serverless-ircd 0.7.0 → 0.8.0

package/packages/aws-adapter/tests/handlers.test.ts

@@ -7,13 +7,14 @@
  */
 
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
+import { GetCommand } from '@aws-sdk/lib-dynamodb';
 import {
   InMemoryAccountStore,
   type ParsedServerConfig,
   StaticMotdProvider,
 } from '@serverless-ircd/irc-core';
 import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime } from '../src/aws-runtime.js';
 import type { PostToConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
@@ -156,6 +157,23 @@ describe.skipIf(!available)('handlers', () => {
       expect(res.headers?.['Sec-WebSocket-Protocol']).toBe('text.ircv3.net');
     });
 
+    it('echoes text.ircv3.net (never binary) when binary is offered first', async () => {
+      // Reproduces the production 1003 close: the relay offers binary first,
+      // but API Gateway cannot transport binary frames, so the handler must
+      // agree to text.ircv3.net. Asserting the echoed subprotocol at the
+      // dispatch boundary guards against regressing to the generic selector
+      // which would negotiate binary and trigger an immediate 1003.
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-sub-both' },
+          headers: { 'Sec-WebSocket-Protocol': 'binary.ircv3.net, text.ircv3.net' },
+        },
+        requireFx().deps,
+      );
+      expect(res.statusCode).toBe(200);
+      expect(res.headers?.['Sec-WebSocket-Protocol']).toBe('text.ircv3.net');
+    });
+
     it('omits the Sec-WebSocket-Protocol header on a legacy connect', async () => {
       const res = await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c-nosub' } },
@@ -329,6 +347,54 @@ describe.skipIf(!available)('handlers', () => {
       expect(res.statusCode).toBe(410);
     });
 
+    it('warns when the connection row is missing so the 410 path is visible in logs', async () => {
+      // Previously the 410 early-return logged nothing, which made a
+      // missing-row $default invisible to operators. The handler must now
+      // emit a warning naming the connection id.
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      await dispatch(
+        {
+          requestContext: { routeKey: '$default', connectionId: 'ghost-row' },
+          body: 'PING :tok\r\n',
+        },
+        requireFx().deps,
+      );
+      expect(warnSpy).toHaveBeenCalledOnce();
+      const msg = String(warnSpy.mock.calls[0]?.[0]);
+      expect(msg).toContain('[irc-handler]');
+      expect(msg).toContain('ghost-row');
+      warnSpy.mockRestore();
+    });
+
+    it('reads the Connections row strongly consistently (avoids read-after-write 410)', async () => {
+      // $connect writes the row and $default reads it on the very next
+      // frame. An eventually-consistent Get can miss the just-written row
+      // (replication lag) and silently drop the client's first frame as a
+      // 410. The Get MUST be strongly consistent.
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'cr1' } },
+        requireFx().deps,
+      );
+      requireFx().mgmt.register('cr1', () => {});
+      const sendSpy = vi.spyOn(requireFx().client, 'send');
+      await dispatch(
+        {
+          requestContext: { routeKey: '$default', connectionId: 'cr1' },
+          body: 'PING :tok\r\n',
+        },
+        requireFx().deps,
+      );
+      const conGets = sendSpy.mock.calls
+        .map((call) => call[0] as unknown)
+        .filter(
+          (cmd): cmd is GetCommand =>
+            cmd instanceof GetCommand && (cmd.input.TableName?.endsWith('Connections') ?? false),
+        );
+      expect(conGets.length).toBeGreaterThan(0);
+      expect((conGets[0]?.input as { ConsistentRead?: boolean }).ConsistentRead).toBe(true);
+      sendSpy.mockRestore();
+    });
+
     it('returns 400 when body is missing', async () => {
       // Cast: APIGW always sends a body for $default; tests verify the guard.
       const event = {
@@ -420,11 +486,15 @@ describe.skipIf(!available)('handlers', () => {
       expect(calls.some((d) => d.includes(' 001 '))).toBe(true);
     });
 
