () => {
+    const chan = makeChan('#foo');
+    for (let i = 1; i <= 100; i++) {
+      addMember(chan, `c${i}`, `user${pad(i)}`);
+    }
+    const conn = makeConn();
+    conn.caps.add('batch');
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    expect(lines[0]?.text).toBe('BATCH +batch-0 names');
+    expect(lines[lines.length - 1]?.text).toBe('BATCH -batch-0');
+    const inner = lines.slice(1, -1);
+    const replies = namReplyLines(inner);
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    expect(inner[inner.length - 1]?.text).toBe(
+      ':irc.example.com 366 alice #foo :End of /NAMES list.',
+    );
+  });
+});

package/packages/irc-core/tests/commands/nickserv.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest';
 import { NICKSERV_NICK, enforceRegisteredNick, nickservReducer } from '../../src/commands/nickserv';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType } from '../../src/effects';
-import type { ServicesStore } from '../../src/ports';
+import type { ServicesAuthResult, ServicesStore } from '../../src/ports';
 import {
   EmptyMotdProvider,
   FakeClock,
@@ -41,9 +41,10 @@ function makeCtx(
   state: ConnectionState,
   services?: ServicesStore,
   clock = new FakeClock(NOW),
+  configOverrides: Partial<ServerConfig> = {},
 ): Ctx {
   return buildCtx({
-    serverConfig,
+    serverConfig: { ...serverConfig, ...configOverrides },
     clock,
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
@@ -283,6 +284,185 @@ describe('nickservReducer — IDENTIFY', () => {
   });
 });
 
+/**
+ * InMemoryServicesStore subclass that counts `verifyNick` calls so the
+ * identify-freeze tests can assert the frozen attempt is rejected BEFORE
+ * scrypt runs (the freeze must short-circuit the verification path).
+ */
+class VerifyCountingStore extends InMemoryServicesStore {
+  verifyCalls = 0;
+  override verifyNick(nick: string, password: string): ServicesAuthResult {
+    this.verifyCalls++;
+    return super.verifyNick(nick, password);
+  }
+}
+
+describe('nickservReducer — IDENTIFY freeze (per-account throttle)', () => {
+  it('short-circuits the 6th failed IDENTIFY with a freeze notice (no scrypt)', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(services.verifyCalls).toBe(5);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+  });
+
+  it('lifts the freeze once the failures age out of the 300s window', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    // Exactly at the window boundary the failures have aged out.
+    clock.advance(300_000);
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(services.verifyCalls).toBe(6);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+  });
+
+  it('keeps the freeze while the failures are still inside the window', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    clock.advance(300_000 - 1);
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(services.verifyCalls).toBe(5);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+  });
+
+  it('delivers a queued owner NOTICE on the next successful identify after the freeze', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    clock.advance(300_000);
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Warning: 5 failed identify attempts recorded against your account since your last successful login.',
+    );
+
+    // The notice is delivered once — a second successful identify (fresh
+    // connection) does not repeat it.
+    const conn2 = makeConn('c2', 'alice');
+    const ctx2 = makeCtx(conn2, services, clock);
+    const out2 = nickservReducer(conn2, privmsg('IDENTIFY hunter2'), ctx2);
+    expect(sentTexts(out2.effects).some((t) => t.includes('Warning:'))).toBe(false);
+  });
+
+  it('delivers the owner NOTICE with singular wording for a single failed identify', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Warning: 1 failed identify attempt recorded against your account since your last successful login.',
+    );
+  });
+
+  it('resets the failure counter on a successful identify', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 3; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    // Fresh connection (the first is now identified). Without a reset the
+    // counter would still hold 3 failures and the account would freeze
+    // after only 2 more; with the reset all 5 new attempts must reach
+    // scrypt and return the plain invalid-password notice.
+    const conn2 = makeConn('c2', 'alice');
+    const ctx2 = makeCtx(conn2, services, clock);
+    for (let i = 0; i < 5; i++) {
+      const out = nickservReducer(conn2, privmsg('IDENTIFY wrongpass'), ctx2);
+      expect(sentTexts(out.effects)).toContain(
+        ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+      );
+    }
+    expect(services.verifyCalls).toBe(3 + 1 + 5);
+
+    // The 6th new failure crosses the (reset) threshold → frozen.
+    const frozen = nickservReducer(conn2, privmsg('IDENTIFY wrongpass'), ctx2);
+    expect(services.verifyCalls).toBe(9);
+    expect(sentTexts(frozen.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+  });
+
+  it('honours nickServ.maxIdentifyFailures and identifyFreezeSeconds overrides', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock, {
+      nickServ: { maxIdentifyFailures: 2, identifyFreezeSeconds: 60 },
+    });
+
+    nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    const second = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    expect(services.verifyCalls).toBe(2);
+    expect(sentTexts(second.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+
+    // Threshold 2 reached → the next attempt is frozen without scrypt.
+    const frozen = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    expect(services.verifyCalls).toBe(2);
+    expect(sentTexts(frozen.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+
+    // The configured 60s window ages the failures out sooner than default.
+    clock.advance(60_000);
+    const after = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    expect(services.verifyCalls).toBe(3);
+    expect(sentTexts(after.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+  });
+});
+
 describe('nickservReducer — ID (alias for IDENTIFY)', () => {
   it('sets +r and account on correct password (ID <password>)', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });