serverless-ircd 0.7.0 → 0.8.0

package/packages/irc-core/tests/commands/nickserv.test.ts

@@ -0,0 +1,807 @@
+import { describe, expect, it } from 'vitest';
+import { NICKSERV_NICK, enforceRegisteredNick, nickservReducer } from '../../src/commands/nickserv';
+import { Effect } from '../../src/effects';
+import type { Effect as EffectType } from '../../src/effects';
+import type { ServicesStore } from '../../src/ports';
+import {
+  EmptyMotdProvider,
+  FakeClock,
+  InMemoryServicesStore,
+  SequentialIdFactory,
+} from '../../src/ports';
+import type { IrcMessage } from '../../src/protocol/messages';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const NOW = 1_700_000_000_000;
+
+const serverConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeConn(id = 'c1', nick = 'alice'): ConnectionState {
+  const s = createConnection({ id, connectedSince: 0 });
+  s.nick = nick;
+  s.user = nick;
+  s.host = 'example.com';
+  s.realname = nick;
+  s.registration = 'registered';
+  return s;
+}
+
+function makeCtx(
+  state: ConnectionState,
+  services?: ServicesStore,
+  clock = new FakeClock(NOW),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    ...(services !== undefined ? { services } : {}),
+  });
+}
+
+function privmsg(body: string): IrcMessage {
+  return { command: 'PRIVMSG', params: [NICKSERV_NICK, body], tags: {} };
+}
+
+/** Extracts the text of every Send line emitted by the reducer. */
+function sentTexts(effects: EffectType[]): string[] {
+  return effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+}
+
+describe('nickservReducer — REGISTER', () => {
+  it('registers a fresh nick and confirms via NickServ NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('REGISTER hunter2 alice@example.com'), ctx);
+
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    const rec = services.getNick('alice');
+    expect(rec?.email).toBe('alice@example.com');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice is now registered.',
+    );
+  });
+
+  it('does NOT auto-identify after REGISTER (no +r, no account)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('REGISTER hunter2 alice@example.com'), ctx);
+
+    expect(conn.userModes.registered).toBe(false);
+    expect(conn.account).toBeUndefined();
+  });
+
+  it('rejects REGISTER on an already-registered nick with a NOTICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('REGISTER otherpw other@example.com'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice is already registered.',
+    );
+  });
+
+  it('rejects REGISTER with missing parameters', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('REGISTER hunter2'), ctx);
+
+    expect(services.isRegisteredNick('alice')).toBe(false);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: REGISTER <password> <email>',
+    );
+  });
+
+  it('rejects REGISTER with no body at all', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg(''), ctx);
+
+    expect(sentTexts(out.effects).some((t) => t.includes('NOTICE alice'))).toBe(true);
+  });
+
+  it('returns a help NOTICE when PRIVMSG has no body parameter at all', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(
+      conn,
+      { command: 'PRIVMSG', params: [NICKSERV_NICK], tags: {} },
+      ctx,
+    );
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Available commands: REGISTER, IDENTIFY, DROP, INFO, SET',
+    );
+  });
+
+  it('returns a NOTICE when no services store is bound', () => {
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = nickservReducer(conn, privmsg('REGISTER hunter2 alice@example.com'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Services are not available on this server.',
+    );
+  });
+});
+
+describe('nickservReducer — IDENTIFY', () => {
+  it('sets +r and account on correct password (IDENTIFY <password>)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You are now identified for nick alice.',
+    );
+  });
+
+  it('sets +r and account for IDENTIFY <nick> <password>', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    // Connection is using nick "bob" but identifies as "alice".
