serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/commands/names.test.ts

@@ -3,6 +3,7 @@ import { namesReducer } from '../../src/commands/names';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
+import { byteLength } from '../../src/protocol/bytes';
 import { type ChannelState, createChannel } from '../../src/state/channel';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
@@ -238,6 +239,43 @@ describe('namesReducer — rejections', () => {
     ]);
   });
 
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing NUL', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo\0bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\0bar :No such channel')]),
+    ]);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing a control character', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo\x1fbar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\x1fbar :No such channel')]),
+    ]);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name whose UTF-8 byte size exceeds the cap', () => {
+    const long = `#${'é'.repeat(25)}`; // 51 UTF-8 bytes, only 26 UTF-16 units
+    const chan = makeChan(long);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: [long], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(`:irc.example.com 403 alice ${long} :No such channel`)]),
+    ]);
+  });
+
   it('emits 403 ERR_NOSUCHCHANNEL for an empty channel name', () => {
     const chan = makeChan('#foo');
     const conn = makeConn();
@@ -340,3 +378,158 @@ describe('namesReducer — rejections', () => {
     ]);
   });
 });
+
+// ============================================================================
+// namesReducer — long NAMES list splitting (RFC 2812 §3.2.5)
+// ============================================================================
+
+/** RFC 1459 §2.3: 512-byte line budget minus the trailing CRLF pair. */
+const MAX_TEXT_BYTES = 510;
+
+describe('namesReducer — long NAMES list splitting', () => {
+  /** Returns the Send effect's lines, or [] when the first effect is not a Send. */
+  function sentLines(out: { effects: EffectType[] }): RawLine[] {
+    const send = out.effects[0];
+    return send?.tag === 'Send' ? send.lines : [];
+  }
+
+  /** Returns the trailing parameter of a formatted numeric line (after the last ` :`). */
+  function trailingOf(text: string): string {
+    const idx = text.lastIndexOf(' :');
+    return idx === -1 ? '' : text.slice(idx + 2);
+  }
+
+  /** Returns only the 353 RPL_NAMREPLY lines, in order. */
+  function namReplyLines(lines: RawLine[]): RawLine[] {
+    return lines.filter((l) => l.text.includes(' 353 '));
+  }
+
+  function pad(i: number): string {
+    return i.toString().padStart(3, '0');
+  }
+
+  it('splits a 100-member roster across multiple complete 353 lines within the byte budget', () => {
+    const chan = makeChan('#foo');
+    const expected: string[] = [];
+    for (let i = 1; i <= 100; i++) {
+      const nick = `user${pad(i)}`;
+      addMember(chan, `c${i}`, nick);
+      expected.push(nick);
+    }
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    const replies = namReplyLines(lines);
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    // No mid-nick truncation: the roster survives intact, in order, across lines.
+    expect(replies.map((l) => trailingOf(l.text)).join(' ')).toBe(expected.join(' '));
+    // Exactly one 366 terminator, emitted after the final 353.
+    const endLines = lines.filter((l) => l.text.includes(' 366 '));
+    expect(endLines.length).toBe(1);
+    expect(lines[lines.length - 1]?.text).toBe(
