serverless-ircd 0.9.0 → 0.10.0

package/packages/irc-core/tests/commands/registration.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import pkg from '../../package.json' with { type: 'json' };
 import { cloakHost } from '../../src/cloak';
 import {
@@ -27,14 +27,7 @@ import {
   SequentialIdFactory,
   StaticMotdProvider,
 } from '../../src/ports';
-import type {
-  AccountStore,
-  AwayStore,
-  MotdProvider,
-  SaslPayload,
-  SaslResult,
-  ServicesStore,
-} from '../../src/ports';
+import type { AwayStore, MotdProvider, ServicesStore } from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
@@ -615,8 +608,9 @@ describe('passReducer', () => {
 describe('passReducer — post-registration PASS <nick>:<password>', () => {
   it('logs in when PASS <nick>:<password> matches an account after registration', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
 
     expect(out.state.account).toBe('alice');
@@ -632,8 +626,9 @@ describe('passReducer — post-registration PASS <nick>:<password>', () => {
 
   it('does not log in or disconnect when the password is wrong', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
@@ -645,8 +640,8 @@ describe('passReducer — post-registration PASS <nick>:<password>', () => {
   it('is indistinguishable from an unknown nick (no auth numerics, no disconnect)', () => {
     const state = registeredState();
     state.nick = 'nobody';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['nobody:wrong'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
@@ -655,55 +650,63 @@ describe('passReducer — post-registration PASS <nick>:<password>', () => {
 
   it('equalises timing with an extra dummy verify on failure', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     passReducer(state, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
 
-    expect(accounts.calls).toHaveLength(2);
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'wrong',
-    });
-    expect(accounts.calls[1]?.payload.kind).toBe('PLAIN');
+    // Two calls: the real (failed) verify against `alice`, then the
+    // timing-equalising dummy verify.
+    expect(verifyNick).toHaveBeenCalledTimes(2);
+    expect(verifyNick.mock.calls[0]?.[0]).toBe('alice');
+    expect(verifyNick.mock.calls[0]?.[1]).toBe('wrong');
+    // The second call is the dummy; its nick is the sentinel, not 'alice'.
+    expect(verifyNick.mock.calls[1]?.[0]).not.toBe('alice');
   });
 
   it('does not log in when the payload nick does not match state.nick', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'bob' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['bob:hunter2'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(out.effects).toEqual([]);
   });
 
   it('ignores a bare PASS value (no colon) after registration — no 462, no disconnect', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['serverpw'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
     expect(out.effects).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
   });
 
   it('ignores a late PASS when the connection is already identified', () => {
     const state = registeredState();
     state.account = 'alice';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(out.effects).toEqual([]);
     expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
   });
 
-  it('ignores a late PASS <nick>:<password> when no AccountStore is bound', () => {
+  it('ignores a late PASS <nick>:<password> when no ServicesStore is bound', () => {
     const state = registeredState();
     const ctx = makeCtx(state);
     const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
@@ -1630,32 +1633,6 @@ describe('emitWelcomeIfReady — OperServ AKILL admission', () => {
 // PASS-based account auth (NICK + PASS <nick>:<password> + USER → identified)
 // ============================================================================
 
-/** A capture-and-respond fake AccountStore (mirrors the sasl.test.ts fake). */
-class FakeAccountStore implements AccountStore {
-  readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-  constructor(private readonly result: SaslResult) {}
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    this.calls.push({ mech, payload });
-    return this.result;
-  }
-}
-
-/** Like {@link makeCtx} but also threads a bound AccountStore. */
-function makeCtxWithAccounts(
-  state: ConnectionState,
-  accounts: AccountStore,
-  clock = new FakeClock(1_000),
-): Ctx {
-  return buildCtx({
-    serverConfig,
-    clock,
-    ids: new SequentialIdFactory(),
-    motd: EmptyMotdProvider,
-    connection: state,
-    accounts,
-  });
-}
-
 const SV = 'irc.example.com';
 const L2 = (text: string): RawLine => ({ text });
 
@@ -1666,8 +1643,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
     state.user = 'alice';
     state.host = 'example.com';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
 
     const effects = emitWelcomeIfReady(state, ctx);
 
@@ -1684,11 +1662,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
 
 // ---- helpers for the broader PASS-auth coverage ----
 
-/** Flexible ctx that binds any combination of account/services/away stores. */
+/** Flexible ctx that binds any combination of services/away stores. */
 function makeCtxPassAuth(
   state: ConnectionState,
   opts: {
-    accounts?: AccountStore;
     services?: ServicesStore;
     away?: AwayStore;
     serverPassword?: string;
@@ -1703,7 +1680,6 @@ function makeCtxPassAuth(
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
-    ...(opts.accounts !== undefined ? { accounts: opts.accounts } : {}),
     ...(opts.services !== undefined ? { services: opts.services } : {}),
     ...(opts.away !== undefined ? { away: opts.away } : {}),
   });
@@ -1715,16 +1691,16 @@ function sentTexts(effects: EffectType[]): string[] {
 }
 
 describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity with SASL)', () => {
-  it('forwards the parsed credentials to the AccountStore as a PLAIN verify', () => {
+  it('forwards the parsed credentials to services.verifyNick as a PLAIN verify', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'hunter2' } },
-    ]);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
+    expect(verifyNick).toHaveBeenCalledWith('alice', 'hunter2');
   });
 
   it('stamps read-only user mode `r` on a successful PASS-auth', () => {
@@ -1732,8 +1708,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.userModes.registered).toBe(true);
   });
 
