serverless-ircd 0.9.0 → 0.10.0

package/packages/aws-adapter/tests/default-occ.test.ts

@@ -0,0 +1,219 @@
+/**
+ * Tests for the optimistic-concurrency state persist in `$default`
+ * (`handleDefault` + `buildPersistUpdate` + `isConditionalCheckFailed`).
+ *
+ * Background: API Gateway dispatches a client's rapid frames (CAP END,
+ * NICK, USER) as CONCURRENT Lambda invocations that each
+ * read-modify-write the same Connections row. Without a revision guard,
+ * the last writer wins and clobbers the others — the registration
+ * deadlock where `CAP END`'s `capNegotiating=false` was overwritten by
+ * `NICK`/`USER`'s stale read, so `001 RPL_WELCOME` never fired.
+ *
+ * The fix: every persist is a conditional `UpdateItem` requiring
+ * `revision = :expected` (bumped atomically); a
+ * `ConditionalCheckFailedException` triggers a re-read + re-run retry
+ * loop in `handleDefault`.
+ */
+
+import { GetCommand, UpdateCommand } from '@aws-sdk/lib-dynamodb';
+import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+import {
+  type ParsedServerConfig,
+  StaticMotdProvider,
+  createConnection,
+} from '@serverless-ircd/irc-core';
+import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
+import { describe, expect, it } from 'vitest';
+import {
+  buildPersistUpdate,
+  handleDefault,
+  isConditionalCheckFailed,
+} from '../src/handlers/default.js';
+import { marshalConnection } from '../src/serialize.js';
+import type { TablesConfig } from '../src/tables.js';
+
+const SERVER_CONFIG: ParsedServerConfig = makeTestServerConfig({
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  motdLines: ['Welcome'],
+});
+const MOTD = new StaticMotdProvider(SERVER_CONFIG.motdLines);
+const TABLES: TablesConfig = {
+  Connections: 'Connections',
+  ChannelMeta: 'ChannelMeta',
+  ChannelMembers: 'ChannelMembers',
+  Nicks: 'Nicks',
+  Services: 'Services',
+};
+
+describe('buildPersistUpdate — optimistic-concurrency revision guard', () => {
+  it('adds an ADD #rev :revInc clause to the update expression', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7);
+    expect(expr.updateExpression).toContain('ADD #rev :revInc');
+  });
+
+  it('gates the write on attribute_not_exists(#rev) OR #rev = :expectedRev', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7);
+    expect(expr.conditionExpression).toBe('attribute_not_exists(#rev) OR #rev = :expectedRev');
+  });
+
+  it('binds #rev to the revision column and :expectedRev to the read revision', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7);
+    expect(expr.expressionAttributeNames['#rev']).toBe('revision');
+    expect(expr.expressionAttributeValues[':expectedRev']).toBe(7);
+    expect(expr.expressionAttributeValues[':revInc']).toBe(1);
+  });
+});
+
+describe('isConditionalCheckFailed', () => {
+  it('returns true for a DynamoDB ConditionalCheckFailedException', () => {
+    const err = new Error('The conditional request failed');
+    err.name = 'ConditionalCheckFailedException';
+    expect(isConditionalCheckFailed(err)).toBe(true);
+  });
+
+  it('returns false for an unrelated error name', () => {
+    const err = new Error('boom');
+    err.name = 'ProvisionedThroughputExceededException';
+    expect(isConditionalCheckFailed(err)).toBe(false);
+  });
+
+  it('returns false for non-object throws', () => {
+    expect(isConditionalCheckFailed(null)).toBe(false);
+    expect(isConditionalCheckFailed(undefined)).toBe(false);
+    expect(isConditionalCheckFailed('string throw')).toBe(false);
+  });
+});
+
+/**
+ * Minimal fake document client. It does NOT implement DynamoDB's
+ * expression semantics — it only:
+ *   - returns the seeded row on GetCommand;
+ *   - simulates a concurrent writer on UpdateCommand by failing the first
+ *     `failNextUpdates` writes with ConditionalCheckFailedException (and
+ *     bumping the row's revision so a re-read sees it), then succeeding.
+ * This is enough to exercise `handleDefault`'s retry loop.
+ */
+class FakeDynamo {
+  readonly items = new Map<string, Record<string, unknown>>();
+  failNextUpdates = 0;
+  updateCalls = 0;
