serverless-ircd 0.8.0 → 0.9.0

package/packages/irc-core/tests/commands/chanserv.test.ts

@@ -5,7 +5,9 @@ import {
   SHORTHAND_LEVELS,
   chanservReducer,
   positiveMlockLetters,
+  resolveMembershipTarget,
 } from '../../src/commands/chanserv';
+import { Effect } from '../../src/effects';
 import type { Effect as EffectType } from '../../src/effects';
 import type { ServicesStore } from '../../src/ports';
 import {
@@ -15,6 +17,7 @@ import {
   SequentialIdFactory,
 } from '../../src/ports';
 import type { IrcMessage } from '../../src/protocol/messages';
+import { type RosterEntry, createChannel } from '../../src/state/channel';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
@@ -778,7 +781,7 @@ describe('chanservReducer — SET misc', () => {
     const out = chanservReducer(conn, privmsg('FROBNICATE'), ctx);
 
     expect(sentTexts(out.effects)).toContain(
-      ':ChanServ!ChanServ@services NOTICE alice :Unknown command. Available: REGISTER, DROP, INFO, SET, ACCESS, LEVELS, SOP, AOP, HOP, VOP',
+      ':ChanServ!ChanServ@services NOTICE alice :Unknown command. Available: REGISTER, DROP, INFO, SET, ACCESS, LEVELS, SOP, AOP, HOP, VOP, OP, DEOP, VOICE, DEVOICE, KICK, BAN, UNBAN',
     );
   });
 
@@ -1666,3 +1669,667 @@ describe('SHORTHAND_LEVELS / DEFAULT_CHANNEL_LEVELS constants', () => {
     }
   });
 });
+
+// ============================================================================
+// OP / DEOP / VOICE / DEVOICE
+// ============================================================================
+//
+// These four commands share a single prefix-broadcast + ApplyChannelDelta
+// shape. ChanServ cannot resolve nick → connId (it operates on
+// ConnectionState, not ChannelState), so the reducer emits a membership
+// delta carrying a `targetNick` hint and a placeholder `conn: ''`. The
+// actor layer resolves the nick against the channel roster at apply time:
+//   - resolved → the present op/voice fields are *patched* onto the
+//     existing roster entry (so op-ing a voiced user does not clear voice)
+//   - absent   → the delta is a no-op and ChanServ NOTICEs the caller
+//
+// The patch semantics (only fields present on the delta are applied) are
+// documented on `MembershipDelta.targetNick` in state/channel.ts and are
+// exercised by the `resolveMembershipTarget` helper tests at the bottom
+// of this file.
+
+/** Extracts the first ApplyChannelDelta effect from a reducer output. */
+function firstApplyChannelDelta(effects: EffectType[]): EffectType | undefined {
+  return effects.find((e) => e.tag === 'ApplyChannelDelta');
+}
+
+/** Extracts the first Broadcast effect from a reducer output. */
+function firstBroadcast(effects: EffectType[]): EffectType | undefined {
+  return effects.find((e) => e.tag === 'Broadcast');
+}
+
+describe('chanservReducer — OP', () => {
+  it('emits a +o broadcast, a targetNick-keyed delta, and a confirmation NOTICE from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [{ text: ':ChanServ!ChanServ@services MODE #home +o bob' }]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        memberships: [{ type: 'add', conn: '', nick: 'bob', targetNick: 'bob', op: true }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set mode +o on bob on #home.',
+    );
+  });
+
+  it('allows OP from an AUTOOP-level access-list user', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+  });
+
+  it('rejects OP from a non-privileged identified account with Permission denied', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('mallory', 'pw', 'm@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'mallory', 1);
+    const conn = makeConn('c1', 'mallory');
+    conn.account = 'mallory';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE mallory :Permission denied.',
+    );
+  });
+
+  it('rejects OP on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects OP when the caller is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before changing channel settings.',
+    );
+  });
+
+  it('rejects OP with a missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: OP <#channel> <nick>.',
+    );
+  });
+
+  it('rejects OP with a missing target nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: OP <#channel> <nick>.',
+    );
+  });
+
+  it('rejects OP with an invalid channel name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('OP bogus bob'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: OP <#channel> <nick>.',
+    );
+  });
+
+  it('is case-insensitive on the verb', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('op #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+  });
