serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/src/commands/registration.ts

@@ -17,6 +17,7 @@ import { cloakHost } from '../cloak.js';
 import { formatCreatedAt, resolveServerVersion } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { constantTimeEquals } from '../ports.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChanName } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
@@ -28,6 +29,31 @@ import { buildMotdNumerics } from './motd-lines.js';
 import { enforceRegisteredNick } from './nickserv.js';
 import { checkAkillAdmission, enforceJupedNick } from './operserv.js';
 
+/**
+ * Indirection over {@link constantTimeEquals} so tests can swap in a
+ * call-counting stub and prove the server-password gate funnels every
+ * comparison bucket (equal / unequal / different length) through exactly
+ * one constant-time comparison. Defaults to the real primitive; `null`
+ * restores the default.
+ */
+let constantTimeEqualsFn: (a: string, b: string) => boolean = constantTimeEquals;
+
+/**
+ * Test seam: replaces the server-password comparison primitive with `fn`
+ * (or restores the default when `fn === null`). Exported for tests;
+ * production callers MUST NOT use.
+ *
+ * @internal
+ */
+export function setServerPasswordCompare(fn: ((a: string, b: string) => boolean) | null): void {
+  constantTimeEqualsFn = fn ?? constantTimeEquals;
+}
+
+/** @internal test seam: clears any spy registered above. */
+export function resetServerPasswordCompareSpy(): void {
+  constantTimeEqualsFn = constantTimeEquals;
+}
+
 /** User mode letters for `004 RPL_MYINFO` (invisible, oper, wallops, server-notices). */
 const USER_MODES_004 = 'iosw';
 
@@ -50,6 +76,79 @@ export function isValidNick(nick: string, maxLen: number): boolean {
   return NICK_GRAMMAR_RE.test(nick);
 }
 
+// ============================================================================
+// USER username/realname validation (charset + length + control chars)
+// ----------------------------------------------------------------------------
+
+/**
+ * Maximum username (ident) length in bytes. Matches the de-facto IRC standard
+ * `USERLEN=16` advertised in `005 RPL_ISUPPORT` by mainstream daemons.
+ */
+const USERLEN = 16;
+
+/**
+ * Maximum realname (GECOS) length in bytes. Matches the common ircd-seven
+ * GECOS ceiling; enforced as a byte cap so multi-byte UTF-8 realnames are
+ * measured correctly.
+ */
+const REALLEN = 64;
+
+/**
+ * C0 control chars + NUL (\x00-\x1f). Covers `\0`, `\r`, `\n`, and the rest
+ * of the ASCII control block. These MUST NOT appear in either the username
+ * or the realname: a bare `\r` in the realname survives the line parser
+ * (which strips only trailing CR/LF) and produces CRLF injection; NUL bytes
+ * truncate display; other control chars corrupt terminal rendering.
+ */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: intentional — this regex exists to detect C0 control chars (NUL/CR/LF/etc.) in USER params.
+const CONTROL_CHAR_RE = /[\x00-\x1f]/u;
+
+/**
+ * Username-specific forbidden chars: space, `!`, and `@`. These corrupt
+ * hostmask parsing (`nick!user@host`) — a username containing `!` or `@`
+ * makes the hostmask ambiguous, and a space breaks param delimiting on
+ * re-serialization. Not applied to realname (spaces are valid there).
+ */
+const USERNAME_FORBIDDEN_RE = /[ !@]/u;
+
+/** Canonical disconnect reason applied on USER validation failure. */
+const USER_INVALID_REASON = 'invalid USER';
+
+/** Tailored NOTICE text emitted before disconnect on an invalid username. */
+const USERNAME_INVALID_TEXT =
+  'Invalid USER: username must be 1-16 bytes with no spaces, !, @, or control characters';
+
+/** Tailored NOTICE text emitted before disconnect on an invalid realname. */
+const REALNAME_INVALID_TEXT =
+  'Invalid USER: realname must be at most 64 bytes with no control characters';
+
+/** Reused encoder for UTF-8 byte-length measurement (stateless, safe to share). */
+const utf8Encoder = new TextEncoder();
+
+/**
+ * Returns true iff `value` is a safe username: at most {@link USERLEN} UTF-8
+ * bytes, no hostmask-corrupting chars (`!`/`@`/space), and no C0 control
+ * chars.
+ */
+function isValidUsername(value: string): boolean {
+  if (utf8Encoder.encode(value).length > USERLEN) return false;
+  if (USERNAME_FORBIDDEN_RE.test(value)) return false;
+  if (CONTROL_CHAR_RE.test(value)) return false;
+  return true;
+}
+
+/**
+ * Returns true iff `value` is a safe realname: at most {@link REALLEN} UTF-8
+ * bytes and no C0 control chars. Spaces ARE allowed (real names contain
+ * spaces); hostmask chars (`!`/`@`) are also allowed since the realname
+ * never appears in a hostmask.
+ */
+function isValidRealname(value: string): boolean {
+  if (utf8Encoder.encode(value).length > REALLEN) return false;
+  if (CONTROL_CHAR_RE.test(value)) return false;
+  return true;
+}
+
 /**
  * Builds the welcome numeric block emitted once registration completes:
  * `001`–`005` (with `005` generated from the server config) followed by
@@ -100,7 +199,9 @@ export function buildWelcomeLines(state: ConnectionState, ctx: Ctx): RawLine[] {
  * `serverConfig.serverPassword`) before completing registration:
  *   - No password configured (undefined or empty) → gate skipped.
  *   - SASL already authenticated (`state.account` set) → gate satisfied.
- *   - Otherwise `state.passAttempt` must equal the configured password.
+ *   - Otherwise `state.passAttempt` must equal the configured password,
+ *     compared in constant time ({@link constantTimeEquals}) so response
+ *     timing leaks neither the password length nor a matching prefix.
  *
  * On gate failure the connection is NOT registered; the returned effects
  * are `[Send(464 ERR_PASSWDMISMATCH), Disconnect("Bad Password")]` per
@@ -119,7 +220,7 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
   // the account-login numerics (900/903 + downstream effects), satisfying
   // the gate as a side effect. On every other outcome it returns `[]` and
   // the gate below decides. No-op when already identified (SASL), when no
-  // `<nick>:<password>` form is present, or when no AccountStore is bound.
+  // `<nick>:<password>` form is present, or when no ServicesStore is bound.
   const authEffects = passBasedAccountAuth(state, ctx);
 
