deps: migrate from go-chi/chi v1 to go-chi/chi/v5

Migrate all import paths from github.com/go-chi/chi to github.com/go-chi/chi/v5 and github.com/go-chi/chi/middleware to github.com/go-chi/chi/v5/middleware. This resolves GO-2026-4316 (open redirect vulnerability in RedirectSlashes middleware) by moving to the maintained v5 module path. Files changed: - go.mod: chi v1.5.5 → chi/v5 v5.2.1 - internal/server/server.go: updated import - internal/server/routes.go: updated imports - internal/middleware/middleware.go: updated import - internal/handlers/api.go: updated import - README.md: updated Required Libraries table
feat: store auth tokens as SHA-256 hashes instead of plaintext (#69 )
2026-03-10 07:27:26 -07:00 · 2026-03-10 12:44:29 +01:00 · 2026-03-10 11:54:27 +01:00 · 2026-03-10 11:41:43 +01:00 · 2026-03-10 11:20:15 +01:00 · 2026-03-10 11:08:13 +01:00
23 changed files with 564 additions and 883 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -21,6 +21,7 @@ node_modules/
 *.key

 # Build artifacts
+web/dist/
 /neoircd
 /bin/
 *.exe
--- a/14
+++ b/14
@@ -1,3 +1,13 @@
+# Web build stage — compile SPA from source
+# node:22-alpine, 2026-03-09
+FROM node@sha256:8094c002d08262dba12645a3b4a15cd6cd627d30bc782f53229a2ec13ee22a00 AS web-builder
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/src/ src/
+COPY web/build.sh build.sh
+RUN sh build.sh
+
 # Lint stage — fast feedback on formatting and lint issues
 # golangci/golangci-lint:v2.1.6, 2026-03-02
 FROM golangci/golangci-lint@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b AS lint
@@ -5,6 +15,9 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
+# Create placeholder files so //go:embed dist/* in web/embed.go resolves
+# without depending on the web-builder stage (lint should fail fast)
+RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
 RUN make fmt-check
 RUN make lint

@@ -21,6 +34,7 @@ COPY go.mod go.sum ./
 RUN go mod download

 COPY . .
+COPY --from=web-builder /web/dist/ web/dist/

 RUN make test

--- a/README.md
+++ b/README.md
@@ -1032,6 +1032,12 @@ Return the current user's session state.

 **Request:** No body. Requires auth.

+**Query Parameters:**
+
+| Parameter | Type   | Default | Description |
+|-----------|--------|---------|-------------|
+| `initChannelState` | string | (none) | When set to `1`, enqueues synthetic JOIN + TOPIC + NAMES messages for every channel the session belongs to into the calling client's queue. Used by the SPA on reconnect to restore channel tabs without re-sending JOIN commands. |
+
 **Response:** `200 OK`
 ```json
 {
@@ -1064,6 +1070,12 @@ curl -s http://localhost:8080/api/v1/state \
  -H "Authorization: Bearer $TOKEN" | jq .
 ```

+**Reconnect with channel state initialization:**
+```bash
+curl -s "http://localhost:8080/api/v1/state?initChannelState=1" \
+  -H "Authorization: Bearer $TOKEN" | jq .
+```
+
 ### GET /api/v1/messages — Poll Messages (Long-Poll)

 Retrieve messages from the client's delivery queue. This is the primary
@@ -1362,16 +1374,18 @@ Return server metadata. No authentication required.
 ```json
 {
  "name": "My NeoIRC Server",
+  "version": "0.1.0",
  "motd": "Welcome! Be nice.",
  "users": 42
 }
 ```

-| Field   | Type    | Description |
-|---------|---------|-------------|
-| `name`  | string  | Server display name |
-| `motd`  | string  | Message of the day |
-| `users` | integer | Number of currently active user sessions |
+| Field     | Type    | Description |
+|-----------|---------|-------------|
+| `name`    | string  | Server display name |
+| `version` | string  | Server version |
+| `motd`    | string  | Message of the day |
+| `users`   | integer | Number of currently active user sessions |

 ### GET /.well-known/healthcheck.json — Health Check

@@ -1610,6 +1624,10 @@ authenticity.
  termination.
 - **CORS**: The server allows all origins by default (`Access-Control-Allow-Origin: *`).
  Restrict this in production via reverse proxy configuration if needed.
+- **Content-Security-Policy**: The server sets a strict CSP header on all
+  responses, restricting resource loading to same-origin and disabling
+  dangerous features (object embeds, framing, base tag injection). The
+  embedded SPA works without `'unsafe-inline'` for scripts or styles.

