serverless-ircd 0.2.0 → 0.3.0

package/packages/irc-core/tests/commands/who.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest';
+import { operReducer } from '../../src/commands/oper';
 import { whoReducer } from '../../src/commands/who';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
@@ -10,6 +11,10 @@ import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 const serverConfig: ServerConfig = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
+  operCreds: [
+    { user: 'alice', password: 'oppass' },
+    { user: 'bob', password: 'oppass' },
+  ],
   maxChannelsPerUser: 30,
   maxTargetsPerCommand: 10,
   maxListEntries: 50,
@@ -19,6 +24,13 @@ const serverConfig: ServerConfig = {
   quitMessage: 'Client Quit',
 };
 
+/** Grants oper to a connection via the real OPER command flow. */
+function grantOper(conn: ConnectionState): void {
+  const ctx = makeCtx(conn);
+  const user = conn.nick ?? 'oper';
+  operReducer(conn, { command: 'OPER', params: [user, 'oppass'], tags: {} }, ctx);
+}
+
 function makeCtx(conn: ConnectionState, clock = new FakeClock(1_000)): Ctx {
   return buildCtx({
     serverConfig,
@@ -129,9 +141,11 @@ describe('whoReducer — channel target', () => {
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
     const ctx = makeCtx(conn);
-    const connStates = new Map<string, ConnectionState>([
-      ['c1', makeConnState('c1', 'alice', { oper: true })],
-    ]);
+    const alice = makeConnState('c1', 'alice');
+    // Grant oper via the real OPER command flow, not by poking state.
+    grantOper(alice);
+    expect(alice.userModes.oper).toBe(true);
+    const connStates = new Map<string, ConnectionState>([['c1', alice]]);
 
     const out = whoReducer(chan, connStates, { command: 'WHO', params: ['#foo'] }, ctx);
 
@@ -333,9 +347,13 @@ describe('whoReducer — operators-only filter', () => {
     addMember(chan, 'c2', 'bob');
     const conn = makeConn();
     const ctx = makeCtx(conn);
+    const bob = makeConnState('c2', 'bob');
+    // Grant oper via the real OPER command flow, not by poking state.
+    grantOper(bob);
+    expect(bob.userModes.oper).toBe(true);
     const connStates = new Map<string, ConnectionState>([
       ['c1', makeConnState('c1', 'alice')],
-      ['c2', makeConnState('c2', 'bob', { oper: true })],
+      ['c2', bob],
     ]);
 
     const out = whoReducer(chan, connStates, { command: 'WHO', params: ['#foo', 'o'] }, ctx);

package/packages/irc-core/tests/commands/whois.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest';
+import { operReducer } from '../../src/commands/oper';
 import { whoisReducer } from '../../src/commands/whois';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
@@ -10,6 +11,7 @@ import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 const serverConfig: ServerConfig = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
+  operCreds: [{ user: 'bob', password: 'oppass' }],
   maxChannelsPerUser: 30,
   maxTargetsPerCommand: 10,
   maxListEntries: 50,
@@ -150,13 +152,18 @@ describe('whoisReducer — happy path', () => {
   it('emits 313 RPL_WHOISOPERATOR when the target is an IRC operator', () => {
     const requester = makeConn();
     const ctx = makeCtx(requester);
-    const target = makeTarget('c2', 'bob', { oper: true });
+    // Grant oper via the real OPER command flow rather than poking state directly.
+    const target = makeTarget('c2', 'bob');
+    const targetCtx = makeCtx(target);
+    operReducer(target, { command: 'OPER', params: ['bob', 'oppass'], tags: {} }, targetCtx);
+    expect(target.userModes.oper).toBe(true);
 
     const out = whoisReducer(target, [], { command: 'WHOIS', params: ['bob'] }, ctx);
 
     const send = out.effects[0];
     if (send?.tag === 'Send') {
       expect(send.lines.some((l) => l.text.includes(' 313 '))).toBe(true);
+      expect(send.lines.some((l) => l.text.endsWith(':is an IRC operator'))).toBe(true);
     }
   });
 });

