serverless-ircd 0.9.0 → 0.10.0

package/packages/irc-core/tests/commands/sasl.test.ts

@@ -1,17 +1,10 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { getLsString } from '../../src/caps/capabilities';
 import { capReducer } from '../../src/commands/cap';
 import { authenticateReducer } from '../../src/commands/sasl';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
-import type {
-  AccountStore,
-  AwayStore,
-  MtlsIdentityProvider,
-  SaslPayload,
-  SaslResult,
-  ServicesStore,
-} from '../../src/ports';
+import type { AwayStore, MtlsIdentityProvider, ServicesStore } from '../../src/ports';
 import {
   EmptyMotdProvider,
   FakeClock,
@@ -53,11 +46,24 @@ function saslReadyState(): ConnectionState {
   return s;
 }
 
+/**
+ * Builds a {@link InMemoryServicesStore} with `nick` registered under
+ * `password`. The single credential home for SASL PLAIN / EXTERNAL / PASS.
+ */
+function registeredServices(
+  nick = 'alice',
+  password = 'secret',
+  email = 'alice@example.com',
+): InMemoryServicesStore {
+  const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+  services.registerNick(nick, password, email);
+  return services;
+}
+
 function makeCtx(
   state: ConnectionState,
-  accounts?: AccountStore,
-  mtlsIdentity?: MtlsIdentityProvider,
   services?: ServicesStore,
+  mtlsIdentity?: MtlsIdentityProvider,
   away?: AwayStore,
 ): Ctx {
   return buildCtx({
@@ -66,23 +72,12 @@ function makeCtx(
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
-    ...(accounts !== undefined ? { accounts } : {}),
-    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
     ...(services !== undefined ? { services } : {}),
+    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
     ...(away !== undefined ? { away } : {}),
   });
 }
 
-/** A capture-and-respond fake AccountStore. */
-class FakeAccountStore implements AccountStore {
-  readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-  constructor(private readonly result: SaslResult) {}
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    this.calls.push({ mech, payload });
-    return this.result;
-  }
-}
-
 /** A fake MtlsIdentityProvider that returns a canned identity for one connId. */
 class FakeMtlsIdentityProvider implements MtlsIdentityProvider {
   readonly calls: string[] = [];
@@ -135,10 +130,10 @@ describe('authenticateReducer — PLAIN success', () => {
     expect(state.saslMech).toBe('PLAIN');
   });
 
-  it('completes with 900 and 903 when the AccountStore accepts the credentials', () => {
+  it('completes with 900 and 903 when the ServicesStore accepts the credentials', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -152,8 +147,8 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('records the authenticated account name on the connection', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -163,11 +158,10 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('seeds lastReadMarkers from the ServicesStore at identify', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.setLastReadMarker('alice', '#foo', 'm1');
     services.setLastReadMarker('alice', '#bar', 'm2');
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -178,10 +172,9 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('does not seed markers for a different account', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.setLastReadMarker('bob', '#foo', 'm9');
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -191,10 +184,10 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('replays the persisted away reason on identify (draft/pre-away)', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
     const away = new InMemoryAwayStore();
     away.set('alice', 'brb');
-    const ctx = makeCtx(state, accounts, undefined, undefined, away);
+    const ctx = makeCtx(state, services, undefined, away);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -204,10 +197,10 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('emits 306 RPL_NOWAWAY after identifying when an away reason is replayed', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
     const away = new InMemoryAwayStore();
     away.set('alice', 'brb');
-    const ctx = makeCtx(state, accounts, undefined, undefined, away);
+    const ctx = makeCtx(state, services, undefined, away);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -220,9 +213,9 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('does not replay an away reason when none is persisted', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
     const away = new InMemoryAwayStore();
-    const ctx = makeCtx(state, accounts, undefined, undefined, away);
+    const ctx = makeCtx(state, services, undefined, away);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -234,8 +227,8 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('does not replay an away reason when no AwayStore is bound', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts); // no away store
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services); // no away store
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -247,10 +240,10 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('looks up the persisted away reason case-insensitively', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
     const away = new InMemoryAwayStore();
     away.set('ALICE', 'brb');
-    const ctx = makeCtx(state, accounts, undefined, undefined, away);
+    const ctx = makeCtx(state, services, undefined, away);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -260,10 +253,9 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('delivers queued unread memos on a successful SASL login', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'Hi alice!', sentAt: 1_000 });
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -276,10 +268,9 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('marks delivered memos as read after a successful SASL login', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'Hi alice!', sentAt: 1_000 });
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -289,11 +280,10 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('does not deliver already-read memos on a SASL login', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'old', sentAt: 1_000 });
     services.markMemoRead('alice', 1);
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -305,10 +295,9 @@ describe('authenticateReducer — PLAIN success', () => {
   it('applies the assigned HostServ vhost on SASL PLAIN success', () => {
     const state = saslReadyState();
     state.host = 'real.example.net';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.setVhost('alice', 'cool.example.net');
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -321,10 +310,9 @@ describe('authenticateReducer — PLAIN success', () => {
   it('does not emit a CHGHOST broadcast on SASL success (pre-registration, no peers)', () => {
     const state = saslReadyState();
     state.host = 'real.example.net';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.setVhost('alice', 'cool.example.net');
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -335,9 +323,8 @@ describe('authenticateReducer — PLAIN success', () => {
   it('leaves host unchanged on SASL success when no vhost is assigned', () => {
     const state = saslReadyState();
     state.host = 'real.example.net';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -348,9 +335,8 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('delivers nothing on a SASL login when the account has no memos', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -361,10 +347,9 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('looks up queued memos case-insensitively on a SASL login', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
     services.recordMemo({ from: 'bob', to: 'ALICE', body: 'folded', sentAt: 1_000 });
-    const ctx = makeCtx(state, accounts, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -377,8 +362,7 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('does not deliver memos when no ServicesStore is bound', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const ctx = makeCtx(state);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -389,8 +373,8 @@ describe('authenticateReducer — PLAIN success', () => {
 
