serverless-ircd 0.9.0 → 0.10.0

package/packages/cf-adapter/src/d1-services-store.ts

@@ -78,7 +78,7 @@ interface D1QueryClient {
  * the list on a warm deploy is a no-op.
  */
 export const CREATE_NICKSERV_ACCOUNTS_SQL =
-  'CREATE TABLE IF NOT EXISTS nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
+  "CREATE TABLE IF NOT EXISTS nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, cert_subjects TEXT NOT NULL DEFAULT '[]', algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)";
 
 export const CREATE_SERVICES_TABLES_SQL: readonly string[] = [
   CREATE_NICKSERV_ACCOUNTS_SQL,
@@ -136,7 +136,7 @@ export class D1ServicesStore extends PersistentServicesStore {
         return [
           this.db
             .prepare(
-              'INSERT OR REPLACE INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, algorithm, salt, hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
+              'INSERT OR REPLACE INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
             )
             .bind(
               fold(r.nick),
@@ -145,6 +145,7 @@ export class D1ServicesStore extends PersistentServicesStore {
               r.email,
               r.createdAt,
               r.enforce,
+              JSON.stringify(r.certSubjects ?? []),
               r.credential.algorithm,
               r.credential.salt,
               r.credential.hash,
@@ -361,12 +362,13 @@ async function loadNicks(db: D1QueryClient): Promise<ServicesNickRow[]> {
     email: unknown;
     created_at: unknown;
     enforce: unknown;
+    cert_subjects: unknown;
     algorithm: unknown;
     salt: unknown;
     hash: unknown;
   }>(
     db,
-    'SELECT nick, account, email, created_at, enforce, algorithm, salt, hash FROM nickserv_accounts',
+    'SELECT nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash FROM nickserv_accounts',
   );
   const out: ServicesNickRow[] = [];
   for (const r of rows) {
@@ -388,6 +390,7 @@ async function loadNicks(db: D1QueryClient): Promise<ServicesNickRow[]> {
       email: r.email,
       createdAt: r.created_at,
       enforce: r.enforce as NickEnforcePolicy,
+      certSubjects: parseCertSubjects(r.cert_subjects),
       credential: {
         account: r.account,
         algorithm: 'scrypt',
@@ -399,6 +402,23 @@ async function loadNicks(db: D1QueryClient): Promise<ServicesNickRow[]> {
   return out;
 }
 
+/**
+ * Parses the `cert_subjects` TEXT column (JSON-encoded array) into a
+ * `string[]`. Tolerates `undefined` (a row written before the column
+ * existed), `null`, or malformed JSON — all collapse to `[]` so a stale or
+ * partially-migrated row loads cleanly.
+ */
+function parseCertSubjects(raw: unknown): string[] {
+  if (typeof raw !== 'string' || raw.length === 0) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((s): s is string => typeof s === 'string');
+  } catch {
+    return [];
+  }
+}
+
 async function loadChannels(db: D1QueryClient): Promise<RegisteredChannel[]> {
   const rows = await safeSelect<{
     channel: unknown;
@@ -603,8 +623,13 @@ async function loadJupes(db: D1QueryClient): Promise<JupeEntry[]> {
  * table does not exist yet (fresh deploy) or the binding is unreachable.
  * Silent-skip mirrors the DynamoDB loader: a missing table is treated as
  * an empty section rather than a fatal boot error.
+ *
+ * Exported so the catch-block fallback is unit-testable directly with a
+ * throwing D1 stub (the real binding does not fail on queries that target
+ * existing tables, so the catch arm is unreachable through integration
+ * tests).
  */
-async function safeSelect<R>(db: D1QueryClient, sql: string): Promise<R[]> {
+export async function safeSelect<R>(db: D1QueryClient, sql: string): Promise<R[]> {
   try {
     const result = await db.prepare(sql).all<R>();
     return result.results;
@@ -648,35 +673,47 @@ async function ensureServicesTables(db: D1QueryClient): Promise<void> {
 }
 
