serverless-ircd 0.2.0 → 0.4.0

package/packages/aws-adapter/tests/account-store-dynamo.test.ts

@@ -0,0 +1,182 @@
+/**
+ * DynamoDB-backed integration tests for the `Accounts` table path.
+ * Exercises the real DynamoDB round-trip that pure unit
+ * tests cannot: `putAccountCredential` writes a hashed row,
+ * `loadDynamoAccountStore` scans it back, and `resolveAccountStore`
+ * applies the table-then-config precedence.
+ *
+ * Gated on DynamoDB Local availability (same `DDB_AVAILABLE` flag as
+ * `handlers.test.ts`).
+ */
+
+import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
+import { DEFAULT_SERVER_CONFIG } from '@serverless-ircd/irc-core';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import {
+  loadDynamoAccountStore,
+  putAccountCredential,
+  resolveAccountStore,
+} from '../src/account-store.js';
+import { TABLE_DEFS } from '../src/cdk-table-defs.js';
+import { createDynamoDocumentClient } from '../src/dynamo.js';
+
+const available = process.env.DDB_AVAILABLE === '1';
+const endpoint = process.env.DYNAMO_ENDPOINT;
+
+interface Fx {
+  tableName: string;
+  client: ReturnType<typeof createDynamoDocumentClient>;
+  cleanup: () => Promise<void>;
+}
+
+let fx: Fx | null = null;
+
+function requireFx(): Fx {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
+async function makeFx(): Promise<Fx> {
+  if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
+  const tableName = `acct-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+  const client = createDynamoDocumentClient({ endpoint });
+  const props = TABLE_DEFS.Accounts;
+  const pkName = props.partitionKey?.name;
+  if (pkName === undefined) throw new Error('Accounts table missing partitionKey');
+  await client.send(
+    new CreateTableCommand({
+      TableName: tableName,
+      AttributeDefinitions: [{ AttributeName: pkName, AttributeType: 'S' }],
+      KeySchema: [{ AttributeName: pkName, KeyType: 'HASH' }],
+      BillingMode: 'PAY_PER_REQUEST',
+    }),
+  );
+  return {
+    tableName,
+    client,
+    cleanup: async () => {
+      try {
+        await client.send(new DeleteTableCommand({ TableName: tableName }));
+      } catch {
+        // Idempotent.
+      }
+    },
+  };
+}
+
+describe.skipIf(!available)('Accounts table round-trip', () => {
+  beforeEach(async () => {
+    fx = await makeFx();
+  });
+  afterEach(async () => {
+    if (fx) await fx.cleanup();
+    fx = null;
+  });
+
+  it('putAccountCredential then loadDynamoAccountStore verifies the account', async () => {
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 's3cret');
+    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
+    expect(store).toBeDefined();
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 's3cret' }),
+    ).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('loadDynamoAccountStore returns undefined when the table has no rows', async () => {
+    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
+    expect(store).toBeUndefined();
+  });
+
+  it('putAccountCredential writes multiple distinct accounts', async () => {
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'a1');
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'bob', 'b2');
+    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
+    expect(store).toBeDefined();
+    expect(store?.size).toBe(2);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'a1' }).ok).toBe(
+      true,
+    );
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'b2' }).ok).toBe(
+      true,
+    );
+  });
+
+  it('putAccountCredential overwrites an existing account (re-seed)', async () => {
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'old');
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'new');
+    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
+    expect(store).toBeDefined();
+    expect(store?.size).toBe(1);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'old' }).ok).toBe(
+      false,
+    );
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'new' }).ok).toBe(
+      true,
+    );
+  });
+
+  it('rejects a wrong password after round-trip', async () => {
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'right');
+    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
+    expect(store).toBeDefined();
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
+      false,
+    );
+  });
+});
+
+describe.skipIf(!available)('resolveAccountStore precedence', () => {
+  beforeEach(async () => {
+    fx = await makeFx();
+  });
+  afterEach(async () => {
+    if (fx) await fx.cleanup();
+    fx = null;
+  });
+
+  it('returns a DynamoAccountStore when the table has rows (table wins)', async () => {
+    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'table-secret');
+    const cfgWithSasl = {
+      ...DEFAULT_SERVER_CONFIG,
+      saslAccounts: [{ username: 'envuser', password: 'env-secret' }],
+    };
+    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, cfgWithSasl);
+    expect(store).toBeDefined();
+    // Table account verifies; config account does NOT (table is authoritative).
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'table-secret' }).ok,
+    ).toBe(true);
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
+    ).toBe(false);
+  });
+
+  it('falls back to the config-seeded store when the table is empty', async () => {
+    const cfgWithSasl = {
+      ...DEFAULT_SERVER_CONFIG,
+      saslAccounts: [{ username: 'envuser', password: 'env-secret' }],
+    };
+    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, cfgWithSasl);
+    expect(store).toBeDefined();
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
+    ).toBe(true);
+  });
+
+  it('returns undefined when the table is empty and no config accounts are set', async () => {
+    const store = await resolveAccountStore(
+      requireFx().client,
+      requireFx().tableName,
+      DEFAULT_SERVER_CONFIG,
+    );
+    expect(store).toBeUndefined();
+  });
+
+  it('returns undefined when the table is empty and serverConfig is undefined', async () => {
+    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, undefined);
+    expect(store).toBeUndefined();
+  });
+});

