serverless-ircd 0.9.0 → 0.10.0

package/packages/irc-core/tests/services-store.test.ts

@@ -11,6 +11,7 @@ import {
   type ReadMarkerEntry,
   type RegisteredNick,
   type ServicesAuthResult,
+  type ServicesSnapshot,
   type ServicesStore,
 } from '../src/ports';
 
@@ -116,6 +117,185 @@ describe('InMemoryServicesStore — NickServ IDENTIFY (verifyNick)', () => {
   });
 });
 
+// ============================================================================
+// NickServ CertFP — hydrate round-trip (legacy snapshot without certSubjects)
+// ============================================================================
+
+describe('InMemoryServicesStore — CertFP snapshot hydration', () => {
+  it('defaults certSubjects to [] when a legacy snapshot row omits the field', () => {
+    // Simulate a pre-certSubjects snapshot: the row is missing the field
+    // entirely (as if loaded from JSON written before the column existed).
+    const legacySnap: ServicesSnapshot = {
+      nicks: [
+        {
+          nick: 'alice',
+          account: 'alice',
+          email: 'a@x',
+          createdAt: NOW,
+          enforce: 'none',
+          certSubjects: undefined as unknown as string[],
+          credential: { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'aGVsbG8=' },
+        },
+      ],
+      channels: [],
+      access: [],
+      levels: [],
+      vhosts: [],
+      pendingVhosts: [],
+      memos: [],
+      readMarkers: [],
+      akills: [],
+      jupes: [],
+    };
+    const s = new InMemoryServicesStore({ clock: new FakeClock(NOW), snapshot: legacySnap });
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec !== undefined) {
+      expect(rec.certSubjects).toEqual([]);
+    }
+  });
+});
+
+// ============================================================================
+// NickServ CertFP — SASL EXTERNAL surface (verifyCertFP / addCertFP / removeCertFP)
+// ============================================================================
+
+describe('InMemoryServicesStore — NickServ CertFP (verifyCertFP)', () => {
+  it('returns ok with the account name for a known subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.verifyCertFP('CN=alice')).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('returns ok:false for an unknown subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    const out = s.verifyCertFP('CN=evil');
+    expect(out.ok).toBe(false);
+    if (out.ok) return;
+    expect(out.reason.length).toBeGreaterThan(0);
+  });
+
+  it('returns ok:false when no nick has any cert subject registered', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+  });
+
+  it('matches the subject case-sensitively (byte-exact)', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=Alice');
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+    expect(s.verifyCertFP('CN=Alice').ok).toBe(true);
+  });
+
+  it('resolves the account that owns the subject (multiple accounts)', () => {
+    const s = store();
+    s.registerNick('alice', 'pw', 'a@e');
+    s.registerNick('bob', 'pw', 'b@e');
+    s.addCertFP('bob', 'CN=bob');
+    expect(s.verifyCertFP('CN=bob')).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'bob',
+    });
+  });
+
+  it('exposes the registered subjects on the RegisteredNick record', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice-2');
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec === undefined) return;
+    expect(rec.certSubjects).toEqual(['CN=alice', 'CN=alice-2']);
+  });
+
+  it('defaults certSubjects to an empty array on a fresh registration', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec === undefined) return;
+    expect(rec.certSubjects).toEqual([]);
+  });
+});
+
+describe('InMemoryServicesStore — NickServ CertFP mutators (addCertFP / removeCertFP)', () => {
+  it('addCertFP attaches a subject to a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+  });
+
+  it('addCertFP is a no-op on an unregistered nick', () => {
+    const s = store();
+    s.addCertFP('ghost', 'CN=ghost');
+    expect(s.verifyCertFP('CN=ghost').ok).toBe(false);
+  });
+
+  it('addCertFP does not duplicate an already-attached subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+  });
+
+  it('addCertFP folds the nick case-insensitively', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.verifyCertFP('CN=alice')).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'Alice',
+    });
+  });
+
+  it('removeCertFP detaches a subject from a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.removeCertFP('alice', 'CN=alice')).toBe(true);
+    expect(s.getNick('alice')?.certSubjects).toEqual([]);
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+  });
+
+  it('removeCertFP returns false when the subject is not attached', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.removeCertFP('alice', 'CN=alice')).toBe(false);
+  });
+
+  it('removeCertFP returns false on an unregistered nick', () => {
+    const s = store();
+    expect(s.removeCertFP('ghost', 'CN=ghost')).toBe(false);
+  });
+
+  it('removeCertFP folds the nick case-insensitively but matches the subject byte-exactly', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=Alice');
+    expect(s.removeCertFP('ALICE', 'CN=alice')).toBe(false);
+    expect(s.removeCertFP('ALICE', 'CN=Alice')).toBe(true);
+  });
+
+  it('dropNick removes the attached cert subjects along with the registration', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.dropNick('alice');
+    expect(s.verifyCertFP('CN=alice').ok).toBe(false);
+  });
+});
+
 describe('InMemoryServicesStore — NickServ DROP (dropNick)', () => {
   it('returns true and removes the registration for a known nick', () => {
     const s = store();
@@ -175,6 +355,29 @@ describe('InMemoryServicesStore — NickServ SET ENFORCE (setNickEnforce)', () =
   });
 });
 
