serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-server/tests/dispatch.test.ts

@@ -21,6 +21,9 @@ function fakeRuntime(calls: RecordedCall[]): IrcRuntime {
     async broadcastWallops(lines, except) {
       calls.push({ method: 'broadcastWallops', args: [lines, except] });
     },
+    async broadcastOperNotice(lines, except) {
+      calls.push({ method: 'broadcastOperNotice', args: [lines, except] });
+    },
     async disconnect(conn, reason) {
       calls.push({ method: 'disconnect', args: [conn, reason] });
     },
@@ -151,6 +154,30 @@ describe('dispatch', () => {
     });
   });
 
+  it('routes BroadcastOperNotice with lines and except', async () => {
+    const calls: RecordedCall[] = [];
+    await dispatch(
+      [Effect.broadcastOperNotice([L(':s NOTICE * :OPER lockout triggered for h')], 'c1')],
+      fakeRuntime(calls),
+    );
+    expect(calls[0]).toEqual({
+      method: 'broadcastOperNotice',
+      args: [[{ text: ':s NOTICE * :OPER lockout triggered for h' }], 'c1'],
+    });
+  });
+
+  it('routes BroadcastOperNotice preserving undefined except', async () => {
+    const calls: RecordedCall[] = [];
+    await dispatch(
+      [Effect.broadcastOperNotice([L(':s NOTICE * :OPER lockout triggered for h')])],
+      fakeRuntime(calls),
+    );
+    expect(calls[0]).toEqual({
+      method: 'broadcastOperNotice',
+      args: [[{ text: ':s NOTICE * :OPER lockout triggered for h' }], undefined],
+    });
+  });
+
   it('calls reserveNick, changeNick, releaseNick in order', async () => {
     const calls: RecordedCall[] = [];
     await dispatch(
@@ -279,6 +306,7 @@ function capAwareRuntime(members: ReadonlyMap<ConnId, MemberInfo>): {
       broadcasts.push({ chan, lines, except });
     },
     async broadcastWallops() {},
+    async broadcastOperNotice() {},
     async disconnect() {},
     async sendToNick() {},
     async reserveNick() {
@@ -429,6 +457,7 @@ describe('dispatch — Broadcast cap / capLines', () => {
       },
       async broadcast() {},
       async broadcastWallops() {},
+      async broadcastOperNotice() {},
       async disconnect() {},
       async sendToNick() {},
       async reserveNick() {
@@ -476,6 +505,7 @@ describe('dispatch — Broadcast cap / capLines', () => {
       },
       async broadcast() {},
       async broadcastWallops() {},
+      async broadcastOperNotice() {},
       async disconnect() {},
       async sendToNick() {},
       async reserveNick() {
@@ -662,6 +692,7 @@ describe('dispatch — Broadcast caps (OR semantics)', () => {
       },
       async broadcast() {},
       async broadcastWallops() {},
+      async broadcastOperNotice() {},
       async disconnect() {},
       async sendToNick() {},
       async reserveNick() {

