serverless-ircd 0.2.0 → 0.4.0

package/packages/irc-core/tests/account-store.test.ts

@@ -0,0 +1,131 @@
+import { describe, expect, it } from 'vitest';
+import {
+  type AccountStore,
+  InMemoryAccountStore,
+  type SaslPayload,
+  type SaslResult,
+} from '../src/ports';
+
+/** Convenience: a PLAIN payload. */
+function plain(username: string, password: string): SaslPayload {
+  return { kind: 'PLAIN', username, password };
+}
+
+describe('InMemoryAccountStore — PLAIN', () => {
+  it('implements the AccountStore port', () => {
+    const store: AccountStore = new InMemoryAccountStore([
+      { username: 'alice', password: 'secret' },
+    ]);
+    expect(store).toBeDefined();
+  });
+
+  it('accepts valid PLAIN credentials and returns the account name', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('PLAIN', plain('alice', 'secret'));
+    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
+  });
+
+  it('rejects a wrong password', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('PLAIN', plain('alice', 'wrong'));
+    expect(out.ok).toBe(false);
+  });
+
+  it('rejects an unknown username', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('PLAIN', plain('bob', 'secret'));
+    expect(out.ok).toBe(false);
+  });
+
+  it('matches the first of several configured accounts', () => {
+    const store = new InMemoryAccountStore([
+      { username: 'alice', password: 'a-secret' },
+      { username: 'bob', password: 'b-secret' },
+    ]);
+    expect(store.verify('PLAIN', plain('bob', 'b-secret'))).toEqual<SaslResult>({
+      ok: true,
+      account: 'bob',
+    });
+  });
+
+  it('rejects when constructed with an empty account list', () => {
+    const store = new InMemoryAccountStore([]);
+    const out = store.verify('PLAIN', plain('alice', 'secret'));
+    expect(out.ok).toBe(false);
+  });
+
+  it('does not confuse credentials across accounts (no password cross-match)', () => {
+    const store = new InMemoryAccountStore([
+      { username: 'alice', password: 'a-secret' },
+      { username: 'bob', password: 'b-secret' },
+    ]);
+    // bob's password with alice's username must fail.
+    expect(store.verify('PLAIN', plain('alice', 'b-secret')).ok).toBe(false);
+  });
+});
+
+describe('InMemoryAccountStore — mechanism handling', () => {
+  it('rejects an unsupported mechanism with a failure result', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('CRAM-MD5', { kind: 'RAW', data: 'whatever' });
+    expect(out.ok).toBe(false);
+  });
+
+  it('treats the mechanism name case-insensitively for PLAIN', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('plain', plain('alice', 'secret'));
+    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
+  });
+});
+
+describe('InMemoryAccountStore — EXTERNAL (mTLS)', () => {
+  it('maps a known cert subject to its account', () => {
+    const store = new InMemoryAccountStore([
+      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
+    ]);
+    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=alice' });
+    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
+  });
+
+  it('rejects an unknown cert subject', () => {
+    const store = new InMemoryAccountStore([
+      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
+    ]);
+    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=evil' });
+    expect(out.ok).toBe(false);
+  });
+
+  it('rejects EXTERNAL when no cert subjects are configured', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=alice' });
+    expect(out.ok).toBe(false);
+  });
+
+  it('treats the mechanism name case-insensitively for EXTERNAL', () => {
+    const store = new InMemoryAccountStore([
+      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
+    ]);
+    const out = store.verify('external', { kind: 'EXTERNAL', identity: 'CN=alice' });
+    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
+  });
+
+  it('maps multiple accounts with distinct cert subjects', () => {
+    const store = new InMemoryAccountStore([
+      { username: 'alice', password: 'a', certSubject: 'CN=alice' },
+      { username: 'bob', password: 'b', certSubject: 'CN=bob' },
+    ]);
+    expect(store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=bob' })).toEqual<SaslResult>({
+      ok: true,
+      account: 'bob',
+    });
+  });
+});
+
+describe('InMemoryAccountStore — failure reason', () => {
+  it('returns a human-readable reason on failure', () => {
+    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
+    const out = store.verify('PLAIN', plain('alice', 'wrong'));
+    if (out.ok) throw new Error('expected failure');
+    expect(out.reason.length).toBeGreaterThan(0);
+  });
+});

package/packages/irc-core/tests/caps/capabilities.test.ts

@@ -31,10 +31,10 @@ describe('SUPPORTED_CAPABILITIES', () => {
     );
   });
 
