serverless-ircd 0.8.0 → 0.10.0

package/packages/aws-adapter/tests/connect.test.ts

@@ -17,7 +17,6 @@ const TABLES: TablesConfig = {
   ChannelMeta: 'ChannelMeta',
   ChannelMembers: 'ChannelMembers',
   Nicks: 'Nicks',
-  Accounts: 'Accounts',
 };
 
 interface Stub {
@@ -298,3 +297,127 @@ describe('handleConnect — IRCv3 WebSocket subprotocol negotiation', () => {
     expect(stub.puts).toBe(0);
   });
 });
+
+describe('handleConnect — Origin allowlist (CSWSH defence)', () => {
+  // The same lowercase / trim / comma-split semantics as the CF Worker's
+  // policy (`apps/cf-worker/src/origin-allowlist.ts`); the parsed set is
+  // built once per cold start and injected via `ConnectParams.webOrigins`.
+  const allowlist = new Set(['https://app.example.com']);
+
+  it('denies a disallowed Origin with 403 before touching the counter', async () => {
+    // A denied upgrade must NOT consume an admission slot — the Origin
+    // check runs before the counter increment so a CSWSH flood from a
+    // hostile origin cannot exhaust the `maxClients` cap.
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-cswsh',
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: 'https://attacker.example.com',
+      webOrigins: allowlist,
+    });
+    expect(outcome).toEqual({
+      admitted: false,
+      statusCode: 403,
+      reason: expect.stringMatching(/origin/iu),
+    });
+    expect(stub.puts).toBe(0);
+    expect(stub.increments).toBe(0);
+    expect(stub.decrements).toBe(0);
+  });
+
+  it('admits an allowed Origin (existing connect path)', async () => {
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-ok',
+      now: 42,
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: 'https://app.example.com',
+      webOrigins: allowlist,
+    });
+    expect(outcome).toEqual({ admitted: true, subprotocol: null });
+    expect(stub.puts).toBe(1);
+  });
+
+  it('case-insensitively matches a mixed-case allowed Origin', async () => {
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-case',
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: 'https://APP.Example.COM',
+      webOrigins: allowlist,
+    });
+    expect(outcome.admitted).toBe(true);
+  });
+
+  it('admits a missing Origin (non-browser client: curl, WeeChat, tcp-ws-forwarder)', async () => {
+    // The defence only fires when `Origin` is present; non-browser
+    // tooling never sends it and must pass through unchanged.
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-cli',
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: null,
+      webOrigins: allowlist,
+    });
+    expect(outcome.admitted).toBe(true);
+    expect(stub.puts).toBe(1);
+  });
+
+  it('admits a missing Origin when the header key is absent from the event', async () => {
+    // APIGW may omit the header entirely on some non-browser flows;
+    // `undefined` is treated the same as `null`.
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-noheader',
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: undefined,
+      webOrigins: allowlist,
+    });
+    expect(outcome.admitted).toBe(true);
+  });
+
+  it('skips the check when WEB_ORIGINS is unset (defence is opt-in)', async () => {
+    // An empty allowlist means the deployment has not opted in; every
+    // Origin (including an obviously hostile one) must proceed so
+    // existing AWS deployments without a web frontend are unchanged
+    // on upgrade.
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-unset',
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: 'https://attacker.example.com',
+      webOrigins: new Set(),
+    });
+    expect(outcome.admitted).toBe(true);
+    expect(stub.puts).toBe(1);
+  });
+
+  it('denies an Origin that matches a listed origin except for the scheme', async () => {
+    // Origins are case-sensitive on scheme+host+port; an `http://`
+    // form MUST NOT be admitted against an `https://`-only allowlist
+    // (defends against a stripped-TLS attacker on the same hostname).
+    const stub = makeStub(0);
+    const outcome = await handleConnect({
+      dynamo: stub.dynamo,
+      tables: TABLES,
+      connectionId: 'c-scheme',
+      serverConfig: makeTestServerConfig({ maxClients: 5 }),
+      originHeader: 'http://app.example.com',
+      webOrigins: allowlist,
+    });
+    expect(outcome.admitted).toBe(false);
+    expect(outcome.admitted === false && outcome.statusCode).toBe(403);
+  });
+});