 /**
- * One-time schema migration for the `algorithm/salt/hash` unification
- * (commit cfa5a3c). `CREATE TABLE IF NOT EXISTS` does NOT add columns to
- * an existing table, so a D1 first provisioned by an older deploy keeps
- * the original `nickserv_accounts (... enforce, password)` schema. Every
- * current SELECT/INSERT references `algorithm`, so reads throw
- * "no such column: algorithm" (masked by `safeSelect` as an empty
- * snapshot) and writes throw inside `flush()` (after the success NOTICE).
+ * One-time schema migrations for `nickserv_accounts`.
+ *
+ * `CREATE TABLE IF NOT EXISTS` does NOT add columns to an existing table,
+ * so a D1 first provisioned by an older deploy keeps the original schema.
+ * Two additive migrations run idempotently, each gated on `PRAGMA
+ * table_info`:
  *
- * Detection: `PRAGMA table_info`. If `nickserv_accounts` lacks
- * `algorithm`, it is the pre-unification schema. Those rows stored a
- * non-scrypt `password` the current `verifyNick` cannot validate, so the
- * table is dropped and recreated with the current schema (data loss is
- * intentional and limited to already-unusable credentials). Idempotent:
- * once the new schema is in place, `algorithm` is present and this is a
- * no-op.
+ *   1. **algorithm/salt/hash unification** (commit cfa5a3c). If the table
+ *      lacks `algorithm`, it has the pre-unification `password` column
+ *      whose credentials the current `verifyNick` cannot validate. The
+ *      table is dropped and recreated with the current schema (data loss
+ *      is intentional and limited to already-unusable credentials).
+ *   2. **cert_subjects**. If the table has `algorithm` but lacks
+ *      `cert_subjects`, the column is added with `NOT NULL DEFAULT '[]'`
+ *      so existing rows load with an empty cert-subject list. No data
+ *      loss — the column is additive.
  */
 async function migrateServicesSchema(db: D1QueryClient): Promise<void> {
   const nickservInfo = await db
     .prepare('PRAGMA table_info(nickserv_accounts)')
     .all<{ name: string }>();
   const nickservCols = new Set(nickservInfo.results.map((r) => r.name));
-  if (nickservCols.has('algorithm')) return;
-  // Old schema detected (has `password`, lacks `algorithm`). The table is
-  // guaranteed to exist (ensureServicesTables just ran CREATE IF NOT
-  // EXISTS); recreate it with the current schema.
-  await db.batch([
-    db.prepare('DROP TABLE nickserv_accounts'),
-    db.prepare(CREATE_NICKSERV_ACCOUNTS_SQL),
-  ]);
+  if (!nickservCols.has('algorithm')) {
+    // Old schema detected (has `password`, lacks `algorithm`). The table is
+    // guaranteed to exist (ensureServicesTables just ran CREATE IF NOT
+    // EXISTS); recreate it with the current schema (which includes
+    // cert_subjects).
+    await db.batch([
+      db.prepare('DROP TABLE nickserv_accounts'),
+      db.prepare(CREATE_NICKSERV_ACCOUNTS_SQL),
+    ]);
+    return;
+  }
+  // algorithm present — check for the additive cert_subjects column.
+  if (!nickservCols.has('cert_subjects')) {
+    await db.batch([
+      db.prepare(
+        "ALTER TABLE nickserv_accounts ADD COLUMN cert_subjects TEXT NOT NULL DEFAULT '[]'",
+      ),
+    ]);
+  }
 }
 
