serverless-ircd 0.9.0 → 0.10.0

package/packages/irc-core/src/commands/nickserv.ts

@@ -26,10 +26,10 @@
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. The services store is synchronous (mirrors
- * the {@link AccountStore} / {@link MessageStore} pattern).
+ * the {@link MessageStore} pattern).
  */
 
-import { DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
+import { DEFAULT_MIN_PASSWORD_LENGTH, DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { NickEnforcePolicy, ServicesStore } from '../ports.js';
@@ -48,6 +48,30 @@ const SERVICES_HOST = 'services';
 /** Policies accepted by `SET ENFORCE` (lowercased input forms). */
 const ENFORCE_POLICIES: ReadonlySet<NickEnforcePolicy> = new Set(['none', 'ghost', 'kill']);
 
+/**
+ * Fixed maximum password length accepted by `SET PASSWORD`. Bounds the
+ * scrypt input budget (256 is the practical limit of the scrypt input);
+ * not configurable. Over-long passwords are rejected before hashing.
+ */
+const MAX_PASSWORD_LENGTH = 256;
+
+/**
+ * Gate NOTICE sent to an unidentified caller (or one identified as a
+ * different account) attempting `SET ENFORCE`. Wording kept verbatim from
+ * the original inline literal so the existing ENFORCE test suite is not
+ * churned by the addition of `SET PASSWORD` (a sibling constant covers the
+ * PASSWORD gate).
+ */
+const ENFORCE_GATE_NOTICE = 'You must identify before changing enforcement.';
+
+/**
+ * Gate NOTICE sent to an unidentified caller (or one identified as a
+ * different account) attempting `SET PASSWORD`. Wording mirrors the ENFORCE
+ * gate's intent but speaks to "password" rather than "enforcement" so a
+ * caller who hits it understands which subcommand they tripped.
+ */
+const PASSWORD_GATE_NOTICE = 'You must identify before changing your password.';
+
 /**
  * Reducer for `PRIVMSG NickServ :<subcommand> <args…>`.
  * Authority: the invoking connection's {@link ConnectionState}.
@@ -318,12 +342,24 @@ export function enforceRegisteredNick(state: ConnectionState, ctx: Ctx): EffectT
 // ============================================================================
 
 /**
- * Handles `SET <subkey> <args…>`. Currently only `ENFORCE none|ghost|kill`
- * is supported; unknown subkeys fall back to the ENFORCE syntax notice.
+ * Handles `SET <subkey> <args…>`. Supported subkeys:
+ *
+ *   - `ENFORCE none|ghost|kill` — sets the per-account enforcement policy.
+ *   - `PASSWORD <old> <new>` — self-service password change. Requires the
+ *     current password to be re-supplied as a defence against a hijacked
+ *     identified session (a stolen `+r` session should not let an attacker
+ *     silently rotate the password and lock the real owner out — this is
+ *     Atheme's shape, not the alternative "trust the gate" one-arg form).
+ *     The new password is re-hashed via `hashAccountCredential` and
+ *     overwrites the stored credential via
+ *     {@link ServicesStore.setNickPassword}; the current session stays
+ *     `+r` and other sessions of the same account are NOT kicked.
+ *
+ * Unknown subkeys fall back to the ENFORCE syntax notice.
  *
- * Requires the caller to be identified as the account bound to the current
- * nick: enforcement is a per-account policy, so an unidentified client
- * (or one identified as a different account) cannot mutate it.
+ * Both subkeys require the caller to be identified as the account bound to
+ * the current nick: an unidentified client (or one identified as a
+ * different account) cannot mutate the account.
  */
 function handleSet(
   state: ConnectionState,
@@ -331,8 +367,10 @@ function handleSet(
   ctx: Ctx,
   effects: EffectType[],
 ): { state: ConnectionState; effects: EffectType[] } {
-  const services = ctx.services as ServicesStore;
   const subkey = args[0]?.toUpperCase();
+  if (subkey === 'PASSWORD') {
+    return handleSetPassword(state, args.slice(1), ctx, effects);
+  }
   if (subkey !== 'ENFORCE') {
     effects.push(enforceSyntaxNotice(state));
     return { state, effects };
@@ -347,10 +385,11 @@ function handleSet(
 
   const nick = state.nick;
   if (nick === undefined || state.account === undefined) {
-    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    effects.push(notice(state, ENFORCE_GATE_NOTICE));
     return { state, effects };
   }
 
