serverless-ircd 0.9.0 → 0.11.0

package/packages/aws-adapter/tests/default-occ.test.ts

@@ -0,0 +1,226 @@
+/**
+ * Tests for the optimistic-concurrency state persist in `$default`
+ * (`handleDefault` + `buildPersistUpdate` + `isConditionalCheckFailed`).
+ *
+ * Background: API Gateway dispatches a client's rapid frames (CAP END,
+ * NICK, USER) as CONCURRENT Lambda invocations that each
+ * read-modify-write the same Connections row. Without a revision guard,
+ * the last writer wins and clobbers the others — the registration
+ * deadlock where `CAP END`'s `capNegotiating=false` was overwritten by
+ * `NICK`/`USER`'s stale read, so `001 RPL_WELCOME` never fired.
+ *
+ * The fix: every persist is a conditional `UpdateItem` requiring
+ * `revision = :expected` (bumped atomically); a
+ * `ConditionalCheckFailedException` triggers a re-read + re-run retry
+ * loop in `handleDefault`.
+ */
+
+import { GetCommand, UpdateCommand } from '@aws-sdk/lib-dynamodb';
+import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+import {
+  type ParsedServerConfig,
+  StaticMotdProvider,
+  createConnection,
+} from '@serverless-ircd/irc-core';
+import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
+import { describe, expect, it } from 'vitest';
+import {
+  buildPersistUpdate,
+  handleDefault,
+  isConditionalCheckFailed,
+} from '../src/handlers/default.js';
+import { marshalConnection } from '../src/serialize.js';
+import type { TablesConfig } from '../src/tables.js';
+
+const SERVER_CONFIG: ParsedServerConfig = makeTestServerConfig({
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  motdLines: ['Welcome'],
+});
+const MOTD = new StaticMotdProvider(SERVER_CONFIG.motdLines);
+const TABLES: TablesConfig = {
+  Connections: 'Connections',
+  ChannelMeta: 'ChannelMeta',
+  ChannelMembers: 'ChannelMembers',
+  Nicks: 'Nicks',
+  Services: 'Services',
+};
+
+describe('buildPersistUpdate — optimistic-concurrency revision guard', () => {
+  it('adds an ADD #rev :revInc clause to the update expression', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7, []);
+    expect(expr.updateExpression).toContain('ADD #rev :revInc');
+  });
+
+  it('gates the write on attribute_not_exists(#rev) OR #rev = :expectedRev', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7, []);
+    expect(expr.conditionExpression).toBe('attribute_not_exists(#rev) OR #rev = :expectedRev');
+  });
+
+  it('binds #rev to the revision column and :expectedRev to the read revision', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7, []);
+    expect(expr.expressionAttributeNames['#rev']).toBe('revision');
+    expect(expr.expressionAttributeValues[':expectedRev']).toBe(7);
+    expect(expr.expressionAttributeValues[':revInc']).toBe(1);
+  });
+
+  it('persists the inbound frame-window timestamps in the same atomic write', () => {
+    const state = createConnection({ id: 'c1', connectedSince: 1 });
+    const expr = buildPersistUpdate(state, 100, 7, [90, 95]);
+    expect(expr.updateExpression).toContain('frameTimes = :ft');
+    expect(expr.expressionAttributeValues[':ft']).toEqual([90, 95]);
+  });
+});
+
+describe('isConditionalCheckFailed', () => {
+  it('returns true for a DynamoDB ConditionalCheckFailedException', () => {
+    const err = new Error('The conditional request failed');
+    err.name = 'ConditionalCheckFailedException';
+    expect(isConditionalCheckFailed(err)).toBe(true);
+  });
+
+  it('returns false for an unrelated error name', () => {
+    const err = new Error('boom');
+    err.name = 'ProvisionedThroughputExceededException';
+    expect(isConditionalCheckFailed(err)).toBe(false);
+  });
+
+  it('returns false for non-object throws', () => {
+    expect(isConditionalCheckFailed(null)).toBe(false);
+    expect(isConditionalCheckFailed(undefined)).toBe(false);
+    expect(isConditionalCheckFailed('string throw')).toBe(false);
+  });
+});
+
+/**
+ * Minimal fake document client. It does NOT implement DynamoDB's
+ * expression semantics — it only:
+ *   - returns the seeded row on GetCommand;
+ *   - simulates a concurrent writer on UpdateCommand by failing the first
+ *     `failNextUpdates` writes with ConditionalCheckFailedException (and
+ *     bumping the row's revision so a re-read sees it), then succeeding.