package/packages/aws-adapter/tests/account-store.test.ts

@@ -0,0 +1,279 @@
+import { DynamoDBDocumentClient, PutCommand, ScanCommand } from '@aws-sdk/lib-dynamodb';
+import {
+  DEFAULT_SERVER_CONFIG,
+  type ParsedServerConfig,
+  type SaslPayload,
+} from '@serverless-ircd/irc-core';
+import { mockClient } from 'aws-sdk-client-mock';
+import { describe, expect, it } from 'vitest';
+import {
+  DynamoAccountStore,
+  type HashedAccountCredential,
+  bindAccountStore,
+  hashAccountCredential,
+  putAccountCredential,
+  resolveAccountStore,
+} from '../src/account-store';
+
+function plainPayload(username: string, password: string): SaslPayload {
+  return { kind: 'PLAIN', username, password };
+}
+
+/** Builds a minimal parsed config with the supplied saslAccounts. */
+function configWith(accounts: Array<{ username: string; password: string }>): ParsedServerConfig {
+  return { ...DEFAULT_SERVER_CONFIG, saslAccounts: accounts };
+}
+
+// ---------------------------------------------------------------------------
+// bindAccountStore — config-seeded fallback
+// ---------------------------------------------------------------------------
+
+describe('bindAccountStore', () => {
+  it('returns an AccountStore that accepts valid PLAIN creds', () => {
+    const store = bindAccountStore(configWith([{ username: 'alice', password: 'secret' }]));
+    expect(store).toBeDefined();
+    const out = store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' });
+    expect(out).toEqual({ ok: true, account: 'alice' });
+  });
+
+  it('returns undefined when the account list is empty', () => {
+    expect(bindAccountStore(configWith([]))).toBeUndefined();
+  });
+
+  it('returns undefined when serverConfig is undefined', () => {
+    expect(bindAccountStore(undefined)).toBeUndefined();
+  });
+
+  it('rejects wrong credentials', () => {
+    const store = bindAccountStore(configWith([{ username: 'alice', password: 'secret' }]));
+    expect(store).toBeDefined();
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
+      false,
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// hashAccountCredential — pure scrypt hashing helper
+// ---------------------------------------------------------------------------
+
+describe('hashAccountCredential', () => {
+  it('produces an entry keyed by the username with scrypt', () => {
+    const entry = hashAccountCredential('alice', 'secret');
+    expect(entry.account).toBe('alice');
+    expect(entry.algorithm).toBe('scrypt');
+    expect(entry.salt.length).toBeGreaterThan(0);
+    expect(entry.hash.length).toBeGreaterThan(0);
+  });
+
+  it('never stores the plaintext password in any field', () => {
+    const entry = hashAccountCredential('alice', 'hunter2-secret');
+    expect(entry.account).not.toContain('hunter2');
+    expect(entry.salt).not.toContain('hunter2');
+    expect(entry.hash).not.toContain('hunter2');
+  });
+
+  it('produces different hashes for the same password under different salts', () => {
+    const a = hashAccountCredential('alice', 'secret', { salt: Buffer.from('aaaaaaaaaaaaaaaa') });
+    const b = hashAccountCredential('alice', 'secret', { salt: Buffer.from('bbbbbbbbbbbbbbbb') });
+    expect(a.hash).not.toBe(b.hash);
+  });
+
+  it('is deterministic for a fixed salt', () => {
+    const salt = Buffer.from('1234567890123456');
+    const a = hashAccountCredential('alice', 'secret', { salt });
+    const b = hashAccountCredential('alice', 'secret', { salt });
+    expect(a.hash).toBe(b.hash);
