serverless-ircd 0.9.0 → 0.11.0

package/packages/aws-adapter/src/dynamo-account-store.ts

@@ -1,95 +0,0 @@
-/**
- * DynamoDB-backed {@link AccountStore} primitives for the AWS adapter.
- *
- * The `Accounts` DynamoDB table stores SASL PLAIN credentials as
- * **scrypt hashes** (never plaintext). Each row is a flat
- * {@link HashedAccountCredential} (`{ account, algorithm, salt, hash }`).
- *
- * Two-phase construction keeps the `AccountStore` port synchronous:
- *   1. {@link loadDynamoAccountStore} (async) scans the table at Lambda
- *      cold start and returns a fully-populated `DynamoAccountStore`.
- *   2. `DynamoAccountStore(entries)` (sync constructor) takes the
- *      pre-loaded entries. The class itself has zero DynamoDB
- *      coupling — it works equally well with entries from any source.
- *
- * This mirrors the pre-load pattern documented in
- * `irc-core/src/ports.ts` and used by `MotdProvider` / `MessageStore`:
- * adapters that need an async backend pre-load the data at boot into a
- * synchronously-readable store.
- *
- * The scrypt hashing helpers (`hashAccountCredential` /
- * `verifyHashedPassword` + the `HashedAccountCredential` type) live in
- * `irc-core` and are shared with the CF adapter's `D1AccountStore`. They
- * are re-exported below so existing call sites importing from this module
- * keep working.
- */
-
-import type { ScanCommandOutput } from '@aws-sdk/client-dynamodb';
-import { ScanCommand } from '@aws-sdk/lib-dynamodb';
-import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-import {
-  type HashedAccountCredential,
-  HashedAccountStore,
-  hashAccountCredential,
-  verifyHashedPassword,
-} from '@serverless-ircd/irc-core';
-
-// Re-export so callers importing these from `@serverless-ircd/aws-adapter`
-// (the historical home of the hashing helpers) keep compiling.
-export { type HashedAccountCredential, hashAccountCredential, verifyHashedPassword };
-
-/**
- * Synchronous {@link AccountStore} backed by pre-loaded hashed credentials.
- *
- * Now a re-export of the shared `HashedAccountStore` from `irc-core` —
- * both adapters use one store implementation. The AWS-specific surface
- * (`loadDynamoAccountStore`) lives below; it diverges from CF only at the
- * scan boundary.
- */
-export { HashedAccountStore as DynamoAccountStore };
-
-/**
- * Scans the `Accounts` table and returns a fully-populated
- * {@link DynamoAccountStore}, or `undefined` when the table has no rows.
- *
- * Handles pagination (`LastEvaluatedKey`) so tables larger than the 1 MB
- * scan page are fully loaded. Rows missing required attributes are
- * silently skipped.
- */
-export async function loadDynamoAccountStore(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-): Promise<HashedAccountStore | undefined> {
-  const entries: HashedAccountCredential[] = [];
-  let exclusiveStartKey: Record<string, unknown> | undefined = undefined;
-  do {
-    const result: ScanCommandOutput = await docClient.send(
-      new ScanCommand({
-        TableName: tableName,
-        ExclusiveStartKey: exclusiveStartKey,
-      }),
-    );
-    for (const item of result.Items ?? []) {
-      const account = typeof item.account === 'string' ? item.account : undefined;
-      const algorithm = typeof item.algorithm === 'string' ? item.algorithm : undefined;
-      const salt = typeof item.salt === 'string' ? item.salt : undefined;
-      const hash = typeof item.hash === 'string' ? item.hash : undefined;
-      if (
-        account !== undefined &&
-        algorithm !== undefined &&
-        salt !== undefined &&
-        hash !== undefined
-      ) {
-        entries.push({
-          account,
-          algorithm: algorithm as HashedAccountCredential['algorithm'],
-          salt,
-          hash,
-        });
-      }
-    }
-    exclusiveStartKey = result.LastEvaluatedKey;
-  } while (exclusiveStartKey !== undefined);
-  if (entries.length === 0) return undefined;
-  return new HashedAccountStore(entries);
-}

package/packages/aws-adapter/tests/account-store-dynamo.test.ts

@@ -1,223 +0,0 @@
-/**
- * DynamoDB-backed integration tests for the `Accounts` table path.