-    it('delivers one postToConnection per line for a binary.ircv3.net connection', async () => {
+    it('delivers one postToConnection per line when binary is offered first (selects text.ircv3.net)', async () => {
+      // API Gateway cannot transport binary frames (1003 close), so a
+      // `binary.ircv3.net, text.ircv3.net` offer resolves to text.ircv3.net
+      // and the connection is spec-text: one postToConnection per outbound
+      // IRC line, no trailing CRLF.
       await dispatch(
         {
           requestContext: { routeKey: '$connect', connectionId: 'spec2' },
-          headers: { 'Sec-WebSocket-Protocol': 'binary.ircv3.net' },
+          headers: { 'Sec-WebSocket-Protocol': 'binary.ircv3.net, text.ircv3.net' },
         },
         requireFx().deps,
       );
@@ -473,6 +543,38 @@ describe.skipIf(!available)('handlers', () => {
       expect(calls[0]).toContain(' 001 ');
     });
 
+    it('logs and still returns 200 when postToConnection fails (silent reply loss)', async () => {
+      // Reproduces the production failure mode where the management API
+      // rejects every post (gone connection, stale MANAGEMENT_URL, …).
+      // Previously the catch was empty → the operator saw zero logs and
+      // the client saw nothing. The handler must now surface the error.
+      await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'dead1' } },
+        requireFx().deps,
+      );
+      const failingMgmt: PostToConnection = {
+        async postToConnection(): Promise<unknown> {
+          throw new Error('GoneException: 410');
+        },
+      };
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$default', connectionId: 'dead1' },
+          body: 'NICK dead\r\nUSER dead 0 * :Dead\r\n',
+        },
+        { ...requireFx().deps, managementApi: failingMgmt as never },
+      );
+      // Graceful degradation: mutations are persisted, status stays 200.
+      expect(res.statusCode).toBe(200);
+      // The reply failure is surfaced to CloudWatch (was previously silent).
+      expect(errorSpy).toHaveBeenCalledOnce();
+      const firstArg = String(errorSpy.mock.calls[0]?.[0]);
+      expect(firstArg).toContain('[irc-handler]');
+      expect(firstArg).toContain('postToConnection');
+      errorSpy.mockRestore();
+    });
+
     it('persists joined channels across $default invocations', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c1' } },

package/packages/aws-adapter/tests/tables.test.ts

@@ -13,15 +13,20 @@ import {
 } from '../src/tables.js';
 
 describe('TABLE_NAMES', () => {
-  it('contains exactly the five canonical logical names', () => {
+  it('contains exactly the six canonical logical names', () => {
     expect(TABLE_NAMES).toEqual([
       'Connections',
       'ChannelMeta',
       'ChannelMembers',
       'Nicks',
       'Accounts',
+      'Services',
     ]);
   });
+
+  it('TABLE_KEYS omits Services (the runtime reads SERVICES_TABLE directly)', () => {
+    expect(TABLE_KEYS).not.toHaveProperty('Services');
+  });
 });
 
 describe('TABLE_KEYS', () => {

package/packages/cf-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-adapter",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": true,
   "description": "Cloudflare Workers adapter: Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and CfRuntime implementing IrcRuntime",
   "license": "BSD-3-Clause",

package/packages/cf-adapter/src/config-loader.ts

@@ -38,6 +38,14 @@ export interface CfConfigEnv {
   CHANNEL_PREFIXES?: string;
   OPER_USER?: string;
   OPER_PASSWORD?: string;
+  /**
+   * Server-password gate. Treat as a wrangler secret in production
+   * (never a plaintext `[vars]` entry); the loader threads it through
+   * to `ServerConfig.serverPassword` so the registration reducer can
+   * enforce `PASS <value>` before `001 RPL_WELCOME`. Undefined / empty
+   * disables the gate.
+   */
+  SERVER_PASSWORD?: string;
   MAX_CHANNELS_PER_USER?: string;
   MAX_TARGETS_PER_COMMAND?: string;
   NICK_LEN?: string;
@@ -92,6 +100,9 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
       },
     ];
   }
+  if (env.SERVER_PASSWORD !== undefined) {
+    input.serverPassword = env.SERVER_PASSWORD;
+  }
   if (env.MAX_CHANNELS_PER_USER !== undefined) {
     input.maxChannelsPerUser = Number.parseInt(env.MAX_CHANNELS_PER_USER, 10);
   }