+  });
+
+  it('honours a custom key length', () => {
+    const entry = hashAccountCredential('alice', 'secret', { keyLen: 32 });
+    // base64 of 32 bytes → ~44 chars; base64 of 64 bytes → ~88 chars
+    expect(Buffer.from(entry.hash, 'base64').length).toBe(32);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// DynamoAccountStore — synchronous verify against pre-loaded hashed entries
+// ---------------------------------------------------------------------------
+
+describe('DynamoAccountStore', () => {
+  it('accepts valid PLAIN credentials and returns the account name', () => {
+    const entry = hashAccountCredential('alice', 'secret');
+    const store = new DynamoAccountStore([entry]);
+    expect(store.verify('PLAIN', plainPayload('alice', 'secret'))).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('rejects a wrong password', () => {
+    const entry = hashAccountCredential('alice', 'secret');
+    const store = new DynamoAccountStore([entry]);
+    expect(store.verify('PLAIN', plainPayload('alice', 'wrong')).ok).toBe(false);
+  });
+
+  it('rejects an unknown username', () => {
+    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
+    expect(store.verify('PLAIN', plainPayload('bob', 'secret')).ok).toBe(false);
+  });
+
+  it('rejects a non-PLAIN mechanism', () => {
+    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
+    expect(store.verify('EXTERNAL', plainPayload('alice', 'secret')).ok).toBe(false);
+  });
+
+  it('rejects a RAW payload', () => {
+    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
+    expect(store.verify('PLAIN', { kind: 'RAW', data: 'whatever' }).ok).toBe(false);
+  });
+
+  it('handles multiple loaded accounts', () => {
+    const store = new DynamoAccountStore([
+      hashAccountCredential('alice', 'a-secret'),
+      hashAccountCredential('bob', 'b-secret'),
+    ]);
+    expect(store.verify('PLAIN', plainPayload('alice', 'a-secret'))).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+    expect(store.verify('PLAIN', plainPayload('bob', 'b-secret'))).toEqual({
+      ok: true,
+      account: 'bob',
+    });
+  });
+
+  it('fails every verify when constructed with no entries', () => {
+    const store = new DynamoAccountStore([]);
+    expect(store.verify('PLAIN', plainPayload('alice', 'secret')).ok).toBe(false);
+  });
+
+  it('round-trips an externally-constructed HashedAccountCredential', () => {
+    const row: HashedAccountCredential = hashAccountCredential('carol', 'p@ss');
+    const store = new DynamoAccountStore([row]);
+    expect(store.verify('PLAIN', plainPayload('carol', 'p@ss'))).toEqual({
+      ok: true,
+      account: 'carol',
+    });
+  });
+
+  it('reports the number of loaded entries via size', () => {
+    const store = new DynamoAccountStore([
+      hashAccountCredential('alice', 'a'),
+      hashAccountCredential('bob', 'b'),
+    ]);
+    expect(store.size).toBe(2);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// resolveAccountStore — table-then-config precedence (mock-based)
+// ---------------------------------------------------------------------------
+
+describe('resolveAccountStore', () => {
+  it('returns a DynamoAccountStore when the table has rows (table wins)', async () => {
+    const entry = hashAccountCredential('alice', 's3cret');
+    const ddb = mockClient(DynamoDBDocumentClient);
+    ddb.on(ScanCommand).resolves({
+      Items: [entry],
+    });
+
+    const fallback = bindAccountStore(configWith([{ username: 'envuser', password: 'env-pw' }]));
