serverless-ircd 0.8.0 → 0.10.0

package/packages/irc-core/src/commands/service-aliases.ts

@@ -0,0 +1,52 @@
+/**
+ * Service shortcut command aliases (Atheme/Anope convention).
+ *
+ * Clients and user expectations support shortcut verbs like
+ * `NICKSERV REGISTER pw` as an alias for `PRIVMSG NickServ :REGISTER pw`.
+ * These are not RFC-standardized but are a de facto convention from
+ * services packages (Atheme/Anope) and IRCd alias modules (InspIRCd
+ * `m_alias`, UnrealIRCd `alias{}`).
+ *
+ * The actor's dispatcher rewrites any of these verbs to a
+ * `PRIVMSG <ServiceNick> :<joined args>` and delegates to the existing
+ * `routeMessageTarget` path, so the service reducers see the canonical
+ * `params=[serviceNick, body]` shape unchanged.
+ *
+ * This module is the **single source of truth** for the alias → service
+ * nick mapping. Both the dispatcher rewrite (in `irc-server`'s actor) and
+ * the service-nick recognition in `serviceReducerFor` consult the derived
+ * {@link SERVICE_NICKS} list rather than maintaining their own copies.
+ */
+
+import { CHANSERV_NICK } from './chanserv.js';
+import { HOSTSERV_NICK } from './hostserv.js';
+import { MEMOSERV_NICK } from './memoserv.js';
+import { NICKSERV_NICK } from './nickserv.js';
+import { OPERSERV_NICK } from './operserv.js';
+
+/**
+ * Shortcut command verb (uppercased) → canonical service nick. Keyed by
+ * uppercased command so the dispatcher's `msg.command.toUpperCase()` lookup
+ * is case-insensitive. The full set of Atheme/Anope-convention aliases.
+ */
+export const SHORTCUT_TO_SERVICE: ReadonlyMap<string, string> = new Map<string, string>([
+  ['NICKSERV', NICKSERV_NICK],
+  ['NS', NICKSERV_NICK],
+  ['CHANSERV', CHANSERV_NICK],
+  ['CS', CHANSERV_NICK],
+  ['HOSTSERV', HOSTSERV_NICK],
+  ['HS', HOSTSERV_NICK],
+  ['MEMOSERV', MEMOSERV_NICK],
+  ['MS', MEMOSERV_NICK],
+  ['OPERSERV', OPERSERV_NICK],
+  ['OS', OPERSERV_NICK],
+]);
+
+/**
+ * The canonical, de-duplicated list of service nicks derived from
+ * {@link SHORTCUT_TO_SERVICE}'s values. Used by `serviceReducerFor` for the
+ * "is this target a service nick?" membership check so the service-nick list
+ * lives in exactly one place (this module), not duplicated across an
+ * `if`-chain.
+ */
+export const SERVICE_NICKS: readonly string[] = Array.from(new Set(SHORTCUT_TO_SERVICE.values()));

package/packages/irc-core/src/commands/topic.ts

@@ -153,7 +153,8 @@ function readTopic(
   ctx: Ctx,
   effects: EffectType[],
 ): { state: ChannelState; effects: EffectType[] } {
-  if (state.topic === undefined) {
+  const topicReply = topicNumerics(state, ctx);
+  if (topicReply === undefined) {
     effects.push(
       Effect.send(ctx.connId, [
         numericErr(ctx, Numerics.RPL_NOTOPIC, 'No topic is set', state.name),
@@ -161,19 +162,31 @@ function readTopic(
     );
     return { state, effects };
   }
+  effects.push(topicReply);
+  return { state, effects };
+}
 
+/**
+ * Builds the `332 RPL_TOPIC` + `333 RPL_TOPICWHOTIME` {@link Effect.send}
+ * for the connection's current nick, or `undefined` when no topic is set
+ * on `state.topic`.
+ *
+ * Shared by the TOPIC read-form ({@link readTopic}) and the JOIN success
+ * path so both emit an identical numeric block whenever a topic is
+ * present, regardless of whether the topic came from a ChanServ KEEPTOPIC
+ * restore, a deploy snapshot, or an earlier joiner.
+ */
+export function topicNumerics(state: ChannelState, ctx: Ctx): EffectType | undefined {
+  if (state.topic === undefined) return undefined;
   const nick = ctx.connection.nick ?? '*';
   const codeStr332 = Numerics.RPL_TOPIC.toString().padStart(3, '0');
   const codeStr333 = Numerics.RPL_TOPICWHOTIME.toString().padStart(3, '0');
-  effects.push(
-    Effect.send(ctx.connId, [
-      { text: `:${ctx.serverName} ${codeStr332} ${nick} ${state.name} :${state.topic.text}` },
-      {
-        text: `:${ctx.serverName} ${codeStr333} ${nick} ${state.name} ${state.topic.setter} ${state.topic.setAt}`,
-      },
-    ]),
-  );
-  return { state, effects };
+  return Effect.send(ctx.connId, [
+    { text: `:${ctx.serverName} ${codeStr332} ${nick} ${state.name} :${state.topic.text}` },
+    {
+      text: `:${ctx.serverName} ${codeStr333} ${nick} ${state.name} ${state.topic.setter} ${state.topic.setAt}`,
+    },
+  ]);
 }
 
