serverless-ircd 0.6.0 → 0.8.0

package/packages/irc-core/tests/commands/oper.test.ts

@@ -65,9 +65,22 @@ describe('operReducer — successful authentication', () => {
     expect(out.state.userModes.oper).toBe(true);
     expect(out.effects).toEqual<EffectType[]>([
       Effect.send('c1', [L(':irc.example.com 381 alice :You are now an IRC operator')]),
+      Effect.send('c1', [L(':alice!alice@example.com MODE alice +o')]),
     ]);
   });
 
+  it('emits a MODE +o notification to the connection after granting oper', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = operReducer(state, oper('alice', 'secret'), ctx);
+
+    const modeLines = out.effects
+      .filter((e): e is Extract<EffectType, { tag: 'Send' }> => e.tag === 'Send')
+      .flatMap((e) => e.lines.map((l) => l.text));
+    expect(modeLines).toContain(':alice!alice@example.com MODE alice +o');
+  });
+
   it('matches the second configured credential pair', () => {
     const state = makeState();
     const ctx = makeCtx(state);

package/packages/irc-core/tests/commands/operserv.test.ts

@@ -0,0 +1,656 @@
+import { describe, expect, it } from 'vitest';
+import {
+  OPERSERV_NICK,
+  checkAkillAdmission,
+  enforceJupedNick,
+  operservReducer,
+} from '../../src/commands/operserv';
+import type { Effect as EffectType } from '../../src/effects';
+import type { ServicesStore } from '../../src/ports';
+import {
+  EmptyMotdProvider,
+  FakeClock,
+  InMemoryServicesStore,
+  SequentialIdFactory,
+} from '../../src/ports';
+import type { IrcMessage } from '../../src/protocol/messages';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const NOW = 1_700_000_000_000;
+
+const serverConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeConn(id = 'c1', nick = 'admin'): ConnectionState {
+  const s = createConnection({ id, connectedSince: 0 });
+  s.nick = nick;
+  s.user = nick;
+  s.host = 'example.com';
+  s.realname = nick;
+  s.registration = 'registered';
+  return s;
+}
+
+/** Returns a connection marked as oper (the OperServ precondition). */
+function makeOper(id = 'c1', nick = 'admin'): ConnectionState {
+  const s = makeConn(id, nick);
+  s.userModes.oper = true;
+  return s;
+}
+
+function makeCtx(
+  state: ConnectionState,
+  services?: ServicesStore,
+  clock = new FakeClock(NOW),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    ...(services !== undefined ? { services } : {}),
+  });
+}
+
+function privmsg(body: string): IrcMessage {
+  return { command: 'PRIVMSG', params: [OPERSERV_NICK, body], tags: {} };
+}
+
+/** Extracts the text of every Send line emitted by the reducer. */
+function sentTexts(effects: EffectType[]): string[] {
+  return effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+}
+
+/** Extracts the text of every Disconnect line emitted by the reducer. */
+function disconnectReasons(effects: EffectType[]): string[] {
+  return effects.flatMap((e) => (e.tag === 'Disconnect' ? [e.reason ?? ''] : []));
+}
+
+describe('OPERSERV_NICK constant', () => {
+  it('is the canonical OperServ pseudo-client nick', () => {
+    expect(OPERSERV_NICK).toBe('OperServ');
+  });
+});
+
+// ============================================================================
+// OperServ precondition — oper-only gate
+// ============================================================================
+
+describe('operservReducer — oper gate', () => {
+  it('rejects every subcommand from a non-oper with a NOTICE and no state change', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL ADD *!*@bad.example flooding'), ctx);
+
+    expect(services.listAkills()).toEqual([]);
+    expect(services.listJupes()).toEqual([]);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Permission denied — oper privileges required.',
+    );
+  });
+
+  it('rejects every subcommand when services are not bound', () => {
+    const conn = makeOper();
+    const ctx = makeCtx(conn);
+
+    const out = operservReducer(conn, privmsg('AKILL ADD *!*@bad.example flooding'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Services are not available on this server.',
+    );
+  });
+
+  it('returns a help NOTICE when PRIVMSG has no body', () => {
+    const conn = makeOper();
+    const ctx = makeCtx(conn, new InMemoryServicesStore({ clock: new FakeClock(NOW) }));
+
+    const out = operservReducer(
+      conn,
+      { command: 'PRIVMSG', params: [OPERSERV_NICK], tags: {} },
+      ctx,
+    );
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Available commands: AKILL, JUPE, RAW',
+    );
+  });
+
+  it('returns a help NOTICE when the body is whitespace only', () => {
+    const conn = makeOper();
+    const ctx = makeCtx(conn, new InMemoryServicesStore({ clock: new FakeClock(NOW) }));
+
+    const out = operservReducer(conn, privmsg('   '), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Available commands: AKILL, JUPE, RAW',