package/packages/irc-core/tests/config.test.ts

@@ -288,6 +288,81 @@ describe('ServerConfigSchema — operCreds', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — saslAccounts
+// ============================================================================
+
+describe('ServerConfigSchema — saslAccounts', () => {
+  it('accepts an array of {username,password} entries', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      saslAccounts: [
+        { username: 'alice', password: 'p1' },
+        { username: 'bob', password: 'p2' },
+      ],
+    });
+    expect(cfg.saslAccounts).toHaveLength(2);
+    expect(cfg.saslAccounts[0]?.username).toBe('alice');
+    expect(cfg.saslAccounts[1]?.password).toBe('p2');
+  });
+
+  it('defaults saslAccounts to an empty array when omitted', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.saslAccounts).toEqual([]);
+  });
+
+  it('rejects saslAccounts entries missing username', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        saslAccounts: [{ password: 'p' }],
+      }),
+    ).toThrowError(/username/u);
+  });
+
+  it('rejects saslAccounts entries missing password', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        saslAccounts: [{ username: 'u' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('rejects saslAccounts entries with empty username', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        saslAccounts: [{ username: '', password: 'p' }],
+      }),
+    ).toThrowError(/username/u);
+  });
+
+  it('rejects saslAccounts entries with empty password', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        saslAccounts: [{ username: 'u', password: '' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('rejects a non-array saslAccounts', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        saslAccounts: { username: 'u', password: 'p' },
+      }),
+    ).toThrowError(/saslAccounts/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — limit knobs
 // ============================================================================

package/packages/irc-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": true,
   "description": "Orchestration layer: IrcRuntime port, dispatch interpreter, ConnectionActor",
   "license": "BSD-3-Clause",

package/packages/irc-server/src/actor.ts

@@ -26,6 +26,7 @@
  */
 
 import {
+  type AccountStore,
   type ChanName,
   type ChannelState,
   type Clock,
@@ -103,6 +104,16 @@ export interface ConnectionActorOptions {
    * opt in.
    */
   readonly messages?: MessageStore;
+  /**
+   * SASL account verification source (absent when no accounts are
+   * configured). When bound, `ctx.accounts` is defined so the
+   * `AUTHENTICATE` reducer can verify PLAIN credentials end-to-end.
+   * Omitted (→ `ctx.accounts` undefined) preserves the existing
+   * behaviour for callers/tests that do not opt in: a client completing
+   * `AUTHENTICATE PLAIN` receives `904 ERR_SASLFAIL` because no store
+   * can vouch for the credentials.
+   */
+  readonly accounts?: AccountStore;
   /**
    * Structured-logger port. When omitted the actor runs
    * silently — observability is purely opt-in. When supplied, every
@@ -127,6 +138,7 @@ export class ConnectionActor {
   private readonly ids: IdFactory;
   private readonly motd: MotdProvider;
   private readonly messages: MessageStore | undefined;
+  private readonly accounts: AccountStore | undefined;
   private readonly reducers: RoutedReducers;
   /**
    * Bound logger. Defaults to a no-op so the actor pipeline has no
@@ -150,6 +162,7 @@ export class ConnectionActor {
     this.ids = opts.ids;
     this.motd = opts.motd ?? EmptyMotdProvider;
     this.messages = opts.messages;
+    this.accounts = opts.accounts;
     this.logger = opts.logger ?? NoopLoggerInstance;
     this.pinnedTraceId = opts.traceId;
     // Bind the connection id once so every record the actor emits carries
@@ -242,6 +255,7 @@ export class ConnectionActor {
       motd: this.motd,
       connection: this.state,
       ...(this.messages !== undefined ? { messages: this.messages } : {}),
+      ...(this.accounts !== undefined ? { accounts: this.accounts } : {}),
     });
 
