serverless-ircd 0.9.0 → 0.11.0

package/packages/cf-adapter/src/d1-account-store.ts

@@ -1,198 +0,0 @@
-/**
- * D1-backed SASL account store primitives for the Cloudflare adapter.
- *
- * Mirrors the AWS `dynamo-account-store.ts` / `account-store.ts` pair:
- * credentials are stored as scrypt hashes (never plaintext) in a D1
- * `accounts` table and pre-loaded at {@link ConnectionDO} construction
- * into the shared {@link HashedAccountStore}.
- *
- * Table-then-config precedence is implemented by {@link resolveAccountStore}:
- * when the D1 table has rows it is authoritative; when it is empty (or
- * unreachable, or the binding is absent) the code falls back to the
- * `SASL_ACCOUNTS` env-var seed — preserving the config-seed behaviour for
- * deployments that have not migrated to D1.
- *
- * The adapters diverge only at the scan/put boundary; the hashing helpers
- * and the synchronous {@link HashedAccountStore} are shared via `irc-core`.
- */
-
-import {
-  type AccountStore,
-  type HashedAccountCredential,
-  HashedAccountStore,
-  InMemoryAccountStore,
-  hashAccountCredential,
-} from '@serverless-ircd/irc-core';
-
-/**
- * SQL to create the `accounts` table. Exported so the seed tool and
- * provisioning docs reference one schema definition.
- */
-export const CREATE_ACCOUNTS_TABLE_SQL =
-  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
-
-/**
- * A raw D1 row — the untyped shape returned by `prepare().all()`. Each
- * column is `unknown` until validated into a {@link HashedAccountCredential}.
- */
-type AccountsRow = Record<string, unknown>;
-
-/**
- * Coerces a raw D1 row into a {@link HashedAccountCredential}, or returns
- * `undefined` when the row is missing required columns or has the wrong
- * types. Mirrors the silent-skip behaviour of the DynamoDB loader.
- */
-function coerceRow(row: AccountsRow): HashedAccountCredential | undefined {
-  const { account, algorithm, salt, hash } = row;
-  if (
-    typeof account !== 'string' ||
-    typeof algorithm !== 'string' ||
-    typeof salt !== 'string' ||
-    typeof hash !== 'string'
-  ) {
-    return undefined;
-  }
-  return {
-    account,
-    algorithm: algorithm as HashedAccountCredential['algorithm'],
-    salt,
-    hash,
-  };
-}
-
-/**
- * Queries the D1 `accounts` table and returns a fully-populated
- * {@link HashedAccountStore}, or `undefined` when the table has no rows.
- *
- * Rows missing required attributes are silently skipped. Callers that need
- * the table-then-config fallback should use {@link resolveAccountStore}
- * rather than catching `undefined` themselves.
- *
- * @param db The D1 binding (may be `undefined` when D1 is not configured).
- */
-export async function loadD1AccountStore(
-  db: D1Database | undefined,
-): Promise<HashedAccountStore | undefined> {
-  if (db === undefined) return undefined;
-  const result = await db
-    .prepare('SELECT account, algorithm, salt, hash FROM accounts')
-    .all<AccountsRow>();
-  const entries: HashedAccountCredential[] = [];
-  for (const row of result.results ?? []) {
-    const entry = coerceRow(row);
-    if (entry !== undefined) entries.push(entry);
-  }
-  if (entries.length === 0) return undefined;
-  return new HashedAccountStore(entries);
-}
-
-/**
- * Writes (or re-seeds) a SASL PLAIN account into the D1 `accounts` table.
- *
- * The password is hashed via {@link hashAccountCredential} (scrypt, random
- * salt) and stored as a {@link HashedAccountCredential} row — plaintext is
- * never written. A repeat call for the same `username` overwrites the prior
- * row (the PK is `account`), so this is the canonical CRUD/seed entry point
- * for oper and SASL account provisioning.
