serverless-ircd 0.3.0 → 0.5.0

package/packages/irc-core/tests/commands/registration.test.ts

@@ -9,11 +9,13 @@ import {
   passReducer,
   userReducer,
 } from '../../src/commands/registration';
+import { DEFAULT_CREATED_TEXT, DEFAULT_SERVER_VERSION } from '../../src/config';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import {
   EmptyMotdProvider,
   FakeClock,
+  InMemoryNickHistoryStore,
   SequentialIdFactory,
   StaticMotdProvider,
 } from '../../src/ports';
@@ -47,6 +49,22 @@ function makeCtx(
   });
 }
 
+/** Like {@link makeCtx} but also threads a bound nick-history store. */
+function makeCtxWithHistory(
+  state: ConnectionState,
+  history: InMemoryNickHistoryStore,
+  clock = new FakeClock(1_000),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    history,
+  });
+}
+
 function makeState(): ConnectionState {
   return createConnection({ id: 'c1', connectedSince: 0 });
 }
@@ -86,9 +104,9 @@ function expectedWelcome(nick: string, user: string, host: string | undefined):
   );
   return [
     L(`${prefix} 001 ${nick} :Welcome to the ExampleNet IRC Network, ${hostmask}`),
-    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version 0.2.0`),
-    L(`${prefix} 003 ${nick} :This server was created in Phase 1`),
-    L(`${prefix} 004 ${nick} ${sv} 0.2.0 iosw biklmnstp`),
+    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${DEFAULT_SERVER_VERSION}`),
+    L(`${prefix} 003 ${nick} :This server was created in ${DEFAULT_CREATED_TEXT}`),
+    L(`${prefix} 004 ${nick} ${sv} ${DEFAULT_SERVER_VERSION} iosw biklmnstp`),
     ...isupport,
     L(`${prefix} 422 ${nick} :MOTD File is missing`),
   ];
@@ -327,6 +345,63 @@ describe('nickReducer', () => {
     expect(out.effects).toEqual([]);
     expect(out.state.nick).toBeUndefined();
   });
+
+  it('records the old nick into ctx.history on a post-registration nick change', () => {
+    const state = registeredState();
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtxWithHistory(state, history, clock);
+
+    nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+
+    const entries = history.query('alice', 10);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.nick).toBe('alice');
+    expect(entries[0]?.connId).toBe('c1');
+    expect(entries[0]?.username).toBe('alice');
+    expect(entries[0]?.hostname).toBe('example.com');
+    expect(entries[0]?.realname).toBe('Alice');
+    expect(entries[0]?.signoffTime).toBe(5_000);
+  });
+
+  it('does not record history on a pre-registration NICK', () => {
+    const state = makeState();
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtxWithHistory(state, history, clock);
+
+    nickReducer(state, { command: 'NICK', params: ['alice'], tags: {} }, ctx);
+
+    expect(history.query('alice', 10)).toEqual([]);
+  });
+
+  it('does not record history on a nick change when no store is bound', () => {
+    const state = registeredState();
+    const ctx = makeCtx(state);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+
+    // No crash; the no-store path is a graceful no-op.
+    expect(out.state.nick).toBe('bob');
+  });
+
+  it('records a history entry with only nick/connId when user/host/realname are absent', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.registration = 'registered';
+    const clock = new FakeClock(5_000);
+    const history = new InMemoryNickHistoryStore(clock);
+    const ctx = makeCtxWithHistory(state, history, clock);
+
+    nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+
+    const entries = history.query('alice', 10);
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.nick).toBe('alice');
+    expect(entries[0]?.username).toBeUndefined();
+    expect(entries[0]?.hostname).toBeUndefined();
+    expect(entries[0]?.realname).toBeUndefined();
+  });
 });
 
 // ============================================================================
@@ -568,6 +643,76 @@ describe('buildWelcomeLines', () => {
   });
 });
 