     switch (msg.command) {
@@ -260,6 +274,8 @@ export class ConnectionActor {
         return this.reducers.quit(this.state, msg, ctx).effects;
       case 'MOTD':
         return this.reducers.motd(this.state, msg, ctx).effects;
+      case 'OPER':
+        return this.reducers.oper(this.state, msg, ctx).effects;
       case 'CAP':
         return this.reducers.cap(this.state, msg, ctx).effects;
       case 'AUTHENTICATE':
@@ -307,6 +323,13 @@ export class ConnectionActor {
           this.reducers.noticeUser,
           ctx,
         );
+      case 'TAGMSG':
+        return this.routeMessageTarget(
+          msg,
+          this.reducers.tagmsgChannel,
+          this.reducers.tagmsgUser,
+          ctx,
+        );
       case 'MODE':
         return isChannelTarget(msg.params[0] ?? '')
           ? this.routeSingleChannel(
@@ -557,6 +580,7 @@ function channelTargetsForMessage(msg: IrcMessage): ChanName[] {
     case 'MODE':
     case 'PRIVMSG':
     case 'NOTICE':
+    case 'TAGMSG':
       return splitCsv(msg.params[0] ?? '').filter(isChannelTarget) as ChanName[];
     case 'INVITE':
       // INVITE <nick> <channel> — the channel is the second param.

package/packages/irc-server/src/routing.ts

@@ -42,6 +42,7 @@ import {
   nickReducer,
   noticeChannelReducer,
   noticeUserReducer,
+  operReducer,
   partReducer,
   passReducer,
   pingReducer,
@@ -49,6 +50,8 @@ import {
   privmsgChannelReducer,
   privmsgUserReducer,
   quitReducer,
+  tagmsgChannelReducer,
+  tagmsgUserReducer,
   topicReducer,
   userModeReducer,
   userReducer,
@@ -69,6 +72,7 @@ export interface RoutedReducers {
   readonly pass: Reducer<ConnectionState>;
   readonly quit: Reducer<ConnectionState>;
   readonly motd: Reducer<ConnectionState>;
+  readonly oper: Reducer<ConnectionState>;
   readonly cap: Reducer<ConnectionState>;
   readonly authenticate: Reducer<ConnectionState>;
   readonly away: Reducer<ConnectionState>;
@@ -84,6 +88,8 @@ export interface RoutedReducers {
   readonly privmsgUser: Reducer<ConnectionState>;
   readonly noticeChannel: Reducer<ChannelState>;
   readonly noticeUser: Reducer<ConnectionState>;
+  readonly tagmsgChannel: Reducer<ChannelState>;
+  readonly tagmsgUser: Reducer<ConnectionState>;
   readonly channelMode: Reducer<ChannelState>;
   readonly userMode: Reducer<ConnectionState>;
 }
@@ -132,6 +138,7 @@ export function buildRoutedReducers(serverConfig: ServerConfig): RoutedReducers
     pass: wrap(passReducer),
     quit: wrap(quitReducer),
     motd: wrap(motdReducer),
+    oper: wrap(operReducer),
     cap: wrap(capReducer),
     authenticate: wrap(authenticateReducer),
     away: wrap(awayReducer),
@@ -145,6 +152,8 @@ export function buildRoutedReducers(serverConfig: ServerConfig): RoutedReducers
     privmsgUser: wrap(privmsgUserReducer),
     noticeChannel: wrap(noticeChannelReducer),
     noticeUser: wrap(noticeUserReducer),
+    tagmsgChannel: wrap(tagmsgChannelReducer),
+    tagmsgUser: wrap(tagmsgUserReducer),
     channelMode: wrap(channelModeReducer),
     userMode: wrap(userModeReducer),
   };