+  getCalls = 0;
+
+  async send(cmd: unknown): Promise<{ Item?: Record<string, unknown> } | Record<string, never>> {
+    if (cmd instanceof GetCommand) {
+      this.getCalls += 1;
+      const input = (cmd as unknown as { input: { Key: { connectionId: string } } }).input;
+      const item = this.items.get(input.Key.connectionId);
+      return item === undefined ? {} : { Item: { ...item } };
+    }
+    if (cmd instanceof UpdateCommand) {
+      this.updateCalls += 1;
+      const input = (
+        cmd as unknown as {
+          input: {
+            Key: { connectionId: string };
+            ExpressionAttributeValues?: Record<string, unknown>;
+          };
+        }
+      ).input;
+      const key = input.Key.connectionId;
+      if (this.failNextUpdates > 0) {
+        this.failNextUpdates -= 1;
+        // Simulate a concurrent writer landing first: bump the row's
+        // revision so the next read sees the conflict.
+        const cur = this.items.get(key);
+        if (cur !== undefined) {
+          cur.revision = ((cur.revision as number | undefined) ?? 0) + 1;
+        }
+        const err = new Error('The conditional request failed');
+        err.name = 'ConditionalCheckFailedException';
+        throw err;
+      }
+      // Success: bump revision (ADD #rev :revInc) and apply the simple
+      // SETs the assertions care about.
+      const cur = this.items.get(key);
+      if (cur !== undefined) {
+        cur.revision = ((cur.revision as number | undefined) ?? 0) + 1;
+        const vals = input.ExpressionAttributeValues ?? {};
+        if (vals[':capN'] !== undefined) cur.capNegotiating = vals[':capN'];
+      }
+      return {};
+    }
+    return {};
+  }
+}
+
+describe('handleDefault — optimistic-concurrency retry loop', () => {
+  it('retries read→run→persist when concurrent writes race, then returns 200', async () => {
+    const connId = 'c1';
+    const state = createConnection({ id: connId, connectedSince: 1000 });
+    // Mid-CAP-negotiation so CAP END is a meaningful, peer-free frame.
+    state.capNegotiating = true;
+    const dynamo = new FakeDynamo();
+    dynamo.items.set(connId, { ...marshalConnection(state, 1000) });
+    // Two concurrent invocations write first (conditional-check failures).
+    dynamo.failNextUpdates = 2;
+
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: connId,
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+
+    expect(result.statusCode).toBe(200);
+    // 2 failed writes + 1 committed write, and a re-read per attempt.
+    expect(dynamo.updateCalls).toBe(3);
+    expect(dynamo.getCalls).toBe(3);
+    // Final committed state reflects this invocation's mutation and the
+    // revision bumps (2 concurrent + 1 own = 3).
+    const finalRow = dynamo.items.get(connId);
+    expect(finalRow?.capNegotiating).toBe(false);
+    expect(finalRow?.revision).toBe(3);
+  });
+
+  it('commits on the first try when there is no contention', async () => {
+    const connId = 'c2';
+    const state = createConnection({ id: connId, connectedSince: 1000 });
+    state.capNegotiating = true;
+    const dynamo = new FakeDynamo();
+    dynamo.items.set(connId, { ...marshalConnection(state, 1000) });
+
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: connId,
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+
+    expect(result.statusCode).toBe(200);
+    expect(dynamo.updateCalls).toBe(1);
+    expect(dynamo.getCalls).toBe(1);
+    expect(dynamo.items.get(connId)?.capNegotiating).toBe(false);
+  });
+
+  it('returns 410 when the connection row is missing (not retried)', async () => {
+    const dynamo = new FakeDynamo();
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: 'ghost',
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+    expect(result.statusCode).toBe(410);
+    expect(dynamo.updateCalls).toBe(0);
+  });
+});

package/packages/aws-adapter/tests/dynamo-services-store-unit.test.ts

@@ -163,6 +163,17 @@ describe('DynamoServicesStore — round-trip via fake DDB', () => {
     expect(reloaded.getNickEnforce('alice')).toBe('kill');
   });
 
