serverless-ircd 0.10.0 → 0.11.0

package/packages/irc-core/tests/config.test.ts

@@ -4,6 +4,7 @@ import {
   DEFAULT_CREATED_TEXT,
   ServerConfigSchema,
   formatCreatedAt,
+  narrowOperCred,
   parseServerConfig,
   resolveServerVersion,
 } from '../src/config';
@@ -327,7 +328,8 @@ describe('ServerConfigSchema — operCreds', () => {
     });
     expect(cfg.operCreds).toHaveLength(2);
     expect(cfg.operCreds[0]?.user).toBe('op1');
-    expect(cfg.operCreds[1]?.password).toBe('p2');
+    const second = cfg.operCreds[1];
+    expect(second !== undefined && 'password' in second ? second.password : undefined).toBe('p2');
   });
 
   it('defaults operCreds to an empty array when omitted', () => {
@@ -384,6 +386,120 @@ describe('ServerConfigSchema — operCreds', () => {
       }),
     ).toThrowError(/operCreds/u);
   });
+
+  it('accepts the new hashed form {user, salt, hash}', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      operCreds: [{ user: 'admin', salt: 'c2FsdA==', hash: 'aGFzaA==' }],
+    });
+    expect(cfg.operCreds).toHaveLength(1);
+    expect(cfg.operCreds[0]).toEqual({
+      user: 'admin',
+      salt: 'c2FsdA==',
+      hash: 'aGFzaA==',
+    });
+  });
+
+  it('accepts a mix of legacy plaintext and hashed creds', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      operCreds: [
+        { user: 'legacy', password: 'p' },
+        { user: 'hashed', salt: 'c2FsdA==', hash: 'aGFzaA==' },
+      ],
+    });
+    expect(cfg.operCreds).toHaveLength(2);
+  });
+
+  it('rejects a hashed cred missing salt', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', hash: 'aGFzaA==' }],
+      }),
+    ).toThrowError(/salt/u);
+  });
+
+  it('rejects a hashed cred missing hash', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', salt: 'c2FsdA==' }],
+      }),
+    ).toThrowError(/hash/u);
+  });
+
+  it('rejects a hashed cred with empty salt', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', salt: '', hash: 'aGFzaA==' }],
+      }),
+    ).toThrowError(/salt/u);
+  });
+
+  it('rejects a hashed cred with empty hash', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', salt: 'c2FsdA==', hash: '' }],
+      }),
+    ).toThrowError(/hash/u);
+  });
+
+  it('rejects a cred that mixes plaintext password and hashed salt/hash', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', password: 'p', salt: 'c2FsdA==', hash: 'aGFzaA==' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('rejects a cred that mixes plaintext password with only salt', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', password: 'p', salt: 'c2FsdA==' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+});
+
+// ============================================================================
+// narrowOperCred — loose parse output → OperCred union narrowing
+// ============================================================================
+
+describe('narrowOperCred', () => {
+  it('narrows to the plaintext shape when password is present', () => {
+    expect(narrowOperCred({ user: 'op', password: 'p' })).toEqual({
+      user: 'op',
+      password: 'p',
+    });
+  });
+
+  it('narrows to the hashed shape when salt + hash are present', () => {
+    expect(narrowOperCred({ user: 'op', salt: 's', hash: 'h' })).toEqual({
+      user: 'op',
+      salt: 's',
+      hash: 'h',
+    });
+  });
+
+  it('is total: a bare {user} input falls back to empty salt/hash (defensive only)', () => {
+    // Unreachable through parseServerConfig (the superRefine rejects a
+    // cred with no authentication fields); asserted so the defensive
+    // fallback branch is covered and the helper is total.
+    expect(narrowOperCred({ user: 'op' })).toEqual({ user: 'op', salt: '', hash: '' });
+  });
 });
 
