serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/certfp.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, it } from 'vitest';
+import {
+  CERT_FP_PREFIX,
+  canonicalizeCertSubject,
+  certFingerprintId,
+  certIdentityFromSubject,
+} from '../src/certfp';
+
+// ============================================================================
+// canonicalizeCertSubject — RFC 4514-style DN canonicalisation
+// ============================================================================
+
+describe('canonicalizeCertSubject', () => {
+  it('lowercases the attribute type but preserves the value case', () => {
+    expect(canonicalizeCertSubject('CN=Alice')).toBe('cn=Alice');
+  });
+
+  it('collapses repeated whitespace inside a value', () => {
+    expect(canonicalizeCertSubject('CN=alice   smith')).toBe('cn=alice smith');
+  });
+
+  it('trims whitespace around the type and value', () => {
+    expect(canonicalizeCertSubject('  CN  =  alice  ')).toBe('cn=alice');
+  });
+
+  it('sorts RDNs into a stable order regardless of input ordering', () => {
+    expect(canonicalizeCertSubject('O=Example Inc,CN=alice')).toBe('cn=alice,o=Example Inc');
+    expect(canonicalizeCertSubject('CN=alice,O=Example Inc')).toBe('cn=alice,o=Example Inc');
+  });
+
+  it('sorts AVAs inside a multi-valued RDN regardless of input ordering', () => {
+    expect(canonicalizeCertSubject('O=Example+CN=alice')).toBe('cn=alice+o=Example');
+    expect(canonicalizeCertSubject('CN=alice+O=Example')).toBe('cn=alice+o=Example');
+  });
+
+  it('collapses two semantically-equal DNs (spacing + ordering differ) to one form', () => {
+    const a = canonicalizeCertSubject('CN=alice ,  O = Example   Inc , C=US');
+    const b = canonicalizeCertSubject('C=US,O=Example Inc,CN=alice');
+    expect(a).toBe(b);
+  });
+
+  it('does not split on an escaped separator', () => {
+    expect(canonicalizeCertSubject('CN=a\\,b,O=x')).toBe('cn=a\\,b,o=x');
+  });
+
+  it('skips escaped characters when locating the type/value split', () => {
+    expect(canonicalizeCertSubject('CN\\=tag=y')).toBe('cn\\=tag=y');
+  });
+
+  it('does not trim an escaped trailing space from a value', () => {
+    expect(canonicalizeCertSubject('CN=alice\\ ')).toBe('cn=alice\\ ');
+  });
+
+  it('keeps an escape pair intact when a pending space precedes it', () => {
+    expect(canonicalizeCertSubject('CN=a  \\, b')).toBe('cn=a \\, b');
+  });
+
+  it('keeps a trailing dangling backslash verbatim', () => {
+    expect(canonicalizeCertSubject('CN=a\\')).toBe('cn=a\\');
+  });
+
+  it('keeps a malformed AVA without an equals sign as trimmed collapsed text', () => {
+    expect(canonicalizeCertSubject('  alice  smith ')).toBe('alice smith');
+  });
+
+  it('canonicalises an empty DN to the empty string', () => {
+    expect(canonicalizeCertSubject('')).toBe('');
+  });
+});
+
+// ============================================================================
+// certFingerprintId — normalised DER SHA-256 fingerprint binding id
+// ============================================================================
+
+describe('certFingerprintId', () => {
+  it('prefixes the fingerprint with the binding prefix', () => {
+    expect(certFingerprintId('af363dc8')).toBe(`${CERT_FP_PREFIX}af363dc8`);
+  });
+
+  it('lowercases an uppercase hex fingerprint', () => {
+    expect(certFingerprintId('AF363DC8')).toBe('fp:af363dc8');
+  });
+
+  it('strips openssl-style colon separators', () => {
+    expect(certFingerprintId('AF:36:3D:C8')).toBe('fp:af363dc8');
+  });
+
+  it('trims surrounding whitespace', () => {
+    expect(certFingerprintId('  af363dc8  ')).toBe('fp:af363dc8');
+  });
+});
+
+// ============================================================================
+// certIdentityFromSubject — CertIdentity construction
+// ============================================================================
+
+describe('certIdentityFromSubject', () => {
+  it('builds an identity with the canonical DN and no fingerprint key', () => {
+    expect(certIdentityFromSubject('CN=alice')).toEqual({
+      subject: 'CN=alice',
+      canonicalDn: 'cn=alice',
+    });
+  });
+
+  it('includes the fingerprint when the platform supplied one', () => {
+    expect(certIdentityFromSubject('CN=alice', 'af363dc8')).toEqual({
+      subject: 'CN=alice',
+      canonicalDn: 'cn=alice',
+      fingerprint: 'af363dc8',
+    });
+  });
+
+  it('carries the canonical DN of a multi-RDN subject', () => {
+    const id = certIdentityFromSubject('O=Example,CN=alice');
+    expect(id.canonicalDn).toBe('cn=alice,o=Example');
+  });
+});