   const gateFailure = passwordGateFailure(state, ctx);
@@ -187,7 +288,11 @@ function passwordGateFailure(state: ConnectionState, ctx: Ctx): EffectType[] | n
   if (configured === undefined || configured === '') return null;
   // SASL success satisfies the password gate.
   if (state.account !== undefined) return null;
-  if (state.passAttempt === configured) return null;
+  // Constant-time compare: a short-circuiting `===` would leak how much of
+  // the attempt matched (and the attempt length) through response timing.
+  // A missing attempt folds to the empty string — never equal, because a
+  // non-empty `configured` is guaranteed by the disabled-gate check above.
+  if (constantTimeEqualsFn(state.passAttempt ?? '', configured)) return null;
   return [
     Effect.send(ctx.connId, [numericErr(ctx, Numerics.ERR_PASSWDMISMATCH, 'Password mismatch')]),
     Effect.disconnect(ctx.connId, PASSWORD_MISMATCH_REASON),
@@ -212,6 +317,16 @@ function numericErr(ctx: Ctx, code: number, trailing: string, middle?: string):
   return { text: parts.join(' ') };
 }
 
+/**
+ * Formats a `:<server> NOTICE <nick> :<text>` line addressed to the
+ * connection's current nick (or `*` when unregistered). Used for USER
+ * validation rejections where no RFC numeric fits the failure mode.
+ */
+function serverNotice(ctx: Ctx, text: string): RawLine {
+  const nick = ctx.connection.nick ?? '*';
+  return { text: `:${ctx.serverName} NOTICE ${nick} :${text}` };
+}
+
 /**
  * Reducer for `NICK <nickname>`.
  *
@@ -330,6 +445,35 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
     return { state, effects };
   }
 