 // ============================================================================

package/packages/irc-core/src/config.ts

@@ -34,8 +34,8 @@ export const OperCredSchema = z.object({
 /**
  * Schema for a single SASL PLAIN account credential. The `username` is also
  * the canonical account name recorded on the connection (for `extended-join`
- * / `account-tag`). Both fields are non-empty strings; adapters seed an
- * {@link InMemoryAccountStore} from this list at boot.
+ * / `account-tag`). Both fields are non-empty strings; adapters seed the
+ * `InMemoryServicesStore` from this list at boot.
  */
 export const SaslAccountSchema = z.object({
   username: z.string().min(1),
@@ -173,6 +173,15 @@ export const DEFAULT_CREATED_TEXT: string = BUILD_DATE;
  */
 export const DEFAULT_NICK_ENFORCE_GRACE_MS = 30_000;
 
+/**
+ * Default minimum password length enforced by NickServ `SET PASSWORD`.
+ * Mirrors common IRC services (Atheme/Anope) and modern guidance (NIST
+ * SP 800-63B). Overridable per deployment via
+ * `ServerConfig.nickServ.minPasswordLength`. A new password shorter than
+ * the floor is rejected before hashing.
+ */
+export const DEFAULT_MIN_PASSWORD_LENGTH = 8;
+
 /**
  * The full server-config schema. Optional fields default to deployment-
  * sensible values so a minimal `{ serverName, networkName }` config is
@@ -271,13 +280,12 @@ export const ServerConfigSchema = z.object({
   operCreds: z.array(OperCredSchema).default([]),
 
   /**
-   * SASL PLAIN account credentials. The adapter seeds an
-   * `InMemoryAccountStore` from this list at boot so `AUTHENTICATE PLAIN`
-   * succeeds end-to-end for the listed accounts. Empty array (the default)
-   * disables SASL account verification: `ctx.accounts` is then omitted and
-   * a client completing `AUTHENTICATE PLAIN` receives `904 ERR_SASLFAIL`.
-   * A persistent variant (DynamoDB `Accounts`, D1) is a documented
-   * follow-up; swapping it in means replacing the construction call.
+   * SASL PLAIN seed credentials. The adapter ingests these into the
+   * `ServicesStore` at boot via `registerNick` (idempotent — existing
+   * registrations win). `AUTHENTICATE PLAIN`, `PASS <nick>:<password>`,
+   * and NickServ `IDENTIFY` all verify against the resulting
+   * `nickserv_accounts` rows. Empty array (the default) leaves the seed
+   * empty; accounts can still be created at runtime via NickServ REGISTER.
    */
   saslAccounts: z.array(SaslAccountSchema).default([]),
 
@@ -357,6 +365,24 @@ export const ServerConfigSchema = z.object({
    */
   nickEnforceGraceMs: z.number().int().nonnegative().optional(),
 
+  /**
+   * NickServ-specific tunables. Currently only the minimum length enforced
+   * by `SET PASSWORD` is configurable; the maximum (256) is fixed to bound
+   * the scrypt input budget. Omit entirely to inherit the documented
+   * defaults.
+   */
+  nickServ: z
+    .object({
+      /**
+       * Minimum length a new password must meet to be accepted by
+       * `SET PASSWORD`. Defaults to {@link DEFAULT_MIN_PASSWORD_LENGTH}
+       * (8) when unset. A shorter new password is rejected before hashing
+       * with `Password is too short (minimum <n> characters).`.
+       */
+      minPasswordLength: z.number().int().positive().optional(),
+    })
+    .optional(),
+
   /**
    * HostServ approval mode for `REQUEST <vhost>`. `true` (the default)
    * preserves the legacy auto-approve behaviour — the requested vhost is

