serverless-ircd 0.7.0 → 0.8.0

package/packages/irc-core/tests/commands/topic.test.ts

@@ -2,7 +2,13 @@ import { describe, expect, it } from 'vitest';
 import { topicReducer } from '../../src/commands/topic';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
-import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import {
+  EmptyMotdProvider,
+  FakeClock,
+  InMemoryServicesStore,
+  SequentialIdFactory,
+  type ServicesStore,
+} from '../../src/ports';
 import { type ChannelState, createChannel } from '../../src/state/channel';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
@@ -19,13 +25,18 @@ const serverConfig: ServerConfig = {
   quitMessage: 'Client Quit',
 };
 
-function makeCtx(conn: ConnectionState, clock = new FakeClock(1_000)): Ctx {
+function makeCtx(
+  conn: ConnectionState,
+  clock = new FakeClock(1_000),
+  services?: ServicesStore,
+): Ctx {
   return buildCtx({
     serverConfig,
     clock,
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: conn,
+    ...(services !== undefined ? { services } : {}),
   });
 }
 
@@ -335,3 +346,84 @@ describe('topicReducer — rejections', () => {
     ]);
   });
 });
+
+// ============================================================================
+// topicReducer — ChanServ KEEPTOPIC persistence
+// ============================================================================
+
+describe('topicReducer — KEEPTOPIC persistence', () => {
+  it('persists a non-empty topic when KEEPTOPIC is on', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(2_000) });
+    services.registerNick('alice', 'pw', 'a@e');
+    services.registerChannel('#foo', 'alice');
+    services.setChannelKeepTopic('#foo', true);
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice', true);
+    const conn = makeConn();
+    const ctx = makeCtx(conn, new FakeClock(2_000), services);
+
+    topicReducer(chan, { command: 'TOPIC', params: ['#foo', 'remember me'], tags: {} }, ctx);
+
+    const stored = services.getChannelTopic('#foo');
+    expect(stored).toEqual({
+      text: 'remember me',
+      setter: 'alice!alice@example.com',
+      setAt: 2_000,
+    });
+  });
+
+  it('clears the persisted topic when the topic is cleared', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(2_000) });
+    services.registerNick('alice', 'pw', 'a@e');
+    services.registerChannel('#foo', 'alice');
+    services.setChannelKeepTopic('#foo', true);
+    services.setChannelTopic('#foo', { text: 'old', setter: 's', setAt: 0 });
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice', true);
+    const conn = makeConn();
+    const ctx = makeCtx(conn, new FakeClock(2_000), services);
+
+    topicReducer(chan, { command: 'TOPIC', params: ['#foo', ''], tags: {} }, ctx);
+
+    expect(services.getChannelTopic('#foo')).toBeUndefined();
+  });
+
+  it('does not persist when KEEPTOPIC is off', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(2_000) });
+    services.registerNick('alice', 'pw', 'a@e');
+    services.registerChannel('#foo', 'alice');
+    // keepTopic is false by default.
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice', true);
+    const conn = makeConn();
+    const ctx = makeCtx(conn, new FakeClock(2_000), services);
+
+    topicReducer(chan, { command: 'TOPIC', params: ['#foo', 'forget me'], tags: {} }, ctx);
+
+    expect(services.getChannelTopic('#foo')).toBeUndefined();
+  });
+
+  it('does not persist when no services store is bound', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice', true);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    // Should not throw — services is undefined.
+    const out = topicReducer(chan, { command: 'TOPIC', params: ['#foo', 'x'], tags: {} }, ctx);
+
+    expect(out.state.topic?.text).toBe('x');
+  });
+
+  it('does not persist when the channel is not registered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(2_000) });
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice', true);
+    const conn = makeConn();
+    const ctx = makeCtx(conn, new FakeClock(2_000), services);
+
+    topicReducer(chan, { command: 'TOPIC', params: ['#foo', 'x'], tags: {} }, ctx);
+
+    expect(services.getChannelTopic('#foo')).toBeUndefined();
+  });
+});