package/packages/aws-adapter/tests/connection-counter.test.ts

@@ -95,6 +95,23 @@ describe('incrementConnectionCount', () => {
     expect(stub.count).toBe(1);
     expect(CONNECTION_COUNT_META_ID).toContain('__meta:');
   });
+
+  it('returns 0 when the response carries no numeric count (defensive)', async () => {
+    // A malformed/empty response must not crash the connect path; the
+    // handler treats a missing count as a 0 reservation so admission still
+    // proceeds conservatively rather than throwing.
+    const dynamo = {
+      send: async () => ({ Attributes: { count: 'not-a-number' } }),
+    } as unknown as DynamoDBDocumentClient;
+    await expect(incrementConnectionCount(dynamo, 'Connections')).resolves.toBe(0);
+  });
+
+  it('returns 0 when the response carries no Attributes at all', async () => {
+    const dynamo = {
+      send: async () => ({}),
+    } as unknown as DynamoDBDocumentClient;
+    await expect(incrementConnectionCount(dynamo, 'Connections')).resolves.toBe(0);
+  });
 });
 
 describe('decrementConnectionCount', () => {

package/packages/aws-adapter/tests/default-occ.test.ts

@@ -0,0 +1,219 @@
+/**
+ * Tests for the optimistic-concurrency state persist in `$default`
+ * (`handleDefault` + `buildPersistUpdate` + `isConditionalCheckFailed`).
+ *
+ * Background: API Gateway dispatches a client's rapid frames (CAP END,
+ * NICK, USER) as CONCURRENT Lambda invocations that each
+ * read-modify-write the same Connections row. Without a revision guard,
+ * the last writer wins and clobbers the others — the registration
+ * deadlock where `CAP END`'s `capNegotiating=false` was overwritten by
+ * `NICK`/`USER`'s stale read, so `001 RPL_WELCOME` never fired.
+ *
+ * The fix: every persist is a conditional `UpdateItem` requiring
+ * `revision = :expected` (bumped atomically); a
+ * `ConditionalCheckFailedException` triggers a re-read + re-run retry
+ * loop in `handleDefault`.
+ */
+
+import { GetCommand, UpdateCommand } from '@aws-sdk/lib-dynamodb';
+import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+import {
+  type ParsedServerConfig,
+  StaticMotdProvider,
+  createConnection,
+} from '@serverless-ircd/irc-core';
+import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
+import { describe, expect, it } from 'vitest';
+import {
+  buildPersistUpdate,
+  handleDefault,
+  isConditionalCheckFailed,
+} from '../src/handlers/default.js';
+import { marshalConnection } from '../src/serialize.js';
+import type { TablesConfig } from '../src/tables.js';
+
+const SERVER_CONFIG: ParsedServerConfig = makeTestServerConfig({
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  motdLines: ['Welcome'],
+});
+const MOTD = new StaticMotdProvider(SERVER_CONFIG.motdLines);
+const TABLES: TablesConfig = {
+  Connections: 'Connections',
+  ChannelMeta: 'ChannelMeta',
+  ChannelMembers: 'ChannelMembers',
+  Nicks: 'Nicks',
+  Services: 'Services',
+};
+
+describe('buildPersistUpdate — optimistic-concurrency revision guard', () => {
+  it('adds an ADD #rev :revInc clause to the update expression', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7);
+    expect(expr.updateExpression).toContain('ADD #rev :revInc');
+  });
+
+  it('gates the write on attribute_not_exists(#rev) OR #rev = :expectedRev', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7);
+    expect(expr.conditionExpression).toBe('attribute_not_exists(#rev) OR #rev = :expectedRev');
+  });
+
+  it('binds #rev to the revision column and :expectedRev to the read revision', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7);
+    expect(expr.expressionAttributeNames['#rev']).toBe('revision');
+    expect(expr.expressionAttributeValues[':expectedRev']).toBe(7);
+    expect(expr.expressionAttributeValues[':revInc']).toBe(1);
+  });
+});
+
+describe('isConditionalCheckFailed', () => {
+  it('returns true for a DynamoDB ConditionalCheckFailedException', () => {
+    const err = new Error('The conditional request failed');
+    err.name = 'ConditionalCheckFailedException';
+    expect(isConditionalCheckFailed(err)).toBe(true);
+  });
+
+  it('returns false for an unrelated error name', () => {
+    const err = new Error('boom');
+    err.name = 'ProvisionedThroughputExceededException';
+    expect(isConditionalCheckFailed(err)).toBe(false);
+  });
+
+  it('returns false for non-object throws', () => {
+    expect(isConditionalCheckFailed(null)).toBe(false);
+    expect(isConditionalCheckFailed(undefined)).toBe(false);
