serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/commands/oper.test.ts

@@ -1,11 +1,26 @@
-import { describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  OPER_HASHED_USER,
+  OPER_HASHED_VALID_PASSWORD,
+  OPER_HASHED_WRONG_PASSWORD,
+  OPER_PRECOMPUTED_DUMMY_HASHED,
+  OPER_PRECOMPUTED_HASHED_CRED,
+  resetOperLegacyPlaintextWarning,
+  resetOperTimingSpy,
+  setOperLegacyPlaintextWarner,
+  setOperVerifyHashedPassword,
+} from '../../src/commands/oper';
 import { matchOperCred, operReducer } from '../../src/commands/oper';
+import { type HashedAccountCredential, hashAccountCredential } from '../../src/credential-hashing';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
+import { OperFailureStats } from '../../src/oper-lockout';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
+type VerifyHashedPasswordFn = (password: string, entry: HashedAccountCredential) => boolean;
+
 const baseServerConfig: ServerConfig = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
@@ -36,6 +51,27 @@ function makeCtx(state: ConnectionState, config: ServerConfig = serverConfigWith
   });
 }
 
+/**
+ * Builds a ctx with a per-IP failed-OPER tracker bound, sharing `clock`
+ * between the tracker and the ctx so window arithmetic is deterministic
+ * under FakeClock advances.
+ */
+function makeTrackedCtx(
+  state: ConnectionState,
+  tracker: OperFailureStats,
+  clock: FakeClock,
+  config: ServerConfig = serverConfigWithCreds,
+): Ctx {
+  return buildCtx({
+    serverConfig: config,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    operFailures: tracker,
+  });
+}
+
 function makeState(): ConnectionState {
   const s = createConnection({ id: 'c1', connectedSince: 0 });
   s.nick = 'alice';
@@ -81,6 +117,24 @@ describe('operReducer — successful authentication', () => {
     expect(modeLines).toContain(':alice!alice@example.com MODE alice +o');
   });
 
+  it('falls back to ? / * in the MODE echo when the connection has no nick or hostmask', () => {
+    // A connection with no nick/user/host: hostmaskOf returns undefined
+    // and state.nick is undefined, so modeEchoLine falls back to '?' / '*'.
+    // Registered so the registration gate passes (the formatter fallback,
+    // not the gate, is under test here).
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.registration = 'registered';
+    const ctx = makeCtx(state);
+
+    const out = operReducer(state, oper('alice', 'secret'), ctx);
+
+    expect(out.state.userModes.oper).toBe(true);
+    const modeLines = out.effects
+      .filter((e): e is Extract<EffectType, { tag: 'Send' }> => e.tag === 'Send')
+      .flatMap((e) => e.lines.map((l) => l.text));
+    expect(modeLines).toContain(':? MODE * +o');
+  });
+
   it('matches the second configured credential pair', () => {
     const state = makeState();
     const ctx = makeCtx(state);
@@ -228,7 +282,10 @@ describe('operReducer — missing parameters', () => {
   });
 
   it('uses "*" as the nick in 461 when the connection has no nick yet', () => {
+    // Registered (a synthetic nick-less connection) so the test exercises
+    // the 461 nick fallback rather than the registration gate.
     const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.registration = 'registered';
     const ctx = makeCtx(state);
 
     const out = operReducer(state, oper(), ctx);
@@ -239,6 +296,69 @@ describe('operReducer — missing parameters', () => {
   });
 });
 
