serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/tests/services-store.test.ts

@@ -1,4 +1,6 @@
-import { describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { CERT_FP_PREFIX, certIdentityFromSubject } from '../src/certfp';
+import type { HashedAccountCredential } from '../src/credential-hashing';
 import {
   type ChannelLevelOp,
   type ChannelRegisterResult,
@@ -11,9 +13,15 @@ import {
   type ReadMarkerEntry,
   type RegisteredNick,
   type ServicesAuthResult,
+  type ServicesSnapshot,
   type ServicesStore,
+  VERIFY_NICK_PRECOMPUTED_DUMMY,
+  resetVerifyNickTimingSpy,
+  setVerifyNickHashedPassword,
 } from '../src/ports';
 
+type VerifyHashedPasswordFn = (password: string, entry: HashedAccountCredential) => boolean;
+
 const NOW = 1_700_000_000_000;
 
 function store(): InMemoryServicesStore {
@@ -116,6 +124,540 @@ describe('InMemoryServicesStore — NickServ IDENTIFY (verifyNick)', () => {
   });
 });
 
+// ============================================================================
+// verifyNick timing equalisation — the unknown-nick miss must perform the
+// same scrypt work as a wrong-password verify so callers (SASL PLAIN, PASS
+// auth, NickServ IDENTIFY/SETPASS) cannot enumerate registered nicks by
+// measuring latency.
+// ============================================================================
+
+describe('InMemoryServicesStore — verifyNick timing equalisation', () => {
+  afterEach(() => {
+    resetVerifyNickTimingSpy();
+  });
+
+  it('runs exactly one dummy scrypt verify on an unknown nick — no O(1) short-circuit', () => {
+    const s = store();
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setVerifyNickHashedPassword(spy);
+    try {
+      expect(s.verifyNick('ghost', 'hunter2').ok).toBe(false);
+      // Critical: a single dummy verify runs even though the nick is unknown,
+      // equalising wall-clock cost with the wrong-password path.
+      expect(spy).toHaveBeenCalledTimes(1);
+      // The dummy verify is fed the candidate password and runs against the
+      // fixed precomputed entry (never a real credential), exactly as a real
+      // verify would be — the cost is the point, the result is discarded.
+      expect(spy.mock.calls[0]?.[0]).toBe('hunter2');
+      expect(spy.mock.calls[0]?.[1]).toBe(VERIFY_NICK_PRECOMPUTED_DUMMY);
+    } finally {
+      setVerifyNickHashedPassword(null);
+    }
+  });
+
+  it('runs exactly one scrypt verify against the stored credential on a wrong password', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setVerifyNickHashedPassword(spy);
+    try {
+      expect(s.verifyNick('alice', 'wrong').ok).toBe(false);
+      expect(spy).toHaveBeenCalledTimes(1);
+      expect(spy.mock.calls[0]?.[0]).toBe('wrong');
+      expect(spy.mock.calls[0]?.[1]?.account).toBe('alice');
+    } finally {
+      setVerifyNickHashedPassword(null);
+    }
+  });
+
+  it('costs the same single verify on the unknown-nick and wrong-password paths', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    const unknownNick = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setVerifyNickHashedPassword(unknownNick);
+    try {
+      s.verifyNick('ghost', 'hunter2');
+    } finally {
+      setVerifyNickHashedPassword(null);
+    }
+    const wrongPassword = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setVerifyNickHashedPassword(wrongPassword);
+    try {
+      s.verifyNick('alice', 'wrong');
+    } finally {
+      setVerifyNickHashedPassword(null);
+    }
+    expect(unknownNick).toHaveBeenCalledTimes(1);
+    expect(wrongPassword).toHaveBeenCalledTimes(1);
+  });
+
+  it('still returns the identical failure result on the unknown-nick path', () => {
+    const s = store();
+    const spy = vi.fn<VerifyHashedPasswordFn>(() => false);
+    setVerifyNickHashedPassword(spy);
+    try {
+      expect(s.verifyNick('ghost', 'hunter2')).toEqual<ServicesAuthResult>({
+        ok: false,
+        reason: 'invalid credentials',
+      });
+    } finally {
+      setVerifyNickHashedPassword(null);
+    }
+  });
+
+  it('verifies a correct password through the same seam with no dummy call', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    const spy = vi.fn<VerifyHashedPasswordFn>((_pw, entry) => entry.account === 'alice');
+    setVerifyNickHashedPassword(spy);
+    try {
+      expect(s.verifyNick('alice', 'hunter2').ok).toBe(true);
+      expect(spy).toHaveBeenCalledTimes(1);
+    } finally {
+      setVerifyNickHashedPassword(null);
+    }
+  });
+});
+
+// ============================================================================
+// NickServ CertFP — hydrate round-trip (legacy snapshot without certSubjects)
+// ============================================================================
+
+describe('InMemoryServicesStore — CertFP snapshot hydration', () => {
+  it('defaults certSubjects to [] when a legacy snapshot row omits the field', () => {
+    // Simulate a pre-certSubjects snapshot: the row is missing the field
+    // entirely (as if loaded from JSON written before the column existed).
+    const legacySnap: ServicesSnapshot = {
