serverless-ircd 0.9.0 → 0.11.0

package/packages/cf-adapter/tests/counter-do.test.ts

@@ -0,0 +1,181 @@
+/**
+ * `CounterDO` — global live-connection admission counter.
+ *
+ * TDD outline:
+ *   "Red on admit-under-cap / reject-at-cap; green; then TTL reap,
+ *    heartbeat refresh, and the lazy reconcile on admit."
+ *
+ * Tests address the single global counter instance directly over RPC,
+ * driving every branch of admit / release / heartbeat / sweep with
+ * explicit timestamps so the TTL boundary is deterministic (no wall
+ * clock dependence). Each test gets an isolated storage namespace, so
+ * the shared `global` instance never bleeds state across tests.
+ */
+
+import { env, reset } from 'cloudflare:test';
+import { afterEach, describe, expect, it } from 'vitest';
+import { COUNTER_INSTANCE_NAME, DEFAULT_CONNECTION_TTL_MS } from '../src/counter-do';
+import type { CounterRpc } from '../src/env';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      COUNTER_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+// DO storage persists across tests in the same file; reset between each so
+// admission entries from one test never leak into the next. Every test
+// addresses the same `global` counter instance, so this is essential.
+afterEach(async () => {
+  await reset();
+});
+
+/** Fixed epoch base for deterministic TTL arithmetic. */
+const T0 = 1_700_000_000_000;
+/** Alias for readability in the TTL-boundary tests. */
+const TTL = DEFAULT_CONNECTION_TTL_MS;
+
+/** RPC handle on the single global counter instance. */
+function counter(): CounterRpc {
+  const stub = env.COUNTER_DO.get(env.COUNTER_DO.idFromName(COUNTER_INSTANCE_NAME));
+  return stub as unknown as CounterRpc;
+}
+
+// ---------------------------------------------------------------------------
+// admit
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — admit', () => {
+  it('admits when under the cap and reports the live count', async () => {
+    const c = counter();
+    expect(await c.admit('conn-a', 2, T0)).toEqual({ admitted: true, live: 1 });
+  });
+
+  it('admits a second connection while still under the cap', async () => {
+    const c = counter();
+    await c.admit('conn-b1', 2, T0);
+    expect(await c.admit('conn-b2', 2, T0)).toEqual({ admitted: true, live: 2 });
+  });
+
+  it('rejects once the cap is reached', async () => {
+    const c = counter();
+    await c.admit('conn-c1', 1, T0);
+    expect(await c.admit('conn-c2', 1, T0)).toEqual({ admitted: false, live: 1 });
+  });
+
+  it('a rejected admission registers no entry', async () => {
+    const c = counter();
+    await c.admit('conn-d1', 1, T0);
+    await c.admit('conn-d2', 1, T0);
+    expect(await c.liveCount()).toBe(1);
+  });
+
+  it('re-admits after the capped connection is released', async () => {
+    const c = counter();
+    await c.admit('conn-e1', 1, T0);
+    await c.release('conn-e1');
+    expect(await c.admit('conn-e2', 1, T0)).toEqual({ admitted: true, live: 1 });
+  });
+
+  it('exactly one of two concurrent admissions wins at cap 1', async () => {
+    // Two worker-edge fetches race on the single counter instance. The
+    // DO's serialized event loop linearises the admits; exactly one
+    // reservation survives. Mirrors the RegistryDO concurrency suite.
+    const c = counter();
+    const [r1, r2] = await Promise.all([c.admit('race-1', 1, T0), c.admit('race-2', 1, T0)]);
