serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/effects.test.ts

@@ -95,6 +95,18 @@ describe('Effect constructors', () => {
     });
   });
 
+  it('BroadcastOperNotice carries lines and optional except', () => {
+    expect(Effect.broadcastOperNotice([line(':s NOTICE * :lockout')])).toEqual<EffectType>({
+      tag: 'BroadcastOperNotice',
+      lines: [{ text: ':s NOTICE * :lockout' }],
+    });
+    expect(Effect.broadcastOperNotice([line(':s NOTICE * :lockout')], 'c1')).toEqual<EffectType>({
+      tag: 'BroadcastOperNotice',
+      lines: [{ text: ':s NOTICE * :lockout' }],
+      except: 'c1',
+    });
+  });
+
   it('EnforceNick carries conn, nick, policy, and graceMs', () => {
     expect(Effect.enforceNick('c1', 'alice', 'kill', 0)).toEqual<EffectType>({
       tag: 'EnforceNick',
@@ -125,6 +137,7 @@ describe('Effect tag set', () => {
     'ApplyChannelDelta',
     'SendToNick',
     'BroadcastWallops',
+    'BroadcastOperNotice',
     'EnforceNick',
   ];
 
@@ -139,6 +152,7 @@ describe('Effect tag set', () => {
       ApplyChannelDelta: Effect.applyChannelDelta('#c', { memberships: [] }),
       SendToNick: Effect.sendToNick('n', 'c', []),
       BroadcastWallops: Effect.broadcastWallops([]),
+      BroadcastOperNotice: Effect.broadcastOperNotice([]),
       EnforceNick: Effect.enforceNick('c', 'n', 'none', 0),
     };
     expect(constructors[tag].tag).toBe(tag);

package/packages/irc-core/tests/flood-control.test.ts

@@ -286,13 +286,41 @@ describe('wrapWithFloodControl — generic over inner state', () => {
 
 describe('wrapWithFloodControl — per-command cost (commandCost)', () => {
   it('defaultCommandCost returns 0 for the control-plane exempt set and 1 otherwise', () => {
-    for (const command of ['PING', 'PONG', 'CAP', 'AUTHENTICATE', 'QUIT']) {
+    for (const command of ['PING', 'PONG', 'CAP', 'QUIT']) {
       expect(defaultCommandCost(command)).toBe(0);
     }
     expect(defaultCommandCost('PRIVMSG')).toBe(1);
     expect(defaultCommandCost('JOIN')).toBe(1);
   });
 
+  it('AUTHENTICATE is NOT exempt — it consumes the default flood bucket', () => {
+    // SASL brute-force hardening: an attacker spamming AUTHENTICATE must
+    // not get a free pass. The per-connection SASL failure tracker in the
+    // SASL reducer is the second, orthogonal defense.
+    expect(defaultCommandCost('AUTHENTICATE')).toBe(1);
+  });
+
+  it('an AUTHENTICATE burst drains the bucket like PRIVMSG would', () => {
+    const state = makeState();
+    const clock = new FakeClock(1_000);
+    const ctx = makeCtx(state, clock);
+    const inner = countingReducer();
+    const wrapped = wrapWithFloodControl(inner.reducer, {
+      capacity: 2,
+      refillRatePerSecond: 1,
+      disconnectThreshold: 0,
+      commandCost: defaultCommandCost,
+    });
+
+    wrapped(state, ircMessage('AUTHENTICATE', ['PLAIN']), ctx);
+    wrapped(state, ircMessage('AUTHENTICATE', ['dGVzdA==']), ctx);
+    expect(inner.getCalls()).toBe(2);
+
+    const out = wrapped(state, ircMessage('AUTHENTICATE', ['*']), ctx);
+    expect(out.effects).toEqual<EffectType[]>([Effect.disconnect('c1', EXCESS_FLOOD_REASON)]);
+    expect(inner.getCalls()).toBe(2);
+  });
+
   it('delegates a cost-0 PING to the inner reducer even when the bucket is exhausted', () => {
     const state = makeState();
     const clock = new FakeClock(1_000);

