serverless-ircd 0.9.0 → 0.10.0

package/packages/cf-adapter/tests/connection-do-coverage.test.ts

@@ -0,0 +1,460 @@
+/**
+ * Coverage-focused tests for {@link ConnectionDO}.
+ *
+ * Each test pins a residual branch that the main `connection-do.test.ts`
+ * suite does not naturally drive:
+ *
+ *   - non-WebSocket `fetch` (426 response)
+ *   - mTLS cert-subject capture + actor wiring
+ *   - `webSocketError` event handler
+ *   - `deliver` over a non-OPEN socket (lazy prune signal)
+ *   - `sendOutbound` no-op on a non-OPEN socket
+ *   - `spec-binary` outbound path (UTF-8 binary frames)
+ *   - `__triggerClose` with a live socket (the `tearDown(ws)` branch)
+ *   - `disconnect()` RPC on a DO with no socket (the `tearDownNoSocket`
+ *     branch)
+ *
+ * Tests run inside real workerd via miniflare so DO hibernation, storage,
+ * and RPC behave as in production. Each test gets isolated storage.
+ */
+
+import { env, runInDurableObject } from 'cloudflare:test';
+import { describe, expect, it } from 'vitest';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      CONNECTION_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+type WsMode = 'legacy' | 'spec-text' | 'spec-binary';
+
+/**
+ * Opens a WebSocket to the named ConnectionDO, accepts it, and returns a
+ * non-null `WebSocket`. Centralizes the upgrade + null-guard so type
+ * narrowing is preserved across awaits in the call sites below.
+ */
+async function openWs(connId: string, protocols?: string): Promise<WebSocket> {
+  const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName(connId));
+  const headers: Record<string, string> = { Upgrade: 'websocket' };
+  if (protocols !== undefined) {
+    headers['Sec-WebSocket-Protocol'] = protocols;
+  }
+  const response = await stub.fetch('https://do/upgrade', { headers });
+  const ws = response.webSocket;
+  if (ws === undefined || ws === null) {
+    throw new Error('upgrade did not return a WebSocket');
+  }
+  ws.accept();
+  return ws;
+}
+
+/** Minimal fake WebSocket whose readyState and sent bytes are controlled. */
+class FakeWs {
+  constructor(readonly readyState: number) {}
+  readonly sent: unknown[] = [];
+  closed = false;
+  send(data: unknown): void {
+    this.sent.push(data);
+  }
+  close(): void {
+    this.closed = true;
+  }
+}
+
+describe('ConnectionDO — fetch rejects non-WebSocket upgrades with 426', () => {
+  it('returns 426 Expected WebSocket when no Upgrade header is present', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-426'));
+    const response = await stub.fetch('https://do/upgrade', {
+      headers: { 'Content-Type': 'text/plain' },
+    });
+    expect(response.status).toBe(426);
+    expect(await response.text()).toBe('Expected WebSocket');
+  });
+});
+
+describe('ConnectionDO — mTLS cert subject capture at upgrade', () => {
+  it('captures cf.tlsClientAuthCertSubject when present on the request', async () => {
+    // The workerd test runtime strips request.cf across the DO RPC
+    // boundary, so the inline fetch path can't be exercised directly.
+    // We drive the same captureMtlsSubject logic via the test seam.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-mtls-fetch'));
+    const fake = { cf: { tlsClientAuthCertSubject: 'CN=mtls-fetch-alice' } } as unknown as Request;
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __captureMtlsSubjectForTest?: (request: Request) => void };
+      doi.__captureMtlsSubjectForTest?.(fake);
+    });
+    const captured = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __peekMtlsCertSubject?: () => Promise<string | undefined> };
+      return doi.__peekMtlsCertSubject?.();
+    });
+    expect(captured).toBe('CN=mtls-fetch-alice');
+  });
+});
+
+describe('ConnectionDO — mTLS cert subject seeds InMemoryMtlsIdentityProvider in buildActor', () => {
+  it('constructs the actor with mtlsIdentity when __setMtlsCertSubject is set', async () => {
+    // The buildActor path builds an InMemoryMtlsIdentityProvider when
+    // mtlsCertSubject is non-undefined. Production captures the subject
+    // at upgrade time via request.cf; the workerd test runtime does not
+    // surface cf, so we set it via the __setMtlsCertSubject test hook
+    // and then drive a frame so buildActor runs.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-mtls-build'));
+    const ws = await openWs('conn-mtls-build');
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __setMtlsCertSubject?: (s: string | undefined) => void };
+      doi.__setMtlsCertSubject?.('CN=mtls-alice');
+    });
+    // Drive a frame so buildActor runs with mtlsCertSubject set. The
+    // registration handshake completes; the actor's mtlsIdentity arm
+    // has now executed even though no AUTHENTICATE EXTERNAL follows.