+    const results = [r1, r2];
+    expect(results.filter((r) => r.admitted).length).toBe(1);
+    expect(results.filter((r) => !r.admitted).length).toBe(1);
+    expect(await c.liveCount()).toBe(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// release
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — release', () => {
+  it('removes the entry so the slot frees', async () => {
+    const c = counter();
+    await c.admit('rel-a', 5, T0);
+    await c.release('rel-a');
+    expect(await c.liveCount()).toBe(0);
+  });
+
+  it('is idempotent for an unknown connection id', async () => {
+    const c = counter();
+    await c.release('never-registered');
+    expect(await c.liveCount()).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// TTL reap — housekeeping for DO instances that crashed without a close
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — TTL reap (housekeeping)', () => {
+  it('sweep reaps entries older than the TTL and keeps fresh ones', async () => {
+    const c = counter();
+    await c.admit('stale', 5, T0);
+    await c.admit('fresh', 5, T0 + 60_000);
+    const result = await c.sweep(T0 + TTL + 60_000);
+    expect(result.reaped).toBe(1);
+    expect(result.live).toBe(1);
+    expect(await c.liveCount()).toBe(1);
+  });
+
+  it('an entry aged exactly the TTL is still live (only strictly-older reaps)', async () => {
+    const c = counter();
+    await c.admit('boundary', 5, T0);
+    expect(await c.sweep(T0 + TTL)).toEqual({ reaped: 0, live: 1 });
+  });
+
+  it('admit lazily reaps stale entries first (a crashed DO frees its slot)', async () => {
+    // The production failure mode: a ConnectionDO isolate is dropped
+    // without ever delivering a close event, so `release` never fires and
+    // the entry goes stale. The next admission must sweep it out instead
+    // of rejecting the newcomer.
+    const c = counter();
+    await c.admit('crashed', 1, T0);
+    expect(await c.admit('newcomer', 1, T0 + TTL + 1)).toEqual({ admitted: true, live: 1 });
+    expect(await c.liveCount()).toBe(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// heartbeat — keeps live connections safe from the TTL reap
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — heartbeat', () => {
+  it('refreshes the entry so a live connection survives the TTL reap', async () => {
+    const c = counter();
+    await c.admit('beat', 5, T0);
+    // The ConnectionDO's PING alarm refreshes the entry well inside the
+    // TTL window; by T0+TTL+60s the lastSeen has moved past the original
+    // admission stamp, so the sweep at T0+TTL+60s+1ms must keep it.
+    await c.heartbeat('beat', T0 + TTL + 60_000);
+    expect(await c.sweep(T0 + TTL + 60_001)).toEqual({ reaped: 0, live: 1 });
+  });
+
+  it('does not resurrect a released entry', async () => {
+    // A late heartbeat (e.g. racing the close handler) must not re-create
+    // a slot that was already released — that would overcount.
+    const c = counter();
+    await c.admit('gone', 5, T0);
+    await c.release('gone');
+    await c.heartbeat('gone', T0 + 1000);
+    expect(await c.liveCount()).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// liveCount
+// ---------------------------------------------------------------------------
+
+describe('CounterDO — liveCount', () => {
+  it('reports zero for a fresh counter', async () => {
+    expect(await counter().liveCount()).toBe(0);
+  });
+});