package/packages/cf-adapter/src/connection-do.ts

@@ -67,6 +67,7 @@ import { makeCfRuntime } from './cf-runtime.js';
 import type { CfConnectionHandlers } from './cf-runtime.js';
 import { loadServerConfigFromCfEnv } from './config-loader.js';
 import { resolveAccountStore } from './d1-account-store.js';
+import { type D1ServicesStore, loadD1ServicesStore } from './d1-services-store.js';
 import type { Env } from './env.js';
 import { STATE_STORAGE_KEY, deserialize, serialize } from './serialize.js';
 import type { PersistedConnectionState } from './serialize.js';
@@ -114,6 +115,16 @@ export class ConnectionDO extends DurableObject<Env> {
    * should seed `createdAt` with its receive time.
    */
   private channelAccess: PassthroughChannelAccess | undefined;
+  /**
+   * Test-only: when set, `webSocketClose`/`webSocketError` skip the
+   * `tearDown` cleanup. Simulates the production failure mode where the
+   * platform drops a hibernated WebSocket without ever delivering the
+   * close event to the DO — the exact condition the idle-sweep alarm
+   * exists as a backstop for. Lets the alarm test exercise the no-socket
+   * teardown path as the sole cleanup, without the close handler racing
+   * in to do the work first.
+   */
+  private __suppressCloseTeardown = false;
   /**
    * Per-connection chat-history store backing `draft/chathistory`
    * playback. The minimum-viable in-worker ring buffer is scoped to this
@@ -143,6 +154,17 @@ export class ConnectionDO extends DurableObject<Env> {
   private accounts: AccountStore | undefined;
   /** Guards {@link loadAccountStore} so the D1 query runs at most once. */
   private accountsResolved = false;
+  /**
+   * Persistent services store (NickServ / ChanServ / HostServ / MemoServ /
+   * OperServ + read-marker), hydrated once via {@link loadServicesStore}
+   * before the first frame dispatches. The store mutates the in-memory
+   * cache synchronously and enqueues write-behind ops; {@link flushServices}
+   * drains them into D1 after each frame / at teardown. `undefined` when
+   * D1 is not configured (services unbound → no NickServ/ChanServ routing).
+   */
+  private services: D1ServicesStore | undefined;
+  /** Guards {@link loadServicesStore} so the D1 scan runs at most once. */
+  private servicesResolved = false;
   /**
    * Verified client-cert subject captured at WebSocket upgrade time when
    * CF API Shield mTLS is configured. Surfaced to the SASL EXTERNAL reducer
@@ -157,6 +179,17 @@ export class ConnectionDO extends DurableObject<Env> {
    * When unset (no mTLS configured), EXTERNAL auth fails with `904`.
    */
   private mtlsCertSubject: string | undefined;
+  /**
+   * Client source IP captured at WebSocket upgrade time, surfaced onto the
+   * {@link ConnectionState.host} field so WHOIS / hostmasks resolve instead
+   * of falling back to `?`. Read from the Cloudflare edge header
+   * `CF-Connecting-IP` (set unconditionally by the CF proxy on every
+   * request), with `X-Real-IP` as a fallback for non-CF reverse-proxy
+   * deployments. When neither is present the host stays `undefined`
+   * (hostmasks omit the `@host` segment). Cloaking, if enabled, replaces
+   * this raw IP with a deterministic cloak at registration time.
+   */
+  private sourceHost: string | undefined;
   private readonly clock: Clock = SystemClock;
   private readonly ids: IdFactory = new UuidIdFactory();
   private readonly pingIntervalMs: number = DEFAULT_PING_INTERVAL_MS;
@@ -193,6 +226,13 @@ export class ConnectionDO extends DurableObject<Env> {
     if (cf !== undefined && typeof cf.tlsClientAuthCertSubject === 'string') {
       this.mtlsCertSubject = cf.tlsClientAuthCertSubject;
     }
+    // Capture the client source IP for ConnectionState.host. CF-Connecting-IP
+    // is set by the Cloudflare edge on every proxied request; X-Real-IP is
+    // the conventional fallback for non-CF reverse proxies. Stashed on the
+    // instance because loadState runs lazily on the first event (and again
+    // after hibernation), not here at upgrade time.
+    this.sourceHost =
+      request.headers.get('CF-Connecting-IP') ?? request.headers.get('X-Real-IP') ?? undefined;
     // IRCv3 WebSocket subprotocol negotiation: read the offered
     // `Sec-WebSocket-Protocol` list, select the first supported entry, and
     // echo it back when one was agreed. The negotiated frame mode is tagged
@@ -244,12 +284,14 @@ export class ConnectionDO extends DurableObject<Env> {
     const beforeNick = state.nick;
 
