serverless-ircd 0.9.0 → 0.11.0

package/packages/aws-adapter/tests/migrate-accounts-to-services.test.ts

@@ -0,0 +1,164 @@
+/**
+ * Unit tests for the pure helpers exported from `tools/migrate-accounts-to-services.ts`.
+ *
+ * The helpers are side-effect-free (the CLI entry point is guarded behind
+ * `void main()` which only runs when the module is executed directly), so
+ * they can be imported and tested without triggering wrangler / DynamoDB
+ * IO.
+ */
+
+import {
+  type LegacyAccountRow,
+  buildMigrationSql,
+  buildServicesPutItem,
+  parseSaslAccountsForMigration,
+} from '@serverless-ircd/irc-core';
+import { describe, expect, it } from 'vitest';
+
+describe('parseSaslAccountsForMigration', () => {
+  it('returns an empty array for undefined', () => {
+    expect(parseSaslAccountsForMigration(undefined)).toEqual([]);
+  });
+
+  it('returns an empty array for an empty string', () => {
+    expect(parseSaslAccountsForMigration('')).toEqual([]);
+  });
+
+  it('parses a single username:password entry', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret')).toEqual([
+      { username: 'alice', password: 's3cret' },
+    ]);
+  });
+
+  it('parses multiple newline-delimited entries', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret\nbob:pw')).toEqual([
+      { username: 'alice', password: 's3cret' },
+      { username: 'bob', password: 'pw' },
+    ]);
+  });
+
+  it('skips blank lines and malformed entries', () => {
+    expect(
+      parseSaslAccountsForMigration('alice:s3cret\n\nnocolon\n:emptyuser\nemptypass:\n   \n'),
+    ).toEqual([{ username: 'alice', password: 's3cret' }]);
+  });
+});
+
+describe('buildMigrationSql — D1 migration SQL', () => {
+  const legacyRow = (account: string, salt = 'salt', hash = 'hash'): LegacyAccountRow => ({
+    account,
+    algorithm: 'scrypt',
+    salt,
+    hash,
+  });
+
+  it('(a) creates a nickserv_accounts row with cert_subjects "[]" for a legacy account', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    // First statement is CREATE TABLE.
+    expect(stmts[0]).toContain('CREATE TABLE IF NOT EXISTS nickserv_accounts');
+    // Second statement is the INSERT OR IGNORE for alice.
+    expect(stmts[1]).toContain('INSERT OR IGNORE INTO nickserv_accounts');
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'[]'");
+    expect(stmts[1]).toContain("'scrypt'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[1]).toContain("'hash'");
+  });
+
+  it('uses INSERT OR IGNORE (never INSERT OR REPLACE) so existing rows are never clobbered', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts[1]).toContain('INSERT OR IGNORE');
+    expect(stmts[1]).not.toContain('INSERT OR REPLACE');
+  });
+
+  it('(c) a legacy row never overwrites an existing NickServ registration (INSERT OR IGNORE)', () => {
+    // The SQL is INSERT OR IGNORE — if the nick_key already exists in
+    // nickserv_accounts, the INSERT is a no-op. The generated SQL encodes
+    // this; running it twice produces the same statements.
+    const stmts1 = buildMigrationSql([legacyRow('alice')], undefined);
+    const stmts2 = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts1).toEqual(stmts2);
+  });
+
+  it('carries SASL_ACCOUNTS env-seed entries not already in the legacy table', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], 'bob:bobspw\nalice:alicespw');
+    // CREATE TABLE + alice (legacy) + bob (env-seed).
+    // alice is in the legacy table so the env-seed alice is NOT duplicated.
+    expect(stmts).toHaveLength(3);
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[2]).toContain("'bob'");
+    // bob's credential is freshly hashed from the plaintext password.