+  it('persists SET PASSWORD and round-trips the new credential', async () => {
+    const { store, client } = await fresh();
+    store.registerNick('alice', 'hunter2', 'a@x');
+    store.setNickPassword('alice', 'newpassword');
+    await store.flush();
+
+    const reloaded = await reload(client);
+    expect(reloaded.verifyNick('alice', 'newpassword')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const { store, client } = await fresh();
     store.registerNick('alice', 'pw', 'a@x');

package/packages/aws-adapter/tests/handlers.test.ts

@@ -8,16 +8,13 @@
 
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
 import { GetCommand } from '@aws-sdk/lib-dynamodb';
-import {
-  InMemoryAccountStore,
-  type ParsedServerConfig,
-  StaticMotdProvider,
-} from '@serverless-ircd/irc-core';
+import { type ParsedServerConfig, StaticMotdProvider } from '@serverless-ircd/irc-core';
 import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime } from '../src/aws-runtime.js';
 import type { PostToConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
+import { DynamoServicesStore } from '../src/dynamo-services-store.js';
 import { createDynamoDocumentClient } from '../src/dynamo.js';
 import {
   type HandlerDeps,
@@ -262,6 +259,107 @@ describe.skipIf(!available)('handlers', () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  // $connect Origin allowlist (CSWSH defence)
+  // -------------------------------------------------------------------------
+
+  describe('$connect Origin allowlist (CSWSH defence)', () => {
+    it('denies a disallowed Origin with 403 when WEB_ORIGINS is set', async () => {
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-cswsh' },
+          headers: { Origin: 'https://attacker.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(403);
+      // The denied upgrade must NOT persist a Connections row — a
+      // subsequent $default for the same id hits the missing-row path.
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect(await probe.getConnectionInfo('c-cswsh')).toBeNull();
+    });
+
+    it('admits an allowed Origin (200 + persisted row)', async () => {
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-ok-origin' },
+          headers: { Origin: 'https://app.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(200);
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect((await probe.getConnectionInfo('c-ok-origin'))?.id).toBe('c-ok-origin');
+    });
+
+    it('matches an `Origin` header served lowercased by APIGW', async () => {
+      // API Gateway normalises header keys to lowercase; the handler
+      // MUST find `origin` (not just `Origin`) so a CSWSH defence
+      // bypass cannot hide behind header-key casing.
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-lower' },
+          headers: { origin: 'https://attacker.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(403);
+    });
+
+    it('admits a missing Origin header (non-browser client)', async () => {
+      // curl / WeeChat / the tcp-ws-forwarder never send `Origin`;
+      // their upgrades must pass through unchanged even when the
+      // allowlist is configured.
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c-cli' } },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(200);
+    });
+
+    it('skips the check entirely when WEB_ORIGINS is unset', async () => {
+      // The default — defence is opt-in. Existing AWS deployments
+      // without a web frontend must be unchanged on upgrade: any
+      // Origin (including an obviously hostile one) proceeds.
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-unset' },
+          headers: { Origin: 'https://attacker.example.com' },
+        },
+        requireFx().deps, // no webOrigins
+      );
+      expect(res.statusCode).toBe(200);
+    });
+  });
+
   // -------------------------------------------------------------------------
   // $disconnect
   // -------------------------------------------------------------------------
@@ -693,7 +791,7 @@ describe.skipIf(!available)('handlers', () => {
       expect(replay).toBeDefined();
     });
 