 ---

@@ -1838,26 +1856,16 @@ docker run -p 8080:8080 \
  neoirc
 ```

-The Dockerfile is a multi-stage build:
-1. **Build stage**: Compiles `neoircd` and `neoirc-cli` (CLI built to verify
+The Dockerfile is a four-stage build:
+1. **web-builder**: Installs Node dependencies and compiles the SPA (JSX →
+   bundled JS via esbuild) into `web/dist/`
+2. **lint**: Runs formatting checks and golangci-lint against the Go source
+   (uses empty placeholder files for `web/dist/` so it runs independently of
+   web-builder for fast feedback)
+3. **builder**: Runs tests and compiles static `neoircd` and `neoirc-cli`
+   binaries with the real SPA assets from web-builder (CLI built to verify
   compilation, not included in final image)
-2. **Final stage**: Alpine Linux + `neoircd` binary only
-
-```dockerfile
-FROM golang:1.24-alpine AS builder
-WORKDIR /src
-RUN apk add --no-cache make
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN go build -o /neoircd ./cmd/neoircd/
-RUN go build -o /neoirc-cli ./cmd/neoirc-cli/
-
-FROM alpine:latest
-COPY --from=builder /neoircd /usr/local/bin/neoircd
-EXPOSE 8080
-CMD ["neoircd"]
-```
+4. **final**: Minimal Alpine image with only the `neoircd` binary

 ### Binary

@@ -2306,10 +2314,14 @@ neoirc/
 │       └── http.go         # HTTP timeouts
 ├── web/
 │   ├── embed.go            # go:embed directive for SPA
-│   └── dist/               # Built SPA (vanilla JS, no build step)
-│       ├── index.html
-│       ├── style.css
-│       └── app.js
+│   ├── build.sh            # SPA build script (esbuild, runs in Docker)
+│   ├── package.json        # Node dependencies (preact, esbuild)
+│   ├── package-lock.json
+│   ├── src/                # SPA source files (JSX + HTML + CSS)
+│   │   ├── app.jsx
+│   │   ├── index.html
+│   │   └── style.css
+│   └── dist/               # Generated at Docker build time (not committed)
 ├── schema/                 # JSON Schema definitions (planned)
 ├── go.mod
 ├── go.sum
@@ -2324,7 +2336,7 @@ neoirc/
 | Purpose    | Library |
 |------------|---------|
 | DI         | `go.uber.org/fx` |
-| Router     | `github.com/go-chi/chi` |
+| Router     | `github.com/go-chi/chi/v5` |
 | Logging    | `log/slog` (stdlib) |
 | Config     | `github.com/spf13/viper` |
 | Env        | `github.com/joho/godotenv/autoload` |
--- a/REPO_POLICIES.md
+++ b/REPO_POLICIES.md
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-02-22
+last_modified: 2026-03-09
 ---

 This document covers repository structure, tooling, and workflow standards. Code
@@ -98,6 +98,13 @@ style conventions are in separate documents:
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
  a new repo.

+- **No build artifacts in version control.** Code-derived data (compiled
+  bundles, minified output, generated assets) must never be committed to the
+  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
+  should generate these at build time. Notable exception: Go protobuf generated
+  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
+  downloads code but does not execute code generation.
+
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.

 - Never force-push to `main`.
@@ -144,8 +151,14 @@ style conventions are in separate documents:
 - Use SemVer.

 - Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
-  Post-1.0.0: add new migration files.
+  the binary.
+    - `000_migration.sql` — contains ONLY the creation of the migrations
+      tracking table itself. Nothing else.
+    - `001_schema.sql` — the full application schema.
+    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    - **Post-1.0.0:** add new numbered migration files for each schema change.
