serverless-ircd 0.7.0 → 0.8.0

package/packages/irc-core/tests/commands/registration.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, it } from 'vitest';
+import pkg from '../../package.json' with { type: 'json' };
 import { cloakHost } from '../../src/cloak';
+import {
+  applyAccountSuccess,
+  parsePassAccountAttempt,
+  passBasedAccountAuth,
+} from '../../src/commands/account-auth';
 import { generateIsupport } from '../../src/commands/isupport';
 import {
   buildWelcomeLines,
@@ -9,23 +15,41 @@ import {
   passReducer,
   userReducer,
 } from '../../src/commands/registration';
-import { DEFAULT_CREATED_TEXT, DEFAULT_SERVER_VERSION } from '../../src/config';
+import { DEFAULT_CREATED_TEXT } from '../../src/config';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import {
   EmptyMotdProvider,
   FakeClock,
+  InMemoryAwayStore,
   InMemoryNickHistoryStore,
+  InMemoryServicesStore,
   SequentialIdFactory,
   StaticMotdProvider,
 } from '../../src/ports';
-import type { MotdProvider } from '../../src/ports';
+import type {
+  AccountStore,
+  AwayStore,
+  MotdProvider,
+  SaslPayload,
+  SaslResult,
+  ServicesStore,
+} from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
+// Explicit version pinned in the fixture so the assertions below verify that
+// the configured version is what reaches the wire — not a specific default.
+const FIXTURE_VERSION = '9.9.9';
+// The schema default must track the irc-core package version so a deployment
+// that omits `serverVersion` advertises the version it was shipped with, not
+// a stale hardcoded placeholder.
+const PACKAGE_VERSION = pkg.version as string;
+
 const serverConfig: ServerConfig = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
+  serverVersion: FIXTURE_VERSION,
   maxChannelsPerUser: 30,
   maxTargetsPerCommand: 10,
   maxListEntries: 50,
@@ -104,9 +128,9 @@ function expectedWelcome(nick: string, user: string, host: string | undefined):
   );
   return [
     L(`${prefix} 001 ${nick} :Welcome to the ExampleNet IRC Network, ${hostmask}`),
-    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${DEFAULT_SERVER_VERSION}`),
+    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${FIXTURE_VERSION}`),
     L(`${prefix} 003 ${nick} :This server was created in ${DEFAULT_CREATED_TEXT}`),
-    L(`${prefix} 004 ${nick} ${sv} ${DEFAULT_SERVER_VERSION} iosw biklmnstp`),
+    L(`${prefix} 004 ${nick} ${sv} ${FIXTURE_VERSION} iosw biklmnstp`),
     ...isupport,
     L(`${prefix} 422 ${nick} :MOTD File is missing`),
   ];
@@ -307,6 +331,21 @@ describe('nickReducer', () => {
     expect(out.state.registration).toBe('registered');
   });
 
+  it('broadcasts the NICK change to every joined channel (except self)', () => {
+    const state = registeredState();
+    state.joinedChannels.add('#foo');
+    state.joinedChannels.add('#bar');
+    const ctx = makeCtx(state);
+    const out = nickReducer(state, { command: 'NICK', params: ['bob'], tags: {} }, ctx);
+    const line = L(':alice!alice@example.com NICK bob');
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.changeNick('c1', 'alice', 'bob'),
+      Effect.send('c1', [line]),
+      Effect.broadcast('#foo', [line], 'c1'),
+      Effect.broadcast('#bar', [line], 'c1'),
+    ]);
+  });
+
   it('echoes back with partial hostmask when host is absent on nick change', () => {
     const state = makeState();
     state.nick = 'alice';
@@ -530,7 +569,7 @@ describe('passReducer', () => {
     expect(out.state.registration).toBe('pre-registration');
   });
 
-  it('does not validate the password (enforcement lives in the actor layer)', () => {
+  it('stashes the password attempt; the gate is enforced by passwordGateFailure at emitWelcomeIfReady', () => {
     const state = makeState();
     const ctx = makeCtx(state);
     const out = passReducer(state, { command: 'PASS', params: ['wrong-password'], tags: {} }, ctx);
@@ -648,14 +687,18 @@ describe('buildWelcomeLines', () => {
 // ============================================================================
 
 describe('buildWelcomeLines — config-driven version & created text', () => {
-  /** Builds a ctx whose serverConfig carries the supplied version/created. */
+  /** Builds a ctx whose serverConfig carries the supplied version/created.
