serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/config.test.ts

@@ -4,6 +4,7 @@ import {
   DEFAULT_CREATED_TEXT,
   ServerConfigSchema,
   formatCreatedAt,
+  narrowOperCred,
   parseServerConfig,
   resolveServerVersion,
 } from '../src/config';
@@ -327,7 +328,8 @@ describe('ServerConfigSchema — operCreds', () => {
     });
     expect(cfg.operCreds).toHaveLength(2);
     expect(cfg.operCreds[0]?.user).toBe('op1');
-    expect(cfg.operCreds[1]?.password).toBe('p2');
+    const second = cfg.operCreds[1];
+    expect(second !== undefined && 'password' in second ? second.password : undefined).toBe('p2');
   });
 
   it('defaults operCreds to an empty array when omitted', () => {
@@ -384,6 +386,120 @@ describe('ServerConfigSchema — operCreds', () => {
       }),
     ).toThrowError(/operCreds/u);
   });
+
+  it('accepts the new hashed form {user, salt, hash}', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      operCreds: [{ user: 'admin', salt: 'c2FsdA==', hash: 'aGFzaA==' }],
+    });
+    expect(cfg.operCreds).toHaveLength(1);
+    expect(cfg.operCreds[0]).toEqual({
+      user: 'admin',
+      salt: 'c2FsdA==',
+      hash: 'aGFzaA==',
+    });
+  });
+
+  it('accepts a mix of legacy plaintext and hashed creds', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      operCreds: [
+        { user: 'legacy', password: 'p' },
+        { user: 'hashed', salt: 'c2FsdA==', hash: 'aGFzaA==' },
+      ],
+    });
+    expect(cfg.operCreds).toHaveLength(2);
+  });
+
+  it('rejects a hashed cred missing salt', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', hash: 'aGFzaA==' }],
+      }),
+    ).toThrowError(/salt/u);
+  });
+
+  it('rejects a hashed cred missing hash', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', salt: 'c2FsdA==' }],
+      }),
+    ).toThrowError(/hash/u);
+  });
+
+  it('rejects a hashed cred with empty salt', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', salt: '', hash: 'aGFzaA==' }],
+      }),
+    ).toThrowError(/salt/u);
+  });
+
+  it('rejects a hashed cred with empty hash', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', salt: 'c2FsdA==', hash: '' }],
+      }),
+    ).toThrowError(/hash/u);
+  });
+
+  it('rejects a cred that mixes plaintext password and hashed salt/hash', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', password: 'p', salt: 'c2FsdA==', hash: 'aGFzaA==' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('rejects a cred that mixes plaintext password with only salt', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', password: 'p', salt: 'c2FsdA==' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+});
+
+// ============================================================================
+// narrowOperCred — loose parse output → OperCred union narrowing
+// ============================================================================
+
+describe('narrowOperCred', () => {
+  it('narrows to the plaintext shape when password is present', () => {
+    expect(narrowOperCred({ user: 'op', password: 'p' })).toEqual({
+      user: 'op',
+      password: 'p',
+    });
+  });
+
+  it('narrows to the hashed shape when salt + hash are present', () => {
+    expect(narrowOperCred({ user: 'op', salt: 's', hash: 'h' })).toEqual({
+      user: 'op',
+      salt: 's',
+      hash: 'h',
+    });
+  });
+
+  it('is total: a bare {user} input falls back to empty salt/hash (defensive only)', () => {
+    // Unreachable through parseServerConfig (the superRefine rejects a
+    // cred with no authentication fields); asserted so the defensive
+    // fallback branch is covered and the helper is total.
+    expect(narrowOperCred({ user: 'op' })).toEqual({ user: 'op', salt: '', hash: '' });
+  });
 });
 