package/packages/irc-core/tests/frame-rate-limit.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Per-connection inbound frame-rate window (`admitFrameWindow`).
+ *
+ * Pure sliding-window admission policy shared by the adapters' inbound
+ * frame gates: a connection may deliver at most `maxFrames`
+ * frames inside any `windowMs` window; the frame that would exceed the
+ * budget is rejected so the adapter can close the connection before the
+ * actor / storage write runs.
+ *
+ * Coverage matrix: under-threshold, at-threshold,
+ * over-threshold, and the sliding-window decay.
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  FRAME_FLOOD_CLOSE_CODE,
+  FRAME_FLOOD_ERROR_LINE,
+  admitFrameWindow,
+} from '../src/frame-rate-limit';
+
+describe('admitFrameWindow', () => {
+  it('admits a frame while the window holds fewer than maxFrames entries (under-threshold)', () => {
+    const decision = admitFrameWindow([1_000, 2_000], 3_000, 50, 5_000);
+    expect(decision.admitted).toBe(true);
+    expect(decision.times).toEqual([1_000, 2_000, 3_000]);
+  });
+
+  it('admits an empty window (first frame of a connection)', () => {
+    const decision = admitFrameWindow([], 42, 50, 5_000);
+    expect(decision.admitted).toBe(true);
+    expect(decision.times).toEqual([42]);
+  });
+
+  it('admits exactly the maxFrames-th frame in the window (at-threshold)', () => {
+    const times = Array.from({ length: 49 }, (_, i) => i + 1);
+    const decision = admitFrameWindow(times, 50, 50, 5_000);
+    expect(decision.admitted).toBe(true);
+    expect(decision.times.length).toBe(50);
+  });
+
+  it('rejects the maxFrames+1-th frame within the window (over-threshold)', () => {
+    const times = Array.from({ length: 50 }, (_, i) => i + 1);
+    const decision = admitFrameWindow(times, 51, 50, 5_000);
+    expect(decision.admitted).toBe(false);
+    // The rejected frame is NOT recorded; the caller keeps the pruned view.
+    expect(decision.times.length).toBe(50);
+  });
+
+  it('ages entries out of the window so old frames stop counting (sliding-window decay)', () => {
+    // 50 frames at t=0..49; 6 s after the first frame every entry has
+    // aged out of the 5 s window, so the connection starts fresh.
+    const times = Array.from({ length: 50 }, (_, i) => i);
+    const decision = admitFrameWindow(times, 6_049, 50, 5_000);
+    expect(decision.admitted).toBe(true);
+    expect(decision.times).toEqual([6_049]);
+  });
+
+  it('partially decays a window (entries inside the window still count)', () => {
+    // Frames at t=0 and t=4_000; at t=5_500 only the t=0 entry has aged
+    // out of the 5 s window — the recent one still counts, so this frame
+    // fits a max=2 budget.
+    const decision = admitFrameWindow([0, 4_000], 5_500, 2, 5_000);
+    expect(decision.admitted).toBe(true);
+    expect(decision.times).toEqual([4_000, 5_500]);
+  });
+
+  it('keeps an entry at exactly now - windowMs inside the window (inclusive boundary)', () => {
+    const decision = admitFrameWindow([1_000], 6_000, 1, 5_000);
+    // 1_000 >= 6_000 - 5_000 → still counted, so this frame exceeds max=1.
+    expect(decision.admitted).toBe(false);
+    expect(decision.times).toEqual([1_000]);
+  });
+
+  it('drops entries older than the window even when the frame is rejected', () => {
+    // t=0 has aged out at now=6_100 (5 s window); the two recent entries
+    // fill the max=2 budget → rejected, and the decayed entry is gone
+    // from the retained window.
+    const decision = admitFrameWindow([0, 6_000, 6_050], 6_100, 2, 5_000);
+    expect(decision.admitted).toBe(false);
+    expect(decision.times).toEqual([6_000, 6_050]);
+  });
+
+  it('does not mutate the caller-supplied times array (pure)', () => {
+    const times = [1, 2, 3];
+    admitFrameWindow(times, 4, 50, 5_000);
+    expect(times).toEqual([1, 2, 3]);
+  });
+});
+
+describe('frame-flood close constants', () => {
+  it('uses RFC 6455 close code 1008 (Policy Violation)', () => {
+    expect(FRAME_FLOOD_CLOSE_CODE).toBe(1008);
+  });
+
+  it('delivers the canonical flooding ERROR line before the close', () => {
+    expect(FRAME_FLOOD_ERROR_LINE).toBe('ERROR :Closing link (flooding)');
+  });
+});