+   * When `serverVersion` is undefined the inherited fixture version is dropped
+   * so the schema/reducer default applies — this lets callers exercise the
+   * fallback path explicitly. */
   function makeCtxWithMeta(
     state: ConnectionState,
     serverVersion: string | undefined,
     createdAt: string | number | undefined,
   ): Ctx {
+    const { serverVersion: _drop, ...base } = serverConfig;
     const cfg: ServerConfig = {
-      ...serverConfig,
+      ...base,
       ...(serverVersion !== undefined ? { serverVersion } : {}),
       ...(createdAt !== undefined ? { createdAt } : {}),
     };
@@ -702,14 +745,13 @@ describe('buildWelcomeLines — config-driven version & created text', () => {
     expect(line003?.text).toContain('2023');
   });
 
-  it('falls back to the default version when serverVersion is omitted', () => {
+  it('falls back to the irc-core package version when serverVersion is omitted', () => {
     const ctx = makeCtxWithMeta(registeredConn(), undefined, undefined);
     const lines = buildWelcomeLines(ctx.connection, ctx);
     const line002 = lines.find((l) => l.text.split(' ')[1] === '002');
-    // The hardcoded placeholder '0.2.0' must no longer appear; the default
-    // is the irc-core package version (DEFAULT_SERVER_VERSION).
-    expect(line002?.text).not.toContain('0.2.0');
-    expect(line002?.text).toContain(DEFAULT_SERVER_VERSION);
+    // The default must track the irc-core package version (PACKAGE_VERSION),
+    // not a stale hardcoded placeholder.
+    expect(line002?.text).toContain(PACKAGE_VERSION);
   });
 });
 
@@ -1095,9 +1137,9 @@ function expectedWelcomeWithHost(nick: string, hostmask: string): RawLine[] {
   );
   return [
     L(`${prefix} 001 ${nick} :Welcome to the ExampleNet IRC Network, ${hostmask}`),
-    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${DEFAULT_SERVER_VERSION}`),
+    L(`${prefix} 002 ${nick} :Your host is ${sv}, running version ${FIXTURE_VERSION}`),
     L(`${prefix} 003 ${nick} :This server was created in ${DEFAULT_CREATED_TEXT}`),
-    L(`${prefix} 004 ${nick} ${sv} ${DEFAULT_SERVER_VERSION} iosw biklmnstp`),
+    L(`${prefix} 004 ${nick} ${sv} ${FIXTURE_VERSION} iosw biklmnstp`),
     ...isupport,
     L(`${prefix} 422 ${nick} :MOTD File is missing`),
   ];
@@ -1166,3 +1208,735 @@ describe('emitWelcomeIfReady — user mode `S` (TLS connected)', () => {
     expect(out.state.userModes.tls).toBe(true);
   });
 });
+
+// ============================================================================
+// NickServ nick-enforcement wiring (fires on registration + nick change)
+// ============================================================================
+
+/** Like {@link makeCtx} but threads a bound services store. */
+function makeCtxWithServices(
+  state: ConnectionState,
+  services: ServicesStore,
+  clock = new FakeClock(1_000),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    services,
+  });
+}
+
+describe('emitWelcomeIfReady — NickServ nick enforcement', () => {
+  it('fires EnforceNick(kill) when an unidentified client registers a kill-enforced nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'kill');
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    // First effect is still the welcome Send.
+    expect(effects[0]?.tag).toBe('Send');
+    const enforce = effects.filter((e) => e.tag === 'EnforceNick');
+    expect(enforce).toEqual<EffectType[]>([Effect.enforceNick('c1', 'alice', 'kill', 0)]);
+  });
+
+  it('fires EnforceNick(ghost) with the configured grace for a ghost-enforced nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'ghost');
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const ctx: Ctx = buildCtx({
+      serverConfig: { ...serverConfig, nickEnforceGraceMs: 12_000 },
+      clock: new FakeClock(1_000),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: state,
+      services,
+    });
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([
+      Effect.enforceNick('c1', 'alice', 'ghost', 12_000),
+    ]);
+  });
+
+  it('does NOT fire enforcement when the connection is identified as the owner', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'kill');
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice'; // SASL-identified before CAP END
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([]);
+    // Welcome is the only effect.