 export async function loadD1ServicesStore(

package/packages/cf-adapter/src/env.ts

@@ -47,13 +47,13 @@ export interface Env {
    */
   CHANNEL_REGISTRY_DO: DurableObjectNamespace;
   /**
-   * D1 database backing persistent SASL account credentials. The `accounts`
-   * table holds scrypt-hashed rows (`{ account PK, algorithm, salt, hash }`),
-   * loaded at {@link ConnectionDO} construction by `loadD1AccountStore`.
+   * D1 database backing persistent services (NickServ / ChanServ / HostServ /
+   * MemoServ / OperServ + the unified SASL credential store). The
+   * `nickserv_accounts` table holds scrypt-hashed credential rows, loaded at
+   * {@link ConnectionDO} construction by `loadD1ServicesStore`.
    *
-   * Optional so deployments that have not migrated to D1 keep working: when
-   * unset, the precedence resolver falls straight through to the
-   * `SASL_ACCOUNTS` env-var seed (the legacy `InMemoryAccountStore`).
+   * Optional: when unset, services are unbound (no NickServ routing, no
+   * SASL/PASS credential verify).
    */
   ACCOUNTS_DB?: D1Database;
   /** Server-level config knobs (name, MOTD lines, limits). */
@@ -71,10 +71,11 @@ export interface Env {
   CREATED_AT?: string;
   MOTD_LINES: string;
   /**
-   * SASL PLAIN accounts seeded into the in-worker `AccountStore`.
-   * Newline-delimited `username:password` pairs; the connection-do parses
-   * these into an `InMemoryAccountStore` so `AUTHENTICATE PLAIN` works
-   * end-to-end. Empty/undefined disables SASL account verification.
+   * SASL PLAIN seed accounts. Newline-delimited `username:password` pairs;
+   * the connection-do ingests these into the `ServicesStore` at boot via
+   * `registerNick` (idempotent — existing registrations win) so
+   * `AUTHENTICATE PLAIN`, `PASS <nick>:<password>`, and NickServ `IDENTIFY`
+   * all verify for the listed accounts.
    */
   SASL_ACCOUNTS?: string;
   /**

package/packages/cf-adapter/src/index.ts

@@ -26,12 +26,6 @@ export type { CfConnectionHandlers } from './cf-runtime.js';
 export { CfStats } from './stats.js';
 export type { CfStatsRuntime } from './stats.js';
 export type { ChannelRpc, ChannelRegistryRpc, Env, RegistryRpc } from './env.js';
-export {
-  CREATE_ACCOUNTS_TABLE_SQL,
-  loadD1AccountStore,
-  putAccountCredential,
-  resolveAccountStore,
-} from './d1-account-store.js';
 export {
   CREATE_SERVICES_TABLES_SQL,
   D1ServicesStore,

package/packages/cf-adapter/tests/cf-runtime.test.ts

@@ -29,9 +29,10 @@ import {
   type RawLine,
   createConnection,
 } from '@serverless-ircd/irc-core';
-import { afterAll, afterEach, describe, expect, it } from 'vitest';
+import { afterAll, afterEach, describe, expect, it, vi } from 'vitest';
 import { type CfConnectionHandlers, CfRuntime } from '../src/cf-runtime';
 import type { Env, RegistryRpc } from '../src/env';
+import { serialize } from '../src/serialize';
 import { registryKeyForNick } from '../src/sharding';
 