package/packages/irc-core/tests/message-store.test.ts

@@ -590,4 +590,9 @@ describe('InMemoryMessageStore — getMsg (msgid -> message)', () => {
     const store = seededStore();
     expect(store.getMsg('#FoO', 'm2')?.msgid).toBe('m2');
   });
+
+  it('returns undefined for a channel with no recorded messages', () => {
+    const store = seededStore();
+    expect(store.getMsg('#empty', 'm1')).toBeUndefined();
+  });
 });

package/packages/irc-core/tests/oper-hashing.test.ts

@@ -0,0 +1,60 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { matchOperCred, resetOperLegacyPlaintextWarning } from '../src/commands/oper';
+import { hashAccountCredential } from '../src/credential-hashing';
+import { type OperCredHashed, hashOperCredential } from '../src/oper-hashing';
+
+describe('hashOperCredential', () => {
+  afterEach(() => {
+    resetOperLegacyPlaintextWarning();
+  });
+
+  it('emits a {user, salt, hash} triple with non-empty base64 fields', () => {
+    const out = hashOperCredential('admin', 's3cret');
+    expect(out.user).toBe('admin');
+    expect(out.salt.length).toBeGreaterThan(0);
+    expect(out.hash.length).toBeGreaterThan(0);
+    // base64 alphabet only (no whitespace, no plaintext leakage).
+    expect(out.salt).toMatch(/^[A-Za-z0-9+/]+=*$/u);
+    expect(out.hash).toMatch(/^[A-Za-z0-9+/]+=*$/u);
+  });
+
+  it('never stores the plaintext password in any field', () => {
+    const out = hashOperCredential('admin', 'hunter2-secret');
+    expect(out.user).not.toContain('hunter2');
+    expect(out.salt).not.toContain('hunter2');
+    expect(out.hash).not.toContain('hunter2');
+  });
+
+  it('produces a fresh random salt per call (no two salts collide)', () => {
+    const a = hashOperCredential('admin', 's3cret');
+    const b = hashOperCredential('admin', 's3cret');
+    expect(a.salt).not.toBe(b.salt);
+    expect(a.hash).not.toBe(b.hash);
+  });
+
+  it('honours a fixed salt for deterministic test scenarios', () => {
+    const salt = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]);
+    const a = hashOperCredential('admin', 's3cret', { salt });
+    const b = hashOperCredential('admin', 's3cret', { salt });
+    expect(a.hash).toBe(b.hash);
+  });
+
+  it('round-trips via matchOperCred: the hashed output verifies the original password', () => {
+    const cred = hashOperCredential('admin', 's3cret-password');
+    expect(matchOperCred([cred], 'admin', 's3cret-password')).toBe(true);
+    expect(matchOperCred([cred], 'admin', 'wrong')).toBe(false);
+  });
+
+  it('round-trips via verifyHashedPassword: the underlying scrypt entry is well-formed', () => {
+    const cred = hashOperCredential('admin', 's3cret');
+    const entry = hashAccountCredential('admin', 's3cret', {
+      salt: Uint8Array.from(Buffer.from(cred.salt, 'base64')),
+    });
+    expect(entry.hash).toBe(cred.hash);
+  });
+
+  it('returns an object assignable to the OperCredHashed type', () => {
+    const cred: OperCredHashed = hashOperCredential('admin', 's3cret');
+    expect(cred.user).toBe('admin');
+  });
+});