package/packages/irc-core/tests/commands/cap.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { getLsString } from '../../src/caps/capabilities';
+import { certIdentityFromSubject } from '../../src/certfp';
 import { capReducer } from '../../src/commands/cap';
 import { userReducer } from '../../src/commands/registration';
 import { Effect } from '../../src/effects';
@@ -131,8 +132,12 @@ describe('capReducer — LS', () => {
 
   it('advertises sasl=PLAIN,EXTERNAL when an mTLS provider is configured', () => {
     const state = makeState();
-    const provider: MtlsIdentityProvider = { getIdentity: () => 'CN=alice' };
-    const ctx = makeCtx(state, serverConfig, provider);
+    state.secure = true;
+    const provider: MtlsIdentityProvider = {
+      getIdentity: () => certIdentityFromSubject('CN=alice'),
+    };
+    const cfg: ServerConfig = { ...serverConfig, sasl: { externalEnabled: true } };
+    const ctx = makeCtx(state, cfg, provider);
     const out = capReducer(state, { command: 'CAP', params: ['LS'], tags: {} }, ctx);
     const send = out.effects[0];
     expect(send).toBeDefined();
@@ -142,6 +147,75 @@ describe('capReducer — LS', () => {
     }
   });
 
+  it('advertises sasl=PLAIN when EXTERNAL is not opted in, even with mTLS on a secure connection', () => {
+    // The operator opt-in gate: without sasl.externalEnabled the mechanism
+    // is not advertised, so clients never attempt an exchange the server
+    // would refuse with 908.
+    const state = makeState();
+    state.secure = true;
+    const provider: MtlsIdentityProvider = {
+      getIdentity: () => certIdentityFromSubject('CN=alice'),
+    };
+    const ctx = makeCtx(state, serverConfig, provider);
+    const out = capReducer(state, { command: 'CAP', params: ['LS'], tags: {} }, ctx);
+    const send = out.effects[0];
+    expect(send).toBeDefined();
+    if (send?.tag === 'Send') {
+      const body = send.lines[0]?.text ?? '';
+      expect(body).toContain('sasl=PLAIN');
+      expect(body).not.toContain('sasl=PLAIN,EXTERNAL');
+    }
+  });
+
+  it('advertises sasl=PLAIN on an insecure connection even when EXTERNAL is opted in', () => {
+    // SASL EXTERNAL is certificate-backed authentication: the client-cert
+    // identity only carries meaning over a transport the server trusts
+    // (TLS). A plaintext connection never sees the mechanism.
+    const state = makeState();
+    state.secure = false;
+    const provider: MtlsIdentityProvider = {
+      getIdentity: () => certIdentityFromSubject('CN=alice'),
+    };
+    const cfg: ServerConfig = { ...serverConfig, sasl: { externalEnabled: true } };
+    const ctx = makeCtx(state, cfg, provider);
+    const out = capReducer(state, { command: 'CAP', params: ['LS'], tags: {} }, ctx);
+    const send = out.effects[0];
+    expect(send).toBeDefined();
+    if (send?.tag === 'Send') {
+      const body = send.lines[0]?.text ?? '';
+      expect(body).toContain('sasl=PLAIN');
+      expect(body).not.toContain('sasl=PLAIN,EXTERNAL');
+    }
+  });
+
+  it('advertises sasl=PLAIN when the transport-level EXTERNAL override is set, even with mTLS + opt-in on a secure connection', () => {
+    // A transport that cannot surface a client-cert identity (the
+    // Spectrum TCP container origin) pins the mechanism off via
+    // sasl.externalUnsupportedMessage: the cap must never advertise a
+    // mechanism AUTHENTICATE would refuse with a transport-specific 904.
+    const state = makeState();
+    state.secure = true;
+    const provider: MtlsIdentityProvider = {
+      getIdentity: () => certIdentityFromSubject('CN=alice'),
+    };
+    const cfg: ServerConfig = {
+      ...serverConfig,
+      sasl: {
+        externalEnabled: true,
+        externalUnsupportedMessage: 'SASL EXTERNAL not supported on this transport',
+      },
+    };
+    const ctx = makeCtx(state, cfg, provider);
+    const out = capReducer(state, { command: 'CAP', params: ['LS'], tags: {} }, ctx);
+    const send = out.effects[0];
+    expect(send).toBeDefined();
+    if (send?.tag === 'Send') {
+      const body = send.lines[0]?.text ?? '';
+      expect(body).toContain('sasl=PLAIN');
+      expect(body).not.toContain('sasl=PLAIN,EXTERNAL');
+    }
+  });
+
   it('advertises draft/multiline=4096 with the default byte budget', () => {
     const state = makeState();
     const ctx = makeCtx(state);

