serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/commands/registration.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import pkg from '../../package.json' with { type: 'json' };
 import { cloakHost } from '../../src/cloak';
 import {
@@ -13,6 +13,8 @@ import {
   isValidNick,
   nickReducer,
   passReducer,
+  resetServerPasswordCompareSpy,
+  setServerPasswordCompare,
   userReducer,
 } from '../../src/commands/registration';
 import { DEFAULT_CREATED_TEXT } from '../../src/config';
@@ -27,14 +29,7 @@ import {
   SequentialIdFactory,
   StaticMotdProvider,
 } from '../../src/ports';
-import type {
-  AccountStore,
-  AwayStore,
-  MotdProvider,
-  SaslPayload,
-  SaslResult,
-  ServicesStore,
-} from '../../src/ports';
+import type { AwayStore, MotdProvider, ServicesStore } from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
@@ -555,6 +550,340 @@ describe('userReducer', () => {
   });
 });
 
+// ============================================================================
+// userReducer — USER validation (charset + length + control chars)
+// ============================================================================
+
+/**
+ * Builds the expected NOTICE line for a USER rejection addressed to the
+ * connection's current nick (or `*` when unregistered).
+ */
+function userRejectNotice(nick: string, text: string): RawLine {
+  return L(`:irc.example.com NOTICE ${nick} :${text}`);
+}
+
+/** Username-rejection NOTICE text (matches the reducer's tailored notice). */
+const USERNAME_INVALID_TEXT =
+  'Invalid USER: username must be 1-16 bytes with no spaces, !, @, or control characters';
+
+/** Realname-rejection NOTICE text (matches the reducer's tailored notice). */
+const REALNAME_INVALID_TEXT =
+  'Invalid USER: realname must be at most 64 bytes with no control characters';
+
+describe('userReducer — USER validation (charset + length)', () => {
+  // ------------------------------------------------------------------------
+  // Username charset rejections (params[0])
+  // ------------------------------------------------------------------------
+
+  it('rejects a username containing "!" with NOTICE + Disconnect (hostmask safety)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al!ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.state.realname).toBeUndefined();
+    expect(out.state.registration).toBe('pre-registration');
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing "@" with NOTICE + Disconnect (hostmask safety)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al@ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a space with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing NUL (\\0) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\0ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a bare CR (\\r) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\rce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a bare LF (\\n) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\nce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a username containing a control char (\\x01) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['al\x01ce', '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  // ------------------------------------------------------------------------
+  // Username length rejection (USERLEN = 16 byte cap)
+  // ------------------------------------------------------------------------
+
+  it('rejects a 17-byte username with NOTICE + Disconnect (USERLEN = 16)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const longUser = 'a'.repeat(17);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: [longUser, '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('accepts a username at exactly the 16-byte USERLEN cap (boundary)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const exactUser = 'a'.repeat(16);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: [exactUser, '0', '*', 'Alice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBe(exactUser);
+    expect(out.state.realname).toBe('Alice');
+  });
+
+  // ------------------------------------------------------------------------
+  // Realname charset rejections (params[3])
+  // ------------------------------------------------------------------------
+
+  it('rejects a realname containing NUL (\\0) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\0ice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a realname containing a bare CR (\\r) with NOTICE + Disconnect (CRLF injection)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\rice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a realname containing a bare LF (\\n) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\nice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a realname containing a control char (\\x01) with NOTICE + Disconnect', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\x01ice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  // ------------------------------------------------------------------------
+  // Realname length rejection (REALLEN = 64 byte cap, multi-byte aware)
+  // ------------------------------------------------------------------------
+
+  it('rejects a 65-byte realname with NOTICE + Disconnect (REALLEN = 64)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const longReal = 'A'.repeat(65);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', longReal], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('rejects a multi-byte UTF-8 realname exceeding the 64-byte budget', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    // Each '€' is 3 bytes in UTF-8; 22 × 3 = 66 bytes > 64.
+    const overBudget = '€'.repeat(22);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', overBudget], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('*', REALNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('accepts a multi-byte UTF-8 realname within the 64-byte budget (regression guard)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    // 21 × 3 = 63 bytes ≤ 64.
+    const withinBudget = '€'.repeat(21);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', withinBudget], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBe('alice');
+    expect(out.state.realname).toBe(withinBudget);
+  });
+
+  it('accepts a realname at exactly the 64-byte REALLEN cap (boundary)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const exactReal = 'A'.repeat(64);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', exactReal], tags: {} },
+      ctx,
+    );
+    expect(out.state.realname).toBe(exactReal);
+  });
+
+  it('does not half-store state when the username is valid but the realname is invalid', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Al\rice'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBeUndefined();
+    expect(out.state.realname).toBeUndefined();
+  });
+
+  it('uses the current nick (not *) in the rejection NOTICE when partially registered', () => {
+    const state = makeState();
+    state.nick = 'bob';
+    state.registration = 'registering';
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['b!ob', '0', '*', 'Bob'], tags: {} },
+      ctx,
+    );
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [userRejectNotice('bob', USERNAME_INVALID_TEXT)]),
+      Effect.disconnect('c1', 'invalid USER'),
+    ]);
+  });
+
+  it('still allows a realname containing spaces (valid realname)', () => {
+    const state = makeState();
+    const ctx = makeCtx(state);
+    const out = userReducer(
+      state,
+      { command: 'USER', params: ['alice', '0', '*', 'Alice Wonderland'], tags: {} },
+      ctx,
+    );
+    expect(out.state.user).toBe('alice');
+    expect(out.state.realname).toBe('Alice Wonderland');
+  });
+});
+
 // ============================================================================
 // passReducer
 // ============================================================================
@@ -615,8 +944,9 @@ describe('passReducer', () => {
 describe('passReducer — post-registration PASS <nick>:<password>', () => {
   it('logs in when PASS <nick>:<password> matches an account after registration', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
 
