serverless-ircd 0.2.0 → 0.4.0

package/apps/cf-tcp-container/tests/tls-e2e.test.ts

@@ -0,0 +1,275 @@
+import { execFileSync } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { type Socket, createConnection } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  type Server,
+  type TLSSocket,
+  connect as tlsConnect,
+  createServer as tlsCreateServer,
+} from 'node:tls';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { type ContainerServer, startContainerServer } from '../src/container-server.js';
+
+/**
+ * Generates a self-signed TLS certificate for the test proxy using the
+ * system `openssl` binary. This mirrors what Cloudflare Spectrum does in
+ * production: terminate TLS at the edge with a certificate, then forward
+ * plaintext TCP to the origin.
+ *
+ * If `openssl` is not available, the calling test is skipped — the TLS
+ * e2e requires it to synthesise a trust anchor.
+ */
+async function generateSelfSignedCert(dir: string): Promise<{ key: string; cert: string }> {
+  const keyPath = join(dir, 'key.pem');
+  const certPath = join(dir, 'cert.pem');
+  try {
+    execFileSync(
+      'openssl',
+      [
+        'req',
+        '-x509',
+        '-newkey',
+        'rsa:2048',
+        '-keyout',
+        keyPath,
+        '-out',
+        certPath,
+        '-days',
+        '1',
+        '-nodes',
+        '-subj',
+        '/CN=localhost',
+      ],
+      { stdio: 'pipe' },
+    );
+  } catch {
+    throw new Error('openssl not available — required to generate test TLS cert');
+  }
+  const key = await readFile(keyPath, 'utf8');
+  const cert = await readFile(certPath, 'utf8');
+  return { key, cert };
+}
+
+/**
+ * IRC test client that speaks TLS (mirrors the Spectrum client path).
+ * Connects via `tls.connect`, sends lines with CRLF, parses inbound bytes.
+ */
+class TlsIrcClient extends EventEmitter {
+  readonly socket: TLSSocket;
+  readonly received: string[] = [];
+
+  constructor(host: string, port: number, opts: { key: string; cert: string }) {
+    super();
+    this.socket = tlsConnect({
+      host,
+      port,
+      rejectUnauthorized: false,
+      ca: opts.cert,
+    });
+    this.socket.setEncoding('utf8');
+    this.socket.on('data', (text: string) => {
+      for (const line of text.split(/\r?\n/u)) {
+        if (line.length > 0) {
+          this.received.push(line);
+          this.emit('line', line);
+        }
+      }
+    });
+  }
+
+  secured(): Promise<void> {
+    return new Promise((resolve, reject) => {
+      if (this.socket.authorized !== undefined) resolve();
+      else {
+        this.socket.once('secure', () => resolve());
+        this.socket.once('error', reject);
+      }
+    });
+  }
+
+  send(line: string): Promise<void> {
+    return new Promise((resolve, reject) => {
+      this.socket.write(`${line}\r\n`, (err) => (err ? reject(err) : resolve()));
+    });
+  }
+
+  waitFor(predicate: (line: string) => boolean, timeoutMs = 3000): Promise<string> {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        reject(new Error(`timeout; received: ${JSON.stringify(this.received)}`));
+      }, timeoutMs);
+      const check = (line: string): void => {
+        if (predicate(line)) {
+          clearTimeout(timeout);
+          this.off('line', check);
+          resolve(line);
+        }
+      };
+      for (const line of this.received) {
+        if (predicate(line)) {
+          clearTimeout(timeout);
+          resolve(line);
+          return;
+        }
+      }
+      this.on('line', check);
+    });
+  }
+
+  close(): Promise<void> {
+    return new Promise((resolve) => {
+      this.socket.once('close', () => resolve());
+      this.socket.end();
+    });
+  }
+}
+
+/**
+ * Starts an in-process TLS-terminating proxy (the "stunnel" replacement).
+ * Each TLS connection from a client gets a plaintext TCP connection piped
+ * to the container origin. This is the local analogue of Cloudflare
+ * Spectrum: TLS at the edge, plaintext to the origin.
+ */
+function startTlsProxy(opts: {
+  key: string;
+  cert: string;
+  originHost: string;
+  originPort: number;
+}): Promise<{ server: Server; port: number; close: () => Promise<void> }> {
+  return new Promise((resolve, reject) => {
+    const originSockets = new Set<Socket>();
+    const server = tlsCreateServer({ key: opts.key, cert: opts.cert }, (tlsSocket) => {
+      const origin = createConnection({ host: opts.originHost, port: opts.originPort });