 // ============================================================================
@@ -516,6 +632,41 @@ describe('ServerConfigSchema — limit knobs', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — draft/multiline limits
+// ============================================================================
+
+describe('ServerConfigSchema — draft/multiline limits', () => {
+  it('defaults multilineMaxBytes to the IRCv3-recommended 4096', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.multilineMaxBytes).toBe(4096);
+  });
+
+  it('defaults multilineMaxEntries to 100 (defense-in-depth entry cap)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.multilineMaxEntries).toBe(100);
+  });
+
+  it('accepts a custom multilineMaxEntries', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      multilineMaxEntries: 250,
+    });
+    expect(cfg.multilineMaxEntries).toBe(250);
+  });
+
+  it('rejects non-positive multilineMaxEntries', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        multilineMaxEntries: 0,
+      }),
+    ).toThrowError(/multilineMaxEntries/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — failure diagnostics
 // ============================================================================
@@ -830,6 +981,56 @@ describe('ServerConfigSchema — perIpConnectionRate', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — oper (failed-OPER lockout tunables)
+// ============================================================================
+
+describe('ServerConfigSchema — oper lockout tunables', () => {
+  it('defaults oper.maxFailures to 3 and oper.failureWindowSeconds to 300 when omitted', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.oper).toEqual({ maxFailures: 3, failureWindowSeconds: 300 });
+  });
+
+  it('accepts explicit positive integers for both fields', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      oper: { maxFailures: 5, failureWindowSeconds: 60 },
+    });
+    expect(cfg.oper).toEqual({ maxFailures: 5, failureWindowSeconds: 60 });
+  });
+
+  it('rejects zero maxFailures', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        oper: { maxFailures: 0, failureWindowSeconds: 300 },
+      }),
+    ).toThrowError(/maxFailures/u);
+  });
+
+  it('rejects a non-integer failureWindowSeconds', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        oper: { maxFailures: 3, failureWindowSeconds: 1.5 },
+      }),
+    ).toThrowError(/failureWindowSeconds/u);
+  });
+
+  it('rejects a non-object oper value', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        oper: 'strict',
+      }),
+    ).toThrowError(/oper/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — sts (Strict Transport Security)
 // ============================================================================
@@ -909,6 +1110,56 @@ describe('ServerConfigSchema — sts', () => {
   });
 });
 
+// ============================================================================
+// ServerConfigSchema — chathistory (limit ceiling)
+// ============================================================================
+
+describe('ServerConfigSchema — chathistory limit ceiling', () => {
+  it('defaults chathistory.maxLimit to 100 when omitted', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.chathistory).toEqual({ maxLimit: 100 });
+  });
+
+  it('accepts an explicit positive integer maxLimit', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      chathistory: { maxLimit: 250 },
+    });
+    expect(cfg.chathistory?.maxLimit).toBe(250);
+  });
+
+  it('rejects zero maxLimit', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        chathistory: { maxLimit: 0 },
+      }),
+    ).toThrowError(/maxLimit/u);
+  });
+
+  it('rejects a non-integer maxLimit', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        chathistory: { maxLimit: 1.5 },
+      }),
+    ).toThrowError(/maxLimit/u);
+  });
+
+  it('rejects a non-object chathistory value', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        chathistory: 'unlimited',
+      }),
+    ).toThrowError(/chathistory/u);
+  });
+});
+
 // ============================================================================
 // ServerConfigSchema — hostservAutoApproveVhosts
 // ============================================================================
@@ -919,11 +1170,12 @@ describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
     expect(cfg.hostservAutoApproveVhosts).toBe(false);
   });
 
-  it('accepts an explicit true (auto-approve mode)', () => {
+  it('accepts an explicit true (auto-approve mode) with a non-empty allowlist', () => {
     const cfg = parseServerConfig({
       serverName: 's',
       networkName: 'n',
       hostservAutoApproveVhosts: true,
+      hostservAutoApproveAllowlist: ['users.example.com'],
     });
     expect(cfg.hostservAutoApproveVhosts).toBe(true);
   });
@@ -937,6 +1189,73 @@ describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
     expect(cfg.hostservAutoApproveVhosts).toBe(false);
   });
 
