serverless-ircd 0.8.0 → 0.10.0

package/tools/load-test/tests/client.test.ts

@@ -1,7 +1,8 @@
+import { EventEmitter } from 'node:events';
 import { type LocalServer, startLocalServer } from '@serverless-ircd/local-cli/dist/server.js';
-import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
 import { WebSocketServer } from 'ws';
-import { IrcLoadClient } from '../src/client';
+import { IrcLoadClient, type WebSocketCtor } from '../src/client';
 import { resolveConfig } from '../src/config';
 
 /**
@@ -210,3 +211,258 @@ function startDroppingWsServer(): Promise<{ port: number; close: () => Promise<v
     wss.once('error', onError);
   });
 }
+
+// ---------------------------------------------------------------------------
+// Failure-path coverage via an injectable fake WebSocket.
+//
+// The client accepts a `WebSocketCtor` dependency (client.ts) so the lifecycle
+// can be driven against a scriptable fake. The four tests below exercise the
+// branches that are impractical to reach through a real socket: connect
+// timeout (socket never opens), join timeout, privmsg timeout, and a socket
+// `error` event fanning out to pending waiters mid-wait.
+// ---------------------------------------------------------------------------
+
+/** A reply the fake fires when the client sends a matching line. */
+type FakeHandler = {
+  match: RegExp;
+  action: { kind: 'messages'; lines: string[] } | { kind: 'error'; error: unknown };
+};
+
+/** Module-level fake controller state (reset per test in beforeEach). */
+let fakeAutoOpen = true;
+let fakeHandlers: FakeHandler[] = [];
+let fakeReadyState: number | undefined;
+let fakeErrorOnClose = false;
+let lastFake: FakeSocket | undefined;
+
+/**
+ * Minimal WebSocket stand-in. Emits `open` on the next microtask (so the
+ * client's `once('open')` listener is attached first), and on `send()` fires
+ * any scripted reply for the sent line. `emit('error', ...)` is used to drive
+ * the socket-error path.
+ */
+class FakeSocket extends EventEmitter {
+  readonly OPEN = 1;
+  readyState: number;
+  readonly sent: string[] = [];
+
+  constructor(_url: string, _protocols: string[]) {
+    super();
+    lastFake = this;
+    this.readyState = fakeReadyState ?? 1;
+    if (fakeAutoOpen) {
+      queueMicrotask(() => this.emit('open'));
+    }
+  }
+
+  send(line: string): void {
+    this.sent.push(line);
+    for (const h of fakeHandlers) {
+      if (h.match.test(line)) {
+        const action = h.action;
+        queueMicrotask(() => {
+          if (action.kind === 'messages') {
+            for (const text of action.lines) {
+              this.emit('message', Buffer.from(text, 'utf8'));
+            }
+          } else {
+            this.emit('error', action.error);
+          }
+        });
+      }
+    }
+  }
+
+  close(): void {
+    this.readyState = 3;
+    if (fakeErrorOnClose) {
+      this.emit('error', new Error('emitted on close'));
+    }
+  }
+}
+
+/**
+ * A WebSocketCtor whose constructor throws synchronously — drives the
+ * `this.ws === undefined` path in teardown.
+ */
+class ThrowingSocketCtor extends EventEmitter {
+  constructor(_url: string, _protocols: string[]) {
+    super();
+    throw new Error('constructor blew up');
+  }
+}
+
+describe('IrcLoadClient — failure paths (fake WebSocket)', () => {
+  beforeEach(() => {
+    fakeAutoOpen = true;
+    fakeHandlers = [];
+    fakeReadyState = undefined;
+    fakeErrorOnClose = false;
+    lastFake = undefined;
+  });
+
+  /** Resolves a config aimed at the fake, with short timeouts. */
+  function fakeCfg(
+    overrides: Parameters<typeof resolveConfig>[0] = {},
+  ): ReturnType<typeof resolveConfig> {
+    return resolveConfig({
+      target: 'ws://fake.local/',
+      channel: '#test',
+      nickPrefix: 'bot',
+      messagesPerClient: 0,
+      connectTimeoutMs: 1000,
+      registerTimeoutMs: 100,
+      ...overrides,
+    });
+  }
+
+  it('fails at connect when the socket never opens (connect timeout)', async () => {
+    fakeAutoOpen = false;
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ connectTimeoutMs: 50 }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.failedPhase).toBe('connect');
+    expect(result.error).toMatch(/connect timeout/i);
+  });
+
+  it('fails at join when the server never replies with 366', async () => {
+    // Registration completes (001 sent in reply to NICK); JOIN gets no 366