 // ============================================================================
@@ -516,6 +632,41 @@ describe('ServerConfigSchema — limit knobs', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — draft/multiline limits
+// ============================================================================
+
+describe('ServerConfigSchema — draft/multiline limits', () => {
+  it('defaults multilineMaxBytes to the IRCv3-recommended 4096', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.multilineMaxBytes).toBe(4096);
+  });
+
+  it('defaults multilineMaxEntries to 100 (defense-in-depth entry cap)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.multilineMaxEntries).toBe(100);
+  });
+
+  it('accepts a custom multilineMaxEntries', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      multilineMaxEntries: 250,
+    });
+    expect(cfg.multilineMaxEntries).toBe(250);
+  });
+
+  it('rejects non-positive multilineMaxEntries', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        multilineMaxEntries: 0,
+      }),
+    ).toThrowError(/multilineMaxEntries/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — failure diagnostics
 // ============================================================================
@@ -830,6 +981,56 @@ describe('ServerConfigSchema — perIpConnectionRate', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — oper (failed-OPER lockout tunables)
+// ============================================================================
+
+describe('ServerConfigSchema — oper lockout tunables', () => {
+  it('defaults oper.maxFailures to 3 and oper.failureWindowSeconds to 300 when omitted', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.oper).toEqual({ maxFailures: 3, failureWindowSeconds: 300 });
+  });
+
+  it('accepts explicit positive integers for both fields', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      oper: { maxFailures: 5, failureWindowSeconds: 60 },
+    });
+    expect(cfg.oper).toEqual({ maxFailures: 5, failureWindowSeconds: 60 });
+  });
+
+  it('rejects zero maxFailures', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        oper: { maxFailures: 0, failureWindowSeconds: 300 },
+      }),
+    ).toThrowError(/maxFailures/u);
+  });
+
+  it('rejects a non-integer failureWindowSeconds', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        oper: { maxFailures: 3, failureWindowSeconds: 1.5 },
+      }),
+    ).toThrowError(/failureWindowSeconds/u);
+  });
+
+  it('rejects a non-object oper value', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        oper: 'strict',
+      }),
+    ).toThrowError(/oper/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — sts (Strict Transport Security)
 // ============================================================================
@@ -909,6 +1110,56 @@ describe('ServerConfigSchema — sts', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — chathistory (limit ceiling)
+// ============================================================================
+
+describe('ServerConfigSchema — chathistory limit ceiling', () => {
+  it('defaults chathistory.maxLimit to 100 when omitted', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.chathistory).toEqual({ maxLimit: 100 });
+  });
+
+  it('accepts an explicit positive integer maxLimit', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      chathistory: { maxLimit: 250 },
+    });
+    expect(cfg.chathistory?.maxLimit).toBe(250);
+  });
+
+  it('rejects zero maxLimit', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        chathistory: { maxLimit: 0 },
+      }),
+    ).toThrowError(/maxLimit/u);
+  });
+
+  it('rejects a non-integer maxLimit', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        chathistory: { maxLimit: 1.5 },
+      }),
+    ).toThrowError(/maxLimit/u);
+  });
+
+  it('rejects a non-object chathistory value', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        chathistory: 'unlimited',
+      }),
+    ).toThrowError(/chathistory/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — hostservAutoApproveVhosts
 // ============================================================================
@@ -919,11 +1170,12 @@ describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
     expect(cfg.hostservAutoApproveVhosts).toBe(false);
   });
 
-  it('accepts an explicit true (auto-approve mode)', () => {
+  it('accepts an explicit true (auto-approve mode) with a non-empty allowlist', () => {
     const cfg = parseServerConfig({
       serverName: 's',
       networkName: 'n',
       hostservAutoApproveVhosts: true,
+      hostservAutoApproveAllowlist: ['users.example.com'],
     });
     expect(cfg.hostservAutoApproveVhosts).toBe(true);
   });
@@ -937,6 +1189,73 @@ describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
     expect(cfg.hostservAutoApproveVhosts).toBe(false);
   });
 
