serverless-ircd 0.8.0 → 0.10.0

package/packages/irc-core/src/commands/hostserv.ts

@@ -413,6 +413,31 @@ function handleList(
 // vhost application helpers
 // ============================================================================
 
+/**
+ * Consults the bound {@link ServicesStore} for an assigned vhost for `account`
+ * and, when one is present, applies it to {@link ConnectionState} via
+ * {@link applyVhost}. This is the shared login-time hook invoked by every
+ * account-success path (SASL PLAIN, PASS-auth via {@link applyAccountSuccess},
+ * and NickServ `IDENTIFY` via {@link applyIdentify}) so a reconnecting user
+ * with an assigned vhost does not have to re-run `HostServ ON` every session.
+ *
+ * No-op (no effects emitted, no state change) when no vhost is recorded. The
+ * CHGHOST fanout appended to `effects` is empty at SASL / PASS-auth time
+ * (registration has not completed and/or no channels are joined yet) but fires
+ * for a post-registration NickServ `IDENTIFY` when the user is already in
+ * channels — reusing {@link applyVhost} so the wire shape matches `HostServ ON`.
+ */
+export function applyAssignedVhost(
+  state: ConnectionState,
+  services: ServicesStore,
+  account: string,
+  effects: EffectType[],
+): void {
+  const vhost = services.getVhost(account);
+  if (vhost === undefined) return;
+  applyVhost(state, vhost, effects);
+}
+
 /**
  * Applies `vhost` to {@link ConnectionState.host}, records the prior host
  * on {@link ConnectionState.preVhostHost}, flips
@@ -421,7 +446,7 @@ function handleList(
  * {@link emitChghost} helper so the wire shape matches every other
  * user/host mutation.
  */
-function applyVhost(state: ConnectionState, vhost: string, effects: EffectType[]): void {
+export function applyVhost(state: ConnectionState, vhost: string, effects: EffectType[]): void {
   const oldUser = state.user ?? '';
   const oldHost = state.host ?? '';
   state.preVhostHost = oldHost;
@@ -457,13 +482,23 @@ function notice(state: ConnectionState, text: string): EffectType {
   return Effect.send(state.id, [servicesNotice(HOSTSERV_NICK, state, text)]);
 }
 
+/** User-visible HostServ subcommands (shown to every caller). */
+const USER_COMMANDS = 'ON, OFF, REQUEST';
+
+/** Oper-only HostServ subcommands, appended to {@link USER_COMMANDS} for opers. */
+const OPER_COMMANDS = 'SET, APPROVE, REJECT, LIST';
+
 /** Builds a help `:HostServ!HostServ@services NOTICE <nick> :…` line. */
 function helpNotice(state: ConnectionState): EffectType {
-  return notice(state, 'Available commands: ON, OFF, REQUEST, SET, APPROVE, REJECT, LIST');
+  const commands =
+    state.userModes.oper === true ? `${USER_COMMANDS}, ${OPER_COMMANDS}` : USER_COMMANDS;
+  return notice(state, `Available commands: ${commands}`);
 }
 
 function unknownNotice(state: ConnectionState): EffectType {
-  return notice(state, 'Unknown command. Available: ON, OFF, REQUEST, SET, APPROVE, REJECT, LIST');
+  const commands =
+    state.userModes.oper === true ? `${USER_COMMANDS}, ${OPER_COMMANDS}` : USER_COMMANDS;
+  return notice(state, `Unknown command. Available: ${commands}`);
 }
 
 /**

package/packages/irc-core/src/commands/index.ts

@@ -110,3 +110,4 @@ export {
 } from './chanserv.js';
 export { HOSTSERV_NICK, hostservReducer } from './hostserv.js';
 export { OPERSERV_NICK, operservReducer } from './operserv.js';
+export { SERVICE_NICKS, SHORTCUT_TO_SERVICE } from './service-aliases.js';

package/packages/irc-core/src/commands/join.ts

@@ -27,6 +27,7 @@ import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 import { CHANSERV_HOSTMASK, DEFAULT_CHANNEL_LEVELS } from './chanserv.js';
 import { CHATHISTORY_CAP, buildChathistoryBatch } from './chathistory.js';
+import { topicNumerics } from './topic.js';
 