+  // Validate username and realname BEFORE storing to avoid half-stored
+  // state on rejection. The username (params[0]) flows into every outbound
+  // hostmask (`nick!user@host`); a `!`/`@`/space in it corrupts hostmask
+  // parsing. The realname (params[3]) appears in `311 RPL_WHOISUSER` and,
+  // if it carries a bare `\r`, produces CRLF injection (the line parser
+  // strips only trailing CR/LF). Both fields are byte-capped to keep
+  // 001/311/005 replies within the 512-byte wire budget.
+  //
+  // Reply format: a tailored server NOTICE followed by Disconnect.
+  // No RFC numeric fits "invalid USER charset" — 461 ERR_NEEDMOREPARAMS is
+  // for missing params, and 432 ERR_ERRONEUSNICKNAME is nick-specific. The
+  // NOTICE + Disconnect mirrors the AKILL admission hook's pattern and
+  // matches mainstream IRC daemon behaviour for registration security
+  // failures. The adapter renders the reason as `ERROR :Closing link: …`.
+  if (!isValidUsername(user)) {
+    effects.push(
+      Effect.send(ctx.connId, [serverNotice(ctx, USERNAME_INVALID_TEXT)]),
+      Effect.disconnect(ctx.connId, USER_INVALID_REASON),
+    );
+    return { state, effects };
+  }
+  if (!isValidRealname(realname)) {
+    effects.push(
+      Effect.send(ctx.connId, [serverNotice(ctx, REALNAME_INVALID_TEXT)]),
+      Effect.disconnect(ctx.connId, USER_INVALID_REASON),
+    );
+    return { state, effects };
+  }
+
   state.user = user;
   state.realname = realname;
   if (state.registration === 'pre-registration') {
@@ -351,7 +495,7 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
  *
  * Post-registration: a bare server password is meaningless, so only the
  * `<nick>:<password>` form is honoured — as a late account login via
- * {@link attemptPassAccountAuth} against the bound `ctx.accounts`. Every
+ * {@link attemptPassAccountAuth} against the bound `ctx.services`. Every
  * other outcome (bare value, no store, already identified, verify failure)
  * is a silent no-op: no `462`, no disconnect. This lets a client that
  * completed `NICK`+`USER` before sending `PASS` identify after the fact.

package/packages/irc-core/src/commands/sasl.ts

@@ -6,30 +6,47 @@
  *
  *   1. `AUTHENTICATE <MECH>` — selects a mechanism. `PLAIN` is always
  *      supported and answers with `AUTHENTICATE +` (requesting the payload).
- *      `EXTERNAL` is supported only when an mTLS identity provider is
- *      configured for the connection; without one, EXTERNAL falls through
- *      to `908 ERR_SASLMECHS` (mechanism not available) listing what is.
+ *      `EXTERNAL` is supported only when ALL of no transport-level
+ *      non-support override (`sasl.externalUnsupportedMessage`), an mTLS
+ *      identity source, the `sasl.externalEnabled` operator opt-in, and a
+ *      secure (TLS) transport are in place; under the override the
+ *      mechanism is rejected up front with a `904 ERR_SASLFAIL` carrying
+ *      the configured transport-specific message, without it and without
+ *      any one of the other three, EXTERNAL falls through to
+ *      `908 ERR_SASLMECHS` (mechanism not available) listing what is.
  *      The verified client-cert subject is resolved at finalise time.
  *      Anything else gets `908 ERR_SASLMECHS` listing what is available.
  *   2. `AUTHENTICATE <b64>` / `AUTHENTICATE +` — delivers the payload (whole
  *      or in `<=400`-byte chunks; `+` marks an empty/final chunk). The
- *      decoded bytes are handed to the injected {@link AccountStore}; on
- *      success the connection records the account name and the reducer emits
- *      `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure `904 ERR_SASLFAIL`.
+ *      decoded bytes are verified against the bound {@link ServicesStore};
+ *      on success the connection records the account name and the reducer
+ *      emits `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, on failure
+ *      `904 ERR_SASLFAIL`. PLAIN consults `services.verifyNick`, EXTERNAL
+ *      consults `services.verifyCertFP` with the mTLS-resolved cert
+ *      identity (DER SHA-256 fingerprint preferred, canonical DN
+ *      fallback).
  *   3. `AUTHENTICATE *` — client abort → `906 ERR_SASLABORT`.
  *
- * The `AccountStore` port is **synchronous** (see {@link AccountStore} docs):
+ * The {@link ServicesStore} port is **synchronous** (reducers stay pure):
  * adapters pre-load credentials so the reducer stays pure. Async backends
  * resolve their lookups before the actor invokes this reducer.
  *
+ * Brute-force hardening: every `904 ERR_SASLFAIL` records a timestamp on
+ * the per-connection tracker ({@link ConnectionState.saslFailures}); once
+ * the configured `sasl.maxFailures` ceiling is reached inside the
+ * configured `sasl.failureWindowSeconds` sliding window, the connection is
+ * disconnected (904 first, then the Disconnect). A successful login resets
+ * the tracker.
+ *
  * State: {@link ConnectionState.saslMech} tracks the mechanism in flight;
  * {@link ConnectionState.saslBuffer} accumulates chunked payloads. Both are
  * cleared on every terminal outcome.
  */
 