+// ============================================================================
+// buildWelcomeLines — server version / created text driven from ServerConfig
+// ============================================================================
+
+describe('buildWelcomeLines — config-driven version & created text', () => {
+  /** Builds a ctx whose serverConfig carries the supplied version/created. */
+  function makeCtxWithMeta(
+    state: ConnectionState,
+    serverVersion: string | undefined,
+    createdAt: string | number | undefined,
+  ): Ctx {
+    const cfg: ServerConfig = {
+      ...serverConfig,
+      ...(serverVersion !== undefined ? { serverVersion } : {}),
+      ...(createdAt !== undefined ? { createdAt } : {}),
+    };
+    return buildCtx({
+      serverConfig: cfg,
+      clock: new FakeClock(1_000),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: state,
+    });
+  }
+
+  function registeredConn(): ConnectionState {
+    const s = makeState();
+    s.nick = 'alice';
+    s.user = 'alice';
+    s.host = 'example.com';
+    return s;
+  }
+
+  it('reflects the configured serverVersion in the 002 and 004 lines', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), '9.9.9', undefined);
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line002 = lines.find((l) => l.text.split(' ')[1] === '002');
+    const line004 = lines.find((l) => l.text.split(' ')[1] === '004');
+    expect(line002?.text).toContain('9.9.9');
+    expect(line004?.text).toContain('9.9.9');
+  });
+
+  it('reflects the configured createdAt string in the 003 line', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), undefined, '2024-06-01');
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line003 = lines.find((l) => l.text.split(' ')[1] === '003');
+    expect(line003?.text).toContain('2024-06-01');
+  });
+
+  it('formats a numeric createdAt (epoch ms) into the 003 line', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), undefined, 1_700_000_000_000);
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line003 = lines.find((l) => l.text.split(' ')[1] === '003');
+    // 1700000000000ms → 2023-11-14T22:13:20.000Z ; the formatted text must
+    // contain a human-readable rendering of that instant, not the raw number.
+    expect(line003?.text).not.toContain('1700000000000');
+    expect(line003?.text).toContain('2023');
+  });
+
+  it('falls back to the default version when serverVersion is omitted', () => {
+    const ctx = makeCtxWithMeta(registeredConn(), undefined, undefined);
+    const lines = buildWelcomeLines(ctx.connection, ctx);
+    const line002 = lines.find((l) => l.text.split(' ')[1] === '002');
+    // The hardcoded placeholder '0.2.0' must no longer appear; the default
+    // is the irc-core package version (DEFAULT_SERVER_VERSION).
+    expect(line002?.text).not.toContain('0.2.0');
+    expect(line002?.text).toContain(DEFAULT_SERVER_VERSION);
+  });
+});
+
 // ============================================================================
 // buildWelcomeLines — MOTD driven from MotdProvider
 // ============================================================================
@@ -950,9 +1095,9 @@ function expectedWelcomeWithHost(nick: string, hostmask: string): RawLine[] {
   );
   return [
     L(`${prefix} 001 ${nick} :Welcome to the ExampleNet IRC Network, ${hostmask}`),
-    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version 0.2.0`),
-    L(`${prefix} 003 ${nick} :This server was created in Phase 1`),
-    L(`${prefix} 004 ${nick} ${sv} 0.2.0 iosw biklmnstp`),
+    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${DEFAULT_SERVER_VERSION}`),
+    L(`${prefix} 003 ${nick} :This server was created in ${DEFAULT_CREATED_TEXT}`),
+    L(`${prefix} 004 ${nick} ${sv} ${DEFAULT_SERVER_VERSION} iosw biklmnstp`),
     ...isupport,
     L(`${prefix} 422 ${nick} :MOTD File is missing`),
   ];