- *
- * @returns The stored {@link HashedAccountCredential} (for tooling/tests).
- */
-export async function putAccountCredential(
-  db: D1Database,
-  username: string,
-  password: string,
-): Promise<HashedAccountCredential> {
-  const entry = hashAccountCredential(username, password);
-  await db
-    .prepare('INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)')
-    .bind(entry.account, entry.algorithm, entry.salt, entry.hash)
-    .run();
-  return entry;
-}
-
-/**
- * Builds a self-contained `INSERT OR REPLACE` SQL statement that writes a
- * scrypt-hashed account row, suitable for `wrangler d1 execute --command`.
- *
- * The password is hashed via {@link hashAccountCredential}; the plaintext
- * never appears in the SQL. The values are single-quoted with embedded
- * single quotes doubled (`'` → `''`) to avoid injection through the
- * username or the base64 output.
- *
- * This is the pure (non-IO) half of {@link putAccountCredential}; the seed
- * CLI (`tools/seed-cf-accounts.ts`) calls this and pipes the result to
- * `wrangler d1 execute`, while the runtime `ConnectionDO` path uses the
- * bound-parameter {@link putAccountCredential}.
- *
- * @returns The hashed credential and the executable SQL string.
- */
-export function buildAccountPutStatement(
-  username: string,
-  password: string,
-): { entry: HashedAccountCredential; sql: string } {
-  const entry = hashAccountCredential(username, password);
-  const sql = `INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES ('${sqlEscape(entry.account)}', '${sqlEscape(entry.algorithm)}', '${sqlEscape(entry.salt)}', '${sqlEscape(entry.hash)}')`;
-  return { entry, sql };
-}
-
-/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
-function sqlEscape(value: string): string {
-  return value.replace(/'/g, "''");
-}
-
-/**
- * Resolves the SASL account store for a CF deployment, applying the
- * table-then-config precedence.
- *
- *   1. Queries the D1 `accounts` table (pre-loading every hashed credential
- *      into a {@link HashedAccountStore}). When the table has one or more
- *      rows it is authoritative — the table wins and the config seed is
- *      ignored.
- *   2. When the table is empty (or the binding is absent), falls back to
- *      the `SASL_ACCOUNTS` env-var seed (an {@link InMemoryAccountStore})
- *      so existing deployments that have not migrated to D1 keep working.
- *   3. Returns `undefined` when neither source has accounts so the actor's
- *      `ctx.accounts` stays unset (`AUTHENTICATE PLAIN` → `904`).
- *
- * Query failures are swallowed and treated as an empty table, falling
- * through to the config seed — mirroring `resolveAccountStore` on AWS.
- *
- * @param db  The D1 binding (`undefined` when D1 is not configured).
- * @param saslAccountsRaw The raw `SASL_ACCOUNTS` env var (newline-delimited
- *   `username:password` pairs), or `undefined` when unset.
- */
-export async function resolveAccountStore(
-  db: D1Database | undefined,
-  saslAccountsRaw: string | undefined,
-): Promise<AccountStore | undefined> {
-  try {
-    const store = await loadD1AccountStore(db);
-    if (store !== undefined) return store;
-  } catch {
-    // Table might not exist yet or be unreachable; fall through to seed.
-  }
-  const seed = parseSeed(saslAccountsRaw);
-  if (seed.length === 0) return undefined;
-  return new InMemoryAccountStore(seed);
-}
-
-/**
- * Parses the `SASL_ACCOUNTS` env var into credential entries for the
- * config-seed fallback. Re-exported from the in-memory account-store module
- * so the precedence resolver is self-contained.
- */
-function parseSeed(raw: string | undefined): Array<{ username: string; password: string }> {
-  if (raw === undefined || raw.length === 0) return [];
-  const out: Array<{ username: string; password: string }> = [];
-  for (const line of raw.split('\n')) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) continue;
-    const sep = trimmed.indexOf(':');
-    if (sep <= 0) continue;
-    const username = trimmed.slice(0, sep);
-    const password = trimmed.slice(sep + 1);
-    if (username.length === 0 || password.length === 0) continue;
-    out.push({ username, password });
-  }
-  return out;
-}

package/packages/cf-adapter/tests/d1-account-store.test.ts

@@ -1,274 +0,0 @@
-/**
- * D1-backed SASL account store + precedence resolver.