+      nicks: [
+        {
+          nick: 'alice',
+          account: 'alice',
+          email: 'a@x',
+          createdAt: NOW,
+          enforce: 'none',
+          certSubjects: undefined as unknown as string[],
+          identifyFailures: [],
+          pendingIdentifyFailureNotice: 0,
+          credential: { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'aGVsbG8=' },
+        },
+      ],
+      channels: [],
+      access: [],
+      levels: [],
+      vhosts: [],
+      pendingVhosts: [],
+      memos: [],
+      readMarkers: [],
+      akills: [],
+      jupes: [],
+    };
+    const s = new InMemoryServicesStore({ clock: new FakeClock(NOW), snapshot: legacySnap });
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec !== undefined) {
+      expect(rec.certSubjects).toEqual([]);
+    }
+  });
+});
+
+// ============================================================================
+// NickServ — failed-IDENTIFY throttle (record / frozen / clear)
+// ============================================================================
+
+describe('InMemoryServicesStore — identify-failure throttle', () => {
+  const WINDOW = { maxFailures: 3, windowMs: 300_000 };
+
+  it('records failures and freezes once the threshold is met inside the window', () => {
+    const clock = new FakeClock(NOW);
+    const s = new InMemoryServicesStore({ clock });
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+
+    s.recordIdentifyFailure('alice');
+    s.recordIdentifyFailure('alice');
+    expect(s.isNickIdentifyFrozen('alice', WINDOW)).toBe(false);
+    s.recordIdentifyFailure('alice');
+    expect(s.isNickIdentifyFrozen('alice', WINDOW)).toBe(true);
+  });
+
+  it('prunes failures that aged out of the window (freeze lifts)', () => {
+    const clock = new FakeClock(NOW);
+    const s = new InMemoryServicesStore({ clock });
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+
+    s.recordIdentifyFailure('alice'); // at NOW
+    clock.advance(400_000);
+    s.recordIdentifyFailure('alice'); // at NOW + 400_000 (first failure is 400s old)
+    s.recordIdentifyFailure('alice');
+    // Only the two recent failures survive the prune → below threshold.
+    expect(s.isNickIdentifyFrozen('alice', WINDOW)).toBe(false);
+
+    clock.advance(1);
+    s.recordIdentifyFailure('alice'); // third failure inside the window
+    expect(s.isNickIdentifyFrozen('alice', WINDOW)).toBe(true);
+  });
+
+  it('clearIdentifyFailures returns the queued notice count and resets the throttle', () => {
+    const clock = new FakeClock(NOW);
+    const s = new InMemoryServicesStore({ clock });
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+
+    s.recordIdentifyFailure('alice');
+    s.recordIdentifyFailure('alice');
+    expect(s.clearIdentifyFailures('alice')).toBe(2);
+
+    // Both the window and the pending notice are reset.
+    expect(s.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(s.clearIdentifyFailures('alice')).toBe(0);
+  });
+
+  it('is a no-op for an unknown nick (record / frozen / clear)', () => {
+    const clock = new FakeClock(NOW);
+    const s = new InMemoryServicesStore({ clock });
+    s.recordIdentifyFailure('ghost');
+    expect(s.isNickIdentifyFrozen('ghost', WINDOW)).toBe(false);
+    expect(s.clearIdentifyFailures('ghost')).toBe(0);
+  });
+
+  it('round-trips the throttle state through a snapshot reload', () => {
+    const clock = new FakeClock(NOW);
+    const original = new InMemoryServicesStore({ clock });
+    original.registerNick('alice', 'hunter2', 'alice@example.com');
+    original.recordIdentifyFailure('alice');
+    clock.advance(1);
+    original.recordIdentifyFailure('alice');
+
+    const reloaded = new InMemoryServicesStore({
+      clock: new FakeClock(NOW + 1),
+      snapshot: original.snapshot(),
+    });
+    // A re-identify from a fresh connection (fresh store) still sees the
+    // recorded failures and the queued owner notice.
+    expect(reloaded.isNickIdentifyFrozen('alice', { maxFailures: 2, windowMs: 300_000 })).toBe(
+      true,
+    );
+    expect(reloaded.clearIdentifyFailures('alice')).toBe(2);
+  });
+
+  it('defaults the throttle fields when a legacy snapshot row omits them', () => {
+    const legacySnap: ServicesSnapshot = {
+      nicks: [
+        {
+          nick: 'alice',
+          account: 'alice',
+          email: 'a@x',
+          createdAt: NOW,
+          enforce: 'none',
+          certSubjects: [],
+          identifyFailures: undefined as unknown as number[],
+          pendingIdentifyFailureNotice: undefined as unknown as number,
+          credential: { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'aGVsbG8=' },
+        },
+      ],
+      channels: [],
+      access: [],
+      levels: [],
+      vhosts: [],
+      pendingVhosts: [],
+      memos: [],
+      readMarkers: [],
+      akills: [],
+      jupes: [],
+    };
+    const s = new InMemoryServicesStore({ clock: new FakeClock(NOW), snapshot: legacySnap });
+    expect(s.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(false);