@@ -1742,10 +1719,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setLastReadMarker('alice', '#foo', 'm1');
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.lastReadMarkers?.get('#foo')).toBe('m1');
   });
 
@@ -1754,10 +1731,11 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     const away = new InMemoryAwayStore();
     away.set('alice', 'brb');
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, away }));
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services, away }));
     expect(state.away).toBe('brb');
     expect(sentTexts(effects)).toContain(`:${SV} 306 alice :You have been marked as being away`);
   });
@@ -1771,8 +1749,7 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.registerNick('bob', 'pw', 'bob@example.com');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'hi', sentAt: 0 });
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(sentTexts(effects).some((t) => t.includes('[Memo #') && t.includes('hi'))).toBe(true);
   });
 
@@ -1782,10 +1759,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.user = 'alice';
     state.host = 'real.example.net';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setVhost('alice', 'cool.example.net');
-    const ctx = makeCtxPassAuth(state, { accounts, services });
+    const ctx = makeCtxPassAuth(state, { services });
 
     const effects = emitWelcomeIfReady(state, ctx);
 
@@ -1804,9 +1781,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.user = 'alice';
     state.host = 'real.example.net';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
-    const ctx = makeCtxPassAuth(state, { accounts, services });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxPassAuth(state, { services });
 
     emitWelcomeIfReady(state, ctx);
 
@@ -1820,8 +1797,8 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.user = 'alice';
     state.host = '203.0.113.5';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setVhost('alice', 'cool.example.net');
     const ctx: Ctx = buildCtx({
       serverConfig: { ...serverConfig, cloaking: { enabled: true, secret: 's3cret' } },
@@ -1829,7 +1806,6 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
       ids: new SequentialIdFactory(),
       motd: EmptyMotdProvider,
       connection: state,
-      accounts,
       services,
     });
 
@@ -1851,8 +1827,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.account).toBe('alice');
   });
 });
@@ -1863,8 +1840,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.userModes.registered).toBe(false);
@@ -1880,8 +1858,8 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'nobody';
     state.user = 'nobody';
     state.passAttempt = 'nobody:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
@@ -1897,17 +1875,15 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
-
-    expect(accounts.calls).toHaveLength(2);
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'wrong',
-    });
-    expect(accounts.calls[1]?.mech).toBe('PLAIN');
-    expect(accounts.calls[1]?.payload.kind).toBe('PLAIN');
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
+
+    expect(verifyNick).toHaveBeenCalledTimes(2);
+    expect(verifyNick.mock.calls[0]?.[0]).toBe('alice');
+    expect(verifyNick.mock.calls[0]?.[1]).toBe('wrong');
+    expect(verifyNick.mock.calls[1]?.[0]).not.toBe('alice');
   });
 
   it('treats a payload nick that does not match state.nick as a failed auth (no silent login)', () => {
@@ -1915,19 +1891,21 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'bob:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'bob' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
     // The store is never consulted on a nick mismatch.
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
   });
 });
 
 describe('emitWelcomeIfReady — PASS-auth interaction with the server-password gate', () => {
-  it('ignores the <nick>:<password> form when no AccountStore is bound (open gate)', () => {
+  it('ignores the <nick>:<password> form when no ServicesStore is bound (open gate)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
@@ -1939,7 +1917,28 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
   });
 
-  it('collapses to the server-password gate (464) when no AccountStore is bound and the colon form does not match', () => {
+  it('a SASL-identified connection (state.account set) satisfies the gate with no credential-store read', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice'; // SASL-identified before registration completion.
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(
+      state,
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
+    );
+
+    // The gate is satisfied by state.account; no PASS-auth verify fires.
+    expect(verifyNick).not.toHaveBeenCalled();
+    expect(state.registration).toBe('registered');
+    expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
+  });
+
+  it('collapses to the server-password gate (464) when no ServicesStore is bound and the colon form does not match', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
@@ -1958,10 +1957,11 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     const effects = emitWelcomeIfReady(
       state,
-      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
     );
 
     expect(state.registration).not.toBe('registered');
@@ -1978,10 +1978,12 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.user = 'alice';
     state.account = 'alice'; // SASL-identified before registration completion
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(state.registration).toBe('registered');
     // No 900/903 are re-emitted by PASS-auth; SASL already emitted them.
     expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
@@ -1992,13 +1994,15 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 's3cret';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
     const effects = emitWelcomeIfReady(
       state,
-      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
     );
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
     expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
@@ -2011,8 +2015,9 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
     state.user = 'alice';
     // state.nick intentionally undefined — PASS arrived before NICK.
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBe('alice');
     expect(effects.some((e) => e.tag === 'Send')).toBe(true);
@@ -2021,26 +2026,31 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
   it('returns no effects when no PASS was sent', () => {
     const state = makeState();
     state.nick = 'alice';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
   });
 
   it('returns no effects for a bare PASS value (no colon)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = 's3cret';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('returns no effects when the nick portion is empty (`:password`)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = ':hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('splits only on the first colon so a password may contain colons', () => {
@@ -2048,16 +2058,13 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:p:ass:word';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'p:ass:word',
-    });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'p:ass:word', 'alice@example.com');
+    passBasedAccountAuth(state, makeCtxPassAuth(state, { services }));
+    expect(state.account).toBe('alice');
   });
 
-  it('returns no effects when no AccountStore is bound', () => {
+  it('returns no effects when no ServicesStore is bound', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = 'alice:hunter2';