+    const conn = makeConn('c1', 'bob');
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY alice hunter2'), ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE bob :You are now identified for nick alice.',
+    );
+  });
+
+  it('emits ACCOUNT to account-notify peers on successful identify', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.joinedChannels.add('#foo');
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    const broadcasts = out.effects.filter((e) => e.tag === 'Broadcast');
+    expect(broadcasts).toHaveLength(1);
+    if (broadcasts.length === 0) return;
+    const bcast = broadcasts[0];
+    if (bcast?.tag !== 'Broadcast') return;
+    expect(bcast.chan).toBe('#foo');
+    expect(bcast.cap).toBe('account-notify');
+    expect(bcast.capLines?.[0]?.text).toBe(':alice!alice@example.com ACCOUNT alice');
+  });
+
+  it('rejects IDENTIFY with wrong password (no +r, NOTICE only)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(conn.account).toBeUndefined();
+    expect(conn.userModes.registered).toBe(false);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+    expect(out.effects.filter((e) => e.tag === 'Broadcast')).toHaveLength(0);
+  });
+
+  it('rejects IDENTIFY for an unregistered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(conn.account).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is not registered.',
+    );
+  });
+
+  it('rejects IDENTIFY with missing parameters', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY'), ctx);
+
+    expect(conn.account).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: IDENTIFY [nick] <password>',
+    );
+  });
+
+  it('informs an already-identified connection', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You are already identified.',
+    );
+  });
+
+  it('delivers queued memos on successful identify', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.recordMemo({
+      from: 'bob',
+      to: 'alice',
+      body: 'Hi alice!',
+      sentAt: NOW,
+    });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] Hi alice!',
+    );
+    const memos = services.listMemos('alice');
+    expect(memos[0]?.read).toBe(true);
+  });
+});
+
+describe('nickservReducer — DROP', () => {
+  it('removes the registration when the connection is identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('DROP'), ctx);
+
+    expect(services.isRegisteredNick('alice')).toBe(false);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice has been dropped.',
+    );
+  });
+
+  it('clears +r and the account after DROP', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('DROP'), ctx);
+
+    expect(conn.account).toBeUndefined();
+    expect(conn.userModes.registered).toBe(false);
+  });
+
+  it('emits ACCOUNT * (logout) to account-notify peers after DROP', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    conn.joinedChannels.add('#foo');
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('DROP'), ctx);
+
+    const bcast = out.effects.find((e) => e.tag === 'Broadcast');
+    if (bcast?.tag === 'Broadcast') {
+      expect(bcast.capLines?.[0]?.text).toBe(':alice!alice@example.com ACCOUNT *');
+    } else {
+      expect.fail('expected an ACCOUNT * broadcast');
+    }
+  });
+
+  it('requires identification before DROP', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('DROP'), ctx);
+
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before dropping a nick.',
+    );
+  });
+
+  it('guards DROP when the connection has an account but no nick (defensive)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+    delete conn.nick;
+    conn.account = 'leftover';
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('DROP'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE * :You must identify before dropping a nick.',
+    );
+  });
+});
+
+describe('nickservReducer — INFO', () => {
+  it('reports info for a registered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('INFO'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE alice :Nick: alice');
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE alice :Account: alice');
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE alice :Email: alice@example.com');
+  });
+
+  it('reports info for an explicitly named registered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('INFO bob'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE alice :Nick: bob');
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE alice :Email: bob@example.com');
+  });
+
+  it('reports not-registered for an unknown nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('INFO ghostie'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick ghostie is not registered.',
+    );
+  });
+
+  it('reports not-registered for the current nick when unregistered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('INFO'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is not registered.',
+    );
+  });
+
+  it('emits a syntax notice when INFO has no target and the connection has no nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+    delete conn.nick;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('INFO'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE * :Syntax: INFO [nick]',
+    );
+  });
+});
+
+describe('nickservReducer — misc', () => {
+  it('returns a help NOTICE for an unknown subcommand', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('FROBNICATE foo bar'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET',
+    );
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, new FakeClock(NOW + 500));
+
+    nickservReducer(conn, privmsg('INFO'), ctx);
+
+    expect(conn.lastSeen).toBe(NOW + 500);
+  });
+
+  it('is case-insensitive on the subcommand', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('identify hunter2'), ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+  });
+});
+
+describe('NICKSERV_NICK constant', () => {
+  it('is the canonical NickServ pseudo-client nick', () => {
+    expect(NICKSERV_NICK).toBe('NickServ');
+  });
+});
+
+// ============================================================================
+// SET ENFORCE
+// ============================================================================
+
+describe('nickservReducer — SET ENFORCE', () => {
+  it('sets the enforce policy on the caller-identified nick (ghost)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE ghost'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('ghost');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Enforcement for nick alice is now set to ghost.',
+    );
+  });
+
+  it('sets the enforce policy to kill', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('SET ENFORCE kill'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('kill');
+  });
+
+  it('sets the enforce policy to none (explicit)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'ghost');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('SET ENFORCE none'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+  });
+
+  it('requires identification before SET ENFORCE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE ghost'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before changing enforcement.',
+    );
+  });
+
+  it('rejects SET ENFORCE on a nick the caller does not own', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    // bob is identified as bob, but tries to set enforce on alice's nick.