+    // so the join waiter times out. The reply bundles a blank line and a
+    // non-prefixed PING line alongside the 001 to also cover the empty-line
+    // skip (onMessage) and the non-':' prefix arm (numericOf).
+    fakeHandlers = [
+      {
+        match: /^NICK /u,
+        action: {
+          kind: 'messages',
+          lines: ['\r\nPING :keepalive\r\n:srv 001 bot0 :Welcome'],
+        },
+      },
+    ];
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ echoMessage: false }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.failedPhase).toBe('join');
+    expect(result.samples.register.length).toBe(1);
+    expect(lastFake?.sent.some((l) => l.startsWith('JOIN'))).toBe(true);
+  });
+
+  it('fails at privmsg when the echo never arrives', async () => {
+    // Registration + join succeed; the PRIVMSG echo never arrives so the
+    // privmsg waiter times out.
+    fakeHandlers = [
+      {
+        match: /^NICK /u,
+        action: { kind: 'messages', lines: [':srv 001 bot0 :Welcome'] },
+      },
+      {
+        match: /^JOIN /u,
+        action: { kind: 'messages', lines: [':srv 366 bot0 #test :End of NAMES'] },
+      },
+    ];
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ messagesPerClient: 1, echoMessage: false }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.failedPhase).toBe('privmsg');
+    expect(result.samples.register.length).toBe(1);
+    expect(result.samples.join.length).toBe(1);
+    expect(lastFake?.sent.some((l) => l.startsWith('PRIVMSG'))).toBe(true);
+  });
+
+  it('fails via onError when the socket errors during a pending wait', async () => {
+    // The socket errors mid-registration: the `on('error')` handler fans the
+    // error out to the pending register waiter via failWaiters.
+    fakeHandlers = [
+      {
+        match: /^NICK /u,
+        action: { kind: 'error', error: new Error('socket boom') },
+      },
+    ];
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ echoMessage: false }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe('socket boom');
+    // connect succeeded before the error fired.
+    expect(result.samples.connect.length).toBe(1);
+  });
+
+  it('coerces a non-Error rejection to a string error message', async () => {
+    // Some transports emit non-Error values on 'error'. The client's failedAt
+    // helper must fall back to String(err) rather than crash.
+    fakeHandlers = [
+      {
+        match: /^NICK /u,
+        action: { kind: 'error', error: 'stringy failure' },
+      },
+    ];
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ echoMessage: false }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe('stringy failure');
+  });
+
+  it('skips send() when the socket is not in the OPEN state', async () => {
+    // The fake reports CLOSED even though it emits 'open', so the send()
+    // readyState guard is exercised and no lines reach the wire.
+    fakeReadyState = 3;
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ echoMessage: false }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.failedPhase).toBe('register');
+    expect(lastFake?.sent.length).toBe(0);
+  });
+
+  it('ignores a socket error that arrives after teardown', async () => {
+    // The fake emits 'error' from close(); by the time teardown calls close()
+    // the client is already settled, so onError's guard short-circuits.
+    fakeErrorOnClose = true;
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ echoMessage: false }),
+      WebSocketCtor: FakeSocket as unknown as WebSocketCtor,
+    });
+    // register will time out (no 001), then teardown → close() → error is
+    // swallowed by the settled guard.
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.failedPhase).toBe('register');
+  });
+
+  it('handles a WebSocket constructor that throws synchronously', async () => {
+    // The constructor blowing up means this.ws is never assigned; teardown
+    // must skip the close path without crashing.
+    const client = new IrcLoadClient({
+      id: 0,
+      config: fakeCfg({ echoMessage: false }),
+      WebSocketCtor: ThrowingSocketCtor as unknown as WebSocketCtor,
+    });
+    const result = await client.run();
+    expect(result.ok).toBe(false);
+    expect(result.failedPhase).toBe('connect');
+    expect(result.error).toBe('constructor blew up');
+  });
+});

