serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/commands/topic.test.ts

@@ -29,9 +29,10 @@ function makeCtx(
   conn: ConnectionState,
   clock = new FakeClock(1_000),
   services?: ServicesStore,
+  config: ServerConfig = serverConfig,
 ): Ctx {
   return buildCtx({
-    serverConfig,
+    serverConfig: config,
     clock,
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
@@ -182,6 +183,21 @@ describe('topicReducer — writes', () => {
     expect(out.state.topic?.text).toBe('a'.repeat(serverConfig.topicLen));
   });
 
+  it('keeps an ASCII topic of exactly topicLen bytes unchanged (no truncation)', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, new FakeClock(1_000), undefined, {
+      ...serverConfig,
+      topicLen: 64,
+    });
+
+    const topic = 'a'.repeat(64);
+    const out = topicReducer(chan, { command: 'TOPIC', params: ['#foo', topic], tags: {} }, ctx);
+
+    expect(out.state.topic?.text).toBe(topic);
+  });
+
   it('emits 482 ERR_CHANOPRIVSNEEDED when +t is set and the writer is a non-op member', () => {
     const chan = makeChan('#foo');
     chan.modes.topicLock = true;
@@ -238,9 +254,91 @@ describe('topicReducer — writes', () => {
 });
 
 // ============================================================================
-// topicReducer — rejections
+// topicReducer — byte-budget truncation (TOPICLEN as a UTF-8 byte ceiling)
 // ============================================================================
 
+describe('topicReducer — byte-budget truncation', () => {
+  const byteCtx = (conn: ConnectionState): Ctx =>
+    makeCtx(conn, new FakeClock(1_000), undefined, { ...serverConfig, topicLen: 64 });
+
+  it('truncates a multi-byte Latin-1 topic to the byte budget, not the char budget', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    const conn = makeConn();
+    const ctx = byteCtx(conn);
+
+    // 50 `é` chars = 50 UTF-16 units (under the 64 char budget) but 100
+    // UTF-8 bytes (over the 64 byte budget). Char-based slicing keeps all
+    // 50; byte-based truncation must keep exactly 32 (64 bytes).
+    const out = topicReducer(
+      chan,
+      { command: 'TOPIC', params: ['#foo', 'é'.repeat(50)], tags: {} },
+      ctx,
+    );
+
+    expect(out.state.topic?.text).toBe('é'.repeat(32));
+  });
+
+  it('backs off to a complete-char boundary when the budget lands mid-CJK-char', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    const conn = makeConn();
+    const ctx = byteCtx(conn);
+
+    // `好` is 3 UTF-8 bytes. 64 bytes fits 21 whole chars (63 bytes); the
+    // 22nd would need 66 bytes, so it is dropped whole and the result is a
+    // valid-UTF-8 string 1 byte under budget — never split mid-char.
+    const out = topicReducer(
+      chan,
+      { command: 'TOPIC', params: ['#foo', '好'.repeat(30)], tags: {} },
+      ctx,
+    );
+
+    expect(out.state.topic?.text).toBe('好'.repeat(21));
+  });
+
+  it('truncates an emoji topic without splitting surrogate pairs', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    const conn = makeConn();
+    const ctx = byteCtx(conn);
+
+    // `😀` is astral: 2 UTF-16 code units and 4 UTF-8 bytes each. 20 emoji
+    // = 40 UTF-16 units (under 64 chars) but 80 bytes (over budget). The
+    // byte budget fits exactly 16 emoji (64 bytes); a naive UTF-16 slice
+    // at 64 units would keep all 20, and a naive byte slice at 64 would
+    // split a surrogate pair.
+    const out = topicReducer(
+      chan,
+      { command: 'TOPIC', params: ['#foo', '😀'.repeat(20)], tags: {} },
+      ctx,
+    );
+
+    expect(out.state.topic?.text).toBe('😀'.repeat(16));
+  });
+
+  it('broadcasts and persists the byte-truncated text', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    const conn = makeConn();
+    const ctx = byteCtx(conn);
+
+    const out = topicReducer(
+      chan,
+      { command: 'TOPIC', params: ['#foo', 'é'.repeat(50)], tags: {} },
+      ctx,
+    );
+
+    const truncated = 'é'.repeat(32);
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.applyChannelDelta('#foo', {
+        topic: { text: truncated, setter: 'alice!alice@example.com', setAt: 1_000 },
+      }),
+      Effect.broadcast('#foo', [L(`:alice!alice@example.com TOPIC #foo :${truncated}`)]),
+    ]);
+  });
+});
+
 describe('topicReducer — rejections', () => {
   it('emits 461 ERR_NEEDMOREPARAMS when no channel is supplied', () => {
     const chan = makeChan('#foo');
@@ -279,6 +377,43 @@ describe('topicReducer — rejections', () => {
     ]);
   });
 