     expect(out.state.account).toBe('alice');
@@ -632,8 +962,9 @@ describe('passReducer — post-registration PASS <nick>:<password>', () => {
 
   it('does not log in or disconnect when the password is wrong', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
@@ -645,8 +976,8 @@ describe('passReducer — post-registration PASS <nick>:<password>', () => {
   it('is indistinguishable from an unknown nick (no auth numerics, no disconnect)', () => {
     const state = registeredState();
     state.nick = 'nobody';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['nobody:wrong'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
@@ -655,55 +986,63 @@ describe('passReducer — post-registration PASS <nick>:<password>', () => {
 
   it('equalises timing with an extra dummy verify on failure', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     passReducer(state, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
 
-    expect(accounts.calls).toHaveLength(2);
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'wrong',
-    });
-    expect(accounts.calls[1]?.payload.kind).toBe('PLAIN');
+    // Two calls: the real (failed) verify against `alice`, then the
+    // timing-equalising dummy verify.
+    expect(verifyNick).toHaveBeenCalledTimes(2);
+    expect(verifyNick.mock.calls[0]?.[0]).toBe('alice');
+    expect(verifyNick.mock.calls[0]?.[1]).toBe('wrong');
+    // The second call is the dummy; its nick is the sentinel, not 'alice'.
+    expect(verifyNick.mock.calls[1]?.[0]).not.toBe('alice');
   });
 
   it('does not log in when the payload nick does not match state.nick', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'bob' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['bob:hunter2'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(out.effects).toEqual([]);
   });
 
   it('ignores a bare PASS value (no colon) after registration — no 462, no disconnect', () => {
     const state = registeredState();
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['serverpw'], tags: {} }, ctx);
 
     expect(out.state.account).toBeUndefined();
     expect(out.effects).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
   });
 
   it('ignores a late PASS when the connection is already identified', () => {
     const state = registeredState();
     state.account = 'alice';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const ctx = makeCtxWithServices(state, services);
     const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(out.effects).toEqual([]);
     expect(out.effects.some((e) => e.tag === 'Disconnect')).toBe(false);
   });
 
-  it('ignores a late PASS <nick>:<password> when no AccountStore is bound', () => {
+  it('ignores a late PASS <nick>:<password> when no ServicesStore is bound', () => {
     const state = registeredState();
     const ctx = makeCtx(state);
     const out = passReducer(state, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
@@ -1094,6 +1433,132 @@ describe('emitWelcomeIfReady — server-password gate', () => {
   });
 });
 