 /**
  * RFC 1459/2812 channel-name grammar. The first character must be a channel
@@ -265,16 +266,27 @@ export const joinReducer: Reducer<ChannelState> = (state, msg, ctx) => {
     }
   }
 
-  // All checks passed: add to roster. First joiner gets op per RFC 2812.
+  // All checks passed: add to roster. First joiner gets op per RFC 2812,
+  // unless the channel is ChanServ-registered — in that case the first
+  // joiner is opped only when they are the founder or meet the AUTOOP
+  // level (computeChanservAutoPrefix), so a random user reconnecting
+  // first after a roster-wiping deploy cannot seize op in a channel they
+  // do not own. The real founder / access-list users who join later are
+  // opped by the same access check on the non-empty path.
   const wasEmpty = state.members.size === 0;
-  // ChanServ ACCESS auto-prefix: when services are bound, the channel is
-  // registered, and this is not the RFC 2812 first-joiner case, look up
-  // the joiner's access level and apply the matching channel prefix.
-  // `chanservPrefix` is non-null only when ChanServ (not the RFC 2812
-  // rule) granted the prefix, so the JOIN hook knows to emit a ChanServ
-  // MODE broadcast alongside the roster mutation.
-  const autoPrefix = wasEmpty ? null : computeChanservAutoPrefix(ctx, state.nameLower);
-  const grantOp = wasEmpty || (autoPrefix?.op ?? false);
+  // ChanServ ACCESS auto-prefix: always look up the joiner's access level
+  // so the empty-channel gating above and the non-empty case share one
+  // code path. `autoPrefix` is non-null only when ChanServ could resolve
+  // the joiner's access (services bound, channel registered, joiner
+  // identified); it carries {op:false,voice:false} when the joiner is on
+  // no list, and null when ChanServ is not authoritative for this join
+  // (services unbound / channel unregistered / joiner unidentified).
+  const autoPrefix = computeChanservAutoPrefix(ctx, state.nameLower);
+  const channelRegistered = ctx.services?.getChannel(state.nameLower) !== undefined;
+  // RFC 2812 first-joiner op applies only when the channel is NOT
+  // registered. A registered channel's first joiner gets op solely via
+  // the access check (founder / AUTOOP), never by the empty-channel rule.
+  const grantOp = (wasEmpty && !channelRegistered) || (autoPrefix?.op ?? false);
   const grantVoice = autoPrefix?.voice ?? false;
   const joinerNick = ctx.connection.nick ?? '?';
   state.members.set(ctx.connId, {
@@ -288,13 +300,12 @@ export const joinReducer: Reducer<ChannelState> = (state, msg, ctx) => {
   // before this join and services have a persisted topic snapshot for a
   // keep-topic-enabled registration, restore the topic onto the
   // authoritative ChannelState. The 332/333 numerics are emitted to the
-  // joiner below alongside the NAMES list.
-  let restoredTopic: ChannelTopic | undefined;
+  // joiner below alongside the NAMES list, keyed off `state.topic`.
   if (wasEmpty) {
-    restoredTopic = restoreKeepTopic(ctx, state.nameLower);
-    if (restoredTopic !== undefined) {
-      state.topic = restoredTopic;
-      effects.push(Effect.applyChannelDelta(state.name, { topic: restoredTopic }));
+    const restored = restoreKeepTopic(ctx, state.nameLower);
+    if (restored !== undefined) {
+      state.topic = restored;
+      effects.push(Effect.applyChannelDelta(state.name, { topic: restored }));
     }
   }
 
@@ -323,13 +334,15 @@ export const joinReducer: Reducer<ChannelState> = (state, msg, ctx) => {
     }),
   );
 