+  const services = ctx.services as ServicesStore;
   const rec = services.getNick(nick);
   if (rec === undefined) {
     effects.push(notice(state, `Nick ${nick} is not registered.`));
@@ -358,7 +397,7 @@ function handleSet(
   }
   // The caller must be identified as the account that owns this nick.
   if (state.account !== rec.account) {
-    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    effects.push(notice(state, ENFORCE_GATE_NOTICE));
     return { state, effects };
   }
 
@@ -367,11 +406,80 @@ function handleSet(
   return { state, effects };
 }
 
+/**
+ * Handles `SET PASSWORD <old> <new>`. Mirrors the `SET ENFORCE` identify
+ * gate (`state.account === rec.account`), then re-verifies the current
+ * password (no-leak parity with `IDENTIFY`'s `Invalid password.` notice)
+ * and enforces the configurable minimum / fixed maximum length on the new
+ * password before re-hashing and persisting.
+ */
+function handleSetPassword(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const oldPassword = args[0];
+  const newPassword = args[1];
+  if (oldPassword === undefined || newPassword === undefined) {
+    effects.push(passwordSyntaxNotice(state));
+    return { state, effects };
+  }
+
+  const nick = state.nick;
+  if (nick === undefined || state.account === undefined) {
+    effects.push(notice(state, PASSWORD_GATE_NOTICE));
+    return { state, effects };
+  }
+
+  const services = ctx.services as ServicesStore;
+  const rec = services.getNick(nick);
+  if (rec === undefined) {
+    effects.push(notice(state, `Nick ${nick} is not registered.`));
+    return { state, effects };
+  }
+  // The caller must be identified as the account that owns this nick.
+  if (state.account !== rec.account) {
+    effects.push(notice(state, PASSWORD_GATE_NOTICE));
+    return { state, effects };
+  }
+
+  // Re-verify the current password (defence against a hijacked `+r`
+  // session). Same `verifyNick` path `IDENTIFY` uses → same `Invalid
+  // password.` notice → no information leak about whether the account
+  // exists (the gate above already proved it does).
+  if (!services.verifyNick(nick, oldPassword).ok) {
+    effects.push(notice(state, 'Invalid password.'));
+    return { state, effects };
+  }
+
+  const minLen = ctx.serverConfig.nickServ?.minPasswordLength ?? DEFAULT_MIN_PASSWORD_LENGTH;
+  if (newPassword.length < minLen) {
+    effects.push(notice(state, `Password is too short (minimum ${minLen} characters).`));
+    return { state, effects };
+  }
+  if (newPassword.length > MAX_PASSWORD_LENGTH) {
+    effects.push(
+      notice(state, `Password is too long (maximum ${MAX_PASSWORD_LENGTH} characters).`),
+    );
+    return { state, effects };
+  }
+
+  services.setNickPassword(nick, newPassword);
+  effects.push(notice(state, 'Password changed.'));
+  return { state, effects };
+}
+
 /** Builds the `SET ENFORCE` syntax NOTICE. */
 function enforceSyntaxNotice(state: ConnectionState): EffectType {
   return notice(state, 'Syntax: SET ENFORCE none|ghost|kill');
 }
 
+/** Builds the `SET PASSWORD` syntax NOTICE. */
+function passwordSyntaxNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Syntax: SET PASSWORD <old-password> <new-password>');
+}
+
 // ============================================================================
 // Notice helpers
 // ============================================================================
@@ -387,7 +495,10 @@ function helpNotice(state: ConnectionState): EffectType {
 }
 
 function unknownNotice(state: ConnectionState): EffectType {
-  return notice(state, 'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET');
+  return notice(
+    state,
+    'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET (ENFORCE, PASSWORD)',
+  );
 }
 
