serverless-ircd 0.9.0 → 0.10.0

package/packages/cf-adapter/tests/connection-do-sasl-d1.test.ts

@@ -1,10 +1,9 @@
 /**
- * End-to-end SASL PLAIN through ConnectionDO with D1-backed accounts.
+ * End-to-end SASL PLAIN through ConnectionDO with D1-backed services.
  *
- * Verifies the full precedence matrix:
- *   - D1 has rows → table is authoritative (900/903 for seeded account,
- *     904 for the env-seed account which the table shadows).
- *   - D1 empty → the `SASL_ACCOUNTS` env-var seed still works (fallback).
+ * Verifies the services-store credential path: an account seeded into the
+ * `nickserv_accounts` table (via `ServicesStore.registerNick`) verifies
+ * end-to-end through `AUTHENTICATE PLAIN`.
  *
  * Each test file gets its own isolated D1 database from miniflare, so the
  * table state set up here does not leak into `connection-do.test.ts`.
@@ -12,7 +11,7 @@
 
 import { env } from 'cloudflare:test';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { CREATE_ACCOUNTS_TABLE_SQL, putAccountCredential } from '../src/d1-account-store';
+import { CREATE_SERVICES_TABLES_SQL } from '../src/d1-services-store';
 
 declare global {
   namespace Cloudflare {
@@ -107,16 +106,56 @@ async function authenticatePlain(
   client.send(`AUTHENTICATE ${plainB64(authcid, password)}\r\n`);
 }
 
-describe('ConnectionDO — SASL PLAIN with D1-backed accounts', () => {
+/**
+ * Seeds a NickServ registration directly into the D1 services table by
+ * driving a first connection through `PRIVMSG NickServ :REGISTER`. Returns
+ * once the registration NOTICE is observed.
+ */
+async function seedViaNickservRegister(
+  connId: string,
+  nick: string,
+  password: string,
+  email: string,
+): Promise<IrcWsClient> {
+  const client = await connect(connId);
+  client.send(`NICK ${nick}\r\n`);
+  client.send(`USER ${nick} 0 * :${nick}\r\n`);
+  await client.waitForMessage((l) => l.includes(' 001 '));
+  client.send(`PRIVMSG NickServ :REGISTER ${password} ${email}\r\n`);
+  await client.waitForMessage((l) => l.includes('NickServ') && l.includes('registered'));
+  return client;
+}
+
+describe('ConnectionDO — SASL PLAIN with D1-backed services', () => {
   beforeEach(async () => {
-    await env.ACCOUNTS_DB.exec(CREATE_ACCOUNTS_TABLE_SQL);
+    for (const sql of CREATE_SERVICES_TABLES_SQL) {
+      await env.ACCOUNTS_DB.exec(sql);
+    }
   });
   afterEach(async () => {
-    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_channels');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_access');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_levels');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS hostserv_vhosts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS hostserv_pending_vhosts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS memoserv_memos');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS read_markers');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS operserv_akills');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS operserv_jupes');
   });
 
-  it('completes SASL PLAIN with 900/903 for a D1-seeded account', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('completes SASL PLAIN with 900/903 for a NickServ-registered account', async () => {
+    // Seed alice via NickServ REGISTER on a first connection.
+    const seeder = await seedViaNickservRegister(
+      'conn-d1-sasl-seed',
+      'd1-alice',
+      'd1-s3cret',
+      'd1@example.com',
+    );
+    await seeder.close();
+
+    // A second connection speaking SASL PLAIN against the registered nick.
     const client = await connect('conn-d1-sasl-1');
     await authenticatePlain(client, 'd1-alice', 'd1-s3cret');
     await client.waitForMessage((l) => l.includes(' 900 '));
@@ -125,42 +164,27 @@ describe('ConnectionDO — SASL PLAIN with D1-backed accounts', () => {
     await client.close();
   });
 
-  it('rejects SASL PLAIN with 904 for a wrong password (D1 account)', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('rejects SASL PLAIN with 904 for a wrong password', async () => {
+    const seeder = await seedViaNickservRegister(
+      'conn-d1-sasl-seed2',
+      'd1-bob',
+      'd1-s3cret',
+      'd1@example.com',
+    );
+    await seeder.close();
+
     const client = await connect('conn-d1-sasl-2');
-    await authenticatePlain(client, 'd1-alice', 'wrong');
+    await authenticatePlain(client, 'd1-bob', 'wrong');
     const fail = await client.waitForMessage((l) => l.includes(' 904 '));
     expect(fail).toContain(' 904 ');
     await client.close();
   });
 