+    expect(s.clearIdentifyFailures('alice')).toBe(0);
+    // Mutations after a legacy hydrate behave like a fresh registration.
+    s.recordIdentifyFailure('alice');
+    expect(s.isNickIdentifyFrozen('alice', { maxFailures: 1, windowMs: 300_000 })).toBe(true);
+  });
+});
+
+// ============================================================================
+// NickServ CertFP — SASL EXTERNAL surface (verifyCertFP / addCertFP /
+// addCertFingerprint / removeCertFP)
+// ============================================================================
+
+describe('InMemoryServicesStore — NickServ CertFP (verifyCertFP)', () => {
+  it('returns ok with the account name for a known subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice'))).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('returns ok:false for an unknown subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    const out = s.verifyCertFP(certIdentityFromSubject('CN=evil'));
+    expect(out.ok).toBe(false);
+    if (out.ok) return;
+    expect(out.reason.length).toBeGreaterThan(0);
+  });
+
+  it('returns ok:false when no nick has any cert subject registered', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice')).ok).toBe(false);
+  });
+
+  it('matches the subject value case-sensitively (values are NOT folded)', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=Alice');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice')).ok).toBe(false);
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=Alice')).ok).toBe(true);
+  });
+
+  it('resolves the account that owns the subject (multiple accounts)', () => {
+    const s = store();
+    s.registerNick('alice', 'pw', 'a@e');
+    s.registerNick('bob', 'pw', 'b@e');
+    s.addCertFP('bob', 'CN=bob');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=bob'))).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'bob',
+    });
+  });
+
+  it('exposes the registered subjects on the RegisteredNick record', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice-2');
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec === undefined) return;
+    expect(rec.certSubjects).toEqual(['CN=alice', 'CN=alice-2']);
+  });
+
+  it('defaults certSubjects to an empty array on a fresh registration', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    const rec = s.getNick('alice');
+    expect(rec).toBeDefined();
+    if (rec === undefined) return;
+    expect(rec.certSubjects).toEqual([]);
+  });
+});
+
+describe('InMemoryServicesStore — NickServ CertFP canonical-DN verify', () => {
+  it('verifies a semantically-equal DN spelling (whitespace + ordering differ)', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice ,  O = Example   Inc');
+    const presented = certIdentityFromSubject('O=Example Inc,CN=alice');
+    expect(s.verifyCertFP(presented)).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'alice',
+    });
+  });
+
+  it('migrates a legacy verbatim binding to the canonical form on first use', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice , O=Example Inc');
+    s.verifyCertFP(certIdentityFromSubject('O=Example Inc,CN=alice'));
+    expect(s.getNick('alice')?.certSubjects).toEqual(['cn=alice,o=Example Inc']);
+  });
+
+  it('leaves an already-canonical binding untouched on verify', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'cn=alice');
+    s.verifyCertFP(certIdentityFromSubject('CN=alice'));
+    expect(s.getNick('alice')?.certSubjects).toEqual(['cn=alice']);
+  });
+
+  it('rejects when the presented DN differs beyond spacing/ordering/type case', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice,O=Example Inc');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice,O=Evil Inc')).ok).toBe(false);
+  });
+});
+
+describe('InMemoryServicesStore — NickServ CertFP fingerprint verify', () => {
+  it('verifies via a fingerprint binding alone (subject spelling irrelevant)', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFingerprint('alice', 'aa112233445566778899aabbccddeeff');
+    expect(
+      s.verifyCertFP(certIdentityFromSubject('CN=whatever', 'aa112233445566778899aabbccddeeff')),
+    ).toEqual<ServicesAuthResult>({ ok: true, account: 'alice' });
+  });
+
+  it('prefers the fingerprint binding over a competing DN binding', () => {
+    const s = store();
+    s.registerNick('alice', 'pw', 'a@e');
+    s.registerNick('bob', 'pw', 'b@e');
+    // bob is bound by the cert subject DN; alice is bound by the cert DER
+    // fingerprint. Both would match the presented cert — the fingerprint
+    // binding must win.
+    s.addCertFP('bob', 'CN=shared,O=TwoCerts');
+    s.addCertFingerprint('alice', 'aa112233445566778899aabbccddeeff');
+    expect(
+      s.verifyCertFP(
+        certIdentityFromSubject('CN=shared,O=TwoCerts', 'aa112233445566778899aabbccddeeff'),
+      ),
+    ).toEqual<ServicesAuthResult>({ ok: true, account: 'alice' });
+  });
+
+  it('normalises fingerprint spelling (colons, case) before comparing', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFingerprint('alice', 'AA:11:22:33');
+    const out = s.verifyCertFP(certIdentityFromSubject('CN=alice', 'aa112233'));