+      originSockets.add(origin);
+      tlsSocket.pipe(origin);
+      origin.pipe(tlsSocket);
+      const cleanup = (): void => {
+        origin.destroy();
+        tlsSocket.destroy();
+      };
+      tlsSocket.on('close', cleanup);
+      origin.on('close', () => {
+        originSockets.delete(origin);
+        tlsSocket.destroy();
+      });
+      tlsSocket.on('error', cleanup);
+      origin.on('error', cleanup);
+    });
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.removeListener('error', reject);
+      const addr = server.address();
+      // c8 ignore next 1
+      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
+      resolve({
+        server,
+        port,
+        close: () =>
+          new Promise<void>((res) => {
+            for (const s of originSockets) s.destroy();
+            originSockets.clear();
+            server.close(() => res());
+          }),
+      });
+    });
+  });
+}
+
+describe('container-server — TLS e2e via in-process proxy (Spectrum analogue)', () => {
+  let origin: ContainerServer;
+  let proxy: { server: Server; port: number; close: () => Promise<void> };
+  let dir: string;
+  let cert: { key: string; cert: string };
+
+  beforeAll(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'sirc-tls-'));
+    try {
+      cert = await generateSelfSignedCert(dir);
+    } catch (err) {
+      // Skip the entire suite if openssl isn't available.
+      console.warn(String((err as Error).message));
+      return;
+    }
+    origin = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.tls.test',
+      networkName: 'TlsTestNet',
+    });
+    proxy = await startTlsProxy({
+      key: cert.key,
+      cert: cert.cert,
+      originHost: '127.0.0.1',
+      originPort: origin.port,
+    });
+  });
+
+  afterAll(async () => {
+    if (proxy !== undefined) await proxy.close();
+    if (origin !== undefined) await origin.close();
+    await rm(dir, { recursive: true, force: true });
+  });
+
+  it('a TLS client completes register → join → privmsg → quit through the proxy', async () => {
+    if (cert === undefined) return; // openssl not available
+
+    const alice = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await alice.secured();
+    const bob = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await bob.secured();
+
+    await alice.send('NICK alice');
+    await alice.send('USER alice 0 * :Alice');
+    await alice.waitFor((l) => l.startsWith(':irc.tls.test 001 '));
+
+    await bob.send('NICK bob');
+    await bob.send('USER bob 0 * :Bob');
+    await bob.waitFor((l) => l.startsWith(':irc.tls.test 001 '));
+
+    await alice.send('JOIN #tls-e2e');
+    await alice.waitFor((l) => l.includes('JOIN #tls-e2e'));
+    await bob.send('JOIN #tls-e2e');
+    await bob.waitFor((l) => l.includes('JOIN #tls-e2e'));
+
+    await alice.send('PRIVMSG #tls-e2e :over tls');
+    await bob.waitFor((l) => l.includes('PRIVMSG #tls-e2e :over tls'));
+
+    await alice.close();
+    await bob.close();
+  });
+
+  it('routes PING → PONG over TLS', async () => {
+    if (cert === undefined) return;
+
+    const client = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await client.secured();
+    await client.send('NICK tlsPing');
+    await client.send('USER tlsPing 0 * :TlsPing');
+    await client.waitFor((l) => l.startsWith(':irc.tls.test 001 '));
+
+    await client.send('PING :tls-tok');
+    await client.waitFor((l) => l === 'PONG :tls-tok');
+    await client.close();
+  });
+
+  it('the origin only sees plaintext (no TLS handshake bytes reach the actor)', async () => {
+    if (cert === undefined) return;
+
+    // If the origin received TLS handshake bytes, the TcpByteStreamTransport
+    // would try to parse them as IRC lines and produce garbage 421 replies.
+    // A clean registration proves only plaintext IRC lines arrived.
+    const client = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await client.secured();
+    await client.send('NICK plaintext');
+    await client.send('USER plaintext 0 * :Plaintext');
+    const welcome = await client.waitFor((l) => l.startsWith(':irc.tls.test 001 plaintext'));
+    expect(welcome).toBeDefined();
+    // No 421 (ERR_UNKNOWNCOMMAND) should appear — that would indicate
+    // non-IRC bytes (TLS handshake) leaking through to the parser.
+    expect(client.received.some((l) => l.includes(' 421 '))).toBe(false);
+    await client.close();
+  });
+});