- * Exercises the real DynamoDB round-trip that pure unit
- * tests cannot: `putAccountCredential` writes a hashed row,
- * `loadDynamoAccountStore` scans it back, and `resolveAccountStore`
- * applies the table-then-config precedence.
- *
- * Gated on DynamoDB Local availability (same `DDB_AVAILABLE` flag as
- * `handlers.test.ts`).
- */
-
-import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
-import { PutCommand } from '@aws-sdk/lib-dynamodb';
-import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  loadDynamoAccountStore,
-  putAccountCredential,
-  resolveAccountStore,
-} from '../src/account-store.js';
-import { TABLE_DEFS } from '../src/cdk-table-defs.js';
-import { createDynamoDocumentClient } from '../src/dynamo.js';
-
-const available = process.env.DDB_AVAILABLE === '1';
-const endpoint = process.env.DYNAMO_ENDPOINT;
-
-interface Fx {
-  tableName: string;
-  client: ReturnType<typeof createDynamoDocumentClient>;
-  cleanup: () => Promise<void>;
-}
-
-let fx: Fx | null = null;
-
-function requireFx(): Fx {
-  if (!fx) throw new Error('test fixture not initialized');
-  return fx;
-}
-
-async function makeFx(): Promise<Fx> {
-  if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
-  const tableName = `acct-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
-  const client = createDynamoDocumentClient({ endpoint });
-  const props = TABLE_DEFS.Accounts;
-  const pkName = props.partitionKey?.name;
-  if (pkName === undefined) throw new Error('Accounts table missing partitionKey');
-  await client.send(
-    new CreateTableCommand({
-      TableName: tableName,
-      AttributeDefinitions: [{ AttributeName: pkName, AttributeType: 'S' }],
-      KeySchema: [{ AttributeName: pkName, KeyType: 'HASH' }],
-      BillingMode: 'PAY_PER_REQUEST',
-    }),
-  );
-  return {
-    tableName,
-    client,
-    cleanup: async () => {
-      try {
-        await client.send(new DeleteTableCommand({ TableName: tableName }));
-      } catch {
-        // Idempotent.
-      }
-    },
-  };
-}
-
-describe.skipIf(!available)('Accounts table round-trip', () => {
-  beforeEach(async () => {
-    fx = await makeFx();
-  });
-  afterEach(async () => {
-    if (fx) await fx.cleanup();
-    fx = null;
-  });
-
-  it('putAccountCredential then loadDynamoAccountStore verifies the account', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 's3cret');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 's3cret' }),
-    ).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-
-  it('loadDynamoAccountStore returns undefined when the table has no rows', async () => {
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeUndefined();
-  });
-
-  it('putAccountCredential writes multiple distinct accounts', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'a1');
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'bob', 'b2');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(store?.size).toBe(2);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'a1' }).ok).toBe(
-      true,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'b2' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('putAccountCredential overwrites an existing account (re-seed)', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'old');
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'new');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(store?.size).toBe(1);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'old' }).ok).toBe(
-      false,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'new' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('rejects a wrong password after round-trip', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'right');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
-      false,
-    );
-  });
-
-  it('silently skips rows with missing or wrong-typed credential fields', async () => {
-    // The scan path must tolerate partially-malformed rows (legacy seeds,
-    // schema drift) without throwing — it just skips them. Each branch of
-    // the per-field `typeof === 'string'` guard is exercised by writing a
-    // row where exactly one non-key field has the wrong type. (The
-    // `account` field is the partition key, so DynamoDB itself enforces
-    // its type at write time and the false branch is not exercisable
-    // through the SDK; that branch is a defensive guard against
-    // synthetically-shaped Scan results.)