+describe('InMemoryServicesStore — NickServ SET PASSWORD (setNickPassword)', () => {
+  it('overwrites the credential so the new password verifies and the old does not', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.setNickPassword('alice', 'newpassword');
+    expect(s.verifyNick('alice', 'newpassword').ok).toBe(true);
+    expect(s.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('folds the nick case-insensitively', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.setNickPassword('alice', 'newpassword');
+    expect(s.verifyNick('ALICE', 'newpassword').ok).toBe(true);
+  });
+
+  it('is a no-op on an unregistered nick (the original credential, if any, is untouched)', () => {
+    const s = store();
+    s.setNickPassword('ghost', 'newpassword');
+    expect(s.isRegisteredNick('ghost')).toBe(false);
+  });
+});
+
 describe('InMemoryServicesStore — NickServ INFO (getNick)', () => {
   it('returns the full record for a registered nick', () => {
     const s = store();
@@ -186,6 +389,7 @@ describe('InMemoryServicesStore — NickServ INFO (getNick)', () => {
       email: 'alice@example.com',
       createdAt: NOW,
       enforce: 'none',
+      certSubjects: [],
     });
   });
 

package/packages/irc-core/vitest.config.ts

@@ -8,7 +8,12 @@ export default defineConfig({
       provider: 'v8',
       all: false,
       include: ['src/**/*.ts'],
-      exclude: ['src/**/index.ts'],
+      // `index.ts` files are barrel re-exports (no runtime logic);
+      // `messages.ts` is type-only (`interface` declarations that
+      // TypeScript erases to an empty module). v8 scores both 0%
+      // because they contain no executable statements — excluding
+      // them keeps the 100% threshold honest about real coverage.
+      exclude: ['src/**/index.ts', 'src/**/messages.ts'],
       reporter: ['text', 'html', 'json-summary'],
       thresholds: {
         lines: 100,

package/packages/irc-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-server",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Orchestration layer: IrcRuntime port, dispatch interpreter, ConnectionActor",
   "license": "BSD-3-Clause",