+});
+
+describe('chanservReducer — DEOP', () => {
+  it('emits a -o broadcast and a targetNick-keyned delta from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [{ text: ':ChanServ!ChanServ@services MODE #home -o bob' }]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        memberships: [{ type: 'add', conn: '', nick: 'bob', targetNick: 'bob', op: false }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set mode -o on bob on #home.',
+    );
+  });
+
+  it('rejects DEOP from a non-privileged caller', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('mallory', 'pw', 'm@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn('c1', 'mallory');
+    conn.account = 'mallory';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE mallory :Permission denied.',
+    );
+  });
+});
+
+describe('chanservReducer — VOICE', () => {
+  it('emits a +v broadcast and a targetNick-keyned delta from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('VOICE #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [{ text: ':ChanServ!ChanServ@services MODE #home +v bob' }]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        memberships: [{ type: 'add', conn: '', nick: 'bob', targetNick: 'bob', voice: true }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set mode +v on bob on #home.',
+    );
+  });
+});
+
+describe('chanservReducer — DEVOICE', () => {
+  it('emits a -v broadcast and a targetNick-keyned delta from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEVOICE #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [{ text: ':ChanServ!ChanServ@services MODE #home -v bob' }]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        memberships: [{ type: 'add', conn: '', nick: 'bob', targetNick: 'bob', voice: false }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set mode -v on bob on #home.',
+    );
+  });
+});
+
+// ============================================================================
+// KICK
+// ============================================================================
+
+describe('chanservReducer — KICK', () => {
+  it('emits a ChanServ KICK broadcast and a targetNick-keyned remove delta from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home bob :trolling'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [{ text: ':ChanServ!ChanServ@services KICK #home bob :trolling' }]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        memberships: [{ type: 'remove', conn: '', targetNick: 'bob' }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Kicked bob from #home.',
+    );
+  });
+
+  it('broadcasts KICK without a trailing reason when none is supplied', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [{ text: ':ChanServ!ChanServ@services KICK #home bob' }]),
+    );
+  });
+
+  it('rejects KICK from a non-founder AUTOOP user (founder-only)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Permission denied.',
+    );
+  });
+
+  it('rejects KICK on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects KICK when the caller is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home bob'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before changing channel settings.',
+    );
+  });
+
+  it('rejects KICK with a missing target nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: KICK <#channel> <nick> [:<reason>].',
+    );
+  });
+
+  it('rejects KICK with an invalid channel name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK bogus bob'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: KICK <#channel> <nick> [:<reason>].',
+    );
+  });
+});
+
+// ============================================================================
+// BAN / UNBAN
+// ============================================================================
+
+describe('chanservReducer — BAN', () => {
+  it('emits a +b broadcast, a banMaskChanges delta, and a confirmation NOTICE from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN #home *!*@badhost'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [
+        { text: ':ChanServ!ChanServ@services MODE #home +b *!*@badhost' },
+      ]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        banMaskChanges: [{ type: 'add', mask: '*!*@badhost' }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set ban *!*@badhost on #home.',
+    );
+  });
+
+  it('does NOT kick matching present members (documented: Atheme-style kick-on-ban is a follow-up)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN #home *!*@badhost'), ctx);
+
+    // The reducer emits no membership deltas (no kick), only the ban-mask add.