-    const client = requireFx().client;
-    const table = requireFx().tableName;
-    // Well-formed row — must survive.
-    await putAccountCredential(client, table, 'good', 's3cret');
-    // Row with non-string `algorithm`.
-    await client.send(
-      new PutCommand({
-        TableName: table,
-        Item: { account: 'noalgo', algorithm: 7, salt: 's', hash: 'h' },
-      }),
-    );
-    // Row with non-string `salt`.
-    await client.send(
-      new PutCommand({
-        TableName: table,
-        Item: { account: 'nosalt', algorithm: 'SCRYPT-SHA-256', salt: false, hash: 'h' },
-      }),
-    );
-    // Row with non-string `hash`.
-    await client.send(
-      new PutCommand({
-        TableName: table,
-        Item: { account: 'nohash', algorithm: 'SCRYPT-SHA-256', salt: 's', hash: null },
-      }),
-    );
-    const store = await loadDynamoAccountStore(client, table);
-    expect(store).toBeDefined();
-    expect(store?.size).toBe(1);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'good', password: 's3cret' }).ok).toBe(
-      true,
-    );
-  });
-});
-
-describe.skipIf(!available)('resolveAccountStore precedence', () => {
-  beforeEach(async () => {
-    fx = await makeFx();
-  });
-  afterEach(async () => {
-    if (fx) await fx.cleanup();
-    fx = null;
-  });
-
-  it('returns a DynamoAccountStore when the table has rows (table wins)', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'table-secret');
-    const cfgWithSasl = makeTestServerConfig({
-      saslAccounts: [{ username: 'envuser', password: 'env-secret' }],
-    });
-    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, cfgWithSasl);
-    expect(store).toBeDefined();
-    // Table account verifies; config account does NOT (table is authoritative).
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'table-secret' }).ok,
-    ).toBe(true);
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(false);
-  });
-
-  it('falls back to the config-seeded store when the table is empty', async () => {
-    const cfgWithSasl = makeTestServerConfig({
-      saslAccounts: [{ username: 'envuser', password: 'env-secret' }],
-    });
-    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, cfgWithSasl);
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(true);
-  });
-
-  it('returns undefined when the table is empty and no config accounts are set', async () => {
-    const store = await resolveAccountStore(
-      requireFx().client,
-      requireFx().tableName,
-      makeTestServerConfig(),
-    );
-    expect(store).toBeUndefined();
-  });
-
-  it('returns undefined when the table is empty and serverConfig is undefined', async () => {
-    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, undefined);
-    expect(store).toBeUndefined();
-  });
-});

package/packages/aws-adapter/tests/account-store.test.ts

@@ -1,276 +0,0 @@
-import { DynamoDBDocumentClient, PutCommand, ScanCommand } from '@aws-sdk/lib-dynamodb';
-import type { ParsedServerConfig, SaslPayload } from '@serverless-ircd/irc-core';
-import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { mockClient } from 'aws-sdk-client-mock';
-import { describe, expect, it } from 'vitest';
-import {
-  DynamoAccountStore,
-  type HashedAccountCredential,
-  bindAccountStore,
-  hashAccountCredential,
-  putAccountCredential,
-  resolveAccountStore,
-} from '../src/account-store';
-
-function plainPayload(username: string, password: string): SaslPayload {
-  return { kind: 'PLAIN', username, password };
-}
-
-/** Builds a minimal parsed config with the supplied saslAccounts. */
-function configWith(accounts: Array<{ username: string; password: string }>): ParsedServerConfig {
-  return makeTestServerConfig({ saslAccounts: accounts });
-}
-
-// ---------------------------------------------------------------------------
-// bindAccountStore — config-seeded fallback
-// ---------------------------------------------------------------------------
-
-describe('bindAccountStore', () => {
-  it('returns an AccountStore that accepts valid PLAIN creds', () => {
-    const store = bindAccountStore(configWith([{ username: 'alice', password: 'secret' }]));
-    expect(store).toBeDefined();