+    ws.send('NICK mtls-build\r\n');
+    ws.send('USER mtls-build 0 * :mtls-build\r\n');
+    await new Promise<void>((r) => setTimeout(r, 80));
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — webSocketError runs the standard teardown', () => {
+  it('invokes tearDown when webSocketError fires and the suppression hook is unset', async () => {
+    // The webSocketError handler mirrors webSocketClose: same tearDown
+    // path unless suppressed. The platform fires it asynchronously on
+    // transport errors; the __triggerWsError test hook calls it
+    // deterministically against the DO's own attached socket.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-wserror'));
+    const ws = await openWs('conn-wserror');
+    ws.send('NICK wserr-alice\r\n');
+    ws.send('USER wserr-alice 0 * :wserr-alice\r\n');
+    await new Promise<void>((r) => setTimeout(r, 50));
+
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __triggerWsError?: (error: unknown) => Promise<void> };
+      await doi.__triggerWsError?.(new Error('synthetic'));
+    });
+    ws.close();
+  });
+
+  it('webSocketError is a no-op when __suppressCloseTeardown is set', async () => {
+    // The same suppression hook used by webSocketClose also gates
+    // webSocketError so a lost-error condition is owned by the alarm.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-wserror-suppressed'));
+    const ws = await openWs('conn-wserror-suppressed');
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __suppressCloseTeardownHook?: () => void;
+        __triggerWsError?: (error: unknown) => Promise<void>;
+      };
+      doi.__suppressCloseTeardownHook?.();
+      // Must not reject and must not run tearDown (no nick release side
+      // effects). The test asserts only that the handler returns
+      // cleanly — the coverage tracks that the suppression arm fired.
+      await doi.__triggerWsError?.(new Error('synthetic'));
+    });
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — deliver skips non-OPEN sockets', () => {
+  it('returns delivered:0 when the socket is not in OPEN state', async () => {
+    // After the client closes, the DO's `ctx.getWebSockets()` may still
+    // return the socket transiently; its readyState is CLOSING/CLOSED.
+    // The readyState guard in `tryDeliver` skips it, returning false.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-deliver-closed'));
+    const ws = await openWs('conn-deliver-closed');
+    ws.close();
+    // Give the runtime a tick to propagate the close.
+    await new Promise<void>((r) => setTimeout(r, 50));
+    const deliverResult = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        deliver?: (lines: Array<{ text: string }>) => Promise<{ delivered: number }>;
+      };
+      return doi.deliver?.([{ text: ':srv NOTICE * :probe' }]);
+    });
+    expect(deliverResult).toEqual({ delivered: 0 });
+  });
+});
+
+describe('ConnectionDO — IRCv3 binary.ircv3.net outbound path', () => {
+  it('delivers each outbound IRC line as a UTF-8 binary WS message', async () => {
+    // spec-binary mode uses TextEncoder + ws.send(Uint8Array) instead
+    // of the spec-text path's string send. Opening a binary.ircv3.net
+    // connection and completing registration causes the DO to emit
+    // several numerics; each is delivered as a binary frame.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-spec-binary-out'));
+    const response = await stub.fetch('https://do/upgrade', {
+      headers: { Upgrade: 'websocket', 'Sec-WebSocket-Protocol': 'binary.ircv3.net' },
+    });
+    expect(response.headers.get('Sec-WebSocket-Protocol')).toBe('binary.ircv3.net');
+    const ws = response.webSocket;
+    if (ws === undefined || ws === null) {
+      throw new Error('upgrade did not return a WebSocket');
+    }
+    ws.accept();
+    const received: ArrayBuffer[] = [];
+    ws.addEventListener('message', (ev: MessageEvent) => {
+      const d = ev.data;
+      if (d instanceof ArrayBuffer) received.push(d);
+    });
+    await new Promise<void>((r) => setTimeout(r, 10));
+    ws.send('NICK bin-alice\r\n');
+    ws.send('USER bin-alice 0 * :bin-alice\r\n');
+    // Wait for the 001 welcome (delivered as a binary frame).