package/packages/cf-adapter/tests/d1-services-store.test.ts

@@ -9,12 +9,17 @@
  */
 
 import { env } from 'cloudflare:test';
-import { FakeClock, type ServicesSnapshot } from '@serverless-ircd/irc-core';
+import {
+  FakeClock,
+  type ServicesSnapshot,
+  certIdentityFromSubject,
+} from '@serverless-ircd/irc-core';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import {
   CREATE_SERVICES_TABLES_SQL,
   D1ServicesStore,
   loadD1ServicesStore,
+  safeSelect,
 } from '../src/d1-services-store';
 
 declare global {
@@ -162,6 +167,119 @@ describe('D1ServicesStore — schema migration (password → algorithm/salt/hash
   });
 });
 
+describe('D1ServicesStore — schema migration (cert_subjects era → identify-throttle columns)', () => {
+  /** Pre-throttle schema: every current column except the two new ones. */
+  const CERT_ERA_NICKSERV_DDL =
+    "CREATE TABLE nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, cert_subjects TEXT NOT NULL DEFAULT '[]', algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)";
+
+  afterEach(async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+  });
+
+  it('adds the identify-throttle columns on load and keeps existing rows (defaults)', async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec(CERT_ERA_NICKSERV_DDL);
+    await env.ACCOUNTS_DB.prepare(
+      'INSERT INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+    )
+      .bind('alice', 'alice', 'alice', 'a@x', 1, 'none', '[]', 'scrypt', 'c2FsdA==', 'aGFzaA==')
+      .run();
+
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    expect(store).toBeDefined();
+
+    // The additive columns now exist.
+    const info = await env.ACCOUNTS_DB.prepare('PRAGMA table_info(nickserv_accounts)').all<{
+      name: string;
+    }>();
+    const cols = info.results.map((r) => r.name);
+    expect(cols).toContain('identify_failures');
+    expect(cols).toContain('pending_identify_notice');
+
+    // The pre-existing row survived and loads with empty throttle defaults.
+    expect(store?.isRegisteredNick('alice')).toBe(true);
+    expect(store?.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(store?.clearIdentifyFailures('alice')).toBe(0);
+  });
+
+  it('is idempotent — a second load does not re-add the columns or drop rows', async () => {
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec(CERT_ERA_NICKSERV_DDL);
+    const first = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    first?.registerNick('carol', 'pw', 'c@x');
+    await first?.flush();
+
+    const second = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW + 1));
+    expect(second?.isRegisteredNick('carol')).toBe(true);
+  });
+
+  it('adds the cert_subjects column too when migrating from the algorithm era', async () => {
+    // Schema after the credential unification but before cert_subjects:
+    // exercises the cert_subjects ALTER arm on its own.
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec(
+      'CREATE TABLE nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)',
+    );
+
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    const info = await env.ACCOUNTS_DB.prepare('PRAGMA table_info(nickserv_accounts)').all<{
+      name: string;
+    }>();
+    const cols = info.results.map((r) => r.name);
+    expect(cols).toContain('cert_subjects');
+    expect(cols).toContain('identify_failures');
+    expect(cols).toContain('pending_identify_notice');
+    expect(store).toBeDefined();
+  });
+
+  it('loads rows with malformed JSON columns as empty arrays (defensive)', async () => {
+    await resetDb();
+    const insert = async (
+      nick: string,
+      certSubjects: string,
+      identifyFailures: string,
+    ): Promise<void> => {
+      await env.ACCOUNTS_DB.prepare(
+        'INSERT INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, identify_failures, pending_identify_notice, algorithm, salt, hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+      )
+        .bind(
+          nick,
+          nick,
+          nick,
+          'x@x',
+          1,
+          'none',
+          certSubjects,
+          identifyFailures,
+          0,
+          'scrypt',
+          'c2FsdA==',
+          'aGFzaA==',
+        )
+        .run();
+    };
+    // Every degenerate column shape: malformed JSON, empty string,
+    // non-array JSON, and arrays with ill-typed entries.
+    await insert('a-malformed', 'not json', 'also not json');
+    await insert('b-empty', '', '');
+    await insert('c-nonarray', '{"a":1}', '{"a":1}');
+    await insert('d-illtyped', '["ok",7]', '[1,"x",2]');
+
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    for (const nick of ['a-malformed', 'b-empty', 'c-nonarray']) {
+      expect(store?.isRegisteredNick(nick)).toBe(true);
+      expect(store?.getNick(nick)?.certSubjects).toEqual([]);
+      expect(store?.isNickIdentifyFrozen(nick, { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    }
+    // Ill-typed entries are filtered; well-typed ones survive. The window
+    // reaches back to the epoch so the literal timestamps count.
+    expect(store?.getNick('d-illtyped')?.certSubjects).toEqual(['ok']);
+    expect(store?.isNickIdentifyFrozen('d-illtyped', { maxFailures: 2, windowMs: NOW + 1 })).toBe(
+      true,
+    );
+  });
+});
+
 describe('D1ServicesStore — NickServ round-trip across reload', () => {
   beforeEach(async () => {
     await resetDb();
@@ -194,6 +312,43 @@ describe('D1ServicesStore — NickServ round-trip across reload', () => {
     expect(reloaded?.getNickEnforce('alice')).toBe('kill');
   });
 