+    );
+  });
+
+  it('rejects an unknown subcommand with a NOTICE', () => {
+    const conn = makeOper();
+    const ctx = makeCtx(conn, new InMemoryServicesStore({ clock: new FakeClock(NOW) }));
+
+    const out = operservReducer(conn, privmsg('FROBNICATE'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Unknown command. Available: AKILL, JUPE, RAW',
+    );
+  });
+
+  it('addresses the NOTICE to "*" when the oper connection has no nick yet', () => {
+    const conn = createConnection({ id: 'c1', connectedSince: 0 });
+    conn.userModes.oper = true;
+    const ctx = makeCtx(conn, new InMemoryServicesStore({ clock: new FakeClock(NOW) }));
+
+    const out = operservReducer(conn, privmsg('FROBNICATE'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE * :Unknown command. Available: AKILL, JUPE, RAW',
+    );
+  });
+});
+
+// ============================================================================
+// AKILL ADD / DEL / LIST
+// ============================================================================
+
+describe('operservReducer — AKILL ADD', () => {
+  it('records the AKILL mask + reason and confirms via NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL ADD *!*@bad.example.net flooding'), ctx);
+
+    expect(services.listAkills()).toHaveLength(1);
+    expect(services.listAkills()[0]?.mask).toBe('*!*@bad.example.net');
+    expect(services.listAkills()[0]?.reason).toBe('flooding');
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :AKILL *!*@bad.example.net added (reason: flooding).',
+    );
+  });
+
+  it('treats everything after the mask as the reason (multi-word)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    operservReducer(conn, privmsg('AKILL ADD *!*@bad.example.net mass flood from net'), ctx);
+
+    expect(services.listAkills()[0]?.reason).toBe('mass flood from net');
+  });
+
+  it('requires both a mask and a reason (NOTICE on missing reason)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL ADD *!*@bad.example.net'), ctx);
+
+    expect(services.listAkills()).toHaveLength(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: AKILL ADD <mask> <reason>',
+    );
+  });
+
+  it('requires both a mask and a reason (NOTICE on missing mask)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL ADD'), ctx);
+
+    expect(services.listAkills()).toHaveLength(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: AKILL ADD <mask> <reason>',
+    );
+  });
+
+  it('replaces the reason on a duplicate mask', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    operservReducer(conn, privmsg('AKILL ADD *!*@bad.example.net flooding'), ctx);
+    const out = operservReducer(conn, privmsg('AKILL ADD *!*@bad.example.net worse flooding'), ctx);
+
+    expect(services.listAkills()).toHaveLength(1);
+    expect(services.listAkills()[0]?.reason).toBe('worse flooding');
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :AKILL *!*@bad.example.net added (reason: worse flooding).',
+    );
+  });
+});
+
+describe('operservReducer — AKILL DEL', () => {
+  it('removes a matching mask and confirms via NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL DEL *!*@bad.example.net'), ctx);
+
+    expect(services.listAkills()).toEqual([]);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :AKILL *!*@bad.example.net removed.',
+    );
+  });
+
+  it('NOTIFIES the oper when the mask is not on the list', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL DEL *!*@other.example.net'), ctx);
+
+    expect(services.listAkills()).toHaveLength(1);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :No AKILL matching *!*@other.example.net.',
+    );
+  });
+
+  it('requires a mask argument', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL DEL'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: AKILL DEL <mask>',
+    );
+  });
+
+  it('matches the mask case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@Bad.Example.Net', 'flooding');
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    operservReducer(conn, privmsg('AKILL DEL *!*@bad.example.net'), ctx);
+
+    expect(services.listAkills()).toEqual([]);
+  });
+});
+
+describe('operservReducer — AKILL LIST', () => {
+  it('returns an empty-list NOTICE on a fresh store', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL LIST'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :No AKILLs are currently set.',
+    );
+  });
+
+  it('enumerates every recorded AKILL with mask + reason', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@a.example', 'flooding');
+    services.addAkill('bot*!*@*', 'bot flood');
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL LIST'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':OperServ!OperServ@services NOTICE admin :*!*@a.example — flooding');
+    expect(texts).toContain(':OperServ!OperServ@services NOTICE admin :bot*!*@* — bot flood');