package/packages/irc-server/tests/redact.test.ts

@@ -0,0 +1,198 @@
+/**
+ * Log-scrubbing helpers: `redactLine`, `truncateToken`, `parseErrorReason`.
+ *
+ * These are the credential-exfiltration guards for log payloads. A hostile
+ * client can smuggle secret material into server logs by sending a
+ * malformed or sensitive line (e.g. `PASS hunter2` inside a frame that
+ * trips the parser). Anything that could end up in a warn/error record
+ * must pass through these helpers first: raw lines go through
+ * `redactLine`, parse diagnostics go through `truncateToken` +
+ * `parseErrorReason`.
+ *
+ * Coverage here is exhaustive by design (100% on this module is a
+ * release requirement): every sensitive command prefix and every branch
+ * of the scrubbers is pinned by a named case.
+ */
+
+import { MAX_TAGS, parse, parseTags } from '@serverless-ircd/irc-core';
+import { describe, expect, it } from 'vitest';
+import { parseErrorReason, redactLine, truncateToken } from '../src/redact';
+
+describe('redactLine — sensitive command prefixes', () => {
+  it('redacts the parameter of PASS while keeping the verb', () => {
+    expect(redactLine('PASS hunter2')).toBe('PASS [REDACTED]');
+  });
+
+  it('matches the PASS verb case-insensitively but preserves its spelling', () => {
+    expect(redactLine('pass hunter2')).toBe('pass [REDACTED]');
+  });
+
+  it('redacts the parameter of AUTHENTICATE (SASL payloads carry credentials)', () => {
+    expect(redactLine('AUTHENTICATE dXNlcjpodW50ZXIy')).toBe('AUTHENTICATE [REDACTED]');
+  });
+
+  it('redacts the parameters of OPER (name + password)', () => {
+    expect(redactLine('OPER admin secretpw')).toBe('OPER [REDACTED]');
+  });
+
+  it('redacts the parameter of a bare IDENTIFY (service shortcut form)', () => {
+    expect(redactLine('IDENTIFY hunter2')).toBe('IDENTIFY [REDACTED]');
+  });
+
+  it('redacts a NickServ-targeted PRIVMSG carrying IDENTIFY, keeping target + subcommand', () => {
+    expect(redactLine('PRIVMSG NickServ :IDENTIFY hunter2')).toBe(
+      'PRIVMSG NickServ :IDENTIFY [REDACTED]',
+    );
+  });
+
+  it('redacts a case-folded NickServ-targeted NOTICE carrying the ID alias', () => {
+    expect(redactLine('NOTICE nickserv :id hunter2')).toBe('NOTICE nickserv :id [REDACTED]');
+  });
+
+  it('redacts a NickServ-targeted PRIVMSG whose body lacks the trailing colon', () => {
+    expect(redactLine('PRIVMSG NickServ IDENTIFY hunter2')).toBe(
+      'PRIVMSG NickServ IDENTIFY [REDACTED]',
+    );
+  });
+});
+
+describe('redactLine — non-sensitive input passes through', () => {
+  it('leaves ordinary commands untouched', () => {
+    expect(redactLine('PRIVMSG #chan :hello there')).toBe('PRIVMSG #chan :hello there');
+  });
+
+  it('leaves a NickServ message that carries no credential subcommand untouched', () => {
+    expect(redactLine('PRIVMSG NickServ :INFO')).toBe('PRIVMSG NickServ :INFO');
+  });
+
+  it('leaves an IDENTIFY with no arguments untouched (nothing to redact)', () => {
+    expect(redactLine('PRIVMSG NickServ :IDENTIFY')).toBe('PRIVMSG NickServ :IDENTIFY');
+  });
+
+  it('leaves an IDENTIFY sent to a non-service nick untouched', () => {
+    expect(redactLine('PRIVMSG Mallory :IDENTIFY hunter2')).toBe(
+      'PRIVMSG Mallory :IDENTIFY hunter2',
+    );
+  });
+
+  it('leaves a bare sensitive verb with no parameters untouched', () => {
+    expect(redactLine('PASS')).toBe('PASS');
+  });
+
+  it('leaves a bare PRIVMSG with no target or body untouched', () => {
+    expect(redactLine('PRIVMSG')).toBe('PRIVMSG');
+  });
+
