serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/commands/hostserv.test.ts

@@ -37,6 +37,7 @@ const queueServerConfig: ServerConfig = {
 const autoApproveServerConfig: ServerConfig = {
   ...serverConfig,
   hostservAutoApproveVhosts: true,
+  hostservAutoApproveAllowlist: ['cool.example.net', 'one.example.net', 'two.example.net'],
 };
 
 function makeConn(id = 'c1', nick = 'alice'): ConnectionState {
@@ -548,6 +549,321 @@ describe('hostservReducer — REQUEST (auto-approve knob explicitly on)', () =>
   });
 });
 
+// ============================================================================
+// REQUEST — auto-approve hardening (denylist + allowlist)
+// ============================================================================
+
+describe('hostservReducer — REQUEST (auto-approve denylist)', () => {
+  /**
+   * Auto-approve config whose allowlist deliberately contains every probed
+   * vhost: each test proves the built-in denylist is enforced regardless
+   * of (and ahead of) the allowlist.
+   */
+  const denyConfig: ServerConfig = {
+    ...serverConfig,
+    hostservAutoApproveVhosts: true,
+    hostservAutoApproveAllowlist: [
+      'admin.example.net',
+      'oper.example.net',
+      'staff.example.net',
+      'irc.example.net',
+      'www.example.net',
+      'root.example.net',
+      'security.example.net',
+      'user.admin.example.net',
+      'example.net.staff',
+      'ADMIN.example.net',
+      'hub.example.net',
+      'user.hub.example.net',
+      'clean.example.net',
+    ],
+  };
+
+  /** Same hardening config on a serverName free of reserved labels, so the
+   * own-hostname suffix check is probed in isolation. */
+  const suffixConfig: ServerConfig = { ...denyConfig, serverName: 'hub.example.net' };
+
+  it.each(['admin', 'oper', 'staff', 'irc', 'www', 'root', 'security'])(
+    'denies a vhost whose first label is the reserved label %s (even when allowlisted)',
+    (label) => {
+      const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+      const conn = identifiedConn('alice');
+      const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+      const out = hostservReducer(conn, privmsg(`REQUEST ${label}.example.net`), ctx);
+
+      expect(services.getVhost('alice')).toBeUndefined();
+      expect(sentTexts(out.effects)).toContain(
+        `:HostServ!HostServ@services NOTICE alice :Vhost ${label}.example.net is not permitted (reserved label or this server's hostname).`,
+      );
+    },
+  );
+
+  it('denies a vhost with a reserved label in a middle position', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST user.admin.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost user.admin.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it('denies a vhost with a reserved label in the last position', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST example.net.staff'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost example.net.staff is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it('matches reserved labels case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), denyConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST ADMIN.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost ADMIN.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it("denies the server's own hostname exactly (even when allowlisted)", () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), suffixConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST hub.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost hub.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it("denies a vhost ending with the server's own hostname", () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), suffixConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST user.hub.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ":HostServ!HostServ@services NOTICE alice :Vhost user.hub.example.net is not permitted (reserved label or this server's hostname).",
+    );
+  });
+
+  it("denies the server's own hostname case-insensitively", () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), {
+      ...suffixConfig,
+      serverName: 'HUB.example.net',
+    });
+
+    hostservReducer(conn, privmsg('REQUEST hub.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+  });
+});
+
+describe('hostservReducer — REQUEST (auto-approve allowlist)', () => {
+  const allowConfig: ServerConfig = {
+    ...serverConfig,
+    hostservAutoApproveVhosts: true,
+    hostservAutoApproveAllowlist: ['users.example.net', '*.vhosts.example.net'],
+  };
+
+  it('approves a vhost that exactly matches an allowlist entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST users.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('users.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost users.example.net has been requested and approved.',
+    );
+  });
+
+  it('matches an exact allowlist entry case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    hostservReducer(conn, privmsg('REQUEST USERS.Example.NET'), ctx);
+
+    expect(services.getVhost('alice')).toBe('USERS.Example.NET');
+  });
+
+  it('denies a vhost with no allowlist entry (nothing recorded)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST other.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(services.getPendingVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost other.example.net is not in the auto-approve allowlist.',
+    );
+  });
+
+  it('approves a vhost covered by a wildcard entry (*.suffix)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST a.vhosts.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('a.vhosts.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost a.vhosts.example.net has been requested and approved.',
+    );
+  });
+
+  it('approves a vhost at any depth beneath a wildcard entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    hostservReducer(conn, privmsg('REQUEST x.y.vhosts.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('x.y.vhosts.example.net');
+  });
+
+  it('matches a wildcard entry case-insensitively', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    hostservReducer(conn, privmsg('REQUEST A.VHOSTS.Example.NET'), ctx);
+
+    expect(services.getVhost('alice')).toBe('A.VHOSTS.Example.NET');
+  });
+
+  it('does NOT match the bare suffix of a wildcard entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), allowConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST vhosts.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost vhosts.example.net is not in the auto-approve allowlist.',
+    );
+  });
+
+  it('checks every allowlist entry until one matches', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const cfg: ServerConfig = {
+      ...serverConfig,
+      hostservAutoApproveVhosts: true,
+      hostservAutoApproveAllowlist: ['first.example.net', 'users.example.net'],
+    };
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), cfg);
+
+    hostservReducer(conn, privmsg('REQUEST users.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('users.example.net');
+  });
+
+  it('fails closed when the allowlist is missing entirely (inline literal)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    // A booted server can never reach this shape (config parsing refuses
+    // auto-approve without an allowlist); the reducer must still deny
+    // everything rather than approve everything.
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), {
+      ...serverConfig,
+      hostservAutoApproveVhosts: true,
+    });
+
+    const out = hostservReducer(conn, privmsg('REQUEST clean.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost clean.example.net is not in the auto-approve allowlist.',
+    );
+  });
+});
+
+describe('hostservReducer — hardening does not apply to oper review', () => {
+  it('queues a reserved-label vhost in queue mode (opers vet it)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), queueServerConfig);
+
+    const out = hostservReducer(conn, privmsg('REQUEST admin.example.net'), ctx);
+
+    expect(services.getPendingVhost('alice')).toBe('admin.example.net');
+    expect(services.getVhost('alice')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost admin.example.net is pending oper approval.',
+    );
+  });
+
+  it('queues a vhost outside the allowlist in queue mode', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = identifiedConn('alice');
+    const cfg: ServerConfig = {
+      ...queueServerConfig,
+      hostservAutoApproveAllowlist: ['users.example.net'],
+    };
+    const ctx = makeCtx(conn, services, new FakeClock(NOW), cfg);
+
+    const out = hostservReducer(conn, privmsg('REQUEST other.example.net'), ctx);
+
+    expect(services.getPendingVhost('alice')).toBe('other.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE alice :Vhost other.example.net is pending oper approval.',
+    );
+  });
+
+  it('lets an oper APPROVE a reserved-label vhost from the queue', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.requestVhost('alice', 'admin.example.net');
+    const conn = operConn('admin');
+    const ctx = makeCtx(conn, services);
+
+    const out = hostservReducer(conn, privmsg('APPROVE alice'), ctx);
+
+    expect(services.getVhost('alice')).toBe('admin.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE admin :Vhost admin.example.net for alice has been approved and activated.',
+    );
+  });
+
+  it('lets an oper SET a reserved-label vhost directly', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = operConn('admin');
+    const ctx = makeCtx(conn, services);
+
+    const out = hostservReducer(conn, privmsg('SET alice staff.example.net'), ctx);
+
+    expect(services.getVhost('alice')).toBe('staff.example.net');
+    expect(sentTexts(out.effects)).toContain(
+      ':HostServ!HostServ@services NOTICE admin :Vhost for alice is now set to staff.example.net.',
+    );
+  });
+});
+
 // ============================================================================
 // APPROVE / ACTIVATE (oper-only)
 // ============================================================================