   it('clears the in-progress mechanism after a successful authentication', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -398,40 +382,36 @@ describe('authenticateReducer — PLAIN success', () => {
     expect(state.saslMech).toBeUndefined();
   });
 
-  it('forwards parsed PLAIN credentials to the AccountStore', () => {
+  it('forwards parsed PLAIN credentials to services.verifyNick', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
 
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'secret' } },
-    ]);
+    expect(verifyNick).toHaveBeenCalledWith('alice', 'secret');
   });
 
   it('ignores the authorization identity field in the PLAIN payload', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret', 'bob')), ctx);
 
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'secret',
-    });
+    expect(verifyNick).toHaveBeenCalledWith('alice', 'secret');
   });
 
   it('targets `*` with an empty hostmask when the client has no nick yet', () => {
     const state = createConnection({ id: 'c1', connectedSince: 0 });
     state.capNegotiating = true;
     state.caps.add('sasl');
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -449,10 +429,10 @@ describe('authenticateReducer — PLAIN success', () => {
 // ============================================================================
 
 describe('authenticateReducer — PLAIN failure', () => {
-  it('emits 904 ERR_SASLFAIL when the AccountStore rejects the credentials', () => {
+  it('emits 904 ERR_SASLFAIL when the ServicesStore rejects the credentials', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
@@ -464,8 +444,8 @@ describe('authenticateReducer — PLAIN failure', () => {
 
   it('does not record an account on failure', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
@@ -475,8 +455,8 @@ describe('authenticateReducer — PLAIN failure', () => {
 
   it('clears the in-progress mechanism after a failure', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
@@ -486,11 +466,11 @@ describe('authenticateReducer — PLAIN failure', () => {
 });
 
 // ============================================================================
-// AUTHENTICATE PLAIN — no AccountStore wired
+// AUTHENTICATE PLAIN — no ServicesStore wired
 // ============================================================================
 
-describe('authenticateReducer — no AccountStore configured', () => {
-  it('emits 904 when the PLAIN payload arrives but no AccountStore is wired', () => {
+describe('authenticateReducer — no ServicesStore configured', () => {
+  it('emits 904 when the PLAIN payload arrives but no ServicesStore is wired', () => {
     const state = saslReadyState();
     const ctx = makeCtx(state);
 
@@ -531,28 +511,41 @@ describe('authenticateReducer — EXTERNAL with mTLS', () => {
 
   it('succeeds (900/903) when a valid cert identity is presented', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
+    services.addCertFP('alice', 'CN=alice');
     const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
-    const ctx = makeCtx(state, accounts, provider);
+    const ctx = makeCtx(state, services, provider);
 
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
     const out = authenticateReducer(state, authenticate('+'), ctx);
 
     expect(state.account).toBe('alice');
-    expect(accounts.calls).toEqual([
-      { mech: 'EXTERNAL', payload: { kind: 'EXTERNAL', identity: 'CN=alice' } },
-    ]);
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
       L(`:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`),
       L(`:${SV} 903 alice :SASL authentication successful`),
     ]);
   });
 