+    expect(stmts[2]).not.toContain("'bobspw'");
+  });
+
+  it('does not re-hash legacy rows (preserves the pre-hashed scrypt credential verbatim)', () => {
+    const stmts = buildMigrationSql([legacyRow('alice', 'mysalt', 'myhash')], undefined);
+    expect(stmts[1]).toContain("'mysalt'");
+    expect(stmts[1]).toContain("'myhash'");
+  });
+
+  it('produces only CREATE TABLE when both legacy rows and env-seed are empty', () => {
+    const stmts = buildMigrationSql([], undefined);
+    expect(stmts).toHaveLength(1);
+    expect(stmts[0]).toContain('CREATE TABLE');
+  });
+
+  it('escapes single quotes in usernames to prevent SQL injection', () => {
+    const stmts = buildMigrationSql([legacyRow("O'Brien")], undefined);
+    expect(stmts[1]).toContain("'O''Brien'");
+    expect(stmts[1]).not.toContain("'O'Brien'");
+  });
+});
+
+describe('buildServicesPutItem — DynamoDB migration', () => {
+  it('targets the NICK:<fold> partition with the nick-type discriminator', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'StagingServices',
+    );
+    expect(input.TableName).toBe('StagingServices');
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.sk).toBe('#');
+    expect(input.Item.type).toBe('nick');
+  });
+
+  it('preserves the legacy scrypt credential fields on the item', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 'mysalt', hash: 'myhash' },
+      'Services',
+    );
+    expect(input.Item.algorithm).toBe('scrypt');
+    expect(input.Item.salt).toBe('mysalt');
+    expect(input.Item.hash).toBe('myhash');
+  });
+
+  it('defaults certSubjects to an empty array', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.certSubjects).toEqual([]);
+  });
+
+  it('folds the nick case-insensitively into the partition key', () => {
+    const input = buildServicesPutItem(
+      { account: 'Alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    // rfc1459 folding: Alice → alice
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.nick).toBe('Alice');
+    expect(input.Item.account).toBe('Alice');
+  });
+
+  it('stamps the default email / enforce / createdAt fields', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.email).toBe('');
+    expect(input.Item.enforce).toBe('none');
+    expect(input.Item.createdAt).toBe(0);
+  });
+});

package/packages/aws-adapter/tests/nlb-secure.test.ts

@@ -0,0 +1,362 @@
+/**
+ * Unit tests for the NLB TLS secure-flag propagation (user mode `S`).
+ *
+ * The stack wires the NLB streaming Lambda exclusively behind a
+ * `Protocol.TLS` listener (ACM-cert terminated at the edge), so every
+ * connection on that entry is TLS-protected. These tests pin the
+ * propagation of that fact end-to-end:
+ *   - the `nlbStreamHandler` dispatcher (`dispatchNlbStream`) asserts
+ *     `secure: true`, so registration stamps read-only user mode `S`
+ *     (visible via `MODE` → `221 … +S`) and the Connections row
+ *     persists both `secure` and `userModes.tls`;
+ *   - STS reflects the secure transport (`CAP LS` advertises the
+ *     duration-only TLS form, never the plaintext `port=` upgrade form);
+ *   - SASL EXTERNAL negotiation is permitted on the secure path (the
+ *     mech is accepted when an mTLS provider is bound; the verify-level
+ *     `904` for a missing account is owned by the EXTERNAL-verify
+ *     ticket, not a secure-connection refusal);
+ *   - a plain transport (secure not asserted) stays unflagged.
+ *
+ * Uses real DynamoDB Local, mirroring `nlb-stream.test.ts`.
+ */
+
+import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
+import { GetCommand } from '@aws-sdk/lib-dynamodb';
+import {
+  InMemoryMtlsIdentityProvider,
+  type ParsedServerConfig,
+  StaticMotdProvider,
+  certIdentityFromSubject,
+} from '@serverless-ircd/irc-core';
+import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import type { PostToConnection } from '../src/aws-runtime.js';
+import { TABLE_DEFS } from '../src/cdk-table-defs.js';
+import { createDynamoDocumentClient } from '../src/dynamo.js';
+import { type HandlerDeps, dispatchNlbStream } from '../src/handlers/index.js';
+import {
+  type NlbStreamEvent,
+  deriveNlbConnectionId,
+  handleNlbStream,
+} from '../src/handlers/nlb-stream.js';
+import { bindMessageStore } from '../src/message-store.js';
+import type { TablesConfig } from '../src/tables.js';
+
+const available = process.env.DDB_AVAILABLE === '1';
+const endpoint = process.env.DYNAMO_ENDPOINT;
+
+const SERVER_CONFIG: ParsedServerConfig = makeTestServerConfig({
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  motdLines: ['Welcome to the test IRC server.'],
+  // SASL EXTERNAL is operator opt-in; these tests exercise the enabled
+  // deployment (mTLS + TLS listener configured at the edge).