package/packages/irc-server/tests/actor.test.ts

@@ -1,4 +1,5 @@
 import {
+  type AccountStore,
   CapturingLogger,
   type ChanName,
   type ChanSnapshot,
@@ -17,14 +18,18 @@ import {
   type Nick,
   Numerics,
   type RawLine,
+  type SaslPayload,
+  type SaslResult,
   SequentialIdFactory,
   type ServerConfig,
   type StoredMessage,
   applyChannelDelta as applyDelta,
   createChannel,
   createConnection,
+  encodeBase64,
   isChannelTarget,
   toChannelSnapshot,
+  toSnapshot,
 } from '@serverless-ircd/irc-core';
 import { describe, expect, it } from 'vitest';
 import { ConnectionActor } from '../src/actor';
@@ -116,7 +121,8 @@ class FakeRuntime implements IrcRuntime {
   }
   async getConnectionInfo(conn: ConnId): Promise<ConnSnapshot | null> {
     this.calls.push({ method: 'getConnectionInfo', args: [conn] });
-    return null;
+    const state = this.testConnections.get(conn);
+    return state === undefined ? null : toSnapshot(state);
   }
   async getConnection(conn: ConnId): Promise<ConnectionState | null> {
     this.calls.push({ method: 'getConnection', args: [conn] });
@@ -154,6 +160,8 @@ function makeActor(opts: {
   logger?: Logger;
   traceId?: string;
   messages?: MessageStore;
+  accounts?: AccountStore;
+  operCreds?: ReadonlyArray<{ user: string; password: string }>;
 }): { actor: ConnectionActor; runtime: FakeRuntime; conn: ConnectionState } {
   const clock = opts.clock ?? new FakeClock(1_000);
   const conn = createConnection({ id: 'c1', connectedSince: 0 });
@@ -179,6 +187,7 @@ function makeActor(opts: {
     topicLen: 390,
     quitMessage: 'Client Quit',
     ...(opts.floodControl !== undefined ? { floodControl: opts.floodControl } : {}),
+    ...(opts.operCreds !== undefined ? { operCreds: opts.operCreds } : {}),
   };
   const ids = new SequentialIdFactory();
   type ActorOpts = ConstructorParameters<typeof ConnectionActor>[0];
@@ -203,6 +212,9 @@ function makeActor(opts: {
   if (opts.messages !== undefined) {
     finalOpts.messages = opts.messages;
   }
+  if (opts.accounts !== undefined) {
+    finalOpts.accounts = opts.accounts;
+  }
   const actor = new ConnectionActor(finalOpts);
   return { actor, runtime, conn };
 }
@@ -478,6 +490,59 @@ describe('ConnectionActor — additional routing', () => {
     expect(runtime.calls.filter((c) => c.method === 'broadcast')).toHaveLength(1);
   });
 
+  it('routes TAGMSG to a channel broadcast (never 421) when message-tags cap is present', async () => {
+    const bobConn = createConnection({ id: 'c2', connectedSince: 0 });
+    bobConn.nick = 'bob';
+    bobConn.user = 'bob';
+    bobConn.host = 'example.org';
+    bobConn.registration = 'registered';
+    bobConn.caps = new Set<string>(['message-tags']);
+    const { actor, runtime } = makeActor({
+      conn: { caps: new Set<string>(['message-tags']) },
+    });
+    runtime.addConnection(bobConn);
+    await runtime.applyChannelDelta('#foo', {
+      memberships: [
+        { type: 'add', conn: 'c1', nick: 'alice' },
+        { type: 'add', conn: 'c2', nick: 'bob' },
+      ],
+    });
+    runtime.calls.length = 0;
+    await actor.receiveTextFrame('@+typing=active TAGMSG #foo\r\n');
+
+    // Cap-gated broadcast dispatches per-recipient via send (only to
+    // message-tags-enabled members, excluding the sender).
+    const sends = runtime.calls.filter(
+      (c) => c.method === 'send' && c.args[0] === 'c2',
+    );
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toBe('@+typing=active :alice!alice@example.com TAGMSG #foo');
+    // Critical: never 421 for a cap-enabled TAGMSG.
+    for (const call of runtime.calls) {
+      if (call.method === 'send') {
+        for (const line of call.args[1] as RawLine[]) {
+          expect(line.text).not.toContain(' 421 ');
+        }
+      }
+    }
+  });
+
+  it('still emits 421 for TAGMSG when message-tags cap is not negotiated', async () => {
+    const { actor, runtime } = makeActor({});
+    await runtime.applyChannelDelta('#foo', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+    runtime.calls.length = 0;
+    await actor.receiveTextFrame('TAGMSG #foo\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toContain(' 421 ');
+    expect(lines[0]?.text).toContain('TAGMSG');
+  });
+
   it('routes PRIVMSG with mixed targets (#chan,nick) into 2 invocations', async () => {
     const { actor, runtime } = makeActor({});
     await runtime.applyChannelDelta('#foo', {
@@ -712,6 +777,63 @@ describe('ConnectionActor — additional routing', () => {
     }
   });
 