+describe('operReducer — registration gate', () => {
+  it('rejects a pre-registration connection with 451 ERR_NOTREGISTERED without granting oper', () => {
+    const state = makeState();
+    state.registration = 'pre-registration';
+    const ctx = makeCtx(state);
+
+    const out = operReducer(state, oper('alice', 'secret'), ctx);
+
+    expect(out.state.userModes.oper).toBe(false);
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 451 alice :You have not registered')]),
+    ]);
+  });
+
+  it('stamps lastSeen even when the registration gate rejects', () => {
+    const state = makeState();
+    state.registration = 'pre-registration';
+    expect(state.lastSeen).toBe(0);
+    const ctx = makeCtx(state);
+
+    operReducer(state, oper('alice', 'secret'), ctx);
+
+    expect(state.lastSeen).toBe(5_000);
+  });
+
+  it('checks the registration gate before parameter validation (451 wins over 461)', () => {
+    const state = makeState();
+    state.registration = 'pre-registration';
+    const ctx = makeCtx(state);
+
+    const out = operReducer(state, oper(), ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 451 alice :You have not registered')]),
+    ]);
+  });
+
+  it('records no lockout failure for a pre-registration rejection', () => {
+    const clock = new FakeClock(1_000);
+    const tracker = new OperFailureStats(clock);
+    const state = makeState();
+    state.registration = 'pre-registration';
+    const ctx = makeTrackedCtx(state, tracker, clock);
+
+    operReducer(state, oper('alice', 'secret'), ctx);
+
+    expect(tracker.recentFailures('example.com', 60_000)).toBe(0);
+  });
+
+  it('grants oper post-registration (gate passes through to the credential path)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+
+    const out = operReducer(state, oper('alice', 'secret'), ctx);
+
+    expect(out.state.userModes.oper).toBe(true);
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 381 alice :You are now an IRC operator')]),
+      Effect.send('c1', [L(':alice!alice@example.com MODE alice +o')]),
+    ]);
+  });
+});
+
 describe('matchOperCred', () => {
   it('returns true when a credential pair matches exactly', () => {
     const creds = [
@@ -268,3 +388,456 @@ describe('matchOperCred', () => {
     expect(matchOperCred(creds, 'alice', 'Secret')).toBe(false);
   });
 });
+
+// ============================================================================
+// Hashed credentials (scrypt) — the new at-rest shape.
+// ============================================================================
+
+describe('matchOperCred — hashed credentials', () => {
+  afterEach(() => {
+    resetOperLegacyPlaintextWarning();
+    resetOperTimingSpy();
+  });
+
+  it('verifies a correct password against the precomputed scrypt-hashed cred', () => {
+    expect(
+      matchOperCred([OPER_PRECOMPUTED_HASHED_CRED], OPER_HASHED_USER, OPER_HASHED_VALID_PASSWORD),
+    ).toBe(true);
+  });
+
+  it('rejects a wrong password against a scrypt-hashed cred', () => {
+    expect(
+      matchOperCred([OPER_PRECOMPUTED_HASHED_CRED], OPER_HASHED_USER, OPER_HASHED_WRONG_PASSWORD),
+    ).toBe(false);
+  });
+
+  it('rejects an unknown user against a scrypt-hashed cred', () => {
+    expect(
+      matchOperCred(
+        [OPER_PRECOMPUTED_HASHED_CRED],
+        'definitely-not-a-user',
+        OPER_HASHED_VALID_PASSWORD,
+      ),
+    ).toBe(false);
+  });
+
+  it('round-trips a freshly-hashed credential via hashAccountCredential', () => {
+    const entry = hashAccountCredential('admin', 's3cret-password');
+    const cred = { user: entry.account, salt: entry.salt, hash: entry.hash };
+    expect(matchOperCred([cred], 'admin', 's3cret-password')).toBe(true);
+    expect(matchOperCred([cred], 'admin', 'wrong')).toBe(false);
+  });
+});
+
+// ============================================================================
+// Timing equalisation — matchOperCred runs a dummy scrypt verify on the
+// user-unknown path so a timing attacker cannot distinguish "user exists"
+// from "user unknown".
+// ============================================================================
+
+describe('matchOperCred — timing-equalising dummy verify on unknown user', () => {
+  afterEach(() => {
+    resetOperLegacyPlaintextWarning();
+    resetOperTimingSpy();
+  });
+
+  it('invokes exactly one verify on a known user with the wrong password', () => {
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setOperVerifyHashedPassword(spy);
+    try {
+      matchOperCred([OPER_PRECOMPUTED_HASHED_CRED], OPER_HASHED_USER, OPER_HASHED_WRONG_PASSWORD);
+      expect(spy).toHaveBeenCalledTimes(1);
+    } finally {
+      setOperVerifyHashedPassword(null);
+    }
+  });
+
