serverless-ircd 0.8.0 → 0.10.0

package/packages/irc-core/tests/services-store.test.ts

@@ -11,6 +11,7 @@ import {
   type ReadMarkerEntry,
   type RegisteredNick,
   type ServicesAuthResult,
+  type ServicesSnapshot,
   type ServicesStore,
 } from '../src/ports';
 
@@ -116,6 +117,185 @@ describe('InMemoryServicesStore — NickServ IDENTIFY (verifyNick)', () => {
   });
 });
 
+// ============================================================================
+// NickServ CertFP — hydrate round-trip (legacy snapshot without certSubjects)
+// ============================================================================
+
+describe('InMemoryServicesStore — CertFP snapshot hydration', () => {
+  it('defaults certSubjects to [] when a legacy snapshot row omits the field', () => {
+    // Simulate a pre-certSubjects snapshot: the row is missing the field
+    // entirely (as if loaded from JSON written before the column existed).
+    const legacySnap: ServicesSnapshot = {
+      nicks: [
+        {
+          nick: 'alice',
+          account: 'alice',
+          email: 'a@x',
+          createdAt: NOW,
+          enforce: 'none',
+          certSubjects: undefined as unknown as string[],
+          credential: { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'aGVsbG8=' },
+        },
+      ],
+      channels: [],
+      access: [],
+      levels: [],
+      vhosts: [],
+      pendingVhosts: [],
+      memos: [],
+      readMarkers: [],
+      akills: [],
+      jupes: [],
+    };
+    const s = new InMemoryServicesStore({ clock: new FakeClock(NOW), snapshot: legacySnap });
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec !== undefined) {
+      expect(rec.certSubjects).toEqual([]);
+    }
+  });
+});
+
+// ============================================================================
+// NickServ CertFP — SASL EXTERNAL surface (verifyCertFP / addCertFP / removeCertFP)
+// ============================================================================
+
+describe('InMemoryServicesStore — NickServ CertFP (verifyCertFP)', () => {
+  it('returns ok with the account name for a known subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.verifyCertFP('CN=alice')).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('returns ok:false for an unknown subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    const out = s.verifyCertFP('CN=evil');
+    expect(out.ok).toBe(false);
+    if (out.ok) return;
+    expect(out.reason.length).toBeGreaterThan(0);
+  });
+
+  it('returns ok:false when no nick has any cert subject registered', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+  });
+
+  it('matches the subject case-sensitively (byte-exact)', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=Alice');
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+    expect(s.verifyCertFP('CN=Alice').ok).toBe(true);
+  });
+
+  it('resolves the account that owns the subject (multiple accounts)', () => {
+    const s = store();
+    s.registerNick('alice', 'pw', 'a@e');
+    s.registerNick('bob', 'pw', 'b@e');
+    s.addCertFP('bob', 'CN=bob');
+    expect(s.verifyCertFP('CN=bob')).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'bob',
+    });
+  });
+
+  it('exposes the registered subjects on the RegisteredNick record', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice-2');
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec === undefined) return;
+    expect(rec.certSubjects).toEqual(['CN=alice', 'CN=alice-2']);
+  });
+
+  it('defaults certSubjects to an empty array on a fresh registration', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec === undefined) return;
+    expect(rec.certSubjects).toEqual([]);
+  });
+});
+
+describe('InMemoryServicesStore — NickServ CertFP mutators (addCertFP / removeCertFP)', () => {
+  it('addCertFP attaches a subject to a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+  });
+
+  it('addCertFP is a no-op on an unregistered nick', () => {
+    const s = store();
+    s.addCertFP('ghost', 'CN=ghost');
+    expect(s.verifyCertFP('CN=ghost').ok).toBe(false);
+  });
+
+  it('addCertFP does not duplicate an already-attached subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+  });
+
+  it('addCertFP folds the nick case-insensitively', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.verifyCertFP('CN=alice')).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'Alice',
+    });
+  });
+
+  it('removeCertFP detaches a subject from a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.removeCertFP('alice', 'CN=alice')).toBe(true);
+    expect(s.getNick('alice')?.certSubjects).toEqual([]);
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+  });
+
+  it('removeCertFP returns false when the subject is not attached', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.removeCertFP('alice', 'CN=alice')).toBe(false);
+  });
+
+  it('removeCertFP returns false on an unregistered nick', () => {
+    const s = store();
+    expect(s.removeCertFP('ghost', 'CN=ghost')).toBe(false);
+  });
+
+  it('removeCertFP folds the nick case-insensitively but matches the subject byte-exactly', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=Alice');
+    expect(s.removeCertFP('ALICE', 'CN=alice')).toBe(false);
+    expect(s.removeCertFP('ALICE', 'CN=Alice')).toBe(true);
+  });
+
+  it('dropNick removes the attached cert subjects along with the registration', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.dropNick('alice');
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+  });
+});
+
 describe('InMemoryServicesStore — NickServ DROP (dropNick)', () => {
   it('returns true and removes the registration for a known nick', () => {
     const s = store();
@@ -175,6 +355,29 @@ describe('InMemoryServicesStore — NickServ SET ENFORCE (setNickEnforce)', () =
   });
 });
 
