serverless-ircd 0.7.0 → 0.9.0

package/packages/irc-core/src/commands/nickserv.ts

@@ -0,0 +1,402 @@
+/**
+ * Pure reducer for the NickServ services pseudo-client.
+ *
+ * NickServ is invoked via `PRIVMSG NickServ :<command>`. The actor routes
+ * any `PRIVMSG` whose target matches {@link NICKSERV_NICK}
+ * (case-insensitive) to {@link nickservReducer} instead of the normal
+ * user-target reducer.
+ *
+ * Supported subcommands:
+ *   - `REGISTER <password> <email>` — registers the current nick against
+ *     the bound {@link ServicesStore}. After registration, SASL PLAIN with
+ *     `<nick>:<password>` succeeds (the SASL reducer falls back to the
+ *     services store). Does NOT auto-identify.
+ *   - `IDENTIFY [nick] <password>` — verifies the credentials and, on
+ *     success, records the account on the connection, sets read-only user
+ *     mode `+r`, fans an `ACCOUNT` line out to `account-notify` peers, and
+ *     delivers queued MemoServ memos.
+ *   - `DROP [nick]` — removes the nick registration. Requires the caller
+ *     to be identified first; clears `+r` and the account, fans `ACCOUNT *`
+ *     out to peers.
+ *   - `INFO [nick]` — queries the registration record.
+ *   - `SET ENFORCE none|ghost|kill` — sets the per-account nick-enforcement
+ *     policy. Requires identification. The policy drives
+ *     {@link enforceRegisteredNick}, which the NICK path consults when a
+ *     client takes a registered nick they are not identified as.
+ *
+ * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
+ * emitted as {@link Effect}s. The services store is synchronous (mirrors
+ * the {@link AccountStore} / {@link MessageStore} pattern).
+ */
+
+import { DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
+import { Effect } from '../effects.js';
+import type { Effect as EffectType, RawLine } from '../effects.js';
+import type { NickEnforcePolicy, ServicesStore } from '../ports.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx, Reducer } from '../types.js';
+import { emitAccountNotify } from './account-notify.js';
+import { applyAssignedVhost } from './hostserv.js';
+import { deliverUnreadMemos } from './memoserv.js';
+
+/** Canonical NickServ pseudo-client nick. */
+export const NICKSERV_NICK = 'NickServ';
+
+/** Services hostmask fragment used by every services pseudo-client. */
+const SERVICES_HOST = 'services';
+
+/** Policies accepted by `SET ENFORCE` (lowercased input forms). */
+const ENFORCE_POLICIES: ReadonlySet<NickEnforcePolicy> = new Set(['none', 'ghost', 'kill']);
+
+/**
+ * Reducer for `PRIVMSG NickServ :<subcommand> <args…>`.
+ * Authority: the invoking connection's {@link ConnectionState}.
+ */
+export const nickservReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  const effects: EffectType[] = [];
+
+  if (ctx.services === undefined) {
+    effects.push(notice(state, 'Services are not available on this server.'));
+    return { state, effects };
+  }
+
+  const body = msg.params[1] ?? '';
+  const tokens = body.split(/\s+/u).filter((t) => t.length > 0);
+  if (tokens.length === 0) {
+    effects.push(helpNotice(state));
+    return { state, effects };
+  }
+
+  const sub = tokens[0]?.toUpperCase();
+  const args = tokens.slice(1);
+
+  switch (sub) {
+    case 'REGISTER':
+      return handleRegister(state, args, ctx, effects);
+    case 'ID':
+    case 'IDENTIFY':
+      return handleIdentify(state, args, ctx, effects);
+    case 'DROP':
+      return handleDrop(state, args, ctx, effects);
+    case 'INFO':
+      return handleInfo(state, args, ctx, effects);
+    case 'SET':
+      return handleSet(state, args, ctx, effects);
+    default:
+      effects.push(unknownNotice(state));
+      return { state, effects };
+  }
+};
+
+// ============================================================================
+// REGISTER
+// ============================================================================
+
+function handleRegister(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const password = args[0];
+  const email = args[1];
+  const nick = state.nick;
+  if (nick === undefined || password === undefined || email === undefined) {
+    effects.push(notice(state, 'Syntax: REGISTER <password> <email>'));
+    return { state, effects };
+  }
+
+  const services = ctx.services as ServicesStore;
+  const result = services.registerNick(nick, password, email);
+  if (result.ok) {