+  it('invokes exactly one (dummy) verify on an unknown user — no O(1) short-circuit', () => {
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setOperVerifyHashedPassword(spy);
+    try {
+      matchOperCred(
+        [OPER_PRECOMPUTED_HASHED_CRED],
+        'definitely-not-a-user',
+        OPER_HASHED_VALID_PASSWORD,
+      );
+      // Critical: a single dummy verify runs even though no user matched,
+      // equalising wall-clock cost with the wrong-password path.
+      expect(spy).toHaveBeenCalledTimes(1);
+      // The dummy verify is fed a fixed precomputed entry (never the
+      // attacker's payload as the "user") so the timing is independent
+      // of attacker input.
+      expect(spy.mock.calls[0]?.[1]).toBe(OPER_PRECOMPUTED_DUMMY_HASHED);
+    } finally {
+      setOperVerifyHashedPassword(null);
+    }
+  });
+
+  it('does not invoke a dummy verify when the user matches and password verifies', () => {
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => true);
+    setOperVerifyHashedPassword(spy);
+    try {
+      matchOperCred([OPER_PRECOMPUTED_HASHED_CRED], OPER_HASHED_USER, OPER_HASHED_VALID_PASSWORD);
+      expect(spy).toHaveBeenCalledTimes(1);
+    } finally {
+      setOperVerifyHashedPassword(null);
+    }
+  });
+});
+
+// ============================================================================
+// Legacy plaintext fallback (deprecation cycle) — keeps verifying but warns
+// once per boot.
+// ============================================================================
+
+describe('matchOperCred — legacy plaintext fallback (deprecation cycle)', () => {
+  afterEach(() => {
+    resetOperLegacyPlaintextWarning();
+    resetOperTimingSpy();
+  });
+
+  it('still verifies a legacy {user,password} cred', () => {
+    const warns: string[] = [];
+    setOperLegacyPlaintextWarner((msg) => {
+      warns.push(msg);
+    });
+    try {
+      expect(matchOperCred([{ user: 'alice', password: 'secret' }], 'alice', 'secret')).toBe(true);
+      expect(matchOperCred([{ user: 'alice', password: 'secret' }], 'alice', 'wrong')).toBe(false);
+    } finally {
+      setOperLegacyPlaintextWarner(null);
+    }
+  });
+
+  it('warns exactly once per boot when a legacy plaintext cred is encountered', () => {
+    const warns: string[] = [];
+    setOperLegacyPlaintextWarner((msg) => {
+      warns.push(msg);
+    });
+    try {
+      matchOperCred([{ user: 'alice', password: 'secret' }], 'alice', 'secret');
+      matchOperCred([{ user: 'bob', password: 'pw' }], 'bob', 'pw');
+      matchOperCred([{ user: 'carol', password: 'pw' }], 'carol', 'pw');
+      expect(warns).toHaveLength(1);
+      expect(warns[0]).toMatch(/deprecat/iu);
+    } finally {
+      setOperLegacyPlaintextWarner(null);
+    }
+  });
+
+  it('does NOT warn when only hashed creds are configured', () => {
+    const warns: string[] = [];
+    setOperLegacyPlaintextWarner((msg) => {
+      warns.push(msg);
+    });
+    try {
+      matchOperCred([OPER_PRECOMPUTED_HASHED_CRED], OPER_HASHED_USER, OPER_HASHED_VALID_PASSWORD);
+      expect(warns).toHaveLength(0);
+    } finally {
+      setOperLegacyPlaintextWarner(null);
+    }
+  });
+
+  it('restores the default console.warn sink when setOperLegacyPlaintextWarner(null) is called', () => {
+    // Spy on console.warn to confirm the default sink routes there after
+    // a `null` restore. The previous test installed a custom sink; this
+    // call MUST revert to console.warn so production emissions land in
+    // the platform's observability pipeline.
+    const calls: string[] = [];
+    const original = console.warn;
+    const warnSpy = (msg: string) => {
+      calls.push(msg);
+    };
+    console.warn = warnSpy;
+    try {
+      setOperLegacyPlaintextWarner(null);
+      // Force the warn flag to fire on the next call.
+      resetOperLegacyPlaintextWarning();
+      matchOperCred([{ user: 'alice', password: 'secret' }], 'alice', 'secret');
+      expect(calls).toHaveLength(1);
+      expect(calls[0]).toMatch(/deprecat/iu);
+    } finally {
+      console.warn = original;
+      resetOperLegacyPlaintextWarning();
+      setOperLegacyPlaintextWarner(null);
+    }
+  });
+});
+
+// ============================================================================
+// Per-IP failed-OPER lockout — threshold crossing, success-resets-counter,
+// window expiry, and the oper-notice emission.
+// ============================================================================
+
+describe('operReducer — per-IP failed-OPER lockout', () => {
+  afterEach(() => {
+    resetOperTimingSpy();
+    resetOperLegacyPlaintextWarning();
+  });
+
+  it('rejects the next OPER with 491 after 3 consecutive credential failures from one IP', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const state = makeState();