-  it('declares the sasl value as the advertised mechanism list', () => {
+  it('declares the sasl value as the base mechanism list (PLAIN only by default)', () => {
     const sasl = SUPPORTED_CAPABILITIES.find((c) => c.name === 'sasl');
     expect(sasl).toBeDefined();
-    expect(sasl?.value).toBe('PLAIN,EXTERNAL');
+    expect(sasl?.value).toBe('PLAIN');
   });
 
   it('does not attach a value to caps that have no parameter', () => {
@@ -107,7 +107,8 @@ describe('getLsString', () => {
   });
 
   it('contains the sasl token with its value', () => {
-    expect(getLsString()).toContain('sasl=PLAIN,EXTERNAL');
+    expect(getLsString()).toContain('sasl=PLAIN');
+    expect(getLsString()).not.toContain('sasl=PLAIN,EXTERNAL');
   });
 
   it('contains server-time as a bare name', () => {

package/packages/irc-core/tests/case-fold.test.ts

@@ -0,0 +1,80 @@
+import fc from 'fast-check';
+import { describe, expect, it } from 'vitest';
+import { type CaseMapping, caseFold } from '../src/case-fold';
+
+// ============================================================================
+// caseFold — rfc1459 special-character folding
+// ============================================================================
+
+describe('caseFold — rfc1459', () => {
+  it('folds [Foo] to {foo}', () => {
+    expect(caseFold('rfc1459', '[Foo]')).toBe('{foo}');
+  });
+
+  it('folds uppercase A–Z to a–z', () => {
+    expect(caseFold('rfc1459', 'ABCXYZ')).toBe('abcxyz');
+  });
+
+  it('folds the four rfc1459 specials [ \\ ] ^ to { | } ~', () => {
+    expect(caseFold('rfc1459', '[\\]^')).toBe('{|}~');
+  });
+
+  it('does not fold { | } ~ any further', () => {
+    expect(caseFold('rfc1459', '{|}~')).toBe('{|}~');
+  });
+
+  it('leaves non-folding characters unchanged', () => {
+    expect(caseFold('rfc1459', 'a1_-.#@')).toBe('a1_-.#@');
+  });
+
+  it('returns the empty string unchanged', () => {
+    expect(caseFold('rfc1459', '')).toBe('');
+  });
+});
+
+// ============================================================================
+// caseFold — ascii mapping (strict subset of rfc1459)
+// ============================================================================
+
+describe('caseFold — ascii', () => {
+  it('folds uppercase A–Z to a–z', () => {
+    expect(caseFold('ascii', 'ABCXYZ')).toBe('abcxyz');
+  });
+
+  it('does NOT fold the rfc1459 specials [ \\ ] ^', () => {
+    expect(caseFold('ascii', '[Foo]')).toBe('[foo]');
+  });
+
+  it('leaves non-folding characters unchanged', () => {
+    expect(caseFold('ascii', 'a1_-.#[]')).toBe('a1_-.#[]');
+  });
+});
+
+// ============================================================================
+// caseFold — idempotency (property test)
+// ============================================================================
+
+describe('caseFold — idempotency', () => {
+  const mappings: CaseMapping[] = ['rfc1459', 'ascii'];
+
+  for (const mapping of mappings) {
+    it(`fold(fold(s)) === fold(s) under ${mapping}`, () => {
+      const nickish = fc.stringMatching(/[\x21-\x7e]{0,16}/u);
+      fc.assert(
+        fc.property(nickish, (s) => {
+          const once = caseFold(mapping, s);
+          expect(caseFold(mapping, once)).toBe(once);
+        }),
+      );
+    });
+  }
+
+  it('rfc1459 and ascii agree on pure A–Z / a–z input', () => {
+    const alpha = fc.stringMatching(/^[A-Za-z]{1,16}$/u);
+    fc.assert(
+      fc.property(alpha, (s) => {
+        expect(caseFold('rfc1459', s)).toBe(caseFold('ascii', s));
+      }),
+    );
+  });
+});

package/packages/irc-core/tests/commands/cap.test.ts

@@ -4,6 +4,7 @@ import { capReducer } from '../../src/commands/cap';
 import { userReducer } from '../../src/commands/registration';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
+import type { MtlsIdentityProvider } from '../../src/ports';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
@@ -20,13 +21,18 @@ const serverConfig: ServerConfig = {
   quitMessage: 'Client Quit',
 };
 
-function makeCtx(state: ConnectionState, cfg: ServerConfig = serverConfig): Ctx {
+function makeCtx(
+  state: ConnectionState,
+  cfg: ServerConfig = serverConfig,
+  mtlsIdentity?: MtlsIdentityProvider,
+): Ctx {
   return buildCtx({
     serverConfig: cfg,
     clock: new FakeClock(1_000),
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
+    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
   });
 }
 
@@ -110,6 +116,32 @@ describe('capReducer — LS', () => {
     }
   });
 
