serverless-ircd 0.4.0 → 0.6.0

package/packages/irc-core/src/commands/wallops.ts

@@ -0,0 +1,118 @@
+/**
+ * Pure reducer for the IRC `WALLOPS` command (oper-only global broadcast).
+ *
+ * PLAN §2.1 location-of-authority: WALLOPS runs in the Connection entity.
+ * The reducer is pure — it enforces the oper gate, validates the message,
+ * and emits a single {@link BroadcastWallopsEffect}. The bound runtime's
+ * `broadcastWallops` method owns the cross-connection enumeration that
+ * the gate cannot observe purely (it does not see which other
+ * connections carry the `+w` user mode).
+ *
+ * Wire format (RFC 2812 §4.7):
+ *   - `WALLOPS :<message>`
+ *   - `481 ERR_NOPRIVILEGES`:
+ *     `:<server> 481 <nick> :Permission Denied - You're not an IRC operator`
+ *   - `412 ERR_NOTEXTTOSEND`:
+ *     `:<server> 412 <nick> :No text to send`
+ *
+ * Behaviour:
+ *   - Non-oper sender → `481` (checked before the message is inspected, so
+ *     a non-oper cannot probe the command shape).
+ *   - Empty / missing message → `412 ERR_NOTEXTTOSEND`. We pick `412` over
+ *     `461 ERR_NEEDMOREPARAMS` to match the message-bearing commands
+ *     PRIVMSG/NOTICE, which use `412` for "no text to send". WALLOPS is a
+ *     single-param message command, so the semantically closer numeric wins.
+ *   - Otherwise emit `BroadcastWallops([:<oper> WALLOPS :<message>], sender)`
+ *     so the runtime fans the line out to every `+w` connection.
+ *
+ * Delivery / skip-self: the originator is ALWAYS passed as `except`. This
+ * matches NOTICE/PRIVMSG channel-broadcast semantics (the sender never
+ * receives their own message back) and avoids a redundant echo to the
+ * oper who just typed it. The `+w` user mode is the *recipient* gate,
+ * owned by the runtime — the sender's own `+w` is therefore irrelevant
+ * under this default. An oper who wants a delivery receipt can query
+ * logs. (RFC leaves delivery to `+w` regardless of oper; we deliberately
+ * diverge to match the rest of the codebase's broadcast primitives.)
+ *
+ * The `+w` user mode is accepted by the MODE reducer (`w → 'wallops'`)
+ * and advertised in `004 RPL_MYINFO`, but no command consumed it before
+ * this one — setting `+w` used to be a silent no-op. This reducer lights
+ * up the consumer.
+ */
+
+import { Effect } from '../effects.js';
+import type { RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+import { hostmaskOf } from '../state/connection.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx, Reducer } from '../types.js';
+
+/** Fixed text emitted for `481 ERR_NOPRIVILEGES` (matches `kill.ts` / `mode.ts`). */
+const NOPRIVILEGES_TRAILING_TEXT = "Permission Denied - You're not an IRC operator";
+
+/** Fixed text emitted for `412 ERR_NOTEXTTOSEND` (matches `privmsg.ts`). */
+const NOTEXTTOSEND_TRAILING_TEXT = 'No text to send';
+
+/**
+ * Renders the `:<source> WALLOPS :<message>` wire line that every `+w`
+ * connection receives. `<source>` is the oper's full hostmask
+ * (`nick!user@host`), consistent with how PRIVMSG/NOTICE/QUIT attribute
+ * user-originated messages. When the hostmask is incomplete (e.g. no
+ * `user`/`host` yet, which should not happen for a registered oper but is
+ * defended against) the bare nick is used, falling back to `*` only when
+ * no nick is set at all.
+ */
+export function wallopsLine(state: ConnectionState, message: string): RawLine {
+  const source = hostmaskOf(state) ?? state.nick ?? '*';
+  return { text: `:${source} WALLOPS :${message}` };
+}
+
+/**
+ * Handles `WALLOPS :<message>`.
+ *
+ * Enforces the oper gate, stamps `lastSeen`, and on success emits a single
+ * {@link BroadcastWallopsEffect} addressed to every `+w` connection. The
+ * sender is always excluded (skip-self). The reducer never performs IO.
+ */
+export const wallopsReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  if (!state.userModes.oper) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.ERR_NOPRIVILEGES, NOPRIVILEGES_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  const message = msg.params[0];
+  if (message === undefined || message.length === 0) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.ERR_NOTEXTTOSEND, NOTEXTTOSEND_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  return {
+    state,
+    effects: [Effect.broadcastWallops([wallopsLine(state, message)], ctx.connId)],
+  };
+};
+
+/**
+ * Builds a `:<server> <code> <nick> :<trailing>` line. The nick falls back
+ * to `*` when the connection has not yet registered one, matching the rest
+ * of the codebase's numeric formatting.
+ */
+function numericLine(ctx: Ctx, code: number, trailing: string): RawLine {
+  const nick = ctx.connection.nick ?? '*';
+  const codeStr = code.toString().padStart(3, '0');
+  return { text: [`:${ctx.serverName}`, codeStr, nick, `:${trailing}`].join(' ') };
+}

