serverless-ircd 0.9.0 → 0.10.0

package/packages/irc-core/tests/account-migration.test.ts

@@ -0,0 +1,133 @@
+import { describe, expect, it } from 'vitest';
+import {
+  type LegacyAccountRow,
+  buildMigrationSql,
+  buildServicesPutItem,
+  parseSaslAccountsForMigration,
+} from '../src/account-migration';
+
+describe('parseSaslAccountsForMigration', () => {
+  it('returns an empty array for undefined', () => {
+    expect(parseSaslAccountsForMigration(undefined)).toEqual([]);
+  });
+
+  it('returns an empty array for an empty string', () => {
+    expect(parseSaslAccountsForMigration('')).toEqual([]);
+  });
+
+  it('parses a single username:password entry', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret')).toEqual([
+      { username: 'alice', password: 's3cret' },
+    ]);
+  });
+
+  it('skips blank lines and malformed entries', () => {
+    expect(
+      parseSaslAccountsForMigration('alice:s3cret\n\nnocolon\n:emptyuser\nemptypass:\n   \n'),
+    ).toEqual([{ username: 'alice', password: 's3cret' }]);
+  });
+});
+
+describe('buildMigrationSql', () => {
+  const legacyRow = (account: string, salt = 'salt', hash = 'hash'): LegacyAccountRow => ({
+    account,
+    algorithm: 'scrypt',
+    salt,
+    hash,
+  });
+
+  it('creates a nickserv_accounts row with cert_subjects "[]" for a legacy account', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts[0]).toContain('CREATE TABLE IF NOT EXISTS nickserv_accounts');
+    expect(stmts[1]).toContain('INSERT OR IGNORE');
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'[]'");
+  });
+
+  it('uses INSERT OR IGNORE (never REPLACE)', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts[1]).toContain('INSERT OR IGNORE');
+    expect(stmts[1]).not.toContain('INSERT OR REPLACE');
+  });
+
+  it('is idempotent (same input → same output)', () => {
+    const stmts1 = buildMigrationSql([legacyRow('alice')], undefined);
+    const stmts2 = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts1).toEqual(stmts2);
+  });
+
+  it('carries SASL_ACCOUNTS env-seed entries not in the legacy table', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], 'bob:bobspw\nalice:alicespw');
+    expect(stmts).toHaveLength(3);
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[2]).toContain("'bob'");
+    expect(stmts[2]).not.toContain("'bobspw'");
+  });
+
+  it('does not re-hash legacy rows', () => {
+    const stmts = buildMigrationSql([legacyRow('alice', 'mysalt', 'myhash')], undefined);
+    expect(stmts[1]).toContain("'mysalt'");
+    expect(stmts[1]).toContain("'myhash'");
+  });
+
+  it('produces only CREATE TABLE when both inputs are empty', () => {
+    const stmts = buildMigrationSql([], undefined);
+    expect(stmts).toHaveLength(1);
+  });
+
+  it('escapes single quotes in usernames', () => {
+    const stmts = buildMigrationSql([legacyRow("O'Brien")], undefined);
+    expect(stmts[1]).toContain("'O''Brien'");
+  });
+});
+
+describe('buildServicesPutItem', () => {
+  it('targets the NICK:<fold> partition', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'StagingServices',
+    );
+    expect(input.TableName).toBe('StagingServices');
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.sk).toBe('#');
+    expect(input.Item.type).toBe('nick');
+  });
+
+  it('preserves the legacy scrypt credential fields', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 'mysalt', hash: 'myhash' },
+      'Services',
+    );
+    expect(input.Item.algorithm).toBe('scrypt');
+    expect(input.Item.salt).toBe('mysalt');
+    expect(input.Item.hash).toBe('myhash');
+  });
+
+  it('defaults certSubjects to an empty array', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.certSubjects).toEqual([]);
+  });
+
+  it('folds the nick case-insensitively', () => {
+    const input = buildServicesPutItem(
+      { account: 'Alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.nick).toBe('Alice');
+  });
+
+  it('stamps default email / enforce / createdAt', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.email).toBe('');
+    expect(input.Item.enforce).toBe('none');
+    expect(input.Item.createdAt).toBe(0);
+  });
+});