-    it('completes SASL PLAIN with 900/903 when an AccountStore is bound', async () => {
+    it('completes SASL PLAIN with 900/903 when a ServicesStore is bound', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
         requireFx().deps,
@@ -704,10 +802,18 @@ describe.skipIf(!available)('handlers', () => {
           if (line.length > 0) sink.push(line);
         }
       });
-      // Swap in a deps with a seeded AccountStore for this dispatch.
-      const depsWithAccounts: HandlerDeps = {
+      // Swap in a deps with a seeded ServicesStore for this dispatch.
+      // The store is constructed against the test's DynamoDB client so the
+      // post-dispatch flush succeeds; the registration lives in the
+      // in-memory cache so SASL PLAIN resolves it synchronously.
+      const servicesStore = new DynamoServicesStore({
+        docClient: requireFx().client,
+        tableName: requireFx().tables.Services ?? 'Services',
+      });
+      servicesStore.registerNick('aws-sasl', 's3cret', '');
+      const depsWithServices: HandlerDeps = {
         ...requireFx().deps,
-        accounts: new InMemoryAccountStore([{ username: 'aws-sasl', password: 's3cret' }]),
+        services: servicesStore,
       };
       const payload = Buffer.from('\0aws-sasl\0s3cret', 'utf8').toString('base64');
       await dispatch(
@@ -715,14 +821,14 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: `CAP REQ :sasl\r\nAUTHENTICATE PLAIN\r\nAUTHENTICATE ${payload}\r\n`,
         },
-        depsWithAccounts,
+        depsWithServices,
       );
       expect(sink.some((l) => l.includes(' 900 '))).toBe(true);
       expect(sink.some((l) => l.includes(' 903 '))).toBe(true);
       expect(sink.some((l) => l.includes(' 904 '))).toBe(false);
     });
 
-    it('emits 904 when no AccountStore is bound (regression guard)', async () => {
+    it('emits 904 when no ServicesStore is bound (regression guard)', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c2' } },
         requireFx().deps,