+    expect(out.ok).toBe(true);
+  });
+
+  it('pins the platform fingerprint onto a DN-bound account on first verify', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.verifyCertFP(certIdentityFromSubject('CN=alice', 'aa112233'));
+    expect(s.getNick('alice')?.certSubjects).toContain(`${CERT_FP_PREFIX}aa112233`);
+  });
+
+  it('migrates a legacy binding and pins the fingerprint in one first use', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice , O=Example Inc');
+    s.verifyCertFP(certIdentityFromSubject('O=Example Inc,CN=alice', 'aa112233'));
+    expect(s.getNick('alice')?.certSubjects).toEqual([
+      'cn=alice,o=Example Inc',
+      `${CERT_FP_PREFIX}aa112233`,
+    ]);
+  });
+
+  it('does not pin a fingerprint twice on repeated verifies', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.verifyCertFP(certIdentityFromSubject('CN=alice', 'aa112233'));
+    s.verifyCertFP(certIdentityFromSubject('CN=alice', 'aa112233'));
+    const fps = s.getNick('alice')?.certSubjects.filter((e) => e.startsWith(CERT_FP_PREFIX));
+    expect(fps).toEqual([`${CERT_FP_PREFIX}aa112233`]);
+  });
+
+  it('rejects an unknown fingerprint and unknown DN (unknown cert)', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFingerprint('alice', 'aa112233');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=evil', 'ffffffffffffffff')).ok).toBe(false);
+  });
+
+  it('falls back to the DN arm when the fingerprint matches nothing', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    // Platform-supplied fingerprint is unknown to the store; the DN binding
+    // still authorises the cert.
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice', 'ffffffffffffffff')).ok).toBe(true);
+  });
+});
+
+describe('InMemoryServicesStore — NickServ CertFP mutators (addCertFP / addCertFingerprint / removeCertFP)', () => {
+  it('addCertFP attaches a subject to a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+  });
+
+  it('addCertFP is a no-op on an unregistered nick', () => {
+    const s = store();
+    s.addCertFP('ghost', 'CN=ghost');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=ghost')).ok).toBe(false);
+  });
+
+  it('addCertFP does not duplicate an already-attached subject', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.getNick('alice')?.certSubjects).toEqual(['CN=alice']);
+  });
+
+  it('addCertFP folds the nick case-insensitively', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice'))).toEqual<ServicesAuthResult>({
+      ok: true,
+      account: 'Alice',
+    });
+  });
+
+  it('addCertFingerprint attaches a fingerprint binding to a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.addCertFingerprint('alice', 'AA:11')).toBe(true);
+    expect(s.getNick('alice')?.certSubjects).toEqual([`${CERT_FP_PREFIX}aa11`]);
+  });
+
+  it('addCertFingerprint does not duplicate an equivalent fingerprint', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFingerprint('alice', 'aa11');
+    s.addCertFingerprint('alice', 'AA:11');
+    expect(s.getNick('alice')?.certSubjects).toEqual([`${CERT_FP_PREFIX}aa11`]);
+  });
+
+  it('addCertFingerprint is a no-op on an unregistered nick', () => {
+    const s = store();
+    expect(s.addCertFingerprint('ghost', 'aa11')).toBe(false);
+  });
+
+  it('removeCertFP detaches a subject from a registered nick', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    expect(s.removeCertFP('alice', 'CN=alice')).toBe(true);
+    expect(s.getNick('alice')?.certSubjects).toEqual([]);
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice')).ok).toBe(false);
+  });
+
+  it('removeCertFP detaches a stored fingerprint binding entry', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFingerprint('alice', 'aa11');
+    expect(s.removeCertFP('alice', `${CERT_FP_PREFIX}aa11`)).toBe(true);
+    expect(s.getNick('alice')?.certSubjects).toEqual([]);
+  });
+
+  it('removeCertFP returns false when the subject is not attached', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    expect(s.removeCertFP('alice', 'CN=alice')).toBe(false);
+  });
+
+  it('removeCertFP returns false on an unregistered nick', () => {
+    const s = store();
+    expect(s.removeCertFP('ghost', 'CN=ghost')).toBe(false);
+  });
+
+  it('removeCertFP folds the nick case-insensitively but matches the subject byte-exactly', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=Alice');
+    expect(s.removeCertFP('ALICE', 'CN=alice')).toBe(false);
+    expect(s.removeCertFP('ALICE', 'CN=Alice')).toBe(true);
+  });
+
+  it('dropNick removes the attached cert subjects along with the registration', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.addCertFP('alice', 'CN=alice');
+    s.dropNick('alice');
+    expect(s.verifyCertFP(certIdentityFromSubject('CN=alice')).ok).toBe(false);
+  });
+});
+
 describe('InMemoryServicesStore — NickServ DROP (dropNick)', () => {
   it('returns true and removes the registration for a known nick', () => {
     const s = store();
@@ -175,6 +717,29 @@ describe('InMemoryServicesStore — NickServ SET ENFORCE (setNickEnforce)', () =
   });
 });
 