+    expect(isConditionalCheckFailed('string throw')).toBe(false);
+  });
+});
+
+/**
+ * Minimal fake document client. It does NOT implement DynamoDB's
+ * expression semantics — it only:
+ *   - returns the seeded row on GetCommand;
+ *   - simulates a concurrent writer on UpdateCommand by failing the first
+ *     `failNextUpdates` writes with ConditionalCheckFailedException (and
+ *     bumping the row's revision so a re-read sees it), then succeeding.
+ * This is enough to exercise `handleDefault`'s retry loop.
+ */
+class FakeDynamo {
+  readonly items = new Map<string, Record<string, unknown>>();
+  failNextUpdates = 0;
+  updateCalls = 0;
+  getCalls = 0;
+
+  async send(cmd: unknown): Promise<{ Item?: Record<string, unknown> } | Record<string, never>> {
+    if (cmd instanceof GetCommand) {
+      this.getCalls += 1;
+      const input = (cmd as unknown as { input: { Key: { connectionId: string } } }).input;
+      const item = this.items.get(input.Key.connectionId);
+      return item === undefined ? {} : { Item: { ...item } };
+    }
+    if (cmd instanceof UpdateCommand) {
+      this.updateCalls += 1;
+      const input = (
+        cmd as unknown as {
+          input: {
+            Key: { connectionId: string };
+            ExpressionAttributeValues?: Record<string, unknown>;
+          };
+        }
+      ).input;
+      const key = input.Key.connectionId;
+      if (this.failNextUpdates > 0) {
+        this.failNextUpdates -= 1;
+        // Simulate a concurrent writer landing first: bump the row's
+        // revision so the next read sees the conflict.
+        const cur = this.items.get(key);
+        if (cur !== undefined) {
+          cur.revision = ((cur.revision as number | undefined) ?? 0) + 1;
+        }
+        const err = new Error('The conditional request failed');
+        err.name = 'ConditionalCheckFailedException';
+        throw err;
+      }
+      // Success: bump revision (ADD #rev :revInc) and apply the simple
+      // SETs the assertions care about.
+      const cur = this.items.get(key);
+      if (cur !== undefined) {
+        cur.revision = ((cur.revision as number | undefined) ?? 0) + 1;
+        const vals = input.ExpressionAttributeValues ?? {};
+        if (vals[':capN'] !== undefined) cur.capNegotiating = vals[':capN'];
+      }
+      return {};
+    }
+    return {};
+  }
+}
+
+describe('handleDefault — optimistic-concurrency retry loop', () => {
+  it('retries read→run→persist when concurrent writes race, then returns 200', async () => {
+    const connId = 'c1';
+    const state = createConnection({ id: connId, connectedSince: 1000 });
+    // Mid-CAP-negotiation so CAP END is a meaningful, peer-free frame.
+    state.capNegotiating = true;
+    const dynamo = new FakeDynamo();
+    dynamo.items.set(connId, { ...marshalConnection(state, 1000) });
+    // Two concurrent invocations write first (conditional-check failures).
+    dynamo.failNextUpdates = 2;
+
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: connId,
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+
+    expect(result.statusCode).toBe(200);
+    // 2 failed writes + 1 committed write, and a re-read per attempt.
+    expect(dynamo.updateCalls).toBe(3);
+    expect(dynamo.getCalls).toBe(3);
+    // Final committed state reflects this invocation's mutation and the
+    // revision bumps (2 concurrent + 1 own = 3).
+    const finalRow = dynamo.items.get(connId);
+    expect(finalRow?.capNegotiating).toBe(false);
+    expect(finalRow?.revision).toBe(3);
+  });
+
+  it('commits on the first try when there is no contention', async () => {
+    const connId = 'c2';
+    const state = createConnection({ id: connId, connectedSince: 1000 });
+    state.capNegotiating = true;
+    const dynamo = new FakeDynamo();
+    dynamo.items.set(connId, { ...marshalConnection(state, 1000) });
+
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: connId,
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+
+    expect(result.statusCode).toBe(200);
+    expect(dynamo.updateCalls).toBe(1);
+    expect(dynamo.getCalls).toBe(1);
+    expect(dynamo.items.get(connId)?.capNegotiating).toBe(false);
+  });
+
+  it('returns 410 when the connection row is missing (not retried)', async () => {
+    const dynamo = new FakeDynamo();
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: 'ghost',
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+    expect(result.statusCode).toBe(410);
+    expect(dynamo.updateCalls).toBe(0);
+  });
+});