+import { DEFAULT_SASL_FAILURE_WINDOW_SECONDS, DEFAULT_SASL_MAX_FAILURES } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
-import type { SaslResult } from '../ports.js';
+import type { ServicesAuthResult } from '../ports.js';
 import { decodeBase64 } from '../protocol/base64.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ConnectionState } from '../state/connection.js';
@@ -42,16 +59,51 @@ const SASL_CHUNK_BYTES = 400;
 /** Total decoded-payload cap before `905 ERR_SASLTOOLONG`. */
 const SASL_MAX_BYTES = 8192;
 
+/**
+ * Disconnect reason stamped once the per-connection SASL failure lockout
+ * trips. The adapter renders it as `ERROR :Closing link: (reason)` — the
+ * same tailoring convention as the registration `invalid USER` path.
+ */
+const SASL_LOCKOUT_REASON = 'too many failed SASL attempts';
+
 /**
  * Mechanisms advertised in `908 ERR_SASLMECHS` and the `sasl` cap value,
- * derived from whether mTLS is configured for this connection.
+ * derived from whether SASL EXTERNAL is available for this connection.
  *
- * PLAIN is always available; EXTERNAL only when an `MtlsIdentityProvider`
- * is bound. Operators enable EXTERNAL by configuring mTLS at the edge
- * — no code change required.
+ * PLAIN is always available. EXTERNAL requires ALL of:
+ *   1. no transport-level non-support override
+ *      (`sasl.externalUnsupportedMessage` unset — the seam a transport
+ *      without any mTLS identity source uses to pin the mechanism off),
+ *   2. an mTLS identity source bound for the connection (edge mTLS
+ *      configured — CF API Shield / AWS APIGW client certs),
+ *   3. the operator opt-in (`sasl.externalEnabled`, surfaced by the
+ *      adapters as `EXTERNAL_ENABLED`; default off),
+ *   4. a secure (TLS) transport — the client-cert identity only carries
+ *      meaning over a connection the server trusts.
+ *
+ * Without any one of these the mechanism is neither advertised nor
+ * accepted: clients see `908 ERR_SASLMECHS` listing `PLAIN` only —
+ * except under the override, which rejects `AUTHENTICATE EXTERNAL`
+ * outright with the configured `904 ERR_SASLFAIL` message.
  */
 function supportedMechs(ctx: Ctx): string {
-  return ctx.mtlsIdentity !== undefined ? 'PLAIN,EXTERNAL' : 'PLAIN';
+  return externalAvailable(ctx) ? 'PLAIN,EXTERNAL' : 'PLAIN';
+}
+
+/**
+ * Whether SASL EXTERNAL may run on this connection: no transport-level
+ * non-support override AND mTLS identity source bound AND the operator
+ * opted in AND the transport is secure. The `sasl` cap value (see
+ * `capabilities.ts`) applies the same gate so advertisement and
+ * enforcement cannot drift apart.
+ */
+function externalAvailable(ctx: Ctx): boolean {
+  return (
+    ctx.serverConfig.sasl?.externalUnsupportedMessage === undefined &&
+    ctx.mtlsIdentity !== undefined &&
+    (ctx.serverConfig.sasl?.externalEnabled ?? false) &&
+    ctx.connection.secure
+  );
 }
 
 /**
@@ -106,7 +158,20 @@ function handleMechanism(
     return { state, effects: [Effect.send(ctx.connId, [L('AUTHENTICATE +')])] };
   }
   if (mech === 'EXTERNAL') {
-    if (ctx.mtlsIdentity === undefined) {
+    // Transport-level non-support override first: a transport that
+    // cannot surface a client-cert identity rejects up front with the
+    // configured stable `904` message — never the generic `908` — even
+    // when every three-way-gate input is bound. A protocol-level
+    // capability refusal, not a credential attempt: it does not count
+    // toward the failure lockout.
+    const unsupportedMessage = ctx.serverConfig.sasl?.externalUnsupportedMessage;
+    if (unsupportedMessage !== undefined) {
+      return {
+        state,
+        effects: [Effect.send(ctx.connId, [saslExternalUnsupported(ctx, unsupportedMessage)])],
+      };
+    }
+    if (!externalAvailable(ctx)) {
       return { state, effects: [Effect.send(ctx.connId, [saslMechs(ctx)])] };
     }
     state.saslMech = 'EXTERNAL';
@@ -143,7 +208,7 @@ function handlePayload(
   return finalize(state, next, mech, ctx);
 }
 
