serverless-ircd 0.2.0 → 0.4.0

package/packages/irc-core/tests/commands/sasl.test.ts

@@ -4,7 +4,7 @@ import { capReducer } from '../../src/commands/cap';
 import { authenticateReducer } from '../../src/commands/sasl';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
-import type { AccountStore, SaslPayload, SaslResult } from '../../src/ports';
+import type { AccountStore, MtlsIdentityProvider, SaslPayload, SaslResult } from '../../src/ports';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
 import { encodeBase64 } from '../../src/protocol/base64';
 import type { IrcMessage } from '../../src/protocol/messages';
@@ -40,7 +40,11 @@ function saslReadyState(): ConnectionState {
   return s;
 }
 
-function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
+function makeCtx(
+  state: ConnectionState,
+  accounts?: AccountStore,
+  mtlsIdentity?: MtlsIdentityProvider,
+): Ctx {
   return buildCtx({
     serverConfig,
     clock: new FakeClock(1_000),
@@ -48,6 +52,7 @@ function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
     motd: EmptyMotdProvider,
     connection: state,
     ...(accounts !== undefined ? { accounts } : {}),
+    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
   });
 }
 
@@ -61,6 +66,19 @@ class FakeAccountStore implements AccountStore {
   }
 }
 
+/** A fake MtlsIdentityProvider that returns a canned identity for one connId. */
+class FakeMtlsIdentityProvider implements MtlsIdentityProvider {
+  readonly calls: string[] = [];
+  constructor(
+    private readonly connId: string,
+    private readonly identity: string | undefined,
+  ) {}
+  getIdentity(connId: string): string | undefined {
+    this.calls.push(connId);
+    return connId === this.connId ? this.identity : undefined;
+  }
+}
+
 /** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
 function plainPayload(authcid: string, password: string, authzid = ''): string {
   return encodeBase64(`${authzid}\0${authcid}\0${password}`);
@@ -243,25 +261,103 @@ describe('authenticateReducer — no AccountStore configured', () => {
 });
 
 // ============================================================================
-// AUTHENTICATE EXTERNAL — stubbed
+// AUTHENTICATE EXTERNAL — mTLS-backed SASL EXTERNAL
 // ============================================================================
 
-describe('authenticateReducer — EXTERNAL stubbed', () => {
-  it('rejects EXTERNAL immediately with 904 (not yet supported)', () => {
+describe('authenticateReducer — EXTERNAL with mTLS', () => {
+  it('enters the payload phase when an mTLS provider is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+    const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+
+    expect(state.saslMech).toBe('EXTERNAL');
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([L('AUTHENTICATE +')]);
+  });
+
+  it('returns 908 ERR_SASLMECHS when no mTLS provider is configured', () => {
     const state = saslReadyState();
     const ctx = makeCtx(state);
     const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
 
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
-      L(`:${SV} 904 alice :SASL authentication failed`),
+      L(`:${SV} 908 alice PLAIN :are the available SASL mechanisms`),
     ]);
+    expect(state.saslMech).toBeUndefined();
   });
 
-  it('does not enter the payload phase for EXTERNAL', () => {
+  it('succeeds (900/903) when a valid cert identity is presented', () => {
     const state = saslReadyState();
-    const ctx = makeCtx(state);
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, accounts, provider);
+
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(state.account).toBe('alice');
+    expect(accounts.calls).toEqual([
+      { mech: 'EXTERNAL', payload: { kind: 'EXTERNAL', identity: 'CN=alice' } },
+    ]);
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`),
+      L(`:${SV} 903 alice :SASL authentication successful`),
+    ]);
+  });
+
+  it('clears saslMech/saslBuffer after a successful EXTERNAL', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    authenticateReducer(state, authenticate('+'), ctx);
+
     expect(state.saslMech).toBeUndefined();
+    expect(state.saslBuffer).toBeUndefined();
+  });
+
+  it('fails with 904 when the provider has no identity for the connection', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', undefined);
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+    expect(state.account).toBeUndefined();
+  });
+
+  it('fails with 904 when the account store rejects the identity', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'untrusted certificate' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=evil');
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+  });
+
+  it('fails with 904 when no account store is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
   });
 });
 