package/packages/aws-adapter/tests/dynamo-services-store-unit.test.ts

@@ -163,6 +163,17 @@ describe('DynamoServicesStore — round-trip via fake DDB', () => {
     expect(reloaded.getNickEnforce('alice')).toBe('kill');
   });
 
+  it('persists SET PASSWORD and round-trips the new credential', async () => {
+    const { store, client } = await fresh();
+    store.registerNick('alice', 'hunter2', 'a@x');
+    store.setNickPassword('alice', 'newpassword');
+    await store.flush();
+
+    const reloaded = await reload(client);
+    expect(reloaded.verifyNick('alice', 'newpassword')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const { store, client } = await fresh();
     store.registerNick('alice', 'pw', 'a@x');

package/packages/aws-adapter/tests/global-setup.ts

@@ -71,7 +71,11 @@ export default async function globalSetup(): Promise<(() => Promise<void>) | und
   const wantZip = strategy === 'auto' || strategy === 'zip';
 
   // Strategy 1: testcontainers (Docker).
-  if (wantDocker) {
+  // Pre-probe the Docker daemon: `docker info` hangs indefinitely on macOS
+  // when Docker Desktop is installed but not running (the CLI waits for
+  // the daemon to spin up). Bound that wait so we fall through to the
+  // ZIP strategy instead of stalling the whole test run.
+  if (wantDocker && (await dockerDaemonReachable())) {
     try {
       const handle = await tryTestcontainers();
       if (handle !== null) {
@@ -85,6 +89,10 @@ export default async function globalSetup(): Promise<(() => Promise<void>) | und
     } catch (err: unknown) {
       console.warn('[aws-adapter global-setup] testcontainers unavailable:', renderErr(err));
     }
+  } else if (wantDocker) {
+    console.warn(
+      '[aws-adapter global-setup] Docker daemon not reachable within probe window; skipping testcontainers.',
+    );
   }
 
   // Strategy 2: local ZIP + Java.
@@ -119,6 +127,25 @@ export default async function globalSetup(): Promise<(() => Promise<void>) | und
 // Strategy 1: testcontainers
 // ---------------------------------------------------------------------------
 