package/packages/irc-core/tests/commands/rehash.test.ts

@@ -0,0 +1,171 @@
+import { describe, expect, it } from 'vitest';
+import { buildRehashTrailing, rehashLine, rehashReducer } from '../../src/commands/rehash';
+import { Effect } from '../../src/effects';
+import type { Effect as EffectType, RawLine } from '../../src/effects';
+import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import type { IrcMessage } from '../../src/protocol/messages';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const baseServerConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeCtx(state: ConnectionState, config: ServerConfig = baseServerConfig): Ctx {
+  return buildCtx({
+    serverConfig: config,
+    clock: new FakeClock(5_000),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+  });
+}
+
+function makeState(oper = false): ConnectionState {
+  const s = createConnection({ id: 'c1', connectedSince: 0 });
+  s.nick = 'alice';
+  s.user = 'alice';
+  s.host = 'example.com';
+  s.realname = 'Alice';
+  s.registration = 'registered';
+  s.userModes.oper = oper;
+  return s;
+}
+
+const L = (text: string): RawLine => ({ text });
+
+const rehash = (): IrcMessage => ({ command: 'REHASH', params: [], tags: {} });
+
+describe('rehashReducer — oper gating', () => {
+  it('emits 382 RPL_REHASHING and signals reload when the caller is oper', () => {
+    const state = makeState(true);
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(out.shouldReload).toBe(true);
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 382 alice :Rehashing from KV')]),
+    ]);
+  });
+
+  it('emits 481 ERR_NOPRIVILEGES and does not signal reload for a non-oper', () => {
+    const state = makeState(false);
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(out.shouldReload).toBe(false);
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [
+        L(":irc.example.com 481 alice :Permission Denied - You're not an IRC operator"),
+      ]),
+    ]);
+  });
+
+  it('accepts a lower-case command token', () => {
+    const state = makeState(true);
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, { command: 'rehash', params: [], tags: {} }, ctx, 'KV');
+    expect(out.shouldReload).toBe(true);
+  });
+});
+
+describe('rehashReducer — state handling', () => {
+  it('returns the same state reference (mutation permitted, no copy)', () => {
+    const state = makeState(true);
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(out.state).toBe(state);
+  });
+
+  it('updates connection lastSeen to ctx.clock.now()', () => {
+    const state = makeState(true);
+    expect(state.lastSeen).toBe(0);
+    const ctx = makeCtx(state);
+
+    rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(state.lastSeen).toBe(5_000);
+  });
+
+  it('also updates lastSeen for the non-oper rejection path', () => {
+    const state = makeState(false);
+    const ctx = makeCtx(state);
+
+    rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(state.lastSeen).toBe(5_000);
+  });
+
+  it('uses "*" as the nick in 382 when the connection has no nick', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.userModes.oper = true;
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 382 * :Rehashing from KV')]),
+    ]);
+  });
+
+  it('uses "*" as the nick in 481 when an unregistered non-oper has no nick', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, rehash(), ctx, 'KV');
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [
+        L(":irc.example.com 481 * :Permission Denied - You're not an IRC operator"),
+      ]),
+    ]);
+  });
+
+  it('reflects the configured source label in the 382 trailing text', () => {
+    const state = makeState(true);
+    const ctx = makeCtx(state);
+
+    const out = rehashReducer(state, rehash(), ctx, 'Secrets Manager');
+
+    expect((out.effects[0] as { lines: RawLine[] }).lines[0]?.text).toContain(
+      ':Rehashing from Secrets Manager',
+    );
+  });
+});
+
+describe('rehash formatting helpers', () => {
+  it('buildRehashTrailing composes the success phrase from the source label', () => {
+    expect(buildRehashTrailing('config file')).toBe('Rehashing from config file');
+  });
+
+  it('buildRehashTrailing appends the error suffix when supplied', () => {
+    expect(buildRehashTrailing('KV', 'store unreachable')).toBe(
+      'Rehashing from KV failed: store unreachable',
+    );
+  });
+
+  it('rehashLine renders the full :server 382 nick :trailing wire line', () => {
+    expect(rehashLine('irc.example.com', 'alice', 'KV')).toEqual(
+      L(':irc.example.com 382 alice :Rehashing from KV'),
+    );
+  });
+
+  it('rehashLine renders the error-suffixed line for the failure path', () => {
+    expect(rehashLine('irc.example.com', 'alice', 'KV', 'boom')).toEqual(
+      L(':irc.example.com 382 alice :Rehashing from KV failed: boom'),
+    );
+  });
+});

package/packages/irc-core/tests/commands/sasl.test.ts

@@ -4,7 +4,7 @@ import { capReducer } from '../../src/commands/cap';
 import { authenticateReducer } from '../../src/commands/sasl';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
-import type { AccountStore, SaslPayload, SaslResult } from '../../src/ports';
+import type { AccountStore, MtlsIdentityProvider, SaslPayload, SaslResult } from '../../src/ports';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
 import { encodeBase64 } from '../../src/protocol/base64';
 import type { IrcMessage } from '../../src/protocol/messages';
@@ -40,7 +40,11 @@ function saslReadyState(): ConnectionState {
   return s;
 }
 
-function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
+function makeCtx(
+  state: ConnectionState,
+  accounts?: AccountStore,
+  mtlsIdentity?: MtlsIdentityProvider,
+): Ctx {
   return buildCtx({
     serverConfig,
     clock: new FakeClock(1_000),
@@ -48,6 +52,7 @@ function makeCtx(state: ConnectionState, accounts?: AccountStore): Ctx {
     motd: EmptyMotdProvider,
     connection: state,
     ...(accounts !== undefined ? { accounts } : {}),
+    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
   });
 }
 