package/packages/irc-core/tests/commands/unified-account.test.ts

@@ -0,0 +1,416 @@
+/**
+ * Unified account behaviour: a NickServ registration IS a SASL account,
+ * and a SASL-created account IS a registered nick.
+ *
+ * Covers the cross-cutting acceptance contract for the unified account
+ * store:
+ *   - `PRIVMSG NickServ :REGISTER <pw> <email>` creates a record that
+ *     `AUTHENTICATE PLAIN <nick>:<pw>` authenticates against immediately.
+ *   - A SASL-created account is treated as a registered nick for NickServ
+ *     purposes (`INFO` resolves it; `SET ENFORCE` applies).
+ *   - NickServ `IDENTIFY` and SASL success run the same downstream effects
+ *     via the shared `applyAccountSuccess`.
+ *   - Credentials live in one scrypt-hashed store; no plaintext password
+ *     is persisted on a registered nick.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { applyAccountSuccess } from '../../src/commands/account-auth';
+import { NICKSERV_NICK, nickservReducer } from '../../src/commands/nickserv';
+import { authenticateReducer } from '../../src/commands/sasl';
+import { type HashedAccountCredential, hashAccountCredential } from '../../src/credential-hashing';
+import type { Effect as EffectType } from '../../src/effects';
+import type { AccountStore } from '../../src/ports';
+import {
+  EmptyMotdProvider,
+  FakeClock,
+  InMemoryServicesStore,
+  type NickEnforcePolicy,
+  SequentialIdFactory,
+  type ServicesSnapshot,
+} from '../../src/ports';
+import { encodeBase64 } from '../../src/protocol/base64';
+import type { IrcMessage } from '../../src/protocol/messages';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const NOW = 1_700_000_000_000;
+const SV = 'irc.example.com';
+
+const serverConfig: ServerConfig = {
+  serverName: SV,
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeConn(id = 'c1', nick = 'alice'): ConnectionState {
+  const s = createConnection({ id, connectedSince: 0 });
+  s.nick = nick;
+  s.user = nick;
+  s.host = 'example.com';
+  s.realname = nick;
+  s.registration = 'registered';
+  return s;
+}
+
+function saslReadyState(nick = 'alice'): ConnectionState {
+  const s = createConnection({ id: 'c1', connectedSince: 0 });
+  s.nick = nick;
+  s.user = nick;
+  s.host = 'example.com';
+  s.realname = nick;
+  s.registration = 'registering';
+  s.capNegotiating = true;
+  s.caps.add('sasl');
+  return s;
+}
+
+function makeCtx(
+  state: ConnectionState,
+  accounts?: AccountStore,
+  services?: InMemoryServicesStore,
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock: new FakeClock(NOW),
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    ...(accounts !== undefined ? { accounts } : {}),
+    ...(services !== undefined ? { services } : {}),
+  });
+}
+
+function privmsg(body: string): IrcMessage {
+  return { command: 'PRIVMSG', params: [NICKSERV_NICK, body], tags: {} };
+}
+
+function authenticate(param: string): IrcMessage {
+  return { command: 'AUTHENTICATE', params: [param], tags: {} };
+}
+
+function plainPayload(authcid: string, password: string): string {
+  return encodeBase64(`\0${authcid}\0${password}`);
+}
+
+function sentTexts(effects: EffectType[]): string[] {
+  return effects.flatMap((e) => (e.tag === 'Send' ? e.lines : [])).map((l) => l.text);
+}
+
+/** Snapshot with empty sections (helper for legacy-row fixtures). */
+function emptySnapshot(): ServicesSnapshot {
+  return {
+    nicks: [],
+    channels: [],
+    access: [],
+    levels: [],
+    vhosts: [],
+    pendingVhosts: [],
+    memos: [],
+    readMarkers: [],
+    akills: [],
+    jupes: [],
+  };
+}
+
+// ============================================================================
+// AC: NickServ REGISTER → SASL PLAIN succeeds with the same password
+// ============================================================================
+
+describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
+  it('a freshly NickServ-registered nick authenticates via SASL PLAIN with no second registration', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    const regCtx = makeCtx(registrar, undefined, services);
+    nickservReducer(registrar, privmsg('REGISTER hunter2 alice@example.com'), regCtx);
+
+    // A second connection speaking SASL PLAIN with the same nick:password.
+    const saslConn = saslReadyState('alice');
+    const saslCtx = makeCtx(saslConn, undefined, services);
+    authenticateReducer(saslConn, authenticate('PLAIN'), saslCtx);
+    const out = authenticateReducer(
+      saslConn,
+      authenticate(plainPayload('alice', 'hunter2')),
+      saslCtx,
+    );
+
+    expect(saslConn.account).toBe('alice');
+    expect(saslConn.userModes.registered).toBe(true);