package/tools/load-test/tests/config.test.ts

@@ -69,6 +69,35 @@ describe('resolveConfig — validation (fail-fast)', () => {
   it('throws when the channel does not start with #', () => {
     expect(() => resolveConfig({ target: 'ws://x/', channel: 'loadtest' })).toThrow(/channel/i);
   });
+
+  it('throws when connectTimeoutMs is non-positive', () => {
+    expect(() => resolveConfig({ target: 'ws://x/', connectTimeoutMs: 0 })).toThrow(
+      /connect timeout/i,
+    );
+  });
+
+  it('throws when registerTimeoutMs is non-positive', () => {
+    expect(() => resolveConfig({ target: 'ws://x/', registerTimeoutMs: -1 })).toThrow(
+      /register timeout/i,
+    );
+  });
+
+  it('throws when rampMs is negative', () => {
+    expect(() => resolveConfig({ target: 'ws://x/', rampMs: -5 })).toThrow(/ramp-ms/i);
+  });
+
+  it('throws when messageIntervalMs is negative', () => {
+    expect(() => resolveConfig({ target: 'ws://x/', messageIntervalMs: -1 })).toThrow(
+      /message interval/i,
+    );
+  });
+});
+
+describe('resolveConfig — reportPath propagation', () => {
+  it('sets reportPath when provided', () => {
+    const cfg = resolveConfig({ target: 'ws://x/', reportPath: './out/report.md' });
+    expect(cfg.reportPath).toBe('./out/report.md');
+  });
 });
 
 describe('parseArgs — CLI flag parsing', () => {
@@ -107,6 +136,16 @@ describe('parseArgs — CLI flag parsing', () => {
     expect(() => parseArgs(['--target', 'ws://x/', '--bogus', '1'])).toThrow(/unknown argument/i);
   });
 
+  it('skips sparse (hole) entries in the argv array', () => {
+    // A hole at index 0 exercises the `a === undefined` guard in the parse
+    // loop; the remaining flags still resolve to a valid config.
+    const sparse: string[] = [];
+    sparse[1] = '--target';
+    sparse[2] = 'ws://x/';
+    const cfg = parseArgs(sparse);
+    expect(cfg.target).toBe('ws://x/');
+  });
+
   it('throws when --target is absent and no positional is given', () => {
     expect(() => parseArgs([])).toThrow(/target/i);
   });

package/tools/load-test/tests/harness.test.ts

@@ -81,6 +81,27 @@ describe('runLoadTest — aggregation', () => {
     const md = generateReport(run);
     expect(md).toContain('Latency');
   });
+
+  it('invokes onProgress as each client completes', async () => {
+    const calls: Array<{ done: number; total: number }> = [];
+    const factory = () => ({
+      run: async () =>
+        ({
+          id: 0,
+          ok: true,
+          samples: { connect: [1], register: [], join: [], privmsg: [] },
+        }) as ClientResult,
+    });
+    const run = await runLoadTest(cfg({ connections: 4, connectConcurrency: 2 }), {
+      clientFactory: factory,
+      onProgress: (done, total) => calls.push({ done, total }),
+    });
+    expect(run.summary.totalClients).toBe(4);
+    // Monotonic done counter, one call per client, total stays constant.
+    expect(calls.length).toBe(4);
+    expect(calls.every((c) => c.total === 4)).toBe(true);
+    expect(calls.map((c) => c.done)).toEqual([1, 2, 3, 4]);
+  });
 });
 