+    const start = Date.now();
+    while (Date.now() - start < 1500) {
+      const lines = received.map((b) => new TextDecoder().decode(b));
+      if (lines.some((l) => l.includes(' 001 '))) break;
+      await new Promise<void>((r) => setTimeout(r, 30));
+    }
+    expect(received.length).toBeGreaterThan(0);
+    const decoded = received.map((b) => new TextDecoder().decode(b));
+    expect(decoded.some((l) => l.includes(' 001 '))).toBe(true);
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — __triggerClose with a live socket', () => {
+  it('runs tearDown(ws) when a WebSocket is still attached', async () => {
+    // The existing connection-do suite exercises __triggerClose only
+    // after client.close(), when the socket has already dropped. This
+    // case drives the else arm: __triggerClose with a still-live socket
+    // invokes tearDown(ws) directly.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-trigger-live'));
+    const ws = await openWs('conn-trigger-live');
+    ws.send('NICK trigger-alice\r\n');
+    ws.send('USER trigger-alice 0 * :trigger-alice\r\n');
+    await new Promise<void>((r) => setTimeout(r, 50));
+
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __triggerClose?: () => Promise<void> };
+      await doi.__triggerClose?.();
+    });
+
+    // The tearDown path closes the server-side WS; poll readyState
+    // rather than relying on the close event reaching the client.
+    const start = Date.now();
+    while (Date.now() - start < 3000) {
+      if (ws.readyState === WebSocket.CLOSING || ws.readyState === WebSocket.CLOSED) break;
+      await new Promise<void>((r) => setTimeout(r, 50));
+    }
+    expect([WebSocket.CLOSING, WebSocket.CLOSED]).toContain(ws.readyState);
+  });
+});
+
+describe('ConnectionDO — disconnect() RPC with no live socket', () => {
+  it('runs tearDownNoSocket when the DO has no attached WebSocket', async () => {
+    // ConnectionDO.disconnect is the cross-connection RPC entry point
+    // (KICK, operator-driven kill). When the target socket has already
+    // dropped (lost close event in production), the no-socket teardown
+    // path still releases the nick and fans the QUIT out.
+    //
+    // We seed a tiny bit of state first (so loadState returns a real
+    // record rather than a fresh default), then invoke disconnect with
+    // no live socket.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-disc-no-socket'));
+    // Open + close a socket quickly so the DO persists a state record.
+    const ws = await openWs('conn-disc-no-socket');
+    ws.send('NICK disc-alice\r\n');
+    ws.send('USER disc-alice 0 * :disc-alice\r\n');
+    await new Promise<void>((r) => setTimeout(r, 50));
+    ws.close();
+    // Wait for the close to propagate so getWebSockets() returns empty.
+    await new Promise<void>((r) => setTimeout(r, 100));
+
+    // Invoke disconnect via RPC; with no live socket the no-socket
+    // path runs.
+    const rpc = stub as unknown as { disconnect(reason?: string): Promise<void> };
+    await expect(rpc.disconnect('Kicked')).resolves.toBeUndefined();
+  });
+
+  it('tearDownNoSocket initializes channelAccess when no prior frame ran', async () => {
+    // The `if (this.channelAccess === undefined)` arm in
+    // tearDownNoSocket: a never-messaged DO has not run buildActor yet,
+    // so channelAccess is undefined and the no-socket teardown seeds
+    // it before constructing the actor.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-disc-fresh-do'));
+    const rpc = stub as unknown as { disconnect(reason?: string): Promise<void> };
+    await expect(rpc.disconnect('Kicked')).resolves.toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Direct seam tests — exercised with a fake non-OPEN WebSocket so the
+// readyState guards (unreachable via real RPC) are covered.
+// ---------------------------------------------------------------------------
+
+describe('ConnectionDO — readyState guards (direct seam)', () => {
+  it('deliverToSockets counts only OPEN sockets (mixed list)', async () => {
+    // Drives the false arm of the tryDeliver ternary inside the loop:
+    // a fake CLOSING socket returns false and the count skips it.