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
+  });
+
+  it('SASL PLAIN with the wrong password fails after NickServ REGISTER', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, undefined, services),
+    );
+
+    const saslConn = saslReadyState('alice');
+    const saslCtx = makeCtx(saslConn, undefined, services);
+    authenticateReducer(saslConn, authenticate('PLAIN'), saslCtx);
+    const out = authenticateReducer(
+      saslConn,
+      authenticate(plainPayload('alice', 'wrong')),
+      saslCtx,
+    );
+
+    expect(saslConn.account).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(`:${SV} 904 alice :SASL authentication failed`);
+  });
+});
+
+// ============================================================================
+// AC: SASL-created account → treated as a registered nick by NickServ
+// ============================================================================
+
+describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', () => {
+  it('NickServ INFO resolves an account seeded into the unified store', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+
+    const conn = makeConn('c1', 'bob');
+    const out = nickservReducer(conn, privmsg('INFO alice'), makeCtx(conn, undefined, services));
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE bob :Nick: alice');
+    expect(texts).toContain(':NickServ!NickServ@services NOTICE bob :Account: alice');
+  });
+
+  it('NickServ isRegisteredNick resolves a seeded SASL account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    expect(services.isRegisteredNick('ALICE')).toBe(true);
+  });
+
+  it('NickServ SET ENFORCE applies to a seeded SASL account once identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    const conn = makeConn('c1', 'alice');
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const out = nickservReducer(
+      conn,
+      privmsg('SET ENFORCE kill'),
+      makeCtx(conn, undefined, services),
+    );
+
+    expect(services.getNickEnforce('alice')).toBe<NickEnforcePolicy>('kill');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Enforcement for nick alice is now set to kill.',
+    );
+  });
+
+  it('NickServ IDENTIFY succeeds against a seeded SASL account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    const conn = makeConn('c1', 'alice');
+    const out = nickservReducer(
+      conn,
+      privmsg('IDENTIFY hunter2'),
+      makeCtx(conn, undefined, services),
+    );
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You are now identified for nick alice.',
+    );
+  });
+
+  it('NickServ IDENTIFY with the wrong password fails against a seeded SASL account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    const conn = makeConn('c1', 'alice');
+    const out = nickservReducer(conn, privmsg('IDENTIFY nope'), makeCtx(conn, undefined, services));
+
+    expect(conn.account).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+  });
+
+  it('a NickServ REGISTER does not overwrite an ingested SASL credential', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    const conn = makeConn('c1', 'alice');
+    const out = nickservReducer(
+      conn,
+      privmsg('REGISTER otherpw alice@example.com'),
+      makeCtx(conn, undefined, services),
+    );
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice is already registered.',
+    );
+    // The original credential still verifies.
+    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
+    expect(services.verifyNick('alice', 'otherpw').ok).toBe(false);
+  });
+
+  it('ingestAccountCredential returns false when the nick is already registered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(services.ingestAccountCredential(hashAccountCredential('alice', 'otherpw'))).toBe(false);
+    // The original credential still verifies.
+    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
+  });
+});
+
+// ============================================================================
+// AC: IDENTIFY and SASL success run the same downstream effects
+// ============================================================================
+
+describe('T156 unified account: IDENTIFY vs SASL downstream parity', () => {
+  it('IDENTIFY delivers queued memos (parity with SASL success)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'hello', sentAt: NOW });
+
+    const conn = makeConn('c1', 'alice');
+    const out = nickservReducer(
+      conn,
+      privmsg('IDENTIFY hunter2'),
+      makeCtx(conn, undefined, services),
+    );
+
+    expect(sentTexts(out.effects)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] hello',
+    );
+  });
+
+  it('both paths share applyAccountSuccess for +r stamping', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    const conn = makeConn('c1', 'alice');