 describe('runLoadTest — concurrency cap', () => {

package/tools/load-test/tests/metrics.test.ts

@@ -59,6 +59,13 @@ describe('percentile (nearest-rank)', () => {
   it('throws for a percentile above 100 (programming error)', () => {
     expect(() => percentile([1, 2, 3], 101)).toThrow(/percentile/i);
   });
+
+  it('returns 0 for a NaN percentile (slips the range guard, hits the defensive fallback)', () => {
+    // NaN < 0 and NaN > 100 are both false, so NaN passes the range check.
+    // It then makes the index NaN, so sorted[NaN] is undefined and the
+    // `?? 0` fallback returns 0 rather than NaN.
+    expect(percentile([1, 2, 3], Number.NaN)).toBe(0);
+  });
 });
 
 describe('summarizePhase', () => {

package/tools/migrate-accounts-to-services.ts

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+/**
+ * Migration script: backfills rows from the legacy `accounts` / `Accounts`
+ * table into the unified `nickserv_accounts` / `Services` table BEFORE the
+ * build that drops the legacy table is deployed.
+ *
+ * The migration is:
+ *   - **One-shot**: run once per environment (staging then prod), then the
+ *     new build lands.
+ *   - **Idempotent**: re-running is a no-op — `INSERT OR IGNORE` (D1) /
+ *     conditional PutItem (DynamoDB) never clobbers an existing services
+ *     row.
+ *   - **Never-overwrite**: a nick already registered in the services table
+ *     (via NickServ REGISTER or a prior seed) wins; the legacy row's
+ *     credential is NOT copied over it.
+ *   - **Cert-subject carry-through**: the legacy `accounts` / `Accounts`
+ *     table has no `cert_subjects` column. The script reads the still-
+ *     deployed `SASL_ACCOUNTS` env var at run time; any account declared
+ *     there is registered (if not already present) so the env-seed
+ *     survives the table drop. The env-var format (`username:password`)
+ *     does NOT carry cert subjects, so `cert_subjects` defaults to `'[]'`
+ *     for every migrated row — matching today's effective behavior (SASL
+ *     EXTERNAL only worked against the static `InMemoryAccountStore`, never
+ *     against the hashed `accounts`/`Accounts` table).
+ *
+ * Usage (Cloudflare D1):
+ *   node --import tsx tools/migrate-accounts-to-services.ts \
+ *     --platform cf \
+ *     --database serverless-ircd-accounts \
+ *     --env staging \
+ *     --remote
+ *
+ * Usage (AWS DynamoDB):
+ *   node --import tsx tools/migrate-accounts-to-services.ts \
+ *     --platform aws \
+ *     --accounts-table StagingAccounts \
+ *     --services-table StagingServices \
+ *     --region us-east-1
+ *
+ * The `SASL_ACCOUNTS` env var is read at run time in both modes so any
+ * operator-declared seed accounts are carried into the services table.
+ */
+
+// ============================================================================
+// Pure helpers (re-exported from irc-core for testability)
+// ============================================================================
+
+export {
+  type LegacyAccountRow,
+  type ParsedSaslAccount,
+  buildMigrationSql,
+  buildServicesPutItem,
+  parseSaslAccountsForMigration,
+} from '@serverless-ircd/irc-core';
+import { caseFold } from '@serverless-ircd/irc-core';
+
+// ============================================================================
+// CLI entry point (only runs when executed directly via `node --import tsx`)
+// ============================================================================
+
+async function main(): Promise<void> {
+  const { execFileSync } = await import('node:child_process');
+  const { parseArgs } = await import('node:util');
+  const { values } = parseArgs({