-    const out = store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' });
-    expect(out).toEqual({ ok: true, account: 'alice' });
-  });
-
-  it('returns undefined when the account list is empty', () => {
-    expect(bindAccountStore(configWith([]))).toBeUndefined();
-  });
-
-  it('returns undefined when serverConfig is undefined', () => {
-    expect(bindAccountStore(undefined)).toBeUndefined();
-  });
-
-  it('rejects wrong credentials', () => {
-    const store = bindAccountStore(configWith([{ username: 'alice', password: 'secret' }]));
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
-      false,
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// hashAccountCredential — pure scrypt hashing helper
-// ---------------------------------------------------------------------------
-
-describe('hashAccountCredential', () => {
-  it('produces an entry keyed by the username with scrypt', () => {
-    const entry = hashAccountCredential('alice', 'secret');
-    expect(entry.account).toBe('alice');
-    expect(entry.algorithm).toBe('scrypt');
-    expect(entry.salt.length).toBeGreaterThan(0);
-    expect(entry.hash.length).toBeGreaterThan(0);
-  });
-
-  it('never stores the plaintext password in any field', () => {
-    const entry = hashAccountCredential('alice', 'hunter2-secret');
-    expect(entry.account).not.toContain('hunter2');
-    expect(entry.salt).not.toContain('hunter2');
-    expect(entry.hash).not.toContain('hunter2');
-  });
-
-  it('produces different hashes for the same password under different salts', () => {
-    const a = hashAccountCredential('alice', 'secret', { salt: Buffer.from('aaaaaaaaaaaaaaaa') });
-    const b = hashAccountCredential('alice', 'secret', { salt: Buffer.from('bbbbbbbbbbbbbbbb') });
-    expect(a.hash).not.toBe(b.hash);
-  });
-
-  it('is deterministic for a fixed salt', () => {
-    const salt = Buffer.from('1234567890123456');
-    const a = hashAccountCredential('alice', 'secret', { salt });
-    const b = hashAccountCredential('alice', 'secret', { salt });
-    expect(a.hash).toBe(b.hash);
-  });
-
-  it('honours a custom key length', () => {
-    const entry = hashAccountCredential('alice', 'secret', { keyLen: 32 });
-    // base64 of 32 bytes → ~44 chars; base64 of 64 bytes → ~88 chars
-    expect(Buffer.from(entry.hash, 'base64').length).toBe(32);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// DynamoAccountStore — synchronous verify against pre-loaded hashed entries
-// ---------------------------------------------------------------------------
-
-describe('DynamoAccountStore', () => {
-  it('accepts valid PLAIN credentials and returns the account name', () => {
-    const entry = hashAccountCredential('alice', 'secret');
-    const store = new DynamoAccountStore([entry]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'secret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-
-  it('rejects a wrong password', () => {
-    const entry = hashAccountCredential('alice', 'secret');
-    const store = new DynamoAccountStore([entry]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'wrong')).ok).toBe(false);
-  });
-
-  it('rejects an unknown username', () => {
-    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
-    expect(store.verify('PLAIN', plainPayload('bob', 'secret')).ok).toBe(false);
-  });
-
-  it('rejects a non-PLAIN mechanism', () => {
-    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
-    expect(store.verify('EXTERNAL', plainPayload('alice', 'secret')).ok).toBe(false);
-  });
-
-  it('rejects a RAW payload', () => {
-    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
-    expect(store.verify('PLAIN', { kind: 'RAW', data: 'whatever' }).ok).toBe(false);
-  });
-
-  it('handles multiple loaded accounts', () => {
-    const store = new DynamoAccountStore([
-      hashAccountCredential('alice', 'a-secret'),
-      hashAccountCredential('bob', 'b-secret'),
-    ]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'a-secret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-    expect(store.verify('PLAIN', plainPayload('bob', 'b-secret'))).toEqual({
-      ok: true,
-      account: 'bob',
-    });
-  });
-
-  it('fails every verify when constructed with no entries', () => {