+      ':irc.example.com 366 alice #foo :End of /NAMES list.',
+    );
+  });
+
+  it('counts @/+ prefix bytes in the budget: no non-final 353 could have taken the next member', () => {
+    const chan = makeChan('#foo');
+    const expected: string[] = [];
+    for (let i = 1; i <= 100; i++) {
+      const nick = `user${pad(i)}`;
+      // Alternating op (`@userNNN`, 8 bytes) and op+voice (`@+userNNN`, 9 bytes).
+      addMember(chan, `c${i}`, nick, true, i % 2 === 0);
+      expected.push(i % 2 === 0 ? `@+${nick}` : `@${nick}`);
+    }
+    const conn = makeConn();
+    conn.caps.add('multi-prefix');
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    const replies = namReplyLines(lines);
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    // Roster intact with prefixes.
+    expect(replies.map((l) => trailingOf(l.text)).join(' ')).toBe(expected.join(' '));
+    // Greedy maximality: appending the next line's first (prefixed) member to
+    // any non-final line would blow the budget — proof the prefix bytes were
+    // counted, not just the bare nicks.
+    for (let i = 0; i + 1 < replies.length; i++) {
+      const cur = replies[i]?.text ?? '';
+      const nextFirst = trailingOf(replies[i + 1]?.text ?? '').split(' ')[0] ?? '';
+      expect(nextFirst.length).toBeGreaterThan(0);
+      expect(byteLength(`${cur} ${nextFirst}`)).toBeGreaterThan(MAX_TEXT_BYTES);
+    }
+  });
+
+  it('measures the budget in UTF-8 bytes: multi-byte nicks split even when UTF-16 units fit', () => {
+    const chan = makeChan('#foo');
+    const nick = 'é'.repeat(60); // 60 UTF-16 units but 120 UTF-8 bytes per nick
+    for (let i = 1; i <= 7; i++) {
+      addMember(chan, `c${i}`, nick);
+    }
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    const replies = namReplyLines(lines);
+    // Names alone: 7*120 + 6 = 846 bytes (but only 426 UTF-16 units) — a
+    // code-unit-based packer would emit one 881-byte line.
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    expect(replies.map((l) => trailingOf(l.text)).join(' ')).toBe(
+      Array<string>(7).fill(nick).join(' '),
+    );
+  });
+
+  it('emits exactly one 353 with an empty trailing + the 366 for a zero-member channel', () => {
+    const chan = makeChan('#foo'); // roster is completely empty
+    const conn = makeConn(); // requester is not a member either
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    expect(sentLines(out)).toEqual<RawLine[]>([
+      L(':irc.example.com 353 alice = #foo :'),
+      L(':irc.example.com 366 alice #foo :End of /NAMES list.'),
+    ]);
+  });
+
+  it('wraps every split 353 line plus the 366 inside one BATCH frame when batch is negotiated', () => {
+    const chan = makeChan('#foo');
+    for (let i = 1; i <= 100; i++) {
+      addMember(chan, `c${i}`, `user${pad(i)}`);
+    }
+    const conn = makeConn();
+    conn.caps.add('batch');
+    const ctx = makeCtx(conn);
+
+    const out = namesReducer(chan, { command: 'NAMES', params: ['#foo'], tags: {} }, ctx);
+
+    const lines = sentLines(out);
+    expect(lines[0]?.text).toBe('BATCH +batch-0 names');
+    expect(lines[lines.length - 1]?.text).toBe('BATCH -batch-0');
+    const inner = lines.slice(1, -1);
+    const replies = namReplyLines(inner);
+    expect(replies.length).toBeGreaterThan(1);
+    for (const line of replies) {
+      expect(byteLength(line.text)).toBeLessThanOrEqual(MAX_TEXT_BYTES);
+    }
+    expect(inner[inner.length - 1]?.text).toBe(
+      ':irc.example.com 366 alice #foo :End of /NAMES list.',
+    );
+  });
+});