+  sasl: { externalEnabled: true },
+});
+
+const STS_CONFIG: ParsedServerConfig = makeTestServerConfig({
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  motdLines: ['Welcome to the test IRC server.'],
+  sts: { duration: 3600, port: 6697 },
+});
+
+const MOTD = new StaticMotdProvider(SERVER_CONFIG.motdLines);
+
+interface Fixture {
+  tables: TablesConfig;
+  client: ReturnType<typeof createDynamoDocumentClient>;
+  mgmt: LocalPostToConnection;
+  deps: HandlerDeps;
+  stsDeps: HandlerDeps;
+  cleanup: () => Promise<void>;
+}
+
+let fx: Fixture | null;
+
+function requireFx(): Fixture {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
+async function makeFixture(): Promise<Fixture> {
+  if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
+  const prefix = `s${Date.now()}-${Math.floor(Math.random() * 1e6)}-`;
+  const tables = Object.fromEntries(
+    Object.keys(TABLE_DEFS).map((name) => [name, `${prefix}${name}`]),
+  ) as TablesConfig;
+  const client = createDynamoDocumentClient({ endpoint });
+  for (const [logical, props] of Object.entries(TABLE_DEFS)) {
+    const pkName = props.partitionKey?.name;
+    const skName = props.sortKey?.name;
+    if (pkName === undefined) throw new Error(`table ${logical} missing partitionKey`);
+    const attributeDefinitions: Array<{ AttributeName: string; AttributeType: 'S' | 'N' }> = [
+      { AttributeName: pkName, AttributeType: 'S' },
+    ];
+    const keySchema: Array<{ AttributeName: string; KeyType: 'HASH' | 'RANGE' }> = [
+      { AttributeName: pkName, KeyType: 'HASH' },
+    ];
+    if (skName !== undefined) {
+      attributeDefinitions.push({ AttributeName: skName, AttributeType: 'S' });
+      keySchema.push({ AttributeName: skName, KeyType: 'RANGE' });
+    }
+    // Secondary indexes declared by the CDK definition (the Connections
+    // per-IP admission GSI) are created here too — the NLB new-flow rate
+    // gate Queries the index, so a fixture without it diverges from the
+    // deployed schema.
+    const globalSecondaryIndexes = (props.globalSecondaryIndexes ?? []).map((g) => {
+      const gpk = g.partitionKey;
+      if (gpk === undefined) throw new Error(`index ${g.indexName} missing partitionKey`);
+      const gsiKeySchema: Array<{ AttributeName: string; KeyType: 'HASH' | 'RANGE' }> = [
+        { AttributeName: gpk.name, KeyType: 'HASH' },
+      ];
+      attributeDefinitions.push({ AttributeName: gpk.name, AttributeType: 'S' });
+      if (g.sortKey !== undefined) {
+        gsiKeySchema.push({ AttributeName: g.sortKey.name, KeyType: 'RANGE' });
+        attributeDefinitions.push({ AttributeName: g.sortKey.name, AttributeType: 'N' });
+      }
+      return {
+        IndexName: g.indexName,
+        KeySchema: gsiKeySchema,
+        Projection: { ProjectionType: 'ALL' as const },
+      };
+    });
+    await client.send(
+      new CreateTableCommand({
+        TableName: `${prefix}${logical}`,
+        AttributeDefinitions: attributeDefinitions,
+        KeySchema: keySchema,
+        ...(globalSecondaryIndexes.length > 0
+          ? { GlobalSecondaryIndexes: globalSecondaryIndexes }
+          : {}),
+        BillingMode: 'PAY_PER_REQUEST',
+      }),
+    );
+  }
+  const mgmt = new LocalPostToConnection();
+  const deps: HandlerDeps = {
+    dynamo: client,
+    tables,
+    serverConfig: SERVER_CONFIG,
+    motd: MOTD,
+    messages: bindMessageStore(SERVER_CONFIG),
+    managementApi: mgmt as never,
+  };
+  const stsDeps: HandlerDeps = {
+    ...deps,
+    serverConfig: STS_CONFIG,
+    messages: bindMessageStore(STS_CONFIG),
+  };
+  return {
+    tables,
+    client,
+    mgmt,
+    deps,
+    stsDeps,
+    cleanup: async () => {
+      for (const logical of Object.keys(TABLE_DEFS)) {
+        try {
+          await client.send(new DeleteTableCommand({ TableName: `${prefix}${logical}` }));
+        } catch {
+          // Already gone.
