serverless-ircd 0.10.0 → 0.11.0

package/packages/irc-core/tests/commands/registration.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import pkg from '../../package.json' with { type: 'json' };
 import { cloakHost } from '../../src/cloak';
 import {
@@ -13,6 +13,8 @@ import {
   isValidNick,
   nickReducer,
   passReducer,
+  resetServerPasswordCompareSpy,
+  setServerPasswordCompare,
   userReducer,
 } from '../../src/commands/registration';
 import { DEFAULT_CREATED_TEXT } from '../../src/config';
@@ -548,6 +550,340 @@ describe('userReducer', () => {
   });
 });
 
+// ============================================================================
+// userReducer — USER validation (charset + length + control chars)
+// ============================================================================
+
+/**
+ * Builds the expected NOTICE line for a USER rejection addressed to the
+ * connection's current nick (or `*` when unregistered).
+ */
+function userRejectNotice(nick: string, text: string): RawLine {
+  return L(`:irc.example.com NOTICE ${nick} :${text}`);
+}
+
+/** Username-rejection NOTICE text (matches the reducer's tailored notice). */
+const USERNAME_INVALID_TEXT =
+  'Invalid USER: username must be 1-16 bytes with no spaces, !, @, or control characters';
+
+/** Realname-rejection NOTICE text (matches the reducer's tailored notice). */
+const REALNAME_INVALID_TEXT =
+  'Invalid USER: realname must be at most 64 bytes with no control characters';
+
+describe('userReducer — USER validation (charset + length)', () => {
+  // ------------------------------------------------------------------------
+  // Username charset rejections (params[0])
+  // ------------------------------------------------------------------------
+
+  it('rejects a username containing "!" with NOTICE + Disconnect (hostmask safety)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al!ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.state.realname).toBeUndefined();
+    expect(out.state.registration).toBe('pre-registration');
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing "@" with NOTICE + Disconnect (hostmask safety)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al@ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a space with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing NUL (\\0) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\0ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a bare CR (\\r) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\rce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a bare LF (\\n) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\nce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a control char (\\x01) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\x01ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  // ------------------------------------------------------------------------
+  // Username length rejection (USERLEN = 16 byte cap)
+  // ------------------------------------------------------------------------
+
+  it('rejects a 17-byte username with NOTICE + Disconnect (USERLEN = 16)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const longUser = 'a'.repeat(17);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: [longUser, '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('accepts a username at exactly the 16-byte USERLEN cap (boundary)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const exactUser = 'a'.repeat(16);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: [exactUser, '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBe(exactUser);
+    expect(out.state.realname).toBe('Alice');
+  });
+
+  // ------------------------------------------------------------------------
+  // Realname charset rejections (params[3])
+  // ------------------------------------------------------------------------
+
+  it('rejects a realname containing NUL (\\0) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\0ice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a realname containing a bare CR (\\r) with NOTICE + Disconnect (CRLF injection)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\rice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a realname containing a bare LF (\\n) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\nice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a realname containing a control char (\\x01) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\x01ice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  // ------------------------------------------------------------------------
+  // Realname length rejection (REALLEN = 64 byte cap, multi-byte aware)
+  // ------------------------------------------------------------------------
+
+  it('rejects a 65-byte realname with NOTICE + Disconnect (REALLEN = 64)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const longReal = 'A'.repeat(65);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', longReal], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a multi-byte UTF-8 realname exceeding the 64-byte budget', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    // Each '€' is 3 bytes in UTF-8; 22 × 3 = 66 bytes > 64.
+    const overBudget = '€'.repeat(22);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', overBudget], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('accepts a multi-byte UTF-8 realname within the 64-byte budget (regression guard)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    // 21 × 3 = 63 bytes ≤ 64.
+    const withinBudget = '€'.repeat(21);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', withinBudget], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBe('alice');
+    expect(out.state.realname).toBe(withinBudget);
+  });
+
+  it('accepts a realname at exactly the 64-byte REALLEN cap (boundary)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const exactReal = 'A'.repeat(64);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', exactReal], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBe(exactReal);
+  });
+
+  it('does not half-store state when the username is valid but the realname is invalid', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\rice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.state.realname).toBeUndefined();
+  });
+
+  it('uses the current nick (not *) in the rejection NOTICE when partially registered', () => {
+    const state = makeState();
+    state.nick = 'bob';
+    state.registration = 'registering';
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['b!ob', '0', '*', 'Bob'], tags: {} },
+      ctx,
+    );
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('bob', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('still allows a realname containing spaces (valid realname)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Alice Wonderland'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBe('alice');
+    expect(out.state.realname).toBe('Alice Wonderland');
+  });
+});
+
 // ============================================================================
 // passReducer
 // ============================================================================
@@ -1097,6 +1433,132 @@ describe('emitWelcomeIfReady — server-password gate', () => {
   });
 });
 
