serverless-ircd 0.7.0 → 0.8.0

package/packages/cf-adapter/src/env.ts

@@ -89,6 +89,14 @@ export interface Env {
    * Cloudflare secret (never a plaintext `[vars]` entry) in production.
    */
   OPER_PASSWORD?: string;
+  /**
+   * Server-password gate. Treat as a Cloudflare secret (set via
+   * `wrangler secret put SERVER_PASSWORD`); the loader threads it into
+   * `ServerConfig.serverPassword` so the registration reducer requires
+   * `PASS <value>` (or a SASL-identified connection) before
+   * `001 RPL_WELCOME`. Undefined / empty disables the gate.
+   */
+  SERVER_PASSWORD?: string;
 }
 
 /**

package/packages/cf-adapter/src/index.ts

@@ -32,6 +32,11 @@ export {
   putAccountCredential,
   resolveAccountStore,
 } from './d1-account-store.js';
+export {
+  CREATE_SERVICES_TABLES_SQL,
+  D1ServicesStore,
+  loadD1ServicesStore,
+} from './d1-services-store.js';
 export {
   PERSISTED_STATE_VERSION,
   STATE_STORAGE_KEY,

package/packages/cf-adapter/tests/config-loader.test.ts

@@ -17,6 +17,12 @@ interface CfEnvLike {
   CHANNEL_PREFIXES?: string;
   OPER_USER?: string;
   OPER_PASSWORD?: string;
+  /**
+   * Server-password gate. Treat as a wrangler secret in production
+   * (never a plaintext `[vars]` entry); the loader threads it through
+   * to `ServerConfig.serverPassword`.
+   */
+  SERVER_PASSWORD?: string;
   MAX_CHANNELS_PER_USER?: string;
   MAX_TARGETS_PER_COMMAND?: string;
   NICK_LEN?: string;
@@ -76,6 +82,19 @@ describe('loadServerConfigFromCfEnv — valid env', () => {
     expect(cfg.operCreds).toEqual([{ user: 'admin', password: 'hunter2' }]);
   });
 
+  it('threads SERVER_PASSWORD through to serverPassword', () => {
+    const cfg = loadServerConfigFromCfEnv({
+      ...baseEnv(),
+      SERVER_PASSWORD: 'hunter2',
+    });
+    expect(cfg.serverPassword).toBe('hunter2');
+  });
+
+  it('leaves serverPassword undefined when SERVER_PASSWORD is unset', () => {
+    const cfg = loadServerConfigFromCfEnv(baseEnv());
+    expect(cfg.serverPassword).toBeUndefined();
+  });
+
   it('parses numeric limit overrides from string env vars', () => {
     const cfg = loadServerConfigFromCfEnv({
       ...baseEnv(),

