serverless-ircd 0.3.0 → 0.4.0

package/packages/irc-core/tests/commands/ison.test.ts

@@ -0,0 +1,166 @@
+import { describe, expect, it } from 'vitest';
+import { isonReducer } from '../../src/commands/ison';
+import { Effect } from '../../src/effects';
+import type { Effect as EffectType, RawLine } from '../../src/effects';
+import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const baseServerConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeCtx(state: ConnectionState): Ctx {
+  return buildCtx({
+    serverConfig: baseServerConfig,
+    clock: new FakeClock(5_000),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+  });
+}
+
+function makeState(): ConnectionState {
+  const s = createConnection({ id: 'c1', connectedSince: 0 });
+  s.nick = 'alice';
+  s.user = 'alice';
+  s.host = 'example.com';
+  s.realname = 'Alice';
+  s.registration = 'registered';
+  return s;
+}
+
+const L = (text: string): RawLine => ({ text });
+
+const ison = (...nicks: string[]) => ({ command: 'ISON', params: nicks, tags: {} }) as const;
+
+/** Builds an online map from display-case nicks (auto-folds the key). */
+const onlineMap = (...nicks: string[]): Map<string, string> =>
+  new Map(nicks.map((n) => [n.toLowerCase(), n]));
+
+describe('isonReducer', () => {
+  it('emits 303 RPL_ISON with the online nicks from the requested set', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob', 'carol'), ison('bob', 'carol', 'dave'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob carol')]),
+    ]);
+  });
+
+  it('only includes nicks that are online', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('bob', 'carol', 'dave'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob')]),
+    ]);
+  });
+
+  it('emits an empty trailing when no requested nicks are online', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(new Map(), ison('nobody'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :')]),
+    ]);
+  });
+
+  it('preserves the registered display spelling from the online map', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('Bob'), ison('Bob'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :Bob')]),
+    ]);
+  });
+
+  it('matches case-insensitively (rfc1459 case-mapping)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('BOB'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob')]),
+    ]);
+  });
+
+  it('reports the registered spelling even when requested with different case', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('Bob'), ison('BOB'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :Bob')]),
+    ]);
+  });
+
+  it('uses * as nick placeholder for unregistered connections', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('bob'), ctx);
+
+    expect(out.effects[0]).toEqual<EffectType>(
+      Effect.send('c1', [L(':irc.example.com 303 * :bob')]),
+    );
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    isonReducer(new Map(), ison('bob'), ctx);
+
+    expect(state.lastSeen).toBe(5_000);
+  });
+
+  it('returns the same state reference', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(new Map(), ison(), ctx);
+
+    expect(out.state).toBe(state);
+  });
+
+  it('handles no-nick argument (empty request)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison(), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :')]),
+    ]);
+  });
+
+  it('skips empty-string params in the nick list', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = isonReducer(onlineMap('bob'), ison('', 'bob'), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 303 alice :bob')]),
+    ]);
+  });
+});

package/packages/irc-core/tests/commands/quit.test.ts

@@ -2,7 +2,12 @@ import { describe, expect, it } from 'vitest';
 import { quitReducer } from '../../src/commands/quit';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
-import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import {
+  EmptyMotdProvider,
+  FakeClock,
+  InMemoryNickHistoryStore,
+  SequentialIdFactory,
+} from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
@@ -18,13 +23,18 @@ const serverConfig: ServerConfig = {
   quitMessage: 'Client Quit',
 };
 
-function makeCtx(state: ConnectionState, clock = new FakeClock(1_000)): Ctx {
+function makeCtx(
+  state: ConnectionState,
+  clock = new FakeClock(1_000),
+  history?: InMemoryNickHistoryStore,
+): Ctx {
   return buildCtx({
     serverConfig,
     clock,
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
+    ...(history !== undefined ? { history } : {}),
   });
 }
 