+    const ctx = makeCtx(conn, undefined, services);
+
+    const effects = applyAccountSuccess(conn, ctx, 'alice');
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    // The shared helper emits 900 + 903.
+    expect(sentTexts(effects)).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(sentTexts(effects)).toContain(`:${SV} 903 alice :SASL authentication successful`);
+  });
+});
+
+// ============================================================================
+// AC: Credentials live in one scrypt-hashed store (no plaintext)
+// ============================================================================
+
+describe('T156 unified account: scrypt-hashed credentials at rest', () => {
+  it('registerNick stores a scrypt hash, never the plaintext password', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+
+    const snap = services.snapshot();
+    expect(snap.nicks).toHaveLength(1);
+    const row = snap.nicks[0];
+    if (row === undefined) throw new Error('expected one nick row');
+    // The persisted credential must be a HashedAccountCredential.
+    expect(row.credential.algorithm).toBe('scrypt');
+    expect(row.credential.salt).not.toBe('');
+    expect(row.credential.hash).not.toBe('');
+    // Plaintext must not be present anywhere on the row.
+    expect(JSON.stringify(row)).not.toContain('hunter2');
+  });
+
+  it('verifyNick validates the correct password and rejects a wrong one', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
+    expect(services.verifyNick('alice', 'wrong').ok).toBe(false);
+  });
+
+  it('the snapshot does not carry a plaintext password field', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const row = services.snapshot().nicks[0];
+    if (row === undefined) throw new Error('expected one nick row');
+    expect((row as unknown as Record<string, unknown>).password).toBeUndefined();
+  });
+
+  it('a legacy plaintext-only row does not authenticate (no silent fallback)', () => {
+    const legacySnapshot: ServicesSnapshot = {
+      ...emptySnapshot(),
+      nicks: [
+        {
+          nick: 'legacy',
+          account: 'legacy',
+          email: 'l@x',
+          createdAt: NOW,
+          enforce: 'none',
+          // Malformed credential — empty hash, rejected by verifyHashedPassword.
+          credential: { account: 'legacy', algorithm: 'scrypt', salt: 's', hash: '' },
+        },
+      ],
+    };
+    const services = new InMemoryServicesStore({
+      clock: new FakeClock(NOW),
+      snapshot: legacySnapshot,
+    });
+    expect(services.verifyNick('legacy', 'plaintext').ok).toBe(false);
+  });
+
+  it('round-trips a hashed credential across a snapshot reload', () => {
+    const original = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    original.registerNick('alice', 'hunter2', 'alice@example.com');
+    const snap = original.snapshot();
+    const reloaded = new InMemoryServicesStore({ clock: new FakeClock(NOW), snapshot: snap });
+    expect(reloaded.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded.verifyNick('alice', 'wrong').ok).toBe(false);
+    // The plaintext never appears in the persisted row.
+    expect(JSON.stringify(snap.nicks[0])).not.toContain('hunter2');
+  });
+});
+
+// ============================================================================
+// Adapter ingestion contract: ingestAccountCredential accepts HashedAccountCredential
+// ============================================================================
+
+describe('T156 unified account: ingestAccountCredential', () => {
+  it('creates a registered nick with default email / enforce from a hashed credential', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const cred = hashAccountCredential('alice', 'hunter2');
+    expect(services.ingestAccountCredential(cred)).toBe(true);
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    const rec = services.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec !== undefined) {
+      expect(rec.account).toBe('alice');
+      expect(rec.enforce).toBe<NickEnforcePolicy>('none');
+    }
+    // verifyNick goes through the same scrypt path as registerNick.
+    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
+  });
+
+  it('preserves the original spelling of the account name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const cred: HashedAccountCredential = {
+      account: 'Alice',
+      algorithm: 'scrypt',
+      salt: 's',
+      hash: 'aGVsbG8=',
+    };
+    services.ingestAccountCredential(cred);
+    const rec = services.getNick('Alice');
+    expect(rec?.nick).toBe('Alice');
+    expect(rec?.account).toBe('Alice');
+  });
+});