+        }
+      }
+    },
+  };
+}
+
+/** Builds an NLB event from raw client bytes (base64-encodes the body). */
+function nlbEvent(sourceIp: string, sourcePort: string, data: string): NlbStreamEvent {
+  return {
+    requestContext: { elb: { targetGroupArn: 'arn:aws:elasticloadbalancing:::targetgroup/test' } },
+    version: '2.0',
+    body: Buffer.from(data, 'utf8').toString('base64'),
+    isBase64Encoded: true,
+    headers: {
+      'x-forwarded-for': sourceIp,
+      'x-forwarded-port': sourcePort,
+    },
+  };
+}
+
+/** Decodes an NLB response body back to raw IRC bytes. */
+function decodeBody(res: { body: string }): string {
+  return Buffer.from(res.body, 'base64').toString('utf8');
+}
+
+/** Reads a raw Connections row. */
+async function readRow(
+  tableName: string,
+  client: Fixture['client'],
+  connId: string,
+): Promise<Record<string, unknown> | undefined> {
+  const row = await client.send(
+    new GetCommand({ TableName: tableName, Key: { connectionId: connId } }),
+  );
+  return row.Item;
+}
+
+describe.skipIf(!available)('NLB TLS secure-flag propagation', () => {
+  beforeEach(async () => {
+    fx = await makeFixture();
+  });
+  afterEach(async () => {
+    if (fx) await fx.cleanup();
+    fx = null;
+  });
+
+  it('flags the NLB+TLS connection secure: MODE read-back shows +S and the row persists secure + userModes.tls', async () => {
+    const f = requireFx();
+    const res = await dispatchNlbStream(
+      nlbEvent(
+        '10.0.0.70',
+        '50070',
+        'NICK tlsclient\r\nUSER tls 0 * :TLS User\r\nMODE tlsclient\r\n',
+      ),
+      f.deps,
+    );
+    expect(res.statusCode).toBe(200);
+    const body = decodeBody(res);
+    // Read-only user mode `S` is visible in the MODE read form (221).
+    expect(body).toContain('221 tlsclient +S');
+    expect(body).not.toContain('221 tlsclient +\r\n');
+
+    // The persisted row carries the TLS fact for cross-invocation readers.
+    const row = await readRow(
+      f.tables.Connections,
+      f.client,
+      deriveNlbConnectionId('10.0.0.70', '50070'),
+    );
+    expect(row?.secure).toBe(true);
+    expect(row?.userModes).toMatchObject({ tls: true });
+  });
+
+  it('keeps the secure flag across invocations of the same flow (persist + re-stamp)', async () => {
+    const f = requireFx();
+    await dispatchNlbStream(
+      nlbEvent('10.0.0.71', '50071', 'NICK reuser\r\nUSER u 0 * :Re User\r\n'),
+      f.deps,
+    );
+    const res = await dispatchNlbStream(nlbEvent('10.0.0.71', '50071', 'MODE reuser\r\n'), f.deps);
+    expect(res.statusCode).toBe(200);
+    expect(decodeBody(res)).toContain('221 reuser +S');
+
+    const row = await readRow(
+      f.tables.Connections,
+      f.client,
+      deriveNlbConnectionId('10.0.0.71', '50071'),
+    );
+    expect(row?.secure).toBe(true);
+    expect(row?.userModes).toMatchObject({ tls: true });
+  });
+
+  it('does not flag a plain transport when secure is not asserted (contrast)', async () => {
+    const f = requireFx();
+    // handleNlbStream called WITHOUT `secure` models a plain-TCP listener
+    // target: no S mode, and the row records the plain transport.