@@ -217,4 +227,61 @@ describe('quitReducer', () => {
       Effect.disconnect('c1'),
     ]);
   });
+
+  it('records a nick-history entry when ctx.history is bound', () => {
+    const state = makeRegisteredState();
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtx(state, clock, history);
+
+    quitReducer(state, { command: 'QUIT', params: ['bye'], tags: {} }, ctx);
+
+    const entries = history.query('alice', 10);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.nick).toBe('alice');
+    expect(entries[0]?.connId).toBe('c1');
+    expect(entries[0]?.username).toBe('alice');
+    expect(entries[0]?.hostname).toBe('example.com');
+    expect(entries[0]?.realname).toBe('Alice');
+    expect(entries[0]?.signoffTime).toBe(5_000);
+  });
+
+  it('does not record history when no store is bound (ctx.history undefined)', () => {
+    const state = makeRegisteredState();
+    const ctx = makeCtx(state);
+
+    const out = quitReducer(state, { command: 'QUIT', params: [], tags: {} }, ctx);
+
+    expect(out.effects).toContainEqual<EffectType>(Effect.disconnect('c1'));
+    // No crash; the no-store path is a graceful no-op.
+  });
+
+  it('does not record history when the connection was never registered', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtx(state, clock, history);
+
+    quitReducer(state, { command: 'QUIT', params: [], tags: {} }, ctx);
+
+    expect(history.query('ghost', 10)).toEqual([]);
+  });
+
+  it('records a history entry with only nick/connId when user/host/realname are absent', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.nick = 'alice';
+    state.registration = 'registered';
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtx(state, clock, history);
+
+    quitReducer(state, { command: 'QUIT', params: [], tags: {} }, ctx);
+
+    const entries = history.query('alice', 10);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.nick).toBe('alice');
+    expect(entries[0]?.username).toBeUndefined();
+    expect(entries[0]?.hostname).toBeUndefined();
+    expect(entries[0]?.realname).toBeUndefined();
+  });
 });

package/packages/irc-core/tests/commands/registration.test.ts

@@ -9,11 +9,13 @@ import {
   passReducer,
   userReducer,
 } from '../../src/commands/registration';
+import { DEFAULT_CREATED_TEXT, DEFAULT_SERVER_VERSION } from '../../src/config';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import {
   EmptyMotdProvider,
   FakeClock,
+  InMemoryNickHistoryStore,
   SequentialIdFactory,
   StaticMotdProvider,
 } from '../../src/ports';
@@ -47,6 +49,22 @@ function makeCtx(
   });
 }
 
+/** Like {@link makeCtx} but also threads a bound nick-history store. */
+function makeCtxWithHistory(
+  state: ConnectionState,
+  history: InMemoryNickHistoryStore,
+  clock = new FakeClock(1_000),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    history,
+  });
+}
+
 function makeState(): ConnectionState {
   return createConnection({ id: 'c1', connectedSince: 0 });
 }
@@ -86,9 +104,9 @@ function expectedWelcome(nick: string, user: string, host: string | undefined):
   );
   return [
     L(`${prefix} 001 ${nick} :Welcome to the ExampleNet IRC Network, ${hostmask}`),
-    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version 0.2.0`),
-    L(`${prefix} 003 ${nick} :This server was created in Phase 1`),
-    L(`${prefix} 004 ${nick} ${sv} 0.2.0 iosw biklmnstp`),
+    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${DEFAULT_SERVER_VERSION}`),
+    L(`${prefix} 003 ${nick} :This server was created in ${DEFAULT_CREATED_TEXT}`),
+    L(`${prefix} 004 ${nick} ${sv} ${DEFAULT_SERVER_VERSION} iosw biklmnstp`),
     ...isupport,
     L(`${prefix} 422 ${nick} :MOTD File is missing`),
   ];
@@ -327,6 +345,63 @@ describe('nickReducer', () => {
     expect(out.effects).toEqual([]);
     expect(out.state.nick).toBeUndefined();
   });
+
+  it('records the old nick into ctx.history on a post-registration nick change', () => {
+    const state = registeredState();
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtxWithHistory(state, history, clock);
+
+    nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+
+    const entries = history.query('alice', 10);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.nick).toBe('alice');
+    expect(entries[0]?.connId).toBe('c1');
+    expect(entries[0]?.username).toBe('alice');
+    expect(entries[0]?.hostname).toBe('example.com');
+    expect(entries[0]?.realname).toBe('Alice');
+    expect(entries[0]?.signoffTime).toBe(5_000);
+  });
+
+  it('does not record history on a pre-registration NICK', () => {
+    const state = makeState();
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtxWithHistory(state, history, clock);
+
+    nickReducer(state, { command: 'NICK', params: ['alice'], tags: {} }, ctx);
+
+    expect(history.query('alice', 10)).toEqual([]);
+  });
+
+  it('does not record history on a nick change when no store is bound', () => {
+    const state = registeredState();
+    const ctx = makeCtx(state);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+
+    // No crash; the no-store path is a graceful no-op.
+    expect(out.state.nick).toBe('bob');
+  });
+
+  it('records a history entry with only nick/connId when user/host/realname are absent', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.registration = 'registered';
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtxWithHistory(state, history, clock);
+
+    nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+
+    const entries = history.query('alice', 10);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.nick).toBe('alice');
+    expect(entries[0]?.username).toBeUndefined();
+    expect(entries[0]?.hostname).toBeUndefined();
+    expect(entries[0]?.realname).toBeUndefined();
+  });
 });
 