package/packages/irc-core/tests/oper-lockout.test.ts

@@ -0,0 +1,74 @@
+/**
+ * Unit tests for {@link OperFailureStats} — the runtime-owned per-IP
+ * failed-OPER counter (sliding window, AdmissionStats shape).
+ */
+
+import { describe, expect, it } from 'vitest';
+import { OperFailureStats } from '../src/oper-lockout';
+import { FakeClock } from '../src/ports';
+
+describe('OperFailureStats', () => {
+  it('reports zero recent failures for an unknown IP', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(0);
+  });
+
+  it('counts recorded failures within the window', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    stats.recordFailure('10.0.0.1');
+    clock.advance(1_000);
+    stats.recordFailure('10.0.0.1');
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(2);
+  });
+
+  it('prunes failures older than the window (sliding)', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    stats.recordFailure('10.0.0.1'); // t = 5_000
+    clock.advance(10_000);
+    stats.recordFailure('10.0.0.1'); // t = 15_000
+
+    // Window that excludes the first failure keeps only the second.
+    expect(stats.recentFailures('10.0.0.1', 9_000)).toBe(1);
+    // The prune is sticky: the stale entry is gone on the next read.
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(1);
+  });
+
+  it('deletes the per-IP entry when every recorded failure is stale', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    stats.recordFailure('10.0.0.1');
+    clock.advance(301_000);
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(0);
+    // A later failure for the same IP starts from a fresh entry.
+    stats.recordFailure('10.0.0.1');
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(1);
+  });
+
+  it('keeps per-IP accounting independent between IPs', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    stats.recordFailure('10.0.0.1');
+    stats.recordFailure('10.0.0.1');
+    expect(stats.recentFailures('10.0.0.2', 300_000)).toBe(0);
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(2);
+  });
+
+  it('reset clears every recorded failure for the IP', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    stats.recordFailure('10.0.0.1');
+    stats.recordFailure('10.0.0.1');
+    stats.reset('10.0.0.1');
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(0);
+  });
+
+  it('reset is a no-op for an IP with no recorded failures', () => {
+    const clock = new FakeClock(5_000);
+    const stats = new OperFailureStats(clock);
+    expect(() => stats.reset('10.0.0.1')).not.toThrow();
+    expect(stats.recentFailures('10.0.0.1', 300_000)).toBe(0);
+  });
+});

package/packages/irc-core/tests/outbound.test.ts

@@ -1,11 +1,13 @@
 import fc from 'fast-check';
 import { describe, expect, it } from 'vitest';
 import type { RawLine } from '../src/effects';
+import { byteLength } from '../src/protocol/bytes';
 import {
   MAX_LINE_BYTES,
   applyServerTime,
   enforceLineLimit,
   formatServerTime,
+  sanitizeLineText,
 } from '../src/protocol/outbound';
 import { parse } from '../src/protocol/parser';
 import { serialize } from '../src/protocol/serializer';
@@ -243,6 +245,152 @@ describe('enforceLineLimit — WsFrameMode budget', () => {
   });
 });
 