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing NUL', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = topicReducer(chan, { command: 'TOPIC', params: ['#foo\0bar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\0bar :No such channel')]),
+    ]);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name containing a control character', () => {
+    const chan = makeChan('#foo');
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = topicReducer(chan, { command: 'TOPIC', params: ['#foo\x1fbar'], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(':irc.example.com 403 alice #foo\x1fbar :No such channel')]),
+    ]);
+  });
+
+  it('emits 403 ERR_NOSUCHCHANNEL for a channel name whose UTF-8 byte size exceeds the cap', () => {
+    const long = `#${'é'.repeat(25)}`; // 51 UTF-8 bytes, only 26 UTF-16 units
+    const chan = makeChan(long);
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = topicReducer(chan, { command: 'TOPIC', params: [long], tags: {} }, ctx);
+
+    expect(out.effects).toEqual<EffectType[]>([
+      Effect.send('c1', [L(`:irc.example.com 403 alice ${long} :No such channel`)]),
+    ]);
+  });
+
   it('emits 403 ERR_NOSUCHCHANNEL for an empty channel name', () => {
     const chan = makeChan('#foo');
     const conn = makeConn();

package/packages/irc-core/tests/commands/unified-account.test.ts

@@ -15,12 +15,15 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { applyAccountSuccess } from '../../src/commands/account-auth';
+import {
+  applyAccountSuccess,
+  attemptPassAccountAuth,
+  passBasedAccountAuth,
+} from '../../src/commands/account-auth';
 import { NICKSERV_NICK, nickservReducer } from '../../src/commands/nickserv';
+import { passReducer } from '../../src/commands/registration';
 import { authenticateReducer } from '../../src/commands/sasl';
-import { type HashedAccountCredential, hashAccountCredential } from '../../src/credential-hashing';
 import type { Effect as EffectType } from '../../src/effects';
-import type { AccountStore } from '../../src/ports';
 import {
   EmptyMotdProvider,
   FakeClock,
@@ -71,18 +74,13 @@ function saslReadyState(nick = 'alice'): ConnectionState {
   return s;
 }
 
-function makeCtx(
-  state: ConnectionState,
-  accounts?: AccountStore,
-  services?: InMemoryServicesStore,
-): Ctx {
+function makeCtx(state: ConnectionState, services?: InMemoryServicesStore): Ctx {
   return buildCtx({
     serverConfig,
     clock: new FakeClock(NOW),
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
-    ...(accounts !== undefined ? { accounts } : {}),
     ...(services !== undefined ? { services } : {}),
   });
 }
@@ -119,6 +117,80 @@ function emptySnapshot(): ServicesSnapshot {
   };
 }
 