-/** Decodes the accumulated payload and runs it through the AccountStore. */
+/** Decodes the accumulated payload and verifies it against the ServicesStore. */
 function finalize(
   state: ConnectionState,
   payloadB64: string,
@@ -166,35 +231,23 @@ function finalizePlain(
 
   if (parsed === null) {
     clearSasl(state);
-    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
-  }
-
-  // Prefer the static AccountStore; fall back to the ServicesStore so a
-  // nick registered via NickServ can authenticate via SASL PLAIN without a
-  // separate static credential table. When neither verifies, fail.
-  const store = ctx.accounts;
-  let result = store?.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: parsed.username,
-    password: parsed.password,
-  });
-
-  if (result === undefined || !result.ok) {
-    const servicesResult = ctx.services?.verifyNick(parsed.username, parsed.password);
-    if (servicesResult?.ok) {
-      result = servicesResult;
-    }
+    return { state, effects: saslFailEffects(state, ctx) };
   }
 
-  if (result === undefined) {
+  // Single credential home: services.verifyNick covers every NickServ
+  // registration, every SASL_ACCOUNTS-seeded account (carried into
+  // services via the boot ingest), and every PASS-auth share. No separate
+  // static credential fallback — there is no second credential table.
+  const services = ctx.services;
+  if (services === undefined) {
     clearSasl(state);
-    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+    return { state, effects: saslFailEffects(state, ctx) };
   }
-
+  const result = services.verifyNick(parsed.username, parsed.password);
   return applyResult(state, result, ctx);
 }
 
-/** SASL EXTERNAL: resolve the mTLS cert subject and verify it. */
+/** SASL EXTERNAL: resolve the mTLS cert identity and verify it. */
 function finalizeExternal(
   state: ConnectionState,
   ctx: Ctx,
@@ -204,32 +257,78 @@ function finalizeExternal(
 
   if (identity === undefined) {
     clearSasl(state);
-    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+    return { state, effects: saslFailEffects(state, ctx) };
   }
 
-  const store = ctx.accounts;
-  if (store === undefined) {
+  // Cert identities (fingerprint-preferred, canonical-DN fallback) are
+  // mapped to accounts via services.verifyCertFP — the same single
+  // credential home as SASL PLAIN / PASS-auth. No separate services
+  // lookup.
+  const services = ctx.services;
+  if (services === undefined) {
     clearSasl(state);
-    return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+    return { state, effects: saslFailEffects(state, ctx) };
   }
-
-  const result = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity });
-
+  const result = services.verifyCertFP(identity);
   return applyResult(state, result, ctx);
 }
 
 /** Shared success/failure handling after a `verify` call. */
 function applyResult(
   state: ConnectionState,
-  result: SaslResult,
+  result: ServicesAuthResult,
   ctx: Ctx,
 ): { state: ConnectionState; effects: EffectType[] } {
   clearSasl(state);
 