package/packages/irc-core/tests/commands/join.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { handleJoinZero, isValidChannelName, joinReducer } from '../../src/commands/join';
+import { handleJoinZero, joinReducer } from '../../src/commands/join';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import {
@@ -12,6 +12,7 @@ import {
   type ServicesStore,
   type StoredMessage,
 } from '../../src/ports';
+import { isValidChannelName } from '../../src/protocol/channel-name';
 import { type ChannelState, createChannel } from '../../src/state/channel';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
@@ -107,6 +108,30 @@ describe('isValidChannelName', () => {
     expect(isValidChannelName('#foo:bar', 50)).toBe(false);
   });
 
+  it('rejects a name containing NUL', () => {
+    expect(isValidChannelName('#foo\0bar', 50)).toBe(false);
+  });
+
+  it('rejects a name containing a control character', () => {
+    expect(isValidChannelName('#foo\x01bar', 50)).toBe(false);
+  });
+
+  it('rejects a multi-byte name whose UTF-8 byte size exceeds the cap', () => {
+    expect(isValidChannelName(`#${'é'.repeat(25)}`, 50)).toBe(false); // 51 bytes, 26 UTF-16 units
+  });
+
+  it('accepts a multi-byte name at exactly the UTF-8 byte cap', () => {
+    expect(isValidChannelName(`#${'é'.repeat(24)}x`, 50)).toBe(true); // 1 + 48 + 1 = 50 bytes
+  });
+
+  it('continues to accept ! in a channel name', () => {
+    expect(isValidChannelName('#foo!bar', 50)).toBe(true);
+  });
+
+  it('continues to accept @ in a channel name', () => {
+    expect(isValidChannelName('#foo@bar', 50)).toBe(true);
+  });
+
   it('rejects a name exceeding the length cap', () => {
     expect(isValidChannelName(`#${'a'.repeat(50)}`, 50)).toBe(false);
   });
@@ -395,6 +420,58 @@ describe('joinReducer — rejections', () => {
     ]);
   });
 