+// ============================================================================
+// AC: NickServ REGISTER → PASS <nick>:<password> succeeds post-registration
+// (T178: PASS-auth consults ServicesStore.verifyNick — the bug fix)
+// ============================================================================
+
+describe('T178 unified account: NickServ REGISTER → PASS-auth (post-registration)', () => {
+  it('a freshly NickServ-registered nick authenticates via PASS <nick>:<password>', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, services),
+    );
+
+    // A second connection sending PASS after registration (no AccountStore).
+    const conn = makeConn('c1', 'alice');
+    const ctx = makeCtx(conn, services);
+    const out = passReducer(conn, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
+  });
+
+  it('PASS-auth with the wrong password after NickServ REGISTER is a silent no-op', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, services),
+    );
+
+    const conn = makeConn('c1', 'alice');
+    const ctx = makeCtx(conn, services);
+    const out = passReducer(conn, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
+
+    expect(conn.account).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([]);
+  });
+
+  it('passBasedAccountAuth identifies via services.verifyNick at registration completion', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, services),
+    );
+
+    const conn = makeConn('c1', 'alice');
+    conn.registration = 'registering';
+    conn.passAttempt = 'alice:hunter2';
+    const effects = passBasedAccountAuth(conn, makeCtx(conn, services));
+
+    expect(conn.account).toBe('alice');
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(true);
+  });
+
+  it('attemptPassAccountAuth consults services.verifyNick directly', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn('c1', 'alice');
+    const effects = attemptPassAccountAuth(conn, makeCtx(conn, services), 'alice:hunter2');
+    expect(conn.account).toBe('alice');
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(true);
+  });
+});
+
 // ============================================================================
 // AC: NickServ REGISTER → SASL PLAIN succeeds with the same password
 // ============================================================================
@@ -127,12 +199,12 @@ describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
   it('a freshly NickServ-registered nick authenticates via SASL PLAIN with no second registration', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
     const registrar = makeConn('c-reg', 'alice');
-    const regCtx = makeCtx(registrar, undefined, services);
+    const regCtx = makeCtx(registrar, services);
     nickservReducer(registrar, privmsg('REGISTER hunter2 alice@example.com'), regCtx);
 
     // A second connection speaking SASL PLAIN with the same nick:password.
     const saslConn = saslReadyState('alice');
-    const saslCtx = makeCtx(saslConn, undefined, services);
+    const saslCtx = makeCtx(saslConn, services);
     authenticateReducer(saslConn, authenticate('PLAIN'), saslCtx);
     const out = authenticateReducer(
       saslConn,
@@ -155,11 +227,11 @@ describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
     nickservReducer(
       registrar,
       privmsg('REGISTER hunter2 alice@example.com'),
-      makeCtx(registrar, undefined, services),
+      makeCtx(registrar, services),
     );
 
     const saslConn = saslReadyState('alice');
-    const saslCtx = makeCtx(saslConn, undefined, services);
+    const saslCtx = makeCtx(saslConn, services);
     authenticateReducer(saslConn, authenticate('PLAIN'), saslCtx);
     const out = authenticateReducer(
       saslConn,
@@ -179,10 +251,10 @@ describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
 describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', () => {
   it('NickServ INFO resolves an account seeded into the unified store', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
 
     const conn = makeConn('c1', 'bob');
-    const out = nickservReducer(conn, privmsg('INFO alice'), makeCtx(conn, undefined, services));
+    const out = nickservReducer(conn, privmsg('INFO alice'), makeCtx(conn, services));
 
     const texts = sentTexts(out.effects);
     expect(texts).toContain(':NickServ!NickServ@services NOTICE bob :Nick: alice');
@@ -191,22 +263,18 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 
   it('NickServ isRegisteredNick resolves a seeded SASL account', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     expect(services.isRegisteredNick('alice')).toBe(true);
     expect(services.isRegisteredNick('ALICE')).toBe(true);
   });
 
   it('NickServ SET ENFORCE applies to a seeded SASL account once identified', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
     conn.account = 'alice';
     conn.userModes.registered = true;
-    const out = nickservReducer(
-      conn,
-      privmsg('SET ENFORCE kill'),
-      makeCtx(conn, undefined, services),
-    );
+    const out = nickservReducer(conn, privmsg('SET ENFORCE kill'), makeCtx(conn, services));
 
     expect(services.getNickEnforce('alice')).toBe<NickEnforcePolicy>('kill');
     expect(sentTexts(out.effects)).toContain(
@@ -216,13 +284,9 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 
   it('NickServ IDENTIFY succeeds against a seeded SASL account', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
-    const out = nickservReducer(
-      conn,
-      privmsg('IDENTIFY hunter2'),
-      makeCtx(conn, undefined, services),
-    );
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), makeCtx(conn, services));
 
     expect(conn.account).toBe('alice');
     expect(conn.userModes.registered).toBe(true);
@@ -233,9 +297,9 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 
   it('NickServ IDENTIFY with the wrong password fails against a seeded SASL account', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
-    const out = nickservReducer(conn, privmsg('IDENTIFY nope'), makeCtx(conn, undefined, services));
+    const out = nickservReducer(conn, privmsg('IDENTIFY nope'), makeCtx(conn, services));
 
     expect(conn.account).toBeUndefined();
     expect(sentTexts(out.effects)).toContain(
@@ -243,14 +307,14 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
     );
   });
 