+
+    for (let i = 0; i < 3; i++) {
+      const out = operReducer(
+        state,
+        oper('alice', `wrong-${i}`),
+        makeTrackedCtx(state, tracker, clock),
+      );
+      expect(out.state.userModes.oper).toBe(false);
+      expect(out.effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password Incorrect')]),
+      ]);
+    }
+
+    // The 4th attempt is rejected without consulting the credential store —
+    // even with the CORRECT password the lockout wins.
+    const locked = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock),
+    );
+    expect(locked.state.userModes.oper).toBe(false);
+    const texts = locked.effects.flatMap((e) =>
+      e.tag === 'Send' ? e.lines.map((l) => l.text) : [],
+    );
+    expect(texts).toContain(':irc.example.com 491 alice :No O-lines for your host');
+  });
+
+  it('does not invoke the credential verifier once the IP is locked out', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const config: ServerConfig = {
+      ...baseServerConfig,
+      operCreds: [OPER_PRECOMPUTED_HASHED_CRED],
+    };
+    const state = makeState();
+
+    for (let i = 0; i < 3; i++) {
+      operReducer(
+        state,
+        oper(OPER_HASHED_USER, OPER_HASHED_WRONG_PASSWORD),
+        makeTrackedCtx(state, tracker, clock, config),
+      );
+    }
+
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => true);
+    setOperVerifyHashedPassword(spy);
+    try {
+      const locked = operReducer(
+        state,
+        oper(OPER_HASHED_USER, OPER_HASHED_VALID_PASSWORD),
+        makeTrackedCtx(state, tracker, clock, config),
+      );
+      // Critical: the lockout short-circuits BEFORE matchOperCred, so the
+      // (stubbed) scrypt verifier is never invoked for the locked attempt.
+      expect(spy).toHaveBeenCalledTimes(0);
+      expect(locked.state.userModes.oper).toBe(false);
+    } finally {
+      setOperVerifyHashedPassword(null);
+    }
+  });
+
+  it('emits a BroadcastOperNotice effect to all opers when the lockout trips', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const state = makeState();
+
+    for (let i = 0; i < 3; i++) {
+      operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    }
+
+    const locked = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock),
+    );
+    expect(locked.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 491 alice :No O-lines for your host')]),
+      Effect.broadcastOperNotice([
+        L(':irc.example.com NOTICE * :OPER lockout triggered for example.com'),
+      ]),
+    ]);
+  });
+
+  it('resets the per-IP failure counter on successful OPER', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const state = makeState();
+
+    // Two failures, then a success that resets the counter.
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    const ok = operReducer(state, oper('alice', 'secret'), makeTrackedCtx(state, tracker, clock));
+    expect(ok.state.userModes.oper).toBe(true);
+
+    // Two more failures after the reset: only 2 recent failures remain, so
+    // the next correct attempt is NOT locked out.
+    state.userModes.oper = false;
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    const after = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock),
+    );
+    expect(after.state.userModes.oper).toBe(true);
+  });
+
+  it('forgets failures once the configured window has elapsed', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const state = makeState();
+
+    for (let i = 0; i < 3; i++) {
+      operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    }
+
+    // Default window is 300s; advancing past it prunes every recorded
+    // failure, so a subsequent correct attempt succeeds.
+    clock.advance(300_001);
+    const after = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock),
+    );
+    expect(after.state.userModes.oper).toBe(true);
+    expect(tracker.recentFailures('example.com', 300_000)).toBe(0);
+  });
+
+  it('honours oper.maxFailures and oper.failureWindowSeconds from ServerConfig', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const config: ServerConfig = {
+      ...serverConfigWithCreds,
+      oper: { maxFailures: 1, failureWindowSeconds: 60 },
+    };
+    const state = makeState();
+
+    // maxFailures: 1 — the SECOND attempt from this IP is already locked.
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock, config));
+    const locked = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock, config),
+    );
+    expect(locked.state.userModes.oper).toBe(false);
+    expect(locked.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 491 alice :No O-lines for your host')]),