-  // ChanServ auto-prefix broadcast: when ChanServ granted op or voice
-  // (i.e. NOT the RFC 2812 first-joiner case), emit a
-  // `:ChanServ!ChanServ@services MODE #chan +o nick` broadcast so every
-  // client in the channel updates its prefix display. Supersedes the
-  // implicit voice when op is granted (the channel-prefix grammar
-  // already renders `@` for ops).
-  if (autoPrefix !== null && (autoPrefix.op || autoPrefix.voice)) {
+  // ChanServ auto-prefix broadcast: when ChanServ granted op or voice on
+  // a non-empty channel, emit a `:ChanServ!ChanServ@services MODE #chan
+  // +o nick` broadcast so existing clients update their prefix display.
+  // Suppressed on the empty-channel first-join (wasEmpty) because the
+  // joiner is the channel's only client and already sees their prefix in
+  // the NAMES list — the op grant is silent. Supersedes the implicit
+  // voice when op is granted (the channel-prefix grammar already renders
+  // `@` for ops).
+  if (!wasEmpty && autoPrefix !== null && (autoPrefix.op || autoPrefix.voice)) {
     effects.push(buildChanservPrefixBroadcast(state.name, joinerNick, autoPrefix));
   }
 
@@ -379,19 +392,12 @@ export const joinReducer: Reducer<ChannelState> = (state, msg, ctx) => {
 
   effects.push(Effect.send(ctx.connId, lines));
 
-  // When ChanServ KEEPTOPIC restored a topic this JOIN, emit the 332/333
-  // topic numerics to the joiner so their client renders the restored
-  // topic (mirroring the TOPIC read-form reply shape).
-  if (restoredTopic !== undefined) {
-    effects.push(
-      Effect.send(ctx.connId, [
-        { text: `:${ctx.serverName} 332 ${nick} ${chanName} :${restoredTopic.text}` },
-        {
-          text: `:${ctx.serverName} 333 ${nick} ${chanName} ${restoredTopic.setter} ${restoredTopic.setAt}`,
-        },
-      ]),
-    );
-  }
+  // Emit 332/333 topic numerics to the joiner whenever a topic is set on
+  // the channel, regardless of whether it came from a ChanServ KEEPTOPIC
+  // restore this join, a deploy snapshot, or an earlier joiner. Mirrors
+  // the TOPIC read-form reply shape (RFC 2812 §3.2.1).
+  const topicReply = topicNumerics(state, ctx);
+  if (topicReply !== undefined) effects.push(topicReply);
 
   return { state, effects };
 };

package/packages/irc-core/src/commands/memoserv.ts

@@ -19,7 +19,7 @@
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. The services store is synchronous (mirrors
- * the {@link AccountStore} / {@link MessageStore} pattern).
+ * the {@link MessageStore} pattern).
  */
 
 import { caseFold } from '../case-fold.js';

package/packages/irc-core/src/commands/nickserv.ts

@@ -26,16 +26,17 @@
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. The services store is synchronous (mirrors
- * the {@link AccountStore} / {@link MessageStore} pattern).
+ * the {@link MessageStore} pattern).
  */
 
-import { DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
+import { DEFAULT_MIN_PASSWORD_LENGTH, DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { NickEnforcePolicy, ServicesStore } from '../ports.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 import { emitAccountNotify } from './account-notify.js';
+import { applyAssignedVhost } from './hostserv.js';
 import { deliverUnreadMemos } from './memoserv.js';
 
 /** Canonical NickServ pseudo-client nick. */
@@ -47,6 +48,30 @@ const SERVICES_HOST = 'services';
 /** Policies accepted by `SET ENFORCE` (lowercased input forms). */
 const ENFORCE_POLICIES: ReadonlySet<NickEnforcePolicy> = new Set(['none', 'ghost', 'kill']);
 
+/**
+ * Fixed maximum password length accepted by `SET PASSWORD`. Bounds the
+ * scrypt input budget (256 is the practical limit of the scrypt input);
+ * not configurable. Over-long passwords are rejected before hashing.
+ */
+const MAX_PASSWORD_LENGTH = 256;
+
+/**
+ * Gate NOTICE sent to an unidentified caller (or one identified as a
+ * different account) attempting `SET ENFORCE`. Wording kept verbatim from
+ * the original inline literal so the existing ENFORCE test suite is not
+ * churned by the addition of `SET PASSWORD` (a sibling constant covers the
+ * PASSWORD gate).
+ */
+const ENFORCE_GATE_NOTICE = 'You must identify before changing enforcement.';
+
+/**
+ * Gate NOTICE sent to an unidentified caller (or one identified as a
+ * different account) attempting `SET PASSWORD`. Wording mirrors the ENFORCE
+ * gate's intent but speaks to "password" rather than "enforcement" so a
+ * caller who hits it understands which subcommand they tripped.
+ */
+const PASSWORD_GATE_NOTICE = 'You must identify before changing your password.';
+
 /**
  * Reducer for `PRIVMSG NickServ :<subcommand> <args…>`.
  * Authority: the invoking connection's {@link ConnectionState}.
@@ -74,6 +99,7 @@ export const nickservReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
   switch (sub) {
     case 'REGISTER':
       return handleRegister(state, args, ctx, effects);
+    case 'ID':
     case 'IDENTIFY':
       return handleIdentify(state, args, ctx, effects);
     case 'DROP':
@@ -166,9 +192,10 @@ function handleIdentify(
 }
 
