serverless-ircd 0.8.0 → 0.10.0

package/packages/irc-core/tests/commands/registration.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import pkg from '../../package.json' with { type: 'json' };
 import { cloakHost } from '../../src/cloak';
 import {
@@ -27,14 +27,7 @@ import {
   SequentialIdFactory,
   StaticMotdProvider,
 } from '../../src/ports';
-import type {
-  AccountStore,
-  AwayStore,
-  MotdProvider,
-  SaslPayload,
-  SaslResult,
-  ServicesStore,
-} from '../../src/ports';
+import type { AwayStore, MotdProvider, ServicesStore } from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
@@ -577,12 +570,15 @@ describe('passReducer', () => {
     expect(out.effects).toEqual([]);
   });
 
-  it('overwrites a previous passAttempt on repeated PASS', () => {
+  it('emits 462 when PASS is sent twice before registration completes', () => {
     const state = makeState();
     state.passAttempt = 'first';
     const ctx = makeCtx(state);
     const out = passReducer(state, { command: 'PASS', params: ['second'], tags: {} }, ctx);
-    expect(out.state.passAttempt).toBe('second');
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 462 * :You may not reregister')]),
+    ]);
+    expect(out.state.passAttempt).toBe('first');
   });
 
   it('emits 461 when no password is supplied', () => {
@@ -595,14 +591,129 @@ describe('passReducer', () => {
     expect(out.state.passAttempt).toBeUndefined();
   });
 
-  it('emits 462 when already registered', () => {
+  it('emits 461 when no password is supplied even after registration', () => {
     const state = registeredState();
     const ctx = makeCtx(state);
-    const out = passReducer(state, { command: 'PASS', params: ['secret'], tags: {} }, ctx);
+    const out = passReducer(state, { command: 'PASS', params: [], tags: {} }, ctx);
     expect(out.effects).toEqual<EffectType[]>([
-      Effect.send('c1', [L(':irc.example.com 462 alice :You may not reregister')]),
+      Effect.send('c1', [L(':irc.example.com 461 alice PASS :Not enough parameters')]),
     ]);
-    expect(out.state.passAttempt).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// passReducer — post-registration PASS (late account login)
+// ============================================================================
+
+describe('passReducer — post-registration PASS <nick>:<password>', () => {
+  it('logs in when PASS <nick>:<password> matches an account after registration', () => {
+    const state = registeredState();
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
+    const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
+
+    expect(out.state.account).toBe('alice');
+    expect(out.state.userModes.registered).toBe(true);
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
+    expect(texts.some((t) => t.includes(' 462 '))).toBe(false);
+    expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
+  });
+
+  it('does not log in or disconnect when the password is wrong', () => {
+    const state = registeredState();
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
+    const out = passReducer(state, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
+
+    expect(out.state.account).toBeUndefined();
+    expect(out.state.userModes.registered).toBe(false);
+    expect(out.effects).toEqual([]);
+    expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
+  });
+
+  it('is indistinguishable from an unknown nick (no auth numerics, no disconnect)', () => {
+    const state = registeredState();
+    state.nick = 'nobody';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const ctx = makeCtxWithServices(state, services);
+    const out = passReducer(state, { command: 'PASS', params: ['nobody:wrong'], tags: {} }, ctx);
+
+    expect(out.state.account).toBeUndefined();
+    expect(out.effects).toEqual([]);
+  });
+
+  it('equalises timing with an extra dummy verify on failure', () => {
+    const state = registeredState();
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
+    passReducer(state, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
+
+    // Two calls: the real (failed) verify against `alice`, then the
+    // timing-equalising dummy verify.
+    expect(verifyNick).toHaveBeenCalledTimes(2);
+    expect(verifyNick.mock.calls[0]?.[0]).toBe('alice');
+    expect(verifyNick.mock.calls[0]?.[1]).toBe('wrong');
+    // The second call is the dummy; its nick is the sentinel, not 'alice'.
+    expect(verifyNick.mock.calls[1]?.[0]).not.toBe('alice');
+  });
+
+  it('does not log in when the payload nick does not match state.nick', () => {
+    const state = registeredState();
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
+    const out = passReducer(state, { command: 'PASS', params: ['bob:hunter2'], tags: {} }, ctx);
+
+    expect(out.state.account).toBeUndefined();
+    expect(verifyNick).not.toHaveBeenCalled();
+    expect(out.effects).toEqual([]);
+  });
+
+  it('ignores a bare PASS value (no colon) after registration — no 462, no disconnect', () => {
+    const state = registeredState();
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
+    const out = passReducer(state, { command: 'PASS', params: ['serverpw'], tags: {} }, ctx);
+
+    expect(out.state.account).toBeUndefined();
+    expect(out.effects).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
+    expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
+  });
+
+  it('ignores a late PASS when the connection is already identified', () => {
+    const state = registeredState();
+    state.account = 'alice';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
+    const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
+
+    expect(verifyNick).not.toHaveBeenCalled();
+    expect(out.effects).toEqual([]);
+    expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
+  });
+
+  it('ignores a late PASS <nick>:<password> when no ServicesStore is bound', () => {
+    const state = registeredState();
+    const ctx = makeCtx(state);
+    const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
+
+    expect(out.state.account).toBeUndefined();
+    expect(out.effects).toEqual([]);
+    expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
   });
 });
 