+  it('forwards the resolved mTLS subject to services.verifyCertFP', () => {
+    const state = saslReadyState();
+    const services = registeredServices('alice', 'secret');
+    services.addCertFP('alice', 'CN=alice');
+    const verifyCertFP = vi.spyOn(services, 'verifyCertFP');
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, services, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(verifyCertFP).toHaveBeenCalledWith('CN=alice');
+  });
+
   it('clears saslMech/saslBuffer after a successful EXTERNAL', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
+    services.addCertFP('alice', 'CN=alice');
     const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
-    const ctx = makeCtx(state, accounts, provider);
+    const ctx = makeCtx(state, services, provider);
 
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
     authenticateReducer(state, authenticate('+'), ctx);
@@ -563,11 +556,11 @@ describe('authenticateReducer — EXTERNAL with mTLS', () => {
 
   it('delivers queued memos on a successful EXTERNAL login', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
-    const services = new InMemoryServicesStore();
+    const services = registeredServices('alice', 'secret');
+    services.addCertFP('alice', 'CN=alice');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'via mTLS', sentAt: 1_000 });
-    const ctx = makeCtx(state, accounts, provider, services);
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const ctx = makeCtx(state, services, provider);
 
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
     const out = authenticateReducer(state, authenticate('+'), ctx);
@@ -581,9 +574,10 @@ describe('authenticateReducer — EXTERNAL with mTLS', () => {
 
   it('fails with 904 when the provider has no identity for the connection', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = registeredServices('alice', 'secret');
+    services.addCertFP('alice', 'CN=alice');
     const provider = new FakeMtlsIdentityProvider('c1', undefined);
-    const ctx = makeCtx(state, accounts, provider);
+    const ctx = makeCtx(state, services, provider);
 
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
     const out = authenticateReducer(state, authenticate('+'), ctx);
@@ -594,11 +588,12 @@ describe('authenticateReducer — EXTERNAL with mTLS', () => {
     expect(state.account).toBeUndefined();
   });
 
-  it('fails with 904 when the account store rejects the identity', () => {
+  it('fails with 904 when the subject is not attached to any account', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'untrusted certificate' });
+    const services = registeredServices('alice', 'secret');
+    // No cert subject attached to alice; CN=evil is unknown to the store.
     const provider = new FakeMtlsIdentityProvider('c1', 'CN=evil');
-    const ctx = makeCtx(state, accounts, provider);
+    const ctx = makeCtx(state, services, provider);
 
     authenticateReducer(state, authenticate('EXTERNAL'), ctx);
     const out = authenticateReducer(state, authenticate('+'), ctx);
@@ -606,9 +601,27 @@ describe('authenticateReducer — EXTERNAL with mTLS', () => {
     expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
       L(`:${SV} 904 alice :SASL authentication failed`),
     ]);
+    expect(state.account).toBeUndefined();
   });
 
-  it('fails with 904 when no account store is configured', () => {
+  it('does not leak account existence on an unknown subject (no state change)', () => {
+    const state = saslReadyState();
+    const services = registeredServices('alice', 'secret');
+    services.addCertFP('alice', 'CN=alice');
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=evil');
+    const ctx = makeCtx(state, services, provider);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    expect(sendLinesOf(out.effects[0])).toEqual<RawLine[]>([
+      L(`:${SV} 904 alice :SASL authentication failed`),
+    ]);
+    expect(state.account).toBeUndefined();
+    expect(state.saslMech).toBeUndefined();
+  });
+
+  it('fails with 904 when no ServicesStore is configured', () => {
     const state = saslReadyState();
     const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
     const ctx = makeCtx(state, undefined, provider);
@@ -674,8 +687,8 @@ describe('authenticateReducer — abort / already-authenticated', () => {
 
   it('emits 907 when sent after a successful SASL authentication', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -736,13 +749,14 @@ describe('authenticateReducer — client abort', () => {
 describe('authenticateReducer — empty payload (`+`)', () => {
   it('treats `AUTHENTICATE +` as the final (empty) chunk and rejects malformed PLAIN', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'empty' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate('+'), ctx);
 