+describe('InMemoryServicesStore — NickServ SET PASSWORD (setNickPassword)', () => {
+  it('overwrites the credential so the new password verifies and the old does not', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.setNickPassword('alice', 'newpassword');
+    expect(s.verifyNick('alice', 'newpassword').ok).toBe(true);
+    expect(s.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('folds the nick case-insensitively', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.setNickPassword('alice', 'newpassword');
+    expect(s.verifyNick('ALICE', 'newpassword').ok).toBe(true);
+  });
+
+  it('is a no-op on an unregistered nick (the original credential, if any, is untouched)', () => {
+    const s = store();
+    s.setNickPassword('ghost', 'newpassword');
+    expect(s.isRegisteredNick('ghost')).toBe(false);
+  });
+});
+
 describe('InMemoryServicesStore — NickServ INFO (getNick)', () => {
   it('returns the full record for a registered nick', () => {
     const s = store();
@@ -186,6 +389,7 @@ describe('InMemoryServicesStore — NickServ INFO (getNick)', () => {
       email: 'alice@example.com',
       createdAt: NOW,
       enforce: 'none',
+      certSubjects: [],
     });
   });
 

package/packages/irc-core/vitest.config.ts

@@ -8,7 +8,12 @@ export default defineConfig({
       provider: 'v8',
       all: false,
       include: ['src/**/*.ts'],
-      exclude: ['src/**/index.ts'],
+      // `index.ts` files are barrel re-exports (no runtime logic);
+      // `messages.ts` is type-only (`interface` declarations that
+      // TypeScript erases to an empty module). v8 scores both 0%
+      // because they contain no executable statements — excluding
+      // them keeps the 100% threshold honest about real coverage.
+      exclude: ['src/**/index.ts', 'src/**/messages.ts'],
       reporter: ['text', 'html', 'json-summary'],
       thresholds: {
         lines: 100,

package/packages/irc-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-server",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Orchestration layer: IrcRuntime port, dispatch interpreter, ConnectionActor",
   "license": "BSD-3-Clause",