 declare global {
@@ -921,3 +922,102 @@ describe('CfRuntime — getConnection and getChannelConnections branches', () =>
     member.ws.close();
   });
 });
+
+// ---------------------------------------------------------------------------
+// Tests — pure helper seams for defensive null-DTO branches
+// ---------------------------------------------------------------------------
+
+describe('CfRuntime — defensive DTO helper seams', () => {
+  it('deserializeConnState returns null when the DTO is null', () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-dsz-null', recordingHandlers());
+    expect(rt.deserializeConnState(null)).toBeNull();
+  });
+
+  it('deserializeConnState rehydrates a populated DTO', () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-dsz-real', recordingHandlers());
+    const live = createConnection({ id: 'conn-dsz-real', connectedSince: 0 });
+    live.nick = 'dz';
+    // Round-trip through serialize so the DTO matches what a real
+    // ConnectionDO.getConnState would return.
+    const dto = serialize(live);
+    const out = rt.deserializeConnState(dto);
+    expect(out?.nick).toBe('dz');
+    expect(out?.id).toBe('conn-dsz-real');
+  });
+
+  it('collectChannelMember skips a null DTO without mutating the map', () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-ccm-null', recordingHandlers());
+    const out = new Map();
+    rt.collectChannelMember(out, 'ghost', null);
+    expect(out.size).toBe(0);
+  });
+
+  it('collectChannelMember rehydrates and inserts a populated DTO', () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-ccm-real', recordingHandlers());
+    const live = createConnection({ id: 'conn-ccm-real', connectedSince: 0 });
+    live.nick = 'ccm';
+    const out = new Map();
+    rt.collectChannelMember(out, 'conn-ccm-real', serialize(live));
+    expect(out.size).toBe(1);
+    expect(out.get('conn-ccm-real')?.nick).toBe('ccm');
+  });
+
+  it('deliverWallopsToCandidate is a no-op when the DTO is null', async () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-dwc-null', recordingHandlers());
+    const deliver = vi.fn();
+    await rt.deliverWallopsToCandidate({ deliver }, null, [{ text: 'x' }]);
+    expect(deliver).not.toHaveBeenCalled();
+  });
+
+  it('deliverWallopsToCandidate skips a candidate whose +w mode is off', async () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-dwc-now', recordingHandlers());
+    const live = createConnection({ id: 'conn-dwc-now', connectedSince: 0 });
+    live.userModes.wallops = false;
+    const deliver = vi.fn();
+    await rt.deliverWallopsToCandidate({ deliver }, serialize(live), [{ text: 'x' }]);
+    expect(deliver).not.toHaveBeenCalled();
+  });
+
+  it('deliverWallopsToCandidate delivers to a +w candidate', async () => {
+    const stubEnv = envWithChannelStub();
+    const rt = new CfRuntime(stubEnv, 'conn-dwc-yes', recordingHandlers());
+    const live = createConnection({ id: 'conn-dwc-yes', connectedSince: 0 });
+    live.userModes.wallops = true;
+    const calls: RawLine[][] = [];
+    const deliver = (lines: RawLine[]): Promise<void> => {
+      calls.push(lines);
+      return Promise.resolve();
+    };
+    await rt.deliverWallopsToCandidate({ deliver }, serialize(live), [
+      { text: ':oper!u@h WALLOPS :hi' },
+    ]);
+    expect(calls).toEqual([[{ text: ':oper!u@h WALLOPS :hi' }]]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Tests — getChannelSnapshot topic branch (the { topic } arm of the spread)
+// ---------------------------------------------------------------------------
+
+describe('CfRuntime — getChannelSnapshot topic branch', () => {
+  it('rehydrates the topic onto ChanSnapshot when the ChannelDO reports one', async () => {
+    // Existing coverage exercises the `: {}` arm of the topic spread; this
+    // case drives the `{ topic: dto.topic }` arm by applying a topic
+    // through the real ChannelDO and reading it back via CfRuntime.
+    const realEnv = envWithRealDOs();
+    const rt = new CfRuntime(realEnv, 'conn-topic-caller', recordingHandlers());
+    const topic = { text: 'news', setter: 'alice', setAt: 1 };
+    await rt.applyChannelDelta('#topic-branch', {
+      memberships: [{ type: 'add' as const, conn: 'conn-topic-caller', nick: 'alice' }],
+      topic,
+    });
+    const snap = await rt.getChannelSnapshot('#topic-branch');
+    expect(snap?.topic).toEqual(topic);
+  });
+});

package/packages/cf-adapter/tests/channel-do.test.ts

@@ -18,7 +18,7 @@
 import { env, runInDurableObject } from 'cloudflare:test';
 import type { ChannelDelta, ChannelTopic, ConnId, RosterEntry } from '@serverless-ircd/irc-core';
 import { describe, expect, it } from 'vitest';
-import type { ChannelSnapshotDto } from '../src/channel-do';
+import { type ChannelSnapshotDto, deserializeChannel, toDto } from '../src/channel-do';
 