- *
- * Exercises the real D1 round-trip via miniflare: `putAccountCredential`
- * writes a hashed row, `loadD1AccountStore` reads it back, and
- * `resolveAccountStore` applies the table-then-config precedence.
- */
-
-import { env } from 'cloudflare:test';
-import { hashAccountCredential } from '@serverless-ircd/irc-core';
-import { beforeEach, describe, expect, it } from 'vitest';
-import {
-  buildAccountPutStatement,
-  loadD1AccountStore,
-  putAccountCredential,
-  resolveAccountStore,
-} from '../src/d1-account-store';
-
-declare global {
-  namespace Cloudflare {
-    interface Env {
-      ACCOUNTS_DB: D1Database;
-    }
-  }
-}
-
-const CREATE_TABLE =
-  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
-
-async function resetDb(): Promise<void> {
-  await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
-  await env.ACCOUNTS_DB.exec(CREATE_TABLE);
-}
-
-describe('loadD1AccountStore', () => {
-  beforeEach(async () => {
-    await resetDb();
-  });
-
-  it('returns undefined when the table has no rows', async () => {
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeUndefined();
-  });
-
-  it('verifies an account after a row is written via putAccountCredential', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 's3cret');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 's3cret' }),
-    ).toEqual({ ok: true, account: 'alice' });
-  });
-
-  it('rejects a wrong password after round-trip', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'right');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
-      false,
-    );
-  });
-
-  it('loads multiple distinct accounts', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'a1');
-    await putAccountCredential(env.ACCOUNTS_DB, 'bob', 'b2');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.size).toBe(2);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'a1' }).ok).toBe(
-      true,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'b2' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('overwrites an existing account on re-seed', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'old');
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'new');
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.size).toBe(1);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'old' }).ok).toBe(
-      false,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'new' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('skips rows missing required columns', async () => {
-    // Use a permissive table (no NOT NULL) to simulate a row with a missing
-    // salt — the production schema's NOT NULL prevents this, but the loader
-    // stays defensive against schema drift / manual edits.
-    await env.ACCOUNTS_DB.exec('DROP TABLE accounts');
-    await env.ACCOUNTS_DB.exec(
-      'CREATE TABLE accounts (account TEXT PRIMARY KEY, algorithm TEXT, salt TEXT, hash TEXT)',
-    );
-    await env.ACCOUNTS_DB.prepare(
-      "INSERT INTO accounts (account, algorithm, hash) VALUES ('bad', 'scrypt', 'bbbb')",
-    ).run();
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store).toBeUndefined();
-  });
-});
-
-describe('putAccountCredential', () => {
-  beforeEach(async () => {
-    await resetDb();
-  });
-
-  it('writes a hashed row that round-trips through the store', async () => {
-    const entry = await putAccountCredential(env.ACCOUNTS_DB, 'carol', 'p@ss');
-    expect(entry.account).toBe('carol');
-    expect(entry.algorithm).toBe('scrypt');
-
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'carol', password: 'p@ss' })).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-
-  it('never writes the plaintext password to the row', async () => {
-    const entry = await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'hunter2-secret');
-    expect(entry.account).not.toContain('hunter2');
-    expect(entry.salt).not.toContain('hunter2');
-    expect(entry.hash).not.toContain('hunter2');
-  });
-
-  it('matches a manually-hashed entry written via raw D1 insert', async () => {
-    const hashed = hashAccountCredential('dave', 'pw');
-    await env.ACCOUNTS_DB.prepare(
-      'INSERT INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)',
-    )
-      .bind(hashed.account, hashed.algorithm, hashed.salt, hashed.hash)
-      .run();
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'dave', password: 'pw' }).ok).toBe(
-      true,
-    );
-  });
-});
-
-describe('buildAccountPutStatement (seed SQL builder)', () => {
-  it('produces an INSERT OR REPLACE statement with scrypt-hashed values', () => {
-    const { entry, sql } = buildAccountPutStatement('alice', 's3cret');
-    expect(entry.account).toBe('alice');
-    expect(entry.algorithm).toBe('scrypt');
-    expect(sql).toContain('INSERT OR REPLACE INTO accounts');
-    // Plaintext must never appear in the SQL.