package/packages/irc-core/tests/commands/chanserv.test.ts

@@ -2,9 +2,11 @@ import { describe, expect, it } from 'vitest';
 import {
   CHANSERV_NICK,
   DEFAULT_CHANNEL_LEVELS,
+  FOUNDER_RANK,
   SHORTHAND_LEVELS,
   chanservReducer,
   positiveMlockLetters,
+  rankOf,
   resolveMembershipTarget,
 } from '../../src/commands/chanserv';
 import { Effect } from '../../src/effects';
@@ -1670,6 +1672,29 @@ describe('SHORTHAND_LEVELS / DEFAULT_CHANNEL_LEVELS constants', () => {
   });
 });
 
+describe('rankOf / FOUNDER_RANK', () => {
+  it('maps positive access levels to themselves', () => {
+    expect(rankOf(SHORTHAND_LEVELS.VOP)).toBe(SHORTHAND_LEVELS.VOP);
+    expect(rankOf(SHORTHAND_LEVELS.SOP)).toBe(SHORTHAND_LEVELS.SOP);
+    expect(rankOf(7)).toBe(7);
+  });
+
+  it('clamps zero and negative levels to the minimum rank', () => {
+    expect(rankOf(0)).toBe(0);
+    expect(rankOf(-3)).toBe(0);
+  });
+
+  it('passes the founder rank through unchanged', () => {
+    expect(rankOf(FOUNDER_RANK)).toBe(Number.POSITIVE_INFINITY);
+  });
+
+  it('FOUNDER_RANK outranks every shorthand access level', () => {
+    for (const level of Object.values(SHORTHAND_LEVELS)) {
+      expect(FOUNDER_RANK).toBeGreaterThan(level);
+    }
+  });
+});
+
 // ============================================================================
 // OP / DEOP / VOICE / DEVOICE
 // ============================================================================
@@ -1895,6 +1920,109 @@ describe('chanservReducer — DEOP', () => {
       ':ChanServ!ChanServ@services NOTICE mallory :Permission denied.',
     );
   });
+
+  it('rejects DEOP of the channel founder by an AUTOOP-level access entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :You do not have sufficient privileges on #home to affect alice.',
+    );
+  });
+
+  it('allows peer-level DEOP between AUTOOP-level access entries', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerNick('dave', 'pw', 'd@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    services.setChannelAccess('#home', 'dave', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home dave'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Set mode -o on dave on #home.',
+    );
+  });
+
+  it('rejects DEOP of a higher-ranked access entry by a lower-ranked caller', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerNick('dave', 'pw', 'd@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    services.setChannelAccess('#home', 'dave', SHORTHAND_LEVELS.SOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home dave'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :You do not have sufficient privileges on #home to affect dave.',
+    );
+  });
+
+  it('allows an SOP-level entry to DEOP an AOP-level target', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerNick('dave', 'pw', 'd@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', SHORTHAND_LEVELS.SOP);
+    services.setChannelAccess('#home', 'dave', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home dave'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Set mode -o on dave on #home.',
+    );
+  });
+
+  it('allows the founder to DEOP themselves', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DEOP #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Set mode -o on alice on #home.',
+    );
+  });
 });
 