package/apps/cf-tcp-container/tsconfig.build.json

@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "tsBuildInfoFile": "./.tsbuildinfo",
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["dist", "tests", "**/*.test.ts", "src/worker.ts", "src/container-do.ts"],
+  "references": [
+    { "path": "../../packages/irc-core/tsconfig.build.json" },
+    { "path": "../../packages/irc-server/tsconfig.build.json" },
+    { "path": "../../packages/in-memory-runtime/tsconfig.build.json" }
+  ]
+}

package/apps/cf-tcp-container/tsconfig.test.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "types": ["node"],
+    "composite": false
+  },
+  "include": ["src/**/*.ts", "tests/**/*.ts"],
+  "exclude": ["dist", "src/worker.ts", "src/container-do.ts"],
+  "references": [
+    { "path": "../../packages/irc-core/tsconfig.build.json" },
+    { "path": "../../packages/irc-server/tsconfig.build.json" },
+    { "path": "../../packages/in-memory-runtime/tsconfig.build.json" }
+  ]
+}

package/apps/cf-tcp-container/vitest.config.ts

@@ -0,0 +1,26 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    testTimeout: 10_000,
+    include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      all: false,
+      include: ['src/**/*.ts'],
+      // `main.ts` is CLI glue (argv parsing, signal handlers); exercised
+      // manually by `pnpm start`. `worker.ts` + `container-do.ts` are
+      // wrangler-only deploy artifacts (depend on @cloudflare/containers,
+      // compiled by wrangler at deploy time). The rest targets ≥90%.
+      exclude: ['src/main.ts', 'src/worker.ts', 'src/container-do.ts'],
+      reporter: ['text', 'html', 'json-summary'],
+      thresholds: {
+        lines: 90,
+        functions: 90,
+        branches: 80,
+        statements: 90,
+      },
+    },
+  },
+});

package/apps/cf-tcp-container/wrangler.toml

@@ -0,0 +1,63 @@
+#:vim:set ft=toml:
+##
+## Cloudflare Containers config for the ServerlessIRCd TCP origin.
+##
+## Deploys the IRC TCP container (apps/cf-tcp-container) to the Cloudflare
+## Containers platform. The container listens on port 6667 (plaintext TCP);
+## Cloudflare Spectrum (configured separately in terraform/spectrum.tf)
+## terminates TLS on :6697 and forwards plaintext to this container.
+##
+## Prerequisites:
+##   - Cloudflare account with Containers beta access.
+##   - wrangler v4.112+ (`pnpm add -g wrangler`).
+##   - The container image is built from apps/cf-tcp-container/Dockerfile.
+##
+## Deploy:
+##   wrangler deploy --env staging
+##
+
+name = "sirc-tcp-origin"
+main = "src/worker.ts"
+compatibility_date = "2024-11-01"
+compatibility_flags = ["nodejs_compat"]
+
+[observability]
+enabled = true
+
+# --- Container definition ---
+# The IRC TCP origin container. Listens on port 6667; the Worker below is a
+# thin management/health-check wrapper (Spectrum routes TCP directly to the
+# container origin, not through the Worker).
+[[containers]]
+class_name = "IrcTcpOrigin"
+image = "./Dockerfile"
+instance_type = "standard-1"
+max_instances = 3
+sleep_after = "2h"
+
+# --- Durable Object binding for the container ---
+[[durable_objects.bindings]]
+name = "IRC_TCP_ORIGIN"
+class_name = "IrcTcpOrigin"
+
+# --- Migration ---
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["IrcTcpOrigin"]
+
+# --- Environment ---
+[vars]
+SERVER_NAME = "irc.example.com"
+NETWORK_NAME = "ExampleNet"
+MOTD_LINES = "Welcome to the ServerlessIRCd TCP origin."
+TCP_PORT = "6667"
+PERSISTENCE_PATH = "/data/state.json"
+
+# --- Staging ---
+[env.staging]
+name = "sirc-tcp-origin-staging"
+
+[env.staging.vars]
+SERVER_NAME = "irc-staging.example.com"
+NETWORK_NAME = "StagingNet"
+MOTD_LINES = "Welcome to the staging ServerlessIRCd TCP origin."