@@ -275,6 +371,17 @@ describe('authenticateReducer — unknown mechanism', () => {
     const ctx = makeCtx(state);
     const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
 
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 908 alice PLAIN :are the available SASL mechanisms`),
+    ]);
+  });
+
+  it('lists PLAIN,EXTERNAL in 908 when an mTLS provider is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+    const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
+
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
       L(`:${SV} 908 alice PLAIN,EXTERNAL :are the available SASL mechanisms`),
     ]);
@@ -529,8 +636,9 @@ describe('authenticateReducer — CAP REQ sasl integration', () => {
     expect(state.account).toBe('alice');
   });
 
-  it('does not affect the advertised sasl cap value (PLAIN,EXTERNAL)', () => {
+  it('advertises the base sasl cap value (PLAIN) without mTLS', () => {
     const advertised = getLsString();
-    expect(advertised).toContain('sasl=PLAIN,EXTERNAL');
+    expect(advertised).toContain('sasl=PLAIN');
+    expect(advertised).not.toContain('sasl=PLAIN,EXTERNAL');
   });
 });

package/packages/irc-core/tests/commands/server-info.test.ts

@@ -0,0 +1,274 @@
+import { describe, expect, it } from 'vitest';
+import {
+  adminReducer,
+  infoReducer,
+  timeReducer,
+  versionReducer,
+} from '../../src/commands/server-info';
+import { DEFAULT_SERVER_VERSION } from '../../src/config';
+import { Effect } from '../../src/effects';
+import type { Effect as EffectType, RawLine } from '../../src/effects';
+import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const baseServerConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeCtx(state: ConnectionState, clockMs = 5_000): Ctx {
+  return buildCtx({
+    serverConfig: baseServerConfig,
+    clock: new FakeClock(clockMs),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+  });
+}
+
+function makeState(): ConnectionState {
+  const s = createConnection({ id: 'c1', connectedSince: 0 });
+  s.nick = 'alice';
+  s.user = 'alice';
+  s.host = 'example.com';
+  s.realname = 'Alice';
+  s.registration = 'registered';
+  return s;
+}
+
+const L = (text: string): RawLine => ({ text });
+
+const version = (server?: string) =>
+  ({ command: 'VERSION', params: server === undefined ? [] : [server], tags: {} }) as const;
+
+const time = (server?: string) =>
+  ({ command: 'TIME', params: server === undefined ? [] : [server], tags: {} }) as const;
+
+const admin = (server?: string) =>
+  ({ command: 'ADMIN', params: server === undefined ? [] : [server], tags: {} }) as const;
+
+const info = (server?: string) =>
+  ({ command: 'INFO', params: server === undefined ? [] : [server], tags: {} }) as const;
+
+// ---------------------------------------------------------------------------
+// VERSION
+// ---------------------------------------------------------------------------
+
+describe('versionReducer', () => {
+  it('emits 351 RPL_VERSION with the server version and name', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = versionReducer(state, version(), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [
+        L(`:irc.example.com 351 alice ${DEFAULT_SERVER_VERSION} irc.example.com :ExampleNet`),
+      ]),
+    ]);
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const state = makeState();
+    const ctx = makeCtx(state, 9_999);
+
+    versionReducer(state, version(), ctx);
+
+    expect(state.lastSeen).toBe(9_999);
+  });
+
+  it('uses * as nick placeholder for unregistered connections', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = versionReducer(state, version(), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [
+        L(`:irc.example.com 351 * ${DEFAULT_SERVER_VERSION} irc.example.com :ExampleNet`),
+      ]),
+    );
+  });
+
+  it('ignores the optional server target parameter (single-server deployment)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = versionReducer(state, version('other.server'), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [
+        L(`:irc.example.com 351 alice ${DEFAULT_SERVER_VERSION} irc.example.com :ExampleNet`),
+      ]),
+    );
+  });
+
+  it('returns the same state reference', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = versionReducer(state, version(), ctx);
+