+      Effect.broadcastOperNotice([
+        L(':irc.example.com NOTICE * :OPER lockout triggered for example.com'),
+      ]),
+    ]);
+
+    // failureWindowSeconds: 60 — after 61s the single failure expires.
+    clock.advance(61_000);
+    const after = operReducer(
+      state,
+      oper('alice', 'wrong'),
+      makeTrackedCtx(state, tracker, clock, config),
+    );
+    expect(after.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 464 alice :Password Incorrect')]),
+    ]);
+  });
+
+  it('falls back to the default thresholds when the oper config omits the fields', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const config: ServerConfig = { ...serverConfigWithCreds, oper: {} };
+    const state = makeState();
+
+    // Defaults: 3 failures. Two failures are not yet enough to lock.
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock, config));
+    operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock, config));
+    const notLocked = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock, config),
+    );
+    expect(notLocked.state.userModes.oper).toBe(true);
+
+    // Three failures (post-success reset makes it a fresh run) then lock.
+    state.userModes.oper = false;
+    for (let i = 0; i < 3; i++) {
+      operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock, config));
+    }
+    const locked = operReducer(
+      state,
+      oper('alice', 'secret'),
+      makeTrackedCtx(state, tracker, clock, config),
+    );
+    expect(locked.state.userModes.oper).toBe(false);
+  });
+
+  it('does not lock out when no failure tracker is bound (ctx.operFailures undefined)', () => {
+    const state = makeState();
+    for (let i = 0; i < 5; i++) {
+      const out = operReducer(state, oper('alice', 'wrong'), makeCtx(state));
+      expect(out.effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password Incorrect')]),
+      ]);
+    }
+  });
+
+  it('skips lockout accounting when the connection has no host set', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const state = createConnection({ id: 'c1', connectedSince: 0 });
+    state.nick = 'alice';
+    state.registration = 'registered';
+
+    // No host → no lockout key → failures are never recorded, so the
+    // credential store keeps being consulted.
+    for (let i = 0; i < 5; i++) {
+      const out = operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+      expect(out.effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password Incorrect')]),
+      ]);
+    }
+  });
+
+  it('still re-confirms 381 for an already-oper connection from a locked-out IP', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const state = makeState();
+
+    for (let i = 0; i < 3; i++) {
+      operReducer(state, oper('alice', 'wrong'), makeTrackedCtx(state, tracker, clock));
+    }
+
+    // A different connection from the same host that is ALREADY oper: the
+    // idempotent re-confirm path runs before the lockout gate.
+    const operState = makeState();
+    operState.userModes.oper = true;
+    const out = operReducer(
+      operState,
+      oper('alice', 'secret'),
+      makeTrackedCtx(operState, tracker, clock),
+    );
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 381 alice :You are now an IRC operator')]),
+    ]);
+  });
+
+  it('keys failures per host so distinct hosts do not lock each other out', () => {
+    const clock = new FakeClock(5_000);
+    const tracker = new OperFailureStats(clock);
+    const attacker = makeState();
+    const victim = makeState();
+    victim.host = '10.0.0.2';
+
+    for (let i = 0; i < 3; i++) {
+      operReducer(attacker, oper('alice', 'wrong'), makeTrackedCtx(attacker, tracker, clock));
+    }
+
+    const out = operReducer(
+      victim,
+      oper('alice', 'secret'),
+      makeTrackedCtx(victim, tracker, clock),
+    );
+    expect(out.state.userModes.oper).toBe(true);
+  });
+});

package/packages/irc-core/tests/commands/privmsg.test.ts

@@ -97,6 +97,22 @@ describe('isChannelTarget', () => {
   it('returns false for a name with a space', () => {
     expect(isChannelTarget('foo bar')).toBe(false);
   });
+
+  it('returns false for a channel name containing NUL', () => {
+    expect(isChannelTarget('#foo\0bar')).toBe(false);
+  });
+
+  it('returns false for a channel name containing a control character', () => {
+    expect(isChannelTarget('#foo\x01bar')).toBe(false);
+  });
+
+  it('returns true for a channel name containing !', () => {
+    expect(isChannelTarget('#foo!bar')).toBe(true);
+  });
+
+  it('returns true for a channel name containing @', () => {
+    expect(isChannelTarget('#foo@bar')).toBe(true);
+  });
 });
 
 // ============================================================================