+    const res = await handleNlbStream(
+      nlbEvent(
+        '10.0.0.72',
+        '50072',
+        'NICK plainclient\r\nUSER p 0 * :Plain User\r\nMODE plainclient\r\n',
+      ),
+      {
+        dynamo: f.client,
+        tables: f.tables,
+        serverConfig: SERVER_CONFIG,
+        motd: MOTD,
+        messages: bindMessageStore(SERVER_CONFIG),
+        managementApi: f.mgmt,
+      },
+    );
+    expect(res.statusCode).toBe(200);
+    const body = decodeBody(res);
+    expect(body).toContain('221 plainclient +\r\n');
+    expect(body).not.toContain('+S');
+
+    const row = await readRow(
+      f.tables.Connections,
+      f.client,
+      deriveNlbConnectionId('10.0.0.72', '50072'),
+    );
+    expect(row?.secure).toBe(false);
+    expect(row?.userModes).toMatchObject({ tls: false });
+  });
+
+  it('advertises the TLS form of sts on the secure NLB path (duration only, no port)', async () => {
+    const f = requireFx();
+    const res = await dispatchNlbStream(
+      nlbEvent('10.0.0.73', '50073', 'CAP LS 302\r\n'),
+      f.stsDeps,
+    );
+    expect(res.statusCode).toBe(200);
+    const body = decodeBody(res);
+    // Already on the secure listener: duration-only advertisement.
+    expect(body).toContain('sts=duration=3600');
+    expect(body).not.toContain('port=');
+
+    // Contrast — the same config over a transport that did not assert
+    // secure advertises the plaintext upgrade form with the port.
+    const plain = await handleNlbStream(nlbEvent('10.0.0.74', '50074', 'CAP LS 302\r\n'), {
+      dynamo: f.client,
+      tables: f.tables,
+      serverConfig: STS_CONFIG,
+      motd: MOTD,
+      messages: bindMessageStore(STS_CONFIG),
+      managementApi: f.mgmt,
+    });
+    expect(decodeBody(plain)).toContain('sts=duration=3600,port=6697');
+  });
+
+  it('permits SASL EXTERNAL negotiation on the secure NLB path', async () => {
+    const f = requireFx();
+    const connId = deriveNlbConnectionId('10.0.0.75', '50075');
+    const opts = {
+      dynamo: f.client,
+      tables: f.tables,
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      messages: bindMessageStore(SERVER_CONFIG),
+      managementApi: f.mgmt,
+      secure: true,
+      mtlsIdentity: new InMemoryMtlsIdentityProvider([
+        { connId, identity: certIdentityFromSubject('CN=extuser') },
+      ]),
+    };
+
+    // Mechanism selection: EXTERNAL is advertised and accepted (the
+    // server asks for the empty payload with `AUTHENTICATE +`).
+    const ls = await handleNlbStream(
+      nlbEvent('10.0.0.75', '50075', 'CAP LS 302\r\nAUTHENTICATE EXTERNAL\r\n'),
+      opts,
+    );
+    const lsBody = decodeBody(ls);
+    expect(lsBody).toContain('sasl=PLAIN,EXTERNAL');
+    expect(lsBody).toContain('AUTHENTICATE +');
+
+    // Payload delivery: the exchange proceeds to the verify step. With no
+    // services store bound the verify fails with 904 (account resolution
+    // is the EXTERNAL-verify ticket's concern) — never a 908 mech-level
+    // refusal on secure-connection grounds.
+    const fin = await handleNlbStream(nlbEvent('10.0.0.75', '50075', 'AUTHENTICATE +\r\n'), opts);
+    const finBody = decodeBody(fin);
+    expect(finBody).toContain('904');
+    expect(finBody).not.toContain('908');
+  });
+});
+
+/**
+ * Test double for `ApiGatewayManagementApi`. Routes `postToConnection`
+ * calls to a registered sink for `ConnectionId`.
+ */
+class LocalPostToConnection implements PostToConnection {
+  private readonly sinks = new Map<string, (data: string) => void>();
+  register(connId: string, sink: (data: string) => void): void {
+    this.sinks.set(connId, sink);
+  }
+  async postToConnection(input: { ConnectionId: string; Data: string }): Promise<unknown> {
+    const sink = this.sinks.get(input.ConnectionId);
+    if (sink !== undefined) sink(input.Data);
+    return {};
+  }
+}