package/packages/irc-server/src/actor.ts

@@ -26,7 +26,6 @@
  */
 
 import {
-  type AccountStore,
   type AwayStore,
   CHANSERV_NICK,
   type ChanName,
@@ -150,16 +149,6 @@ export interface ConnectionActorOptions {
    * opt in.
    */
   readonly messages?: MessageStore;
-  /**
-   * SASL account verification source (absent when no accounts are
-   * configured). When bound, `ctx.accounts` is defined so the
-   * `AUTHENTICATE` reducer can verify PLAIN credentials end-to-end.
-   * Omitted (→ `ctx.accounts` undefined) preserves the existing
-   * behaviour for callers/tests that do not opt in: a client completing
-   * `AUTHENTICATE PLAIN` receives `904 ERR_SASLFAIL` because no store
-   * can vouch for the credentials.
-   */
-  readonly accounts?: AccountStore;
   /**
    * mTLS client-cert identity source for SASL EXTERNAL (absent when mTLS
    * is not configured). When bound, `ctx.mtlsIdentity` is defined so the
@@ -271,7 +260,6 @@ export class ConnectionActor {
   private readonly ids: IdFactory;
   private readonly motd: MotdProvider;
   private readonly messages: MessageStore | undefined;
-  private readonly accounts: AccountStore | undefined;
   private readonly mtlsIdentity: MtlsIdentityProvider | undefined;
   private readonly history: NickHistoryStore | undefined;
   private readonly away: AwayStore | undefined;
@@ -325,7 +313,6 @@ export class ConnectionActor {
     this.ids = opts.ids;
     this.motd = opts.motd ?? EmptyMotdProvider;
     this.messages = opts.messages;
-    this.accounts = opts.accounts;
     this.mtlsIdentity = opts.mtlsIdentity;
     this.history = opts.history;
     this.away = opts.away;
@@ -511,7 +498,6 @@ export class ConnectionActor {
       motd: this.motd,
       connection: this.state,
       ...(this.messages !== undefined ? { messages: this.messages } : {}),
-      ...(this.accounts !== undefined ? { accounts: this.accounts } : {}),
       ...(this.mtlsIdentity !== undefined ? { mtlsIdentity: this.mtlsIdentity } : {}),
       ...(this.history !== undefined ? { history: this.history } : {}),
       ...(this.away !== undefined ? { away: this.away } : {}),

package/packages/irc-server/tests/actor.test.ts

@@ -1,5 +1,4 @@
 import {
-  type AccountStore,
   type AwayStore,
   CapturingLogger,
   type ChanName,
@@ -26,8 +25,6 @@ import {
   type NickHistoryStore,
   Numerics,
   type RawLine,
-  type SaslPayload,
-  type SaslResult,
   SequentialIdFactory,
   type ServerConfig,
   type ServerStats,
@@ -219,7 +216,6 @@ function makeActor(opts: {
   logger?: Logger;
   traceId?: string;
   messages?: MessageStore;
-  accounts?: AccountStore;
   mtlsIdentity?: MtlsIdentityProvider;
   history?: NickHistoryStore;
   stats?: ServerStats;
@@ -280,9 +276,6 @@ function makeActor(opts: {
   if (opts.messages !== undefined) {
     finalOpts.messages = opts.messages;
   }
-  if (opts.accounts !== undefined) {
-    finalOpts.accounts = opts.accounts;
-  }
   if (opts.mtlsIdentity !== undefined) {
     finalOpts.mtlsIdentity = opts.mtlsIdentity;
   }
@@ -2129,17 +2122,7 @@ describe('ConnectionActor — CHATHISTORY', () => {
 // SASL / AccountStore — actor plumbing (ctx.accounts threaded through buildCtx)
 // ===========================================================================
 
-describe('ConnectionActor — SASL AccountStore plumbing', () => {
-  /** Capture-and-respond fake AccountStore (mirrors the irc-core sasl tests). */
-  class FakeAccountStore implements AccountStore {
-    readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-    constructor(private readonly result: SaslResult) {}
-    verify(mech: string, payload: SaslPayload): SaslResult {
-      this.calls.push({ mech, payload });
-      return this.result;
-    }
-  }
-
+describe('ConnectionActor — SASL ServicesStore plumbing', () => {
   /** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
   function plainPayload(authcid: string, password: string): string {
     return encodeBase64(`\0${authcid}\0${password}`);
@@ -2154,11 +2137,12 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
     };
   }
 