+    expect(effects).toHaveLength(1);
+    expect(effects[0]?.tag).toBe('Send');
+  });
+
+  it('emits only a warning NOTICE (no EnforceNick) for a none-enforced nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setNickEnforce('alice', 'none');
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([]);
+    // Welcome Send + warning NOTICE Send.
+    expect(effects.filter((e) => e.tag === 'Send')).toHaveLength(2);
+  });
+
+  it('does not fire enforcement for an unregistered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const state = makeState();
+    state.nick = 'ghostie';
+    state.user = 'ghostie';
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([]);
+    expect(effects).toHaveLength(1);
+  });
+
+  it('does not fire enforcement when no services store is bound', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const ctx = makeCtx(state);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([]);
+    expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+  });
+});
+
+describe('nickReducer — NickServ nick enforcement on post-registration nick change', () => {
+  it('fires EnforceNick(ghost) when changing onto a ghost-enforced registered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('carol', 'hunter2', 'carol@example.com');
+    services.setNickEnforce('carol', 'ghost');
+    const state = registeredState(); // already registered as alice
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['carol'], tags: {} }, ctx);
+
+    expect(out.state.nick).toBe('carol');
+    // changeNick + NICK echo + warning NOTICE + EnforceNick(ghost).
+    const enforce = out.effects.filter((e) => e.tag === 'EnforceNick');
+    expect(enforce).toEqual<EffectType[]>([Effect.enforceNick('c1', 'carol', 'ghost', 30_000)]);
+  });
+
+  it('fires EnforceNick(kill) when changing onto a kill-enforced registered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('carol', 'hunter2', 'carol@example.com');
+    services.setNickEnforce('carol', 'kill');
+    const state = registeredState();
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['carol'], tags: {} }, ctx);
+
+    expect(out.effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([
+      Effect.enforceNick('c1', 'carol', 'kill', 0),
+    ]);
+  });
+
+  it('does not fire enforcement when changing onto an unregistered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const state = registeredState();
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['carol'], tags: {} }, ctx);
+
+    expect(out.effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([]);
+    // changeNick + NICK echo only.
+    expect(out.effects).toHaveLength(2);
+  });
+
+  it('does not fire enforcement when already identified as the nick owner', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('carol', 'hunter2', 'carol@example.com');
+    services.setNickEnforce('carol', 'kill');
+    const state = registeredState();
+    state.account = 'carol'; // identified as carol
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['carol'], tags: {} }, ctx);
+
+    expect(out.effects.filter((e) => e.tag === 'EnforceNick')).toEqual<EffectType[]>([]);
+    expect(out.effects).toHaveLength(2);
+  });
+});
+
+// ============================================================================
+// OperServ JUPE enforcement (NICK reducer returns 432 for a juped nick)
+// ============================================================================
+
+describe('nickReducer — OperServ JUPE enforcement', () => {
+  it('returns 432 ERR_ERRONEUSNICKNAME on a pre-registration attempt to use a juped nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.addJupe('moo', 'blocked');
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['moo'], tags: {} }, ctx);
+
+    // The jupe hook fires after the grammar check; the nick IS reserved
+    // (the actor's ReserveNick will succeed and the connection will be
+    // welcomed under a different nick later), but the 432 is emitted so
+    // the client knows the choice was rejected.
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+    expect(texts.some((t) => / 432 .*moo/.test(t))).toBe(true);
+  });
+
+  it('returns 432 on a post-registration NICK change onto a juped nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.addJupe('moo', 'blocked');
+    const state = registeredState();
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['moo'], tags: {} }, ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+    expect(texts.some((t) => / 432 .*moo/.test(t))).toBe(true);
+    // The nick should NOT change for the post-registration case (rejected).
