serverless-ircd 0.2.0 → 0.4.0

package/packages/aws-adapter/tests/handlers.test.ts

@@ -9,6 +9,7 @@
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
 import {
   DEFAULT_SERVER_CONFIG,
+  InMemoryAccountStore,
   type ParsedServerConfig,
   StaticMotdProvider,
 } from '@serverless-ircd/irc-core';
@@ -48,6 +49,11 @@ interface Fixture {
 
 let fx: Fixture | null;
 
+function requireFx(): Fixture {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
 async function makeFixture(): Promise<Fixture> {
   if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
   const prefix = `h${Date.now()}-${Math.floor(Math.random() * 1e6)}-`;
@@ -121,12 +127,12 @@ describe.skipIf(!available)('handlers', () => {
     it('returns 200 and persists a Connections row', async () => {
       const res = await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
-        fx!.deps,
+        requireFx().deps,
       );
       expect(res.statusCode).toBe(200);
       const probe = new AwsRuntime({
-        dynamo: fx!.client,
-        tables: fx!.tables,
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
         connId: '__probe__',
         handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
         managementApi: null,
@@ -138,11 +144,14 @@ describe.skipIf(!available)('handlers', () => {
 
     it('is idempotent on APIGW retry (same connectionId overwrites)', async () => {
       for (let i = 0; i < 2; i++) {
-        await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
+        await dispatch(
+          { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+          requireFx().deps,
+        );
       }
       const probe = new AwsRuntime({
-        dynamo: fx!.client,
-        tables: fx!.tables,
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
         connId: '__probe__',
         handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
         managementApi: null,
@@ -152,21 +161,84 @@ describe.skipIf(!available)('handlers', () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  // $connect admission gate (max-clients cap)
+  // -------------------------------------------------------------------------
+
+  describe('$connect admission gate', () => {
+    it('rejects the connection that exceeds the maxClients cap', async () => {
+      const capped: HandlerDeps = {
+        ...requireFx().deps,
+        serverConfig: { ...SERVER_CONFIG, maxClients: 2 },
+      };
+      const r1 = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'a1' } },
+        capped,
+      );
+      const r2 = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'a2' } },
+        capped,
+      );
+      const r3 = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'a3' } },
+        capped,
+      );
+      expect(r1.statusCode).toBe(200);
+      expect(r2.statusCode).toBe(200);
+      expect(r3.statusCode).toBe(429);
+
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect((await probe.getConnectionInfo('a1'))?.id).toBe('a1');
+      expect((await probe.getConnectionInfo('a2'))?.id).toBe('a2');
+      // The over-cap connection must NOT be recorded.
+      expect(await probe.getConnectionInfo('a3')).toBeNull();
+    });
+
+    it('admits a connection when the table is below the cap', async () => {
+      const capped: HandlerDeps = {
+        ...requireFx().deps,
+        serverConfig: { ...SERVER_CONFIG, maxClients: 5 },
+      };
+      const res = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'b1' } },
+        capped,
+      );
+      expect(res.statusCode).toBe(200);
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect((await probe.getConnectionInfo('b1'))?.id).toBe('b1');
+    });
+  });
+
   // -------------------------------------------------------------------------
   // $disconnect
   // -------------------------------------------------------------------------
 
   describe('$disconnect', () => {
     it('returns 200 and deletes the Connections row', async () => {
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
       const res = await dispatch(
         { requestContext: { routeKey: '$disconnect', connectionId: 'c1' } },
-        fx!.deps,
+        requireFx().deps,
       );
       expect(res.statusCode).toBe(200);
       const probe = new AwsRuntime({
-        dynamo: fx!.client,
-        tables: fx!.tables,
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
         connId: '__probe__',
         handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
         managementApi: null,
@@ -177,33 +249,39 @@ describe.skipIf(!available)('handlers', () => {
     it('returns 200 even when the connection was never seen', async () => {
       const res = await dispatch(
         { requestContext: { routeKey: '$disconnect', connectionId: 'never' } },
-        fx!.deps,
+        requireFx().deps,
       );
       expect(res.statusCode).toBe(200);
     });
 