package/apps/cf-worker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-worker",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Cloudflare Worker deploy glue: WebSocket edge entry point + DO bindings + wrangler pipeline",
   "license": "BSD-3-Clause",

package/apps/cf-worker/src/worker.ts

@@ -22,11 +22,17 @@
  * See `wrangler.toml` and `docs/deployment-cf.md`.
  */
 
-import { ChannelDO, ConnectionDO, type Env, RegistryDO } from '@serverless-ircd/cf-adapter';
+import {
+  ChannelDO,
+  ChannelRegistryDO,
+  ConnectionDO,
+  type Env,
+  RegistryDO,
+} from '@serverless-ircd/cf-adapter';
 
 // Re-exported for wrangler DO binding resolution. The class names below
 // MUST match `class_name` in `wrangler.toml`.
-export { ChannelDO, ConnectionDO, RegistryDO };
+export { ChannelDO, ChannelRegistryDO, ConnectionDO, RegistryDO };
 export type { Env };
 
 /**

package/apps/cf-worker/tests/smoke.test.ts

@@ -26,6 +26,7 @@ declare global {
       CONNECTION_DO: DurableObjectNamespace;
       REGISTRY_DO: DurableObjectNamespace;
       CHANNEL_DO: DurableObjectNamespace;
+      CHANNEL_REGISTRY_DO: DurableObjectNamespace;
       SERVER_NAME: string;
       NETWORK_NAME: string;
       MOTD_LINES: string;

package/apps/cf-worker/wrangler.test.toml

@@ -28,6 +28,16 @@ class_name = "RegistryDO"
 name = "CHANNEL_DO"
 class_name = "ChannelDO"
 
+[[durable_objects.bindings]]
+name = "CHANNEL_REGISTRY_DO"
+class_name = "ChannelRegistryDO"
+
+# D1 backing for persistent SASL accounts
+[[d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "cf-worker-test-accounts"
+database_id = "test-d1-worker-accounts"
+
 [[migrations]]
 tag = "v1"
-new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO"]
+new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO"]

package/apps/cf-worker/wrangler.toml

@@ -50,7 +50,10 @@ invocation_logs = true
 [vars]
 SERVER_NAME = "irc.example.com"
 NETWORK_NAME = "ServerlessIRCd"
-MOTD_LINES = "Welcome to ServerlessIRCd.\nThis is a deployed Cloudflare Worker."
+MOTD_LINES = """
+Welcome to ServerlessIRCd.
+This is a deployed Cloudflare Worker.
+"""
 
 ## ---------------------------------------------------------------------------
 ## Staging environment.
@@ -68,7 +71,30 @@ head_sampling_rate = 1
 [env.staging.vars]
 SERVER_NAME = "irc-staging.example.com"
 NETWORK_NAME = "ServerlessIRCd (staging)"
-MOTD_LINES = "Welcome to ServerlessIRCd staging.\nThis Worker was deployed by CI from the main branch."
+MOTD_LINES = """
+Welcome to ServerlessIRCd staging.
+This is a deployed Cloudflare Worker.
+This Worker was deployed by CI from the main branch.
+"""
+
+## ---------------------------------------------------------------------------
+## D1 database — SASL account persistence.
+## ---------------------------------------------------------------------------
+## The `accounts` table stores scrypt-hashed SASL PLAIN credentials (never
+## plaintext). Loaded at ConnectionDO construction; when empty or unreachable
+## the resolver falls back to the `SASL_ACCOUNTS` env-var seed. Provision with:
+##   wrangler d1 create serverless-ircd-accounts
+##   wrangler d1 execute serverless-ircd-accounts --command \
+##     "CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)"
+## Seed accounts via `tools/seed-cf-accounts.ts`.
+[[d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "serverless-ircd-accounts"
+# database_id is filled in by `wrangler d1 create` and is env-specific.
+
+[[env.staging.d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "serverless-ircd-accounts-staging"
 