+ * This is enough to exercise `handleDefault`'s retry loop.
+ */
+class FakeDynamo {
+  readonly items = new Map<string, Record<string, unknown>>();
+  failNextUpdates = 0;
+  updateCalls = 0;
+  getCalls = 0;
+
+  async send(cmd: unknown): Promise<{ Item?: Record<string, unknown> } | Record<string, never>> {
+    if (cmd instanceof GetCommand) {
+      this.getCalls += 1;
+      const input = (cmd as unknown as { input: { Key: { connectionId: string } } }).input;
+      const item = this.items.get(input.Key.connectionId);
+      return item === undefined ? {} : { Item: { ...item } };
+    }
+    if (cmd instanceof UpdateCommand) {
+      this.updateCalls += 1;
+      const input = (
+        cmd as unknown as {
+          input: {
+            Key: { connectionId: string };
+            ExpressionAttributeValues?: Record<string, unknown>;
+          };
+        }
+      ).input;
+      const key = input.Key.connectionId;
+      if (this.failNextUpdates > 0) {
+        this.failNextUpdates -= 1;
+        // Simulate a concurrent writer landing first: bump the row's
+        // revision so the next read sees the conflict.
+        const cur = this.items.get(key);
+        if (cur !== undefined) {
+          cur.revision = ((cur.revision as number | undefined) ?? 0) + 1;
+        }
+        const err = new Error('The conditional request failed');
+        err.name = 'ConditionalCheckFailedException';
+        throw err;
+      }
+      // Success: bump revision (ADD #rev :revInc) and apply the simple
+      // SETs the assertions care about.
+      const cur = this.items.get(key);
+      if (cur !== undefined) {
+        cur.revision = ((cur.revision as number | undefined) ?? 0) + 1;
+        const vals = input.ExpressionAttributeValues ?? {};
+        if (vals[':capN'] !== undefined) cur.capNegotiating = vals[':capN'];
+      }
+      return {};
+    }
+    return {};
+  }
+}
+
+describe('handleDefault — optimistic-concurrency retry loop', () => {
+  it('retries read→run→persist when concurrent writes race, then returns 200', async () => {
+    const connId = 'c1';
+    const state = createConnection({ id: connId, connectedSince: 1000 });
+    // Mid-CAP-negotiation so CAP END is a meaningful, peer-free frame.
+    state.capNegotiating = true;
+    const dynamo = new FakeDynamo();
+    dynamo.items.set(connId, { ...marshalConnection(state, 1000) });
+    // Two concurrent invocations write first (conditional-check failures).
+    dynamo.failNextUpdates = 2;
+
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: connId,
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+
+    expect(result.statusCode).toBe(200);
+    // 2 failed writes + 1 committed write, and a re-read per attempt.
+    expect(dynamo.updateCalls).toBe(3);
+    expect(dynamo.getCalls).toBe(3);
+    // Final committed state reflects this invocation's mutation and the
+    // revision bumps (2 concurrent + 1 own = 3).
+    const finalRow = dynamo.items.get(connId);
+    expect(finalRow?.capNegotiating).toBe(false);
+    expect(finalRow?.revision).toBe(3);
+  });
+
+  it('commits on the first try when there is no contention', async () => {
+    const connId = 'c2';
+    const state = createConnection({ id: connId, connectedSince: 1000 });
+    state.capNegotiating = true;
+    const dynamo = new FakeDynamo();
+    dynamo.items.set(connId, { ...marshalConnection(state, 1000) });
+
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: connId,
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+
+    expect(result.statusCode).toBe(200);
+    expect(dynamo.updateCalls).toBe(1);
+    expect(dynamo.getCalls).toBe(1);
+    expect(dynamo.items.get(connId)?.capNegotiating).toBe(false);
+  });
+
+  it('returns 410 when the connection row is missing (not retried)', async () => {
+    const dynamo = new FakeDynamo();
+    const result = await handleDefault({
+      dynamo: dynamo as unknown as DynamoDBDocumentClient,
+      tables: TABLES,
+      connectionId: 'ghost',
+      body: 'CAP END\r\n',
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      managementApi: null,
+    });
+    expect(result.statusCode).toBe(410);
+    expect(dynamo.updateCalls).toBe(0);
+  });
+});