+    // The real `ctx.getWebSockets()` only returns OPEN sockets in the
+    // test runtime, so this seam is the only way to exercise the
+    // mixed case. Both fakes here are non-OPEN so the loop body
+    // avoids wsFrameMode (which requires a real hibernated WS).
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-deliver-mixed'));
+    const ws = await openWs('conn-deliver-mixed');
+
+    const result = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        deliverToSockets?: (
+          sockets: WebSocket[],
+          lines: Array<{ text: string }>,
+        ) => { delivered: number };
+      };
+      const a = new FakeWs(WebSocket.CLOSING) as unknown as WebSocket;
+      const b = new FakeWs(WebSocket.CLOSED) as unknown as WebSocket;
+      return doi.deliverToSockets?.([a, b], [{ text: 'x' }]);
+    });
+    expect(result).toEqual({ delivered: 0 });
+    ws.close();
+  });
+
+  it('tryDeliver returns false and does not write when the socket is not OPEN', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-trydeliver-closed'));
+    const ws = await openWs('conn-trydeliver-closed');
+
+    const result = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        tryDeliver?: (ws: WebSocket, lines: Array<{ text: string }>) => boolean;
+      };
+      const fake = new FakeWs(WebSocket.CLOSING) as unknown as WebSocket;
+      return doi.tryDeliver?.(fake, [{ text: ':srv NOTICE * :probe' }]);
+    });
+    expect(result).toBe(false);
+    ws.close();
+  });
+
+  it('tryDeliver writes and returns true when the socket is OPEN', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-trydeliver-open'));
+    const ws = await openWs('conn-trydeliver-open');
+
+    // The real OPEN WS goes through tryDeliver via the deliver RPC.
+    // We exercise the OPEN arm directly via the seam: pass the live WS
+    // back into the DO context through runInDurableObject isn't possible
+    // (different DO context). Instead, run deliver() against the live
+    // socket — that already exercises the OPEN arm of tryDeliver.
+    const deliver = stub as unknown as {
+      deliver(lines: Array<{ text: string }>): Promise<{ delivered: number }>;
+    };
+    const deliverResult = await deliver.deliver([{ text: ':srv NOTICE conn-trydeliver-open :hi' }]);
+    expect(deliverResult.delivered).toBe(1);
+    ws.close();
+  });
+
+  it('sendOutbound early-returns without writing when the socket is not OPEN', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-sendoutbound-closed'));
+    const ws = await openWs('conn-sendoutbound-closed');
+
+    const fake = new FakeWs(WebSocket.CLOSED);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __sendOutboundForTest?: (
+          ws: WebSocket,
+          lines: Array<{ text: string }>,
+          mode: WsMode,
+        ) => void;
+      };
+      doi.__sendOutboundForTest?.(
+        fake as unknown as WebSocket,
+        [{ text: ':srv NOTICE * :probe' }],
+        'legacy',
+      );
+    });
+    // Nothing was written (the guard returned before ws.send).
+    expect(fake.sent.length).toBe(0);
+    ws.close();
+  });
+
+  it('writeDisconnect with a reason writes the ERROR Closing link line', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-writedisc-reason'));
+    const ws = await openWs('conn-writedisc-reason');
+
+    // Use a fake OPEN socket so sendOutbound writes through; the
+    // __writeDisconnectForTest seam then calls ws.close on the fake.