 /**
- * Applies a successful identify: records the account, sets `+r`, emits the
- * confirmation NOTICE, fans `ACCOUNT` out to peers, and delivers queued
- * memos.
+ * Applies a successful identify: records the account, sets `+r`, re-applies any
+ * assigned HostServ vhost (so a reconnecting user does not have to re-run
+ * `HostServ ON`), emits the confirmation NOTICE, fans `ACCOUNT` out to peers,
+ * and delivers queued memos.
  */
 function applyIdentify(
   state: ConnectionState,
@@ -178,6 +205,10 @@ function applyIdentify(
 ): void {
   state.account = account;
   state.userModes.registered = true;
+  // Re-apply an assigned HostServ vhost. At identify time the connection is
+  // usually pre-JOIN so the CHGHOST fanout is empty, but a post-JOIN IDENTIFY
+  // fans CHGHOST out to the user's current `chghost`-capable peers.
+  applyAssignedVhost(state, services, account, effects);
   effects.push(notice(state, `You are now identified for nick ${account}.`));
   effects.push(...emitAccountNotify({ conn: state, account }));
   deliverUnreadMemos(state, services, account, effects);
@@ -241,7 +272,12 @@ function handleInfo(
 
   effects.push(notice(state, `Nick: ${rec.nick}`));
   effects.push(notice(state, `Account: ${rec.account}`));
-  effects.push(notice(state, `Email: ${rec.email}`));
+  // Email is private: only the account owner or an oper may see it. Mirrors
+  // the `state.account === rec.account` gate used by SET ENFORCE / the
+  // enforcement hook, extended to opers.
+  if (state.account === rec.account || state.userModes.oper) {
+    effects.push(notice(state, `Email: ${rec.email}`));
+  }
   return { state, effects };
 }
 
@@ -306,12 +342,24 @@ export function enforceRegisteredNick(state: ConnectionState, ctx: Ctx): EffectT
 // ============================================================================
 
 /**
- * Handles `SET <subkey> <args…>`. Currently only `ENFORCE none|ghost|kill`
- * is supported; unknown subkeys fall back to the ENFORCE syntax notice.
+ * Handles `SET <subkey> <args…>`. Supported subkeys:
+ *
+ *   - `ENFORCE none|ghost|kill` — sets the per-account enforcement policy.
+ *   - `PASSWORD <old> <new>` — self-service password change. Requires the
+ *     current password to be re-supplied as a defence against a hijacked
+ *     identified session (a stolen `+r` session should not let an attacker
+ *     silently rotate the password and lock the real owner out — this is
+ *     Atheme's shape, not the alternative "trust the gate" one-arg form).
+ *     The new password is re-hashed via `hashAccountCredential` and
+ *     overwrites the stored credential via
+ *     {@link ServicesStore.setNickPassword}; the current session stays
+ *     `+r` and other sessions of the same account are NOT kicked.
  *
- * Requires the caller to be identified as the account bound to the current
- * nick: enforcement is a per-account policy, so an unidentified client
- * (or one identified as a different account) cannot mutate it.
+ * Unknown subkeys fall back to the ENFORCE syntax notice.
+ *
+ * Both subkeys require the caller to be identified as the account bound to
+ * the current nick: an unidentified client (or one identified as a
+ * different account) cannot mutate the account.
  */
 function handleSet(
   state: ConnectionState,
@@ -319,8 +367,10 @@ function handleSet(
   ctx: Ctx,
   effects: EffectType[],
 ): { state: ConnectionState; effects: EffectType[] } {
-  const services = ctx.services as ServicesStore;
   const subkey = args[0]?.toUpperCase();
+  if (subkey === 'PASSWORD') {
+    return handleSetPassword(state, args.slice(1), ctx, effects);
+  }
   if (subkey !== 'ENFORCE') {
     effects.push(enforceSyntaxNotice(state));
     return { state, effects };
@@ -335,10 +385,11 @@ function handleSet(
 
   const nick = state.nick;
   if (nick === undefined || state.account === undefined) {
-    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    effects.push(notice(state, ENFORCE_GATE_NOTICE));
     return { state, effects };
   }
 