+    expect(texts).toContain(':OperServ!OperServ@services NOTICE admin :End of AKILL list.');
+  });
+});
+
+describe('operservReducer — AKILL (unknown action)', () => {
+  it('NOTIFIES the oper on an unknown AKILL action', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL FROB'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: AKILL ADD|DEL|LIST [args]',
+    );
+  });
+
+  it('NOTIFIES the oper on a bare AKILL with no action', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('AKILL'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: AKILL ADD|DEL|LIST [args]',
+    );
+  });
+});
+
+// ============================================================================
+// JUPE / UNJUPE / LIST
+// ============================================================================
+
+describe('operservReducer — JUPE', () => {
+  it('records the jupe and confirms via NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('JUPE moo'), ctx);
+
+    expect(services.isJuped('moo')).toBe(true);
+    expect(services.getJupe('moo')?.reason).toBe('');
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :JUPE moo added.',
+    );
+  });
+
+  it('captures a reason from the rest of the line', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('JUPE moo blocked by abuse'), ctx);
+
+    expect(services.getJupe('moo')?.reason).toBe('blocked by abuse');
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :JUPE moo added (reason: blocked by abuse).',
+    );
+  });
+
+  it('requires a name argument', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('JUPE'), ctx);
+
+    expect(services.listJupes()).toEqual([]);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: JUPE <nick> [reason]',
+    );
+  });
+
+  it('replaces the reason on a duplicate name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    operservReducer(conn, privmsg('JUPE moo one'), ctx);
+    operservReducer(conn, privmsg('JUPE moo two'), ctx);
+
+    expect(services.listJupes()).toHaveLength(1);
+    expect(services.getJupe('moo')?.reason).toBe('two');
+  });
+});
+
+describe('operservReducer — UNJUPE', () => {
+  it('removes a jupe and confirms via NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addJupe('moo', 'blocked');
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('UNJUPE moo'), ctx);
+
+    expect(services.isJuped('moo')).toBe(false);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :JUPE moo removed.',
+    );
+  });
+
+  it('NOTIFIES the oper when the name is not juped', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addJupe('moo', 'blocked');
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('UNJUPE bar'), ctx);
+
+    expect(services.isJuped('moo')).toBe(true);
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :No JUPE matching bar.',
+    );
+  });
+
+  it('requires a name argument', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('UNJUPE'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: UNJUPE <nick>',
+    );
+  });
+});
+
+// ============================================================================
+// RAW
+// ============================================================================
+
+describe('operservReducer — RAW', () => {
+  it('echoes the raw line back to the oper via a Send effect', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('RAW :irc.example.com 001 alice :Welcome'), ctx);
+
+    // The actor interprets the Send as a raw injection. The oper should
+    // observe the line they asked the server to emit.
+    const sent = out.effects.find(
+      (e) =>
+        e.tag === 'Send' && e.to === conn.id && e.lines.some((l) => !l.text.includes('NOTICE')),
+    );
+    expect(sent).toBeDefined();
+    if (sent === undefined) return;
+    if (sent.tag !== 'Send') return;
+    expect(sent.lines.map((l) => l.text)).toContain(':irc.example.com 001 alice :Welcome');
+  });
+
+  it('emits a confirmation NOTICE so the oper sees the line was accepted', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('RAW :server NOTICE * :test'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :RAW line accepted and logged.',
+    );
+  });
+
+  it('requires a non-empty line argument', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeOper();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('RAW'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Syntax: RAW <line>',
+    );
+  });
+
+  it('rejects RAW from a non-oper with the oper-gate NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = operservReducer(conn, privmsg('RAW :server NOTICE * :test'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :Permission denied — oper privileges required.',
+    );
+    // No raw Send effect from a non-oper — the requested line must not be
+    // echoed back. Only the rejection NOTICE should be observed.
