serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/src/commands/nickserv.ts

@@ -26,10 +26,15 @@
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. The services store is synchronous (mirrors
- * the {@link AccountStore} / {@link MessageStore} pattern).
+ * the {@link MessageStore} pattern).
  */
 
-import { DEFAULT_NICK_ENFORCE_GRACE_MS } from '../config.js';
+import {
+  DEFAULT_IDENTIFY_FREEZE_SECONDS,
+  DEFAULT_MAX_IDENTIFY_FAILURES,
+  DEFAULT_MIN_PASSWORD_LENGTH,
+  DEFAULT_NICK_ENFORCE_GRACE_MS,
+} from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { NickEnforcePolicy, ServicesStore } from '../ports.js';
@@ -48,6 +53,41 @@ const SERVICES_HOST = 'services';
 /** Policies accepted by `SET ENFORCE` (lowercased input forms). */
 const ENFORCE_POLICIES: ReadonlySet<NickEnforcePolicy> = new Set(['none', 'ghost', 'kill']);
 
+/**
+ * Fixed maximum password length accepted by `SET PASSWORD`. Bounds the
+ * scrypt input budget (256 is the practical limit of the scrypt input);
+ * not configurable. Over-long passwords are rejected before hashing.
+ */
+const MAX_PASSWORD_LENGTH = 256;
+
+/**
+ * Gate NOTICE sent to an unidentified caller (or one identified as a
+ * different account) attempting `SET ENFORCE`. Wording kept verbatim from
+ * the original inline literal so the existing ENFORCE test suite is not
+ * churned by the addition of `SET PASSWORD` (a sibling constant covers the
+ * PASSWORD gate).
+ */
+const ENFORCE_GATE_NOTICE = 'You must identify before changing enforcement.';
+
+/**
+ * Gate NOTICE sent to an unidentified caller (or one identified as a
+ * different account) attempting `SET PASSWORD`. Wording mirrors the ENFORCE
+ * gate's intent but speaks to "password" rather than "enforcement" so a
+ * caller who hits it understands which subcommand they tripped.
+ */
+const PASSWORD_GATE_NOTICE = 'You must identify before changing your password.';
+
+/**
+ * Formats the owner NOTICE delivered on the first successful identify
+ * after failed identifies were recorded against the account. Delivered
+ * once (the queued count is cleared with the delivery), so the owner
+ * learns their account was targeted even though every attempt failed.
+ */
+function identifyFailureNoticeText(count: number): string {
+  const plural = count === 1 ? 'attempt' : 'attempts';
+  return `Warning: ${count} failed identify ${plural} recorded against your account since your last successful login.`;
+}
+
 /**
  * Reducer for `PRIVMSG NickServ :<subcommand> <args…>`.
  * Authority: the invoking connection's {@link ConnectionState}.
@@ -157,13 +197,36 @@ function handleIdentify(
     return { state, effects };
   }
 
+  // Per-account freeze: once maxIdentifyFailures failed attempts were
+  // recorded within the sliding freeze window, reject BEFORE running
+  // scrypt (the freeze is the cheap rejection path; verifyNick is the
+  // expensive one an attacker would otherwise keep hitting).
+  const maxFailures =
+    ctx.serverConfig.nickServ?.maxIdentifyFailures ?? DEFAULT_MAX_IDENTIFY_FAILURES;
+  const freezeWindowMs =
+    (ctx.serverConfig.nickServ?.identifyFreezeSeconds ?? DEFAULT_IDENTIFY_FREEZE_SECONDS) * 1000;
+  if (services.isNickIdentifyFrozen(nick, { maxFailures, windowMs: freezeWindowMs })) {
+    effects.push(
+      notice(state, `Nick ${nick} is temporarily frozen due to too many failed identify attempts.`),
+    );
+    return { state, effects };
+  }
+
   const result = services.verifyNick(nick, password);
   if (!result.ok) {
+    services.recordIdentifyFailure(nick);
     effects.push(notice(state, 'Invalid password.'));
     return { state, effects };
   }
 
+  // A successful login delivers the queued owner notice (if any failed
+  // identifies were recorded since the last successful login) and resets
+  // the per-account failure accounting.
+  const failedSinceLogin = services.clearIdentifyFailures(nick);
   applyIdentify(state, result.account, services, effects);
+  if (failedSinceLogin > 0) {
+    effects.push(notice(state, identifyFailureNoticeText(failedSinceLogin)));
+  }
   return { state, effects };
 }
 
@@ -318,12 +381,24 @@ export function enforceRegisteredNick(state: ConnectionState, ctx: Ctx): EffectT
 // ============================================================================
 