+  const services = ctx.services as ServicesStore;
   const rec = services.getNick(nick);
   if (rec === undefined) {
     effects.push(notice(state, `Nick ${nick} is not registered.`));
@@ -346,7 +397,7 @@ function handleSet(
   }
   // The caller must be identified as the account that owns this nick.
   if (state.account !== rec.account) {
-    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    effects.push(notice(state, ENFORCE_GATE_NOTICE));
     return { state, effects };
   }
 
@@ -355,11 +406,80 @@ function handleSet(
   return { state, effects };
 }
 
+/**
+ * Handles `SET PASSWORD <old> <new>`. Mirrors the `SET ENFORCE` identify
+ * gate (`state.account === rec.account`), then re-verifies the current
+ * password (no-leak parity with `IDENTIFY`'s `Invalid password.` notice)
+ * and enforces the configurable minimum / fixed maximum length on the new
+ * password before re-hashing and persisting.
+ */
+function handleSetPassword(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const oldPassword = args[0];
+  const newPassword = args[1];
+  if (oldPassword === undefined || newPassword === undefined) {
+    effects.push(passwordSyntaxNotice(state));
+    return { state, effects };
+  }
+
+  const nick = state.nick;
+  if (nick === undefined || state.account === undefined) {
+    effects.push(notice(state, PASSWORD_GATE_NOTICE));
+    return { state, effects };
+  }
+
+  const services = ctx.services as ServicesStore;
+  const rec = services.getNick(nick);
+  if (rec === undefined) {
+    effects.push(notice(state, `Nick ${nick} is not registered.`));
+    return { state, effects };
+  }
+  // The caller must be identified as the account that owns this nick.
+  if (state.account !== rec.account) {
+    effects.push(notice(state, PASSWORD_GATE_NOTICE));
+    return { state, effects };
+  }
+
+  // Re-verify the current password (defence against a hijacked `+r`
+  // session). Same `verifyNick` path `IDENTIFY` uses → same `Invalid
+  // password.` notice → no information leak about whether the account
+  // exists (the gate above already proved it does).
+  if (!services.verifyNick(nick, oldPassword).ok) {
+    effects.push(notice(state, 'Invalid password.'));
+    return { state, effects };
+  }
+
+  const minLen = ctx.serverConfig.nickServ?.minPasswordLength ?? DEFAULT_MIN_PASSWORD_LENGTH;
+  if (newPassword.length < minLen) {
+    effects.push(notice(state, `Password is too short (minimum ${minLen} characters).`));
+    return { state, effects };
+  }
+  if (newPassword.length > MAX_PASSWORD_LENGTH) {
+    effects.push(
+      notice(state, `Password is too long (maximum ${MAX_PASSWORD_LENGTH} characters).`),
+    );
+    return { state, effects };
+  }
+
+  services.setNickPassword(nick, newPassword);
+  effects.push(notice(state, 'Password changed.'));
+  return { state, effects };
+}
+
 /** Builds the `SET ENFORCE` syntax NOTICE. */
 function enforceSyntaxNotice(state: ConnectionState): EffectType {
   return notice(state, 'Syntax: SET ENFORCE none|ghost|kill');
 }
 
+/** Builds the `SET PASSWORD` syntax NOTICE. */
+function passwordSyntaxNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Syntax: SET PASSWORD <old-password> <new-password>');
+}
+
 // ============================================================================
 // Notice helpers
 // ============================================================================
@@ -375,7 +495,10 @@ function helpNotice(state: ConnectionState): EffectType {
 }
 
 function unknownNotice(state: ConnectionState): EffectType {
-  return notice(state, 'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET');
+  return notice(
+    state,
+    'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET (ENFORCE, PASSWORD)',
+  );
 }
 