+  it('persists SET PASSWORD and round-trips the new credential', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.setNickPassword('alice', 'newpassword');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // The new password verifies against the reloaded store; the old one no longer does.
+    expect(reloaded?.verifyNick('alice', 'newpassword')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded?.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('persists the identify-failure throttle and round-trips the freeze', async () => {
+    const clock = new FakeClock(NOW);
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, clock);
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    clock.advance(10);
+    store?.recordIdentifyFailure('alice');
+    clock.advance(10);
+    store?.recordIdentifyFailure('alice');
+    await store?.flush();
+
+    // Simulate a fresh connection (fresh store) after a deploy: the reload
+    // still sees the recorded failures and the queued owner-notice count.
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW + 20));
+    expect(reloaded?.isNickIdentifyFrozen('alice', { maxFailures: 2, windowMs: 300_000 })).toBe(
+      true,
+    );
+    expect(reloaded?.clearIdentifyFailures('alice')).toBe(2);
+
+    // The cleared state round-trips too.
+    await reloaded?.flush();
+    const after = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW + 20));
+    expect(after?.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(after?.clearIdentifyFailures('alice')).toBe(0);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
     store?.registerNick('alice', 'pw', 'a@x');
@@ -206,6 +361,55 @@ describe('D1ServicesStore — NickServ round-trip across reload', () => {
     const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
     expect(reloaded?.isRegisteredNick('alice')).toBe(false);
   });
+
+  it('round-trips a bound cert fingerprint and verifies EXTERNAL after reload', async () => {
+    // A cert binding attached before a deploy must still authenticate a
+    // SASL EXTERNAL client after the store rehydrates from D1 — the
+    // production path for certificate-backed login.
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.addCertFingerprint('alice', 'AA112233445566778899AABBCCDDEEFF');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // The fingerprint is normalised (lowercase, colon-free) on the round-trip.
+    expect(reloaded?.getNick('alice')?.certSubjects).toEqual([
+      'fp:aa112233445566778899aabbccddeeff',
+    ]);
+    expect(
+      reloaded?.verifyCertFP(
+        certIdentityFromSubject('CN=alice', 'aa112233445566778899aabbccddeeff'),
+      ),
+    ).toEqual({ ok: true, account: 'alice' });
+  });
+
+  it('round-trips a bound subject DN and verifies EXTERNAL via the canonical DN arm', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.addCertFP('alice', 'CN=alice,O=Example Inc');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // Platform-surfaced DN in a different RDN order still matches (canonical compare).
+    expect(reloaded?.verifyCertFP(certIdentityFromSubject('O=Example Inc,CN=alice'))).toEqual({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('keeps EXTERNAL verify failing for an unbound cert after reload', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.addCertFingerprint('alice', 'aa112233445566778899aabbccddeeff');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    expect(
+      reloaded?.verifyCertFP(
+        certIdentityFromSubject('CN=alice', 'ffffffffffffffffffffffffffffffff'),
+      )?.ok,
+    ).toBe(false);
+  });
 });
 
 describe('D1ServicesStore — ChanServ round-trip across reload', () => {
@@ -524,14 +728,18 @@ describe('D1ServicesStore — tolerance', () => {
     expect(snap.jupes).toEqual([]);
   });
 
-  it('skips rows with NULL fields in the all-TEXT tables (vhosts / read_markers)', async () => {
-    // Recreate the two all-TEXT tables without NOT NULL so a NULL field can
+  it('skips rows with NULL fields in the all-TEXT tables (vhosts / pending_vhosts / read_markers)', async () => {
+    // Recreate the all-TEXT tables without NOT NULL so a NULL field can
     // survive — exercises the typeof-string defensive skip for the loaders
     // whose INTEGER-corruption path is unreachable under SQLite affinity.
     await env.ACCOUNTS_DB.exec('DROP TABLE hostserv_vhosts');
     await env.ACCOUNTS_DB.exec(
       'CREATE TABLE hostserv_vhosts (account_key TEXT PRIMARY KEY, account TEXT, vhost TEXT)',
     );
+    await env.ACCOUNTS_DB.exec('DROP TABLE hostserv_pending_vhosts');
+    await env.ACCOUNTS_DB.exec(
+      'CREATE TABLE hostserv_pending_vhosts (account_key TEXT PRIMARY KEY, account TEXT, vhost TEXT)',
+    );
     await env.ACCOUNTS_DB.exec('DROP TABLE read_markers');
     await env.ACCOUNTS_DB.exec(
       'CREATE TABLE read_markers (account_key TEXT NOT NULL, channel_key TEXT NOT NULL, account TEXT, channel TEXT, msgid TEXT)',
@@ -541,6 +749,11 @@ describe('D1ServicesStore — tolerance', () => {
     )
       .bind('bad#v', null, 'cloak')
       .run();
+    await env.ACCOUNTS_DB.prepare(
+      'INSERT INTO hostserv_pending_vhosts (account_key, account, vhost) VALUES (?, ?, ?)',
+    )
+      .bind('bad#pv', 'someone', null)
+      .run();
     await env.ACCOUNTS_DB.prepare(
       'INSERT INTO read_markers (account_key, channel_key, account, channel, msgid) VALUES (?, ?, ?, ?, ?)',
     )
@@ -552,6 +765,7 @@ describe('D1ServicesStore — tolerance', () => {
     if (!store) throw new Error('services store failed to load');
     const snap = store.snapshot();
     expect(snap.vhosts).toEqual([]);
+    expect(snap.pendingVhosts).toEqual([]);
     expect(snap.readMarkers).toEqual([]);
   });
 