+/**
+ * Bounds the `docker info` probe. The Docker CLI on macOS waits silently for
+ * the daemon to start when Docker Desktop is installed but stopped, which
+ * would otherwise hang the entire global setup. Treat anything that doesn't
+ * return within `DOCKER_PROBE_MS` as "unavailable" and fall through to the
+ * ZIP strategy.
+ */
+const DOCKER_PROBE_MS = 5_000;
+
+async function dockerDaemonReachable(): Promise<boolean> {
+  if (which('docker') === null) return false;
+  try {
+    await execAsync('docker info', { timeout: DOCKER_PROBE_MS });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function tryTestcontainers(): Promise<DdbHandle | null> {
   let mod: typeof import('testcontainers') | undefined;
   try {

package/packages/aws-adapter/tests/gone-exception.test.ts

@@ -10,10 +10,10 @@
 
 import { GoneException } from '@aws-sdk/client-apigatewaymanagementapi';
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
-import { PutCommand } from '@aws-sdk/lib-dynamodb';
+import { GetCommand, PutCommand } from '@aws-sdk/lib-dynamodb';
 import { type Nick, type ParsedServerConfig, createConnection } from '@serverless-ircd/irc-core';
 import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime, type PostToConnection, cleanupConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
 import { createDynamoDocumentClient } from '../src/dynamo.js';
@@ -219,6 +219,25 @@ describe.skipIf(!available)('GoneException cleanup', () => {
     ).resolves.toBeUndefined();
   });
 
+  it('cleanupConnection reads the Connections row strongly consistently', async () => {
+    // $disconnect runs cleanupConnection immediately after the connection's
+    // own row was last written/updated. An eventually-consistent Get can miss
+    // that just-written row under replication lag and skip nick release +
+    // roster fanout. The Get MUST be strongly consistent.
+    await seedConnection(requireFx().client, requireFx().tables, 'cr', 'crnick', '#room');
+    const sendSpy = vi.spyOn(requireFx().client, 'send');
+    await cleanupConnection(requireFx().client, requireFx().tables, 'cr', null);
+    const conGets = sendSpy.mock.calls
+      .map((call) => call[0] as unknown)
+      .filter(
+        (cmd): cmd is GetCommand =>
+          cmd instanceof GetCommand && (cmd.input.TableName?.endsWith('Connections') ?? false),
+      );
+    expect(conGets.length).toBeGreaterThan(0);
+    expect((conGets[0]?.input as { ConsistentRead?: boolean }).ConsistentRead).toBe(true);
+    sendSpy.mockRestore();
+  });
+
   it('broadcast() skips and cleans up gone members', async () => {
     await seedConnection(requireFx().client, requireFx().tables, 'gone3', 'eve', '#room');
     const mgmt: PostToConnection = {