+    const raw = out.effects.find(
+      (e) => e.tag === 'Send' && e.lines.some((l) => l.text === ':server NOTICE * :test'),
+    );
+    expect(raw).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// Admission hook — checkAkillAdmission
+// ============================================================================
+
+describe('checkAkillAdmission', () => {
+  it('returns an empty effect list when no services store is bound', () => {
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const effects = checkAkillAdmission(conn, ctx);
+
+    expect(effects).toEqual([]);
+  });
+
+  it('returns an empty effect list when the connection has no hostmask yet', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const conn = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(conn, services);
+
+    const effects = checkAkillAdmission(conn, ctx);
+
+    expect(effects).toEqual([]);
+  });
+
+  it('returns an empty effect list when no AKILL matches the hostmask', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const conn = makeConn();
+    conn.user = 'alice';
+    conn.host = 'good.example.net';
+    const ctx = makeCtx(conn, services);
+
+    const effects = checkAkillAdmission(conn, ctx);
+
+    expect(effects).toEqual([]);
+  });
+
+  it('emits a Disconnect effect when an AKILL mask matches the hostmask', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const conn = makeConn();
+    conn.user = 'spammer';
+    conn.host = 'bad.example.net';
+    const ctx = makeCtx(conn, services);
+
+    const effects = checkAkillAdmission(conn, ctx);
+
+    const reasons = disconnectReasons(effects);
+    expect(reasons).toHaveLength(1);
+    expect(reasons[0]).toContain('AKILL');
+  });
+
+  it('NOTIFIES the connection with the matching AKILL reason before disconnecting', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const conn = makeConn();
+    conn.user = 'spammer';
+    conn.host = 'bad.example.net';
+    const ctx = makeCtx(conn, services);
+
+    const effects = checkAkillAdmission(conn, ctx);
+
+    expect(sentTexts(effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :You are banned from this network (AKILL: flooding).',
+    );
+  });
+
+  it('returns the first matching AKILL when several masks could match', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addAkill('*!*@a.example', 'first');
+    services.addAkill('*!*@bad.example.net', 'second');
+    const conn = makeConn();
+    conn.user = 'spammer';
+    conn.host = 'bad.example.net';
+    const ctx = makeCtx(conn, services);
+
+    const effects = checkAkillAdmission(conn, ctx);
+
+    expect(sentTexts(effects)).toContain(
+      ':OperServ!OperServ@services NOTICE admin :You are banned from this network (AKILL: second).',
+    );
+  });
+});
+
+// ============================================================================
+// JUPE enforcement hook — enforceJupedNick
+// ============================================================================
+
+describe('enforceJupedNick', () => {
+  it('returns an empty effect list when no services store is bound', () => {
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const effects = enforceJupedNick(conn, 'moo', ctx);
+
+    expect(effects).toEqual([]);
+  });
+
+  it('returns an empty effect list when the nick is not juped', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const effects = enforceJupedNick(conn, 'moo', ctx);
+
+    expect(effects).toEqual([]);
+  });
+
+  it('emits a 432 ERR_ERRONEUSNICKNAME when the nick is juped', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addJupe('moo', 'blocked');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const effects = enforceJupedNick(conn, 'moo', ctx);
+
+    const texts = sentTexts(effects);
+    expect(texts.some((t) => / 432 /.test(t))).toBe(true);
+    expect(texts.some((t) => t.includes('moo'))).toBe(true);
+  });
+
+  it('matches the jupe case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addJupe('Moo', 'blocked');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const effects = enforceJupedNick(conn, 'moo', ctx);
+
+    expect(sentTexts(effects).some((t) => / 432 /.test(t))).toBe(true);
+  });
+
+  it('returns an empty effect list when the nick is undefined', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.addJupe('moo', 'blocked');
+    const conn = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(conn, services);
+
+    const effects = enforceJupedNick(conn, undefined, ctx);
+
+    expect(effects).toEqual([]);
+  });
+});