 /**

package/packages/irc-core/src/commands/registration.ts

@@ -22,7 +22,7 @@ import type { ChanName } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
-import { passBasedAccountAuth } from './account-auth.js';
+import { attemptPassAccountAuth, passBasedAccountAuth } from './account-auth.js';
 import { generateIsupport } from './isupport.js';
 import { buildMotdNumerics } from './motd-lines.js';
 import { enforceRegisteredNick } from './nickserv.js';
@@ -119,7 +119,7 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
   // the account-login numerics (900/903 + downstream effects), satisfying
   // the gate as a side effect. On every other outcome it returns `[]` and
   // the gate below decides. No-op when already identified (SASL), when no
-  // `<nick>:<password>` form is present, or when no AccountStore is bound.
+  // `<nick>:<password>` form is present, or when no ServicesStore is bound.
   const authEffects = passBasedAccountAuth(state, ctx);
 
   const gateFailure = passwordGateFailure(state, ctx);
@@ -161,12 +161,16 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
  * Replaces `state.host` with a deterministic cloak derived from the
  * deployment's cloaking secret + the current (real) host. No-op when
  * cloaking is disabled or no host is set yet (e.g. transport didn't supply
- * one, or the connection sets it later via CHGHOST).
+ * one, or the connection sets it later via CHGHOST). Also a no-op when a
+ * HostServ vhost is already active (`vhostActive`) — the vhost was re-applied
+ * by {@link applyAccountSuccess} during SASL / PASS-auth and must win over the
+ * cloak so it remains visible in the `001` welcome.
  */
 function applyCloakIfEnabled(state: ConnectionState, ctx: Ctx): void {
   const cloaking = ctx.serverConfig.cloaking;
   if (cloaking === undefined || !cloaking.enabled) return;
   if (state.host === undefined) return;
+  if (state.vhostActive === true) return;
   state.host = cloakHost(state.host, cloaking, ctx.networkName);
 }
 
@@ -340,33 +344,40 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
 /**
  * Reducer for `PASS <password>`.
  *
- * Stashes the attempt as `state.passAttempt`. The pure-reducer gate
- * itself lives in {@link passwordGateFailure} (same file), which
- * {@link emitWelcomeIfReady} consults at registration completion:
- * it compares `state.passAttempt` against
- * `ctx.serverConfig.serverPassword` and, on mismatch, emits
- * `464 ERR_PASSWDMISMATCH` plus a `Disconnect("Bad Password")`. A
- * SASL-identified connection (`state.account !== undefined`) short-
- * circuits the gate, so PASS is unnecessary when SASL has already
- * authenticated an account.
+ * Pre-registration: stashes the attempt as `state.passAttempt` for the
+ * server-password gate ({@link passwordGateFailure}) and the at-completion
+ * PASS-auth ({@link passBasedAccountAuth}). A second `PASS` before
+ * registration completes is rejected with `462 ERR_ALREADYREGISTRED`.
+ *
+ * Post-registration: a bare server password is meaningless, so only the
+ * `<nick>:<password>` form is honoured — as a late account login via
+ * {@link attemptPassAccountAuth} against the bound `ctx.services`. Every
+ * other outcome (bare value, no store, already identified, verify failure)
+ * is a silent no-op: no `462`, no disconnect. This lets a client that
+ * completed `NICK`+`USER` before sending `PASS` identify after the fact.
  */
 export const passReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
   const effects: EffectType[] = [];
 
-  if (state.registration === 'registered') {
+  const password = msg.params[0];
+  if (password === undefined) {
     effects.push(
       Effect.send(ctx.connId, [
-        numericErr(ctx, Numerics.ERR_ALREADYREGISTRED, 'You may not reregister'),
+        numericErr(ctx, Numerics.ERR_NEEDMOREPARAMS, 'Not enough parameters', 'PASS'),
       ]),
     );
     return { state, effects };
   }
 