 // ============================================================================
@@ -568,6 +643,76 @@ describe('buildWelcomeLines', () => {
   });
 });
 
+// ============================================================================
+// buildWelcomeLines — server version / created text driven from ServerConfig
+// ============================================================================
+
+describe('buildWelcomeLines — config-driven version & created text', () => {
+  /** Builds a ctx whose serverConfig carries the supplied version/created. */
+  function makeCtxWithMeta(
+    state: ConnectionState,
+    serverVersion: string | undefined,
+    createdAt: string | number | undefined,
+  ): Ctx {
+    const cfg: ServerConfig = {
+      ...serverConfig,
+      ...(serverVersion !== undefined ? { serverVersion } : {}),
+      ...(createdAt !== undefined ? { createdAt } : {}),
+    };
+    return buildCtx({
+      serverConfig: cfg,
+      clock: new FakeClock(1_000),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: state,
+    });
+  }
+
+  function registeredConn(): ConnectionState {
+    const s = makeState();
+    s.nick = 'alice';
+    s.user = 'alice';
+    s.host = 'example.com';
+    return s;
+  }
+
+  it('reflects the configured serverVersion in the 002 and 004 lines', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), '9.9.9', undefined);
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line002 = lines.find((l) => l.text.split(' ')[1] === '002');
+    const line004 = lines.find((l) => l.text.split(' ')[1] === '004');
+    expect(line002?.text).toContain('9.9.9');
+    expect(line004?.text).toContain('9.9.9');
+  });
+
+  it('reflects the configured createdAt string in the 003 line', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), undefined, '2024-06-01');
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line003 = lines.find((l) => l.text.split(' ')[1] === '003');
+    expect(line003?.text).toContain('2024-06-01');
+  });
+
+  it('formats a numeric createdAt (epoch ms) into the 003 line', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), undefined, 1_700_000_000_000);
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line003 = lines.find((l) => l.text.split(' ')[1] === '003');
+    // 1700000000000ms → 2023-11-14T22:13:20.000Z ; the formatted text must
+    // contain a human-readable rendering of that instant, not the raw number.
+    expect(line003?.text).not.toContain('1700000000000');
+    expect(line003?.text).toContain('2023');
+  });
+
+  it('falls back to the default version when serverVersion is omitted', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), undefined, undefined);
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line002 = lines.find((l) => l.text.split(' ')[1] === '002');
+    // The hardcoded placeholder '0.2.0' must no longer appear; the default
+    // is the irc-core package version (DEFAULT_SERVER_VERSION).
+    expect(line002?.text).not.toContain('0.2.0');
+    expect(line002?.text).toContain(DEFAULT_SERVER_VERSION);
+  });
+});
+
 // ============================================================================
 // buildWelcomeLines — MOTD driven from MotdProvider
 // ============================================================================
@@ -950,9 +1095,9 @@ function expectedWelcomeWithHost(nick: string, hostmask: string): RawLine[] {
   );
   return [
     L(`${prefix} 001 ${nick} :Welcome to the ExampleNet IRC Network, ${hostmask}`),
-    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version 0.2.0`),
-    L(`${prefix} 003 ${nick} :This server was created in Phase 1`),
-    L(`${prefix} 004 ${nick} ${sv} 0.2.0 iosw biklmnstp`),
+    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${DEFAULT_SERVER_VERSION}`),
+    L(`${prefix} 003 ${nick} :This server was created in ${DEFAULT_CREATED_TEXT}`),
+    L(`${prefix} 004 ${nick} ${sv} ${DEFAULT_SERVER_VERSION} iosw biklmnstp`),
     ...isupport,
     L(`${prefix} 422 ${nick} :MOTD File is missing`),
   ];

package/packages/irc-core/tests/commands/sasl.test.ts

@@ -4,7 +4,7 @@ import { capReducer } from '../../src/commands/cap';
 import { authenticateReducer } from '../../src/commands/sasl';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
-import type { AccountStore, SaslPayload, SaslResult } from '../../src/ports';
+import type { AccountStore, MtlsIdentityProvider, SaslPayload, SaslResult } from '../../src/ports';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
 import { encodeBase64 } from '../../src/protocol/base64';
 import type { IrcMessage } from '../../src/protocol/messages';
@@ -40,7 +40,11 @@ function saslReadyState(): ConnectionState {
   return s;
 }
 