+    const fake = new FakeWs(WebSocket.OPEN);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __writeDisconnectForTest?: (ws: WebSocket, mode: WsMode, reason?: string) => void;
+      };
+      doi.__writeDisconnectForTest?.(fake as unknown as WebSocket, 'legacy', 'Kicked');
+    });
+    expect(fake.sent.length).toBe(1);
+    expect(String(fake.sent[0])).toContain('ERROR :Closing link: (Kicked)');
+    expect(fake.closed).toBe(true);
+    ws.close();
+  });
+
+  it('writeDisconnect without a reason skips the ERROR line and still closes', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-writedisc-noreason'));
+    const ws = await openWs('conn-writedisc-noreason');
+
+    const fake = new FakeWs(WebSocket.OPEN);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __writeDisconnectForTest?: (ws: WebSocket, mode: WsMode, reason?: string) => void;
+      };
+      doi.__writeDisconnectForTest?.(fake as unknown as WebSocket, 'legacy');
+    });
+    expect(fake.sent.length).toBe(0);
+    expect(fake.closed).toBe(true);
+    ws.close();
+  });
+
+  it('closeIfStillOpen closes an OPEN socket', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-closeifopen-open'));
+    const ws = await openWs('conn-closeifopen-open');
+
+    const fake = new FakeWs(WebSocket.OPEN);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __closeIfStillOpenForTest?: (ws: WebSocket) => void };
+      doi.__closeIfStillOpenForTest?.(fake as unknown as WebSocket);
+    });
+    expect(fake.closed).toBe(true);
+    ws.close();
+  });
+
+  it('closeIfStillOpen is a no-op on a CLOSED socket', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-closeifopen-closed'));
+    const ws = await openWs('conn-closeifopen-closed');
+
+    const fake = new FakeWs(WebSocket.CLOSED);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __closeIfStillOpenForTest?: (ws: WebSocket) => void };
+      doi.__closeIfStillOpenForTest?.(fake as unknown as WebSocket);
+    });
+    expect(fake.closed).toBe(false);
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — __triggerWsError with no socket', () => {
+  it('is a no-op when no WebSocket is attached', async () => {
+    // The "no socket attached" branch of __triggerWsError: a never-opened
+    // DO has no live WebSocket, so the hook returns without invoking
+    // webSocketError. Covers the `if (ws === undefined) return;` guard.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-wserror-nosocket'));
+    await expect(
+      runInDurableObject(stub, async (instance: unknown) => {
+        const doi = instance as { __triggerWsError?: (error: unknown) => Promise<void> };
+        await doi.__triggerWsError?.(new Error('nothing to close'));
+      }),
+    ).resolves.toBeUndefined();
+  });
+});
+
+describe('ConnectionDO — flushServices no-op when services are unbound', () => {
+  it('does not reject when services is undefined (e.g. binding absent)', async () => {
+    // flushServices guards `if (this.services === undefined) return;`.
+    // The D1 binding is present in the test env, so the loader resolves
+    // a store on the first frame; to exercise the undefined arm we
+    // invoke flushServices on a never-touched DO before any frame runs.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-flush-empty'));
+    await expect(
+      runInDurableObject(stub, async (instance: unknown) => {
+        const doi = instance as { __flushServicesForTest?: () => Promise<void> };
+        await doi.__flushServicesForTest?.();
+      }),
+    ).resolves.toBeUndefined();
+  });
+});

package/packages/cf-adapter/tests/connection-do-pure.test.ts

@@ -6,60 +6,14 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { parseSaslAccountsEnv, wsFrameModeFromTags } from '../src/connection-do';
-
-describe('parseSaslAccountsEnv', () => {
-  it('returns an empty array for undefined input', () => {
-    expect(parseSaslAccountsEnv(undefined)).toEqual([]);
-  });
-
-  it('returns an empty array for an empty string', () => {
-    expect(parseSaslAccountsEnv('')).toEqual([]);
-  });
-
-  it('parses a single well-formed entry', () => {
-    expect(parseSaslAccountsEnv('alice:secret')).toEqual([
-      { username: 'alice', password: 'secret' },
-    ]);
-  });
-
-  it('parses multiple newline-delimited entries', () => {
-    expect(parseSaslAccountsEnv('alice:secret\nbob:pw')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
-  });
-
-  it('skips blank lines', () => {
-    expect(parseSaslAccountsEnv('alice:secret\n\nbob:pw\n   \n')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
-  });
-
-  it('skips lines with no colon separator', () => {
-    expect(parseSaslAccountsEnv('alice:secret\nnocolonhere\nbob:pw')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
-  });
-