 describe('chanservReducer — VOICE', () => {
@@ -2076,6 +2204,44 @@ describe('chanservReducer — KICK', () => {
       ':ChanServ!ChanServ@services NOTICE alice :Syntax: KICK <#channel> <nick> [:<reason>].',
     );
   });
+
+  it('rejects KICK of the channel founder by an AUTOOP-level caller', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('carol', 'pw', 'c@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'carol', DEFAULT_CHANNEL_LEVELS.AUTOOP);
+    const conn = makeConn('c1', 'carol');
+    conn.account = 'carol';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeUndefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE carol :Permission denied.',
+    );
+  });
+
+  it('allows the founder to KICK themselves (self-target through the rank guard)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('KICK #home alice'), ctx);
+
+    expect(firstBroadcast(out.effects)).toBeDefined();
+    expect(firstApplyChannelDelta(out.effects)).toBeDefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Kicked alice from #home.',
+    );
+  });
 });
 
 // ============================================================================

package/packages/irc-core/tests/commands/chathistory.test.ts

@@ -1013,6 +1013,146 @@ describe('chathistoryReducer — TAGMSG replay', () => {
   });
 });
 
+// ============================================================================
+// Limit ceiling (L9)
+//
+// The client-supplied limit is capped at a deployment-configurable ceiling
+// (ServerConfig.chathistory.maxLimit, default 100) so an oversized request
+// like `CHATHISTORY LATEST #chan 999999999` cannot ask a future higher-
+// capacity store to materialize a huge result set. The cap is silent: the
+// client simply receives at most the ceiling worth of replay lines.
+// ============================================================================
+
+describe('chathistoryReducer — limit ceiling', () => {
+  /** Number of replay lines inside the emitted BATCH frame (0 when elided). */
+  function replayCount(effects: EffectType[]): number {
+    if (effects.length === 0) return 0;
+    const send = effects[0] as { lines: RawLine[] };
+    return send.lines.length - 2; // minus BATCH start + BATCH end
+  }
+
+  /** Ctx over a store that retains more than the default ceiling. */
+  function makeCappedCtx(conn: ConnectionState, store: MessageStore, config: ServerConfig): Ctx {
+    return buildCtx({
+      serverConfig: config,
+      clock: new FakeClock(10_000),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      messages: store,
+      connection: conn,
+    });
+  }
+
+  it('caps an oversized limit at the default ceiling of 100', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, serverConfig);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '999999999'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(100);
+  });
+
+  it('honors a limit at exactly the ceiling (100 passes through uncapped)', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, serverConfig);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '100'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(100);
+  });
+
+  it('passes a below-ceiling limit through unchanged', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, serverConfig);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '5'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(5);
+  });
+
+  it('caps at a configured lower ceiling via serverConfig.chathistory.maxLimit', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, {
+      ...serverConfig,
+      chathistory: { maxLimit: 3 },
+    });
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '999999999'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(3);
+  });
+
+  it('caps the default (omitted) limit at a configured lower ceiling', () => {
+    const store = new InMemoryMessageStore(1000);
+    seed(store, '#foo', 150);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCappedCtx(conn, store, {
+      ...serverConfig,
+      chathistory: { maxLimit: 3 },
+    });
+
+    const out = chathistoryReducer(
+      chan,
+      // No limit param — the default 50 must still respect the ceiling of 3.
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*'], tags: {} },
+      ctx,
+    );
+
+    expect(replayCount(out.effects)).toBe(3);
+  });
+
+  it('returns 461 for a negative limit', () => {
+    const store = new InMemoryMessageStore();
+    seed(store, '#foo', 3);
+    const conn = makeConn();
+    const chan = makeChan();
+    chan.members.set('c1', { conn: 'c1', nick: 'alice', op: false, voice: false });
+    const ctx = makeCtx(conn, store);
+
+    const out = chathistoryReducer(
+      chan,
+      { command: 'CHATHISTORY', params: ['LATEST', '#foo', '*', '-5'], tags: {} },
+      ctx,
+    );
+
+    expect((out.effects[0] as { lines: RawLine[] }).lines[0]?.text).toContain('461');
+  });
+});
+
 // ============================================================================
 // No MessageStore bound (deployment disabled chathistory persistence)
 // ============================================================================