package/packages/irc-core/tests/commands/markread.test.ts

@@ -115,6 +115,24 @@ describe('markreadChannelReducer — cap gating', () => {
       Effect.send('c1', [L(':irc.example.com 421 alice MARKREAD :Unknown command')]),
     ]);
   });
+
+  it('substitutes * for the nick in the 421 numeric when the connection has no nick', () => {
+    const chan = makeChan();
+    // A bare connection: no nick set and no draft/read-marker cap negotiated.
+    // The 421 numeric's `ctx.connection.nick ?? '*'` falls back to `*`.
+    const conn = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(conn);
+
+    const out = markreadChannelReducer(
+      chan,
+      { command: 'MARKREAD', params: ['#foo', ts(2_000)], tags: {} },
+      ctx,
+    );
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 421 * MARKREAD :Unknown command')]),
+    ]);
+  });
 });
 
 // ============================================================================
@@ -168,6 +186,42 @@ describe('markreadChannelReducer — parameter errors', () => {
       Effect.send('c1', [READ_MARKER_FAIL('INVALID_PARAMS', 'Invalid parameters')]),
     ]);
   });
+
+  it('FAILs with INVALID_PARAMS when the timestamp prefix is present but the value is empty', () => {
+    const chan = makeChan();
+    addMember(chan, 'c1', 'alice');
+    const store = new InMemoryMessageStore();
+    seed(store, '#foo', 3);
+    const ctx = makeCtx(makeConn(), new FakeClock(10_000), store);
+
+    const out = markreadChannelReducer(
+      chan,
+      { command: 'MARKREAD', params: ['#foo', 'timestamp='], tags: {} },
+      ctx,
+    );
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [READ_MARKER_FAIL('INVALID_PARAMS', 'Invalid parameters')]),
+    ]);
+  });
+
+  it('FAILs with INVALID_PARAMS when the timestamp value is not a parseable date', () => {
+    const chan = makeChan();
+    addMember(chan, 'c1', 'alice');
+    const store = new InMemoryMessageStore();
+    seed(store, '#foo', 3);
+    const ctx = makeCtx(makeConn(), new FakeClock(10_000), store);
+
+    const out = markreadChannelReducer(
+      chan,
+      { command: 'MARKREAD', params: ['#foo', 'timestamp=not-a-date'], tags: {} },
+      ctx,
+    );
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [READ_MARKER_FAIL('INVALID_PARAMS', 'Invalid parameters')]),
+    ]);
+  });
 });
 
 // ============================================================================

package/packages/irc-core/tests/commands/memoserv.test.ts

@@ -71,6 +71,25 @@ describe('memoservReducer — services availability', () => {
   });
 });
 
+describe('memoservReducer — empty body', () => {
+  it('replies with the help notice when the PRIVMSG carries no body parameter', () => {
+    const conn = makeConn();
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(conn, services);
+    // params: [MEMOSERV_NICK] only — params[1] is undefined, exercising the
+    // `msg.params[1] ?? ''` fallback. The empty body resolves to an empty
+    // subcommand, which emits the help notice.
+    const out = memoservReducer(
+      conn,
+      { command: 'PRIVMSG', params: [MEMOSERV_NICK], tags: {} },
+      ctx,
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :Available commands: SEND, LIST, READ, DEL',
+    );
+  });
+});
+
 describe('memoservReducer — SEND', () => {
   it('requires the sender to be identified', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });

package/packages/irc-core/tests/commands/nickserv.test.ts

@@ -622,7 +622,7 @@ describe('nickservReducer — misc', () => {
     const out = nickservReducer(conn, privmsg('FROBNICATE foo bar'), ctx);
 
     expect(sentTexts(out.effects)).toContain(
-      ':NickServ!NickServ@services NOTICE alice :Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET',
+      ':NickServ!NickServ@services NOTICE alice :Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET (ENFORCE, PASSWORD)',
     );
   });
 
@@ -857,6 +857,242 @@ describe('nickservReducer — SET ENFORCE', () => {
   });
 });
 