package/packages/aws-adapter/tests/handlers.test.ts

@@ -8,16 +8,13 @@
 
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
 import { GetCommand } from '@aws-sdk/lib-dynamodb';
-import {
-  InMemoryAccountStore,
-  type ParsedServerConfig,
-  StaticMotdProvider,
-} from '@serverless-ircd/irc-core';
+import { type ParsedServerConfig, StaticMotdProvider } from '@serverless-ircd/irc-core';
 import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime } from '../src/aws-runtime.js';
 import type { PostToConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
+import { DynamoServicesStore } from '../src/dynamo-services-store.js';
 import { createDynamoDocumentClient } from '../src/dynamo.js';
 import {
   type HandlerDeps,
@@ -262,6 +259,107 @@ describe.skipIf(!available)('handlers', () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  // $connect Origin allowlist (CSWSH defence)
+  // -------------------------------------------------------------------------
+
+  describe('$connect Origin allowlist (CSWSH defence)', () => {
+    it('denies a disallowed Origin with 403 when WEB_ORIGINS is set', async () => {
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-cswsh' },
+          headers: { Origin: 'https://attacker.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(403);
+      // The denied upgrade must NOT persist a Connections row — a
+      // subsequent $default for the same id hits the missing-row path.
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect(await probe.getConnectionInfo('c-cswsh')).toBeNull();
+    });
+
+    it('admits an allowed Origin (200 + persisted row)', async () => {
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-ok-origin' },
+          headers: { Origin: 'https://app.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(200);
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect((await probe.getConnectionInfo('c-ok-origin'))?.id).toBe('c-ok-origin');
+    });
+
+    it('matches an `Origin` header served lowercased by APIGW', async () => {
+      // API Gateway normalises header keys to lowercase; the handler
+      // MUST find `origin` (not just `Origin`) so a CSWSH defence
+      // bypass cannot hide behind header-key casing.
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-lower' },
+          headers: { origin: 'https://attacker.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(403);
+    });
+
+    it('admits a missing Origin header (non-browser client)', async () => {
+      // curl / WeeChat / the tcp-ws-forwarder never send `Origin`;
+      // their upgrades must pass through unchanged even when the
+      // allowlist is configured.
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c-cli' } },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(200);
+    });
+
+    it('skips the check entirely when WEB_ORIGINS is unset', async () => {
+      // The default — defence is opt-in. Existing AWS deployments
+      // without a web frontend must be unchanged on upgrade: any
+      // Origin (including an obviously hostile one) proceeds.
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-unset' },
+          headers: { Origin: 'https://attacker.example.com' },
+        },
+        requireFx().deps, // no webOrigins
+      );
+      expect(res.statusCode).toBe(200);
+    });
+  });
+
   // -------------------------------------------------------------------------
   // $disconnect
   // -------------------------------------------------------------------------
@@ -693,7 +791,7 @@ describe.skipIf(!available)('handlers', () => {
       expect(replay).toBeDefined();
     });
 
-    it('completes SASL PLAIN with 900/903 when an AccountStore is bound', async () => {
+    it('completes SASL PLAIN with 900/903 when a ServicesStore is bound', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
         requireFx().deps,
@@ -704,10 +802,18 @@ describe.skipIf(!available)('handlers', () => {
           if (line.length > 0) sink.push(line);
         }
       });
-      // Swap in a deps with a seeded AccountStore for this dispatch.
-      const depsWithAccounts: HandlerDeps = {
+      // Swap in a deps with a seeded ServicesStore for this dispatch.
+      // The store is constructed against the test's DynamoDB client so the
+      // post-dispatch flush succeeds; the registration lives in the
+      // in-memory cache so SASL PLAIN resolves it synchronously.
+      const servicesStore = new DynamoServicesStore({
+        docClient: requireFx().client,
+        tableName: requireFx().tables.Services ?? 'Services',
+      });
+      servicesStore.registerNick('aws-sasl', 's3cret', '');
+      const depsWithServices: HandlerDeps = {
         ...requireFx().deps,
-        accounts: new InMemoryAccountStore([{ username: 'aws-sasl', password: 's3cret' }]),
+        services: servicesStore,
       };
       const payload = Buffer.from('\0aws-sasl\0s3cret', 'utf8').toString('base64');
       await dispatch(
@@ -715,14 +821,14 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: `CAP REQ :sasl\r\nAUTHENTICATE PLAIN\r\nAUTHENTICATE ${payload}\r\n`,
         },
-        depsWithAccounts,
+        depsWithServices,
       );
       expect(sink.some((l) => l.includes(' 900 '))).toBe(true);
       expect(sink.some((l) => l.includes(' 903 '))).toBe(true);
       expect(sink.some((l) => l.includes(' 904 '))).toBe(false);
     });
 
-    it('emits 904 when no AccountStore is bound (regression guard)', async () => {
+    it('emits 904 when no ServicesStore is bound (regression guard)', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c2' } },
         requireFx().deps,