+  it('refuses to boot auto-approve mode when the allowlist is omitted', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveVhosts: true,
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
+  it('refuses to boot auto-approve mode when the allowlist is empty', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveVhosts: true,
+        hostservAutoApproveAllowlist: [],
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
+  it('accepts auto-approve mode when the allowlist is non-empty', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      hostservAutoApproveVhosts: true,
+      hostservAutoApproveAllowlist: ['users.example.com'],
+    });
+    expect(cfg.hostservAutoApproveVhosts).toBe(true);
+    expect(cfg.hostservAutoApproveAllowlist).toEqual(['users.example.com']);
+  });
+
+  it('defaults the allowlist to empty in queue mode (allowlist unconstrained)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.hostservAutoApproveAllowlist).toEqual([]);
+  });
+
+  it('accepts a non-empty allowlist even in queue mode (unused but legal)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      hostservAutoApproveVhosts: false,
+      hostservAutoApproveAllowlist: ['a.example.com', '*.b.example.com'],
+    });
+    expect(cfg.hostservAutoApproveAllowlist).toEqual(['a.example.com', '*.b.example.com']);
+  });
+
+  it('rejects an allowlist entry that is not a non-empty string', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveAllowlist: [''],
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
+  it('rejects a non-array allowlist', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        hostservAutoApproveAllowlist: 'users.example.com',
+      }),
+    ).toThrowError(/hostservAutoApproveAllowlist/u);
+  });
+
   it('rejects a non-boolean value', () => {
     expect(() =>
       parseServerConfig({
@@ -947,3 +1266,216 @@ describe('ServerConfigSchema — hostservAutoApproveVhosts', () => {
     ).toThrowError(/hostservAutoApproveVhosts/u);
   });
 });
+
+// ============================================================================
+// ServerConfigSchema — sasl (per-connection failure lockout tunables)
+// ============================================================================
+
+describe('ServerConfigSchema — sasl', () => {
+  it('defaults sasl to undefined when omitted (reducer falls back to 3 / 60)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.sasl).toBeUndefined();
+  });
+
+  it('accepts an explicit sasl config with maxFailures + failureWindowSeconds', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { maxFailures: 5, failureWindowSeconds: 120 },
+    });
+    expect(cfg.sasl).toEqual({ maxFailures: 5, failureWindowSeconds: 120 });
+  });
+
+  it('accepts a partial sasl config (each knob is independently optional)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { maxFailures: 2 },
+    });
+    expect(cfg.sasl).toEqual({ maxFailures: 2 });
+  });
+
+  it('leaves externalEnabled unset when the sasl section is absent (EXTERNAL off)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.sasl?.externalEnabled ?? false).toBe(false);
+  });
+
+  it('accepts sasl.externalEnabled true (operators opt in to SASL EXTERNAL)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { externalEnabled: true },
+    });
+    expect(cfg.sasl?.externalEnabled).toBe(true);
+  });
+
+  it('leaves externalEnabled unset within a partial sasl section (other knobs alone do not enable it)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { maxFailures: 5, failureWindowSeconds: 120 },
+    });
+    expect(cfg.sasl?.externalEnabled ?? false).toBe(false);
+  });
+
+  it('accepts sasl.externalEnabled false (explicit opt-out)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { externalEnabled: false },
+    });
+    expect(cfg.sasl?.externalEnabled).toBe(false);
+  });
+
+  it('rejects a non-boolean externalEnabled', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { externalEnabled: 'yes' } }),
+    ).toThrowError(/externalEnabled/u);
+  });
+
+  it('accepts sasl.externalUnsupportedMessage (transport-level EXTERNAL non-support)', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      sasl: { externalUnsupportedMessage: 'SASL EXTERNAL not supported on this transport' },
+    });
+    expect(cfg.sasl?.externalUnsupportedMessage).toBe(
+      'SASL EXTERNAL not supported on this transport',
+    );
+  });
+
+  it('rejects an empty-string externalUnsupportedMessage', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        sasl: { externalUnsupportedMessage: '' },
+      }),
+    ).toThrowError(/externalUnsupportedMessage/u);
+  });
+
+  it('rejects a non-string externalUnsupportedMessage', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        sasl: { externalUnsupportedMessage: 42 },
+      }),
+    ).toThrowError(/externalUnsupportedMessage/u);
+  });
+
+  it('rejects a zero maxFailures', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { maxFailures: 0 } }),
+    ).toThrowError(/sasl/u);
+  });
+
+  it('rejects a zero failureWindowSeconds', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { failureWindowSeconds: 0 } }),
+    ).toThrowError(/sasl/u);
+  });
+
+  it('rejects a non-number maxFailures', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: { maxFailures: '3' } }),
+    ).toThrowError(/sasl/u);
+  });
+
+  it('rejects a non-object sasl value', () => {
+    expect(() =>
+      parseServerConfig({ serverName: 's', networkName: 'n', sasl: 'PLAIN' }),
+    ).toThrowError(/sasl/u);
+  });
+});
+
+// ============================================================================
+// ServerConfigSchema — nickServ identify-freeze knobs
+// ============================================================================
+
+describe('ServerConfigSchema — nickServ identify freeze', () => {
+  it('leaves the freeze knobs unset when omitted (reducer applies defaults)', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.nickServ?.maxIdentifyFailures).toBeUndefined();
+    expect(cfg.nickServ?.identifyFreezeSeconds).toBeUndefined();
+  });
+
+  it('accepts explicit maxIdentifyFailures + identifyFreezeSeconds', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      nickServ: { maxIdentifyFailures: 3, identifyFreezeSeconds: 120 },
+    });
+    expect(cfg.nickServ?.maxIdentifyFailures).toBe(3);
+    expect(cfg.nickServ?.identifyFreezeSeconds).toBe(120);
+  });
+
+  it('rejects a non-positive maxIdentifyFailures', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        nickServ: { maxIdentifyFailures: 0 },
+      }),
+    ).toThrowError(/maxIdentifyFailures/u);
+  });
+
+  it('rejects a non-integer identifyFreezeSeconds', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        nickServ: { identifyFreezeSeconds: 1.5 },
+      }),
+    ).toThrowError(/identifyFreezeSeconds/u);
+  });
+});
+
+// ============================================================================
+// ServerConfigSchema — adapter inbound frame-rate limit
+// ============================================================================
+
+describe('ServerConfigSchema — adapter frame-rate limit', () => {
+  it('defaults the adapter frame window to 50 frames / 5 seconds', () => {
+    const cfg = parseServerConfig({ serverName: 's', networkName: 'n' });
+    expect(cfg.adapter).toEqual({ maxFramesPerWindow: 50, frameWindowSeconds: 5 });
+  });
+
+  it('accepts explicit adapter frame-window overrides', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      adapter: { maxFramesPerWindow: 10, frameWindowSeconds: 2 },
+    });
+    expect(cfg.adapter).toEqual({ maxFramesPerWindow: 10, frameWindowSeconds: 2 });
+  });
+
+  it('fills a partially-supplied adapter section with per-field defaults', () => {
+    const cfg = parseServerConfig({
+      serverName: 's',
+      networkName: 'n',
+      adapter: { frameWindowSeconds: 30 },
+    });
+    expect(cfg.adapter).toEqual({ maxFramesPerWindow: 50, frameWindowSeconds: 30 });
+  });
+
+  it('rejects a non-positive maxFramesPerWindow', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        adapter: { maxFramesPerWindow: 0 },
+      }),
+    ).toThrowError(/maxFramesPerWindow/u);
+  });
+
+  it('rejects a non-integer frameWindowSeconds', () => {
+    expect(() =>
+      parseServerConfig({
+        serverName: 's',
+        networkName: 'n',
+        adapter: { frameWindowSeconds: 1.5 },
+      }),
+    ).toThrowError(/frameWindowSeconds/u);
+  });
+});