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing NUL', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: ['#foo\0bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\0bar :No such channel')]),
+    ]);
+    expect(out.state.members.has('c1')).toBe(false);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing a control character', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: ['#foo\x01bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\x01bar :No such channel')]),
+    ]);
+    expect(out.state.members.has('c1')).toBe(false);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name whose UTF-8 byte size exceeds the cap', () => {
+    const long = `#${'é'.repeat(25)}`; // 51 UTF-8 bytes, only 26 UTF-16 units
+    const chan = makeChan(long);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: [long], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(`:irc.example.com 403 alice ${long} :No such channel`)]),
+    ]);
+    expect(out.state.members.has('c1')).toBe(false);
+  });
+
+  it('joins a multi-byte channel name at exactly the 50-byte cap', () => {
+    const name = `#${'é'.repeat(24)}x`; // 1 + 48 + 1 = 50 UTF-8 bytes
+    const chan = makeChan(name);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = joinReducer(chan, { command: 'JOIN', params: [name], tags: {} }, ctx);
+
+    expect(out.state.members.has('c1')).toBe(true);
+    expect(conn.joinedChannels.has(name.toLowerCase())).toBe(true);
+  });
+
   it('emits 405 ERR_TOOMANYCHANNELS when the connection is at the max-channels limit', () => {
     const chan = makeChan('#newchan');
     const conn = makeConn();

package/packages/irc-core/tests/commands/markread.test.ts

@@ -115,6 +115,24 @@ describe('markreadChannelReducer — cap gating', () => {
       Effect.send('c1', [L(':irc.example.com 421 alice MARKREAD :Unknown command')]),
     ]);
   });
+
+  it('substitutes * for the nick in the 421 numeric when the connection has no nick', () => {
+    const chan = makeChan();
+    // A bare connection: no nick set and no draft/read-marker cap negotiated.
+    // The 421 numeric's `ctx.connection.nick ?? '*'` falls back to `*`.
+    const conn = createConnection({ id: 'c1', connectedSince: 0 });
+    const ctx = makeCtx(conn);
+
+    const out = markreadChannelReducer(
+      chan,
+      { command: 'MARKREAD', params: ['#foo', ts(2_000)], tags: {} },
+      ctx,
+    );
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 421 * MARKREAD :Unknown command')]),
+    ]);
+  });
 });
 
 // ============================================================================
@@ -168,6 +186,42 @@ describe('markreadChannelReducer — parameter errors', () => {
       Effect.send('c1', [READ_MARKER_FAIL('INVALID_PARAMS', 'Invalid parameters')]),
     ]);
   });
+
+  it('FAILs with INVALID_PARAMS when the timestamp prefix is present but the value is empty', () => {
+    const chan = makeChan();
+    addMember(chan, 'c1', 'alice');
+    const store = new InMemoryMessageStore();
+    seed(store, '#foo', 3);
+    const ctx = makeCtx(makeConn(), new FakeClock(10_000), store);
+
+    const out = markreadChannelReducer(
+      chan,
+      { command: 'MARKREAD', params: ['#foo', 'timestamp='], tags: {} },
+      ctx,
+    );
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [READ_MARKER_FAIL('INVALID_PARAMS', 'Invalid parameters')]),
+    ]);
+  });
+
+  it('FAILs with INVALID_PARAMS when the timestamp value is not a parseable date', () => {
+    const chan = makeChan();
+    addMember(chan, 'c1', 'alice');
+    const store = new InMemoryMessageStore();
+    seed(store, '#foo', 3);
+    const ctx = makeCtx(makeConn(), new FakeClock(10_000), store);
+
+    const out = markreadChannelReducer(
+      chan,
+      { command: 'MARKREAD', params: ['#foo', 'timestamp=not-a-date'], tags: {} },
+      ctx,
+    );
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [READ_MARKER_FAIL('INVALID_PARAMS', 'Invalid parameters')]),
+    ]);
+  });
 });
 
 // ============================================================================

package/packages/irc-core/tests/commands/memoserv.test.ts

@@ -71,6 +71,25 @@ describe('memoservReducer — services availability', () => {
   });
 });
 
+describe('memoservReducer — empty body', () => {
+  it('replies with the help notice when the PRIVMSG carries no body parameter', () => {
+    const conn = makeConn();
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(conn, services);
+    // params: [MEMOSERV_NICK] only — params[1] is undefined, exercising the
+    // `msg.params[1] ?? ''` fallback. The empty body resolves to an empty
+    // subcommand, which emits the help notice.
+    const out = memoservReducer(
+      conn,
+      { command: 'PRIVMSG', params: [MEMOSERV_NICK], tags: {} },
+      ctx,
+    );
+    expect(sentTexts(out.effects)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :Available commands: SEND, LIST, READ, DEL',
+    );
+  });
+});
+
 describe('memoservReducer — SEND', () => {
   it('requires the sender to be identified', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });