serverless-ircd 0.8.0 → 0.10.0

package/packages/cf-adapter/tests/d1-account-store.test.ts

@@ -1,274 +0,0 @@
-/**
- * D1-backed SASL account store + precedence resolver.
- *
- * Exercises the real D1 round-trip via miniflare: `putAccountCredential`
- * writes a hashed row, `loadD1AccountStore` reads it back, and
- * `resolveAccountStore` applies the table-then-config precedence.
- */
-
-import { env } from 'cloudflare:test';
-import { hashAccountCredential } from '@serverless-ircd/irc-core';
-import { beforeEach, describe, expect, it } from 'vitest';
-import {
-  buildAccountPutStatement,
-  loadD1AccountStore,
-  putAccountCredential,
-  resolveAccountStore,
-} from '../src/d1-account-store';
-
-declare global {
-  namespace Cloudflare {
-    interface Env {
-      ACCOUNTS_DB: D1Database;
-    }
-  }
-}
-
-const CREATE_TABLE =
-  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
-
-async function resetDb(): Promise<void> {
-  await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
-  await env.ACCOUNTS_DB.exec(CREATE_TABLE);
-}
-
-describe('loadD1AccountStore', () => {
-  beforeEach(async () => {
-    await resetDb();
-  });
-
-  it('returns undefined when the table has no rows', async () => {
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeUndefined();
-  });
-
-  it('verifies an account after a row is written via putAccountCredential', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 's3cret');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 's3cret' }),
-    ).toEqual({ ok: true, account: 'alice' });
-  });
-
-  it('rejects a wrong password after round-trip', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'right');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
-      false,
-    );
-  });
-
-  it('loads multiple distinct accounts', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'a1');
-    await putAccountCredential(env.ACCOUNTS_DB, 'bob', 'b2');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.size).toBe(2);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'a1' }).ok).toBe(
-      true,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'b2' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('overwrites an existing account on re-seed', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'old');
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'new');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.size).toBe(1);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'old' }).ok).toBe(
-      false,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'new' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('skips rows missing required columns', async () => {
-    // Use a permissive table (no NOT NULL) to simulate a row with a missing
-    // salt — the production schema's NOT NULL prevents this, but the loader
-    // stays defensive against schema drift / manual edits.
-    await env.ACCOUNTS_DB.exec('DROP TABLE accounts');
-    await env.ACCOUNTS_DB.exec(
-      'CREATE TABLE accounts (account TEXT PRIMARY KEY, algorithm TEXT, salt TEXT, hash TEXT)',
-    );
-    await env.ACCOUNTS_DB.prepare(
-      "INSERT INTO accounts (account, algorithm, hash) VALUES ('bad', 'scrypt', 'bbbb')",
-    ).run();
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeUndefined();
-  });
-});
-
-describe('putAccountCredential', () => {
-  beforeEach(async () => {
-    await resetDb();
-  });
-
-  it('writes a hashed row that round-trips through the store', async () => {
-    const entry = await putAccountCredential(env.ACCOUNTS_DB, 'carol', 'p@ss');
-    expect(entry.account).toBe('carol');
-    expect(entry.algorithm).toBe('scrypt');
-
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'carol', password: 'p@ss' })).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-
-  it('never writes the plaintext password to the row', async () => {
-    const entry = await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'hunter2-secret');
-    expect(entry.account).not.toContain('hunter2');
-    expect(entry.salt).not.toContain('hunter2');
-    expect(entry.hash).not.toContain('hunter2');
-  });
-
-  it('matches a manually-hashed entry written via raw D1 insert', async () => {
-    const hashed = hashAccountCredential('dave', 'pw');
-    await env.ACCOUNTS_DB.prepare(
-      'INSERT INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)',
-    )
-      .bind(hashed.account, hashed.algorithm, hashed.salt, hashed.hash)
-      .run();
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'dave', password: 'pw' }).ok).toBe(
-      true,
-    );
-  });
-});
-
-describe('buildAccountPutStatement (seed SQL builder)', () => {
-  it('produces an INSERT OR REPLACE statement with scrypt-hashed values', () => {
-    const { entry, sql } = buildAccountPutStatement('alice', 's3cret');
-    expect(entry.account).toBe('alice');
-    expect(entry.algorithm).toBe('scrypt');
-    expect(sql).toContain('INSERT OR REPLACE INTO accounts');
-    // Plaintext must never appear in the SQL.
-    expect(sql).not.toContain('s3cret');
-  });
-
-  it('the generated SQL round-trips through loadD1AccountStore', async () => {
-    await resetDb();
-    const { sql } = buildAccountPutStatement('carol', 'p@ss');
-    await env.ACCOUNTS_DB.exec(sql);
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'carol', password: 'p@ss' })).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-
-  it('escapes single quotes in the username to avoid breaking the SQL', async () => {
-    await resetDb();
-    const { sql } = buildAccountPutStatement("o'brien", 'pw');
-    await env.ACCOUNTS_DB.exec(sql);
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: "o'brien", password: 'pw' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('escapes single quotes in the base64 hash output', () => {
-    // The hash is base64 so it won't contain quotes, but the escaper is
-    // still exercised — verify the SQL is well-formed.
-    const { sql } = buildAccountPutStatement('alice', 'secret');
-    // A valid INSERT with four quoted values.
-    expect(sql.match(/'/g)?.length).toBe(8);
-  });
-});
-
-describe('resolveAccountStore precedence', () => {
-  beforeEach(async () => {
-    await resetDb();
-  });
-
-  it('returns the D1 store when the table has rows (table wins)', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'table-secret');
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, 'envuser:env-secret');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'table-secret' }).ok,
-    ).toBe(true);
-    // Config account does NOT verify (table is authoritative).
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(false);
-  });
-
-  it('falls back to the SASL_ACCOUNTS seed when the table is empty', async () => {
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, 'envuser:env-secret');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(true);
-  });
-
-  it('returns undefined when the table is empty and no seed is set', async () => {
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, undefined);
-    expect(store).toBeUndefined();
-  });
-
-  it('returns undefined when the table is empty and the seed is blank', async () => {
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, '');
-    expect(store).toBeUndefined();
-  });
-
-  it('falls back to the seed when the D1 binding is undefined', async () => {
-    const store = await resolveAccountStore(undefined, 'envuser:env-secret');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveAccountStore seed parsing — malformed entries are skipped so a
-// trailing newline or partial edit does not break boot.
-// ---------------------------------------------------------------------------
-
-describe('resolveAccountStore — SASL_ACCOUNTS seed edge cases', () => {
-  it('skips blank lines within the seed', async () => {
-    const store = await resolveAccountStore(undefined, 'alice:secret\n\nbob:pw\n   \n');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' }).ok,
-    ).toBe(true);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'pw' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('skips lines with no colon separator', async () => {
-    const store = await resolveAccountStore(undefined, 'alice:secret\nnocolon\nbob:pw');
-    // Only the two well-formed entries are loaded.
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'nocolon', password: '' }).ok).toBe(
-      false,
-    );
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' }).ok,
-    ).toBe(true);
-  });
-
-  it('skips lines where the colon is at position 0', async () => {
-    const store = await resolveAccountStore(undefined, ':secret\nalice:valid');
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'valid' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('skips lines with an empty password', async () => {
-    const store = await resolveAccountStore(undefined, 'alice:\nbob:valid');
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'valid' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('returns undefined when every line is malformed', async () => {
-    const store = await resolveAccountStore(undefined, '\n   \n:no-user\nuser:');
-    expect(store).toBeUndefined();
-  });
-});

package/packages/irc-core/tests/account-store.test.ts

@@ -1,131 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  type AccountStore,
-  InMemoryAccountStore,
-  type SaslPayload,
-  type SaslResult,
-} from '../src/ports';
-
-/** Convenience: a PLAIN payload. */
-function plain(username: string, password: string): SaslPayload {
-  return { kind: 'PLAIN', username, password };
-}
-
-describe('InMemoryAccountStore — PLAIN', () => {
-  it('implements the AccountStore port', () => {
-    const store: AccountStore = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret' },
-    ]);
-    expect(store).toBeDefined();
-  });
-
-  it('accepts valid PLAIN credentials and returns the account name', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('alice', 'secret'));
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-
-  it('rejects a wrong password', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('alice', 'wrong'));
-    expect(out.ok).toBe(false);
-  });
-
-  it('rejects an unknown username', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('bob', 'secret'));
-    expect(out.ok).toBe(false);
-  });
-
-  it('matches the first of several configured accounts', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'a-secret' },
-      { username: 'bob', password: 'b-secret' },
-    ]);
-    expect(store.verify('PLAIN', plain('bob', 'b-secret'))).toEqual<SaslResult>({
-      ok: true,
-      account: 'bob',
-    });
-  });
-
-  it('rejects when constructed with an empty account list', () => {
-    const store = new InMemoryAccountStore([]);
-    const out = store.verify('PLAIN', plain('alice', 'secret'));
-    expect(out.ok).toBe(false);
-  });
-
-  it('does not confuse credentials across accounts (no password cross-match)', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'a-secret' },
-      { username: 'bob', password: 'b-secret' },
-    ]);
-    // bob's password with alice's username must fail.
-    expect(store.verify('PLAIN', plain('alice', 'b-secret')).ok).toBe(false);
-  });
-});
-
-describe('InMemoryAccountStore — mechanism handling', () => {
-  it('rejects an unsupported mechanism with a failure result', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('CRAM-MD5', { kind: 'RAW', data: 'whatever' });
-    expect(out.ok).toBe(false);
-  });
-
-  it('treats the mechanism name case-insensitively for PLAIN', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('plain', plain('alice', 'secret'));
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-});
-
-describe('InMemoryAccountStore — EXTERNAL (mTLS)', () => {
-  it('maps a known cert subject to its account', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
-    ]);
-    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=alice' });
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-
-  it('rejects an unknown cert subject', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
-    ]);
-    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=evil' });
-    expect(out.ok).toBe(false);
-  });
-
-  it('rejects EXTERNAL when no cert subjects are configured', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=alice' });
-    expect(out.ok).toBe(false);
-  });
-
-  it('treats the mechanism name case-insensitively for EXTERNAL', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
-    ]);
-    const out = store.verify('external', { kind: 'EXTERNAL', identity: 'CN=alice' });
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-
-  it('maps multiple accounts with distinct cert subjects', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'a', certSubject: 'CN=alice' },
-      { username: 'bob', password: 'b', certSubject: 'CN=bob' },
-    ]);
-    expect(store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=bob' })).toEqual<SaslResult>({
-      ok: true,
-      account: 'bob',
-    });
-  });
-});
-
-describe('InMemoryAccountStore — failure reason', () => {
-  it('returns a human-readable reason on failure', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('alice', 'wrong'));
-    if (out.ok) throw new Error('expected failure');
-    expect(out.reason.length).toBeGreaterThan(0);
-  });
-});