package/packages/aws-adapter/tests/dynamo-services-store-unit.test.ts

@@ -11,7 +11,7 @@
  */
 
 import type { BatchWriteCommandInput } from '@aws-sdk/lib-dynamodb';
-import { FakeClock } from '@serverless-ircd/irc-core';
+import { FakeClock, certIdentityFromSubject } from '@serverless-ircd/irc-core';
 import { describe, expect, it } from 'vitest';
 import { DynamoServicesStore, loadDynamoServicesStore } from '../src/dynamo-services-store';
 
@@ -163,6 +163,43 @@ describe('DynamoServicesStore — round-trip via fake DDB', () => {
     expect(reloaded.getNickEnforce('alice')).toBe('kill');
   });
 
+  it('persists SET PASSWORD and round-trips the new credential', async () => {
+    const { store, client } = await fresh();
+    store.registerNick('alice', 'hunter2', 'a@x');
+    store.setNickPassword('alice', 'newpassword');
+    await store.flush();
+
+    const reloaded = await reload(client);
+    expect(reloaded.verifyNick('alice', 'newpassword')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('persists the identify-failure throttle and round-trips the freeze', async () => {
+    const clock = new FakeClock(NOW);
+    const { client } = makeFakeClient();
+    const first = await loadDynamoServicesStore(asClient(client), 'Services', clock);
+    if (first === undefined) throw new Error('store not loaded');
+    first.registerNick('alice', 'hunter2', 'a@x');
+    clock.advance(10);
+    first.recordIdentifyFailure('alice');
+    clock.advance(10);
+    first.recordIdentifyFailure('alice');
+    await first.flush();
+
+    // Fresh connection / deploy: the reload still sees the freeze.
+    const reloaded = await reload(client);
+    expect(reloaded.isNickIdentifyFrozen('alice', { maxFailures: 2, windowMs: 300_000 })).toBe(
+      true,
+    );
+    expect(reloaded.clearIdentifyFailures('alice')).toBe(2);
+
+    // The cleared state round-trips too.
+    await reloaded.flush();
+    const after = await reload(client);
+    expect(after.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(after.clearIdentifyFailures('alice')).toBe(0);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const { store, client } = await fresh();
     store.registerNick('alice', 'pw', 'a@x');
@@ -173,6 +210,54 @@ describe('DynamoServicesStore — round-trip via fake DDB', () => {
     expect((await reload(client)).isRegisteredNick('alice')).toBe(false);
   });
 
+  it('round-trips a bound cert fingerprint and verifies EXTERNAL after reload', async () => {
+    // A cert binding attached before a deploy must still authenticate a
+    // SASL EXTERNAL client after the store rehydrates from DynamoDB —
+    // the production path for certificate-backed login.
+    const { store, client } = await fresh();
+    store.registerNick('alice', 'hunter2', 'a@x');
+    store.addCertFingerprint('alice', 'AA112233445566778899AABBCCDDEEFF');
+    await store.flush();
+
+    const reloaded = await reload(client);
+    // The fingerprint is normalised (lowercase, colon-free) on the round-trip.
+    expect(reloaded.getNick('alice')?.certSubjects).toEqual([
+      'fp:aa112233445566778899aabbccddeeff',
+    ]);
+    expect(
+      reloaded.verifyCertFP(
+        certIdentityFromSubject('CN=alice', 'aa112233445566778899aabbccddeeff'),
+      ),
+    ).toEqual({ ok: true, account: 'alice' });
+  });
+
+  it('round-trips a bound subject DN and verifies EXTERNAL via the canonical DN arm', async () => {
+    const { store, client } = await fresh();
+    store.registerNick('alice', 'hunter2', 'a@x');
+    store.addCertFP('alice', 'CN=alice,O=Example Inc');
+    await store.flush();
+
+    const reloaded = await reload(client);
+    // Platform-surfaced DN in a different RDN order still matches (canonical compare).
+    expect(reloaded.verifyCertFP(certIdentityFromSubject('O=Example Inc,CN=alice'))).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('keeps EXTERNAL verify failing for an unbound cert after reload', async () => {
+    const { store, client } = await fresh();
+    store.registerNick('alice', 'hunter2', 'a@x');
+    store.addCertFingerprint('alice', 'aa112233445566778899aabbccddeeff');
+    await store.flush();
+
+    const reloaded = await reload(client);
+    expect(
+      reloaded.verifyCertFP(certIdentityFromSubject('CN=alice', 'ffffffffffffffffffffffffffffffff'))
+        .ok,
+    ).toBe(false);
+  });
+
   it('persists channel + access + levels + topic, then drops the whole subtree', async () => {
     const { store, client } = await fresh();
     store.registerChannel('#chan', 'alice');
@@ -313,6 +398,54 @@ describe('DynamoServicesStore — round-trip via fake DDB', () => {
 });
 