package/packages/aws-adapter/tests/migrate-accounts-to-services.test.ts

@@ -0,0 +1,164 @@
+/**
+ * Unit tests for the pure helpers exported from `tools/migrate-accounts-to-services.ts`.
+ *
+ * The helpers are side-effect-free (the CLI entry point is guarded behind
+ * `void main()` which only runs when the module is executed directly), so
+ * they can be imported and tested without triggering wrangler / DynamoDB
+ * IO.
+ */
+
+import {
+  type LegacyAccountRow,
+  buildMigrationSql,
+  buildServicesPutItem,
+  parseSaslAccountsForMigration,
+} from '@serverless-ircd/irc-core';
+import { describe, expect, it } from 'vitest';
+
+describe('parseSaslAccountsForMigration', () => {
+  it('returns an empty array for undefined', () => {
+    expect(parseSaslAccountsForMigration(undefined)).toEqual([]);
+  });
+
+  it('returns an empty array for an empty string', () => {
+    expect(parseSaslAccountsForMigration('')).toEqual([]);
+  });
+
+  it('parses a single username:password entry', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret')).toEqual([
+      { username: 'alice', password: 's3cret' },
+    ]);
+  });
+
+  it('parses multiple newline-delimited entries', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret\nbob:pw')).toEqual([
+      { username: 'alice', password: 's3cret' },
+      { username: 'bob', password: 'pw' },
+    ]);
+  });
+
+  it('skips blank lines and malformed entries', () => {
+    expect(
+      parseSaslAccountsForMigration('alice:s3cret\n\nnocolon\n:emptyuser\nemptypass:\n   \n'),
+    ).toEqual([{ username: 'alice', password: 's3cret' }]);
+  });
+});
+
+describe('buildMigrationSql — D1 migration SQL', () => {
+  const legacyRow = (account: string, salt = 'salt', hash = 'hash'): LegacyAccountRow => ({
+    account,
+    algorithm: 'scrypt',
+    salt,
+    hash,
+  });
+
+  it('(a) creates a nickserv_accounts row with cert_subjects "[]" for a legacy account', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    // First statement is CREATE TABLE.
+    expect(stmts[0]).toContain('CREATE TABLE IF NOT EXISTS nickserv_accounts');
+    // Second statement is the INSERT OR IGNORE for alice.
+    expect(stmts[1]).toContain('INSERT OR IGNORE INTO nickserv_accounts');
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'[]'");
+    expect(stmts[1]).toContain("'scrypt'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[1]).toContain("'hash'");
+  });
+
+  it('uses INSERT OR IGNORE (never INSERT OR REPLACE) so existing rows are never clobbered', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts[1]).toContain('INSERT OR IGNORE');
+    expect(stmts[1]).not.toContain('INSERT OR REPLACE');
+  });
+
+  it('(c) a legacy row never overwrites an existing NickServ registration (INSERT OR IGNORE)', () => {
+    // The SQL is INSERT OR IGNORE — if the nick_key already exists in
+    // nickserv_accounts, the INSERT is a no-op. The generated SQL encodes
+    // this; running it twice produces the same statements.
+    const stmts1 = buildMigrationSql([legacyRow('alice')], undefined);
+    const stmts2 = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts1).toEqual(stmts2);
+  });
+
+  it('carries SASL_ACCOUNTS env-seed entries not already in the legacy table', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], 'bob:bobspw\nalice:alicespw');
+    // CREATE TABLE + alice (legacy) + bob (env-seed).
+    // alice is in the legacy table so the env-seed alice is NOT duplicated.
+    expect(stmts).toHaveLength(3);
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[2]).toContain("'bob'");
+    // bob's credential is freshly hashed from the plaintext password.
+    expect(stmts[2]).not.toContain("'bobspw'");
+  });
+
+  it('does not re-hash legacy rows (preserves the pre-hashed scrypt credential verbatim)', () => {
+    const stmts = buildMigrationSql([legacyRow('alice', 'mysalt', 'myhash')], undefined);
+    expect(stmts[1]).toContain("'mysalt'");
+    expect(stmts[1]).toContain("'myhash'");
+  });
+
+  it('produces only CREATE TABLE when both legacy rows and env-seed are empty', () => {
+    const stmts = buildMigrationSql([], undefined);
+    expect(stmts).toHaveLength(1);
+    expect(stmts[0]).toContain('CREATE TABLE');
+  });
+
+  it('escapes single quotes in usernames to prevent SQL injection', () => {
+    const stmts = buildMigrationSql([legacyRow("O'Brien")], undefined);
+    expect(stmts[1]).toContain("'O''Brien'");
+    expect(stmts[1]).not.toContain("'O'Brien'");
+  });
+});
+
+describe('buildServicesPutItem — DynamoDB migration', () => {
+  it('targets the NICK:<fold> partition with the nick-type discriminator', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'StagingServices',
+    );
+    expect(input.TableName).toBe('StagingServices');
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.sk).toBe('#');
+    expect(input.Item.type).toBe('nick');
+  });
+
+  it('preserves the legacy scrypt credential fields on the item', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 'mysalt', hash: 'myhash' },
+      'Services',
+    );
+    expect(input.Item.algorithm).toBe('scrypt');
+    expect(input.Item.salt).toBe('mysalt');
+    expect(input.Item.hash).toBe('myhash');
+  });
+
+  it('defaults certSubjects to an empty array', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.certSubjects).toEqual([]);
+  });
+
+  it('folds the nick case-insensitively into the partition key', () => {
+    const input = buildServicesPutItem(
+      { account: 'Alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    // rfc1459 folding: Alice → alice
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.nick).toBe('Alice');
+    expect(input.Item.account).toBe('Alice');
+  });
+
+  it('stamps the default email / enforce / createdAt fields', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.email).toBe('');
+    expect(input.Item.enforce).toBe('none');
+    expect(input.Item.createdAt).toBe(0);
+  });
+});