@@ -566,6 +780,34 @@ describe('D1ServicesStore — tolerance', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// safeSelect — defensive catch block (real D1 bindings don't throw on
+// existing-table queries; the catch arm is unreachable through integration).
+// ---------------------------------------------------------------------------
+
+describe('safeSelect — defensive catch block', () => {
+  it('returns [] and logs when the underlying D1 query rejects', async () => {
+    // A misbehaving binding (transient unavailability, schema drift) would
+    // otherwise brick NickServ for the whole connection (the snapshot is
+    // cached for life). The catch arm logs to wrangler tail and degrades
+    // to an empty result.
+    const stub = {
+      prepare(): { all(): Promise<never> } {
+        return {
+          all: async () => {
+            throw new Error('simulated D1 outage');
+          },
+        };
+      },
+    };
+    const result = await safeSelect<{ x: unknown }>(
+      stub as unknown as Parameters<typeof safeSelect>[0],
+      'SELECT * FROM nicks',
+    );
+    expect(result).toEqual([]);
+  });
+});
+
 function emptySnapshot(): ServicesSnapshot {
   return {
     nicks: [],

package/packages/cf-adapter/tests/rate-limit-do.test.ts

@@ -0,0 +1,160 @@
+/**
+ * `RateLimitDO` — per-IP upgrade rate limiter.
+ *
+ * TDD outline:
+ *   "Red on allow-under-budget / reject-over-budget / window-decay;
+ *    green; then per-IP isolation and the concurrency linearisation."
+ *
+ * Tests address the single global limiter instance directly over RPC,
+ * driving every branch of `check` with explicit timestamps so the
+ * sliding-window boundary is deterministic (no wall clock dependence).
+ * Mirrors the CounterDO suite; each test gets isolated storage.
+ */
+
+import { env, reset } from 'cloudflare:test';
+import { afterEach, describe, expect, it } from 'vitest';
+import type { RateLimitRpc } from '../src/env';
+import { RATE_LIMIT_INSTANCE_NAME } from '../src/rate-limit-do';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      RATE_LIMIT_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+// DO storage persists across tests in the same file; reset between each so
+// rate entries from one test never leak into the next. Every test addresses
+// the same `global` limiter instance, so this is essential.
+afterEach(async () => {
+  await reset();
+});
+
+/** Fixed epoch base for deterministic window arithmetic. */
+const T0 = 1_700_000_000_000;
+/** Window used by every test (1 minute, the schema default order). */
+const WINDOW = 60_000;
+
+/** RPC handle on the single global limiter instance. */
+function limiter(): RateLimitRpc {
+  const stub = env.RATE_LIMIT_DO.get(env.RATE_LIMIT_DO.idFromName(RATE_LIMIT_INSTANCE_NAME));
+  return stub as unknown as RateLimitRpc;
+}
+
+// ---------------------------------------------------------------------------
+// check — allow / reject
+// ---------------------------------------------------------------------------
+
+describe('RateLimitDO — check', () => {
+  it('allows the first N upgrades from one IP and reports the count', async () => {
+    const rl = limiter();
+    expect(await rl.check('203.0.113.1', 2, WINDOW, T0)).toEqual({ allowed: true, count: 1 });
+    expect(await rl.check('203.0.113.1', 2, WINDOW, T0 + 1000)).toEqual({
+      allowed: true,
+      count: 2,
+    });
+  });
+
+  it('rejects the over-budget upgrade from the same IP', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.2', 1, WINDOW, T0);
+    expect(await rl.check('203.0.113.2', 1, WINDOW, T0 + 1000)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+  });
+
+  it('a rejected check does not append a timestamp (count stays at the cap)', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.3', 1, WINDOW, T0);
+    await rl.check('203.0.113.3', 1, WINDOW, T0 + 1000);
+    // Still rejected at the original count: the rejection itself must not
+    // consume budget (otherwise a blocked IP could never recover).
+    expect(await rl.check('203.0.113.3', 1, WINDOW, T0 + 2000)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+  });