+    for (const e of out.effects) {
+      if (e.tag === 'ApplyChannelDelta') {
+        expect(e.delta.memberships ?? []).toEqual([]);
+      }
+    }
+  });
+
+  it('rejects BAN from a non-founder AUTOOP user (founder-only)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN #home *!*@badhost'), ctx);
+
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Permission denied.',
+    );
+  });
+
+  it('rejects BAN on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN #home *!*@badhost'), ctx);
+
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects BAN when the caller is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN #home *!*@badhost'), ctx);
+
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before changing channel settings.',
+    );
+  });
+
+  it('rejects BAN with a missing mask', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: BAN <#channel> <mask>.',
+    );
+  });
+
+  it('rejects BAN with an invalid channel name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('BAN bogus *!*@badhost'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: BAN <#channel> <mask>.',
+    );
+  });
+});
+
+describe('chanservReducer — UNBAN', () => {
+  it('emits a -b broadcast and a remove banMaskChanges delta from the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('UNBAN #home *!*@badhost'), ctx);
+
+    expect(firstBroadcast(out.effects)).toEqual(
+      Effect.broadcast('#home', [
+        { text: ':ChanServ!ChanServ@services MODE #home -b *!*@badhost' },
+      ]),
+    );
+    expect(firstApplyChannelDelta(out.effects)).toEqual(
+      Effect.applyChannelDelta('#home', {
+        banMaskChanges: [{ type: 'remove', mask: '*!*@badhost' }],
+      }),
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Removed ban *!*@badhost from #home.',
+    );
+  });
+
+  it('rejects UNBAN from a non-founder caller', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('UNBAN #home *!*@badhost'), ctx);
+
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Permission denied.',
+    );
+  });
+
+  it('rejects UNBAN with a missing mask', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('UNBAN #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: UNBAN <#channel> <mask>.',
+    );
+  });
+});
+
+// ============================================================================
+// Help / unknown notices include the new commands
+// ============================================================================
+
+describe('chanservReducer — help notice includes the new commands', () => {
+  it('lists OP/DEOP/VOICE/DEVOICE/KICK/BAN/UNBAN on empty body', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg(''), ctx);
+
+    const texts = sentTexts(out.effects);
+    for (const verb of ['OP', 'DEOP', 'VOICE', 'DEVOICE', 'KICK', 'BAN', 'UNBAN']) {
+      expect(texts.some((t) => t.includes(verb))).toBe(true);
+    }
+  });
+
+  it('lists the new commands in the unknown-command notice', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('FROBNICATE'), ctx);
+
+    const texts = sentTexts(out.effects);
+    for (const verb of ['OP', 'DEOP', 'VOICE', 'DEVOICE', 'KICK', 'BAN', 'UNBAN']) {
+      expect(texts.some((t) => t.includes(verb))).toBe(true);
+    }
+  });
+});
+
+// ============================================================================
+// resolveMembershipTarget helper
+// ============================================================================
+
+describe('resolveMembershipTarget', () => {
+  it('resolves a present nick (case-insensitive) to its connId', () => {
+    const chan = createChannel({ name: '#foo', nameLower: '#foo', createdAt: 0 });
+    const entry: RosterEntry = { conn: 'c2', nick: 'Bob', op: false, voice: false };
+    chan.members.set('c2', entry);
+
+    expect(resolveMembershipTarget(chan.members, 'bob')).toBe('c2');
+    expect(resolveMembershipTarget(chan.members, 'BOB')).toBe('c2');
+  });
+
+  it('returns undefined when the nick is not on the channel', () => {
+    const chan = createChannel({ name: '#foo', nameLower: '#foo', createdAt: 0 });
+    chan.members.set('c2', { conn: 'c2', nick: 'bob', op: false, voice: false });
+
+    expect(resolveMembershipTarget(chan.members, 'carol')).toBeUndefined();
+  });
+
+  it('returns undefined for an empty roster', () => {
+    const chan = createChannel({ name: '#foo', nameLower: '#foo', createdAt: 0 });
+
+    expect(resolveMembershipTarget(chan.members, 'bob')).toBeUndefined();
+  });
+});