-    expect(sql).not.toContain('s3cret');
-  });
-
-  it('the generated SQL round-trips through loadD1AccountStore', async () => {
-    await resetDb();
-    const { sql } = buildAccountPutStatement('carol', 'p@ss');
-    await env.ACCOUNTS_DB.exec(sql);
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'carol', password: 'p@ss' })).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-
-  it('escapes single quotes in the username to avoid breaking the SQL', async () => {
-    await resetDb();
-    const { sql } = buildAccountPutStatement("o'brien", 'pw');
-    await env.ACCOUNTS_DB.exec(sql);
-    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: "o'brien", password: 'pw' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('escapes single quotes in the base64 hash output', () => {
-    // The hash is base64 so it won't contain quotes, but the escaper is
-    // still exercised — verify the SQL is well-formed.
-    const { sql } = buildAccountPutStatement('alice', 'secret');
-    // A valid INSERT with four quoted values.
-    expect(sql.match(/'/g)?.length).toBe(8);
-  });
-});
-
-describe('resolveAccountStore precedence', () => {
-  beforeEach(async () => {
-    await resetDb();
-  });
-
-  it('returns the D1 store when the table has rows (table wins)', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'table-secret');
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, 'envuser:env-secret');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'table-secret' }).ok,
-    ).toBe(true);
-    // Config account does NOT verify (table is authoritative).
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(false);
-  });
-
-  it('falls back to the SASL_ACCOUNTS seed when the table is empty', async () => {
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, 'envuser:env-secret');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(true);
-  });
-
-  it('returns undefined when the table is empty and no seed is set', async () => {
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, undefined);
-    expect(store).toBeUndefined();
-  });
-
-  it('returns undefined when the table is empty and the seed is blank', async () => {
-    const store = await resolveAccountStore(env.ACCOUNTS_DB, '');
-    expect(store).toBeUndefined();
-  });
-
-  it('falls back to the seed when the D1 binding is undefined', async () => {
-    const store = await resolveAccountStore(undefined, 'envuser:env-secret');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveAccountStore seed parsing — malformed entries are skipped so a
-// trailing newline or partial edit does not break boot.
-// ---------------------------------------------------------------------------
-
-describe('resolveAccountStore — SASL_ACCOUNTS seed edge cases', () => {
-  it('skips blank lines within the seed', async () => {
-    const store = await resolveAccountStore(undefined, 'alice:secret\n\nbob:pw\n   \n');
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' }).ok,
-    ).toBe(true);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'pw' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('skips lines with no colon separator', async () => {
-    const store = await resolveAccountStore(undefined, 'alice:secret\nnocolon\nbob:pw');
-    // Only the two well-formed entries are loaded.
