serverless-ircd 0.10.0 → 0.11.0

package/tools/hash-oper-cred.ts

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+/**
+ * Hash a plaintext `{user, password}` oper credential into the at-rest
+ * `{user, salt, hash}` shape operators paste into secrets / wrangler
+ * vars / Lambda env.
+ *
+ * Output (JSON to stdout) is directly assignable to the `operCreds`
+ * array on `ServerConfig`. The salt is cryptographically random per
+ * invocation; re-running with the same password produces a different
+ * salt (and therefore a different hash) — that is intentional.
+ *
+ * Usage:
+ *   node --import tsx tools/hash-oper-cred.ts --user admin --password s3cret
+ *
+ * Or read the password from stdin so it never lands in shell history:
+ *   echo 's3cret' | node --import tsx tools/hash-oper-cred.ts --user admin --stdin
+ *
+ * The script NEVER prints the plaintext password to stdout. Operators
+ * paste the resulting `{user, salt, hash}` object into:
+ *   - Cloudflare: a wrangler secret / `vars.OPER_CREDS_JSON` (or
+ *     `OPER_SALT` + `OPER_HASH` env vars the CF config-loader threads
+ *     into the hashed oper-cred shape).
+ *   - AWS: a Secrets Manager entry the Lambda config-loader reads at
+ *     boot (same env-var shape).
+ *   - local-cli: the `operCreds` array on `startLocalServer`.
+ */
+
+// ============================================================================
+// Pure helper (re-exported from irc-core for testability)
+// ============================================================================
+
+export { type OperCredHashed, hashOperCredential } from '@serverless-ircd/irc-core';
+
+// ============================================================================
+// CLI entry point (only runs when executed directly via `node --import tsx`)
+// ============================================================================
+
+async function main(): Promise<void> {
+  const { parseArgs } = await import('node:util');
+  const { values } = parseArgs({
+    options: {
+      user: { type: 'string' },
+      password: { type: 'string', default: undefined },
+      stdin: { type: 'boolean', default: false },
+    },
+  });
+
+  if (values.user === undefined) {
+    console.error('Usage: hash-oper-cred --user <name> [--password <pw>] [--stdin]');
+    console.error('  --user       Oper name (required).');
+    console.error('  --password   Oper password (omit with --stdin to read from stdin).');
+    console.error(
+      '  --stdin      Read the password from stdin (single line, trailing newline stripped).',
+    );
+    process.exit(1);
+  }
+
+  let password = values.password;
+  if (values.stdin) {
+    // Read the first line of stdin (trailing newline stripped) so the
+    // password never lands in shell history.
+    const { stdin } = await import('node:process');
+    const chunks: Buffer[] = [];
+    for await (const chunk of stdin) {
+      chunks.push(Buffer.from(chunk));
+      // Stop at the first newline — a heredoc/pipe with extra lines
+      // must not block the read.
+      if (Buffer.concat(chunks).includes(0x0a)) break;
+    }
+    const raw = Buffer.concat(chunks).toString('utf8');
+    const firstLine = raw.split('\n')[0] ?? '';
+    password = firstLine.trimEnd();
+  }
+
+  if (password === undefined || password.length === 0) {
+    console.error('Missing password. Supply --password <pw> or pipe via --stdin.');
+    process.exit(1);
+  }
+
+  const { hashOperCredential } = await import('@serverless-ircd/irc-core');
+  const cred = hashOperCredential(values.user, password);
+  process.stdout.write(`${JSON.stringify(cred)}\n`);
+}
+
+await main();

package/tools/load-test/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/load-test",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Synthetic WebSocket IRC client farm for load testing ServerlessIRCd (concurrency, latency p50/p95/p99, drop rate)",
   "license": "BSD-3-Clause",

package/tools/tcp-ws-forwarder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/tcp-ws-forwarder",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Local TCP to ws/wss forwarder so standard IRC clients can reach the WebSocket-only ServerlessIRCd transport",
   "license": "BSD-3-Clause",