serverless-ircd 0.9.0 → 0.10.0

package/packages/aws-adapter/tests/origin-allowlist.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Unit tests for the `$connect` Origin-allowlist policy
+ * (`packages/aws-adapter/src/origin-allowlist.ts`).
+ *
+ * Mirrors the canonical CF Worker policy
+ * (`apps/cf-worker/src/origin-allowlist.ts`) for the parsing semantics
+ * (comma-separated, trimmed, lowercased) and the "missing Origin =
+ * non-browser → allow" branch. Deliberately diverges from CF by
+ * supporting ONLY the explicit-allowlist mode (the AWS SPA is served
+ * from a different CloudFront origin than the API Gateway WebSocket
+ * endpoint, so same-origin auto-derive does not apply); see the
+ * module docstring for the rationale.
+ */
+import { describe, expect, it } from 'vitest';
+import { decideConnectOrigin, parseWebOrigins } from '../src/origin-allowlist.js';
+
+describe('parseWebOrigins', () => {
+  it('returns an empty set for undefined input', () => {
+    expect(parseWebOrigins(undefined).size).toBe(0);
+  });
+
+  it('returns an empty set for an empty string', () => {
+    expect(parseWebOrigins('').size).toBe(0);
+  });
+
+  it('parses a single origin', () => {
+    expect(parseWebOrigins('https://app.example.com')).toEqual(
+      new Set(['https://app.example.com']),
+    );
+  });
+
+  it('parses multiple comma-separated origins', () => {
+    expect(parseWebOrigins('https://a.example.com,https://b.example.com')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+
+  it('trims whitespace around each entry', () => {
+    expect(parseWebOrigins('  https://a.example.com , https://b.example.com  ')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+
+  it('lowercases each entry so the match is case-insensitive on scheme/host', () => {
+    // Origins are scheme://host[:port]; scheme and host are case-insensitive
+    // per RFC 3986. Lowercasing the whole string is the simplest
+    // normalisation that matches the real browser-emitted form.
+    expect(parseWebOrigins('https://APP.Example.COM')).toEqual(
+      new Set(['https://app.example.com']),
+    );
+  });
+
+  it('drops empty entries (trailing comma tolerance)', () => {
+    expect(parseWebOrigins('https://a.example.com,,')).toEqual(new Set(['https://a.example.com']));
+  });
+
+  it('drops whitespace-only entries', () => {
+    expect(parseWebOrigins('https://a.example.com,   ,https://b.example.com')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+});
+
+describe('decideConnectOrigin', () => {
+  it('allows a missing Origin header (non-browser client)', () => {
+    // curl, WeeChat, and the tcp-ws-forwarder never send `Origin`;
+    // their upgrades must pass through unchanged so existing
+    // non-browser tooling keeps working.
+    expect(decideConnectOrigin(undefined, new Set(['https://app.example.com']))).toBe('allow');
+    expect(decideConnectOrigin(null, new Set(['https://app.example.com']))).toBe('allow');
+    expect(decideConnectOrigin('', new Set(['https://app.example.com']))).toBe('allow');
+  });
+
+  it('allows every Origin when the allowlist is empty (opt-in defense)', () => {
+    // Unset `WEB_ORIGINS` skips the check entirely — existing AWS
+    // deployments without a web frontend are unchanged on upgrade.
+    expect(decideConnectOrigin('https://attacker.example.com', new Set())).toBe('allow');
+    expect(decideConnectOrigin('https://app.example.com', new Set())).toBe('allow');
+  });
+
+  it('allows an Origin that is in the allowlist (case-insensitively)', () => {
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('https://app.example.com', allowlist)).toBe('allow');
+    // The header value is normalised (lowercased, trimmed) before the
+    // membership test, so a mixed-case header matches a lowercased entry.
+    expect(decideConnectOrigin('https://APP.Example.COM', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('  https://app.example.com  ', allowlist)).toBe('allow');
+  });
+
+  it('denies an Origin that is not in the allowlist', () => {
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('https://attacker.example.com', allowlist)).toBe('deny');
+  });
+
+  it('denies an Origin that matches a listed origin except for the scheme', () => {
+    // Origins are case-sensitive on scheme+host+port; `http://` is a
+    // different origin from `https://` and MUST NOT be admitted when
+    // only the `https://` form is allowlisted (defends against a
+    // stripped-TLS attacker on the same hostname).
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('http://app.example.com', allowlist)).toBe('deny');
+  });
+
+  it('matches one of several allowlisted origins', () => {
+    const allowlist = parseWebOrigins('https://app.example.com, https://staging.app.example.com');
+    expect(decideConnectOrigin('https://staging.app.example.com', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('https://app.example.com', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('https://other.example.com', allowlist)).toBe('deny');
+  });
+});