 /**

package/packages/irc-core/src/commands/registration.ts

@@ -119,7 +119,7 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
   // the account-login numerics (900/903 + downstream effects), satisfying
   // the gate as a side effect. On every other outcome it returns `[]` and
   // the gate below decides. No-op when already identified (SASL), when no
-  // `<nick>:<password>` form is present, or when no AccountStore is bound.
+  // `<nick>:<password>` form is present, or when no ServicesStore is bound.
   const authEffects = passBasedAccountAuth(state, ctx);
 
   const gateFailure = passwordGateFailure(state, ctx);
@@ -351,7 +351,7 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
  *
  * Post-registration: a bare server password is meaningless, so only the
  * `<nick>:<password>` form is honoured — as a late account login via
- * {@link attemptPassAccountAuth} against the bound `ctx.accounts`. Every
+ * {@link attemptPassAccountAuth} against the bound `ctx.services`. Every
  * other outcome (bare value, no store, already identified, verify failure)
  * is a silent no-op: no `462`, no disconnect. This lets a client that
  * completed `NICK`+`USER` before sending `PASS` identify after the fact.

package/packages/irc-core/src/commands/sasl.ts

@@ -13,12 +13,14 @@
  *      Anything else gets `908 ERR_SASLMECHS` listing what is available.
  *   2. `AUTHENTICATE <b64>` / `AUTHENTICATE +` — delivers the payload (whole
  *      or in `<=400`-byte chunks; `+` marks an empty/final chunk). The
- *      decoded bytes are handed to the injected {@link AccountStore}; on
- *      success the connection records the account name and the reducer emits
- *      `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure `904 ERR_SASLFAIL`.
+ *      decoded bytes are verified against the bound {@link ServicesStore};
+ *      on success the connection records the account name and the reducer
+ *      emits `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure
+ *      `904 ERR_SASLFAIL`. PLAIN consults `services.verifyNick`, EXTERNAL
+ *      consults `services.verifyCertFP` against the mTLS-resolved subject.
  *   3. `AUTHENTICATE *` — client abort → `906 ERR_SASLABORT`.
  *
- * The `AccountStore` port is **synchronous** (see {@link AccountStore} docs):
+ * The {@link ServicesStore} port is **synchronous** (reducers stay pure):
  * adapters pre-load credentials so the reducer stays pure. Async backends
  * resolve their lookups before the actor invokes this reducer.
  *
@@ -29,7 +31,7 @@
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
-import type { SaslResult } from '../ports.js';
+import type { ServicesAuthResult } from '../ports.js';
 import { decodeBase64 } from '../protocol/base64.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ConnectionState } from '../state/connection.js';
@@ -143,7 +145,7 @@ function handlePayload(
   return finalize(state, next, mech, ctx);
 }
 
-/** Decodes the accumulated payload and runs it through the AccountStore. */
+/** Decodes the accumulated payload and verifies it against the ServicesStore. */
 function finalize(
   state: ConnectionState,
   payloadB64: string,
@@ -169,28 +171,16 @@ function finalizePlain(
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
 
-  // Prefer the static AccountStore; fall back to the ServicesStore so a
-  // nick registered via NickServ can authenticate via SASL PLAIN without a
-  // separate static credential table. When neither verifies, fail.
-  const store = ctx.accounts;
-  let result = store?.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: parsed.username,
-    password: parsed.password,
-  });
-
-  if (result === undefined || !result.ok) {
-    const servicesResult = ctx.services?.verifyNick(parsed.username, parsed.password);
-    if (servicesResult?.ok) {
-      result = servicesResult;
-    }
-  }
-
-  if (result === undefined) {
+  // Single credential home: services.verifyNick covers every NickServ
+  // registration, every SASL_ACCOUNTS-seeded account (carried into
+  // services via the boot ingest), and every PASS-auth share. No separate
+  // static credential fallback — there is no second credential table.
+  const services = ctx.services;
+  if (services === undefined) {
     clearSasl(state);
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
-
+  const result = services.verifyNick(parsed.username, parsed.password);
   return applyResult(state, result, ctx);
 }
 
@@ -207,21 +197,22 @@ function finalizeExternal(
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
 
-  const store = ctx.accounts;
-  if (store === undefined) {
+  // Cert subjects are mapped to accounts via services.verifyCertFP — the
+  // same single credential home as SASL PLAIN / PASS-auth. No separate
+  // services lookup.
+  const services = ctx.services;
+  if (services === undefined) {
     clearSasl(state);
     return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
   }
-
-  const result = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity });
-
+  const result = services.verifyCertFP(identity);
   return applyResult(state, result, ctx);
 }
 