+  it('routes OPER with matching creds through operReducer (381, never 421)', async () => {
+    const { actor, runtime, conn } = makeActor({
+      operCreds: [{ user: 'alice', password: 'secret' }],
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('OPER alice secret\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toBe(':irc.example.com 381 alice :You are now an IRC operator');
+    expect(conn.userModes.oper).toBe(true);
+    // Critical: never 421 for OPER.
+    for (const s of sends) {
+      for (const line of s.args[1] as RawLine[]) {
+        expect(line.text).not.toContain(' 421 ');
+      }
+    }
+  });
+
+  it('routes OPER with wrong creds through operReducer (464, never 421)', async () => {
+    const { actor, runtime } = makeActor({
+      operCreds: [{ user: 'alice', password: 'secret' }],
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('OPER alice wrong\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toContain(' 464 ');
+    for (const s of sends) {
+      for (const line of s.args[1] as RawLine[]) {
+        expect(line.text).not.toContain(' 421 ');
+      }
+    }
+  });
+
+  it('routes OPER with no configured creds through operReducer (491, never 421)', async () => {
+    const { actor, runtime } = makeActor({});
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('OPER alice secret\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toContain(' 491 ');
+    for (const s of sends) {
+      for (const line of s.args[1] as RawLine[]) {
+        expect(line.text).not.toContain(' 421 ');
+      }
+    }
+  });
+
   it('emits 421 with empty command when routeSingleChannel gets no channel (TOPIC)', async () => {
     const { actor, runtime } = makeActor({});
     await actor.receiveTextFrame('TOPIC\r\n');
@@ -1270,3 +1392,100 @@ describe('ConnectionActor — CHATHISTORY', () => {
     // …but there is no store to record into.
   });
 });
+
+// ===========================================================================
+// SASL / AccountStore — actor plumbing (ctx.accounts threaded through buildCtx)
+// ===========================================================================
+
+describe('ConnectionActor — SASL AccountStore plumbing', () => {
+  /** Capture-and-respond fake AccountStore (mirrors the irc-core sasl tests). */
+  class FakeAccountStore implements AccountStore {
+    readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
+    constructor(private readonly result: SaslResult) {}
+    verify(mech: string, payload: SaslPayload): SaslResult {
+      this.calls.push({ mech, payload });
+      return this.result;
+    }
+  }
+
+  /** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
+  function plainPayload(authcid: string, password: string): string {
+    return encodeBase64(`\0${authcid}\0${password}`);
+  }
+
+  /** A connection that has opened CAP negotiation and requested `sasl`. */
+  function saslReadyConn(): Partial<ConnectionState> {
+    return {
+      registration: 'pre-registration',
+      capNegotiating: true,
+      caps: new Set<string>(['sasl']),
+    };
+  }
+
+  it('completes SASL PLAIN with 900/903 when a bound AccountStore accepts creds', async () => {
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const { actor, runtime, conn } = makeActor({
+      conn: saslReadyConn(),
+      accounts,
+    });
+    conn.nick = 'alice';
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('AUTHENTICATE PLAIN\r\n');
+    await actor.receiveTextFrame(`AUTHENTICATE ${plainPayload('alice', 'secret')}\r\n`);
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    // Second frame emits the success numerics; gather every sent line.
+    const lines = sends.flatMap((s) => s.args[1] as RawLine[]);
+    expect(lines.some((l) => l.text.includes(' 900 '))).toBe(true);
+    expect(lines.some((l) => l.text.includes(' 903 '))).toBe(true);
+    // Critical: never 904 for valid creds.
+    expect(lines.some((l) => l.text.includes(' 904 '))).toBe(false);
+    // The AccountStore was consulted with the parsed PLAIN credentials.
+    expect(accounts.calls).toEqual([
+      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'secret' } },
+    ]);
+    // Account name recorded on the connection for extended-join/account-tag.
+    expect(conn.account).toBe('alice');
+  });
+
+  it('emits 904 ERR_SASLFAIL when no AccountStore is bound (regression guard)', async () => {
+    const { actor, runtime, conn } = makeActor({
+      conn: saslReadyConn(),
+      // No `accounts` option → ctx.accounts is undefined.
+    });
+    conn.nick = 'alice';
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('AUTHENTICATE PLAIN\r\n');
+    await actor.receiveTextFrame(`AUTHENTICATE ${plainPayload('alice', 'secret')}\r\n`);
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    const lines = sends.flatMap((s) => s.args[1] as RawLine[]);
+    expect(lines.some((l) => l.text.includes(' 904 '))).toBe(true);
+    // No success numerics.
+    expect(lines.some((l) => l.text.includes(' 900 '))).toBe(false);
+    expect(lines.some((l) => l.text.includes(' 903 '))).toBe(false);
+    // Account name never recorded.
+    expect(conn.account).toBeUndefined();
+  });
+
+  it('emits 904 when a bound AccountStore rejects the credentials', async () => {
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const { actor, runtime, conn } = makeActor({
+      conn: saslReadyConn(),
+      accounts,
+    });
+    conn.nick = 'alice';
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('AUTHENTICATE PLAIN\r\n');
+    await actor.receiveTextFrame(`AUTHENTICATE ${plainPayload('alice', 'wrong')}\r\n`);
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    const lines = sends.flatMap((s) => s.args[1] as RawLine[]);
+    expect(lines.some((l) => l.text.includes(' 904 '))).toBe(true);
+    expect(lines.some((l) => l.text.includes(' 903 '))).toBe(false);
+    expect(conn.account).toBeUndefined();
+  });
+});