+// ============================================================================
+// server-password gate — constant-time comparison
+// ----------------------------------------------------------------------------
+
+/**
+ * Runs one gate evaluation against the configured password `s3cret` and
+ * returns the effects, so the tests below can focus on comparator calls.
+ */
+function runGate(passAttempt: string | undefined): EffectType[] {
+  const state = makeState();
+  state.nick = 'alice';
+  state.user = 'alice';
+  if (passAttempt !== undefined) state.passAttempt = passAttempt;
+  return emitWelcomeIfReady(state, makeCtxWithPassword(state, 's3cret'));
+}
+
+/**
+ * Installs a call-counting comparator that behaves like string equality so
+ * gate outcomes stay behavioral while the delegation is observable.
+ */
+function installCountingCompare(): ReturnType<typeof vi.fn> {
+  const compare = vi.fn((a: string, b: string) => a === b);
+  setServerPasswordCompare(compare);
+  return compare;
+}
+
+describe('passwordGateFailure — constant-time comparison', () => {
+  afterEach(() => {
+    resetServerPasswordCompareSpy();
+  });
+
+  it('compares the attempt against the configured password via constantTimeEquals', () => {
+    const compare = installCountingCompare();
+    try {
+      runGate('wrong');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(compare).toHaveBeenCalledWith('wrong', 's3cret');
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares exactly once on the equal-password bucket (gate satisfied)', () => {
+    const compare = installCountingCompare();
+    try {
+      const effects = runGate('s3cret');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares exactly once on the same-length unequal bucket (464 + Disconnect)', () => {
+    const compare = installCountingCompare();
+    try {
+      const effects = runGate('X3cret');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password mismatch')]),
+        Effect.disconnect('c1', 'Bad Password'),
+      ]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares exactly once on the different-length bucket — no length pre-check bypass', () => {
+    const compare = installCountingCompare();
+    try {
+      const effects = runGate('s3cr');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(compare).toHaveBeenCalledWith('s3cr', 's3cret');
+      expect(effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password mismatch')]),
+        Effect.disconnect('c1', 'Bad Password'),
+      ]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares the empty placeholder once when no PASS was sent', () => {
+    const compare = installCountingCompare();
+    try {
+      runGate(undefined);
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(compare).toHaveBeenCalledWith('', 's3cret');
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('does not compare when the gate is satisfied by SASL (account set)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice';
+    const compare = installCountingCompare();
+    try {
+      const effects = emitWelcomeIfReady(state, makeCtxWithPassword(state, 's3cret'));
+      expect(compare).not.toHaveBeenCalled();
+      expect(state.registration).toBe('registered');
+      expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('does not compare when no server password is configured (gate disabled)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const compare = installCountingCompare();
+    try {
+      const ctx = makeCtxWithPassword(state, '');
+      const effects = emitWelcomeIfReady(state, ctx);
+      expect(compare).not.toHaveBeenCalled();
+      expect(state.registration).toBe('registered');
+      expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+});
+
 // ============================================================================
 // userReducer / nickReducer — server-password gate integration
 // ============================================================================