serverless-ircd 0.9.0 → 0.11.0

package/packages/cf-adapter/tests/connection-do-frame-limit.test.ts

@@ -0,0 +1,177 @@
+/**
+ * CF adapter — per-connection inbound frame-rate window at the adapter
+ * boundary (`ConnectionDO.webSocketMessage`).
+ *
+ * The gate fires BEFORE the actor / storage write: a connection that
+ * delivers more than `adapter.maxFramesPerWindow` frames inside the
+ * `adapter.frameWindowSeconds` sliding window is closed with RFC 6455
+ * close code 1008 (Policy Violation) after receiving the canonical
+ * `ERROR :Closing link (flooding)` line.
+ *
+ * The default window (50 frames / 5 s) exercises the under/at/over
+ * thresholds; the sliding-window decay uses the `__setFrameWindowForTest`
+ * seam to install a tight window so the test does not sleep for real
+ * seconds.
+ */
+
+import { env, runInDurableObject } from 'cloudflare:test';
+import { describe, expect, it } from 'vitest';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      CONNECTION_DO: DurableObjectNamespace;
+      REGISTRY_DO: DurableObjectNamespace;
+      CHANNEL_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+/** Poll interval (ms) for the waitFor* helpers. */
+const POLL_MS = 10;
+/** Default timeout (ms) for the waitFor* helpers. */
+const DEFAULT_TIMEOUT_MS = 4000;
+
+class FrameWsClient {
+  readonly lines: string[] = [];
+  readonly ws: WebSocket;
+  closedCode: number | undefined;
+
+  constructor(ws: WebSocket) {
+    this.ws = ws;
+    ws.addEventListener('message', (ev: MessageEvent) => {
+      const data = typeof ev.data === 'string' ? ev.data : new TextDecoder().decode(ev.data);
+      for (const line of data.split('\r\n')) {
+        if (line.length > 0) this.lines.push(line);
+      }
+    });
+    ws.addEventListener('close', (ev: CloseEvent) => {
+      this.closedCode = ev.code;
+    });
+  }
+
+  send(line: string): void {
+    this.ws.send(`${line}\r\n`);
+  }
+
+  countPongs(): number {
+    return this.lines.filter((l) => l.startsWith('PONG')).length;
+  }
+
+  async waitForPongs(n: number, timeoutMs = DEFAULT_TIMEOUT_MS): Promise<void> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (this.countPongs() >= n) return;
+      await new Promise((r) => setTimeout(r, POLL_MS));
+    }
+    throw new Error(`waitForPongs(${n}) timed out; lines: ${JSON.stringify(this.lines)}`);
+  }
+
+  async waitForClose(timeoutMs = DEFAULT_TIMEOUT_MS): Promise<number> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (this.closedCode !== undefined) return this.closedCode;
+      await new Promise((r) => setTimeout(r, POLL_MS));
+    }
+    throw new Error(`waitForClose timed out; lines: ${JSON.stringify(this.lines)}`);
+  }
+}
+
+async function openConnection(
+  connId: string,
+): Promise<{ client: FrameWsClient; stub: DurableObjectStub }> {
+  const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName(connId));
+  const response = await stub.fetch('https://do/upgrade', { headers: { Upgrade: 'websocket' } });
+  const ws = response.webSocket;
+  if (ws === undefined || ws === null) {
+    throw new Error('ConnectionDO.fetch did not return a WebSocket');
+  }
+  ws.accept();
+  const client = await new Promise<FrameWsClient>((resolve) => {
+    setTimeout(() => resolve(new FrameWsClient(ws as WebSocket)), 0);
+  });
+  return { client, stub };
+}
+
+/** RPC shape of the `ConnectionDO` test seam used for the decay test. */
+interface FrameWindowSeam {
+  __setFrameWindowForTest(cfg: { maxFrames: number; windowMs: number } | undefined): void;
+}
+
+describe('ConnectionDO — inbound frame-rate window (default 50 / 5 s)', () => {
+  it('admits frames while the window is under the ceiling and at the ceiling (no close)', async () => {
+    const { client } = await openConnection('conn-frame-under');
+    // 50 frames = exactly the default ceiling; every one is admitted and
+    // answered (each PING is one WebSocket frame through the actor).
+    for (let i = 1; i <= 50; i++) {
+      client.send(`PING :u${i}`);
+    }
+    await client.waitForPongs(50);
+    // Grace window: a close would have landed by now if the 50th frame
+    // had tripped the gate.
+    await new Promise((r) => setTimeout(r, 150));
+    expect(client.closedCode).toBeUndefined();
+    client.ws.close();
+  });
+
+  it('closes with RFC 6455 code 1008 after ERROR :Closing link (flooding) on frame 51', async () => {
+    const { client } = await openConnection('conn-frame-over');
+    for (let i = 1; i <= 50; i++) {
+      client.send(`PING :o${i}`);
+    }
+    await client.waitForPongs(50);
+
+    // Frame 51 exceeds the window: no actor run (no PONG), the ERROR
+    // line is delivered, then the socket is closed with 1008.
+    client.send('PING :o51');
+    const code = await client.waitForClose();
+    expect(code).toBe(1008);
+    expect(client.lines).toContain('ERROR :Closing link (flooding)');
+    expect(client.lines.some((l) => l.startsWith('PONG :o51'))).toBe(false);
+  });
+
+  it('admits a fresh burst after the window decays (sliding window)', async () => {
+    const { client, stub } = await openConnection('conn-frame-decay');
+    // Tight window (5 frames / 400 ms) via the test seam so the decay
+    // wait is fast instead of a real 5-second sleep.
+    await runInDurableObject(stub, (instance: unknown) => {
+      (instance as FrameWindowSeam).__setFrameWindowForTest({
+        maxFrames: 5,
+        windowMs: 400,
+      });
+    });
+
+    for (let i = 1; i <= 5; i++) {
+      client.send(`PING :d1-${i}`);
+    }
+    await client.waitForPongs(5);
+
+    // Wait past the window: the first burst decays out entirely.
+    await new Promise((r) => setTimeout(r, 500));
+    for (let i = 1; i <= 5; i++) {
+      client.send(`PING :d2-${i}`);
+    }
+    await client.waitForPongs(10);
+    await new Promise((r) => setTimeout(r, 150));
+    expect(client.closedCode).toBeUndefined();
+    expect(client.countPongs()).toBe(10);
+    client.ws.close();
+  });
+
+  it('still floods out mid-burst once the tight window is full (seam sanity)', async () => {
+    const { client, stub } = await openConnection('conn-frame-tight');
+    await runInDurableObject(stub, (instance: unknown) => {
+      (instance as FrameWindowSeam).__setFrameWindowForTest({
+        maxFrames: 2,
+        windowMs: 60_000,
+      });
+    });
+    client.send('PING :t1');
+    client.send('PING :t2');
+    client.send('PING :t3');
+    const code = await client.waitForClose();
+    expect(code).toBe(1008);
+    expect(client.lines).toContain('ERROR :Closing link (flooding)');
+    expect(client.countPongs()).toBe(2);
+  });
+});