-  it('skips lines where the colon is at position 0 (empty username)', () => {
-    expect(parseSaslAccountsEnv(':secret\nalice:valid')).toEqual([
-      { username: 'alice', password: 'valid' },
-    ]);
-  });
-
-  it('skips lines with an empty password after the colon', () => {
-    expect(parseSaslAccountsEnv('alice:\nbob:valid')).toEqual([
-      { username: 'bob', password: 'valid' },
-    ]);
-  });
-
-  it('returns an empty array when every line is malformed', () => {
-    expect(parseSaslAccountsEnv('\n   \n:no-user\nuser:')).toEqual([]);
-  });
-});
+import {
+  NO_OP_DISCONNECT,
+  NO_OP_SEND,
+  buildOptionalActorFields,
+  chooseMotdProvider,
+  extractMtlsSubject,
+  wsFrameModeFromTags,
+} from '../src/connection-do';
 
 describe('wsFrameModeFromTags', () => {
   it("returns 'legacy' when no tags are present", () => {
@@ -219,3 +173,90 @@ describe('PassthroughChannelAccess.refreshChannel', () => {
     expect(chan.topic?.text).toBe('keep');
   });
 });
+
+// ============================================================================
+// chooseMotdProvider — default vs. populated MOTD_LINES branch
+// ============================================================================
+
+describe('chooseMotdProvider', () => {
+  it('returns the default MOTD when the env value is undefined', () => {
+    const provider = chooseMotdProvider(undefined);
+    expect(provider.lines()).toEqual(['Welcome to the ServerlessIRCd Cloudflare adapter.']);
+  });
+
+  it('returns the default MOTD when the env value is an empty string', () => {
+    const provider = chooseMotdProvider('');
+    expect(provider.lines()).toEqual(['Welcome to the ServerlessIRCd Cloudflare adapter.']);
+  });
+
+  it('splits a populated MOTD_LINES on newlines', () => {
+    const provider = chooseMotdProvider('Line one\nLine two\nLine three');
+    expect(provider.lines()).toEqual(['Line one', 'Line two', 'Line three']);
+  });
+});
+
+// ============================================================================
+// buildOptionalActorFields — conditional spread branches
+// ============================================================================
+
+describe('buildOptionalActorFields', () => {
+  it('returns an empty object when every optional is undefined', () => {
+    expect(buildOptionalActorFields(undefined, undefined)).toEqual({});
+  });
+
+  it('includes `services` when defined', () => {
+    const fake = {} as unknown as Parameters<typeof buildOptionalActorFields>[0];
+    expect(buildOptionalActorFields(fake, undefined).services).toBe(fake);
+  });
+
+  it('includes `mtlsIdentity` when defined', () => {
+    const fake = {} as unknown as Parameters<typeof buildOptionalActorFields>[1];
+    expect(buildOptionalActorFields(undefined, fake).mtlsIdentity).toBe(fake);
+  });
+});
+
+// ============================================================================
+// NO_OP_SEND / NO_OP_DISCONNECT — invoked once to cover the function bodies
+// (the no-socket teardown path constructs these handlers but the actor never
+// invokes send/disconnect during QUIT processing — there is no peer to
+// deliver to and the socket is already gone).
+// ============================================================================
+
+describe('NO_OP_SEND / NO_OP_DISCONNECT', () => {
+  it('NO_OP_SEND runs without throwing and returns undefined', () => {
+    expect(NO_OP_SEND([{ text: 'ignored' }])).toBeUndefined();
+  });
+
+  it('NO_OP_DISCONNECT runs without throwing and returns undefined', () => {
+    expect(NO_OP_DISCONNECT('any reason')).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// extractMtlsSubject — request.cf.tlsClientAuthCertSubject capture
+// ============================================================================
+
+describe('extractMtlsSubject', () => {
+  it('returns the subject when cf.tlsClientAuthCertSubject is a string', () => {
+    // The CF edge injects request.cf on every proxied request. We can't
+    // mutate Request.cf in workerd tests (it's read-only), so the
+    // upgrade-time capture is exercised via this pure seam.
+    const fake = { cf: { tlsClientAuthCertSubject: 'CN=alice' } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBe('CN=alice');
+  });
+
+  it('returns undefined when cf is absent', () => {
+    const fake = { cf: undefined } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+
+  it('returns undefined when cf is present but lacks tlsClientAuthCertSubject', () => {
+    const fake = { cf: { country: 'US' } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+
+  it('returns undefined when tlsClientAuthCertSubject is not a string', () => {
+    const fake = { cf: { tlsClientAuthCertSubject: 42 } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+});