 /** Shared success/failure handling after a `verify` call. */
 function applyResult(
   state: ConnectionState,
-  result: SaslResult,
+  result: ServicesAuthResult,
   ctx: Ctx,
 ): { state: ConnectionState; effects: EffectType[] } {
   clearSasl(state);

package/packages/irc-core/src/config.ts

@@ -34,8 +34,8 @@ export const OperCredSchema = z.object({
 /**
  * Schema for a single SASL PLAIN account credential. The `username` is also
  * the canonical account name recorded on the connection (for `extended-join`
- * / `account-tag`). Both fields are non-empty strings; adapters seed an
- * {@link InMemoryAccountStore} from this list at boot.
+ * / `account-tag`). Both fields are non-empty strings; adapters seed the
+ * `InMemoryServicesStore` from this list at boot.
  */
 export const SaslAccountSchema = z.object({
   username: z.string().min(1),
@@ -173,6 +173,15 @@ export const DEFAULT_CREATED_TEXT: string = BUILD_DATE;
  */
 export const DEFAULT_NICK_ENFORCE_GRACE_MS = 30_000;
 
+/**
+ * Default minimum password length enforced by NickServ `SET PASSWORD`.
+ * Mirrors common IRC services (Atheme/Anope) and modern guidance (NIST
+ * SP 800-63B). Overridable per deployment via
+ * `ServerConfig.nickServ.minPasswordLength`. A new password shorter than
+ * the floor is rejected before hashing.
+ */
+export const DEFAULT_MIN_PASSWORD_LENGTH = 8;
+
 /**
  * The full server-config schema. Optional fields default to deployment-
  * sensible values so a minimal `{ serverName, networkName }` config is
@@ -271,13 +280,12 @@ export const ServerConfigSchema = z.object({
   operCreds: z.array(OperCredSchema).default([]),
 
   /**
-   * SASL PLAIN account credentials. The adapter seeds an
-   * `InMemoryAccountStore` from this list at boot so `AUTHENTICATE PLAIN`
-   * succeeds end-to-end for the listed accounts. Empty array (the default)
-   * disables SASL account verification: `ctx.accounts` is then omitted and
-   * a client completing `AUTHENTICATE PLAIN` receives `904 ERR_SASLFAIL`.
-   * A persistent variant (DynamoDB `Accounts`, D1) is a documented
-   * follow-up; swapping it in means replacing the construction call.
+   * SASL PLAIN seed credentials. The adapter ingests these into the
+   * `ServicesStore` at boot via `registerNick` (idempotent — existing
+   * registrations win). `AUTHENTICATE PLAIN`, `PASS <nick>:<password>`,
+   * and NickServ `IDENTIFY` all verify against the resulting
+   * `nickserv_accounts` rows. Empty array (the default) leaves the seed
+   * empty; accounts can still be created at runtime via NickServ REGISTER.
    */
   saslAccounts: z.array(SaslAccountSchema).default([]),
 
@@ -357,6 +365,24 @@ export const ServerConfigSchema = z.object({
    */
   nickEnforceGraceMs: z.number().int().nonnegative().optional(),
 
+  /**
+   * NickServ-specific tunables. Currently only the minimum length enforced
+   * by `SET PASSWORD` is configurable; the maximum (256) is fixed to bound
+   * the scrypt input budget. Omit entirely to inherit the documented
+   * defaults.
+   */
+  nickServ: z
+    .object({
+      /**
+       * Minimum length a new password must meet to be accepted by
+       * `SET PASSWORD`. Defaults to {@link DEFAULT_MIN_PASSWORD_LENGTH}
+       * (8) when unset. A shorter new password is rejected before hashing
+       * with `Password is too short (minimum <n> characters).`.
+       */
+      minPasswordLength: z.number().int().positive().optional(),
+    })
+    .optional(),
+
   /**
    * HostServ approval mode for `REQUEST <vhost>`. `true` (the default)
    * preserves the legacy auto-approve behaviour — the requested vhost is