+// ============================================================================
+// server-password gate — constant-time comparison
+// ----------------------------------------------------------------------------
+
+/**
+ * Runs one gate evaluation against the configured password `s3cret` and
+ * returns the effects, so the tests below can focus on comparator calls.
+ */
+function runGate(passAttempt: string | undefined): EffectType[] {
+  const state = makeState();
+  state.nick = 'alice';
+  state.user = 'alice';
+  if (passAttempt !== undefined) state.passAttempt = passAttempt;
+  return emitWelcomeIfReady(state, makeCtxWithPassword(state, 's3cret'));
+}
+
+/**
+ * Installs a call-counting comparator that behaves like string equality so
+ * gate outcomes stay behavioral while the delegation is observable.
+ */
+function installCountingCompare(): ReturnType<typeof vi.fn> {
+  const compare = vi.fn((a: string, b: string) => a === b);
+  setServerPasswordCompare(compare);
+  return compare;
+}
+
+describe('passwordGateFailure — constant-time comparison', () => {
+  afterEach(() => {
+    resetServerPasswordCompareSpy();
+  });
+
+  it('compares the attempt against the configured password via constantTimeEquals', () => {
+    const compare = installCountingCompare();
+    try {
+      runGate('wrong');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(compare).toHaveBeenCalledWith('wrong', 's3cret');
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares exactly once on the equal-password bucket (gate satisfied)', () => {
+    const compare = installCountingCompare();
+    try {
+      const effects = runGate('s3cret');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares exactly once on the same-length unequal bucket (464 + Disconnect)', () => {
+    const compare = installCountingCompare();
+    try {
+      const effects = runGate('X3cret');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password mismatch')]),
+        Effect.disconnect('c1', 'Bad Password'),
+      ]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares exactly once on the different-length bucket — no length pre-check bypass', () => {
+    const compare = installCountingCompare();
+    try {
+      const effects = runGate('s3cr');
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(compare).toHaveBeenCalledWith('s3cr', 's3cret');
+      expect(effects).toEqual<EffectType[]>([
+        Effect.send('c1', [L(':irc.example.com 464 alice :Password mismatch')]),
+        Effect.disconnect('c1', 'Bad Password'),
+      ]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('compares the empty placeholder once when no PASS was sent', () => {
+    const compare = installCountingCompare();
+    try {
+      runGate(undefined);
+      expect(compare).toHaveBeenCalledTimes(1);
+      expect(compare).toHaveBeenCalledWith('', 's3cret');
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('does not compare when the gate is satisfied by SASL (account set)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice';
+    const compare = installCountingCompare();
+    try {
+      const effects = emitWelcomeIfReady(state, makeCtxWithPassword(state, 's3cret'));
+      expect(compare).not.toHaveBeenCalled();
+      expect(state.registration).toBe('registered');
+      expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+
+  it('does not compare when no server password is configured (gate disabled)', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    const compare = installCountingCompare();
+    try {
+      const ctx = makeCtxWithPassword(state, '');
+      const effects = emitWelcomeIfReady(state, ctx);
+      expect(compare).not.toHaveBeenCalled();
+      expect(state.registration).toBe('registered');
+      expect(effects).toEqual([Effect.send('c1', expectedWelcome('alice', 'alice', undefined))]);
+    } finally {
+      setServerPasswordCompare(null);
+    }
+  });
+});
+
 // ============================================================================
 // userReducer / nickReducer — server-password gate integration
 // ============================================================================
@@ -1630,32 +2095,6 @@ describe('emitWelcomeIfReady — OperServ AKILL admission', () => {
 // PASS-based account auth (NICK + PASS <nick>:<password> + USER → identified)
 // ============================================================================
 
-/** A capture-and-respond fake AccountStore (mirrors the sasl.test.ts fake). */
-class FakeAccountStore implements AccountStore {
-  readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-  constructor(private readonly result: SaslResult) {}
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    this.calls.push({ mech, payload });
-    return this.result;
-  }
-}
-
-/** Like {@link makeCtx} but also threads a bound AccountStore. */
-function makeCtxWithAccounts(
-  state: ConnectionState,
-  accounts: AccountStore,
-  clock = new FakeClock(1_000),
-): Ctx {
-  return buildCtx({
-    serverConfig,
-    clock,
-    ids: new SequentialIdFactory(),
-    motd: EmptyMotdProvider,
-    connection: state,
-    accounts,
-  });
-}
-
 const SV = 'irc.example.com';
 const L2 = (text: string): RawLine => ({ text });
 
@@ -1666,8 +2105,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
     state.user = 'alice';
     state.host = 'example.com';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const ctx = makeCtxWithAccounts(state, accounts);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxWithServices(state, services);
 
     const effects = emitWelcomeIfReady(state, ctx);
 
@@ -1684,11 +2124,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (success)', () => {
 