@@ -61,6 +66,19 @@ class FakeAccountStore implements AccountStore {
   }
 }
 
+/** A fake MtlsIdentityProvider that returns a canned identity for one connId. */
+class FakeMtlsIdentityProvider implements MtlsIdentityProvider {
+  readonly calls: string[] = [];
+  constructor(
+    private readonly connId: string,
+    private readonly identity: string | undefined,
+  ) {}
+  getIdentity(connId: string): string | undefined {
+    this.calls.push(connId);
+    return connId === this.connId ? this.identity : undefined;
+  }
+}
+
 /** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
 function plainPayload(authcid: string, password: string, authzid = ''): string {
   return encodeBase64(`${authzid}\0${authcid}\0${password}`);
@@ -243,25 +261,103 @@ describe('authenticateReducer — no AccountStore configured', () => {
 });
 
 // ============================================================================
-// AUTHENTICATE EXTERNAL — stubbed
+// AUTHENTICATE EXTERNAL — mTLS-backed SASL EXTERNAL
 // ============================================================================
 
-describe('authenticateReducer — EXTERNAL stubbed', () => {
-  it('rejects EXTERNAL immediately with 904 (not yet supported)', () => {
+describe('authenticateReducer — EXTERNAL with mTLS', () => {
+  it('enters the payload phase when an mTLS provider is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+    const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+
+    expect(state.saslMech).toBe('EXTERNAL');
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([L('AUTHENTICATE +')]);
+  });
+
+  it('returns 908 ERR_SASLMECHS when no mTLS provider is configured', () => {
     const state = saslReadyState();
     const ctx = makeCtx(state);
     const out = authenticateReducer(state, authenticate('EXTERNAL'), ctx);
 
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
-      L(`:${SV} 904 alice :SASL authentication failed`),
+      L(`:${SV} 908 alice PLAIN :are the available SASL mechanisms`),
     ]);
+    expect(state.saslMech).toBeUndefined();
   });
 
-  it('does not enter the payload phase for EXTERNAL', () => {
+  it('succeeds (900/903) when a valid cert identity is presented', () => {
     const state = saslReadyState();
-    const ctx = makeCtx(state);
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, accounts, provider);
+
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(state.account).toBe('alice');
+    expect(accounts.calls).toEqual([
+      { mech: 'EXTERNAL', payload: { kind: 'EXTERNAL', identity: 'CN=alice' } },
+    ]);
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`),
+      L(`:${SV} 903 alice :SASL authentication successful`),
+    ]);
+  });
+
+  it('clears saslMech/saslBuffer after a successful EXTERNAL', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    authenticateReducer(state, authenticate('+'), ctx);
+
     expect(state.saslMech).toBeUndefined();
+    expect(state.saslBuffer).toBeUndefined();
+  });
+
+  it('fails with 904 when the provider has no identity for the connection', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', undefined);
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+    expect(state.account).toBeUndefined();
+  });
+
+  it('fails with 904 when the account store rejects the identity', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: false, reason: 'untrusted certificate' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=evil');
+    const ctx = makeCtx(state, accounts, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+  });
+
+  it('fails with 904 when no account store is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
   });
 });
 
@@ -275,6 +371,17 @@ describe('authenticateReducer — unknown mechanism', () => {
     const ctx = makeCtx(state);
     const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
 
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 908 alice PLAIN :are the available SASL mechanisms`),
+    ]);
+  });
+
+  it('lists PLAIN,EXTERNAL in 908 when an mTLS provider is configured', () => {
+    const state = saslReadyState();
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, undefined, provider);
+    const out = authenticateReducer(state, authenticate('CRAM-MD5'), ctx);
+
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
       L(`:${SV} 908 alice PLAIN,EXTERNAL :are the available SASL mechanisms`),
     ]);
@@ -529,8 +636,9 @@ describe('authenticateReducer — CAP REQ sasl integration', () => {
     expect(state.account).toBe('alice');
   });
 
-  it('does not affect the advertised sasl cap value (PLAIN,EXTERNAL)', () => {
+  it('advertises the base sasl cap value (PLAIN) without mTLS', () => {
     const advertised = getLsString();
-    expect(advertised).toContain('sasl=PLAIN,EXTERNAL');
+    expect(advertised).toContain('sasl=PLAIN');
+    expect(advertised).not.toContain('sasl=PLAIN,EXTERNAL');
   });
 });