package/packages/cf-adapter/tests/connection-do-nickserv-d1.test.ts

@@ -0,0 +1,128 @@
+/**
+ * End-to-end NickServ registration persistence across two ConnectionDO
+ * instances (simulating a register on one connection, then reconnect).
+ *
+ * Regression guard for the symptom: "NickServ says I registered, but on
+ * reconnect it says the nick is not registered." Each connection is a
+ * separate ConnectionDO that hydrates its services store from D1 on first
+ * frame and write-behind-flushes on frame exit. This test proves the D1
+ * round-trip survives across independent DO instances.
+ */
+
+import { env } from 'cloudflare:test';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      CONNECTION_DO: DurableObjectNamespace;
+      REGISTRY_DO: DurableObjectNamespace;
+      CHANNEL_DO: DurableObjectNamespace;
+      ACCOUNTS_DB: D1Database;
+    }
+  }
+}
+
+class IrcWsClient {
+  readonly received: string[] = [];
+  readonly ws: WebSocket;
+
+  constructor(ws: WebSocket) {
+    this.ws = ws;
+    ws.addEventListener('message', (ev: MessageEvent) => {
+      const d = ev.data as string;
+      for (const line of d.split('\r\n')) {
+        if (line.length > 0) this.received.push(line);
+      }
+    });
+  }
+
+  send(line: string): void {
+    this.ws.send(line);
+  }
+
+  waitForMessage(predicate: (line: string) => boolean, timeoutMs = 2000): Promise<string> {
+    return new Promise<string>((resolve, reject) => {
+      const start = Date.now();
+      const tick = (): void => {
+        const hit = this.received.find(predicate);
+        if (hit !== undefined) {
+          resolve(hit);
+          return;
+        }
+        if (Date.now() - start > timeoutMs) {
+          reject(new Error(`timeout waiting for message; got: ${JSON.stringify(this.received)}`));
+          return;
+        }
+        setTimeout(tick, 20);
+      };
+      tick();
+    });
+  }
+
+  close(): Promise<void> {
+    return new Promise<void>((resolve) => {
+      this.ws.addEventListener('close', () => resolve());
+      this.ws.close();
+    });
+  }
+}
+
+async function connect(connId: string): Promise<IrcWsClient> {
+  const doId = env.CONNECTION_DO.idFromName(connId);
+  const stub = env.CONNECTION_DO.get(doId);
+  const response = await stub.fetch('https://do/upgrade', {
+    headers: { Upgrade: 'websocket' },
+  });
+  const ws = response.webSocket;
+  if (ws === undefined || ws === null) {
+    throw new Error('ConnectionDO.fetch did not return a WebSocket');
+  }
+  ws.accept();
+  return new Promise<IrcWsClient>((resolve) => {
+    setTimeout(() => resolve(new IrcWsClient(ws as WebSocket)), 0);
+  });
+}
+
+describe('ConnectionDO — NickServ registration persists across connections', () => {
+  beforeEach(async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+  });
+  afterEach(async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+  });
+
+  it('a registration on one connection is visible after reconnect', async () => {
+    // --- Connection A: register the nick. ---
+    const a = await connect('conn-nickserv-a');
+    a.send('NICK alice\r\n');
+    a.send('USER alice 0 * :alice\r\n');
+    await a.waitForMessage((l) => l.includes(' 001 '));
+    a.send('PRIVMSG NickServ :REGISTER hunter2 alice@example.com\r\n');
+    const registered = await a.waitForMessage((l) => l.includes('is now registered.'));
+    expect(registered).toContain('is now registered.');
+
+    // The success NOTICE is emitted during dispatch, BEFORE the finally-block
+    // D1 flush. Force the REGISTER frame (incl. its flush) to fully complete
+    // by driving a second frame through the same DO and awaiting its reply.
+    // DO message events are processed serially, so the PONG guarantees flush.
+    a.send('PING :flush-barrier\r\n');
+    await a.waitForMessage((l) => l.startsWith('PONG'));
+    await a.close();
+
+    // --- Connection B: a brand-new ConnectionDO that rehydrates from D1. ---
+    const b = await connect('conn-nickserv-b');
+    b.send('NICK bob\r\n');
+    b.send('USER bob 0 * :bob\r\n');
+    await b.waitForMessage((l) => l.includes(' 001 '));
+    // IDENTIFY against the nick registered on connection A.
+    b.send('PRIVMSG NickServ :IDENTIFY alice hunter2\r\n');
+    const identified = await b.waitForMessage(
+      (l) => l.includes('is not registered.') || l.includes('now identified for nick'),
+    );
+
+    expect(identified).toContain('now identified for nick alice');
+    expect(identified).not.toContain('is not registered.');
+    await b.close();
+  });
+});

package/packages/cf-adapter/tests/connection-do.test.ts

@@ -94,14 +94,21 @@ class IrcWsClient {
 /**
  * Opens a WebSocket to a fresh ConnectionDO instance named `connId`.
  * Each connection gets its own DO instance + isolated storage.
+ *
+ * `extraHeaders` merges into the upgrade request headers — used to simulate
+ * Cloudflare edge headers like `CF-Connecting-IP` that production reads at
+ * upgrade time to seed the connection's visible host.
  */
-async function connect(connId: string): Promise<IrcWsClient> {
+async function connect(
+  connId: string,
+  extraHeaders?: Record<string, string>,
+): Promise<IrcWsClient> {
   const doId = env.CONNECTION_DO.idFromName(connId);
   const stub = env.CONNECTION_DO.get(doId);
   // The DO's `fetch` returns the websocket-upgraded Response. We strip
   // the `webSocket` field via the standard Workers WebSocket handshake.
   const response = await stub.fetch('https://do/upgrade', {
-    headers: { Upgrade: 'websocket' },
+    headers: { Upgrade: 'websocket', ...(extraHeaders ?? {}) },
   });
   const ws = response.webSocket;
   if (ws === undefined || ws === null) {
@@ -339,6 +346,63 @@ describe('ConnectionDO — alarms', () => {
     });
     expect(client.isClosed).toBe(true);
   });
+
+  it('alarm prunes channel rosters and notifies peers when the socket is gone', async () => {
+    // Reproduces the ghost-member bug: when a connection drops without a
+    // clean close reaching the DO, the idle-sweep alarm is the backstop
+    // that must remove the member from every shared channel's roster and
+    // fan a QUIT out to peers. Closing the client WS without invoking the
+    // close-teardown path leaves the roster populated, so the alarm is the
+    // sole cleanup path here.
+    const alice = await connect('conn-alarm-ghost-a');
+    await register(alice, 'ghost-alice');
+    const bob = await connect('conn-alarm-ghost-b');
+    await register(bob, 'ghost-bob');
+
+    alice.send('JOIN #alarm-ghost\r\n');
+    await alice.waitForMessage((l) => l.includes(' 366 ') && l.includes('#alarm-ghost'));
+    bob.send('JOIN #alarm-ghost\r\n');
+    await bob.waitForMessage((l) => l.includes(' 366 ') && l.includes('#alarm-ghost'));
+
+    const aliceStub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-alarm-ghost-a'));
+
+    // Suppress the DO's close teardown so the alarm is the SOLE cleanup
+    // path — faithfully simulating a lost close event in production
+    // (where the platform drops a hibernated socket without delivering
+    // `webSocketClose`). Without this the close handler races in and
+    // prunes the roster itself, masking the alarm's behaviour.
+    await runInDurableObject(aliceStub, async (instance: unknown) => {
+      const doInstance = instance as {
+        __suppressCloseTeardownHook?: () => void;
+        __backdateLastSeen?: (ms: number) => Promise<void>;
+      };
+      doInstance.__suppressCloseTeardownHook?.();
+      await doInstance.__backdateLastSeen?.(48 * 60 * 60 * 1000);
+    });
+
+    // Drop alice's socket (client side). webSocketClose will fire but is
+    // suppressed, so the roster still holds alice when the alarm runs.
+    alice.ws.close();
+
+    await runDurableObjectAlarm(aliceStub);
+
+    // bob must observe alice's QUIT: only the alarm's synthetic QUIT can
+    // deliver it (the close teardown was suppressed).
+    const quit = await bob.waitForMessage((l) => l.includes('QUIT') && l.includes('ghost-alice'));
+    expect(quit).toContain('ghost-alice');
+
+    // Flush bob's receive buffer before the NAMES query: the JOIN flow
+    // already delivered a 353 (listing alice) that would otherwise mask
+    // the fresh NAMES response.
+    bob.received.length = 0;
+    bob.send('NAMES #alarm-ghost\r\n');
+    const names = await bob.waitForMessage(
+      (l) => l.includes(' 353 ') && l.includes('#alarm-ghost'),
+    );
+    expect(names).not.toContain('ghost-alice');
+
+    bob.ws.close();
+  });
 });
 