 describe('DynamoServicesStore — snapshot coercion tolerance', () => {
+  it('defaults the identify-throttle fields on a legacy nick item (attrs absent)', async () => {
+    // A nick item written before the identify throttle existed carries no
+    // identifyFailures / pendingIdentifyFailureNotice attributes.
+    const { client, items } = makeFakeClient();
+    items.set('NICK:alice\x00#', {
+      pk: 'NICK:alice',
+      sk: '#',
+      type: 'nick',
+      nick: 'alice',
+      account: 'alice',
+      email: 'a@x',
+      createdAt: NOW,
+      enforce: 'none',
+      // Mixed-types array: exercises the string-filter callback on load.
+      certSubjects: ['CN=alice', 7],
+      algorithm: 'scrypt',
+      salt: 'c2FsdA==',
+      hash: 'aGFzaA==',
+    });
+    const store = await loadDynamoServicesStore(asClient(client), 'Services', new FakeClock(NOW));
+    if (store === undefined) throw new Error('store not loaded');
+    expect(store.isRegisteredNick('alice')).toBe(true);
+    expect(store.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+    expect(store.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(store.clearIdentifyFailures('alice')).toBe(0);
+    // Ill-typed throttle attributes collapse to the same neutral defaults.
+    items.set('NICK:bob\x00#', {
+      pk: 'NICK:bob',
+      sk: '#',
+      type: 'nick',
+      nick: 'bob',
+      account: 'bob',
+      email: 'b@x',
+      createdAt: NOW,
+      enforce: 'none',
+      certSubjects: [],
+      identifyFailures: 'soon',
+      pendingIdentifyFailureNotice: 'many',
+      algorithm: 'scrypt',
+      salt: 'c2FsdA==',
+      hash: 'aGFzaA==',
+    });
+    const second = await loadDynamoServicesStore(asClient(client), 'Services', new FakeClock(NOW));
+    if (second === undefined) throw new Error('store not loaded');
+    expect(second.isNickIdentifyFrozen('bob', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(second.clearIdentifyFailures('bob')).toBe(0);
+  });
+
   it('skips items with unknown or ill-typed fields', async () => {
     // Hand-craft malformed items directly in the fake table.
     const { client, items } = makeFakeClient();