package/packages/irc-server/src/actor.ts

@@ -26,7 +26,6 @@
  */
 
 import {
-  type AccountStore,
   type AwayStore,
   CHANSERV_NICK,
   type ChanName,
@@ -56,6 +55,8 @@ import {
   Numerics,
   OPERSERV_NICK,
   type RawLine,
+  type Reducer,
+  SHORTCUT_TO_SERVICE,
   type ServerConfig,
   type ServerStats,
   type ServicesStore,
@@ -148,16 +149,6 @@ export interface ConnectionActorOptions {
    * opt in.
    */
   readonly messages?: MessageStore;
-  /**
-   * SASL account verification source (absent when no accounts are
-   * configured). When bound, `ctx.accounts` is defined so the
-   * `AUTHENTICATE` reducer can verify PLAIN credentials end-to-end.
-   * Omitted (→ `ctx.accounts` undefined) preserves the existing
-   * behaviour for callers/tests that do not opt in: a client completing
-   * `AUTHENTICATE PLAIN` receives `904 ERR_SASLFAIL` because no store
-   * can vouch for the credentials.
-   */
-  readonly accounts?: AccountStore;
   /**
    * mTLS client-cert identity source for SASL EXTERNAL (absent when mTLS
    * is not configured). When bound, `ctx.mtlsIdentity` is defined so the
@@ -269,7 +260,6 @@ export class ConnectionActor {
   private readonly ids: IdFactory;
   private readonly motd: MotdProvider;
   private readonly messages: MessageStore | undefined;
-  private readonly accounts: AccountStore | undefined;
   private readonly mtlsIdentity: MtlsIdentityProvider | undefined;
   private readonly history: NickHistoryStore | undefined;
   private readonly away: AwayStore | undefined;
@@ -323,7 +313,6 @@ export class ConnectionActor {
     this.ids = opts.ids;
     this.motd = opts.motd ?? EmptyMotdProvider;
     this.messages = opts.messages;
-    this.accounts = opts.accounts;
     this.mtlsIdentity = opts.mtlsIdentity;
     this.history = opts.history;
     this.away = opts.away;
@@ -509,7 +498,6 @@ export class ConnectionActor {
       motd: this.motd,
       connection: this.state,
       ...(this.messages !== undefined ? { messages: this.messages } : {}),
-      ...(this.accounts !== undefined ? { accounts: this.accounts } : {}),
       ...(this.mtlsIdentity !== undefined ? { mtlsIdentity: this.mtlsIdentity } : {}),
       ...(this.history !== undefined ? { history: this.history } : {}),
       ...(this.away !== undefined ? { away: this.away } : {}),
@@ -527,6 +515,28 @@ export class ConnectionActor {
       return this.accumulateMultilineLine(msg);
     }
 
+    // Service shortcut commands (Atheme/Anope convention): rewrite verbs
+    // like `NICKSERV IDENTIFY pw` / `NS INFO` / `CS REGISTER #home` to the
+    // canonical `PRIVMSG <ServiceNick> :<joined args>` and delegate to the
+    // existing service-routing path (`routeMessageTarget` →
+    // `serviceReducerFor`). `SHORTCUT_TO_SERVICE` is the single source of
+    // truth for the alias → service nick mapping; the service reducers run
+    // unchanged against the rewritten `params=[serviceNick, body]` shape.
+    const serviceShortcutTarget = SHORTCUT_TO_SERVICE.get(msg.command.toUpperCase());
+    if (serviceShortcutTarget !== undefined) {
+      const rewritten: IrcMessage = {
+        ...msg,
+        command: 'PRIVMSG',
+        params: [serviceShortcutTarget, msg.params.join(' ')],
+      };
+      return this.routeMessageTarget(
+        rewritten,
+        this.reducers.privmsgChannel,
+        this.reducers.privmsgUser,
+        ctx,
+      );
+    }
+
     switch (msg.command) {
       // -------- Connection-authority commands --------
       case 'PING':
@@ -1348,39 +1358,22 @@ export class ConnectionActor {
     }
     for (const target of targets) {
       const singleParamMsg: IrcMessage = { ...msg, params: [target, ...tail] };
+      const serviceReducer = this.serviceReducerFor(target, msg.command);
       if (isChannelTarget(target)) {
         const chan = this.channels.getOrCreateChannel(target);
         effects.push(...channelReducer(chan, singleParamMsg, ctx).effects);
-      } else if (
-        msg.command === 'PRIVMSG' &&
-        this.services !== undefined &&
-        caseFold('rfc1459', target) === caseFold('rfc1459', NICKSERV_NICK)
-      ) {
-        effects.push(...this.reducers.nickserv(this.state, singleParamMsg, ctx).effects);
-      } else if (
-        msg.command === 'PRIVMSG' &&
-        this.services !== undefined &&
-        caseFold('rfc1459', target) === caseFold('rfc1459', CHANSERV_NICK)
-      ) {
-        effects.push(...this.reducers.chanserv(this.state, singleParamMsg, ctx).effects);
-      } else if (
-        msg.command === 'PRIVMSG' &&
-        this.services !== undefined &&
-        caseFold('rfc1459', target) === caseFold('rfc1459', HOSTSERV_NICK)
-      ) {
-        effects.push(...this.reducers.hostserv(this.state, singleParamMsg, ctx).effects);
-      } else if (
-        msg.command === 'PRIVMSG' &&
-        this.services !== undefined &&
-        caseFold('rfc1459', target) === caseFold('rfc1459', MEMOSERV_NICK)
-      ) {
-        effects.push(...this.reducers.memoserv(this.state, singleParamMsg, ctx).effects);
-      } else if (
-        msg.command === 'PRIVMSG' &&
-        this.services !== undefined &&
-        caseFold('rfc1459', target) === caseFold('rfc1459', OPERSERV_NICK)
-      ) {
-        effects.push(...this.reducers.operserv(this.state, singleParamMsg, ctx).effects);
+      } else if (serviceReducer !== undefined) {
+        // Echo the sender's own PRIVMSG back BEFORE the service reducer's NOTICE
+        // reply — matching how every other PRIVMSG renders (your outgoing line
+        // first, then any reply). Without this ordering a client sees the
+        // service's response above its own message, which reads as a bug.
+        if (ctx.connection.caps.has('echo-message')) {
+          const hostmask = hostmaskOf(this.state) ?? this.state.nick ?? '?';
+          const text = singleParamMsg.params[1] ?? '';
+          const echoLine: RawLine = { text: `:${hostmask} PRIVMSG ${target} :${text}` };
+          effects.push(Effect.send(ctx.connId, [echoLine]));
+        }
+        effects.push(...serviceReducer(this.state, singleParamMsg, ctx).effects);
       } else {
         effects.push(...userReducer(this.state, singleParamMsg, ctx).effects);
       }
@@ -1388,6 +1381,26 @@ export class ConnectionActor {
     return effects;
   }
 