+    const store = await resolveAccountStore(
+      ddb as unknown as DynamoDBDocumentClient,
+      'Accounts',
+      fallback === undefined
+        ? undefined
+        : { ...DEFAULT_SERVER_CONFIG, saslAccounts: [{ username: 'envuser', password: 'env-pw' }] },
+    );
+    expect(store).toBeDefined();
+    expect(store?.verify('PLAIN', plainPayload('alice', 's3cret')).ok).toBe(true);
+    // Config account does NOT verify (table is authoritative).
+    expect(store?.verify('PLAIN', plainPayload('envuser', 'env-pw')).ok).toBe(false);
+  });
+
+  it('falls back to config-seeded store when the table is empty', async () => {
+    const ddb = mockClient(DynamoDBDocumentClient);
+    ddb.on(ScanCommand).resolves({ Items: [] });
+
+    const store = await resolveAccountStore(
+      ddb as unknown as DynamoDBDocumentClient,
+      'Accounts',
+      configWith([{ username: 'bob', password: 'pw' }]),
+    );
+    expect(store).toBeDefined();
+    expect(store?.verify('PLAIN', plainPayload('bob', 'pw')).ok).toBe(true);
+  });
+
+  it('falls back to config-seeded store when the scan throws', async () => {
+    const ddb = mockClient(DynamoDBDocumentClient);
+    ddb.on(ScanCommand).rejects(new Error('ResourceNotFoundException'));
+
+    const store = await resolveAccountStore(
+      ddb as unknown as DynamoDBDocumentClient,
+      'Accounts',
+      configWith([{ username: 'bob', password: 'pw' }]),
+    );
+    expect(store).toBeDefined();
+    expect(store?.verify('PLAIN', plainPayload('bob', 'pw')).ok).toBe(true);
+  });
+
+  it('returns undefined when table is empty and no config accounts', async () => {
+    const ddb = mockClient(DynamoDBDocumentClient);
+    ddb.on(ScanCommand).resolves({ Items: [] });
+
+    const store = await resolveAccountStore(
+      ddb as unknown as DynamoDBDocumentClient,
+      'Accounts',
+      undefined,
+    );
+    expect(store).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// putAccountCredential — CRUD/seed entry point (mock-based)
+// ---------------------------------------------------------------------------
+
+describe('putAccountCredential', () => {
+  it('writes a hashed row to DynamoDB and returns the credential', async () => {
+    const ddb = mockClient(DynamoDBDocumentClient);
+    ddb.on(PutCommand).resolves({});
+
+    const entry = await putAccountCredential(
+      ddb as unknown as DynamoDBDocumentClient,
+      'Accounts',
+      'alice',
+      's3cret',
+    );
+    expect(entry.account).toBe('alice');
+    expect(entry.algorithm).toBe('scrypt');
+
+    const calls = ddb.commandCalls(PutCommand);
+    expect(calls).toHaveLength(1);
+    const item = calls[0]?.args[0].input.Item as HashedAccountCredential;
+    expect(item.account).toBe('alice');
+    expect(item.algorithm).toBe('scrypt');
+    expect(item.salt).toBe(entry.salt);
+    expect(item.hash).toBe(entry.hash);
+  });
+
+  it('the written row round-trips through DynamoAccountStore', async () => {
+    const ddb = mockClient(DynamoDBDocumentClient);
+    ddb.on(PutCommand).resolves({});
+
+    const entry = await putAccountCredential(
+      ddb as unknown as DynamoDBDocumentClient,
+      'Accounts',
+      'alice',
+      's3cret',
+    );
+
+    // Simulate reading the row back via DynamoAccountStore.
+    const store = new DynamoAccountStore([entry]);
+    expect(store.verify('PLAIN', plainPayload('alice', 's3cret'))).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+  });
+});