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'nocolon', password: '' }).ok).toBe(
-      false,
-    );
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' }).ok,
-    ).toBe(true);
-  });
-
-  it('skips lines where the colon is at position 0', async () => {
-    const store = await resolveAccountStore(undefined, ':secret\nalice:valid');
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'valid' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('skips lines with an empty password', async () => {
-    const store = await resolveAccountStore(undefined, 'alice:\nbob:valid');
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'valid' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('returns undefined when every line is malformed', async () => {
-    const store = await resolveAccountStore(undefined, '\n   \n:no-user\nuser:');
-    expect(store).toBeUndefined();
-  });
-});

package/packages/irc-core/tests/account-store.test.ts

@@ -1,131 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  type AccountStore,
-  InMemoryAccountStore,
-  type SaslPayload,
-  type SaslResult,
-} from '../src/ports';
-
-/** Convenience: a PLAIN payload. */
-function plain(username: string, password: string): SaslPayload {
-  return { kind: 'PLAIN', username, password };
-}
-
-describe('InMemoryAccountStore — PLAIN', () => {
-  it('implements the AccountStore port', () => {
-    const store: AccountStore = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret' },
-    ]);
-    expect(store).toBeDefined();
-  });
-
-  it('accepts valid PLAIN credentials and returns the account name', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('alice', 'secret'));
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-
-  it('rejects a wrong password', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('alice', 'wrong'));
-    expect(out.ok).toBe(false);
-  });
-
-  it('rejects an unknown username', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('bob', 'secret'));
-    expect(out.ok).toBe(false);
-  });
-
-  it('matches the first of several configured accounts', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'a-secret' },
-      { username: 'bob', password: 'b-secret' },
-    ]);
-    expect(store.verify('PLAIN', plain('bob', 'b-secret'))).toEqual<SaslResult>({
-      ok: true,
-      account: 'bob',
-    });
-  });
-
-  it('rejects when constructed with an empty account list', () => {
-    const store = new InMemoryAccountStore([]);
-    const out = store.verify('PLAIN', plain('alice', 'secret'));
-    expect(out.ok).toBe(false);
-  });
-
-  it('does not confuse credentials across accounts (no password cross-match)', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'a-secret' },
-      { username: 'bob', password: 'b-secret' },
-    ]);
-    // bob's password with alice's username must fail.
-    expect(store.verify('PLAIN', plain('alice', 'b-secret')).ok).toBe(false);
-  });
-});
-
-describe('InMemoryAccountStore — mechanism handling', () => {
-  it('rejects an unsupported mechanism with a failure result', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('CRAM-MD5', { kind: 'RAW', data: 'whatever' });
-    expect(out.ok).toBe(false);
-  });
-
-  it('treats the mechanism name case-insensitively for PLAIN', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('plain', plain('alice', 'secret'));
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-});
-
-describe('InMemoryAccountStore — EXTERNAL (mTLS)', () => {
-  it('maps a known cert subject to its account', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
-    ]);
-    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=alice' });
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-
-  it('rejects an unknown cert subject', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
-    ]);
-    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=evil' });
-    expect(out.ok).toBe(false);
-  });
-
-  it('rejects EXTERNAL when no cert subjects are configured', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=alice' });
-    expect(out.ok).toBe(false);
-  });
-
-  it('treats the mechanism name case-insensitively for EXTERNAL', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'secret', certSubject: 'CN=alice' },
-    ]);
-    const out = store.verify('external', { kind: 'EXTERNAL', identity: 'CN=alice' });
-    expect(out).toEqual<SaslResult>({ ok: true, account: 'alice' });
-  });
-
-  it('maps multiple accounts with distinct cert subjects', () => {
-    const store = new InMemoryAccountStore([
-      { username: 'alice', password: 'a', certSubject: 'CN=alice' },
-      { username: 'bob', password: 'b', certSubject: 'CN=bob' },
-    ]);
-    expect(store.verify('EXTERNAL', { kind: 'EXTERNAL', identity: 'CN=bob' })).toEqual<SaslResult>({
-      ok: true,
-      account: 'bob',
-    });
-  });
-});
-
-describe('InMemoryAccountStore — failure reason', () => {
-  it('returns a human-readable reason on failure', () => {
-    const store = new InMemoryAccountStore([{ username: 'alice', password: 'secret' }]);
-    const out = store.verify('PLAIN', plain('alice', 'wrong'));
-    if (out.ok) throw new Error('expected failure');
-    expect(out.reason.length).toBeGreaterThan(0);
-  });
-});