+    expect(out.state).toBe(state);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// TIME
+// ---------------------------------------------------------------------------
+
+describe('timeReducer', () => {
+  it('emits 391 RPL_TIME with a human-readable timestamp from the clock', () => {
+    const state = makeState();
+    const ctx = makeCtx(state, 1_700_000_000_000);
+
+    const out = timeReducer(state, time(), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [
+        L(':irc.example.com 391 alice irc.example.com :2023-11-14T22:13:20.000Z'),
+      ]),
+    ]);
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const state = makeState();
+    const ctx = makeCtx(state, 42_000);
+
+    timeReducer(state, time(), ctx);
+
+    expect(state.lastSeen).toBe(42_000);
+  });
+
+  it('uses * as nick placeholder for unregistered connections', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state, 1_700_000_000_000);
+
+    const out = timeReducer(state, time(), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [L(':irc.example.com 391 * irc.example.com :2023-11-14T22:13:20.000Z')]),
+    );
+  });
+
+  it('ignores the optional server target parameter', () => {
+    const state = makeState();
+    const ctx = makeCtx(state, 1_700_000_000_000);
+
+    const out = timeReducer(state, time('elsewhere'), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [
+        L(':irc.example.com 391 alice irc.example.com :2023-11-14T22:13:20.000Z'),
+      ]),
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// ADMIN
+// ---------------------------------------------------------------------------
+
+describe('adminReducer', () => {
+  it('emits 256 RPL_ADMINME with the server name', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = adminReducer(state, admin(), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 256 alice irc.example.com :Administrative info')]),
+    ]);
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const state = makeState();
+    const ctx = makeCtx(state, 7_777);
+
+    adminReducer(state, admin(), ctx);
+
+    expect(state.lastSeen).toBe(7_777);
+  });
+
+  it('uses * as nick placeholder for unregistered connections', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = adminReducer(state, admin(), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [L(':irc.example.com 256 * irc.example.com :Administrative info')]),
+    );
+  });
+
+  it('ignores the optional server target parameter', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = adminReducer(state, admin('foo'), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [L(':irc.example.com 256 alice irc.example.com :Administrative info')]),
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// INFO
+// ---------------------------------------------------------------------------
+
+describe('infoReducer', () => {
+  it('emits 371 RPL_INFO lines followed by 374 RPL_ENDOFINFO', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = infoReducer(state, info(), ctx);
+
+    const lines = (out.effects[0] as { lines: RawLine[] }).lines;
+    expect(lines[0]).toEqual(
+      L(`:irc.example.com 371 alice :ServerlessIRCd - version ${DEFAULT_SERVER_VERSION}`),
+    );
+    expect(lines[1]).toEqual(L(':irc.example.com 371 alice :Running on network ExampleNet'));
+    expect(lines[lines.length - 1]).toEqual(L(':irc.example.com 374 alice :End of INFO list'));
+  });
+
+  it('includes at least one 371 line and the 374 terminator', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = infoReducer(state, info(), ctx);
+
+    const texts = (out.effects[0] as { lines: RawLine[] }).lines.map((l) => l.text);
+    const rpl371Count = texts.filter((t) => / 371 /.test(t)).length;
+    const rpl374Count = texts.filter((t) => / 374 /.test(t)).length;
+    expect(rpl371Count).toBeGreaterThanOrEqual(1);
+    expect(rpl374Count).toBe(1);
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const state = makeState();
+    const ctx = makeCtx(state, 3_333);
+
+    infoReducer(state, info(), ctx);
+
+    expect(state.lastSeen).toBe(3_333);
+  });
+
+  it('uses * as nick placeholder for unregistered connections', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = infoReducer(state, info(), ctx);
+
+    const texts = (out.effects[0] as { lines: RawLine[] }).lines.map((l) => l.text);
+    expect(texts.every((t) => t.includes(' * '))).toBe(true);
+  });
+});