package/packages/irc-core/tests/commands/nickserv.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest';
 import { NICKSERV_NICK, enforceRegisteredNick, nickservReducer } from '../../src/commands/nickserv';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType } from '../../src/effects';
-import type { ServicesStore } from '../../src/ports';
+import type { ServicesAuthResult, ServicesStore } from '../../src/ports';
 import {
   EmptyMotdProvider,
   FakeClock,
@@ -41,9 +41,10 @@ function makeCtx(
   state: ConnectionState,
   services?: ServicesStore,
   clock = new FakeClock(NOW),
+  configOverrides: Partial<ServerConfig> = {},
 ): Ctx {
   return buildCtx({
-    serverConfig,
+    serverConfig: { ...serverConfig, ...configOverrides },
     clock,
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
@@ -283,6 +284,185 @@ describe('nickservReducer — IDENTIFY', () => {
   });
 });
 
+/**
+ * InMemoryServicesStore subclass that counts `verifyNick` calls so the
+ * identify-freeze tests can assert the frozen attempt is rejected BEFORE
+ * scrypt runs (the freeze must short-circuit the verification path).
+ */
+class VerifyCountingStore extends InMemoryServicesStore {
+  verifyCalls = 0;
+  override verifyNick(nick: string, password: string): ServicesAuthResult {
+    this.verifyCalls++;
+    return super.verifyNick(nick, password);
+  }
+}
+
+describe('nickservReducer — IDENTIFY freeze (per-account throttle)', () => {
+  it('short-circuits the 6th failed IDENTIFY with a freeze notice (no scrypt)', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(services.verifyCalls).toBe(5);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+  });
+
+  it('lifts the freeze once the failures age out of the 300s window', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    // Exactly at the window boundary the failures have aged out.
+    clock.advance(300_000);
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(services.verifyCalls).toBe(6);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+  });
+
+  it('keeps the freeze while the failures are still inside the window', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    clock.advance(300_000 - 1);
+    const out = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+
+    expect(services.verifyCalls).toBe(5);
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+  });
+
+  it('delivers a queued owner NOTICE on the next successful identify after the freeze', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 5; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    clock.advance(300_000);
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Warning: 5 failed identify attempts recorded against your account since your last successful login.',
+    );
+
+    // The notice is delivered once — a second successful identify (fresh
+    // connection) does not repeat it.
+    const conn2 = makeConn('c2', 'alice');
+    const ctx2 = makeCtx(conn2, services, clock);
+    const out2 = nickservReducer(conn2, privmsg('IDENTIFY hunter2'), ctx2);
+    expect(sentTexts(out2.effects).some((t) => t.includes('Warning:'))).toBe(false);
+  });
+
+  it('delivers the owner NOTICE with singular wording for a single failed identify', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Warning: 1 failed identify attempt recorded against your account since your last successful login.',
+    );
+  });
+
+  it('resets the failure counter on a successful identify', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock);
+
+    for (let i = 0; i < 3; i++) {
+      nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    }
+    nickservReducer(conn, privmsg('IDENTIFY hunter2'), ctx);
+
+    // Fresh connection (the first is now identified). Without a reset the
+    // counter would still hold 3 failures and the account would freeze
+    // after only 2 more; with the reset all 5 new attempts must reach
+    // scrypt and return the plain invalid-password notice.
+    const conn2 = makeConn('c2', 'alice');
+    const ctx2 = makeCtx(conn2, services, clock);
+    for (let i = 0; i < 5; i++) {
+      const out = nickservReducer(conn2, privmsg('IDENTIFY wrongpass'), ctx2);
+      expect(sentTexts(out.effects)).toContain(
+        ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+      );
+    }
+    expect(services.verifyCalls).toBe(3 + 1 + 5);
+
+    // The 6th new failure crosses the (reset) threshold → frozen.
+    const frozen = nickservReducer(conn2, privmsg('IDENTIFY wrongpass'), ctx2);
+    expect(services.verifyCalls).toBe(9);
+    expect(sentTexts(frozen.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+  });
+
+  it('honours nickServ.maxIdentifyFailures and identifyFreezeSeconds overrides', () => {
+    const clock = new FakeClock(NOW);
+    const services = new VerifyCountingStore({ clock });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services, clock, {
+      nickServ: { maxIdentifyFailures: 2, identifyFreezeSeconds: 60 },
+    });
+
+    nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    const second = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    expect(services.verifyCalls).toBe(2);
+    expect(sentTexts(second.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+
+    // Threshold 2 reached → the next attempt is frozen without scrypt.
+    const frozen = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    expect(services.verifyCalls).toBe(2);
+    expect(sentTexts(frozen.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is temporarily frozen due to too many failed identify attempts.',
+    );
+
+    // The configured 60s window ages the failures out sooner than default.
+    clock.advance(60_000);
+    const after = nickservReducer(conn, privmsg('IDENTIFY wrongpass'), ctx);
+    expect(services.verifyCalls).toBe(3);
+    expect(sentTexts(after.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+  });
+});
+
 describe('nickservReducer — ID (alias for IDENTIFY)', () => {
   it('sets +r and account on correct password (ID <password>)', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
@@ -622,7 +802,7 @@ describe('nickservReducer — misc', () => {
     const out = nickservReducer(conn, privmsg('FROBNICATE foo bar'), ctx);
 
     expect(sentTexts(out.effects)).toContain(
-      ':NickServ!NickServ@services NOTICE alice :Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET',
+      ':NickServ!NickServ@services NOTICE alice :Unknown command. Available: REGISTER, IDENTIFY, DROP, INFO, SET (ENFORCE, PASSWORD)',
     );
   });
 