+    expect(out.state.nick).toBe('alice');
+  });
+
+  it('does not emit 432 when no services store is bound', () => {
+    const state = registeredState();
+    const ctx = makeCtx(state);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['moo'], tags: {} }, ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+    expect(texts.some((t) => / 432 /.test(t))).toBe(false);
+  });
+
+  it('does not emit 432 for a non-jupe nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const state = registeredState();
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['carol'], tags: {} }, ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+    expect(texts.some((t) => / 432 /.test(t))).toBe(false);
+  });
+
+  it('matches the jupe case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.addJupe('Moo', 'blocked');
+    const state = registeredState();
+    const ctx = makeCtxWithServices(state, services);
+
+    const out = nickReducer(state, { command: 'NICK', params: ['moo'], tags: {} }, ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+    expect(texts.some((t) => / 432 /.test(t))).toBe(true);
+  });
+});
+
+// ============================================================================
+// OperServ AKILL admission (emitWelcomeIfReady disconnects on connect-time
+// match)
+// ============================================================================
+
+describe('emitWelcomeIfReady — OperServ AKILL admission', () => {
+  it('disconnects a connection whose hostmask matches a recorded AKILL', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const state = makeState();
+    state.nick = 'evil';
+    state.user = 'spammer';
+    state.host = 'bad.example.net';
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    const disconnects = effects.filter((e) => e.tag === 'Disconnect');
+    expect(disconnects).toHaveLength(1);
+  });
+
+  it('NOTIFIES the connection with the AKILL reason before disconnecting', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const state = makeState();
+    state.nick = 'evil';
+    state.user = 'spammer';
+    state.host = 'bad.example.net';
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    const texts = effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+    expect(texts.some((t) => t.includes('AKILL: flooding'))).toBe(true);
+  });
+
+  it('does NOT disconnect when no AKILL matches the hostmask', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.addAkill('*!*@bad.example.net', 'flooding');
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.host = 'good.example.net';
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'Disconnect')).toHaveLength(0);
+  });
+
+  it('does NOT run the AKILL check when no services store is bound', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const ctx = makeCtx(state);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(effects.filter((e) => e.tag === 'Disconnect')).toHaveLength(0);
+  });
+});
+
+// ============================================================================
+// PASS-based account auth (NICK + PASS <nick>:<password> + USER → identified)
+// ============================================================================
+
+/** A capture-and-respond fake AccountStore (mirrors the sasl.test.ts fake). */
+class FakeAccountStore implements AccountStore {
+  readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
+  constructor(private readonly result: SaslResult) {}
+  verify(mech: string, payload: SaslPayload): SaslResult {
+    this.calls.push({ mech, payload });
+    return this.result;
+  }
+}
+
+/** Like {@link makeCtx} but also threads a bound AccountStore. */
+function makeCtxWithAccounts(
+  state: ConnectionState,
+  accounts: AccountStore,
+  clock = new FakeClock(1_000),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    accounts,
+  });
+}
+
+const SV = 'irc.example.com';
+const L2 = (text: string): RawLine => ({ text });
+
+describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
+  it('identifies the connection when PASS <nick>:<password> matches an account', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.host = 'example.com';
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtxWithAccounts(state, accounts);
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(state.account).toBe('alice');
+    expect(state.registration).toBe('registered');
+    const texts = effects.flatMap((e) => (e.tag === 'Send' ? e.lines : [])).map((l) => l.text);
+    expect(texts).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
+    expect(texts.some((t) => t.startsWith(`:${SV} 001 `))).toBe(true);
+  });
+});
+
+// ---- helpers for the broader PASS-auth coverage ----
+
+/** Flexible ctx that binds any combination of account/services/away stores. */
+function makeCtxPassAuth(
+  state: ConnectionState,
+  opts: {
+    accounts?: AccountStore;
+    services?: ServicesStore;
+    away?: AwayStore;
+    serverPassword?: string;
+  },
+): Ctx {
+  return buildCtx({
+    serverConfig:
+      opts.serverPassword !== undefined
+        ? { ...serverConfig, serverPassword: opts.serverPassword }
+        : serverConfig,
+    clock: new FakeClock(1_000),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    ...(opts.accounts !== undefined ? { accounts: opts.accounts } : {}),
+    ...(opts.services !== undefined ? { services: opts.services } : {}),
+    ...(opts.away !== undefined ? { away: opts.away } : {}),
+  });
+}
+
+/** All Send-effect line texts emitted by `effects`. */
+function sentTexts(effects: EffectType[]): string[] {
+  return effects.flatMap((e) => (e.tag === 'Send' ? e.lines : [])).map((l) => l.text);
+}
+
+describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity with SASL)', () => {
+  it('forwards the parsed credentials to the AccountStore as a PLAIN verify', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    expect(accounts.calls).toEqual([