package/packages/aws-adapter/tests/ping-checker.test.ts

@@ -490,7 +490,6 @@ function fakeParams(client: FakeScanDynamo): PingCheckParams {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     managementApi: null,
     now: 100_000,

package/packages/aws-adapter/tests/stats.test.ts

@@ -238,7 +238,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     // Pass `undefined` so the stub returns `{}` — no Items key — to
     // exercise the `?? []` fallback on the Connections scan, and
@@ -258,7 +257,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     const dynamo = stubDynamo([], 0);
     const stats = new AwsStats({
@@ -279,7 +277,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     // Two registered connection rows.
     const items = [

package/packages/aws-adapter/tests/sweeper.test.ts

@@ -393,7 +393,6 @@ function fakeSweepParams(client: FakeScanDynamo): SweepParams {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     now: 10_000,
     staleAfterMs: 1_000,

package/packages/aws-adapter/tests/tables.test.ts

@@ -13,13 +13,12 @@ import {
 } from '../src/tables.js';
 
 describe('TABLE_NAMES', () => {
-  it('contains exactly the six canonical logical names', () => {
+  it('contains exactly the five canonical logical names', () => {
     expect(TABLE_NAMES).toEqual([
       'Connections',
       'ChannelMeta',
       'ChannelMembers',
       'Nicks',
-      'Accounts',
       'Services',
     ]);
   });
@@ -46,10 +45,6 @@ describe('TABLE_KEYS', () => {
   it('exposes the nickLower PK for Nicks', () => {
     expect(TABLE_KEYS.Nicks.pk).toBe('nickLower');
   });
-
-  it('exposes the account PK for Accounts', () => {
-    expect(TABLE_KEYS.Accounts.pk).toBe('account');
-  });
 });
 
 describe('tablesConfigFromNames', () => {
@@ -59,7 +54,6 @@ describe('tablesConfigFromNames', () => {
       ChannelMeta: 'p-ChannelMeta',
       ChannelMembers: 'p-ChannelMembers',
       Nicks: 'p-Nicks',
-      Accounts: 'p-Accounts',
     };
     expect(tablesConfigFromNames(names)).toEqual(names);
   });
@@ -70,7 +64,6 @@ describe('tablesConfigFromNames', () => {
       ChannelMeta: 'cm',
       ChannelMembers: 'cml',
       Nicks: 'n',
-      Accounts: 'a',
     };
     const out = tablesConfigFromNames(names);
     expect(out).not.toBe(names);

package/packages/aws-adapter/tests/transactions.test.ts

@@ -364,7 +364,6 @@ function fakeRuntime(client: FakeDynamo): AwsRuntime {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     connId: 'probe',
     handlers,

package/packages/cf-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-adapter",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Cloudflare Workers adapter: Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and CfRuntime implementing IrcRuntime",
   "license": "BSD-3-Clause",
@@ -11,10 +11,6 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    },
-    "./accounts": {
-      "types": "./dist/d1-account-store.d.ts",
-      "import": "./dist/d1-account-store.js"
     }
   },
   "scripts": {

package/packages/cf-adapter/src/cf-runtime.ts

@@ -181,10 +181,11 @@ export class CfRuntime implements IrcRuntime {
         if (connId === except || connId === this.connId) return;
         const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(connId));
         const dto = await (stub as unknown as ConnectionRpc).getConnState();
-        if (dto === null) return;
-        const state = deserialize(dto);
-        if (!state.userModes.wallops) return;
-        await (stub as unknown as ConnectionRpc).deliver(lines);
+        await this.deliverWallopsToCandidate(
+          stub as unknown as { deliver(lines: RawLine[]): Promise<unknown> },
+          dto,
+          lines,
+        );
       }),
     );
   }
@@ -284,7 +285,7 @@ export class CfRuntime implements IrcRuntime {
     }
     const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(conn));
     const dto = await (stub as unknown as ConnectionRpc).getConnState();
-    return dto === null ? null : deserialize(dto);
+    return this.deserializeConnState(dto);
   }
 
   async getChannelConnections(chan: ChanName): Promise<ReadonlyMap<ConnId, ConnectionState>> {
@@ -294,9 +295,7 @@ export class CfRuntime implements IrcRuntime {
       memberIds.map(async (id) => {
         const connStub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(id));
         const dto = await (connStub as unknown as ConnectionRpc).getConnState();
-        if (dto !== null) {
-          out.set(id, deserialize(dto));
-        }
+        this.collectChannelMember(out, id, dto);
       }),
     );
     return out;
@@ -320,6 +319,58 @@ export class CfRuntime implements IrcRuntime {
     return loadServerConfigFromCfEnv(this.env as unknown as CfConfigEnv);
   }
 