+describe('InMemoryServicesStore — NickServ SET PASSWORD (setNickPassword)', () => {
+  it('overwrites the credential so the new password verifies and the old does not', () => {
+    const s = store();
+    s.registerNick('alice', 'hunter2', 'alice@example.com');
+    s.setNickPassword('alice', 'newpassword');
+    expect(s.verifyNick('alice', 'newpassword').ok).toBe(true);
+    expect(s.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('folds the nick case-insensitively', () => {
+    const s = store();
+    s.registerNick('Alice', 'hunter2', 'alice@example.com');
+    s.setNickPassword('alice', 'newpassword');
+    expect(s.verifyNick('ALICE', 'newpassword').ok).toBe(true);
+  });
+
+  it('is a no-op on an unregistered nick (the original credential, if any, is untouched)', () => {
+    const s = store();
+    s.setNickPassword('ghost', 'newpassword');
+    expect(s.isRegisteredNick('ghost')).toBe(false);
+  });
+});
+
 describe('InMemoryServicesStore — NickServ INFO (getNick)', () => {
   it('returns the full record for a registered nick', () => {
     const s = store();
@@ -186,6 +751,7 @@ describe('InMemoryServicesStore — NickServ INFO (getNick)', () => {
       email: 'alice@example.com',
       createdAt: NOW,
       enforce: 'none',
+      certSubjects: [],
     });
   });
 