@@ -1522,32 +1633,6 @@ describe('emitWelcomeIfReady — OperServ AKILL admission', () => {
 // PASS-based account auth (NICK + PASS <nick>:<password> + USER → identified)
 // ============================================================================
 
-/** A capture-and-respond fake AccountStore (mirrors the sasl.test.ts fake). */
-class FakeAccountStore implements AccountStore {
-  readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-  constructor(private readonly result: SaslResult) {}
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    this.calls.push({ mech, payload });
-    return this.result;
-  }
-}
-
-/** Like {@link makeCtx} but also threads a bound AccountStore. */
-function makeCtxWithAccounts(
-  state: ConnectionState,
-  accounts: AccountStore,
-  clock = new FakeClock(1_000),
-): Ctx {
-  return buildCtx({
-    serverConfig,
-    clock,
-    ids: new SequentialIdFactory(),
-    motd: EmptyMotdProvider,
-    connection: state,
-    accounts,
-  });
-}
-
 const SV = 'irc.example.com';
 const L2 = (text: string): RawLine => ({ text });
 
@@ -1558,8 +1643,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
     state.user = 'alice';
     state.host = 'example.com';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
 
     const effects = emitWelcomeIfReady(state, ctx);
 
@@ -1576,11 +1662,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
 
 // ---- helpers for the broader PASS-auth coverage ----
 
-/** Flexible ctx that binds any combination of account/services/away stores. */
+/** Flexible ctx that binds any combination of services/away stores. */
 function makeCtxPassAuth(
   state: ConnectionState,
   opts: {
-    accounts?: AccountStore;
     services?: ServicesStore;
     away?: AwayStore;
     serverPassword?: string;
@@ -1595,7 +1680,6 @@ function makeCtxPassAuth(
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
-    ...(opts.accounts !== undefined ? { accounts: opts.accounts } : {}),
     ...(opts.services !== undefined ? { services: opts.services } : {}),
     ...(opts.away !== undefined ? { away: opts.away } : {}),
   });
@@ -1607,16 +1691,16 @@ function sentTexts(effects: EffectType[]): string[] {
 }
 
 describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity with SASL)', () => {
-  it('forwards the parsed credentials to the AccountStore as a PLAIN verify', () => {
+  it('forwards the parsed credentials to services.verifyNick as a PLAIN verify', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'hunter2' } },
-    ]);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
+    expect(verifyNick).toHaveBeenCalledWith('alice', 'hunter2');
   });
 
   it('stamps read-only user mode `r` on a successful PASS-auth', () => {
@@ -1624,8 +1708,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.userModes.registered).toBe(true);
   });
 