package/packages/irc-core/tests/config.test.ts

@@ -1,13 +1,18 @@
 import { describe, expect, it } from 'vitest';
+import pkg from '../package.json' with { type: 'json' };
 import {
   DEFAULT_CREATED_TEXT,
-  DEFAULT_SERVER_VERSION,
   ServerConfigSchema,
   formatCreatedAt,
   parseServerConfig,
   resolveServerVersion,
 } from '../src/config';
 
+// The schema default must track the irc-core package version so a deployment
+// that omits `serverVersion` advertises the version it was shipped with, not
+// a stale hardcoded placeholder.
+const PACKAGE_VERSION = pkg.version as string;
+
 // ============================================================================
 // ServerConfigSchema — valid inputs
 // ============================================================================
@@ -230,9 +235,9 @@ describe('ServerConfigSchema — serverVersion', () => {
     expect(cfg.serverVersion).toBe('9.9.9');
   });
 
-  it('defaults to DEFAULT_SERVER_VERSION when omitted', () => {
+  it('defaults to the irc-core package version when omitted', () => {
     const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
-    expect(cfg.serverVersion).toBe(DEFAULT_SERVER_VERSION);
+    expect(cfg.serverVersion).toBe(PACKAGE_VERSION);
   });
 
   it('rejects an empty version string', () => {
@@ -289,8 +294,8 @@ describe('resolveServerVersion', () => {
   it('returns the configured value when present', () => {
     expect(resolveServerVersion({ serverVersion: '1.2.3' })).toBe('1.2.3');
   });
-  it('falls back to DEFAULT_SERVER_VERSION when undefined', () => {
-    expect(resolveServerVersion({})).toBe(DEFAULT_SERVER_VERSION);
+  it('falls back to the irc-core package version when undefined', () => {
+    expect(resolveServerVersion({})).toBe(PACKAGE_VERSION);
   });
 });
 
@@ -903,3 +908,42 @@ describe('ServerConfigSchema — sts', () => {
     ).toThrowError(/sts/u);
   });
 });
+
+// ============================================================================
+// ServerConfigSchema — hostservAutoApproveVhosts
+// ============================================================================
+
+describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
+  it('defaults to false when omitted (queue mode is the default)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.hostservAutoApproveVhosts).toBe(false);
+  });
+
+  it('accepts an explicit true (auto-approve mode)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      hostservAutoApproveVhosts: true,
+    });
+    expect(cfg.hostservAutoApproveVhosts).toBe(true);
+  });
+
+  it('accepts an explicit false (queue mode)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      hostservAutoApproveVhosts: false,
+    });
+    expect(cfg.hostservAutoApproveVhosts).toBe(false);
+  });
+
+  it('rejects a non-boolean value', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveVhosts: 'yes',
+      }),
+    ).toThrowError(/hostservAutoApproveVhosts/u);
+  });
+});

package/packages/irc-core/tests/effects.test.ts

@@ -94,6 +94,23 @@ describe('Effect constructors', () => {
       except: 'c1',
     });
   });
+
+  it('EnforceNick carries conn, nick, policy, and graceMs', () => {
+    expect(Effect.enforceNick('c1', 'alice', 'kill', 0)).toEqual<EffectType>({
+      tag: 'EnforceNick',
+      conn: 'c1',
+      nick: 'alice',
+      policy: 'kill',
+      graceMs: 0,
+    });
+    expect(Effect.enforceNick('c1', 'alice', 'ghost', 30_000)).toEqual<EffectType>({
+      tag: 'EnforceNick',
+      conn: 'c1',
+      nick: 'alice',
+      policy: 'ghost',
+      graceMs: 30_000,
+    });
+  });
 });
 
 describe('Effect tag set', () => {
@@ -108,6 +125,7 @@ describe('Effect tag set', () => {
     'ApplyChannelDelta',
     'SendToNick',
     'BroadcastWallops',
+    'EnforceNick',
   ];
 
   it.each(expectedTags)('exposes a constructor for the %s tag', (tag) => {
@@ -121,6 +139,7 @@ describe('Effect tag set', () => {
       ApplyChannelDelta: Effect.applyChannelDelta('#c', { memberships: [] }),
       SendToNick: Effect.sendToNick('n', 'c', []),
       BroadcastWallops: Effect.broadcastWallops([]),
+      EnforceNick: Effect.enforceNick('c', 'n', 'none', 0),
     };
     expect(constructors[tag].tag).toBe(tag);
   });