package/packages/cf-adapter/tests/connection-do-pure.test.ts

@@ -6,60 +6,14 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { parseSaslAccountsEnv, wsFrameModeFromTags } from '../src/connection-do';
-
-describe('parseSaslAccountsEnv', () => {
-  it('returns an empty array for undefined input', () => {
-    expect(parseSaslAccountsEnv(undefined)).toEqual([]);
-  });
-
-  it('returns an empty array for an empty string', () => {
-    expect(parseSaslAccountsEnv('')).toEqual([]);
-  });
-
-  it('parses a single well-formed entry', () => {
-    expect(parseSaslAccountsEnv('alice:secret')).toEqual([
-      { username: 'alice', password: 'secret' },
-    ]);
-  });
-
-  it('parses multiple newline-delimited entries', () => {
-    expect(parseSaslAccountsEnv('alice:secret\nbob:pw')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
-  });
-
-  it('skips blank lines', () => {
-    expect(parseSaslAccountsEnv('alice:secret\n\nbob:pw\n   \n')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
-  });
-
-  it('skips lines with no colon separator', () => {
-    expect(parseSaslAccountsEnv('alice:secret\nnocolonhere\nbob:pw')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
-  });
-
-  it('skips lines where the colon is at position 0 (empty username)', () => {
-    expect(parseSaslAccountsEnv(':secret\nalice:valid')).toEqual([
-      { username: 'alice', password: 'valid' },
-    ]);
-  });
-
-  it('skips lines with an empty password after the colon', () => {
-    expect(parseSaslAccountsEnv('alice:\nbob:valid')).toEqual([
-      { username: 'bob', password: 'valid' },
-    ]);
-  });
-
-  it('returns an empty array when every line is malformed', () => {
-    expect(parseSaslAccountsEnv('\n   \n:no-user\nuser:')).toEqual([]);
-  });
-});
+import {
+  NO_OP_DISCONNECT,
+  NO_OP_SEND,
+  buildOptionalActorFields,
+  chooseMotdProvider,
+  extractMtlsSubject,
+  wsFrameModeFromTags,
+} from '../src/connection-do';
 