+    options: {
+      platform: { type: 'string' },
+      database: { type: 'string', default: undefined },
+      env: { type: 'string', default: undefined },
+      remote: { type: 'boolean', default: false },
+      'accounts-table': { type: 'string', default: undefined },
+      'services-table': { type: 'string', default: undefined },
+      region: { type: 'string', default: undefined },
+      endpoint: { type: 'string', default: undefined },
+    },
+  });
+
+  const SASL_ACCOUNTS_RAW = process.env.SASL_ACCOUNTS;
+
+  if (values.platform === 'cf') {
+    await runCfMigration(values, SASL_ACCOUNTS_RAW, execFileSync);
+  } else if (values.platform === 'aws') {
+    await runAwsMigration(values, SASL_ACCOUNTS_RAW);
+  } else {
+    console.error(
+      'Usage: migrate-accounts-to-services --platform cf|aws [platform-specific flags]',
+    );
+    console.error('  cf:  --database <d1-name> [--env staging] [--remote]');
+    console.error(
+      '  aws: --accounts-table <name> --services-table <name> [--region <r>] [--endpoint <url>]',
+    );
+    process.exit(1);
+  }
+}
+
+type CfValues = {
+  database?: string;
+  env?: string;
+  remote?: boolean;
+};
+
+async function runCfMigration(
+  values: CfValues,
+  saslAccountsRaw: string | undefined,
+  execFileSync: typeof import('node:child_process').execFileSync,
+): Promise<void> {
+  if (values.database === undefined) {
+    console.error('CF migration requires --database <d1-name>');
+    process.exit(1);
+  }
+  const selectArgs = [
+    'd1',
+    'execute',
+    values.database,
+    '--command',
+    'SELECT account, algorithm, salt, hash FROM accounts',
+    '--json',
+  ];
+  if (values.env !== undefined) selectArgs.push('--env', values.env);
+  if (values.remote) selectArgs.push('--remote');
+
+  let legacyRows: LegacyAccountRow[] = [];
+  try {
+    const output = execFileSync('npx', ['wrangler', ...selectArgs], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'inherit'],
+    });
+    const parsed = JSON.parse(output) as Array<{ results?: Array<Record<string, unknown>> }>;
+    legacyRows = parsed
+      .flatMap((r) => r.results ?? [])
+      .filter(
+        (r): r is Record<string, string> =>
+          typeof r.account === 'string' &&
+          typeof r.algorithm === 'string' &&
+          typeof r.salt === 'string' &&
+          typeof r.hash === 'string',
+      )
+      .map((r) => ({
+        account: r.account,
+        algorithm: r.algorithm,
+        salt: r.salt,
+        hash: r.hash,
+      }));
+  } catch (err) {
+    console.error(`Could not read legacy accounts table: ${String(err)}`);
+    console.error('Continuing with SASL_ACCOUNTS env-seed carry-through only.');
+  }
+
+  const statements = buildMigrationSql(legacyRows, saslAccountsRaw);
+  for (const sql of statements) {
+    const execArgs = ['d1', 'execute', values.database, '--command', sql];
+    if (values.env !== undefined) execArgs.push('--env', values.env);
+    if (values.remote) execArgs.push('--remote');
+    execFileSync('npx', ['wrangler', ...execArgs], { stdio: 'inherit' });
+  }
+  console.log(
+    `CF migration complete: ${statements.length - 1} statement(s) executed ` +
+      `(${legacyRows.length} legacy rows + env-seed carry-through).`,
+  );
+}
+
+type AwsValues = {
+  'accounts-table'?: string;
+  'services-table'?: string;
+  region?: string;
+  endpoint?: string;
+};
+
+async function runAwsMigration(
+  values: AwsValues,
+  saslAccountsRaw: string | undefined,
+): Promise<void> {
+  if (values['accounts-table'] === undefined || values['services-table'] === undefined) {