     it('releases the nick on disconnect', async () => {
       // Connect + register alice.
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'NICK alice\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'USER alice 0 * :Alice\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       // Disconnect.
-      await dispatch({ requestContext: { routeKey: '$disconnect', connectionId: 'c1' } }, fx!.deps);
+      await dispatch(
+        { requestContext: { routeKey: '$disconnect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
       const probe = new AwsRuntime({
-        dynamo: fx!.client,
-        tables: fx!.tables,
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
         connId: '__probe__',
         handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
         managementApi: null,
@@ -223,7 +301,7 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'ghost' },
           body: 'PING :tok\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       expect(res.statusCode).toBe(410);
     });
@@ -233,23 +311,26 @@ describe.skipIf(!available)('handlers', () => {
       const event = {
         requestContext: { routeKey: '$default', connectionId: 'c1' },
       } as never;
-      const res = await dispatch(event, fx!.deps);
+      const res = await dispatch(event, requireFx().deps);
       expect(res.statusCode).toBe(400);
     });
 
     it('runs a NICK + USER frame and emits the welcome block', async () => {
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
-      fx!.mgmt.register('c1', () => {});
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
+      requireFx().mgmt.register('c1', () => {});
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'NICK alice\r\nUSER alice 0 * :Alice\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       const probe = new AwsRuntime({
-        dynamo: fx!.client,
-        tables: fx!.tables,
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
         connId: '__probe__',
         handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
         managementApi: null,
@@ -260,9 +341,12 @@ describe.skipIf(!available)('handlers', () => {
     });
 
     it('echoes outbound lines back to the caller via the management API', async () => {
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
       const sink: string[] = [];
-      fx!.mgmt.register('c1', (data) => {
+      requireFx().mgmt.register('c1', (data) => {
         for (const line of data.split('\r\n')) {
           if (line.length > 0) sink.push(line);
         }
@@ -272,31 +356,34 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'PING :tok\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       expect(sink).toContain('PONG :tok');
     });
 
     it('persists joined channels across $default invocations', async () => {
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
-      fx!.mgmt.register('c1', () => {});
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
+      requireFx().mgmt.register('c1', () => {});
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'NICK alice\r\nUSER alice 0 * :Alice\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'JOIN #persist\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       const probe = new AwsRuntime({
-        dynamo: fx!.client,
-        tables: fx!.tables,
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
         connId: '__probe__',
         handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
         managementApi: null,
@@ -307,26 +394,32 @@ describe.skipIf(!available)('handlers', () => {
 
     it('rebuilds an existing channel roster via refreshChannel when a second client JOINs', async () => {
       // First connection registers + JOINs.
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
-      fx!.mgmt.register('c1', () => {});
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
+      requireFx().mgmt.register('c1', () => {});
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'NICK alice\r\nUSER alice 0 * :Alice\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'JOIN #room\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       // Second connection registers + JOINs the SAME channel.
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c2' } }, fx!.deps);
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c2' } },
+        requireFx().deps,
+      );
       const c2sink: string[] = [];
-      fx!.mgmt.register('c2', (data) => {
+      requireFx().mgmt.register('c2', (data) => {
         for (const line of data.split('\r\n')) {
           if (line.length > 0) c2sink.push(line);
         }
@@ -336,14 +429,14 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c2' },
           body: 'NICK bob\r\nUSER bob 0 * :Bob\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       await dispatch(
         {
           requestContext: { routeKey: '$default', connectionId: 'c2' },
           body: 'JOIN #room\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       // The 353 RPL_NAMREPLY c2 receives must list BOTH alice and bob —
       // proving that the actor's `refreshChannel` populated the cache
@@ -355,9 +448,12 @@ describe.skipIf(!available)('handlers', () => {
     });
 