 // ---- helpers for the broader PASS-auth coverage ----
 
-/** Flexible ctx that binds any combination of account/services/away stores. */
+/** Flexible ctx that binds any combination of services/away stores. */
 function makeCtxPassAuth(
   state: ConnectionState,
   opts: {
-    accounts?: AccountStore;
     services?: ServicesStore;
     away?: AwayStore;
     serverPassword?: string;
@@ -1703,7 +2142,6 @@ function makeCtxPassAuth(
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
-    ...(opts.accounts !== undefined ? { accounts: opts.accounts } : {}),
     ...(opts.services !== undefined ? { services: opts.services } : {}),
     ...(opts.away !== undefined ? { away: opts.away } : {}),
   });
@@ -1715,16 +2153,16 @@ function sentTexts(effects: EffectType[]): string[] {
 }
 
 describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity with SASL)', () => {
-  it('forwards the parsed credentials to the AccountStore as a PLAIN verify', () => {
+  it('forwards the parsed credentials to services.verifyNick as a PLAIN verify', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'hunter2' } },
-    ]);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
+    expect(verifyNick).toHaveBeenCalledWith('alice', 'hunter2');
   });
 
   it('stamps read-only user mode `r` on a successful PASS-auth', () => {
@@ -1732,8 +2170,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.userModes.registered).toBe(true);
   });
 
@@ -1742,10 +2181,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setLastReadMarker('alice', '#foo', 'm1');
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.lastReadMarkers?.get('#foo')).toBe('m1');
   });
 
@@ -1754,10 +2193,11 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     const away = new InMemoryAwayStore();
     away.set('alice', 'brb');
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, away }));
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services, away }));
     expect(state.away).toBe('brb');
     expect(sentTexts(effects)).toContain(`:${SV} 306 alice :You have been marked as being away`);
   });
@@ -1771,8 +2211,7 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.registerNick('bob', 'pw', 'bob@example.com');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'hi', sentAt: 0 });
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts, services }));
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(sentTexts(effects).some((t) => t.includes('[Memo #') && t.includes('hi'))).toBe(true);
   });
 
@@ -1782,10 +2221,10 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.user = 'alice';
     state.host = 'real.example.net';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setVhost('alice', 'cool.example.net');
-    const ctx = makeCtxPassAuth(state, { accounts, services });
+    const ctx = makeCtxPassAuth(state, { services });
 
     const effects = emitWelcomeIfReady(state, ctx);
 
@@ -1804,9 +2243,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.user = 'alice';
     state.host = 'real.example.net';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
-    const ctx = makeCtxPassAuth(state, { accounts, services });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const ctx = makeCtxPassAuth(state, { services });
 
     emitWelcomeIfReady(state, ctx);
 
@@ -1820,8 +2259,8 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.user = 'alice';
     state.host = '203.0.113.5';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
     const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     services.setVhost('alice', 'cool.example.net');
     const ctx: Ctx = buildCtx({
       serverConfig: { ...serverConfig, cloaking: { enabled: true, secret: 's3cret' } },
@@ -1829,7 +2268,6 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
       ids: new SequentialIdFactory(),
       motd: EmptyMotdProvider,
       connection: state,
-      accounts,
       services,
     });
 
@@ -1851,8 +2289,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (account-effects parity
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
     expect(state.account).toBe('alice');
   });
 });
@@ -1863,8 +2302,9 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.userModes.registered).toBe(false);
@@ -1880,8 +2320,8 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'nobody';
     state.user = 'nobody';
     state.passAttempt = 'nobody:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
@@ -1897,17 +2337,15 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
-    emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
-
-    expect(accounts.calls).toHaveLength(2);
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'wrong',
-    });
-    expect(accounts.calls[1]?.mech).toBe('PLAIN');
-    expect(accounts.calls[1]?.payload.kind).toBe('PLAIN');
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
+
+    expect(verifyNick).toHaveBeenCalledTimes(2);
+    expect(verifyNick.mock.calls[0]?.[0]).toBe('alice');
+    expect(verifyNick.mock.calls[0]?.[1]).toBe('wrong');
+    expect(verifyNick.mock.calls[1]?.[0]).not.toBe('alice');
   });
 
   it('treats a payload nick that does not match state.nick as a failed auth (no silent login)', () => {
@@ -1915,19 +2353,21 @@ describe('emitWelcomeIfReady — PASS-based account auth (failures)', () => {
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'bob:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'bob' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
     // The store is never consulted on a nick mismatch.
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
   });
 });
 
 describe('emitWelcomeIfReady — PASS-auth interaction with the server-password gate', () => {
-  it('ignores the <nick>:<password> form when no AccountStore is bound (open gate)', () => {
+  it('ignores the <nick>:<password> form when no ServicesStore is bound (open gate)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
@@ -1939,7 +2379,28 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
   });
 