-    expect(accounts.calls).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(firstLineText(out.effects[0])).toContain(' 904 ');
     expect(state.saslMech).toBeUndefined();
   });
@@ -755,8 +769,9 @@ describe('authenticateReducer — empty payload (`+`)', () => {
 describe('authenticateReducer — chunked payload', () => {
   it('buffers chunks of exactly 400 bytes and verifies on the short final chunk', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'p'.repeat(320));
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     const longPassword = 'p'.repeat(320);
     const payload = plainPayload('alice', longPassword);
@@ -771,19 +786,17 @@ describe('authenticateReducer — chunked payload', () => {
     const buffered = authenticateReducer(state, authenticate(first), ctx);
     expect(buffered.effects).toEqual([]);
     expect(state.saslMech).toBe('PLAIN');
-    expect(accounts.calls).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
 
     authenticateReducer(state, authenticate(rest), ctx);
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: longPassword } },
-    ]);
+    expect(verifyNick).toHaveBeenCalledWith('alice', longPassword);
     expect(state.account).toBe('alice');
   });
 
   it('rejects an oversized payload with 905 ERR_SASLTOOLONG', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(`${'A'.repeat(8193)}`), ctx);
@@ -802,37 +815,40 @@ describe('authenticateReducer — chunked payload', () => {
 describe('authenticateReducer — malformed PLAIN', () => {
   it('emits 904 when the base64 payload does not decode to three NUL-separated fields', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(encodeBase64('onlyonefield')), ctx);
 
     expect(firstLineText(out.effects[0])).toContain(' 904 ');
-    expect(accounts.calls).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('emits 904 when the payload is not valid base64', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate('!!!notbase64!!!'), ctx);
 
     expect(firstLineText(out.effects[0])).toContain(' 904 ');
-    expect(accounts.calls).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('emits 908 when the first AUTHENTICATE frame is not a recognized mechanism', () => {
     const state = saslReadyState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtx(state, services);
 
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
 
     expect(firstLineText(out.effects[0])).toContain(' 908 ');
-    expect(accounts.calls).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 });
 
@@ -879,8 +895,8 @@ describe('authenticateReducer — CAP REQ sasl integration', () => {
     state.user = 'alice';
     state.host = 'example.com';
     state.registration = 'registering';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtx(state, accounts);
+    const services = registeredServices('alice', 'secret');
+    const ctx = makeCtx(state, services);
 
     capReducer(state, { command: 'CAP', params: ['REQ', 'sasl'], tags: {} }, ctx);
     expect(state.caps.has('sasl')).toBe(true);
@@ -905,15 +921,15 @@ describe('authenticateReducer — CAP REQ sasl integration', () => {
 });
 
 // ============================================================================
-// SASL PLAIN — NickServ-registered accounts (ServicesStore fallback)
+// SASL PLAIN — NickServ-registered accounts (single credential home)
 // ============================================================================
 
 describe('authenticateReducer — NickServ-registered nick via ServicesStore', () => {
-  it('succeeds with credentials registered via NickServ when no AccountStore is bound', () => {
+  it('succeeds with credentials registered via NickServ (no second registration)', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
     services.registerNick('alice', 'hunter2', 'alice@example.com');
     const state = saslReadyState();
-    const ctx = makeCtx(state, undefined, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'hunter2')), ctx);
@@ -925,46 +941,11 @@ describe('authenticateReducer — NickServ-registered nick via ServicesStore', (
     );
   });
 
-  it('succeeds with NickServ credentials even when a static AccountStore is also bound', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
-    services.registerNick('bob', 'bobpass', 'bob@example.com');
-    // Static AccountStore does not know about bob; the services store does.
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const state = saslReadyState();
-    state.nick = 'bob';
-    state.user = 'bob';
-    state.host = 'example.com';
-    const ctx = makeCtx(state, accounts, undefined, services);
-
-    authenticateReducer(state, authenticate('PLAIN'), ctx);
-    const out = authenticateReducer(state, authenticate(plainPayload('bob', 'bobpass')), ctx);
-
-    expect(state.account).toBe('bob');
-    expect(sendLinesOf(out.effects[0]).map((l) => l.text)).toContain(
-      `:${SV} 903 bob :SASL authentication successful`,
-    );
-  });
-
-  it('prefers the static AccountStore over the services store on a match', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
-    services.registerNick('alice', 'servicespw', 'alice@example.com');
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const state = saslReadyState();
-    const ctx = makeCtx(state, accounts, undefined, services);
-
-    authenticateReducer(state, authenticate('PLAIN'), ctx);
-    authenticateReducer(state, authenticate(plainPayload('alice', 'staticpw')), ctx);
-
-    // The static store vouched for the account; it is used.
-    expect(accounts.calls).toHaveLength(1);
-    expect(state.account).toBe('alice');
-  });
-
-  it('fails when neither the AccountStore nor the ServicesStore verifies the credential', () => {
+  it('fails when neither the nick nor a matching credential verifies', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
     services.registerNick('alice', 'hunter2', 'alice@example.com');
     const state = saslReadyState();
-    const ctx = makeCtx(state, undefined, undefined, services);
+    const ctx = makeCtx(state, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     const out = authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);