package/packages/irc-core/tests/credential-hashing.test.ts

@@ -1,11 +1,9 @@
 import { describe, expect, it } from 'vitest';
 import {
   type HashedAccountCredential,
-  HashedAccountStore,
   hashAccountCredential,
   verifyHashedPassword,
 } from '../src/credential-hashing';
-import type { AccountStore, SaslPayload } from '../src/ports';
 
 describe('hashAccountCredential', () => {
   it('produces an entry keyed by the username with scrypt', () => {
@@ -92,79 +90,3 @@ describe('verifyHashedPassword', () => {
     expect(verifyHashedPassword('s3cret', entry)).toBe(false);
   });
 });
-
-describe('HashedAccountStore', () => {
-  function plain(username: string, password: string): SaslPayload {
-    return { kind: 'PLAIN', username, password };
-  }
-
-  it('implements the AccountStore port', () => {
-    const store: AccountStore = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store).toBeDefined();
-  });
-
-  it('accepts valid PLAIN credentials and returns the account name', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', plain('alice', 's3cret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-
-  it('rejects a wrong password', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', plain('alice', 'wrong')).ok).toBe(false);
-  });
-
-  it('rejects an unknown username', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', plain('bob', 's3cret')).ok).toBe(false);
-  });
-
-  it('rejects a non-PLAIN mechanism', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('EXTERNAL', plain('alice', 's3cret')).ok).toBe(false);
-  });
-
-  it('rejects a RAW payload', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', { kind: 'RAW', data: 'whatever' }).ok).toBe(false);
-  });
-
-  it('handles multiple loaded accounts', () => {
-    const store = new HashedAccountStore([
-      hashAccountCredential('alice', 'a-secret'),
-      hashAccountCredential('bob', 'b-secret'),
-    ]);
-    expect(store.verify('PLAIN', plain('alice', 'a-secret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-    expect(store.verify('PLAIN', plain('bob', 'b-secret'))).toEqual({
-      ok: true,
-      account: 'bob',
-    });
-  });
-
-  it('fails every verify when constructed with no entries', () => {
-    const store = new HashedAccountStore([]);
-    expect(store.verify('PLAIN', plain('alice', 's3cret')).ok).toBe(false);
-  });
-
-  it('reports the number of loaded entries via size', () => {
-    const store = new HashedAccountStore([
-      hashAccountCredential('alice', 'a'),
-      hashAccountCredential('bob', 'b'),
-    ]);
-    expect(store.size).toBe(2);
-  });
-
-  it('round-trips an externally-constructed HashedAccountCredential', () => {
-    const row: HashedAccountCredential = hashAccountCredential('carol', 'p@ss');
-    const store = new HashedAccountStore([row]);
-    expect(store.verify('PLAIN', plain('carol', 'p@ss'))).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-});