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    const conn = makeConn('c1', 'alice');
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE ghost'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before changing enforcement.',
+    );
+  });
+
+  it('rejects SET ENFORCE on an unregistered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE ghost'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is not registered.',
+    );
+  });
+
+  it('rejects SET ENFORCE with a missing policy value', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET ENFORCE none|ghost|kill',
+    );
+  });
+
+  it('rejects SET ENFORCE with an invalid policy value', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE maybe'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET ENFORCE none|ghost|kill',
+    );
+  });
+
+  it('rejects SET ENFORCE with no nick on the connection (defensive)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+    delete conn.nick;
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET ENFORCE ghost'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE * :You must identify before changing enforcement.',
+    );
+  });
+
+  it('is case-insensitive on the policy value', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('SET ENFORCE GHOST'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('ghost');
+  });
+
+  it('ignores an extra trailing argument to SET ENFORCE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('set enforce kill now'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('kill');
+  });
+
+  it('returns the ENFORCE syntax notice for an unknown SET subkey', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET FOO bar'), ctx);
+
+    expect(services.getNickEnforce('alice')).toBe('none');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET ENFORCE none|ghost|kill',
+    );
+  });
+
+  it('returns the ENFORCE syntax notice for SET with no subkey', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET ENFORCE none|ghost|kill',
+    );
+  });
+});
+
+// ============================================================================
+// enforceRegisteredNick — the enforcement hook fired by the NICK path
+// ============================================================================
+
+/** Default grace used by the reducer when ServerConfig omits the override. */
+const DEFAULT_GRACE_MS = 30_000;
+
+function makeServicesCtx(
+  state: ConnectionState,
+  services: ServicesStore,
+  clock = new FakeClock(NOW),
+): Ctx {
+  return makeCtx(state, services, clock);
+}
+
+describe('enforceRegisteredNick', () => {
+  it('returns no effects when no services store is bound', () => {
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    expect(enforceRegisteredNick(conn, ctx)).toEqual<EffectType[]>([]);
+  });
+
+  it('returns no effects when the connection has no nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+    delete conn.nick;
+    const ctx = makeServicesCtx(conn, services);
+
+    expect(enforceRegisteredNick(conn, ctx)).toEqual<EffectType[]>([]);
+  });
+
+  it('returns no effects when the nick is not registered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeServicesCtx(conn, services);
+
+    expect(enforceRegisteredNick(conn, ctx)).toEqual<EffectType[]>([]);
+  });
+
+  it('returns no effects when the connection is identified as the nick owner', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'kill');
+    const conn = makeConn();
+    conn.account = 'alice';
+    const ctx = makeServicesCtx(conn, services);
+
+    expect(enforceRegisteredNick(conn, ctx)).toEqual<EffectType[]>([]);
+  });
+
+  it('policy none emits only a warning NOTICE (no EnforceNick effect)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'none');
+    const conn = makeConn();
+    const ctx = makeServicesCtx(conn, services);
+
+    const effects = enforceRegisteredNick(conn, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toHaveLength(0);
+    expect(sentTexts(effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :This nickname is registered and protected. If it is yours, IDENTIFY; otherwise choose another.',
+    );
+  });
+
+  it('policy kill emits the warning NOTICE plus EnforceNick(kill, graceMs=0)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'kill');
+    const conn = makeConn();
+    const ctx = makeServicesCtx(conn, services);
+
+    const effects = enforceRegisteredNick(conn, ctx);
+
+    const enforce = effects.filter((e) => e.tag === 'EnforceNick');
+    expect(enforce).toEqual<EffectType[]>([Effect.enforceNick('c1', 'alice', 'kill', 0)]);
+  });
+
+  it('policy ghost emits the warning NOTICE plus EnforceNick(ghost, graceMs=default)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'ghost');
+    const conn = makeConn();
+    const ctx = makeServicesCtx(conn, services);
+
+    const effects = enforceRegisteredNick(conn, ctx);
+
+    const enforce = effects.filter((e) => e.tag === 'EnforceNick');
+    expect(enforce).toEqual<EffectType[]>([
+      Effect.enforceNick('c1', 'alice', 'ghost', DEFAULT_GRACE_MS),
+    ]);
+  });
+
+  it('policy ghost honours a ServerConfig nickEnforceGraceMs override', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'ghost');
+    const conn = makeConn();
+    const ctx: Ctx = buildCtx({
+      serverConfig: { ...serverConfig, nickEnforceGraceMs: 5_000 },
+      clock: new FakeClock(NOW),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: conn,
+      services,
+    });
+
+    const effects = enforceRegisteredNick(conn, ctx);
+
+    const enforce = effects.filter((e) => e.tag === 'EnforceNick');
+    expect(enforce).toEqual<EffectType[]>([Effect.enforceNick('c1', 'alice', 'ghost', 5_000)]);
+  });
+
+  it('skips the account owner check when the nick has no account (guest)', () => {
+    // Connection using a registered nick they have not identified as. The
+    // nick is registered; the connection has no account; enforcement fires.
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'kill');
+    const conn = makeConn();
+    expect(conn.account).toBeUndefined();
+    const ctx = makeServicesCtx(conn, services);
+
+    const effects = enforceRegisteredNick(conn, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toHaveLength(1);
+  });
+});