package/packages/aws-adapter/tests/admission.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Pure unit tests for the AWS `$connect` admission policy
+ * (`src/admission.ts`). No DynamoDB — these exercise every branch of
+ * {@link decideConnectAdmission} directly so the per-IP branch is covered
+ * even though the AWS handler does not yet feed it a `perIp` count.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { decideConnectAdmission } from '../src/admission.js';
+
+describe('decideConnectAdmission', () => {
+  it('admits when the total is below the cap and no per-IP limit is set', () => {
+    const outcome = decideConnectAdmission({ total: 0 }, { maxClients: 2 });
+    expect(outcome).toEqual({ admitted: true });
+  });
+
+  it('admits when the total is exactly one below the cap', () => {
+    expect(decideConnectAdmission({ total: 1 }, { maxClients: 2 })).toEqual({
+      admitted: true,
+    });
+  });
+
+  it('rejects with 429 once the total reaches the cap', () => {
+    expect(decideConnectAdmission({ total: 2 }, { maxClients: 2 })).toEqual({
+      admitted: false,
+      statusCode: 429,
+      reason: 'server full',
+    });
+  });
+
+  it('rejects with 429 when the total exceeds the cap', () => {
+    expect(decideConnectAdmission({ total: 9999 }, { maxClients: 10 })).toEqual({
+      admitted: false,
+      statusCode: 429,
+      reason: 'server full',
+    });
+  });
+
+  it('admits when a per-IP limit is set but no per-IP count is supplied', () => {
+    expect(
+      decideConnectAdmission({ total: 0 }, { maxClients: 10, maxConnectionsPerIp: 3 }),
+    ).toEqual({ admitted: true });
+  });
+
+  it('admits when the per-IP count is below the per-IP limit', () => {
+    expect(
+      decideConnectAdmission({ total: 0, perIp: 2 }, { maxClients: 10, maxConnectionsPerIp: 3 }),
+    ).toEqual({ admitted: true });
+  });
+
+  it('rejects with 429 once the per-IP count reaches the per-IP limit', () => {
+    expect(
+      decideConnectAdmission({ total: 0, perIp: 3 }, { maxClients: 10, maxConnectionsPerIp: 3 }),
+    ).toEqual({
+      admitted: false,
+      statusCode: 429,
+      reason: 'too many connections from this IP',
+    });
+  });
+
+  it('checks the global cap before the per-IP cap', () => {
+    expect(
+      decideConnectAdmission({ total: 10, perIp: 3 }, { maxClients: 10, maxConnectionsPerIp: 3 }),
+    ).toEqual({
+      admitted: false,
+      statusCode: 429,
+      reason: 'server full',
+    });
+  });
+});