+  it('leaves an empty line untouched', () => {
+    expect(redactLine('')).toBe('');
+  });
+});
+
+describe('redactLine — source prefixes', () => {
+  it('redacts the parameters of a prefixed sensitive command, keeping the prefix', () => {
+    expect(redactLine(':srv.example.com PASS secret')).toBe(':srv.example.com PASS [REDACTED]');
+  });
+
+  it('redacts a prefixed NickServ-targeted PRIVMSG', () => {
+    expect(redactLine(':alice!u@h PRIVMSG NickServ :IDENTIFY hunter2')).toBe(
+      ':alice!u@h PRIVMSG NickServ :IDENTIFY [REDACTED]',
+    );
+  });
+
+  it('leaves a prefix-only line untouched', () => {
+    expect(redactLine(':prefix-only')).toBe(':prefix-only');
+  });
+});
+
+describe('truncateToken', () => {
+  it('returns a token at the cap unchanged', () => {
+    expect(truncateToken('a'.repeat(32))).toBe('a'.repeat(32));
+  });
+
+  it('truncates a token beyond the cap with an ellipsis marker', () => {
+    expect(truncateToken('a'.repeat(33))).toBe(`${'a'.repeat(32)}...`);
+  });
+});
+
+describe('parseErrorReason — stable codes for every parser diagnostic', () => {
+  it('maps the empty-message diagnostic', () => {
+    expect(() => parse('')).toThrow();
+    try {
+      parse('');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('empty-message');
+    }
+  });
+
+  it('maps the input-cap diagnostic', () => {
+    try {
+      parse('A'.repeat(600));
+      expect.unreachable('600 bytes must fail the input cap');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('input-cap-exceeded');
+    }
+  });
+
+  it('maps the tags-without-body diagnostic', () => {
+    try {
+      parse('@account=alice');
+      expect.unreachable('a tag section with no message body must fail');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('tags-without-body');
+    }
+  });
+
+  it('maps the prefix-without-command diagnostic', () => {
+    try {
+      parse(':src.example.com');
+      expect.unreachable('a source prefix with no command must fail');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('prefix-without-command');
+    }
+  });
+
+  it('maps the missing-command diagnostic', () => {
+    try {
+      parse('@a :src ');
+      expect.unreachable('tags + prefix with no command must fail');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('missing-command');
+    }
+  });
+
+  it('maps the invalid-command-token diagnostic', () => {
+    try {
+      parse('12345');
+      expect.unreachable('a 5-digit command token must fail');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('invalid-command-token');
+    }
+  });
+
+  it('maps the too-many-tags diagnostic', () => {
+    try {
+      const tags = Array.from({ length: MAX_TAGS + 1 }, (_, i) => `t${i}`);
+      parse(`@${tags.join(';')} PRIVMSG #foo :hi`);
+      expect.unreachable('a 16-tag line must fail the tag count cap');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('too-many-tags');
+    }
+  });
+
+  it('maps the tag-section-byte-cap diagnostic', () => {
+    try {
+      parseTags(`a=${'x'.repeat(8193 - 2)}`, `@a=${'x'.repeat(8193 - 2)} PRIVMSG #foo :hi`);
+      expect.unreachable('an over-budget tag section must fail');
+    } catch (err) {
+      expect(parseErrorReason(err)).toBe('tag-section-too-large');
+    }
+  });
+
+  it('falls back to a stable code for an unrecognized Error message', () => {
+    expect(parseErrorReason(new Error('boom'))).toBe('parse-failed');
+  });
+
+  it('falls back to a stable code for a non-Error throw', () => {
+    expect(parseErrorReason('boom')).toBe('parse-failed');
+  });
+});