+  it('refuses to boot auto-approve mode when the allowlist is omitted', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveVhosts: true,
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
+  it('refuses to boot auto-approve mode when the allowlist is empty', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveVhosts: true,
+        hostservAutoApproveAllowlist: [],
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
+  it('accepts auto-approve mode when the allowlist is non-empty', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      hostservAutoApproveVhosts: true,
+      hostservAutoApproveAllowlist: ['users.example.com'],
+    });
+    expect(cfg.hostservAutoApproveVhosts).toBe(true);
+    expect(cfg.hostservAutoApproveAllowlist).toEqual(['users.example.com']);
+  });
+
+  it('defaults the allowlist to empty in queue mode (allowlist unconstrained)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.hostservAutoApproveAllowlist).toEqual([]);
+  });
+
+  it('accepts a non-empty allowlist even in queue mode (unused but legal)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      hostservAutoApproveVhosts: false,
+      hostservAutoApproveAllowlist: ['a.example.com', '*.b.example.com'],
+    });
+    expect(cfg.hostservAutoApproveAllowlist).toEqual(['a.example.com', '*.b.example.com']);
+  });
+
+  it('rejects an allowlist entry that is not a non-empty string', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveAllowlist: [''],
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
+  it('rejects a non-array allowlist', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveAllowlist: 'users.example.com',
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
   it('rejects a non-boolean value', () => {
     expect(() =>
       parseServerConfig({
@@ -947,3 +1266,216 @@ describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
     ).toThrowError(/hostservAutoApproveVhosts/u);
   });
 });
+
+// ============================================================================
+// ServerConfigSchema — sasl (per-connection failure lockout tunables)
+// ============================================================================
+
+describe('ServerConfigSchema — sasl', () => {
+  it('defaults sasl to undefined when omitted (reducer falls back to 3 / 60)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.sasl).toBeUndefined();
+  });
+
+  it('accepts an explicit sasl config with maxFailures + failureWindowSeconds', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { maxFailures: 5, failureWindowSeconds: 120 },
+    });
+    expect(cfg.sasl).toEqual({ maxFailures: 5, failureWindowSeconds: 120 });
+  });
+
+  it('accepts a partial sasl config (each knob is independently optional)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { maxFailures: 2 },
+    });
+    expect(cfg.sasl).toEqual({ maxFailures: 2 });
+  });
+
+  it('leaves externalEnabled unset when the sasl section is absent (EXTERNAL off)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.sasl?.externalEnabled ?? false).toBe(false);
+  });
+
+  it('accepts sasl.externalEnabled true (operators opt in to SASL EXTERNAL)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { externalEnabled: true },
+    });
+    expect(cfg.sasl?.externalEnabled).toBe(true);
+  });
+
+  it('leaves externalEnabled unset within a partial sasl section (other knobs alone do not enable it)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { maxFailures: 5, failureWindowSeconds: 120 },
+    });
+    expect(cfg.sasl?.externalEnabled ?? false).toBe(false);
+  });
+
+  it('accepts sasl.externalEnabled false (explicit opt-out)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { externalEnabled: false },
+    });
+    expect(cfg.sasl?.externalEnabled).toBe(false);
+  });
+
+  it('rejects a non-boolean externalEnabled', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { externalEnabled: 'yes' } }),
+    ).toThrowError(/externalEnabled/u);
+  });
+
+  it('accepts sasl.externalUnsupportedMessage (transport-level EXTERNAL non-support)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { externalUnsupportedMessage: 'SASL EXTERNAL not supported on this transport' },
+    });
+    expect(cfg.sasl?.externalUnsupportedMessage).toBe(
+      'SASL EXTERNAL not supported on this transport',
+    );
+  });
+
+  it('rejects an empty-string externalUnsupportedMessage', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        sasl: { externalUnsupportedMessage: '' },
+      }),
+    ).toThrowError(/externalUnsupportedMessage/u);
+  });
+
+  it('rejects a non-string externalUnsupportedMessage', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        sasl: { externalUnsupportedMessage: 42 },
+      }),
+    ).toThrowError(/externalUnsupportedMessage/u);
+  });
+
+  it('rejects a zero maxFailures', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { maxFailures: 0 } }),
+    ).toThrowError(/sasl/u);
+  });
+
+  it('rejects a zero failureWindowSeconds', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { failureWindowSeconds: 0 } }),
+    ).toThrowError(/sasl/u);
+  });
+
+  it('rejects a non-number maxFailures', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { maxFailures: '3' } }),
+    ).toThrowError(/sasl/u);
+  });
+
+  it('rejects a non-object sasl value', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: 'PLAIN' }),
+    ).toThrowError(/sasl/u);
+  });
+});
+
+// ============================================================================
+// ServerConfigSchema — nickServ identify-freeze knobs
+// ============================================================================
+
+describe('ServerConfigSchema — nickServ identify freeze', () => {
+  it('leaves the freeze knobs unset when omitted (reducer applies defaults)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.nickServ?.maxIdentifyFailures).toBeUndefined();
+    expect(cfg.nickServ?.identifyFreezeSeconds).toBeUndefined();
+  });
+
+  it('accepts explicit maxIdentifyFailures + identifyFreezeSeconds', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      nickServ: { maxIdentifyFailures: 3, identifyFreezeSeconds: 120 },
+    });
+    expect(cfg.nickServ?.maxIdentifyFailures).toBe(3);
+    expect(cfg.nickServ?.identifyFreezeSeconds).toBe(120);
+  });
+
+  it('rejects a non-positive maxIdentifyFailures', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        nickServ: { maxIdentifyFailures: 0 },
+      }),
+    ).toThrowError(/maxIdentifyFailures/u);
+  });
+
+  it('rejects a non-integer identifyFreezeSeconds', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        nickServ: { identifyFreezeSeconds: 1.5 },
+      }),
+    ).toThrowError(/identifyFreezeSeconds/u);
+  });
+});
+
+// ============================================================================
+// ServerConfigSchema — adapter inbound frame-rate limit
+// ============================================================================
+
+describe('ServerConfigSchema — adapter frame-rate limit', () => {
+  it('defaults the adapter frame window to 50 frames / 5 seconds', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.adapter).toEqual({ maxFramesPerWindow: 50, frameWindowSeconds: 5 });
+  });
+
+  it('accepts explicit adapter frame-window overrides', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      adapter: { maxFramesPerWindow: 10, frameWindowSeconds: 2 },
+    });
+    expect(cfg.adapter).toEqual({ maxFramesPerWindow: 10, frameWindowSeconds: 2 });
+  });
+
+  it('fills a partially-supplied adapter section with per-field defaults', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      adapter: { frameWindowSeconds: 30 },
+    });
+    expect(cfg.adapter).toEqual({ maxFramesPerWindow: 50, frameWindowSeconds: 30 });
+  });
+
+  it('rejects a non-positive maxFramesPerWindow', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        adapter: { maxFramesPerWindow: 0 },
+      }),
+    ).toThrowError(/maxFramesPerWindow/u);
+  });
+
+  it('rejects a non-integer frameWindowSeconds', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        adapter: { frameWindowSeconds: 1.5 },
+      }),
+    ).toThrowError(/frameWindowSeconds/u);
+  });
+});