 /**
- * Handles `SET <subkey> <args…>`. Currently only `ENFORCE none|ghost|kill`
- * is supported; unknown subkeys fall back to the ENFORCE syntax notice.
+ * Handles `SET <subkey> <args…>`. Supported subkeys:
+ *
+ *   - `ENFORCE none|ghost|kill` — sets the per-account enforcement policy.
+ *   - `PASSWORD <old> <new>` — self-service password change. Requires the
+ *     current password to be re-supplied as a defence against a hijacked
+ *     identified session (a stolen `+r` session should not let an attacker
+ *     silently rotate the password and lock the real owner out — this is
+ *     Atheme's shape, not the alternative "trust the gate" one-arg form).
+ *     The new password is re-hashed via `hashAccountCredential` and
+ *     overwrites the stored credential via
+ *     {@link ServicesStore.setNickPassword}; the current session stays
+ *     `+r` and other sessions of the same account are NOT kicked.
  *
- * Requires the caller to be identified as the account bound to the current
- * nick: enforcement is a per-account policy, so an unidentified client
- * (or one identified as a different account) cannot mutate it.
+ * Unknown subkeys fall back to the ENFORCE syntax notice.
+ *
+ * Both subkeys require the caller to be identified as the account bound to
+ * the current nick: an unidentified client (or one identified as a
+ * different account) cannot mutate the account.
  */
 function handleSet(
   state: ConnectionState,
@@ -331,8 +406,10 @@ function handleSet(
   ctx: Ctx,
   effects: EffectType[],
 ): { state: ConnectionState; effects: EffectType[] } {
-  const services = ctx.services as ServicesStore;
   const subkey = args[0]?.toUpperCase();
+  if (subkey === 'PASSWORD') {
+    return handleSetPassword(state, args.slice(1), ctx, effects);
+  }
   if (subkey !== 'ENFORCE') {
     effects.push(enforceSyntaxNotice(state));
     return { state, effects };
@@ -347,10 +424,11 @@ function handleSet(
 
   const nick = state.nick;
   if (nick === undefined || state.account === undefined) {
-    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    effects.push(notice(state, ENFORCE_GATE_NOTICE));
     return { state, effects };
   }
 
+  const services = ctx.services as ServicesStore;
   const rec = services.getNick(nick);
   if (rec === undefined) {
     effects.push(notice(state, `Nick ${nick} is not registered.`));
@@ -358,7 +436,7 @@ function handleSet(
   }
   // The caller must be identified as the account that owns this nick.
   if (state.account !== rec.account) {
-    effects.push(notice(state, 'You must identify before changing enforcement.'));
+    effects.push(notice(state, ENFORCE_GATE_NOTICE));
     return { state, effects };
   }
 
@@ -367,11 +445,80 @@ function handleSet(
   return { state, effects };
 }
 
+/**
+ * Handles `SET PASSWORD <old> <new>`. Mirrors the `SET ENFORCE` identify
+ * gate (`state.account === rec.account`), then re-verifies the current
+ * password (no-leak parity with `IDENTIFY`'s `Invalid password.` notice)
+ * and enforces the configurable minimum / fixed maximum length on the new
+ * password before re-hashing and persisting.
+ */
+function handleSetPassword(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const oldPassword = args[0];
+  const newPassword = args[1];
+  if (oldPassword === undefined || newPassword === undefined) {
+    effects.push(passwordSyntaxNotice(state));
+    return { state, effects };
+  }
+
+  const nick = state.nick;
+  if (nick === undefined || state.account === undefined) {
+    effects.push(notice(state, PASSWORD_GATE_NOTICE));
+    return { state, effects };
+  }
+
+  const services = ctx.services as ServicesStore;
+  const rec = services.getNick(nick);
+  if (rec === undefined) {
+    effects.push(notice(state, `Nick ${nick} is not registered.`));
+    return { state, effects };
+  }
+  // The caller must be identified as the account that owns this nick.
+  if (state.account !== rec.account) {
+    effects.push(notice(state, PASSWORD_GATE_NOTICE));
+    return { state, effects };
+  }
+
+  // Re-verify the current password (defence against a hijacked `+r`
+  // session). Same `verifyNick` path `IDENTIFY` uses → same `Invalid
+  // password.` notice → no information leak about whether the account
+  // exists (the gate above already proved it does).
+  if (!services.verifyNick(nick, oldPassword).ok) {
+    effects.push(notice(state, 'Invalid password.'));
+    return { state, effects };
+  }
+
+  const minLen = ctx.serverConfig.nickServ?.minPasswordLength ?? DEFAULT_MIN_PASSWORD_LENGTH;
+  if (newPassword.length < minLen) {
+    effects.push(notice(state, `Password is too short (minimum ${minLen} characters).`));
+    return { state, effects };
+  }
+  if (newPassword.length > MAX_PASSWORD_LENGTH) {
+    effects.push(
+      notice(state, `Password is too long (maximum ${MAX_PASSWORD_LENGTH} characters).`),
+    );
+    return { state, effects };
+  }
+
+  services.setNickPassword(nick, newPassword);
+  effects.push(notice(state, 'Password changed.'));
+  return { state, effects };
+}
+
 /** Builds the `SET ENFORCE` syntax NOTICE. */
 function enforceSyntaxNotice(state: ConnectionState): EffectType {
   return notice(state, 'Syntax: SET ENFORCE none|ghost|kill');
 }
 
+/** Builds the `SET PASSWORD` syntax NOTICE. */
+function passwordSyntaxNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Syntax: SET PASSWORD <old-password> <new-password>');
+}
+
 // ============================================================================
 // Notice helpers
 // ============================================================================
@@ -387,7 +534,10 @@ function helpNotice(state: ConnectionState): EffectType {
 }
 
 function unknownNotice(state: ConnectionState): EffectType {
-  return notice(state, 'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET');
+  return notice(
+    state,
+    'Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET (ENFORCE, PASSWORD)',
+  );
 }
 
 /**