package/packages/irc-core/src/credential-hashing.ts

@@ -1,10 +1,10 @@
 /**
  * Shared SASL credential hashing primitives.
  *
- * Both the AWS adapter (`DynamoAccountStore`) and the CF adapter
- * (`D1AccountStore`) store SASL PLAIN credentials as **scrypt hashes**.
- * These helpers live in `irc-core` so both adapters share one hashing
- * implementation — the AWS path previously owned the only copy.
+ * Both the AWS adapter (`DynamoServicesStore`) and the CF adapter
+ * (`D1ServicesStore`) store NickServ/SASL credentials as **scrypt hashes**
+ * via the unified `ServicesStore`. These helpers live in `irc-core` so both
+ * adapters share one hashing implementation.
  *
  * Uses `node:crypto` (`scryptSync`), which is available on Node (AWS Lambda)
  * natively and on Cloudflare Workers via the `nodejs_compat` flag. The public
@@ -14,16 +14,16 @@
  */
 
 import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
-import type { AccountStore, SaslPayload, SaslResult } from './ports.js';
 
 const SCRYPT_KEY_LEN = 64;
 const SALT_LEN = 16;
 
 /**
- * A single SASL PLAIN credential stored as a scrypt hash.
+ * A single credential stored as a scrypt hash.
  *
- * Every field is a persistence-backend attribute — this object IS the table
- * row (DynamoDB `Accounts` item / D1 `accounts` row, keyed by `account`).
+ * Every field is a persistence-backend attribute — this object IS the
+ * credential portion of a `nickserv_accounts` row (DynamoDB `Services`
+ * item / D1 `nickserv_accounts` row, keyed by the folded nick).
  * `algorithm` is retained so future migrations to Argon2/bcrypt can be
  * detected and handled gracefully by {@link verifyHashedPassword}.
  */
@@ -36,8 +36,9 @@ export interface HashedAccountCredential {
 
 /**
  * Hashes a plaintext password into a {@link HashedAccountCredential}
- * suitable for writing to the accounts backend (`putAccountCredential` /
- * `seed-cf-accounts`).
+ * suitable for writing to the services backend
+ * (`ServicesStore.registerNick` stores the result on the registered-nick
+ * row).
  *
  * Uses `scryptSync` (memory-hard, GPU-resistant) with a random salt.
  * Pass `{ salt }` for deterministic test scenarios; pass `{ keyLen }` to
@@ -78,47 +79,3 @@ export function verifyHashedPassword(password: string, entry: HashedAccountCrede
   const computed = scryptSync(password, salt, expected.length);
   return computed.length === expected.length && timingSafeEqual(computed, expected);
 }
-
-/**
- * Synchronous {@link AccountStore} backed by pre-loaded hashed credentials.
- *
- * Construct with entries produced by {@link hashAccountCredential} (for unit
- * tests / seeding) or pre-loaded from a persistence backend at boot. Both
- * adapters use this class:
- *
- *   - AWS: `loadDynamoAccountStore` scans the `Accounts` table at Lambda
- *     cold start and constructs this store; `DynamoAccountStore` is a
- *     re-export alias for back-compat.
- *   - CF: `loadD1AccountStore` queries the D1 `accounts` table at
- *     `ConnectionDO` construction (mirroring the two-phase load pattern).
- *
- * The class has zero backend coupling — it works equally well with entries
- * from any source. The `AccountStore.verify` port stays synchronous, so
- * the async pre-load MUST complete before the first frame dispatches.
- */
-export class HashedAccountStore implements AccountStore {
-  private readonly entries: ReadonlyMap<string, HashedAccountCredential>;
-
-  constructor(entries: ReadonlyArray<HashedAccountCredential>) {
-    this.entries = new Map(entries.map((e) => [e.account, e]));
-  }
-
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    if (mech.toUpperCase() !== 'PLAIN' || payload.kind !== 'PLAIN') {
-      return { ok: false, reason: `unsupported mechanism: ${mech}` };
-    }
-    const entry = this.entries.get(payload.username);
-    if (entry === undefined) {
-      return { ok: false, reason: 'invalid credentials' };
-    }
-    if (!verifyHashedPassword(payload.password, entry)) {
-      return { ok: false, reason: 'invalid credentials' };
-    }
-    return { ok: true, account: payload.username };
-  }
-
-  /** Number of loaded accounts (diagnostics / logging). */
-  get size(): number {
-    return this.entries.size;
-  }
-}

package/packages/irc-core/src/index.ts

@@ -11,6 +11,7 @@ export * from './commands/index.js';
 export * from './effects.js';
 export * from './ports.js';
 export * from './credential-hashing.js';
+export * from './account-migration.js';
 export * from './flood-control.js';
 export * from './cloak.js';
 export * from './case-fold.js';