package/packages/irc-core/src/commands/whois.ts

@@ -134,6 +134,11 @@ export function whoisReducer(
       text: `:${ctx.serverName} ${Numerics.RPL_WHOISOPERATOR.toString().padStart(3, '0')} ${requesterNick} ${tNick} :is an IRC operator`,
     });
   }
+  if (target.userModes.tls) {
+    lines.push({
+      text: `:${ctx.serverName} ${Numerics.RPL_WHOISSECURE.toString().padStart(3, '0')} ${requesterNick} ${tNick} :is using a secure connection`,
+    });
+  }
   if (target.account !== undefined) {
     lines.push({
       text: `:${ctx.serverName} ${Numerics.RPL_WHOISACCOUNT.toString().padStart(3, '0')} ${requesterNick} ${tNick} ${target.account} :is logged in as`,

package/packages/irc-core/src/config.ts

@@ -18,6 +18,7 @@
 
 import { z } from 'zod';
 import { BUILD_DATE } from './build-info.js';
+import { DEFAULT_MULTILINE_MAX_BYTES } from './caps/capabilities.js';
 
 /**
  * Schema for a single IRC operator credential.
@@ -61,6 +62,33 @@ export const CloakingConfigSchema = z.object({
   cloakedSuffix: z.string().min(1).optional(),
 });
 
+/**
+ * IRCv3 `sts` (Strict Transport Security) policy. When supplied, the
+ * server advertises an `sts` capability whose value tells compliant
+ * clients how long to pin TLS and which port to upgrade to on a
+ * plaintext connection. Omit entirely (the default) to disable STS.
+ *
+ * Spec: https://ircv3.net/specs/extensions/sts
+ */
+export const StsConfigSchema = z.object({
+  /**
+   * Pin duration in seconds. Defaults to 30 days at the cap-builder layer
+   * when omitted; supply an explicit value in production.
+   */
+  duration: z.number().int().positive(),
+  /**
+   * TLS listener port advertised on plaintext connections. The canonical
+   * IRC-over-TLS port is 6697 (RFC 7193). Defaults to 6697 at the
+   * cap-builder layer when omitted.
+   */
+  port: z.number().int().positive(),
+  /**
+   * Optional preload directive. When true the policy may be hard-coded
+   * into a client preload list (only advertised on plaintext connections).
+   */
+  preload: z.boolean().optional(),
+});
+
 /**
  * Per-IP connection-rate limit. Caps how many new connections a single
  * source IP may open within a sliding `windowMs` window before the
@@ -256,6 +284,13 @@ export const ServerConfigSchema = z.object({
   channelLen: z.number().int().positive().default(50),
   /** Maximum topic length (advertised as `TOPICLEN=`). */
   topicLen: z.number().int().nonnegative().default(390),
+  /**
+   * Maximum realname (GECOS) length enforced by `SETNAME`. There is no
+   * standard ISUPPORT token for this; registration-time `USER` does not
+   * enforce a cap, so the knob is optional on {@link ServerConfig} and the
+   * reducer falls back to a built-in default when unset.
+   */
+  realnameLen: z.number().int().nonnegative().default(50),
   /** Default QUIT reason when the client disconnects without one. */
   quitMessage: z.string().default('Client Quit'),
 
@@ -265,6 +300,43 @@ export const ServerConfigSchema = z.object({
    * lower per deployment. Only consulted when a MessageStore is bound.
    */
   chatHistoryPlaybackLimit: z.number().int().positive().default(50),
+
+  /**
+   * IRCv3 `sts` (Strict Transport Security) policy. Omit entirely (the
+   * default) to disable STS advertisement; supply `{ duration, port }`
+   * (plus optional `preload`) to advertise the cap and let compliant
+   * clients upgrade from plaintext to TLS and pin the secure listener.
+   */
+  sts: StsConfigSchema.optional(),
+
+  /**
+   * IRCv3 `draft/multiline` byte budget. Advertised as
+   * `draft/multiline=<n>` in `CAP LS` and enforced on every finalized
+   * multi-line batch. Defaults to the IRCv3-recommended 4096; raise or
+   * lower per deployment.
+   */
+  multilineMaxBytes: z.number().int().positive().default(DEFAULT_MULTILINE_MAX_BYTES),
+
+  /**
+   * Per-connection MONITOR watchlist ceiling, advertised as `MONITOR=<n>`
+   * in `005 RPL_ISUPPORT`. Omit to inherit the monitor reducer's built-in
+   * ceiling (DEFAULT_MONITOR_LIMIT, 30).
+   */
+  monitorLimit: z.number().int().positive().optional(),
+
+  /**
+   * Extended-ban prefix sigil for `EXTBAN=<prefix>,…` in
+   * `005 RPL_ISUPPORT`. Omit for the IRC-standard `~`.
+   */
+  extbanPrefix: z.string().min(1).optional(),
+
+  /**
+   * Enables IRC-services-derived ISUPPORT tokens (currently
+   * `ACCOUNTEXTBAN=a`). Set to true once a `ServicesStore` is bound; until
+   * then account-name extended bans are suppressed because unregistered
+   * nicks make them meaningless.
+   */
+  servicesEnabled: z.boolean().optional(),
 });
 