-  const password = msg.params[0];
-  if (password === undefined) {
+  if (state.registration === 'registered') {
+    effects.push(...attemptPassAccountAuth(state, ctx, password));
+    return { state, effects };
+  }
+
+  if (state.passAttempt !== undefined) {
     effects.push(
       Effect.send(ctx.connId, [
-        numericErr(ctx, Numerics.ERR_NEEDMOREPARAMS, 'Not enough parameters', 'PASS'),
+        numericErr(ctx, Numerics.ERR_ALREADYREGISTRED, 'You may not reregister'),
       ]),
     );
     return { state, effects };

package/packages/irc-core/src/commands/sasl.ts

@@ -13,12 +13,14 @@
  *      Anything else gets `908 ERR_SASLMECHS` listing what is available.
  *   2. `AUTHENTICATE <b64>` / `AUTHENTICATE +` — delivers the payload (whole
  *      or in `<=400`-byte chunks; `+` marks an empty/final chunk). The
- *      decoded bytes are handed to the injected {@link AccountStore}; on
- *      success the connection records the account name and the reducer emits
- *      `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure `904 ERR_SASLFAIL`.
+ *      decoded bytes are verified against the bound {@link ServicesStore};
+ *      on success the connection records the account name and the reducer
+ *      emits `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure
+ *      `904 ERR_SASLFAIL`. PLAIN consults `services.verifyNick`, EXTERNAL
+ *      consults `services.verifyCertFP` against the mTLS-resolved subject.
  *   3. `AUTHENTICATE *` — client abort → `906 ERR_SASLABORT`.
  *
- * The `AccountStore` port is **synchronous** (see {@link AccountStore} docs):
+ * The {@link ServicesStore} port is **synchronous** (reducers stay pure):
  * adapters pre-load credentials so the reducer stays pure. Async backends
  * resolve their lookups before the actor invokes this reducer.
  *
@@ -29,7 +31,7 @@
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
-import type { SaslResult } from '../ports.js';
+import type { ServicesAuthResult } from '../ports.js';
 import { decodeBase64 } from '../protocol/base64.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ConnectionState } from '../state/connection.js';
@@ -143,7 +145,7 @@ function handlePayload(
   return finalize(state, next, mech, ctx);
 }
 
-/** Decodes the accumulated payload and runs it through the AccountStore. */
+/** Decodes the accumulated payload and verifies it against the ServicesStore. */
 function finalize(
   state: ConnectionState,
   payloadB64: string,
@@ -169,28 +171,16 @@ function finalizePlain(
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
 
-  // Prefer the static AccountStore; fall back to the ServicesStore so a
-  // nick registered via NickServ can authenticate via SASL PLAIN without a
-  // separate static credential table. When neither verifies, fail.
-  const store = ctx.accounts;
-  let result = store?.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: parsed.username,
-    password: parsed.password,
-  });
-
-  if (result === undefined || !result.ok) {
-    const servicesResult = ctx.services?.verifyNick(parsed.username, parsed.password);
-    if (servicesResult?.ok) {
-      result = servicesResult;
-    }
-  }
-
-  if (result === undefined) {
+  // Single credential home: services.verifyNick covers every NickServ
+  // registration, every SASL_ACCOUNTS-seeded account (carried into
+  // services via the boot ingest), and every PASS-auth share. No separate
+  // static credential fallback — there is no second credential table.
+  const services = ctx.services;
+  if (services === undefined) {
     clearSasl(state);
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
-
+  const result = services.verifyNick(parsed.username, parsed.password);
   return applyResult(state, result, ctx);
 }
 
@@ -207,21 +197,22 @@ function finalizeExternal(
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
 
-  const store = ctx.accounts;
-  if (store === undefined) {
+  // Cert subjects are mapped to accounts via services.verifyCertFP — the
+  // same single credential home as SASL PLAIN / PASS-auth. No separate
+  // services lookup.
+  const services = ctx.services;
+  if (services === undefined) {
     clearSasl(state);
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
-
-  const result = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity });
-
+  const result = services.verifyCertFP(identity);
   return applyResult(state, result, ctx);
 }
 
 /** Shared success/failure handling after a `verify` call. */
 function applyResult(
   state: ConnectionState,
-  result: SaslResult,
+  result: ServicesAuthResult,
   ctx: Ctx,
 ): { state: ConnectionState; effects: EffectType[] } {
   clearSasl(state);