+      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'hunter2' } },
+    ]);
+  });
+
+  it('stamps read-only user mode `r` on a successful PASS-auth', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    expect(state.userModes.registered).toBe(true);
+  });
+
+  it('seeds lastReadMarkers from the ServicesStore on PASS-auth success', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.setLastReadMarker('alice', '#foo', 'm1');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    expect(state.lastReadMarkers?.get('#foo')).toBe('m1');
+  });
+
+  it('replays the persisted away reason and emits 306 on PASS-auth success', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const away = new InMemoryAwayStore();
+    away.set('alice', 'brb');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, away }));
+    expect(state.away).toBe('brb');
+    expect(sentTexts(effects)).toContain(`:${SV} 306 alice :You have been marked as being away`);
+  });
+
+  it('delivers queued unread memos on PASS-auth success (MemoServ parity)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'hi', sentAt: 0 });
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    expect(sentTexts(effects).some((t) => t.includes('[Memo #') && t.includes('hi'))).toBe(true);
+  });
+
+  it('records the payload nick as the canonical account name', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    expect(state.account).toBe('alice');
+  });
+});
+
+describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
+  it('does not identify and still completes registration when the password is wrong (no server password)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:wrong';
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+
+    expect(state.account).toBeUndefined();
+    expect(state.userModes.registered).toBe(false);
+    expect(state.registration).toBe('registered');
+    const texts = sentTexts(effects);
+    expect(texts.some((t) => t.includes(' 900 '))).toBe(false);
+    expect(texts.some((t) => t.includes(' 903 '))).toBe(false);
+    expect(texts.some((t) => t.includes(' 464 '))).toBe(false);
+  });
+
+  it('is indistinguishable from an unknown nick (no auth numerics, un-identified)', () => {
+    const state = makeState();
+    state.nick = 'nobody';
+    state.user = 'nobody';
+    state.passAttempt = 'nobody:wrong';
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+
+    expect(state.account).toBeUndefined();
+    expect(state.registration).toBe('registered');
+    const texts = sentTexts(effects);
+    expect(texts.some((t) => t.includes(' 900 '))).toBe(false);
+    expect(texts.some((t) => t.includes(' 903 '))).toBe(false);
+    expect(texts.some((t) => t.includes(' 904 '))).toBe(false);
+    expect(texts.some((t) => t.includes(' 464 '))).toBe(false);
+  });
+
+  it('runs an extra verify against a fixed dummy entry on failure to equalise timing', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:wrong';
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+
+    expect(accounts.calls).toHaveLength(2);
+    expect(accounts.calls[0]?.payload).toEqual({
+      kind: 'PLAIN',
+      username: 'alice',
+      password: 'wrong',
+    });
+    expect(accounts.calls[1]?.mech).toBe('PLAIN');
+    expect(accounts.calls[1]?.payload.kind).toBe('PLAIN');
+  });
+
+  it('treats a payload nick that does not match state.nick as a failed auth (no silent login)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'bob:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'bob' });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+
+    expect(state.account).toBeUndefined();
+    expect(state.registration).toBe('registered');
+    // The store is never consulted on a nick mismatch.
+    expect(accounts.calls).toHaveLength(0);
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
+  });
+});
+
+describe('emitWelcomeIfReady — PASS-auth interaction with the server-password gate', () => {
+  it('ignores the <nick>:<password> form when no AccountStore is bound (open gate)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, {}));
+
+    expect(state.account).toBeUndefined();
+    expect(state.registration).toBe('registered');
+    expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
+  });
+
+  it('collapses to the server-password gate (464) when no AccountStore is bound and the colon form does not match', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { serverPassword: 's3cret' }));
+
+    expect(state.registration).not.toBe('registered');
+    expect(effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L2(`:${SV} 464 alice :Password mismatch`)]),
+      Effect.disconnect('c1', 'Bad Password'),
+    ]);
+  });
+
+  it('precedence: a server password configured AND a <nick>:<password> that fails verify → 464 + disconnect', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:wrong';
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const effects = emitWelcomeIfReady(
+      state,
+      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+    );
+
+    expect(state.registration).not.toBe('registered');
+    expect(state.account).toBeUndefined();
+    expect(effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L2(`:${SV} 464 alice :Password mismatch`)]),
+      Effect.disconnect('c1', 'Bad Password'),
+    ]);
+  });
+
+  it('does not re-run PASS-auth when the connection already identified via SASL', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice'; // SASL-identified before registration completion
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+
+    expect(accounts.calls).toHaveLength(0);
+    expect(state.registration).toBe('registered');
+    // No 900/903 are re-emitted by PASS-auth; SASL already emitted them.