package/packages/irc-server/tests/runtime.test.ts

@@ -38,6 +38,7 @@ describe('IrcRuntime contract', () => {
         throw new Error('reloadConfig not configured for this fake');
       },
       async broadcastWallops() {},
+      async broadcastOperNotice() {},
     };
     expect(runtime).toBeDefined();
     expect(typeof runtime.send).toBe('function');
@@ -55,5 +56,6 @@ describe('IrcRuntime contract', () => {
     expect(typeof runtime.listChannels).toBe('function');
     expect(typeof runtime.reloadConfig).toBe('function');
     expect(typeof runtime.broadcastWallops).toBe('function');
+    expect(typeof runtime.broadcastOperNotice).toBe('function');
   });
 });

package/packages/irc-server/tests/transport.test.ts

@@ -199,6 +199,72 @@ describe('TcpByteStreamTransport — buffer save/restore', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Input buffer cap: a peer streaming megabytes with no line terminator must
+// not grow the partial-line buffer unboundedly (edge-level memory DoS). The
+// cap is measured in UTF-8 bytes on the retained (unterminated) tail after
+// each append — complete lines flushed out by the same chunk never count.
+// ---------------------------------------------------------------------------
+
+describe('TcpByteStreamTransport — input buffer cap', () => {
+  it('signals onOverflow and drops the buffer when an appended tail exceeds the 8 KiB cap', () => {
+    const overflows: number[] = [];
+    const t = new TcpByteStreamTransport({ onOverflow: () => overflows.push(1) });
+    expect(t.feed('x'.repeat(9 * 1024))).toEqual([]);
+    expect(overflows.length).toBe(1);
+    // The oversized tail is dropped, not retained.
+    expect(t.getBuffer()).toBe('');
+  });
+
+  it('checks the cap once per append (chunk), not per byte', () => {
+    // A single 9 KiB chunk that overflows fires the callback exactly once —
+    // the guard runs on the appended buffer, not per input byte.
+    const overflows: number[] = [];
+    const t = new TcpByteStreamTransport({ onOverflow: () => overflows.push(1) });
+    t.feed('y'.repeat(9 * 1024));
+    expect(overflows.length).toBe(1);
+  });
+
+  it('signals overflow only on the append that crosses the cap (accumulated chunks)', () => {
+    const overflows: number[] = [];
+    const t = new TcpByteStreamTransport({ onOverflow: () => overflows.push(1) });
+    expect(t.feed('a'.repeat(4 * 1024))).toEqual([]);
+    expect(overflows.length).toBe(0);
+    expect(t.feed('b'.repeat(5 * 1024))).toEqual([]);
+    expect(overflows.length).toBe(1);
+  });
+
+  it('does NOT overflow a buffered partial line at (just under) the cap', () => {
+    const overflows: number[] = [];
+    const t = new TcpByteStreamTransport({ onOverflow: () => overflows.push(1) });
+    // Exactly 8192 bytes: at the cap, still allowed.
+    t.feed('z'.repeat(8192));
+    expect(overflows.length).toBe(0);
+    expect(t.getBuffer()).toBe('z'.repeat(8192));
+  });
+
+  it('does not overflow a chunk of complete lines totalling over the cap (batching)', () => {
+    const overflows: number[] = [];
+    const t = new TcpByteStreamTransport({ onOverflow: () => overflows.push(1) });
+    // 20 terminated ~500-byte lines ≈ 10 KiB in one chunk: every line is
+    // complete, so the retained tail is empty and nothing overflows.
+    const chunk = `${Array.from({ length: 20 }, (_, i) => `PING :${`${i}`.padStart(495, '-')}`).join('\r\n')}\r\n`;
+    expect(chunk.length).toBeGreaterThan(8192);
+    const out = t.feed(chunk);
+    expect(overflows.length).toBe(0);
+    expect(out.length).toBe(20);
+    expect(t.getBuffer()).toBe('');
+  });
+
+  it('measures the tail in UTF-8 bytes, not UTF-16 code units', () => {
+    // 'é' is one UTF-16 unit but two UTF-8 bytes: 5000 × é = 10000 bytes.
+    const overflows: number[] = [];
+    const t = new TcpByteStreamTransport({ onOverflow: () => overflows.push(1) });
+    t.feed('é'.repeat(5000));
+    expect(overflows.length).toBe(1);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Equivalence: a fully-terminated message stream produces the same complete
 // lines regardless of how it is chunked across feed() calls.

package/packages/irc-test-support/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-test-support",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Shared IRC scenario runner + harness seam used by every adapter's integration suite",
   "license": "BSD-3-Clause",

package/packages/irc-test-support/src/in-memory-harness.ts

@@ -192,6 +192,10 @@ export class InMemoryHarness implements IrcHarness {
       clock: this.clock,
       ids: this.ids,
       motd: this.motd,
+      // Shared per-IP failed-OPER counter (runtime-owned) so harness
+      // scenarios exercise the OPER brute-force lockout exactly like the
+      // local CLI does.
+      operFailures: this.runtime.operFailures,
       transport: this.newTransport(),
     });
     client.bindActor(actor);

package/pnpm-workspace.yaml

@@ -3,6 +3,7 @@ packages:
   - "apps/*"
   - "tools"
   - "tools/*"
+  - "scripts"
 linkWorkspacePackages: true
 allowBuilds:
   '@biomejs/biome': true