   if (result.ok) {
+    // A successful login forgives this connection's prior SASL failures:
+    // the holder of the credential is legitimate. (Further AUTHENTICATE
+    // frames are rejected with 907 anyway, but the tracker is cleared so
+    // persisted/live state never carries a stale count.)
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+    delete state.saslFailures;
     return { state, effects: applyAccountSuccess(state, ctx, result.account) };
   }
-  return { state, effects: [Effect.send(ctx.connId, [saslFail(ctx)])] };
+  return { state, effects: saslFailEffects(state, ctx) };
+}
+
+/**
+ * Records one failed SASL attempt on the per-connection tracker and builds
+ * the failure effects: the `904 ERR_SASLFAIL` always, followed by a
+ * `Disconnect` once the configured threshold is crossed inside the
+ * configured sliding window (the 904 is delivered first so the client sees
+ * why it is being closed).
+ *
+ * What counts as a failed attempt: every outcome that emits 904 — a wrong
+ * password / unknown user (PLAIN verify), an unverified cert subject or
+ * missing client cert (EXTERNAL verify), an undecodable base64 payload,
+ * and a finalize with no ServicesStore bound. Protocol-level rejections
+ * that are not credential attempts do NOT count (`905 ERR_SASLTOOLONG`,
+ * `908 ERR_SASLMECHS`), and a client abort (`AUTHENTICATE *`) neither
+ * counts nor resets the tracker — an attacker must not launder failures
+ * away with an abort between guesses.
+ *
+ * Sliding window: timestamps older than the window (measured via the
+ * injected `Clock`, never wall time) are pruned before the new failure is
+ * appended, so only failures inside the window are compared against
+ * `sasl.maxFailures`.
+ */
+function saslFailEffects(state: ConnectionState, ctx: Ctx): EffectType[] {
+  const maxFailures = ctx.serverConfig.sasl?.maxFailures ?? DEFAULT_SASL_MAX_FAILURES;
+  const windowMs =
+    (ctx.serverConfig.sasl?.failureWindowSeconds ?? DEFAULT_SASL_FAILURE_WINDOW_SECONDS) * 1_000;
+  const now = ctx.clock.now();
+  const failures = (state.saslFailures ?? []).filter((t) => t > now - windowMs);
+  failures.push(now);
+  state.saslFailures = failures;
+  if (failures.length >= maxFailures) {
+    return [
+      Effect.send(ctx.connId, [saslFail(ctx)]),
+      Effect.disconnect(ctx.connId, SASL_LOCKOUT_REASON),
+    ];
+  }
+  return [Effect.send(ctx.connId, [saslFail(ctx)])];
 }
 
 /**
@@ -263,6 +362,15 @@ function saslFail(ctx: Ctx): RawLine {
   );
 }
 
+/**
+ * Transport-level EXTERNAL non-support refusal: the configured message
+ * verbatim (`sasl.externalUnsupportedMessage`), formatted like every
+ * other `904` so clients render it as a terminal SASL failure.
+ */
+function saslExternalUnsupported(ctx: Ctx, message: string): RawLine {
+  return L(`:${ctx.serverName} ${code(Numerics.ERR_SASLFAIL)} ${nickOf(ctx)} :${message}`);
+}
+
 function saslTooLong(ctx: Ctx): RawLine {
   return L(
     `:${ctx.serverName} ${code(Numerics.ERR_SASLTOOLONG)} ${nickOf(ctx)} :SASL message too long`,

package/packages/irc-core/src/commands/topic.ts

@@ -13,28 +13,23 @@
  *   - Sets `state.topic` (clearing it for an empty trailing param).
  *   - Honors `+t` (topic lock): only ops may change the topic; non-op
  *     members get `482 ERR_CHANOPRIVSNEEDED`.
- *   - Truncates the topic to `serverConfig.topicLen` to keep wire lines
- *     within the 512-byte budget.
+ *   - Truncates the topic to `serverConfig.topicLen` UTF-8 bytes (the
+ *     byte ceiling advertised as `TOPICLEN`) to keep wire lines within
+ *     the 512-byte budget.
  *   - Broadcasts `:hostmask TOPIC <chan> :<topic>` to the channel.
  */
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { PersistedTopic } from '../ports.js';
+import { byteLength, truncateToByteBudget } from '../protocol/bytes.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState, ChannelTopic } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** Formats a numeric error/reply line addressed to the connection's nick. */
 function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
   const nick = ctx.connection.nick ?? '*';
@@ -107,9 +102,12 @@ export const topicReducer: Reducer<ChannelState> = (state, msg, ctx) => {
     return { state, effects };
   }
 
+  // TOPICLEN is a UTF-8 byte ceiling (as advertised via ISUPPORT): measure
+  // bytes, not UTF-16 code units, and shrink to a complete-char boundary so
+  // a CJK/emoji topic is never split mid-character.
   const truncated =
-    newTopic.length > ctx.serverConfig.topicLen
-      ? newTopic.slice(0, ctx.serverConfig.topicLen)
+    byteLength(newTopic) > ctx.serverConfig.topicLen
+      ? truncateToByteBudget(newTopic, ctx.serverConfig.topicLen)
       : newTopic;
 
   // Empty topic clears; non-empty sets.

package/packages/irc-core/src/commands/who.ts

@@ -33,19 +33,12 @@
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState, RosterEntry } from '../state/channel.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx } from '../types.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** Formats a numeric error/reply line addressed to the connection's nick. */
 function numericLine(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
   const nick = ctx.connection.nick ?? '*';