@@ -857,6 +1037,242 @@ describe('nickservReducer — SET ENFORCE', () => {
   });
 });
 
+// ============================================================================
+// SET PASSWORD
+// ============================================================================
+
+describe('nickservReducer — SET PASSWORD', () => {
+  it('changes the password when the caller supplies the correct old one', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+    // The new password verifies, the old one no longer does.
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(true);
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('rejects a wrong old password and leaves the credential unchanged', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD wrongold newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Invalid password.',
+    );
+    // The original password still verifies; the new one does not.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(false);
+  });
+
+  it('requires identification before SET PASSWORD (unidentified caller)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    // No account / +r.
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before changing your password.',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(false);
+  });
+
+  it('rejects SET PASSWORD when identified as a different account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    // bob is identified, but is using alice's nick.
+    services.registerNick('bob', 'bobpw', 'bob@example.com');
+    const conn = makeConn('c1', 'alice');
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You must identify before changing your password.',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'newpassword').ok).toBe(false);
+  });
+
+  it('emits the syntax notice when args are missing', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const noArgs = nickservReducer(conn, privmsg('SET PASSWORD'), ctx);
+    expect(sentTexts(noArgs.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET PASSWORD <old-password> <new-password>',
+    );
+
+    const oneArg = nickservReducer(conn, privmsg('SET PASSWORD only-one'), ctx);
+    expect(sentTexts(oneArg.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Syntax: SET PASSWORD <old-password> <new-password>',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+  });
+
+  it('rejects a new password shorter than the default minimum (8)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 short'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password is too short (minimum 8 characters).',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+    expect(services.verifyNick('alice', 'short').ok).toBe(false);
+  });
+
+  it('honours a configured nickServ.minPasswordLength override', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx: Ctx = buildCtx({
+      serverConfig: { ...serverConfig, nickServ: { minPasswordLength: 12 } },
+      clock: new FakeClock(NOW),
+      ids: new SequentialIdFactory(),
+      motd: EmptyMotdProvider,
+      connection: conn,
+      services,
+    });
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 elevenchars'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password is too short (minimum 12 characters).',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+  });
+
+  it('rejects a new password longer than the maximum (256)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const tooLong = 'x'.repeat(257);
+    const out = nickservReducer(conn, privmsg(`SET PASSWORD hunter2 ${tooLong}`), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password is too long (maximum 256 characters).',
+    );
+    // Credential unchanged.
+    expect(services.verifyNick('alice', 'hunter2').ok).toBe(true);
+  });
+
+  it('keeps the session +r after a successful change (no re-identify required)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(conn.userModes.registered).toBe(true);
+    expect(conn.account).toBe('alice');
+  });
+
+  it('accepts a new password exactly at the minimum length boundary (8)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 exactly8'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+    expect(services.verifyNick('alice', 'exactly8').ok).toBe(true);
+  });
+
+  it('accepts a new password exactly at the maximum length boundary (256)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const boundary = 'x'.repeat(256);
+    const out = nickservReducer(conn, privmsg(`SET PASSWORD hunter2 ${boundary}`), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+    expect(services.verifyNick('alice', boundary).ok).toBe(true);
+  });
+
+  it('is case-insensitive on the PASSWORD subkey', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('set password hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Password changed.',
+    );
+  });
+
+  it('rejects SET PASSWORD on an unregistered nick', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = nickservReducer(conn, privmsg('SET PASSWORD hunter2 newpassword'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nick alice is not registered.',
+    );
+  });
+});
+
 // ============================================================================
 // enforceRegisteredNick — the enforcement hook fired by the NICK path
 // ============================================================================