-  it('table shadows the env-seed account (table wins)', async () => {
-    // SASL_ACCOUNTS env seeds "cf-sasl:s3cret" but D1 has no such row.
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('rejects SASL PLAIN with 904 for an unknown nick', async () => {
     const client = await connect('conn-d1-sasl-3');
-    // env-seed account does NOT verify (table is authoritative).
-    await authenticatePlain(client, 'cf-sasl', 's3cret');
+    await authenticatePlain(client, 'nobody', 'whatever');
     const fail = await client.waitForMessage((l) => l.includes(' 904 '));
     expect(fail).toContain(' 904 ');
     await client.close();
   });
 });
-
-describe('ConnectionDO — SASL PLAIN in-memory fallback (D1 empty)', () => {
-  // The table exists but has zero rows → resolver falls back to SASL_ACCOUNTS.
-  beforeEach(async () => {
-    await env.ACCOUNTS_DB.exec(CREATE_ACCOUNTS_TABLE_SQL);
-  });
-  afterEach(async () => {
-    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
-  });
-
-  it('falls back to SASL_ACCOUNTS seed when D1 is empty', async () => {
-    const client = await connect('conn-d1-sasl-fallback');
-    await authenticatePlain(client, 'cf-sasl', 's3cret');
-    await client.waitForMessage((l) => l.includes(' 900 '));
-    const success = await client.waitForMessage((l) => l.includes(' 903 '));
-    expect(success).toContain(' 903 ');
-    await client.close();
-  });
-});

package/packages/cf-adapter/tests/d1-services-store.test.ts

@@ -15,6 +15,7 @@ import {
   CREATE_SERVICES_TABLES_SQL,
   D1ServicesStore,
   loadD1ServicesStore,
+  safeSelect,
 } from '../src/d1-services-store';
 
 declare global {
@@ -194,6 +195,18 @@ describe('D1ServicesStore — NickServ round-trip across reload', () => {
     expect(reloaded?.getNickEnforce('alice')).toBe('kill');
   });
 
+  it('persists SET PASSWORD and round-trips the new credential', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.setNickPassword('alice', 'newpassword');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // The new password verifies against the reloaded store; the old one no longer does.
+    expect(reloaded?.verifyNick('alice', 'newpassword')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded?.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
     store?.registerNick('alice', 'pw', 'a@x');
@@ -524,14 +537,18 @@ describe('D1ServicesStore — tolerance', () => {
     expect(snap.jupes).toEqual([]);
   });
 
-  it('skips rows with NULL fields in the all-TEXT tables (vhosts / read_markers)', async () => {
-    // Recreate the two all-TEXT tables without NOT NULL so a NULL field can
+  it('skips rows with NULL fields in the all-TEXT tables (vhosts / pending_vhosts / read_markers)', async () => {
+    // Recreate the all-TEXT tables without NOT NULL so a NULL field can
     // survive — exercises the typeof-string defensive skip for the loaders
     // whose INTEGER-corruption path is unreachable under SQLite affinity.
     await env.ACCOUNTS_DB.exec('DROP TABLE hostserv_vhosts');
     await env.ACCOUNTS_DB.exec(
       'CREATE TABLE hostserv_vhosts (account_key TEXT PRIMARY KEY, account TEXT, vhost TEXT)',
     );
+    await env.ACCOUNTS_DB.exec('DROP TABLE hostserv_pending_vhosts');
+    await env.ACCOUNTS_DB.exec(
+      'CREATE TABLE hostserv_pending_vhosts (account_key TEXT PRIMARY KEY, account TEXT, vhost TEXT)',
+    );
     await env.ACCOUNTS_DB.exec('DROP TABLE read_markers');
     await env.ACCOUNTS_DB.exec(
       'CREATE TABLE read_markers (account_key TEXT NOT NULL, channel_key TEXT NOT NULL, account TEXT, channel TEXT, msgid TEXT)',
@@ -541,6 +558,11 @@ describe('D1ServicesStore — tolerance', () => {
     )
       .bind('bad#v', null, 'cloak')
       .run();
+    await env.ACCOUNTS_DB.prepare(
+      'INSERT INTO hostserv_pending_vhosts (account_key, account, vhost) VALUES (?, ?, ?)',
+    )
+      .bind('bad#pv', 'someone', null)
+      .run();
     await env.ACCOUNTS_DB.prepare(
       'INSERT INTO read_markers (account_key, channel_key, account, channel, msgid) VALUES (?, ?, ?, ?, ?)',
     )
@@ -552,6 +574,7 @@ describe('D1ServicesStore — tolerance', () => {
     if (!store) throw new Error('services store failed to load');
     const snap = store.snapshot();
     expect(snap.vhosts).toEqual([]);
+    expect(snap.pendingVhosts).toEqual([]);
     expect(snap.readMarkers).toEqual([]);
   });
 
@@ -566,6 +589,34 @@ describe('D1ServicesStore — tolerance', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// safeSelect — defensive catch block (real D1 bindings don't throw on
+// existing-table queries; the catch arm is unreachable through integration).
+// ---------------------------------------------------------------------------
+
+describe('safeSelect — defensive catch block', () => {
+  it('returns [] and logs when the underlying D1 query rejects', async () => {
+    // A misbehaving binding (transient unavailability, schema drift) would
+    // otherwise brick NickServ for the whole connection (the snapshot is
+    // cached for life). The catch arm logs to wrangler tail and degrades
+    // to an empty result.
+    const stub = {
+      prepare(): { all(): Promise<never> } {
+        return {
+          all: async () => {
+            throw new Error('simulated D1 outage');
+          },
+        };
+      },
+    };
+    const result = await safeSelect<{ x: unknown }>(
+      stub as unknown as Parameters<typeof safeSelect>[0],
+      'SELECT * FROM nicks',
+    );
+    expect(result).toEqual([]);
+  });
+});
+
 function emptySnapshot(): ServicesSnapshot {
   return {
     nicks: [],

package/packages/cf-adapter/tests/serialize.test.ts

@@ -306,4 +306,29 @@ describe('deserialize — migrate integration', () => {
     expect(state.userModes.wallops).toBe(true);
     expect(state.caps).toEqual(new Set(['server-time']));
   });
+
+  it('coalesces an explicit `secure: null` to false via the ?? fallback', () => {
+    // `migrate` only backfills `secure` when the key is absent (=== undefined);
+    // an explicit null survives and the `?? false` arm in `deserialize` must
+    // catch it. Mirrors a hand-edited storage row where someone wrote null.
+    const rec = {
+      version: 1,
+      id: 'c',
+      registration: 'registered' as const,
+      capNegotiating: false,
+      secure: null,
+      caps: [],
+      joinedChannels: [],
+      userModes: {
+        invisible: false,
+        oper: false,
+        wallops: false,
+        serverNotices: false,
+        tls: false,
+      },
+      lastSeen: 0,
+      connectedSince: 0,
+    };
+    expect(deserialize(rec).secure).toBe(false);
+  });
 });

package/packages/in-memory-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/in-memory-runtime",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Single-process reference implementation of the IrcRuntime port, backed by Maps",
   "license": "BSD-3-Clause",

package/packages/irc-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-core",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Platform-agnostic IRC protocol core: parser, serializer, command reducers, state shapes",
   "license": "BSD-3-Clause",

package/packages/irc-core/src/account-migration.ts

@@ -0,0 +1,140 @@
+/**
+ * Pure helpers for the one-shot `accounts` → `nickserv_accounts` /
+ * `Services` migration (`tools/migrate-accounts-to-services.ts`).
+ *
+ * Lives in `irc-core` so both adapter test suites can import the helpers
+ * without a cross-adapter dependency. The CLI entry point (wrangler /
+ * DynamoDB IO) lives in the tools script; these helpers are side-effect-
+ * free and fully unit-testable.
+ */
+
+import { caseFold } from './case-fold.js';
+import { hashAccountCredential } from './credential-hashing.js';
+
+/**
+ * DDL for the `nickserv_accounts` table (the migration target). Inlined
+ * rather than imported from `@serverless-ircd/cf-adapter` so the helpers
+ * are testable from any package. Kept in sync with
+ * `cf-adapter/src/d1-services-store.ts`.
+ */
+export const MIGRATION_NICKSERV_ACCOUNTS_SQL =
+  "CREATE TABLE IF NOT EXISTS nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, cert_subjects TEXT NOT NULL DEFAULT '[]', algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)";
+
+/** Parsed `SASL_ACCOUNTS` env var entry. */
+export interface ParsedSaslAccount {
+  username: string;
+  password: string;
+}
+
+/** A raw legacy `accounts` row read from D1 or DynamoDB. */
+export interface LegacyAccountRow {
+  account: string;
+  algorithm: string;
+  salt: string;
+  hash: string;
+}
+
+/** Parses the `SASL_ACCOUNTS` env var into credential entries. */
+export function parseSaslAccountsForMigration(raw: string | undefined): ParsedSaslAccount[] {
+  if (raw === undefined || raw.length === 0) return [];
+  const out: ParsedSaslAccount[] = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue;
+    const username = trimmed.slice(0, sep);
+    const password = trimmed.slice(sep + 1);
+    if (username.length === 0 || password.length === 0) continue;
+    out.push({ username, password });
+  }
+  return out;
+}
+
+/**
+ * Builds the set of `INSERT OR IGNORE` SQL statements that backfill the
+ * legacy `accounts` rows plus the `SASL_ACCOUNTS` env-seed entries into
+ * `nickserv_accounts`. Pure (no IO).
+ *
+ * - Legacy rows are copied verbatim (the pre-hashed scrypt credential is
+ *   preserved; the plaintext is NOT re-hashed). The services row carries
+ *   `cert_subjects = '[]'`, email `''`, enforce `'none'`, `created_at 0`.
+ * - `SASL_ACCOUNTS` env-seed entries are hashed fresh (the env var carries
+ *   plaintext passwords). Only entries whose username is NOT already
+ *   present in the legacy rows are emitted (legacy rows win over the env
+ *   seed).
+ * - `INSERT OR IGNORE` guarantees idempotency: an existing
+ *   `nickserv_accounts` row (registered via NickServ or a prior seed) is
+ *   never clobbered.
+ *
+ * @returns The array of executable SQL statements (CREATE TABLE + INSERTs).
+ */
+export function buildMigrationSql(
+  legacyRows: ReadonlyArray<LegacyAccountRow>,
+  saslAccountsRaw: string | undefined,
+): string[] {
+  const statements: string[] = [MIGRATION_NICKSERV_ACCOUNTS_SQL];
+
+  const seen = new Set<string>();
+
+  for (const row of legacyRows) {
+    const nickKey = caseFold('rfc1459', row.account);
+    seen.add(nickKey);
+    statements.push(buildInsertOrIgnore(row.account, row));
+  }
+
+  for (const acct of parseSaslAccountsForMigration(saslAccountsRaw)) {
+    const nickKey = caseFold('rfc1459', acct.username);
+    if (seen.has(nickKey)) continue;
+    seen.add(nickKey);
+    const cred = hashAccountCredential(acct.username, acct.password);
+    statements.push(buildInsertOrIgnore(acct.username, cred));
+  }
+
+  return statements;
+}
+
+function buildInsertOrIgnore(
+  username: string,
+  cred: { algorithm: string; salt: string; hash: string },
+): string {
+  const nickKey = caseFold('rfc1459', username);
+  return `INSERT OR IGNORE INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES ('${sqlEscape(nickKey)}', '${sqlEscape(username)}', '${sqlEscape(username)}', '', 0, 'none', '[]', '${sqlEscape(cred.algorithm)}', '${sqlEscape(cred.salt)}', '${sqlEscape(cred.hash)}')`;
+}
+
+/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
+function sqlEscape(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+/**
+ * Builds the DynamoDB `PutItem` input for a legacy row, targeting the
+ * `Services` table's `NICK:<fold>` / `#` item. Pure.
+ *
+ * The caller wraps this in a conditional PutItem
+ * (`ConditionExpression: attribute_not_exists(pk)`) so an existing nick
+ * registration is never clobbered.
+ */
+export function buildServicesPutItem(
+  row: { account: string; algorithm: string; salt: string; hash: string },
+  tableName: string,
+): { TableName: string; Item: Record<string, unknown> } {
+  const fold = caseFold('rfc1459', row.account);
+  return {
+    TableName: tableName,
+    Item: {
+      pk: `NICK:${fold}`,
+      sk: '#',
+      type: 'nick',
+      nick: row.account,
+      account: row.account,
+      email: '',
+      createdAt: 0,
+      enforce: 'none',
+      certSubjects: [],
+      algorithm: row.algorithm,
+      salt: row.salt,
+      hash: row.hash,
+    },
+  };
+}

package/packages/irc-core/src/commands/account-auth.ts

@@ -13,8 +13,10 @@
  *
  * {@link passBasedAccountAuth} is the legacy IRC convention of carrying
  * NickServ credentials in `PASS <nick>:<password>` at registration; it
- * resolves at registration completion via the injected
- * {@link AccountStore} and, on success, delegates to
+ * resolves at registration completion via the bound
+ * {@link ServicesStore} (`services.verifyNick` — the same single
+ * credential home NickServ `REGISTER`, SASL PLAIN, and NickServ
+ * `IDENTIFY` consult) and, on success, delegates to
  * {@link applyAccountSuccess}.
  */
 
@@ -129,17 +131,20 @@ export function passBasedAccountAuth(state: ConnectionState, ctx: Ctx): EffectTy
  * in `passReducer` (reading the `PASS` param directly), so the two entry
  * points share one verify+success path and never diverge.
  *
- * Returns the account-login success effects (`900`/`903`/`+r`/read-marker
+ * Credentials are verified against the bound {@link ServicesStore} via
+ * `services.verifyNick` — the same single credential home NickServ
+ * `REGISTER`, SASL PLAIN, and NickServ `IDENTIFY` consult. Returns the
+ * account-login success effects (`900`/`903`/`+r`/read-marker
  * seeding/away replay/memo delivery/`account-notify`), or `[]` for every
  * other outcome:
  *   - already identified (`state.account` set, e.g. via SASL) → no-op;
  *   - no `<nick>:<password>` form (bare value or undefined) → no-op;
  *   - payload nick does not match `state.nick` (when set) → no-op;
- *   - no {@link AccountStore} bound → no-op;
+ *   - no {@link ServicesStore} bound → no-op;
  *   - verify failure (unknown nick or wrong password) → no-op.
  *
  * A failed verify is followed by a verify against a fixed dummy entry so
- * the failure path performs the same AccountStore work whether the payload
+ * the failure path performs the same scrypt work whether the payload
  * nick was unknown or the password was wrong — the observable outcome
  * (no numerics, no disconnect, no state change) is identical for both
  * cases, giving no information to a remote attacker.
@@ -153,24 +158,16 @@ export function attemptPassAccountAuth(
   const parsed = parsePassAccountAttempt(attempt);
   if (parsed === null) return [];
   if (state.nick !== undefined && state.nick !== parsed.nick) return [];
-  const store = ctx.accounts;
-  if (store === undefined) return [];
-  const result = store.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: parsed.nick,
-    password: parsed.password,
-  });
+  const services = ctx.services;
+  if (services === undefined) return [];
+  const result = services.verifyNick(parsed.nick, parsed.password);
   if (result.ok) {
     return applyAccountSuccess(state, ctx, result.account);
   }
   // Equalise timing: perform a verify against a fixed dummy entry so a
-  // failed PASS-auth always costs one extra AccountStore call regardless
-  // of whether the payload nick was unknown or the password was wrong.
-  store.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: PASS_AUTH_DUMMY_NICK,
-    password: PASS_AUTH_DUMMY_PASSWORD,
-  });
+  // failed PASS-auth always costs one extra scrypt verify regardless of
+  // whether the payload nick was unknown or the password was wrong.
+  services.verifyNick(PASS_AUTH_DUMMY_NICK, PASS_AUTH_DUMMY_PASSWORD);
   return [];
 }
 

package/packages/irc-core/src/commands/memoserv.ts

@@ -19,7 +19,7 @@
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. The services store is synchronous (mirrors
- * the {@link AccountStore} / {@link MessageStore} pattern).
+ * the {@link MessageStore} pattern).
  */
 
 import { caseFold } from '../case-fold.js';