package/packages/aws-adapter/tests/aws-harness.ts

@@ -57,7 +57,8 @@ const endpoint = process.env.DYNAMO_ENDPOINT;
  * unavailable so `describe.skipIf` short-circuits before any test runs.
  */
 export const awsHarnessFactory: IrcHarnessFactory = Object.freeze({
-  name: 'aws',
+  name: 'aws+ws',
+  transport: 'ws',
   async create() {
     return new AwsHarness();
   },
@@ -344,6 +345,17 @@ class AwsClientHandle implements ClientHarness {
     await this.actor.receiveTextFrame(`${line}\r\n`);
   }
 
+  async feed(chunk: string): Promise<void> {
+    if (this.actor === undefined) {
+      throw new Error(`client ${this.id} has no bound actor`);
+    }
+    if (this.closed) return;
+    // Routes the raw chunk through the bound transport (the WS text-frame
+    // transport by default; a future aws+tcp factory via the NLB+Lambda
+    // byte-stream path would inject a TcpByteStreamTransport).
+    await this.actor.receive(chunk);
+  }
+
   async waitForLine(
     predicate: (line: string) => boolean,
     timeoutMs: number = DEFAULT_TIMEOUT_MS,

package/packages/aws-adapter/tests/config-loader.test.ts

@@ -75,6 +75,69 @@ describe('buildLambdaConfigInput', () => {
   it('passes QUIT_MESSAGE through', () => {
     expect(buildLambdaConfigInput({ QUIT_MESSAGE: 'bye' }).quitMessage).toBe('bye');
   });
+
+  it('threads SERVER_VERSION into serverVersion', () => {
+    expect(buildLambdaConfigInput({ SERVER_VERSION: '1.2.3' }).serverVersion).toBe('1.2.3');
+  });
+
+  it('passes a non-numeric CREATED_AT through verbatim', () => {
+    expect(buildLambdaConfigInput({ CREATED_AT: '2024-06-01' }).createdAt).toBe('2024-06-01');
+  });
+
+  it('parses a numeric CREATED_AT string into an epoch-ms number', () => {
+    expect(buildLambdaConfigInput({ CREATED_AT: '1700000000000' }).createdAt).toBe(
+      1_700_000_000_000,
+    );
+  });
+
+  it('omits serverVersion/createdAt when their env vars are unset', () => {
+    const out = buildLambdaConfigInput({});
+    expect('serverVersion' in out).toBe(false);
+    expect('createdAt' in out).toBe(false);
+  });
+
+  it('parses SASL_ACCOUNTS newline-delimited username:password pairs', () => {
+    const out = buildLambdaConfigInput({ SASL_ACCOUNTS: 'alice:secret\nbob:b-pass' });
+    expect(out.saslAccounts).toEqual([
+      { username: 'alice', password: 'secret' },
+      { username: 'bob', password: 'b-pass' },
+    ]);
+  });
+
+  it('omits saslAccounts when SASL_ACCOUNTS is empty', () => {
+    expect('saslAccounts' in buildLambdaConfigInput({ SASL_ACCOUNTS: '' })).toBe(false);
+  });
+
+  it('omits saslAccounts when SASL_ACCOUNTS is undefined', () => {
+    expect('saslAccounts' in buildLambdaConfigInput({})).toBe(false);
+  });
+
+  it('skips blank lines in SASL_ACCOUNTS (trailing newline tolerance)', () => {
+    const out = buildLambdaConfigInput({ SASL_ACCOUNTS: 'alice:secret\n\n   \n' });
+    expect(out.saslAccounts).toEqual([{ username: 'alice', password: 'secret' }]);
+  });
+
+  it('skips SASL_ACCOUNTS entries with no colon separator', () => {
+    const out = buildLambdaConfigInput({ SASL_ACCOUNTS: 'nopass\nalice:secret' });
+    expect(out.saslAccounts).toEqual([{ username: 'alice', password: 'secret' }]);
+  });
+
+  it('skips SASL_ACCOUNTS entries with an empty username (leading colon)', () => {
+    const out = buildLambdaConfigInput({ SASL_ACCOUNTS: ':onlypass\nalice:secret' });
+    expect(out.saslAccounts).toEqual([{ username: 'alice', password: 'secret' }]);
+  });
+
+  it('skips SASL_ACCOUNTS entries with an empty password', () => {
+    const out = buildLambdaConfigInput({ SASL_ACCOUNTS: 'alice:\nbob:real' });
+    expect(out.saslAccounts).toEqual([{ username: 'bob', password: 'real' }]);
+  });
+
+  it('trims whole SASL_ACCOUNTS lines but preserves fields around the colon', () => {
+    // Only the line is trimmed; whitespace adjacent to ':' is kept (so a
+    // stray space does not silently change the stored username/password).
+    const out = buildLambdaConfigInput({ SASL_ACCOUNTS: '  alice:secret  ' });
+    expect(out.saslAccounts).toEqual([{ username: 'alice', password: 'secret' }]);
+  });
 });
 
 describe('loadServerConfigFromLambdaEnv', () => {
@@ -155,4 +218,16 @@ describe('loadServerConfigFromLambdaEnv', () => {
     });
     expect(cfg.quitMessage).toBe('goodbye');
   });
+
+  it('round-trips SASL_ACCOUNTS into cfg.saslAccounts end-to-end', () => {
+    const cfg = loadServerConfigFromLambdaEnv({
+      SERVER_NAME: 's',
+      NETWORK_NAME: 'n',
+      SASL_ACCOUNTS: 'alice:secret\nbob:b-pass',
+    });
+    expect(cfg.saslAccounts).toEqual([
+      { username: 'alice', password: 'secret' },
+      { username: 'bob', password: 'b-pass' },
+    ]);
+  });
 });