+  it('advertises sasl=PLAIN when no mTLS provider is configured', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = capReducer(state, { command: 'CAP', params: ['LS'], tags: {} }, ctx);
+    const send = out.effects[0];
+    expect(send).toBeDefined();
+    if (send?.tag === 'Send') {
+      const body = send.lines[0]?.text ?? '';
+      expect(body).toContain('sasl=PLAIN');
+      expect(body).not.toContain('sasl=PLAIN,EXTERNAL');
+    }
+  });
+
+  it('advertises sasl=PLAIN,EXTERNAL when an mTLS provider is configured', () => {
+    const state = makeState();
+    const provider: MtlsIdentityProvider = { getIdentity: () => 'CN=alice' };
+    const ctx = makeCtx(state, serverConfig, provider);
+    const out = capReducer(state, { command: 'CAP', params: ['LS'], tags: {} }, ctx);
+    const send = out.effects[0];
+    expect(send).toBeDefined();
+    if (send?.tag === 'Send') {
+      const body = send.lines[0]?.text ?? '';
+      expect(body).toContain('sasl=PLAIN,EXTERNAL');
+    }
+  });
+
   it('marks the connection as in CAP negotiation so the welcome is deferred', () => {
     const state = makeState();
     const ctx = makeCtx(state);

package/packages/irc-core/tests/commands/ison.test.ts

@@ -0,0 +1,166 @@
+import { describe, expect, it } from 'vitest';
+import { isonReducer } from '../../src/commands/ison';
+import { Effect } from '../../src/effects';
+import type { Effect as EffectType, RawLine } from '../../src/effects';
+import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const baseServerConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeCtx(state: ConnectionState): Ctx {
+  return buildCtx({
+    serverConfig: baseServerConfig,
+    clock: new FakeClock(5_000),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+  });
+}
+
+function makeState(): ConnectionState {
+  const s = createConnection({ id: 'c1', connectedSince: 0 });
+  s.nick = 'alice';
+  s.user = 'alice';
+  s.host = 'example.com';
+  s.realname = 'Alice';
+  s.registration = 'registered';
+  return s;
+}
+
+const L = (text: string): RawLine => ({ text });
+
+const ison = (...nicks: string[]) => ({ command: 'ISON', params: nicks, tags: {} }) as const;
+
+/** Builds an online map from display-case nicks (auto-folds the key). */
+const onlineMap = (...nicks: string[]): Map<string, string> =>
+  new Map(nicks.map((n) => [n.toLowerCase(), n]));
+
+describe('isonReducer', () => {
+  it('emits 303 RPL_ISON with the online nicks from the requested set', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob', 'carol'), ison('bob', 'carol', 'dave'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob carol')]),
+    ]);
+  });
+
+  it('only includes nicks that are online', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('bob', 'carol', 'dave'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob')]),
+    ]);
+  });
+
+  it('emits an empty trailing when no requested nicks are online', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(new Map(), ison('nobody'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :')]),
+    ]);
+  });
+
+  it('preserves the registered display spelling from the online map', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('Bob'), ison('Bob'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :Bob')]),
+    ]);
+  });
+
+  it('matches case-insensitively (rfc1459 case-mapping)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('BOB'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob')]),
+    ]);
+  });
+
+  it('reports the registered spelling even when requested with different case', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('Bob'), ison('BOB'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :Bob')]),
+    ]);
+  });
+
+  it('uses * as nick placeholder for unregistered connections', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('bob'), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [L(':irc.example.com 303 * :bob')]),
+    );
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    isonReducer(new Map(), ison('bob'), ctx);
+
+    expect(state.lastSeen).toBe(5_000);
+  });
+
+  it('returns the same state reference', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(new Map(), ison(), ctx);
+
+    expect(out.state).toBe(state);
+  });
+
+  it('handles no-nick argument (empty request)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison(), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :')]),
+    ]);
+  });
+
+  it('skips empty-string params in the nick list', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('', 'bob'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob')]),
+    ]);
+  });
+});

package/packages/irc-core/tests/commands/kick.test.ts

@@ -134,6 +134,21 @@ describe('kickReducer — success', () => {
     );
   });
 
+  it('resolves the target using rfc1459 case-mapping ([ and { are equal)', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice', true);
+    addMember(chan, 'c2', 'foo[bar]');
+    const conn = makeConn('c1', 'alice');
+    const ctx = makeCtx(conn);
+
+    const out = kickReducer(chan, { command: 'KICK', params: ['#foo', 'FOO{BAR}'], tags: {} }, ctx);
+
+    expect(out.state.members.has('c2')).toBe(false);
+    expect(out.effects).toContainEqual<EffectType>(
+      Effect.applyChannelDelta('#foo', { memberships: [{ type: 'remove', conn: 'c2' }] }),
+    );
+  });
+
   it('updates the kicker lastSeen to ctx.clock.now()', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice', true);