+// ============================================================================
+// enforceLineLimit — byte (not UTF-16 code-unit) accounting
+// ============================================================================
+
+describe('enforceLineLimit — multi-byte (UTF-8 byte) accounting', () => {
+  const TEXT_BUDGET = MAX_LINE_BYTES - 2;
+
+  it('truncates a 353 NAMES-style line that fits 510 UTF-16 units but exceeds 510 bytes', () => {
+    // Prefix is 23 ASCII bytes; 260 'é' nicks/text = 260 units but 520 bytes.
+    // Total: 283 code units (inside the old unit budget), 543 UTF-8 bytes.
+    const prefix = ':srv 353 alice = #chan :';
+    const line: RawLine = L(`${prefix}${'é'.repeat(260)}`);
+    expect(line.text.length).toBeLessThanOrEqual(TEXT_BUDGET);
+    expect(byteLength(line.text)).toBeGreaterThan(TEXT_BUDGET);
+
+    const out = enforceLineLimit(line, new Set<string>());
+    expect(out).not.toBe(line);
+    expect(out.text.startsWith(prefix)).toBe(true);
+    expect(byteLength(out.text)).toBeLessThanOrEqual(TEXT_BUDGET);
+  });
+
+  it('passes a multi-byte line whose UTF-8 length is exactly 510 bytes through unchanged', () => {
+    // "PRIVMSG #c :" (12 ASCII bytes) + 249 'é' (498 bytes) = 510 bytes in
+    // 261 code units.
+    const line: RawLine = L(`PRIVMSG #c :${'é'.repeat(249)}`);
+    expect(line.text.length).toBeLessThan(TEXT_BUDGET);
+    expect(byteLength(line.text)).toBe(TEXT_BUDGET);
+    expect(enforceLineLimit(line, new Set<string>())).toBe(line);
+  });
+
+  it('keeps the truncated output within the byte budget for a long multi-byte body', () => {
+    const line: RawLine = L(`:alice PRIVMSG #foo :${'é'.repeat(600)}`);
+    const out = enforceLineLimit(line, new Set<string>());
+    expect(byteLength(out.text)).toBeLessThanOrEqual(TEXT_BUDGET);
+    expect(out.text.startsWith(':alice PRIVMSG #foo :')).toBe(true);
+  });
+
+  it('never splits a surrogate pair when truncating multi-byte content', () => {
+    const prefix = ':alice PRIVMSG #foo :';
+    const line: RawLine = L(`${prefix}${'😀'.repeat(400)}`);
+    const out = enforceLineLimit(line, new Set<string>());
+    expect(byteLength(out.text)).toBeLessThanOrEqual(TEXT_BUDGET);
+    // A split pair would leave a half emoji at the end; the last code point
+    // must be a complete emoji.
+    expect(out.text.endsWith('😀')).toBe(true);
+  });
+
+  it('preserves the tag section verbatim and truncates the multi-byte body by bytes', () => {
+    const tagPrefix = '@time=2024-01-15T12:34:56.789Z '; // 31 bytes
+    const prefix = ':srv 353 alice = #chan :';
+    const line: RawLine = L(`${tagPrefix}${prefix}${'é'.repeat(300)}`);
+    const out = enforceLineLimit(line, new Set<string>(['message-tags']));
+    expect(out.text.startsWith(`${tagPrefix}${prefix}`)).toBe(true);
+    expect(byteLength(out.text)).toBeLessThanOrEqual(TEXT_BUDGET);
+  });
+
+  it('truncates the multi-byte body by bytes in spec-text mode too', () => {
+    const line: RawLine = L(`:alice PRIVMSG #foo :${'é'.repeat(400)}`);
+    const out = enforceLineLimit(line, new Set<string>(), 'spec-text');
+    expect(byteLength(out.text)).toBeLessThanOrEqual(MAX_WS_MESSAGE_BYTES);
+  });
+});
+
+// ============================================================================
+// sanitizeLineText — defense-in-depth CR stripping for RawLine.text
+// ============================================================================
+
+describe('sanitizeLineText', () => {
+  it('removes a bare CR embedded in the line text', () => {
+    // The 311 RPL_WHOISREALNAME shape: a realname carrying a CR would echo