+// ============================================================================
+// SET PASSWORD
+// ============================================================================
+
+describe('nickservReducer — SET PASSWORD', () => {
+  it('changes the password when the caller supplies the correct old one', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+    // The new password verifies, the old one no longer does.
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(true);
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('rejects a wrong old password and leaves the credential unchanged', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD wrongold newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+    // The original password still verifies; the new one does not.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(false);
+  });
+
+  it('requires identification before SET PASSWORD (unidentified caller)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    // No account / +r.
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before changing your password.',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(false);
+  });
+
+  it('rejects SET PASSWORD when identified as a different account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    // bob is identified, but is using alice's nick.
+    services.registerNick('bob', 'bobpw', 'bob@example.com');
+    const conn = makeConn('c1', 'alice');
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before changing your password.',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(false);
+  });
+
+  it('emits the syntax notice when args are missing', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const noArgs = nickservReducer(conn, privmsg('SET PASSWORD'), ctx);
+    expect(sentTexts(noArgs.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET PASSWORD <old-password> <new-password>',
+    );
+
+    const oneArg = nickservReducer(conn, privmsg('SET PASSWORD only-one'), ctx);
+    expect(sentTexts(oneArg.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET PASSWORD <old-password> <new-password>',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+  });
+
+  it('rejects a new password shorter than the default minimum (8)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 short'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password is too short (minimum 8 characters).',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'short').ok).toBe(false);
+  });
+
+  it('honours a configured nickServ.minPasswordLength override', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx: Ctx = buildCtx({
+      serverConfig: { ...serverConfig, nickServ: { minPasswordLength: 12 } },
+      clock: new FakeClock(NOW),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: conn,
+      services,
+    });
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 elevenchars'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password is too short (minimum 12 characters).',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+  });
+
+  it('rejects a new password longer than the maximum (256)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const tooLong = 'x'.repeat(257);
+    const out = nickservReducer(conn, privmsg(`SET PASSWORD hunter2 ${tooLong}`), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password is too long (maximum 256 characters).',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+  });
+
+  it('keeps the session +r after a successful change (no re-identify required)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(conn.userModes.registered).toBe(true);
+    expect(conn.account).toBe('alice');
+  });
+
+  it('accepts a new password exactly at the minimum length boundary (8)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 exactly8'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+    expect(services.verifyNick('alice', 'exactly8').ok).toBe(true);
+  });
+
+  it('accepts a new password exactly at the maximum length boundary (256)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const boundary = 'x'.repeat(256);
+    const out = nickservReducer(conn, privmsg(`SET PASSWORD hunter2 ${boundary}`), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+    expect(services.verifyNick('alice', boundary).ok).toBe(true);
+  });
+
+  it('is case-insensitive on the PASSWORD subkey', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('set password hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+  });
+
+  it('rejects SET PASSWORD on an unregistered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is not registered.',
+    );
+  });
+});
+
 // ============================================================================
 // enforceRegisteredNick — the enforcement hook fired by the NICK path
 // ============================================================================

package/packages/irc-core/tests/commands/oper.test.ts

@@ -81,6 +81,21 @@ describe('operReducer — successful authentication', () => {
     expect(modeLines).toContain(':alice!alice@example.com MODE alice +o');
   });
 
+  it('falls back to ? / * in the MODE echo when the connection has no nick or hostmask', () => {
+    // A bare connection with no nick/user/host: hostmaskOf returns undefined
+    // and state.nick is undefined, so modeEchoLine falls back to '?' / '*'.
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(state);
+
+    const out = operReducer(state, oper('alice', 'secret'), ctx);
+
+    expect(out.state.userModes.oper).toBe(true);
+    const modeLines = out.effects
+      .filter((e): e is Extract<EffectType, { tag: 'Send' }> => e.tag === 'Send')
+      .flatMap((e) => e.lines.map((l) => l.text));
+    expect(modeLines).toContain(':? MODE * +o');
+  });
+
   it('matches the second configured credential pair', () => {
     const state = makeState();
     const ctx = makeCtx(state);