-  it('completes SASL PLAIN with 900/903 when a bound AccountStore accepts creds', async () => {
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+  it('completes SASL PLAIN with 900/903 when a bound ServicesStore accepts creds', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
     });
     conn.nick = 'alice';
     runtime.calls.length = 0;
@@ -2173,18 +2157,14 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
     expect(lines.some((l) => l.text.includes(' 903 '))).toBe(true);
     // Critical: never 904 for valid creds.
     expect(lines.some((l) => l.text.includes(' 904 '))).toBe(false);
-    // The AccountStore was consulted with the parsed PLAIN credentials.
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'secret' } },
-    ]);
     // Account name recorded on the connection for extended-join/account-tag.
     expect(conn.account).toBe('alice');
   });
 
-  it('emits 904 ERR_SASLFAIL when no AccountStore is bound (regression guard)', async () => {
+  it('emits 904 ERR_SASLFAIL when no ServicesStore is bound (regression guard)', async () => {
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      // No `accounts` option → ctx.accounts is undefined.
+      // No `services` option → ctx.services is undefined.
     });
     conn.nick = 'alice';
     runtime.calls.length = 0;
@@ -2202,11 +2182,12 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
     expect(conn.account).toBeUndefined();
   });
 
-  it('emits 904 when a bound AccountStore rejects the credentials', async () => {
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+  it('emits 904 when a bound ServicesStore rejects the credentials', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
     });
     conn.nick = 'alice';
     runtime.calls.length = 0;
@@ -2223,16 +2204,6 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
 });
 
 describe('ConnectionActor — SASL EXTERNAL + mTLS plumbing', () => {
-  /** Fake AccountStore that accepts EXTERNAL with a known cert subject. */
-  class FakeAccountStore implements AccountStore {
-    readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-    constructor(private readonly result: SaslResult) {}
-    verify(mech: string, payload: SaslPayload): SaslResult {
-      this.calls.push({ mech, payload });
-      return this.result;
-    }
-  }
-
   /** Fake MtlsIdentityProvider returning a canned subject for 'c1'. */
   class FakeMtlsProvider implements MtlsIdentityProvider {
     constructor(private readonly identity: string | undefined) {}
@@ -2250,11 +2221,13 @@ describe('ConnectionActor — SASL EXTERNAL + mTLS plumbing', () => {
   }
 
   it('completes SASL EXTERNAL with 900/903 when mTLS provider and store accept', async () => {
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
+    services.addCertFP('alice', 'CN=alice');
     const mtlsIdentity = new FakeMtlsProvider('CN=alice');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
       mtlsIdentity,
     });
     conn.nick = 'alice';
@@ -2268,17 +2241,16 @@ describe('ConnectionActor — SASL EXTERNAL + mTLS plumbing', () => {
     expect(lines.some((l) => l.text.includes(' 900 '))).toBe(true);
     expect(lines.some((l) => l.text.includes(' 903 '))).toBe(true);
     expect(lines.some((l) => l.text.includes(' 904 '))).toBe(false);
-    expect(accounts.calls).toEqual([
-      { mech: 'EXTERNAL', payload: { kind: 'EXTERNAL', identity: 'CN=alice' } },
-    ]);
     expect(conn.account).toBe('alice');
   });
 
   it('returns 908 for EXTERNAL when no mTLS provider is bound', async () => {
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
+    services.addCertFP('alice', 'CN=alice');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
       // No mtlsIdentity → EXTERNAL should 908 at mechanism phase.
     });
     conn.nick = 'alice';

package/packages/irc-test-support/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-test-support",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Shared IRC scenario runner + harness seam used by every adapter's integration suite",
   "license": "BSD-3-Clause",

package/pnpm-workspace.yaml

@@ -3,6 +3,7 @@ packages:
   - "apps/*"
   - "tools"
   - "tools/*"
+  - "scripts"
 linkWorkspacePackages: true
 allowBuilds:
   '@biomejs/biome': true