     it('records a PRIVMSG and replays it via CHATHISTORY LATEST in a BATCH', async () => {
-      await dispatch({ requestContext: { routeKey: '$connect', connectionId: 'c1' } }, fx!.deps);
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
       const sink: string[] = [];
-      fx!.mgmt.register('c1', (data) => {
+      requireFx().mgmt.register('c1', (data) => {
         for (const line of data.split('\r\n')) {
           if (line.length > 0) sink.push(line);
         }
@@ -367,7 +463,7 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'CAP REQ :draft/chathistory server-time message-tags batch\r\nNICK aws-alice\r\nUSER aws-alice 0 * :Alice\r\nCAP END\r\nJOIN #aws-chathist\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       sink.length = 0;
       await dispatch(
@@ -375,7 +471,7 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: 'PRIVMSG #aws-chathist :hello from aws\r\nCHATHISTORY LATEST #aws-chathist * 10\r\n',
         },
-        fx!.deps,
+        requireFx().deps,
       );
       const batchOpen = sink.find((l) => /^BATCH \+\S+ chathistory #aws-chathist/.test(l));
       expect(batchOpen).toBeDefined();
@@ -383,6 +479,57 @@ describe.skipIf(!available)('handlers', () => {
       expect(replay).toBeDefined();
     });
 
+    it('completes SASL PLAIN with 900/903 when an AccountStore is bound', async () => {
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
+        requireFx().deps,
+      );
+      const sink: string[] = [];
+      requireFx().mgmt.register('c1', (data) => {
+        for (const line of data.split('\r\n')) {
+          if (line.length > 0) sink.push(line);
+        }
+      });
+      // Swap in a deps with a seeded AccountStore for this dispatch.
+      const depsWithAccounts: HandlerDeps = {
+        ...requireFx().deps,
+        accounts: new InMemoryAccountStore([{ username: 'aws-sasl', password: 's3cret' }]),
+      };
+      const payload = Buffer.from('\0aws-sasl\0s3cret', 'utf8').toString('base64');
+      await dispatch(
+        {
+          requestContext: { routeKey: '$default', connectionId: 'c1' },
+          body: `CAP REQ :sasl\r\nAUTHENTICATE PLAIN\r\nAUTHENTICATE ${payload}\r\n`,
+        },
+        depsWithAccounts,
+      );
+      expect(sink.some((l) => l.includes(' 900 '))).toBe(true);
+      expect(sink.some((l) => l.includes(' 903 '))).toBe(true);
+      expect(sink.some((l) => l.includes(' 904 '))).toBe(false);
+    });
+
+    it('emits 904 when no AccountStore is bound (regression guard)', async () => {
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c2' } },
+        requireFx().deps,
+      );
+      const sink: string[] = [];
+      requireFx().mgmt.register('c2', (data) => {
+        for (const line of data.split('\r\n')) {
+          if (line.length > 0) sink.push(line);
+        }
+      });
+      const payload = Buffer.from('\0aws-sasl\0s3cret', 'utf8').toString('base64');
+      await dispatch(
+        {
+          requestContext: { routeKey: '$default', connectionId: 'c2' },
+          body: `CAP REQ :sasl\r\nAUTHENTICATE PLAIN\r\nAUTHENTICATE ${payload}\r\n`,
+        },
+        requireFx().deps,
+      );
+      expect(sink.some((l) => l.includes(' 904 '))).toBe(true);
+    });
+
     it('returns 500 when unmarshalConnection throws on a corrupted row (caught by Lambda)', async () => {
       // Skip: the catch in handleDefault wraps `actor.receiveTextFrame`,
       // not `unmarshalConnection`. A corrupted-row test would exercise
@@ -400,7 +547,7 @@ describe.skipIf(!available)('handlers', () => {
     it('returns 200 (APIGW only forwards the three known routes)', async () => {
       const res = await dispatch(
         { requestContext: { routeKey: '$custom', connectionId: 'c1' } },
-        fx!.deps,
+        requireFx().deps,
       );
       expect(res.statusCode).toBe(200);
     });
@@ -416,7 +563,7 @@ class LocalPostToConnection implements PostToConnection {
   register(connId: string, sink: (data: string) => void): void {
     this.sinks.set(connId, sink);
   }
-  async postToConnection(input: { ConnectionId: string; Data: string }): Promise<{}> {
+  async postToConnection(input: { ConnectionId: string; Data: string }): Promise<unknown> {
     const sink = this.sinks.get(input.ConnectionId);
     if (sink !== undefined) sink(input.Data);
     return {};