+  /**
+   * Resolves the service pseudo-client reducer for a nick target, or
+   * `undefined` when the target is not a service nick / the command is not
+   * `PRIVMSG` / no services store is bound. Centralised so the
+   * `echo-message` echo (and any future service-routing concern) lives in a
+   * single place rather than being duplicated across five near-identical
+   * branches. `NOTICE` / `TAGMSG` to a service nick intentionally return
+   * `undefined` so they fall through to the normal user-target reducer.
+   *
+   * The membership test is a table lookup against {@link SERVICE_REDUCER_KEYS}
+   * (built from the same `*_NICK` constants that back
+   * {@link SHORTCUT_TO_SERVICE}), so the service-nick list has one source of
+   * truth rather than a per-service `if`-chain here.
+   */
+  private serviceReducerFor(target: string, command: string): Reducer<ConnectionState> | undefined {
+    if (command !== 'PRIVMSG' || this.services === undefined) return undefined;
+    const key = SERVICE_REDUCER_KEYS.get(caseFold('rfc1459', target));
+    return key === undefined ? undefined : this.reducers[key];
+  }
+
   private unknownCommandEffect(command: string): EffectType {
     const nick = this.state.nick ?? '*';
     const code = Numerics.ERR_UNKNOWNCOMMAND.toString().padStart(3, '0');
@@ -1416,6 +1429,29 @@ function splitCsv(param: string): string[] {
   return param.split(',').filter((p) => p.length > 0);
 }
 
+/**
+ * Service reducer keys on {@link RoutedReducers}. Narrower than
+ * `keyof RoutedReducers` so the table lookup resolves to a
+ * `Reducer<ConnectionState>` without a widening cast.
+ */
+type ServiceReducerKey = 'nickserv' | 'chanserv' | 'hostserv' | 'memoserv' | 'operserv';
+
+/**
+ * rfc1459 case-folded service nick → reducer key. The single source of
+ * truth for "which targets are service nicks" — built from the canonical
+ * `*_NICK` constants that also back {@link SHORTCUT_TO_SERVICE}, so the
+ * dispatcher's shortcut rewrite and `serviceReducerFor`'s routing consult
+ * one set of service nicks rather than each maintaining its own
+ * hand-written `if`-chain.
+ */
+const SERVICE_REDUCER_KEYS: ReadonlyMap<string, ServiceReducerKey> = new Map([
+  [caseFold('rfc1459', NICKSERV_NICK), 'nickserv'],
+  [caseFold('rfc1459', CHANSERV_NICK), 'chanserv'],
+  [caseFold('rfc1459', HOSTSERV_NICK), 'hostserv'],
+  [caseFold('rfc1459', MEMOSERV_NICK), 'memoserv'],
+  [caseFold('rfc1459', OPERSERV_NICK), 'operserv'],
+]);
+
 /**
  * Resolves the `<server>` parameter shared by `LUSERS` / `STATS` (and any
  * future single-server-aware query verb). Returns `undefined` when the