 describe('ConnectionDO — chathistory end-to-end', () => {
@@ -366,6 +430,90 @@ describe('ConnectionDO — chathistory end-to-end', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Source host capture (CF-Connecting-IP / X-Real-IP) at WebSocket upgrade
+// ---------------------------------------------------------------------------
+
+describe('ConnectionDO — source host capture at upgrade', () => {
+  it('seeds state.host from the CF-Connecting-IP upgrade header', async () => {
+    const connId = 'conn-ip-cf';
+    const client = await connect(connId, { 'CF-Connecting-IP': '203.0.113.42' });
+    await register(client, 'alice');
+
+    // The visible host is the raw CF-Connecting-IP value (cloaking is off
+    // in this env). state.host drives the `@host` segment of every
+    // hostmask; the 001 welcome line is the cheapest observable.
+    const welcome = await client.waitForMessage((l) => l.includes(' 001 '));
+    expect(welcome).toContain('alice!alice@203.0.113.42');
+
+    const state = await inspectState(connId);
+    expect(state?.host).toBe('203.0.113.42');
+
+    client.ws.close();
+  });
+
+  it('falls back to X-Real-IP when CF-Connecting-IP is absent', async () => {
+    const connId = 'conn-ip-xri';
+    const client = await connect(connId, { 'X-Real-IP': '198.51.100.7' });
+    await register(client, 'bob');
+
+    const welcome = await client.waitForMessage((l) => l.includes(' 001 '));
+    expect(welcome).toContain('bob!bob@198.51.100.7');
+
+    const state = await inspectState(connId);
+    expect(state?.host).toBe('198.51.100.7');
+
+    client.ws.close();
+  });
+
+  it('prefers CF-Connecting-IP over X-Real-IP when both are present', async () => {
+    const connId = 'conn-ip-both';
+    const client = await connect(connId, {
+      'CF-Connecting-IP': '203.0.113.1',
+      'X-Real-IP': '198.51.100.1',
+    });
+    await register(client, 'carol');
+
+    const state = await inspectState(connId);
+    expect(state?.host).toBe('203.0.113.1');
+
+    client.ws.close();
+  });
+
+  it('leaves state.host undefined when no source-IP header is present', async () => {
+    // Pre-feature behaviour preserved: no header → no host → hostmask omits
+    // the `@host` segment entirely (rather than synthesizing `?` or `unknown`).
+    const connId = 'conn-ip-none';
+    const client = await connect(connId);
+    await register(client, 'dave');
+
+    const welcome = await client.waitForMessage((l) => l.includes(' 001 '));
+    // No @host segment: the hostmask ends right after the user segment.
+    expect(welcome).toMatch(/dave!dave$/);
+
+    const state = await inspectState(connId);
+    expect(state?.host).toBeUndefined();
+
+    client.ws.close();
+  });
+
+  it('persists the captured host across simulated hibernation', async () => {
+    const connId = 'conn-ip-hib';
+    const client = await connect(connId, { 'CF-Connecting-IP': '203.0.113.99' });
+    await register(client, 'eve');
+
+    await forceHibernation(connId);
+    // Reload path via a trivial command so loadState re-runs.
+    client.send('PING :token-ip\r\n');
+    await client.waitForMessage((l) => l.startsWith('PONG'));
+
+    const after = await inspectState(connId);
+    expect(after?.host).toBe('203.0.113.99');
+
+    client.ws.close();
+  });
+});
+
 // ---------------------------------------------------------------------------
 // SASL PLAIN end-to-end (AccountStore plumbing)
 // ---------------------------------------------------------------------------