+    effects.push(notice(state, `Nickname ${nick} is now registered.`));
+  } else {
+    effects.push(notice(state, `Nickname ${nick} is already registered.`));
+  }
+  return { state, effects };
+}
+
+// ============================================================================
+// IDENTIFY
+// ============================================================================
+
+function handleIdentify(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as ServicesStore;
+
+  if (state.account !== undefined) {
+    effects.push(notice(state, 'You are already identified.'));
+    return { state, effects };
+  }
+
+  // IDENTIFY <password>   → identify current nick
+  // IDENTIFY <nick> <password> → identify named nick
+  let nick: string | undefined;
+  let password: string | undefined;
+  if (args.length >= 2) {
+    nick = args[0];
+    password = args[1];
+  } else {
+    nick = state.nick;
+    password = args[0];
+  }
+
+  if (nick === undefined || password === undefined) {
+    effects.push(notice(state, 'Syntax: IDENTIFY [nick] <password>'));
+    return { state, effects };
+  }
+
+  if (!services.isRegisteredNick(nick)) {
+    effects.push(notice(state, `Nick ${nick} is not registered.`));
+    return { state, effects };
+  }
+
+  const result = services.verifyNick(nick, password);
+  if (!result.ok) {
+    effects.push(notice(state, 'Invalid password.'));
+    return { state, effects };
+  }
+
+  applyIdentify(state, result.account, services, effects);
+  return { state, effects };
+}
+
+/**
+ * Applies a successful identify: records the account, sets `+r`, re-applies any
+ * assigned HostServ vhost (so a reconnecting user does not have to re-run
+ * `HostServ ON`), emits the confirmation NOTICE, fans `ACCOUNT` out to peers,
+ * and delivers queued memos.
+ */
+function applyIdentify(
+  state: ConnectionState,
+  account: string,
+  services: ServicesStore,
+  effects: EffectType[],
+): void {
+  state.account = account;
+  state.userModes.registered = true;
+  // Re-apply an assigned HostServ vhost. At identify time the connection is
+  // usually pre-JOIN so the CHGHOST fanout is empty, but a post-JOIN IDENTIFY
+  // fans CHGHOST out to the user's current `chghost`-capable peers.
+  applyAssignedVhost(state, services, account, effects);
+  effects.push(notice(state, `You are now identified for nick ${account}.`));
+  effects.push(...emitAccountNotify({ conn: state, account }));
+  deliverUnreadMemos(state, services, account, effects);
+}
+
+// ============================================================================
+// DROP
+// ============================================================================
+
+function handleDrop(
+  state: ConnectionState,
+  _args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as ServicesStore;
+
+  if (state.account === undefined) {
+    effects.push(notice(state, 'You must identify before dropping a nick.'));
+    return { state, effects };
+  }
+
+  const nick = state.nick;
+  if (nick === undefined) {
+    effects.push(notice(state, 'You must identify before dropping a nick.'));
+    return { state, effects };
+  }
+
+  services.dropNick(nick);
+  // Clear the identification state and announce the logout to peers.
+  // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+  delete state.account;
+  state.userModes.registered = false;
+  effects.push(notice(state, `Nickname ${nick} has been dropped.`));
+  effects.push(...emitAccountNotify({ conn: state }));
+  return { state, effects };
+}
+
+// ============================================================================
+// INFO
+// ============================================================================
+
+function handleInfo(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as ServicesStore;
+  const target = args[0] ?? state.nick;
+  if (target === undefined) {
+    effects.push(notice(state, 'Syntax: INFO [nick]'));
+    return { state, effects };
+  }
+
+  const rec = services.getNick(target);
+  if (rec === undefined) {
+    effects.push(notice(state, `Nick ${target} is not registered.`));
+    return { state, effects };
+  }
+
+  effects.push(notice(state, `Nick: ${rec.nick}`));
+  effects.push(notice(state, `Account: ${rec.account}`));
+  // Email is private: only the account owner or an oper may see it. Mirrors
+  // the `state.account === rec.account` gate used by SET ENFORCE / the
+  // enforcement hook, extended to opers.