@@ -1634,10 +1719,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setLastReadMarker('alice', '#foo', 'm1');
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.lastReadMarkers?.get('#foo')).toBe('m1');
   });
 
@@ -1646,10 +1731,11 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     const away = new InMemoryAwayStore();
     away.set('alice', 'brb');
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, away }));
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services, away }));
     expect(state.away).toBe('brb');
     expect(sentTexts(effects)).toContain(`:${SV} 306 alice :You have been marked as being away`);
   });
@@ -1663,18 +1749,87 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.registerNick('bob', 'pw', 'bob@example.com');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'hi', sentAt: 0 });
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(sentTexts(effects).some((t) => t.includes('[Memo #') && t.includes('hi'))).toBe(true);
   });
 
+  it('applies the assigned HostServ vhost on PASS-auth success so 001 carries the vhost', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.host = 'real.example.net';
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setVhost('alice', 'cool.example.net');
+    const ctx = makeCtxPassAuth(state, { services });
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    expect(state.account).toBe('alice');
+    expect(state.vhostActive).toBe(true);
+    expect(state.host).toBe('cool.example.net');
+    expect(state.preVhostHost).toBe('real.example.net');
+    const welcome = sentTexts(effects).find((t) => t.startsWith(`:${SV} 001 `));
+    expect(welcome).toBeDefined();
+    expect(welcome).toContain('cool.example.net');
+  });
+
+  it('does not apply a vhost on PASS-auth success when none is assigned', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.host = 'real.example.net';
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxPassAuth(state, { services });
+
+    emitWelcomeIfReady(state, ctx);
+
+    expect(state.vhostActive).toBeUndefined();
+    expect(state.host).toBe('real.example.net');
+  });
+
+  it('does not cloak over an active vhost applied during PASS-auth (vhost wins)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.host = '203.0.113.5';
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.setVhost('alice', 'cool.example.net');
+    const ctx: Ctx = buildCtx({
+      serverConfig: { ...serverConfig, cloaking: { enabled: true, secret: 's3cret' } },
+      clock: new FakeClock(1_000),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: state,
+      services,
+    });
+
+    const effects = emitWelcomeIfReady(state, ctx);
+
+    // The vhost was applied by the PASS-auth success chain; cloaking must not
+    // clobber it, and the 001 welcome must carry the vhost, not the cloak.
+    expect(state.vhostActive).toBe(true);
+    expect(state.host).toBe('cool.example.net');
+    const welcome = sentTexts(effects).find((t) => t.startsWith(`:${SV} 001 `));
+    expect(welcome).toContain('cool.example.net');
+    expect(welcome).not.toContain(
+      cloakHost('203.0.113.5', { enabled: true, secret: 's3cret' }, 'ExampleNet'),
+    );
+  });
+
   it('records the payload nick as the canonical account name', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.account).toBe('alice');
   });
 });
@@ -1685,8 +1840,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.userModes.registered).toBe(false);
@@ -1702,8 +1858,8 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'nobody';
     state.user = 'nobody';
     state.passAttempt = 'nobody:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
@@ -1719,17 +1875,15 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
-
-    expect(accounts.calls).toHaveLength(2);
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'wrong',
-    });
-    expect(accounts.calls[1]?.mech).toBe('PLAIN');
-    expect(accounts.calls[1]?.payload.kind).toBe('PLAIN');
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
+
+    expect(verifyNick).toHaveBeenCalledTimes(2);
+    expect(verifyNick.mock.calls[0]?.[0]).toBe('alice');
+    expect(verifyNick.mock.calls[0]?.[1]).toBe('wrong');
+    expect(verifyNick.mock.calls[1]?.[0]).not.toBe('alice');
   });
 
   it('treats a payload nick that does not match state.nick as a failed auth (no silent login)', () => {
@@ -1737,19 +1891,21 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'bob:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'bob' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
     // The store is never consulted on a nick mismatch.
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
   });
 });
 
 describe('emitWelcomeIfReady — PASS-auth interaction with the server-password gate', () => {
-  it('ignores the <nick>:<password> form when no AccountStore is bound (open gate)', () => {
+  it('ignores the <nick>:<password> form when no ServicesStore is bound (open gate)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
@@ -1761,7 +1917,28 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
   });
 