+
+  it('keys budgets per IP (one saturated IP does not block another)', async () => {
+    const rl = limiter();
+    await rl.check('198.51.100.1', 1, WINDOW, T0);
+    expect(await rl.check('198.51.100.1', 1, WINDOW, T0 + 1000)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+    expect(await rl.check('198.51.100.2', 1, WINDOW, T0 + 1000)).toEqual({
+      allowed: true,
+      count: 1,
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// sliding window — decay after the window
+// ---------------------------------------------------------------------------
+
+describe('RateLimitDO — window reset', () => {
+  it('an entry aged past the window stops counting (budget recovers)', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.4', 1, WINDOW, T0);
+    // At T0 + WINDOW + 1 the T0 admission is strictly older than the
+    // cutoff (T0 + 1) → decayed out of the window.
+    expect(await rl.check('203.0.113.4', 1, WINDOW, T0 + WINDOW + 1)).toEqual({
+      allowed: true,
+      count: 1,
+    });
+  });
+
+  it('an entry exactly windowMs old still counts (boundary is inclusive)', async () => {
+    // Mirrors irc-core `recentAdmissions`: entries with t >= cutoff count,
+    // so an admission exactly one window old is still inside the window.
+    const rl = limiter();
+    await rl.check('203.0.113.5', 1, WINDOW, T0);
+    expect(await rl.check('203.0.113.5', 1, WINDOW, T0 + WINDOW)).toEqual({
+      allowed: false,
+      count: 1,
+    });
+  });
+
+  it('prunes stale entries so a saturated IP recovers exactly one slot per decayed entry', async () => {
+    const rl = limiter();
+    await rl.check('203.0.113.6', 2, WINDOW, T0);
+    await rl.check('203.0.113.6', 2, WINDOW, T0 + 30_000);
+    // Cutoff at T0+45_000 is T0-15_000 → both entries still count.
+    expect(await rl.check('203.0.113.6', 2, WINDOW, T0 + 45_000)).toEqual({
+      allowed: false,
+      count: 2,
+    });
+    // At T0+WINDOW+1 the cutoff is T0+1: the T0 entry decayed, the
+    // T0+30_000 entry remains → one slot free → allowed (and this check
+    // itself consumes it).
+    expect(await rl.check('203.0.113.6', 2, WINDOW, T0 + WINDOW + 1)).toEqual({
+      allowed: true,
+      count: 2,
+    });
+    // Window members are now {T0+30_000, T0+WINDOW+1} → exhausted again.
+    expect(await rl.check('203.0.113.6', 2, WINDOW, T0 + WINDOW + 2)).toEqual({
+      allowed: false,
+      count: 2,
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// concurrency — the DO's serialized event loop linearises checks
+// ---------------------------------------------------------------------------
+
+describe('RateLimitDO — concurrency', () => {
+  it('exactly one of two concurrent checks wins at budget 1', async () => {
+    const rl = limiter();
+    const [r1, r2] = await Promise.all([
+      rl.check('203.0.113.7', 1, WINDOW, T0),
+      rl.check('203.0.113.7', 1, WINDOW, T0),
+    ]);
+    const results = [r1, r2];
+    expect(results.filter((r) => r.allowed).length).toBe(1);
+    expect(results.filter((r) => !r.allowed).length).toBe(1);
+  });
+});

package/packages/cf-adapter/tests/serialize.test.ts

@@ -306,4 +306,29 @@ describe('deserialize — migrate integration', () => {
     expect(state.userModes.wallops).toBe(true);
     expect(state.caps).toEqual(new Set(['server-time']));
   });
+
+  it('coalesces an explicit `secure: null` to false via the ?? fallback', () => {
+    // `migrate` only backfills `secure` when the key is absent (=== undefined);
+    // an explicit null survives and the `?? false` arm in `deserialize` must
+    // catch it. Mirrors a hand-edited storage row where someone wrote null.
+    const rec = {
+      version: 1,
+      id: 'c',
+      registration: 'registered' as const,
+      capNegotiating: false,
+      secure: null,
+      caps: [],
+      joinedChannels: [],
+      userModes: {
+        invisible: false,
+        oper: false,
+        wallops: false,
+        serverNotices: false,
+        tls: false,
+      },
+      lastSeen: 0,
+      connectedSince: 0,
+    };
+    expect(deserialize(rec).secure).toBe(false);
+  });
 });