     await this.loadAccountStore();
+    await this.loadServicesStore();
     const actor = this.buildActor(ws, state, mode);
     try {
       await actor.receiveTextFrame(text);
     } finally {
       // Persist any mutations even if dispatch threw partway through.
       await this.persistState(state);
+      await this.flushServices();
     }
 
     // If registration completed this frame, schedule a PING alarm.
@@ -270,11 +312,13 @@ export class ConnectionDO extends DurableObject<Env> {
     _reason: string,
     _wasClean: boolean,
   ): Promise<void> {
+    if (this.__suppressCloseTeardown) return;
     await this.tearDown(ws);
   }
 
   /** Same teardown as close. */
   override async webSocketError(ws: WebSocket, _error: unknown): Promise<void> {
+    if (this.__suppressCloseTeardown) return;
     await this.tearDown(ws);
   }
 
@@ -293,12 +337,20 @@ export class ConnectionDO extends DurableObject<Env> {
     const state = await this.loadState();
     const now = this.clock.now();
     if (state.lastSeen + this.pongTimeoutMs < now) {
-      // Idle past the PONG threshold: tear down.
+      // Idle past the PONG threshold: tear down. Both branches must drive
+      // a synthetic QUIT through the actor so the channel rosters prune
+      // the member and shared-channel peers receive the QUIT line. When a
+      // live socket is present `tearDown` closes it; when the socket is
+      // already gone (lost close event, DO woke from hibernation with no
+      // socket) `tearDownNoSocket` runs the same effect pipeline against
+      // no-op transport handlers so the cross-DO fanout still fires.
+      // Using `releaseAndPersist` here would leak the member into every
+      // shared channel's roster indefinitely (ghost users in `/NAMES`).
       const sockets = this.ctx.getWebSockets();
       if (sockets.length > 0) {
         await this.tearDown(sockets[0] as WebSocket);
       } else {
-        await this.releaseAndPersist(state);
+        await this.tearDownNoSocket(state);
       }
       return;
     }
@@ -398,6 +450,13 @@ export class ConnectionDO extends DurableObject<Env> {
         id: this.ctx.id.toString(),
         connectedSince: this.clock.now(),
       });
+      // Seed the visible host from the upgrade-time source IP capture so
+      // WHOIS / hostmasks carry a real `@host` segment instead of the `?`
+      // fallback. Mirrors the local-cli / cf-tcp-container pattern. undefined
+      // when no source-IP header was present (hostmask omits @host entirely).
+      if (this.sourceHost !== undefined) {
+        this.cached.host = this.sourceHost;
+      }
     } else {
       this.cached = deserialize(record);
     }
@@ -445,6 +504,7 @@ export class ConnectionDO extends DurableObject<Env> {
     // per-connection in the Workers dashboard.
     const logger: Logger = new ConsoleLogger({ connectionId: state.id }, undefined, LogLevel.Info);
     const accounts = this.accountStore();
+    const services = this.servicesStore();
     const mtlsIdentity: MtlsIdentityProvider | undefined =
       this.mtlsCertSubject !== undefined
         ? new InMemoryMtlsIdentityProvider([{ connId: state.id, identity: this.mtlsCertSubject }])
@@ -470,6 +530,7 @@ export class ConnectionDO extends DurableObject<Env> {
       // the DO, so every WS connection is secure → user mode `S`.
       secure: true,
       ...(accounts !== undefined ? { accounts } : {}),
+      ...(services !== undefined ? { services } : {}),
       ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
       logger,
     });
@@ -479,11 +540,13 @@ export class ConnectionDO extends DurableObject<Env> {
   private async tearDown(ws: WebSocket): Promise<void> {
     const state = await this.loadState();
     await this.loadAccountStore();
+    await this.loadServicesStore();
     const actor = this.buildActor(ws, state, this.wsFrameMode(ws));
     // Drive QUIT through the actor so the same effect pipeline handles
     // fanout as during normal operation.
     await actor.receiveTextFrame('QUIT\r\n');
     await this.releaseAndPersist(state);
+    await this.flushServices();
     if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
       ws.close();
     }
@@ -577,6 +640,40 @@ export class ConnectionDO extends DurableObject<Env> {
     return this.accounts;
   }
 