 /** Input type: what adapters supply (fields with defaults may be omitted). */
@@ -296,16 +368,6 @@ export function parseServerConfig(input: unknown): ParsedServerConfig {
   return result.data;
 }
 
-/**
- * Default server config: the result of parsing an empty input. Useful as a
- * known-good baseline for tests and for adapters that want to overlay
- * per-deployment overrides via object spread.
- */
-export const DEFAULT_SERVER_CONFIG: ParsedServerConfig = ServerConfigSchema.parse({
-  serverName: 'irc.example.com',
-  networkName: 'ServerlessIRCd',
-});
-
 /**
  * Resolves the effective server version for wire output: the configured
  * value when present, otherwise {@link DEFAULT_SERVER_VERSION}. Used by the

package/packages/irc-core/src/effects.ts

@@ -43,6 +43,18 @@ export interface BroadcastEffect {
   except?: ConnId;
   cap?: string;
   capLines?: RawLine[];
+  /**
+   * OR-semantics cap list: the recipient receives `lines` iff they
+   * negotiated ANY of the listed caps. Used by capabilities whose delivery
+   * rule is the union of two caps — e.g. `draft/typing` TAGMSGs reach
+   * peers that announced `draft/typing` OR `message-tags` (the latter
+   * because every TAGMSG goes to message-tags peers regardless of tag).
+   *
+   * Mutually exclusive with {@link cap}: set one or the other, not both.
+   * When neither is set, dispatch takes the runtime's bulk broadcast fast
+   * path.
+   */
+  caps?: readonly string[];
 }
 
 export interface DisconnectEffect {
@@ -89,6 +101,26 @@ export interface SendToNickEffect {
   notFoundLines?: RawLine[];
 }
 
+/**
+ * Global cross-connection fanout for `WALLOPS`. Unlike
+ * {@link BroadcastEffect} (channel-scoped via the roster), this reaches
+ * every live connection whose `+w` user mode is set, regardless of shared
+ * channel membership. `except` skips a single connection — by convention
+ * the originator, so an oper never receives their own wallops back
+ * (matching NOTICE/PRIVMSG channel-broadcast semantics).
+ *
+ * The reducer does not know which connections carry `+w`; the bound
+ * runtime's `broadcastWallops` method owns that enumeration. On the
+ * in-memory runtime that is a scan of its connection map; on CF it walks
+ * the registry shards; on AWS it scans the `Connections` table. Each
+ * adapter applies its own cost cap (documented at the method).
+ */
+export interface BroadcastWallopsEffect {
+  tag: 'BroadcastWallops';
+  lines: RawLine[];
+  except?: ConnId;
+}
+
 /** Discriminated union of every effect the dispatch interpreter knows. */
 export type Effect =
   | SendEffect
@@ -98,7 +130,8 @@ export type Effect =
   | ChangeNickEffect
   | ReleaseNickEffect
   | ApplyChannelDeltaEffect
-  | SendToNickEffect;
+  | SendToNickEffect
+  | BroadcastWallopsEffect;
 
 /** Literal string tag of every {@link Effect} variant. */
 export type EffectTag = Effect['tag'];
@@ -129,11 +162,13 @@ export const Effect = {
     except?: ConnId,
     cap?: string,
     capLines?: RawLine[],
+    caps?: readonly string[],
   ): Effect {
     const e: BroadcastEffect = { tag: 'Broadcast', chan, lines };
     if (except !== undefined) e.except = except;
     if (cap !== undefined) e.cap = cap;
     if (capLines !== undefined) e.capLines = capLines;
+    if (caps !== undefined) e.caps = caps;
     return e;
   },
   disconnect(conn: ConnId, reason?: string): Effect {
@@ -158,4 +193,9 @@ export const Effect = {
     if (notFoundLines !== undefined) e.notFoundLines = notFoundLines;
     return e;
   },
+  broadcastWallops(lines: RawLine[], except?: ConnId): Effect {
+    const e: BroadcastWallopsEffect = { tag: 'BroadcastWallops', lines };
+    if (except !== undefined) e.except = except;
+    return e;
+  },
 } as const;

package/packages/irc-core/src/index.ts

@@ -14,6 +14,8 @@ export * from './credential-hashing.js';
 export * from './flood-control.js';
 export * from './cloak.js';
 export * from './case-fold.js';
+export * from './ws-subprotocol.js';
+export * from './ws-framing.js';
 export * from './admission.js';
 export * from './config.js';
 export type {