+    // the control character verbatim into a client's frame stream.
+    const out = sanitizeLineText(L(':srv 311 me alice u h * :real\rname'));
+    expect(out.text).toBe(':srv 311 me alice u h * :realname');
+  });
+
+  it('removes every CR in the line text, not just the first', () => {
+    const out = sanitizeLineText(L('TOPIC #foo :a\rb\rc'));
+    expect(out.text).toBe('TOPIC #foo :abc');
+    expect(out.text.includes('\r')).toBe(false);
+  });
+
+  it('returns the same object when the text contains no CR', () => {
+    const line: RawLine = L(':alice PRIVMSG #foo :hi');
+    expect(sanitizeLineText(line)).toBe(line);
+  });
+
+  it('leaves LF untouched (CR-only hardening)', () => {
+    const out = sanitizeLineText(L('PRIVMSG #foo :a\nb'));
+    expect(out.text).toBe('PRIVMSG #foo :a\nb');
+  });
+
+  it('does not mutate the input RawLine', () => {
+    const original: RawLine = L('PRIVMSG #foo :a\rb');
+    sanitizeLineText(original);
+    expect(original.text).toBe('PRIVMSG #foo :a\rb');
+  });
+});
+
+// ============================================================================
+// enforceLineLimit — CR sanitization composes with the byte budget
+// ============================================================================
+
+describe('enforceLineLimit — CR sanitization before budget enforcement', () => {
+  const TEXT_BUDGET = MAX_LINE_BYTES - 2;
+
+  it('strips a bare CR from an otherwise in-budget line', () => {
+    const line: RawLine = L(':srv 311 me alice u h * :real\rname');
+    const out = enforceLineLimit(line, new Set<string>());
+    expect(out.text).toBe(':srv 311 me alice u h * :realname');
+  });
+
+  it('strips CR before measuring the budget so a line that fits after stripping is not truncated', () => {
+    // 21-byte prefix + 488 'x' + CR + 1 'x' = 511 units/bytes; stripping the
+    // single CR byte lands exactly on the 510 budget — no truncation.
+    const prefix = ':alice PRIVMSG #foo :';
+    const xs = 'x'.repeat(TEXT_BUDGET - prefix.length - 1);
+    const line: RawLine = L(`${prefix}${xs}\rx`);
+    expect(byteLength(line.text)).toBe(TEXT_BUDGET + 1);
+    const out = enforceLineLimit(line, new Set<string>());
+    expect(out.text).toBe(`${prefix}${xs}x`);
+    expect(byteLength(out.text)).toBe(TEXT_BUDGET);
+  });
+
+  it('keeps the output within budget when a CR-bearing line also needs truncation', () => {
+    const line: RawLine = L(`:alice PRIVMSG #foo :a\rb${'x'.repeat(600)}`);
+    const out = enforceLineLimit(line, new Set<string>());
+    expect(out.text.includes('\r')).toBe(false);
+    expect(byteLength(out.text)).toBe(TEXT_BUDGET);
+    expect(out.text.startsWith(':alice PRIVMSG #foo :ab')).toBe(true);
+  });
+
+  it('preserves the tag section while sanitizing CR from a tagged, over-budget line', () => {
+    const tagPrefix = '@time=2024-01-15T12:34:56.789Z ';
+    const line: RawLine = L(`${tagPrefix}:alice PRIVMSG #foo :a\rb${'x'.repeat(600)}`);
+    const out = enforceLineLimit(line, new Set<string>(['message-tags']));
+    expect(out.text.startsWith(tagPrefix)).toBe(true);
+    expect(out.text.includes('\r')).toBe(false);
+    expect(byteLength(out.text)).toBe(TEXT_BUDGET);
+  });
+
+  it('returns a CR-free line object unchanged (identity preserved for the common case)', () => {
+    const line: RawLine = L(':alice PRIVMSG #foo :hi');
+    expect(enforceLineLimit(line, new Set<string>())).toBe(line);
+  });
+});
+
 // ============================================================================
 // Round-trip through serialize -> applyServerTime -> parse
 // ============================================================================