-    const store = new DynamoAccountStore([]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'secret')).ok).toBe(false);
-  });
-
-  it('round-trips an externally-constructed HashedAccountCredential', () => {
-    const row: HashedAccountCredential = hashAccountCredential('carol', 'p@ss');
-    const store = new DynamoAccountStore([row]);
-    expect(store.verify('PLAIN', plainPayload('carol', 'p@ss'))).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-
-  it('reports the number of loaded entries via size', () => {
-    const store = new DynamoAccountStore([
-      hashAccountCredential('alice', 'a'),
-      hashAccountCredential('bob', 'b'),
-    ]);
-    expect(store.size).toBe(2);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveAccountStore — table-then-config precedence (mock-based)
-// ---------------------------------------------------------------------------
-
-describe('resolveAccountStore', () => {
-  it('returns a DynamoAccountStore when the table has rows (table wins)', async () => {
-    const entry = hashAccountCredential('alice', 's3cret');
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).resolves({
-      Items: [entry],
-    });
-
-    const fallback = bindAccountStore(configWith([{ username: 'envuser', password: 'env-pw' }]));
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      fallback === undefined
-        ? undefined
-        : makeTestServerConfig({ saslAccounts: [{ username: 'envuser', password: 'env-pw' }] }),
-    );
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', plainPayload('alice', 's3cret')).ok).toBe(true);
-    // Config account does NOT verify (table is authoritative).
-    expect(store?.verify('PLAIN', plainPayload('envuser', 'env-pw')).ok).toBe(false);
-  });
-
-  it('falls back to config-seeded store when the table is empty', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).resolves({ Items: [] });
-
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      configWith([{ username: 'bob', password: 'pw' }]),
-    );
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', plainPayload('bob', 'pw')).ok).toBe(true);
-  });
-
-  it('falls back to config-seeded store when the scan throws', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).rejects(new Error('ResourceNotFoundException'));
-
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      configWith([{ username: 'bob', password: 'pw' }]),
-    );
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', plainPayload('bob', 'pw')).ok).toBe(true);
-  });
-
-  it('returns undefined when table is empty and no config accounts', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).resolves({ Items: [] });
-
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      undefined,
-    );
-    expect(store).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// putAccountCredential — CRUD/seed entry point (mock-based)
-// ---------------------------------------------------------------------------
-
-describe('putAccountCredential', () => {
-  it('writes a hashed row to DynamoDB and returns the credential', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(PutCommand).resolves({});
-
-    const entry = await putAccountCredential(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      'alice',
-      's3cret',
-    );
-    expect(entry.account).toBe('alice');
-    expect(entry.algorithm).toBe('scrypt');
-
-    const calls = ddb.commandCalls(PutCommand);
-    expect(calls).toHaveLength(1);
-    const item = calls[0]?.args[0].input.Item as HashedAccountCredential;
-    expect(item.account).toBe('alice');
-    expect(item.algorithm).toBe('scrypt');
-    expect(item.salt).toBe(entry.salt);
-    expect(item.hash).toBe(entry.hash);
-  });
-
-  it('the written row round-trips through DynamoAccountStore', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(PutCommand).resolves({});
-
-    const entry = await putAccountCredential(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      'alice',
-      's3cret',
-    );
-
-    // Simulate reading the row back via DynamoAccountStore.
-    const store = new DynamoAccountStore([entry]);
-    expect(store.verify('PLAIN', plainPayload('alice', 's3cret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-});