package/packages/aws-adapter/tests/handlers.test.ts

@@ -8,16 +8,13 @@
 
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
 import { GetCommand } from '@aws-sdk/lib-dynamodb';
-import {
-  InMemoryAccountStore,
-  type ParsedServerConfig,
-  StaticMotdProvider,
-} from '@serverless-ircd/irc-core';
+import { type ParsedServerConfig, StaticMotdProvider } from '@serverless-ircd/irc-core';
 import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime } from '../src/aws-runtime.js';
 import type { PostToConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
+import { DynamoServicesStore } from '../src/dynamo-services-store.js';
 import { createDynamoDocumentClient } from '../src/dynamo.js';
 import {
   type HandlerDeps,
@@ -65,7 +62,7 @@ async function makeFixture(): Promise<Fixture> {
     const pkName = props.partitionKey?.name;
     const skName = props.sortKey?.name;
     if (pkName === undefined) throw new Error(`table ${logical} missing partitionKey`);
-    const attributeDefinitions: Array<{ AttributeName: string; AttributeType: 'S' }> = [
+    const attributeDefinitions: Array<{ AttributeName: string; AttributeType: 'S' | 'N' }> = [
       { AttributeName: pkName, AttributeType: 'S' },
     ];
     const keySchema: Array<{ AttributeName: string; KeyType: 'HASH' | 'RANGE' }> = [
@@ -75,11 +72,33 @@ async function makeFixture(): Promise<Fixture> {
       attributeDefinitions.push({ AttributeName: skName, AttributeType: 'S' });
       keySchema.push({ AttributeName: skName, KeyType: 'RANGE' });
     }
+    // Mirror the CDK-declared secondary indexes (the Connections per-IP
+    // admission GSI) so the fixture matches the deployed schema.
+    const globalSecondaryIndexes = (props.globalSecondaryIndexes ?? []).map((g) => {
+      const gpk = g.partitionKey;
+      if (gpk === undefined) throw new Error(`index ${g.indexName} missing partitionKey`);
+      const gsiKeySchema: Array<{ AttributeName: string; KeyType: 'HASH' | 'RANGE' }> = [
+        { AttributeName: gpk.name, KeyType: 'HASH' },
+      ];
+      attributeDefinitions.push({ AttributeName: gpk.name, AttributeType: 'S' });
+      if (g.sortKey !== undefined) {
+        gsiKeySchema.push({ AttributeName: g.sortKey.name, KeyType: 'RANGE' });
+        attributeDefinitions.push({ AttributeName: g.sortKey.name, AttributeType: 'N' });
+      }
+      return {
+        IndexName: g.indexName,
+        KeySchema: gsiKeySchema,
+        Projection: { ProjectionType: 'ALL' as const },
+      };
+    });
     await client.send(
       new CreateTableCommand({
         TableName: `${prefix}${logical}`,
         AttributeDefinitions: attributeDefinitions,
         KeySchema: keySchema,
+        ...(globalSecondaryIndexes.length > 0
+          ? { GlobalSecondaryIndexes: globalSecondaryIndexes }
+          : {}),
         BillingMode: 'PAY_PER_REQUEST',
       }),
     );
@@ -260,6 +279,141 @@ describe.skipIf(!available)('handlers', () => {
       });
       expect((await probe.getConnectionInfo('b1'))?.id).toBe('b1');
     });
+
+    it('rejects the per-IP cap via identity.sourceIp and the sourceIp GSI', async () => {
+      // End-to-end per-IP admission: dispatch feeds
+      // `event.requestContext.identity.sourceIp` into handleConnect,
+      // which counts the IP's live rows on the `sourceIp` GSI and fires
+      // the (previously dead) maxConnectionsPerIp branch.
+      const capped: HandlerDeps = {
+        ...requireFx().deps,
+        serverConfig: { ...SERVER_CONFIG, maxClients: 50, maxConnectionsPerIp: 2 },
+      };
+      const fromIp = (id: string, ip: string) =>
+        dispatch(
+          {
+            requestContext: { routeKey: '$connect', connectionId: id, identity: { sourceIp: ip } },
+          },
+          capped,
+        );
+      expect((await fromIp('ip-a1', '203.0.113.30')).statusCode).toBe(200);
+      expect((await fromIp('ip-a2', '203.0.113.30')).statusCode).toBe(200);
+      const third = await fromIp('ip-a3', '203.0.113.30');
+      expect(third.statusCode).toBe(429);
+      expect(third.body).toBe('too many connections from this IP');
+      // A different IP is unaffected — the budget is keyed per IP.
+      expect((await fromIp('ip-b1', '198.51.100.30')).statusCode).toBe(200);
+      // The rejected connection must NOT be recorded.
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect(await probe.getConnectionInfo('ip-a3')).toBeNull();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // $connect Origin allowlist (CSWSH defence)
+  // -------------------------------------------------------------------------
+
+  describe('$connect Origin allowlist (CSWSH defence)', () => {
+    it('denies a disallowed Origin with 403 when WEB_ORIGINS is set', async () => {
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-cswsh' },
+          headers: { Origin: 'https://attacker.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(403);
+      // The denied upgrade must NOT persist a Connections row — a
+      // subsequent $default for the same id hits the missing-row path.
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect(await probe.getConnectionInfo('c-cswsh')).toBeNull();
+    });
+
+    it('admits an allowed Origin (200 + persisted row)', async () => {
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-ok-origin' },
+          headers: { Origin: 'https://app.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(200);
+      const probe = new AwsRuntime({
+        dynamo: requireFx().client,
+        tables: requireFx().tables,
+        connId: '__probe__',
+        handlers: { send: () => {}, disconnect: () => {}, snapshot: () => undefined },
+        managementApi: null,
+      });
+      expect((await probe.getConnectionInfo('c-ok-origin'))?.id).toBe('c-ok-origin');
+    });
+
+    it('matches an `Origin` header served lowercased by APIGW', async () => {
+      // API Gateway normalises header keys to lowercase; the handler
+      // MUST find `origin` (not just `Origin`) so a CSWSH defence
+      // bypass cannot hide behind header-key casing.
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-lower' },
+          headers: { origin: 'https://attacker.example.com' },
+        },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(403);
+    });
+
+    it('admits a missing Origin header (non-browser client)', async () => {
+      // curl / WeeChat / the tcp-ws-forwarder never send `Origin`;
+      // their upgrades must pass through unchanged even when the
+      // allowlist is configured.
+      const depsWithOrigins: HandlerDeps = {
+        ...requireFx().deps,
+        webOrigins: new Set(['https://app.example.com']),
+      };
+      const res = await dispatch(
+        { requestContext: { routeKey: '$connect', connectionId: 'c-cli' } },
+        depsWithOrigins,
+      );
+      expect(res.statusCode).toBe(200);
+    });
+
+    it('skips the check entirely when WEB_ORIGINS is unset', async () => {
+      // The default — defence is opt-in. Existing AWS deployments
+      // without a web frontend must be unchanged on upgrade: any
+      // Origin (including an obviously hostile one) proceeds.
+      const res = await dispatch(
+        {
+          requestContext: { routeKey: '$connect', connectionId: 'c-unset' },
+          headers: { Origin: 'https://attacker.example.com' },
+        },
+        requireFx().deps, // no webOrigins
+      );
+      expect(res.statusCode).toBe(200);
+    });
   });
 