+  /**
+   * Resolves the persistent services store once (D1 → write-behind cache),
+   * caching the result. Safe to call on every frame; the D1 scan runs at
+   * most once per ConnectionDO instance. Must complete before the first
+   * reducer dispatches so the synchronous `ServicesStore` port has its
+   * snapshot ready. Leaves `services` `undefined` when D1 is absent so the
+   * actor's `ctx.services` stays unset (no NickServ/ChanServ routing).
+   */
+  private async loadServicesStore(): Promise<void> {
+    if (this.servicesResolved) return;
+    this.servicesResolved = true;
+    this.services = await loadD1ServicesStore(this.env.ACCOUNTS_DB, this.clock);
+  }
+
+  /**
+   * Returns the resolved services store, or `undefined` when services are
+   * not configured. Populated by {@link loadServicesStore}; callers MUST
+   * `await loadServicesStore()` before reading this.
+   */
+  private servicesStore(): D1ServicesStore | undefined {
+    return this.services;
+  }
+
+  /**
+   * Drains any queued write-behind ops into D1. No-op when services are
+   * unbound or when no mutations occurred this turn. Called after every
+   * frame (the `webSocketMessage` finally block) and at teardown so a
+   * deploy / DO eviction does not lose services state.
+   */
+  private async flushServices(): Promise<void> {
+    if (this.services === undefined) return;
+    await this.services.flush();
+  }
+
   // -------------------------------------------------------------------------
   // Test hooks (only invoked from `runInDurableObject` in tests)
   // -------------------------------------------------------------------------
@@ -603,6 +700,8 @@ export class ConnectionDO extends DurableObject<Env> {
     // Emit QUIT effects without dispatching transport calls (the socket
     // is already gone). The cross-DO fanout still runs.
     await this.loadAccountStore();
+    await this.loadServicesStore();
+    const services = this.servicesStore();
     const noOpHandlers: CfConnectionHandlers = {
       send: (): void => {},
       disconnect: (): void => {},
@@ -624,9 +723,11 @@ export class ConnectionDO extends DurableObject<Env> {
       motd: this.motdProvider(),
       messages: this.messageStore(),
       history: this.historyStore(),
+      ...(services !== undefined ? { services } : {}),
     });
     await actor.receiveTextFrame('QUIT\r\n');
     await this.releaseAndPersist(state);
+    await this.flushServices();
     try {
       await this.ctx.storage.deleteAlarm();
     } catch {
@@ -651,6 +752,15 @@ export class ConnectionDO extends DurableObject<Env> {
     await this.persistState(state);
   }
 
+  /**
+   * Test-only: suppresses the `webSocketClose`/`webSocketError` teardown
+   * so the idle-sweep alarm is the sole cleanup path — mirroring a lost
+   * close event in production. See {@link __suppressCloseTeardown}.
+   */
+  public __suppressCloseTeardownHook(): void {
+    this.__suppressCloseTeardown = true;
+  }
+
   /** Returns this DO's hex id — the canonical ConnId used in RPC routing. */
   public __peekHexId(): string {
     return this.ctx.id.toString();