 ## ---------------------------------------------------------------------------
 ## Durable Object bindings.
@@ -91,6 +117,10 @@ class_name = "RegistryDO"
 name = "CHANNEL_DO"
 class_name = "ChannelDO"
 
+[[durable_objects.bindings]]
+name = "CHANNEL_REGISTRY_DO"
+class_name = "ChannelRegistryDO"
+
 # Staging environment bindings (wrangler requires per-env blocks).
 [[env.staging.durable_objects.bindings]]
 name = "CONNECTION_DO"
@@ -104,20 +134,40 @@ class_name = "RegistryDO"
 name = "CHANNEL_DO"
 class_name = "ChannelDO"
 
-## ---------------------------------------------------------------------------
-## Durable Object migrations.
-## ---------------------------------------------------------------------------
-## `tag` is the user-defined migration id; wrangler refuses to deploy if
-## the on-disk migrations don't match the live Workers state. `new_classes`
-## declares the three DO classes on first deploy; subsequent schema
-## changes (renames, deletions, splits) extend this list with their own
-## `tag` so the runtime can migrate persisted state.
-##
-## See https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/
-[[migrations]]
-tag = "v1"
-new_sqlite_classes = ["ConnectionDO", "RegistryDO", "ChannelDO"]
-
-[[env.staging.migrations]]
-tag = "v1"
-new_sqlite_classes = ["ConnectionDO", "RegistryDO", "ChannelDO"]
+[[env.staging.durable_objects.bindings]]
+name = "CHANNEL_REGISTRY_DO"
+class_name = "ChannelRegistryDO"
+
+# ## ---------------------------------------------------------------------------
+# ## Durable Object migrations.
+# ## ---------------------------------------------------------------------------
+# ## `tag` is the user-defined migration id; wrangler refuses to deploy if
+# ## the on-disk migrations don't match the live Workers state. `new_classes`
+# ## declares the three DO classes on first deploy; subsequent schema
+# ## changes (renames, deletions, splits) extend this list with their own
+# ## `tag` so the runtime can migrate persisted state.
+# ##
+# ## See https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/
+# [[migrations]]
+# tag = "v1"
+# new_sqlite_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO"]
+
+# [[env.staging.migrations]]
+# tag = "v1"
+# new_sqlite_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO"]
+
+[exports.ConnectionDO]
+type = "durable-object"
+storage = "sqlite"
+
+[exports.RegistryDO]
+type = "durable-object"
+storage = "sqlite"
+
+[exports.ChannelDO]
+type = "durable-object"
+storage = "sqlite"
+
+[exports.ChannelRegistryDO]
+type = "durable-object"
+storage = "sqlite"

package/apps/local-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/local-cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Runnable WebSocket IRC server using the in-memory runtime; manual-test harness and e2e fixture target",
   "license": "BSD-3-Clause",

package/apps/local-cli/src/config-loader.ts

@@ -21,6 +21,16 @@ import { type ParsedServerConfig, parseServerConfig } from '@serverless-ircd/irc
 export interface CliConfigInput {
   serverName: string;
   networkName: string;
+  /**
+   * Server version surfaced in `002`/`004`/`351`/`371`. When omitted the
+   * schema default ({@link DEFAULT_SERVER_VERSION}) applies.
+   */
+  serverVersion?: string;
+  /**
+   * "Created" text for `003 RPL_CREATED`. A string is used verbatim; a
+   * number is treated as epoch-ms and formatted as a UTC timestamp.
+   */
+  createdAt?: string | number;
   motdLines?: string[];
   channelPrefixes?: string;
   maxClients?: number;
@@ -32,6 +42,7 @@ export interface CliConfigInput {
   channelLen?: number;
   topicLen?: number;
   quitMessage?: string;
+  saslAccounts?: Array<{ username: string; password: string }>;
 }
 
 /**

package/apps/local-cli/src/main.ts

@@ -14,7 +14,7 @@
  * Both listeners share one runtime, so a TCP client and a WS client can
  * see each other (cross-transport channel broadcast). Pass `--no-tcp` to
  * run WebSocket-only; the WebSocket port / hostname / MOTD are tunable via
- * flags (a fuller config-loader lands in a later ticket).
+ * flags.
  *
  * Usage:
  *   pnpm --filter local-cli start -- --port 6667 --tcp-port 6668 --host 127.0.0.1