package/packages/irc-core/src/credential-hashing.ts

@@ -1,10 +1,10 @@
 /**
  * Shared SASL credential hashing primitives.
  *
- * Both the AWS adapter (`DynamoAccountStore`) and the CF adapter
- * (`D1AccountStore`) store SASL PLAIN credentials as **scrypt hashes**.
- * These helpers live in `irc-core` so both adapters share one hashing
- * implementation — the AWS path previously owned the only copy.
+ * Both the AWS adapter (`DynamoServicesStore`) and the CF adapter
+ * (`D1ServicesStore`) store NickServ/SASL credentials as **scrypt hashes**
+ * via the unified `ServicesStore`. These helpers live in `irc-core` so both
+ * adapters share one hashing implementation.
  *
  * Uses `node:crypto` (`scryptSync`), which is available on Node (AWS Lambda)
  * natively and on Cloudflare Workers via the `nodejs_compat` flag. The public
@@ -14,16 +14,16 @@
  */
 
 import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
-import type { AccountStore, SaslPayload, SaslResult } from './ports.js';
 
 const SCRYPT_KEY_LEN = 64;
 const SALT_LEN = 16;
 
 /**
- * A single SASL PLAIN credential stored as a scrypt hash.
+ * A single credential stored as a scrypt hash.
  *
- * Every field is a persistence-backend attribute — this object IS the table
- * row (DynamoDB `Accounts` item / D1 `accounts` row, keyed by `account`).
+ * Every field is a persistence-backend attribute — this object IS the
+ * credential portion of a `nickserv_accounts` row (DynamoDB `Services`
+ * item / D1 `nickserv_accounts` row, keyed by the folded nick).
  * `algorithm` is retained so future migrations to Argon2/bcrypt can be
  * detected and handled gracefully by {@link verifyHashedPassword}.
  */
@@ -36,8 +36,9 @@ export interface HashedAccountCredential {
 
 /**
  * Hashes a plaintext password into a {@link HashedAccountCredential}
- * suitable for writing to the accounts backend (`putAccountCredential` /
- * `seed-cf-accounts`).
+ * suitable for writing to the services backend
+ * (`ServicesStore.registerNick` stores the result on the registered-nick
+ * row).
  *
  * Uses `scryptSync` (memory-hard, GPU-resistant) with a random salt.
  * Pass `{ salt }` for deterministic test scenarios; pass `{ keyLen }` to
@@ -78,47 +79,3 @@ export function verifyHashedPassword(password: string, entry: HashedAccountCrede
   const computed = scryptSync(password, salt, expected.length);
   return computed.length === expected.length && timingSafeEqual(computed, expected);
 }
-
-/**
- * Synchronous {@link AccountStore} backed by pre-loaded hashed credentials.
- *
- * Construct with entries produced by {@link hashAccountCredential} (for unit
- * tests / seeding) or pre-loaded from a persistence backend at boot. Both
- * adapters use this class:
- *
- *   - AWS: `loadDynamoAccountStore` scans the `Accounts` table at Lambda
- *     cold start and constructs this store; `DynamoAccountStore` is a
- *     re-export alias for back-compat.
- *   - CF: `loadD1AccountStore` queries the D1 `accounts` table at
- *     `ConnectionDO` construction (mirroring the two-phase load pattern).
- *
- * The class has zero backend coupling — it works equally well with entries
- * from any source. The `AccountStore.verify` port stays synchronous, so
- * the async pre-load MUST complete before the first frame dispatches.
- */
-export class HashedAccountStore implements AccountStore {
-  private readonly entries: ReadonlyMap<string, HashedAccountCredential>;
-
-  constructor(entries: ReadonlyArray<HashedAccountCredential>) {
-    this.entries = new Map(entries.map((e) => [e.account, e]));
-  }
-
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    if (mech.toUpperCase() !== 'PLAIN' || payload.kind !== 'PLAIN') {
-      return { ok: false, reason: `unsupported mechanism: ${mech}` };
-    }
-    const entry = this.entries.get(payload.username);
-    if (entry === undefined) {
-      return { ok: false, reason: 'invalid credentials' };
-    }
-    if (!verifyHashedPassword(payload.password, entry)) {
-      return { ok: false, reason: 'invalid credentials' };
-    }
-    return { ok: true, account: payload.username };
-  }
-
-  /** Number of loaded accounts (diagnostics / logging). */
-  get size(): number {
-    return this.entries.size;
-  }
-}

package/packages/irc-core/src/index.ts

@@ -11,6 +11,7 @@ export * from './commands/index.js';
 export * from './effects.js';
 export * from './ports.js';
 export * from './credential-hashing.js';
+export * from './account-migration.js';
 export * from './flood-control.js';
 export * from './cloak.js';
 export * from './case-fold.js';