 describe('wsFrameModeFromTags', () => {
   it("returns 'legacy' when no tags are present", () => {
@@ -219,3 +173,159 @@ describe('PassthroughChannelAccess.refreshChannel', () => {
     expect(chan.topic?.text).toBe('keep');
   });
 });
+
+// ============================================================================
+// chooseMotdProvider — default vs. populated MOTD_LINES branch
+// ============================================================================
+
+describe('chooseMotdProvider', () => {
+  it('returns the default MOTD when the env value is undefined', () => {
+    const provider = chooseMotdProvider(undefined);
+    expect(provider.lines()).toEqual(['Welcome to the ServerlessIRCd Cloudflare adapter.']);
+  });
+
+  it('returns the default MOTD when the env value is an empty string', () => {
+    const provider = chooseMotdProvider('');
+    expect(provider.lines()).toEqual(['Welcome to the ServerlessIRCd Cloudflare adapter.']);
+  });
+
+  it('splits a populated MOTD_LINES on newlines', () => {
+    const provider = chooseMotdProvider('Line one\nLine two\nLine three');
+    expect(provider.lines()).toEqual(['Line one', 'Line two', 'Line three']);
+  });
+});
+
+// ============================================================================
+// buildOptionalActorFields — conditional spread branches
+// ============================================================================
+
+describe('buildOptionalActorFields', () => {
+  it('returns an empty object when every optional is undefined', () => {
+    expect(buildOptionalActorFields(undefined, undefined)).toEqual({});
+  });
+
+  it('includes `services` when defined', () => {
+    const fake = {} as unknown as Parameters<typeof buildOptionalActorFields>[0];
+    expect(buildOptionalActorFields(fake, undefined).services).toBe(fake);
+  });
+
+  it('includes `mtlsIdentity` when defined', () => {
+    const fake = {} as unknown as Parameters<typeof buildOptionalActorFields>[1];
+    expect(buildOptionalActorFields(undefined, fake).mtlsIdentity).toBe(fake);
+  });
+});
+
+// ============================================================================
+// NO_OP_SEND / NO_OP_DISCONNECT — invoked once to cover the function bodies
+// (the no-socket teardown path constructs these handlers but the actor never
+// invokes send/disconnect during QUIT processing — there is no peer to
+// deliver to and the socket is already gone).
+// ============================================================================
+
+describe('NO_OP_SEND / NO_OP_DISCONNECT', () => {
+  it('NO_OP_SEND runs without throwing and returns undefined', () => {
+    expect(NO_OP_SEND([{ text: 'ignored' }])).toBeUndefined();
+  });
+
+  it('NO_OP_DISCONNECT runs without throwing and returns undefined', () => {
+    expect(NO_OP_DISCONNECT('any reason')).toBeUndefined();
+  });
+});
+
+// ============================================================================
+// extractMtlsSubject — request.cf mTLS identity capture
+// (cf.tlsClientAuthCertSubject + cf.tlsClientAuth.certFingerprintSHA256)
+// ============================================================================
+
+describe('extractMtlsSubject', () => {
+  it('returns the subject identity when cf.tlsClientAuthCertSubject is a string', () => {
+    // The CF edge injects request.cf on every proxied request. We can't
+    // mutate Request.cf in workerd tests (it's read-only), so the
+    // upgrade-time capture is exercised via this pure seam.
+    const fake = { cf: { tlsClientAuthCertSubject: 'CN=alice' } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toEqual({
+      subject: 'CN=alice',
+      canonicalDn: 'cn=alice',
+    });
+  });
+
+  it('includes the fingerprint from cf.tlsClientAuth.certFingerprintSHA256 when present', () => {
+    const fake = {
+      cf: {
+        tlsClientAuthCertSubject: 'CN=alice',
+        tlsClientAuth: { certFingerprintSHA256: 'af363dc85bc942a8' },
+      },
+    } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toEqual({
+      subject: 'CN=alice',
+      canonicalDn: 'cn=alice',
+      fingerprint: 'af363dc85bc942a8',
+    });
+  });
+
+  it('omits the fingerprint when certFingerprintSHA256 is the documented empty default', () => {
+    // Cloudflare documents certFingerprintSHA256 as `""` when the
+    // connection is not mTLS — treat that as "no fingerprint".
+    const fake = {
+      cf: {
+        tlsClientAuthCertSubject: 'CN=alice',
+        tlsClientAuth: { certFingerprintSHA256: '' },
+      },
+    } as unknown as Request;
+    expect(extractMtlsSubject(fake)?.fingerprint).toBeUndefined();
+  });
+
+  it('ignores a non-string certFingerprintSHA256', () => {
+    const fake = {
+      cf: {
+        tlsClientAuthCertSubject: 'CN=alice',
+        tlsClientAuth: { certFingerprintSHA256: 42 },
+      },
+    } as unknown as Request;
+    expect(extractMtlsSubject(fake)?.fingerprint).toBeUndefined();
+  });
+
+  it('falls back to cf.tlsClientAuth.certSubjectDN when the legacy subject field is absent', () => {
+    const fake = {
+      cf: {
+        tlsClientAuth: { certSubjectDN: 'CN=alice,O=Example', certFingerprintSHA256: 'aa11' },
+      },
+    } as unknown as Request;
+    const identity = extractMtlsSubject(fake);
+    expect(identity?.subject).toBe('CN=alice,O=Example');
+    expect(identity?.canonicalDn).toBe('cn=alice,o=Example');
+    expect(identity?.fingerprint).toBe('aa11');
+  });
+
+  it('prefers the legacy subject field over tlsClientAuth.certSubjectDN', () => {
+    const fake = {
+      cf: {
+        tlsClientAuthCertSubject: 'CN=legacy',
+        tlsClientAuth: { certSubjectDN: 'CN=newer' },
+      },
+    } as unknown as Request;
+    expect(extractMtlsSubject(fake)?.subject).toBe('CN=legacy');
+  });
+
+  it('returns undefined when cf is absent', () => {
+    const fake = { cf: undefined } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+
+  it('returns undefined when cf is present but carries no cert subject', () => {
+    const fake = {
+      cf: { country: 'US', tlsClientAuth: { certVerified: 'NONE' } },
+    } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+
+  it('returns undefined when tlsClientAuthCertSubject is not a string', () => {
+    const fake = { cf: { tlsClientAuthCertSubject: 42 } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+
+  it('returns undefined when tlsClientAuth is not an object', () => {
+    const fake = { cf: { tlsClientAuth: 'nope' } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
+  });
+});