+  /**
+   * Phase 2 of {@link broadcastWallops}: rehydrates the candidate's
+   * persisted state, gates on user mode `+w`, and dispatches `lines`
+   * via the target stub's `deliver` RPC. Extracted as a public test
+   * seam because every real ConnectionDO's `getConnState` always
+   * returns a non-null DTO (the storage layer is the source of truth
+   * and always has an entry post-`loadState`), so the `dto === null`
+   * and `!+w` defensive arms are unreachable through end-to-end RPC.
+   *
+   * Behavioural contract:
+   *   - `dto === null`           → no-op (candidate reported no state).
+   *   - `dto` with `+w` off      → no-op (recipient gate fails).
+   *   - `dto` with `+w` on       → `stub.deliver(lines)` awaited.
+   */
+  public async deliverWallopsToCandidate(
+    stub: { deliver(lines: RawLine[]): Promise<unknown> },
+    dto: PersistedConnectionState | null,
+    lines: RawLine[],
+  ): Promise<void> {
+    if (dto === null) return;
+    const state = deserialize(dto);
+    if (!state.userModes.wallops) return;
+    await stub.deliver(lines);
+  }
+
+  /**
+   * Rehydrates a cross-connection DTO into a live {@link ConnectionState},
+   * returning `null` when the candidate reported no persisted state.
+   * Extracted as a public test seam because real ConnectionDOs always
+   * return a non-null DTO from `getConnState`, so the `dto === null`
+   * arm is unreachable through end-to-end RPC.
+   */
+  public deserializeConnState(dto: PersistedConnectionState | null): ConnectionState | null {
+    return dto === null ? null : deserialize(dto);
+  }
+
+  /**
+   * Per-member collector for {@link getChannelConnections}: rehydrates the
+   * DTO and adds it to `out` keyed by `id`. Extracted so the null-DTO arm
+   * (a member whose ConnectionDO reports no live state) is testable
+   * directly without constructing a DO whose `getConnState` always
+   * returns non-null.
+   */
+  public collectChannelMember(
+    out: Map<ConnId, ConnectionState>,
+    id: ConnId,
+    dto: PersistedConnectionState | null,
+  ): void {
+    if (dto === null) return;
+    out.set(id, deserialize(dto));
+  }
+
   // -------------------------------------------------------------------------
   // Internal
   // -------------------------------------------------------------------------

package/packages/cf-adapter/src/channel-do.ts

@@ -63,7 +63,7 @@ interface PersistedChannelState {
   modes: ChannelState['modes'];
   banMasks: string[];
   topic?: ChannelTopic;
-  members: Array<Omit<RosterEntry, 'conn'> & { conn: ConnId }>;
+  members: Array<Omit<RosterEntry, 'conn'> & { conn: ConnId; op?: boolean; voice?: boolean }>;
   pendingInvites: string[];
   createdAt: number;
 }
@@ -370,7 +370,13 @@ function serializeChannel(chan: ChannelState): PersistedChannelState {
   return out;
 }
 
-function deserializeChannel(record: PersistedChannelState): ChannelState {
+/**
+ * Rebuilds a live {@link ChannelState} from a JSON-friendly persisted
+ * record. Exported so the legacy-shape defensive arms (`op`/`voice`
+ * coalescing, missing-topic branch) are unit-testable without driving
+ * a full DO storage round-trip.
+ */
+export function deserializeChannel(record: PersistedChannelState): ChannelState {
   const chan: ChannelState = {
     name: record.name,
     nameLower: record.nameLower,
@@ -393,8 +399,12 @@ function deserializeChannel(record: PersistedChannelState): ChannelState {
  * Builds a JSON-friendly {@link ChannelSnapshotDto} from a live
  * {@link ChannelState}. Uses {@link toSnapshot} for the immutable
  * view, then flattens the `Map`/`Set` fields to arrays.
+ *
+ * Exported so the defensive `?:` arms (which fire when a state was
+ * built outside {@link createChannel} and lacks the `Set`/`Map`
+ * fields) are unit-testable directly.
  */
-function toDto(chan: ChannelState): ChannelSnapshotDto {
+export function toDto(chan: ChannelState): ChannelSnapshotDto {
   // Defensively rebuild arrays; in some test-pool code paths the cached
   // state's Set/Map fields may be missing if the channel was created
   // via an unusual path (e.g. direct storage put without going through