package/packages/irc-core/tests/effects.test.ts

@@ -95,6 +95,18 @@ describe('Effect constructors', () => {
     });
   });
 
+  it('BroadcastOperNotice carries lines and optional except', () => {
+    expect(Effect.broadcastOperNotice([line(':s NOTICE * :lockout')])).toEqual<EffectType>({
+      tag: 'BroadcastOperNotice',
+      lines: [{ text: ':s NOTICE * :lockout' }],
+    });
+    expect(Effect.broadcastOperNotice([line(':s NOTICE * :lockout')], 'c1')).toEqual<EffectType>({
+      tag: 'BroadcastOperNotice',
+      lines: [{ text: ':s NOTICE * :lockout' }],
+      except: 'c1',
+    });
+  });
+
   it('EnforceNick carries conn, nick, policy, and graceMs', () => {
     expect(Effect.enforceNick('c1', 'alice', 'kill', 0)).toEqual<EffectType>({
       tag: 'EnforceNick',
@@ -125,6 +137,7 @@ describe('Effect tag set', () => {
     'ApplyChannelDelta',
     'SendToNick',
     'BroadcastWallops',
+    'BroadcastOperNotice',
     'EnforceNick',
   ];
 
@@ -139,6 +152,7 @@ describe('Effect tag set', () => {
       ApplyChannelDelta: Effect.applyChannelDelta('#c', { memberships: [] }),
       SendToNick: Effect.sendToNick('n', 'c', []),
       BroadcastWallops: Effect.broadcastWallops([]),
+      BroadcastOperNotice: Effect.broadcastOperNotice([]),
       EnforceNick: Effect.enforceNick('c', 'n', 'none', 0),
     };
     expect(constructors[tag].tag).toBe(tag);

package/packages/irc-core/tests/flood-control.test.ts

@@ -286,13 +286,41 @@ describe('wrapWithFloodControl — generic over inner state', () => {
 
 describe('wrapWithFloodControl — per-command cost (commandCost)', () => {
   it('defaultCommandCost returns 0 for the control-plane exempt set and 1 otherwise', () => {
-    for (const command of ['PING', 'PONG', 'CAP', 'AUTHENTICATE', 'QUIT']) {
+    for (const command of ['PING', 'PONG', 'CAP', 'QUIT']) {
       expect(defaultCommandCost(command)).toBe(0);
     }
     expect(defaultCommandCost('PRIVMSG')).toBe(1);
     expect(defaultCommandCost('JOIN')).toBe(1);
   });
 
+  it('AUTHENTICATE is NOT exempt — it consumes the default flood bucket', () => {
+    // SASL brute-force hardening: an attacker spamming AUTHENTICATE must
+    // not get a free pass. The per-connection SASL failure tracker in the
+    // SASL reducer is the second, orthogonal defense.
+    expect(defaultCommandCost('AUTHENTICATE')).toBe(1);
+  });
+
+  it('an AUTHENTICATE burst drains the bucket like PRIVMSG would', () => {
+    const state = makeState();
+    const clock = new FakeClock(1_000);
+    const ctx = makeCtx(state, clock);
+    const inner = countingReducer();
+    const wrapped = wrapWithFloodControl(inner.reducer, {
+      capacity: 2,
+      refillRatePerSecond: 1,
+      disconnectThreshold: 0,
+      commandCost: defaultCommandCost,
+    });
+
+    wrapped(state, ircMessage('AUTHENTICATE', ['PLAIN']), ctx);
+    wrapped(state, ircMessage('AUTHENTICATE', ['dGVzdA==']), ctx);
+    expect(inner.getCalls()).toBe(2);
+
+    const out = wrapped(state, ircMessage('AUTHENTICATE', ['*']), ctx);
+    expect(out.effects).toEqual<EffectType[]>([Effect.disconnect('c1', EXCESS_FLOOD_REASON)]);
+    expect(inner.getCalls()).toBe(2);
+  });
+
   it('delegates a cost-0 PING to the inner reducer even when the bucket is exhausted', () => {
     const state = makeState();
     const clock = new FakeClock(1_000);