-  it('collapses to the server-password gate (464) when no AccountStore is bound and the colon form does not match', () => {
+  it('a SASL-identified connection (state.account set) satisfies the gate with no credential-store read', () => {
+    const state = makeState();
+    state.nick = 'alice';
+    state.user = 'alice';
+    state.account = 'alice'; // SASL-identified before registration completion.
+    state.passAttempt = 'alice:hunter2';
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(
+      state,
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
+    );
+
+    // The gate is satisfied by state.account; no PASS-auth verify fires.
+    expect(verifyNick).not.toHaveBeenCalled();
+    expect(state.registration).toBe('registered');
+    expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
+  });
+
+  it('collapses to the server-password gate (464) when no ServicesStore is bound and the colon form does not match', () => {
     const state = makeState();
     state.nick = 'alice';
     state.user = 'alice';
@@ -1958,10 +2419,11 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:wrong';
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
     const effects = emitWelcomeIfReady(
       state,
-      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
     );
 
     expect(state.registration).not.toBe('registered');
@@ -1978,10 +2440,12 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.user = 'alice';
     state.account = 'alice'; // SASL-identified before registration completion
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    const effects = emitWelcomeIfReady(state, makeCtxPassAuth(state, { services }));
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(state.registration).toBe('registered');
     // No 900/903 are re-emitted by PASS-auth; SASL already emitted them.
     expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(false);
@@ -1992,13 +2456,15 @@ describe('emitWelcomeIfReady — PASS-auth interaction with the server-password
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 's3cret';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
     const effects = emitWelcomeIfReady(
       state,
-      makeCtxPassAuth(state, { accounts, serverPassword: 's3cret' }),
+      makeCtxPassAuth(state, { services, serverPassword: 's3cret' }),
     );
 
-    expect(accounts.calls).toHaveLength(0);
+    expect(verifyNick).not.toHaveBeenCalled();
     expect(state.account).toBeUndefined();
     expect(state.registration).toBe('registered');
     expect(sentTexts(effects).some((t) => t.includes(' 464 '))).toBe(false);
@@ -2011,8 +2477,9 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
     state.user = 'alice';
     // state.nick intentionally undefined — PASS arrived before NICK.
     state.passAttempt = 'alice:hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const effects = passBasedAccountAuth(state, makeCtxPassAuth(state, { services }));
 
     expect(state.account).toBe('alice');
     expect(effects.some((e) => e.tag === 'Send')).toBe(true);
@@ -2021,26 +2488,31 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
   it('returns no effects when no PASS was sent', () => {
     const state = makeState();
     state.nick = 'alice';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
   });
 
   it('returns no effects for a bare PASS value (no colon)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = 's3cret';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('returns no effects when the nick portion is empty (`:password`)', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = ':hunter2';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }))).toEqual([]);
-    expect(accounts.calls).toHaveLength(0);
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const verifyNick = vi.spyOn(services, 'verifyNick');
+    expect(passBasedAccountAuth(state, makeCtxPassAuth(state, { services }))).toEqual([]);
+    expect(verifyNick).not.toHaveBeenCalled();
   });
 
   it('splits only on the first colon so a password may contain colons', () => {
@@ -2048,16 +2520,13 @@ describe('passBasedAccountAuth — unit (PASS before NICK, parsing, edge cases)'
     state.nick = 'alice';
     state.user = 'alice';
     state.passAttempt = 'alice:p:ass:word';
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    passBasedAccountAuth(state, makeCtxPassAuth(state, { accounts }));
-    expect(accounts.calls[0]?.payload).toEqual({
-      kind: 'PLAIN',
-      username: 'alice',
-      password: 'p:ass:word',
-    });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'p:ass:word', 'alice@example.com');
+    passBasedAccountAuth(state, makeCtxPassAuth(state, { services }));
+    expect(state.account).toBe('alice');
   });
 
-  it('returns no effects when no AccountStore is bound', () => {
+  it('returns no effects when no ServicesStore is bound', () => {
     const state = makeState();
     state.nick = 'alice';
     state.passAttempt = 'alice:hunter2';