-  it('a NickServ REGISTER does not overwrite an ingested SASL credential', () => {
+  it('a NickServ REGISTER does not overwrite an existing credential', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
     const out = nickservReducer(
       conn,
       privmsg('REGISTER otherpw alice@example.com'),
-      makeCtx(conn, undefined, services),
+      makeCtx(conn, services),
     );
 
     expect(sentTexts(out.effects)).toContain(
@@ -260,14 +324,6 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
     expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
     expect(services.verifyNick('alice', 'otherpw').ok).toBe(false);
   });
-
-  it('ingestAccountCredential returns false when the nick is already registered', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.registerNick('alice', 'hunter2', 'alice@example.com');
-    expect(services.ingestAccountCredential(hashAccountCredential('alice', 'otherpw'))).toBe(false);
-    // The original credential still verifies.
-    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
-  });
 });
 
 // ============================================================================
@@ -277,15 +333,11 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 describe('T156 unified account: IDENTIFY vs SASL downstream parity', () => {
   it('IDENTIFY delivers queued memos (parity with SASL success)', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'hello', sentAt: NOW });
 
     const conn = makeConn('c1', 'alice');
-    const out = nickservReducer(
-      conn,
-      privmsg('IDENTIFY hunter2'),
-      makeCtx(conn, undefined, services),
-    );
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), makeCtx(conn, services));
 
     expect(sentTexts(out.effects)).toContain(
       ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] hello',
@@ -294,9 +346,9 @@ describe('T156 unified account: IDENTIFY vs SASL downstream parity', () => {
 
   it('both paths share applyAccountSuccess for +r stamping', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
-    const ctx = makeCtx(conn, undefined, services);
+    const ctx = makeCtx(conn, services);
 
     const effects = applyAccountSuccess(conn, ctx, 'alice');
 
@@ -356,6 +408,9 @@ describe('T156 unified account: scrypt-hashed credentials at rest', () => {
           email: 'l@x',
           createdAt: NOW,
           enforce: 'none',
+          certSubjects: [],
+          identifyFailures: [],
+          pendingIdentifyFailureNotice: 0,
           // Malformed credential — empty hash, rejected by verifyHashedPassword.
           credential: { account: 'legacy', algorithm: 'scrypt', salt: 's', hash: '' },
         },
@@ -379,38 +434,3 @@ describe('T156 unified account: scrypt-hashed credentials at rest', () => {
     expect(JSON.stringify(snap.nicks[0])).not.toContain('hunter2');
   });
 });
-
-// ============================================================================
-// Adapter ingestion contract: ingestAccountCredential accepts HashedAccountCredential
-// ============================================================================
-
-describe('T156 unified account: ingestAccountCredential', () => {
-  it('creates a registered nick with default email / enforce from a hashed credential', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    const cred = hashAccountCredential('alice', 'hunter2');
-    expect(services.ingestAccountCredential(cred)).toBe(true);
-    expect(services.isRegisteredNick('alice')).toBe(true);
-    const rec = services.getNick('alice');
-    expect(rec).toBeDefined();
-    if (rec !== undefined) {
-      expect(rec.account).toBe('alice');
-      expect(rec.enforce).toBe<NickEnforcePolicy>('none');
-    }
-    // verifyNick goes through the same scrypt path as registerNick.
-    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
-  });
-
-  it('preserves the original spelling of the account name', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    const cred: HashedAccountCredential = {
-      account: 'Alice',
-      algorithm: 'scrypt',
-      salt: 's',
-      hash: 'aGVsbG8=',
-    };
-    services.ingestAccountCredential(cred);
-    const rec = services.getNick('Alice');
-    expect(rec?.nick).toBe('Alice');
-    expect(rec?.account).toBe('Alice');
-  });
-});