package/packages/cf-adapter/tests/connection-do-sasl-d1.test.ts

@@ -1,10 +1,9 @@
 /**
- * End-to-end SASL PLAIN through ConnectionDO with D1-backed accounts.
+ * End-to-end SASL PLAIN through ConnectionDO with D1-backed services.
  *
- * Verifies the full precedence matrix:
- *   - D1 has rows → table is authoritative (900/903 for seeded account,
- *     904 for the env-seed account which the table shadows).
- *   - D1 empty → the `SASL_ACCOUNTS` env-var seed still works (fallback).
+ * Verifies the services-store credential path: an account seeded into the
+ * `nickserv_accounts` table (via `ServicesStore.registerNick`) verifies
+ * end-to-end through `AUTHENTICATE PLAIN`.
  *
  * Each test file gets its own isolated D1 database from miniflare, so the
  * table state set up here does not leak into `connection-do.test.ts`.
@@ -12,7 +11,7 @@
 
 import { env } from 'cloudflare:test';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { CREATE_ACCOUNTS_TABLE_SQL, putAccountCredential } from '../src/d1-account-store';
+import { CREATE_SERVICES_TABLES_SQL } from '../src/d1-services-store';
 
 declare global {
   namespace Cloudflare {
@@ -107,16 +106,56 @@ async function authenticatePlain(
   client.send(`AUTHENTICATE ${plainB64(authcid, password)}\r\n`);
 }
 
-describe('ConnectionDO — SASL PLAIN with D1-backed accounts', () => {
+/**
+ * Seeds a NickServ registration directly into the D1 services table by
+ * driving a first connection through `PRIVMSG NickServ :REGISTER`. Returns
+ * once the registration NOTICE is observed.
+ */
+async function seedViaNickservRegister(
+  connId: string,
+  nick: string,
+  password: string,
+  email: string,
+): Promise<IrcWsClient> {
+  const client = await connect(connId);
+  client.send(`NICK ${nick}\r\n`);
+  client.send(`USER ${nick} 0 * :${nick}\r\n`);
+  await client.waitForMessage((l) => l.includes(' 001 '));
+  client.send(`PRIVMSG NickServ :REGISTER ${password} ${email}\r\n`);
+  await client.waitForMessage((l) => l.includes('NickServ') && l.includes('registered'));
+  return client;
+}
+
+describe('ConnectionDO — SASL PLAIN with D1-backed services', () => {
   beforeEach(async () => {
-    await env.ACCOUNTS_DB.exec(CREATE_ACCOUNTS_TABLE_SQL);
+    for (const sql of CREATE_SERVICES_TABLES_SQL) {
+      await env.ACCOUNTS_DB.exec(sql);
+    }
   });
   afterEach(async () => {
-    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_channels');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_access');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_levels');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS hostserv_vhosts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS hostserv_pending_vhosts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS memoserv_memos');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS read_markers');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS operserv_akills');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS operserv_jupes');
   });
 