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
+  });
+
+  it('treats a bare PASS value (no colon) as a server-password candidate, never an account attempt', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 's3cret';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const effects = emitWelcomeIfReady(
+      state,
+      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+    );
+
+    expect(accounts.calls).toHaveLength(0);
+    expect(state.account).toBeUndefined();
+    expect(state.registration).toBe('registered');
+    expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
+  });
+});
+
+describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)', () => {
+  it('uses the payload nick (not state.nick) when PASS arrives before NICK', () => {
+    const state = makeState();
+    state.user = 'alice';
+    // state.nick intentionally undefined — PASS arrived before NICK.
+    state.passAttempt = 'alice:hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
+
+    expect(state.account).toBe('alice');
+    expect(effects.some((e) => e.tag === 'Send')).toBe(true);
+  });
+
+  it('returns no effects when no PASS was sent', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
+  });
+
+  it('returns no effects for a bare PASS value (no colon)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.passAttempt = 's3cret';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
+    expect(accounts.calls).toHaveLength(0);
+  });
+
+  it('returns no effects when the nick portion is empty (`:password`)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.passAttempt = ':hunter2';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
+    expect(accounts.calls).toHaveLength(0);
+  });
+
+  it('splits only on the first colon so a password may contain colons', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.passAttempt = 'alice:p:ass:word';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
+    expect(accounts.calls[0]?.payload).toEqual({
+      kind: 'PLAIN',
+      username: 'alice',
+      password: 'p:ass:word',
+    });
+  });
+
+  it('returns no effects when no AccountStore is bound', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.passAttempt = 'alice:hunter2';
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, {}))).toEqual([]);
+  });
+});
+
+describe('parsePassAccountAttempt', () => {
+  it('returns null when the attempt is undefined', () => {
+    expect(parsePassAccountAttempt(undefined)).toBeNull();
+  });
+
+  it('returns null when there is no colon', () => {
+    expect(parsePassAccountAttempt('s3cret')).toBeNull();
+  });
+
+  it('returns null when the nick portion is empty', () => {
+    expect(parsePassAccountAttempt(':hunter2')).toBeNull();
+  });
+
+  it('parses <nick>:<password> into its parts', () => {
+    expect(parsePassAccountAttempt('alice:hunter2')).toEqual({
+      nick: 'alice',
+      password: 'hunter2',
+    });
+  });
+
+  it('keeps colons in the password (splits on the first colon only)', () => {
+    expect(parsePassAccountAttempt('alice:p:w')).toEqual({
+      nick: 'alice',
+      password: 'p:w',
+    });
+  });
+});
+
+describe('applyAccountSuccess — shared account-login helper', () => {
+  it('broadcasts ACCOUNT to account-notify-capable peers in shared channels', () => {
+    const state = registeredState();
+    state.caps.add('account-notify');
+    state.joinedChannels.add('#foo');
+    const ctx = makeCtx(state);
+    const effects = applyAccountSuccess(state, ctx, 'alice');
+
+    const broadcasts = effects.filter((e) => e.tag === 'Broadcast');
+    expect(broadcasts).toHaveLength(1);
+    expect(state.account).toBe('alice');
+    expect(state.userModes.registered).toBe(true);
+  });
+
+  it('emits the 900 RPL_LOGGEDIN and 903 RPL_SASLSUCCESS numerics', () => {
+    const state = registeredState();
+    const ctx = makeCtx(state);
+    const effects = applyAccountSuccess(state, ctx, 'alice');
+    const texts = sentTexts(effects);
+    expect(texts).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
+  });
+});