+    console.error('AWS migration requires --accounts-table and --services-table');
+    process.exit(1);
+  }
+  const { PutCommand, ScanCommand } = await import('@aws-sdk/lib-dynamodb');
+  const { createDynamoDocumentClient, loadDynamoServicesStore } = await import(
+    '@serverless-ircd/aws-adapter'
+  );
+  const { SystemClock } = await import('@serverless-ircd/irc-core');
+
+  const clientOpts: Record<string, string> = {};
+  if (values.region !== undefined) clientOpts.region = values.region;
+  if (values.endpoint !== undefined) clientOpts.endpoint = values.endpoint;
+  const docClient = createDynamoDocumentClient(clientOpts);
+
+  const legacyRows: LegacyAccountRow[] = [];
+  try {
+    let exclusiveStartKey: Record<string, unknown> | undefined;
+    do {
+      const result = await docClient.send(
+        new ScanCommand({
+          TableName: values['accounts-table'],
+          ExclusiveStartKey: exclusiveStartKey,
+        }),
+      );
+      for (const item of result.Items ?? []) {
+        if (
+          typeof item.account === 'string' &&
+          typeof item.algorithm === 'string' &&
+          typeof item.salt === 'string' &&
+          typeof item.hash === 'string'
+        ) {
+          legacyRows.push({
+            account: item.account,
+            algorithm: item.algorithm,
+            salt: item.salt,
+            hash: item.hash,
+          });
+        }
+      }
+      exclusiveStartKey = result.LastEvaluatedKey;
+    } while (exclusiveStartKey !== undefined);
+  } catch (err) {
+    console.error(`Could not scan legacy Accounts table: ${String(err)}`);
+    console.error('Continuing with SASL_ACCOUNTS env-seed carry-through only.');
+  }
+
+  const seen = new Set<string>();
+  let legacyPutCount = 0;
+  for (const row of legacyRows) {
+    const nickKey = caseFold('rfc1459', row.account);
+    seen.add(nickKey);
+    const input = buildServicesPutItem(row, values['services-table']);
+    try {
+      await docClient.send(
+        new PutCommand({
+          ...input,
+          ConditionExpression: 'attribute_not_exists(pk)',
+        }),
+      );
+      legacyPutCount++;
+    } catch (err) {
+      const msg = String(err);
+      if (msg.includes('ConditionalCheckFailed')) {
+        console.log(`Skipped ${row.account} (already registered in services).`);
+      } else {
+        throw err;
+      }
+    }
+  }
+
+  const store = await loadDynamoServicesStore(docClient, values['services-table'], SystemClock);
+  if (store === undefined) {
+    console.error(`Could not load services store from ${values['services-table']}`);
+    process.exit(1);
+  }
+
+  let envSeedCount = 0;
+  for (const acct of parseSaslAccountsForMigration(saslAccountsRaw)) {
+    const nickKey = caseFold('rfc1459', acct.username);
+    if (seen.has(nickKey)) continue;
+    seen.add(nickKey);
+    const result = store.registerNick(acct.username, acct.password, '');
+    if (result.ok) {
+      envSeedCount++;
+      console.log(`Registered ${acct.username} from SASL_ACCOUNTS env seed.`);
+    } else {
+      console.log(`Skipped ${acct.username} (already registered in services).`);
+    }
+  }
+  await store.flush();
+
+  console.log(
+    `AWS migration complete: ${legacyRows.length} legacy rows scanned ` +
+      `(${legacyPutCount} PutItem'd), ${envSeedCount} env-seed accounts registered.`,
+  );
+}
+
+void main();

package/tools/package.json

@@ -4,6 +4,7 @@
   "type": "module",
   "dependencies": {
     "@serverless-ircd/aws-adapter": "workspace:*",
-    "@serverless-ircd/cf-adapter": "workspace:*"
+    "@serverless-ircd/cf-adapter": "workspace:*",
+    "@serverless-ircd/irc-core": "workspace:*"
   }
 }