-  it('completes SASL PLAIN with 900/903 for a D1-seeded account', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('completes SASL PLAIN with 900/903 for a NickServ-registered account', async () => {
+    // Seed alice via NickServ REGISTER on a first connection.
+    const seeder = await seedViaNickservRegister(
+      'conn-d1-sasl-seed',
+      'd1-alice',
+      'd1-s3cret',
+      'd1@example.com',
+    );
+    await seeder.close();
+
+    // A second connection speaking SASL PLAIN against the registered nick.
     const client = await connect('conn-d1-sasl-1');
     await authenticatePlain(client, 'd1-alice', 'd1-s3cret');
     await client.waitForMessage((l) => l.includes(' 900 '));
@@ -125,42 +164,27 @@ describe('ConnectionDO — SASL PLAIN with D1-backed accounts', () => {
     await client.close();
   });
 
-  it('rejects SASL PLAIN with 904 for a wrong password (D1 account)', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('rejects SASL PLAIN with 904 for a wrong password', async () => {
+    const seeder = await seedViaNickservRegister(
+      'conn-d1-sasl-seed2',
+      'd1-bob',
+      'd1-s3cret',
+      'd1@example.com',
+    );
+    await seeder.close();
+
     const client = await connect('conn-d1-sasl-2');
-    await authenticatePlain(client, 'd1-alice', 'wrong');
+    await authenticatePlain(client, 'd1-bob', 'wrong');
     const fail = await client.waitForMessage((l) => l.includes(' 904 '));
     expect(fail).toContain(' 904 ');
     await client.close();
   });
 
-  it('table shadows the env-seed account (table wins)', async () => {
-    // SASL_ACCOUNTS env seeds "cf-sasl:s3cret" but D1 has no such row.
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('rejects SASL PLAIN with 904 for an unknown nick', async () => {
     const client = await connect('conn-d1-sasl-3');
-    // env-seed account does NOT verify (table is authoritative).
-    await authenticatePlain(client, 'cf-sasl', 's3cret');
+    await authenticatePlain(client, 'nobody', 'whatever');
     const fail = await client.waitForMessage((l) => l.includes(' 904 '));
     expect(fail).toContain(' 904 ');
     await client.close();
   });
 });
-
-describe('ConnectionDO — SASL PLAIN in-memory fallback (D1 empty)', () => {
-  // The table exists but has zero rows → resolver falls back to SASL_ACCOUNTS.
-  beforeEach(async () => {
-    await env.ACCOUNTS_DB.exec(CREATE_ACCOUNTS_TABLE_SQL);
-  });
-  afterEach(async () => {
-    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
-  });
-
-  it('falls back to SASL_ACCOUNTS seed when D1 is empty', async () => {
-    const client = await connect('conn-d1-sasl-fallback');
-    await authenticatePlain(client, 'cf-sasl', 's3cret');
-    await client.waitForMessage((l) => l.includes(' 900 '));
-    const success = await client.waitForMessage((l) => l.includes(' 903 '));
-    expect(success).toContain(' 903 ');
-    await client.close();
-  });
-});

package/packages/cf-adapter/tests/connection-do-ws-spec-contract.test.ts

@@ -223,12 +223,15 @@ describe('ConnectionDO — IRCv3 WebSocket spec contract (end-to-end)', () => {
     client.messages.length = 0;
 
     // One WS message that LOOKS like two PING lines. In spec mode the frame
-    // is a single IRC message, so exactly ONE PONG is emitted.
+    // is a single IRC message, so it is never split into two commands: the
+    // embedded CR makes the line unparseable (bare-CR rejection) and the
+    // actor answers with exactly ONE 421 — never a PONG, let alone two.
     client.sendRaw('PING one\r\nPING two');
-    await client.waitForMessages((m) => countCommand([m], 'PONG') === 1, 1);
-    // Give a grace window for a (incorrect) second PONG to arrive.
+    await client.waitForLine((l) => l.includes(' 421 '));
+    // Give a grace window for a (incorrect) PONG or second reply to arrive.
     await new Promise((r) => setTimeout(r, 100));
-    expect(countCommand(client.messages, 'PONG')).toBe(1);
+    expect(countCommand(client.messages, 'PONG')).toBe(0);
+    expect(client.messages.filter((m) => m.includes(' 421 '))).toHaveLength(1);
     client.ws.close();
   });