 declare global {
   namespace Cloudflare {
@@ -595,3 +595,120 @@ describe('ChannelDO — broadcast + cache edge cases', () => {
     await alice.client.close();
   });
 });
+
+// ---------------------------------------------------------------------------
+// Tests — ChannelDO instantiated without a name (idFromString)
+// ---------------------------------------------------------------------------
+
+describe('ChannelDO — id.name fallback', () => {
+  it('falls back to ctx.id.toString() when the DO was created via idFromString', async () => {
+    // ChannelDOs in production are always keyed by lowercased name
+    // (idFromName), but the DO storage-creation path still needs to
+    // handle the no-name case. `newUniqueId()` returns a valid hex DO id
+    // whose `id.name` is null, forcing the `??` fallback to `toString()`.
+    const hexId = env.CHANNEL_DO_REAL.newUniqueId().toString();
+    const stub = env.CHANNEL_DO_REAL.get(env.CHANNEL_DO_REAL.idFromString(hexId));
+    const rpc = stub as unknown as ChannelRpc;
+    await rpc.applyChannelDelta({
+      memberships: [{ type: 'add', conn: 'c-id-fallback', nick: 'alice' }],
+    });
+    const snap = await rpc.getChannelSnapshot();
+    // The DO used the hex id as the storage key, so nameLower resolves
+    // to the hex string (not a lowercased channel name).
+    expect(snap?.nameLower).toBe(hexId);
+    expect(snap?.name).toBe(hexId);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Tests — pure deserializeChannel / toDto helpers (legacy-shape arms)
+// ---------------------------------------------------------------------------
+
+describe('deserializeChannel — legacy record defensive arms', () => {
+  it('coalesces missing op/voice to false for legacy persisted members', () => {
+    // Pre-feature records may have been written without `op`/`voice`
+    // fields (or with them explicitly undefined). The loader's `?? false`
+    // arms must catch both so the rehydrated RosterEntry always carries
+    // a boolean. The PersistedChannelState interface types op/voice as
+    // optional, but legacy on-disk rows predate the field — cast through
+    // unknown to simulate the storage layer's untyped payload.
+    const record = {
+      name: '#legacy',
+      nameLower: '#legacy',
+      modes: {
+        inviteOnly: false,
+        topicLock: false,
+        noExternal: false,
+        moderated: false,
+        secret: false,
+        private: false,
+        registered: false,
+        blockUnidentified: false,
+        moderatedIdent: false,
+      },
+      banMasks: [],
+      members: [{ conn: 'c-1', nick: 'alice' }],
+      pendingInvites: [],
+      createdAt: 0,
+    } as unknown as Parameters<typeof deserializeChannel>[0];
+    const chan = deserializeChannel(record);
+    const entry = chan.members.get('c-1');
+    expect(entry?.op).toBe(false);
+    expect(entry?.voice).toBe(false);
+  });
+
+  it('leaves topic undefined when the record carries none', () => {
+    // The `if (record.topic !== undefined)` else arm: a record written
+    // before any TOPIC was set has no topic field, and deserializeChannel
+    // must leave chan.topic undefined.
+    const record = {
+      name: '#notopic',
+      nameLower: '#notopic',
+      modes: {
+        inviteOnly: false,
+        topicLock: false,
+        noExternal: false,
+        moderated: false,
+        secret: false,
+        private: false,
+        registered: false,
+        blockUnidentified: false,
+        moderatedIdent: false,
+      },
+      banMasks: [],
+      members: [],
+      pendingInvites: [],
+      createdAt: 0,
+    } as unknown as Parameters<typeof deserializeChannel>[0];
+    expect(deserializeChannel(record).topic).toBeUndefined();
+  });
+});
+
+describe('toDto — defensive Set/Map arms', () => {
+  it('returns empty arrays when ChannelState fields are missing', () => {
+    // Channels constructed without going through createChannel (e.g. a
+    // hand-built test fixture or a future storage migration) may lack
+    // the `Set`/`Map` fields. The `?:` arms in toDto must degrade to
+    // empty arrays so the DTO never carries undefined to callers.
+    const partial = {
+      name: '#partial',
+      nameLower: '#partial',
+      modes: {
+        inviteOnly: false,
+        topicLock: false,
+        noExternal: false,
+        moderated: false,
+        secret: false,
+        private: false,
+        registered: false,
+        blockUnidentified: false,
+        moderatedIdent: false,
+      },
+      createdAt: 0,
+    } as unknown as Parameters<typeof toDto>[0];
+    const dto = toDto(partial);
+    expect(dto.banMasks).toEqual([]);
+    expect(dto.members).toEqual([]);
+    expect(dto.pendingInvites).toEqual([]);
+  });
+});