package/packages/irc-server/tests/routing.test.ts

@@ -121,6 +121,7 @@ describe('buildRoutedReducers', () => {
         'nick',
         'noticeChannel',
         'noticeUser',
+        'oper',
         'part',
         'pass',
         'ping',
@@ -128,6 +129,8 @@ describe('buildRoutedReducers', () => {
         'privmsgChannel',
         'privmsgUser',
         'quit',
+        'tagmsgChannel',
+        'tagmsgUser',
         'topic',
         'user',
         'userMode',

package/packages/irc-test-support/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-test-support",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": true,
   "description": "Shared IRC scenario runner + harness seam used by every adapter's integration suite",
   "license": "BSD-3-Clause",

package/packages/irc-test-support/src/in-memory-harness.ts

@@ -52,10 +52,11 @@ export const HARNESS_SERVER_CONFIG = {
 } as const;
 
 /**
- * Default MOTD lines exposed to every spawned client. The welcome block
- * always emits the placeholder 375/372/376 numerics; an explicit `MOTD`
- * command after registration reads these lines via the {@link MotdProvider}
- * port. Tests assert against this content (scenario: MOTD).
+ * Default MOTD lines exposed to every spawned client. The registration
+ * welcome block renders these lines as `375`/`372`×N/`376` numerics, and
+ * an explicit `MOTD` command after registration reads them again via the
+ * {@link MotdProvider} port. Tests assert against this content
+ * (scenario: MOTD).
  */
 export const HARNESS_MOTD_LINES = [
   'Welcome to the ServerlessIRCd integration-test harness.',

package/pnpm-workspace.yaml

@@ -1,3 +1,4 @@
+linkedWorkspacePackages: true
 packages:
   - "packages/*"
   - "apps/*"