+  if (state.account === rec.account || state.userModes.oper) {
+    effects.push(notice(state, `Email: ${rec.email}`));
+  }
+  return { state, effects };
+}
+
+// ============================================================================
+// Nick-enforcement hook (consulted by the NICK path)
+// ============================================================================
+
+/**
+ * Warning NOTICE text sent to every unidentified client using a registered
+ * nick, regardless of the account's enforcement policy.
+ */
+const ENFORCE_WARNING_TEXT =
+  'This nickname is registered and protected. If it is yours, IDENTIFY; otherwise choose another.';
+
+/** Canonical disconnect reason the actor applies on enforcement. */
+export const ENFORCE_NICK_REASON = 'Nick enforced by NickServ';
+
+/**
+ * Returns the effects to emit when a client has just taken `state.nick`:
+ * if the nick is registered and the connection is NOT identified as the
+ * owning account, the {@link NickEnforcePolicy} on the registration drives
+ * the output:
+ *
+ *   - `none`  — warning NOTICE only.
+ *   - `kill`  — warning NOTICE + `EnforceNick(kill, graceMs=0)`.
+ *   - `ghost` — warning NOTICE + `EnforceNick(ghost, graceMs=<config>)`.
+ *
+ * Returns `[]` when services are unbound, the connection has no nick, the
+ * nick is not registered, or the connection is identified as the nick's
+ * account owner. Called by the registration path on welcome-completion and
+ * by the post-registration `NICK` change.
+ */
+export function enforceRegisteredNick(state: ConnectionState, ctx: Ctx): EffectType[] {
+  const services = ctx.services;
+  if (services === undefined) return [];
+  const nick = state.nick;
+  if (nick === undefined) return [];
+
+  const rec = services.getNick(nick);
+  if (rec === undefined) return [];
+  // Identified as the owning account → the use is legitimate.
+  if (state.account !== undefined && state.account === rec.account) return [];
+
+  const effects: EffectType[] = [notice(state, ENFORCE_WARNING_TEXT)];
+
+  if (rec.enforce === 'none') return effects;
+
+  if (rec.enforce === 'kill') {
+    effects.push(Effect.enforceNick(state.id, nick, 'kill', 0));
+    return effects;
+  }
+
+  // ghost: stamp the configured grace so dispatch can schedule the
+  // disconnect. `0` (config-disabled grace) collapses to immediate.
+  const graceMs = ctx.serverConfig.nickEnforceGraceMs ?? DEFAULT_NICK_ENFORCE_GRACE_MS;
+  effects.push(Effect.enforceNick(state.id, nick, 'ghost', graceMs));
+  return effects;
+}
+
+// ============================================================================
+// SET
+// ============================================================================
+
+/**
+ * Handles `SET <subkey> <args…>`. Currently only `ENFORCE none|ghost|kill`
+ * is supported; unknown subkeys fall back to the ENFORCE syntax notice.
+ *
+ * Requires the caller to be identified as the account bound to the current
+ * nick: enforcement is a per-account policy, so an unidentified client
+ * (or one identified as a different account) cannot mutate it.
+ */
+function handleSet(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as ServicesStore;
+  const subkey = args[0]?.toUpperCase();
+  if (subkey !== 'ENFORCE') {
+    effects.push(enforceSyntaxNotice(state));
+    return { state, effects };
+  }
+
+  const policyRaw = args[1]?.toLowerCase();
+  if (policyRaw === undefined || !ENFORCE_POLICIES.has(policyRaw as NickEnforcePolicy)) {
+    effects.push(enforceSyntaxNotice(state));
+    return { state, effects };
+  }
+  const policy = policyRaw as NickEnforcePolicy;
+
+  const nick = state.nick;
+  if (nick === undefined || state.account === undefined) {
+    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    return { state, effects };
+  }
+
+  const rec = services.getNick(nick);
+  if (rec === undefined) {
+    effects.push(notice(state, `Nick ${nick} is not registered.`));
+    return { state, effects };
+  }
+  // The caller must be identified as the account that owns this nick.