   // -------------------------------------------------------------------------
@@ -693,7 +847,7 @@ describe.skipIf(!available)('handlers', () => {
       expect(replay).toBeDefined();
     });
 
-    it('completes SASL PLAIN with 900/903 when an AccountStore is bound', async () => {
+    it('completes SASL PLAIN with 900/903 when a ServicesStore is bound', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c1' } },
         requireFx().deps,
@@ -704,10 +858,18 @@ describe.skipIf(!available)('handlers', () => {
           if (line.length > 0) sink.push(line);
         }
       });
-      // Swap in a deps with a seeded AccountStore for this dispatch.
-      const depsWithAccounts: HandlerDeps = {
+      // Swap in a deps with a seeded ServicesStore for this dispatch.
+      // The store is constructed against the test's DynamoDB client so the
+      // post-dispatch flush succeeds; the registration lives in the
+      // in-memory cache so SASL PLAIN resolves it synchronously.
+      const servicesStore = new DynamoServicesStore({
+        docClient: requireFx().client,
+        tableName: requireFx().tables.Services ?? 'Services',
+      });
+      servicesStore.registerNick('aws-sasl', 's3cret', '');
+      const depsWithServices: HandlerDeps = {
         ...requireFx().deps,
-        accounts: new InMemoryAccountStore([{ username: 'aws-sasl', password: 's3cret' }]),
+        services: servicesStore,
       };
       const payload = Buffer.from('\0aws-sasl\0s3cret', 'utf8').toString('base64');
       await dispatch(
@@ -715,14 +877,14 @@ describe.skipIf(!available)('handlers', () => {
           requestContext: { routeKey: '$default', connectionId: 'c1' },
           body: `CAP REQ :sasl\r\nAUTHENTICATE PLAIN\r\nAUTHENTICATE ${payload}\r\n`,
         },
-        depsWithAccounts,
+        depsWithServices,
       );
       expect(sink.some((l) => l.includes(' 900 '))).toBe(true);
       expect(sink.some((l) => l.includes(' 903 '))).toBe(true);
       expect(sink.some((l) => l.includes(' 904 '))).toBe(false);
     });
 
-    it('emits 904 when no AccountStore is bound (regression guard)', async () => {
+    it('emits 904 when no ServicesStore is bound (regression guard)', async () => {
       await dispatch(
         { requestContext: { routeKey: '$connect', connectionId: 'c2' } },
         requireFx().deps,