package/packages/irc-core/tests/ws-framing.test.ts

@@ -5,6 +5,7 @@ import {
   frameToLines,
   isWithinWsByteBudget,
   sanitizeForTextMode,
+  splitFrameLines,
   stripTrailingCrLf,
   wsFrameModeFor,
 } from '../src/ws-framing';
@@ -147,6 +148,33 @@ describe('frameToLines — mode coverage', () => {
   }
 });
 
+// ============================================================================
+// frameToLines — bare CR pass-through (rejection is the parser's job)
+// ============================================================================
+
+describe('framing passes a bare CR through to the parser', () => {
+  // Framing only recognizes complete CR-LF / LF terminators. A bare CR has
+  // no LF partner, so no framing mode treats it as a boundary: the line is
+  // emitted intact and the shared parser is the single place that rejects
+  // it (loudly, with a parse error) rather than silently dropping frames.
+
+  it('spec-text keeps a bare mid-line CR inside the single line', () => {
+    expect(frameToLines('PRIVMSG #foo :a\rb', 'spec-text')).toEqual(['PRIVMSG #foo :a\rb']);
+  });
+
+  it('spec-binary keeps a bare mid-line CR inside the single line', () => {
+    expect(frameToLines('PRIVMSG #foo :a\rb', 'spec-binary')).toEqual(['PRIVMSG #foo :a\rb']);
+  });
+
+  it('legacy keeps a bare CR (no CR-LF boundary to split on)', () => {
+    expect(splitFrameLines('PRIVMSG #foo :a\rb')).toEqual(['PRIVMSG #foo :a\rb']);
+  });
+
+  it('stripTrailingCrLf leaves a bare mid-line CR untouched', () => {
+    expect(stripTrailingCrLf('PRIVMSG #foo :a\rb')).toBe('PRIVMSG #foo :a\rb');
+  });
+});
+
 // ============================================================================
 // isWithinWsByteBudget — the IRCv3 WS message byte cap
 // ============================================================================
@@ -167,6 +195,23 @@ describe('isWithinWsByteBudget', () => {
   it('accepts a short frame', () => {
     expect(isWithinWsByteBudget('NICK bob')).toBe(true);
   });
+
+  it('rejects a multi-byte frame that fits 510 UTF-16 units but exceeds 510 bytes', () => {
+    // 300 'é' = 300 code units (inside the unit budget) but 600 UTF-8 bytes.
+    const frame = 'é'.repeat(300);
+    expect(frame.length).toBeLessThanOrEqual(MAX_WS_MESSAGE_BYTES);
+    expect(isWithinWsByteBudget(frame)).toBe(false);
+  });
+
+  it('accepts a multi-byte frame whose UTF-8 length is exactly 510 bytes', () => {
+    // 255 'é' = 255 code units, exactly 510 UTF-8 bytes. Byte accounting
+    // must not over-reject.
+    expect(isWithinWsByteBudget('é'.repeat(255))).toBe(true);
+  });
+
+  it('rejects a 511-é frame (1022 bytes) that once passed the unit cap', () => {
+    expect(isWithinWsByteBudget('é'.repeat(511))).toBe(false);
+  });
 });
 
 // ============================================================================

package/packages/irc-core/vitest.config.ts

@@ -8,7 +8,12 @@ export default defineConfig({
       provider: 'v8',
       all: false,
       include: ['src/**/*.ts'],
-      exclude: ['src/**/index.ts'],
+      // `index.ts` files are barrel re-exports (no runtime logic);
+      // `messages.ts` is type-only (`interface` declarations that
+      // TypeScript erases to an empty module). v8 scores both 0%
+      // because they contain no executable statements — excluding
+      // them keeps the 100% threshold honest about real coverage.
+      exclude: ['src/**/index.ts', 'src/**/messages.ts'],
       reporter: ['text', 'html', 'json-summary'],
       thresholds: {
         lines: 100,

package/packages/irc-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-server",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Orchestration layer: IrcRuntime port, dispatch interpreter, ConnectionActor",
   "license": "BSD-3-Clause",