+  if (state.account !== rec.account) {
+    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    return { state, effects };
+  }
+
+  services.setNickEnforce(nick, policy);
+  effects.push(notice(state, `Enforcement for nick ${nick} is now set to ${policy}.`));
+  return { state, effects };
+}
+
+/** Builds the `SET ENFORCE` syntax NOTICE. */
+function enforceSyntaxNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Syntax: SET ENFORCE none|ghost|kill');
+}
+
+// ============================================================================
+// Notice helpers
+// ============================================================================
+
+/** Builds a `:NickServ!NickServ@services NOTICE <nick> :<text>` line. */
+function notice(state: ConnectionState, text: string): EffectType {
+  return Effect.send(state.id, [servicesNotice(NICKSERV_NICK, state, text)]);
+}
+
+/** Builds a help/unknown `:NickServ!NickServ@services NOTICE <nick> :…` line. */
+function helpNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Available commands: REGISTER, IDENTIFY, DROP, INFO, SET');
+}
+
+function unknownNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET');
+}
+
+/**
+ * Formats a services NOTICE line. The source hostmask is
+ * `<svc>!<svc>@services` regardless of the deployment's serverName so the
+ * pseudo-clients are stable across deployments and easy to identify in
+ * client UIs.
+ */
+function servicesNotice(svc: string, state: ConnectionState, text: string): RawLine {
+  const nick = state.nick ?? '*';
+  return { text: `:${svc}!${svc}@${SERVICES_HOST} NOTICE ${nick} :${text}` };
+}

package/packages/irc-core/src/commands/oper.ts

@@ -27,15 +27,19 @@
  *   - Missing `<name>` or `<password>` → `461 ERR_NEEDMOREPARAMS`.
  *   - Already an operator → graceful idempotent no-op that re-confirms with
  *     `381` (no re-authentication required; the connection is already privy).
+ *     No `MODE` echo is emitted because the user mode did not change.
  *   - No operator credentials configured (absent or empty) →
  *     `491 ERR_NOOPERHOST`.
- *   - Matching credential pair → grant oper, emit `381`.
+ *   - Matching credential pair → grant oper, emit `381`, then emit a
+ *     `:<hostmask> MODE <nick> +o` notification to the connection so the
+ *     client learns its user mode changed (mirrors the user `MODE` echo).
  *   - Wrong password / unknown name → `464 ERR_PASSWDMISMATCH`.
  */
 
 import { Effect } from '../effects.js';
 import type { RawLine } from '../effects.js';
 import { Numerics } from '../protocol/numerics.js';
+import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { OperCred } from '../types.js';
 import type { Ctx, Reducer } from '../types.js';
@@ -122,6 +126,7 @@ export const operReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
         Effect.send(ctx.connId, [
           numericLine(ctx, Numerics.RPL_YOUREOPER, YOUREOPER_TRAILING_TEXT),
         ]),
+        Effect.send(ctx.connId, [modeEchoLine(state)]),
       ],
     };
   }
@@ -149,3 +154,15 @@ function numericLine(ctx: Ctx, code: number, trailing: string, middle?: string):
   parts.push(`:${trailing}`);
   return { text: parts.join(' ') };
 }
+
+/**
+ * Builds the `:<hostmask> MODE <nick> +o` echo emitted to the connection
+ * when oper is granted. Mirrors the user `MODE` echo format so clients can
+ * treat oper-up as a regular user-mode change. The hostmask falls back to
+ * the nick (then `?`) to match the rest of the codebase's source formatting.
+ */
+function modeEchoLine(state: ConnectionState): RawLine {
+  const nick = state.nick ?? '*';
+  const source = hostmaskOf(state) ?? state.nick ?? '?';
+  return { text: `:${source} MODE ${nick} +o` };
+}