-function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
+function makeCtx(
+  state: ConnectionState,
+  accounts?: AccountStore,
+  mtlsIdentity?: MtlsIdentityProvider,
+): Ctx {
   return buildCtx({
     serverConfig,
     clock: new FakeClock(1_000),
@@ -48,6 +52,7 @@ function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
     motd: EmptyMotdProvider,
     connection: state,
     ...(accounts !== undefined ? { accounts } : {}),
+    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
   });
 }
 
@@ -61,6 +66,19 @@ class FakeAccountStore implements AccountStore {
   }
 }
 
+/** A fake MtlsIdentityProvider that returns a canned identity for one connId. */
+class FakeMtlsIdentityProvider implements MtlsIdentityProvider {
+  readonly calls: string[] = [];
+  constructor(
+    private readonly connId: string,
+    private readonly identity: string | undefined,
+  ) {}
+  getIdentity(connId: string): string | undefined {
+    this.calls.push(connId);
+    return connId === this.connId ? this.identity : undefined;
+  }
+}
+
 /** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
 function plainPayload(authcid: string, password: string, authzid = ''): string {
   return encodeBase64(`${authzid}\0${authcid}\0${password}`);
@@ -243,25 +261,103 @@ describe('authenticateReducer — no AccountStore configured', () => {
 });
 
 // ============================================================================
-// AUTHENTICATE EXTERNAL — stubbed
+// AUTHENTICATE EXTERNAL — mTLS-backed SASL EXTERNAL
 // ============================================================================
 
-describe('authenticateReducer — EXTERNAL stubbed', () => {
-  it('rejects EXTERNAL immediately with 904 (not yet supported)', () => {
+describe('authenticateReducer — EXTERNAL with mTLS', () => {
+  it('enters the payload phase when an mTLS provider is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+    const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+
+    expect(state.saslMech).toBe('EXTERNAL');
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([L('AUTHENTICATE +')]);
+  });
+
+  it('returns 908 ERR_SASLMECHS when no mTLS provider is configured', () => {
     const state = saslReadyState();
     const ctx = makeCtx(state);
     const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
 
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
-      L(`:${SV} 904 alice :SASL authentication failed`),
+      L(`:${SV} 908 alice PLAIN :are the available SASL mechanisms`),
     ]);
+    expect(state.saslMech).toBeUndefined();
   });
 
-  it('does not enter the payload phase for EXTERNAL', () => {
+  it('succeeds (900/903) when a valid cert identity is presented', () => {
     const state = saslReadyState();
-    const ctx = makeCtx(state);
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, accounts, provider);
+
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(state.account).toBe('alice');
+    expect(accounts.calls).toEqual([
+      { mech: 'EXTERNAL', payload: { kind: 'EXTERNAL', identity: 'CN=alice' } },
+    ]);
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`),
+      L(`:${SV} 903 alice :SASL authentication successful`),
+    ]);
+  });
+
+  it('clears saslMech/saslBuffer after a successful EXTERNAL', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    authenticateReducer(state, authenticate('+'), ctx);
+
     expect(state.saslMech).toBeUndefined();
+    expect(state.saslBuffer).toBeUndefined();
+  });
+
+  it('fails with 904 when the provider has no identity for the connection', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', undefined);
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+    expect(state.account).toBeUndefined();
+  });
+
+  it('fails with 904 when the account store rejects the identity', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'untrusted certificate' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=evil');
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+  });
+
+  it('fails with 904 when no account store is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
   });
 });
 
@@ -275,6 +371,17 @@ describe('authenticateReducer — unknown mechanism', () => {
     const ctx = makeCtx(state);
     const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
 
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 908 alice PLAIN :are the available SASL mechanisms`),
+    ]);
+  });
+
+  it('lists PLAIN,EXTERNAL in 908 when an mTLS provider is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+    const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
+
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
       L(`:${SV} 908 alice PLAIN,EXTERNAL :are the available SASL mechanisms`),
     ]);
@@ -529,8 +636,9 @@ describe('authenticateReducer — CAP REQ sasl integration', () => {
     expect(state.account).toBe('alice');
   });
 
-  it('does not affect the advertised sasl cap value (PLAIN,EXTERNAL)', () => {
+  it('advertises the base sasl cap value (PLAIN) without mTLS', () => {
     const advertised = getLsString();
-    expect(advertised).toContain('sasl=PLAIN,EXTERNAL');
+    expect(advertised).toContain('sasl=PLAIN');
+    expect(advertised).not.toContain('sasl=PLAIN,EXTERNAL');
   });
 });