-  it('collapses to the server-password gate (464) when no AccountStore is bound and the colon form does not match', () => {
+  it('a SASL-identified connection (state.account set) satisfies the gate with no credential-store read', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice'; // SASL-identified before registration completion.
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(
+      state,
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
+    );
+
+    // The gate is satisfied by state.account; no PASS-auth verify fires.
+    expect(verifyNick).not.toHaveBeenCalled();
+    expect(state.registration).toBe('registered');
+    expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
+  });
+
+  it('collapses to the server-password gate (464) when no ServicesStore is bound and the colon form does not match', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
@@ -1780,10 +1957,11 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     const effects = emitWelcomeIfReady(
       state,
-      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
     );
 
     expect(state.registration).not.toBe('registered');
@@ -1800,10 +1978,12 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.user = 'alice';
     state.account = 'alice'; // SASL-identified before registration completion
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(state.registration).toBe('registered');
     // No 900/903 are re-emitted by PASS-auth; SASL already emitted them.
     expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
@@ -1814,13 +1994,15 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 's3cret';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
     const effects = emitWelcomeIfReady(
       state,
-      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
     );
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
     expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
@@ -1833,8 +2015,9 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
     state.user = 'alice';
     // state.nick intentionally undefined — PASS arrived before NICK.
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBe('alice');
     expect(effects.some((e) => e.tag === 'Send')).toBe(true);
@@ -1843,26 +2026,31 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
   it('returns no effects when no PASS was sent', () => {
     const state = makeState();
     state.nick = 'alice';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
   });
 
   it('returns no effects for a bare PASS value (no colon)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = 's3cret';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('returns no effects when the nick portion is empty (`:password`)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = ':hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('splits only on the first colon so a password may contain colons', () => {
@@ -1870,16 +2058,13 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:p:ass:word';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'p:ass:word',
-    });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'p:ass:word', 'alice@example.com');
+    passBasedAccountAuth(state, makeCtxPassAuth(state, { services }));
+    expect(state.account).toBe('alice');
   });
 
-  it('returns no effects when no AccountStore is bound', () => {
+  it('returns no effects when no ServicesStore is bound', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = 'alice:hunter2';
@@ -1940,3 +2125,46 @@ describe('applyAccountSuccess — shared account-login helper', () => {
     expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
   });
 });
+
+// ============================================================================
+// applyAccountSuccess — HostServ vhost auto-apply (SASL + PASS-auth share it)
+// ============================================================================
+
+describe('applyAccountSuccess — HostServ vhost auto-apply', () => {
+  it('applies an assigned vhost to state.host and sets vhostActive when services hold a vhost for the account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.setVhost('alice', 'cool.example.net');
+    const state = registeredState();
+    state.host = 'real.example.net';
+    const ctx = makeCtxWithServices(state, services);
+
+    applyAccountSuccess(state, ctx, 'alice');
+
+    expect(state.vhostActive).toBe(true);
+    expect(state.host).toBe('cool.example.net');
+    expect(state.preVhostHost).toBe('real.example.net');
+  });
+
+  it('leaves state.host unchanged when no vhost is assigned to the account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const state = registeredState();
+    state.host = 'real.example.net';
+    const ctx = makeCtxWithServices(state, services);
+
+    applyAccountSuccess(state, ctx, 'alice');
+
+    expect(state.vhostActive).toBeUndefined();
+    expect(state.host).toBe('real.example.net');
+  });
+
+  it('does not emit a CHGHOST broadcast when no channels are joined (pre-JOIN identify)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.setVhost('alice', 'cool.example.net');
+    const state = registeredState();
+    const ctx = makeCtxWithServices(state, services);
+
+    const effects = applyAccountSuccess(state, ctx, 'alice');
+
+    expect(effects.filter((e) => e.tag === 'Broadcast')).toEqual<EffectType[]>([]);
+  });
+});