+      Never edit existing migrations after release.

 - All repos should have an `.editorconfig` enforcing the project's indentation
  settings.
--- a/cmd/neoirc-cli/api/client.go
+++ b/cmd/neoirc-cli/api/client.go
@@ -13,6 +13,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"git.eeqj.de/sneak/neoirc/internal/irc"
 )

 const (
@@ -168,7 +170,7 @@ func (client *Client) PollMessages(
 func (client *Client) JoinChannel(channel string) error {
 	return client.SendMessage(
 		&Message{ //nolint:exhaustruct // only command+to needed
-			Command: "JOIN", To: channel,
+			Command: irc.CmdJoin, To: channel,
 		},
 	)
 }
@@ -177,7 +179,7 @@ func (client *Client) JoinChannel(channel string) error {
 func (client *Client) PartChannel(channel string) error {
 	return client.SendMessage(
 		&Message{ //nolint:exhaustruct // only command+to needed
-			Command: "PART", To: channel,
+			Command: irc.CmdPart, To: channel,
 		},
 	)
 }
--- a/cmd/neoirc-cli/main.go
+++ b/cmd/neoirc-cli/main.go
@@ -9,6 +9,7 @@ import (
 	"time"

 	api "git.eeqj.de/sneak/neoirc/cmd/neoirc-cli/api"
+	"git.eeqj.de/sneak/neoirc/internal/irc"
 )

 const (
@@ -86,7 +87,7 @@ func (a *App) handleInput(text string) {
 	}

 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "PRIVMSG",
+		Command: irc.CmdPrivmsg,
 		To:      target,
 		Body:    []string{text},
 	})
@@ -241,7 +242,7 @@ func (a *App) cmdNick(nick string) {
 	}

 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "NICK",
+		Command: irc.CmdNick,
 		Body:    []string{nick},
 	})
 	if err != nil {
@@ -376,7 +377,7 @@ func (a *App) cmdMsg(args string) {
 	}

 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "PRIVMSG",
+		Command: irc.CmdPrivmsg,
 		To:      target,
 		Body:    []string{text},
 	})
@@ -434,7 +435,7 @@ func (a *App) cmdTopic(args string) {

 	if args == "" {
 		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-			Command: "TOPIC",
+			Command: irc.CmdTopic,
 			To:      target,
 		})
 		if err != nil {
@@ -447,7 +448,7 @@ func (a *App) cmdTopic(args string) {
 	}

 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "TOPIC",
+		Command: irc.CmdTopic,
 		To:      target,
 		Body:    []string{args},
 	})
@@ -535,7 +536,7 @@ func (a *App) cmdMotd() {
 	}

 	err := a.client.SendMessage(
-		&api.Message{Command: "MOTD"}, //nolint:exhaustruct
+		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
@@ -572,7 +573,7 @@ func (a *App) cmdWho(args string) {

 	err := a.client.SendMessage(
 		&api.Message{ //nolint:exhaustruct
-			Command: "WHO", To: channel,
+			Command: irc.CmdWho, To: channel,
 		},
 	)
 	if err != nil {
@@ -603,7 +604,7 @@ func (a *App) cmdWhois(args string) {

 	err := a.client.SendMessage(
 		&api.Message{ //nolint:exhaustruct
-			Command: "WHOIS", To: args,
+			Command: irc.CmdWhois, To: args,
 		},
 	)
 	if err != nil {
@@ -653,7 +654,7 @@ func (a *App) cmdQuit() {

 	if a.connected && a.client != nil {
 		_ = a.client.SendMessage(
-			&api.Message{Command: "QUIT"}, //nolint:exhaustruct
+			&api.Message{Command: irc.CmdQuit}, //nolint:exhaustruct
 		)
 	}

@@ -738,19 +739,19 @@ func (a *App) handleServerMessage(msg *api.Message) {
 	a.mu.Unlock()

 	switch msg.Command {
-	case "PRIVMSG":
+	case irc.CmdPrivmsg:
 		a.handlePrivmsgEvent(msg, timestamp, myNick)
-	case "JOIN":
+	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
-	case "PART":
+	case irc.CmdPart:
 		a.handlePartEvent(msg, timestamp)
-	case "QUIT":
+	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
-	case "NICK":
+	case irc.CmdNick:
 		a.handleNickEvent(msg, timestamp, myNick)
-	case "NOTICE":
+	case irc.CmdNotice:
 		a.handleNoticeEvent(msg, timestamp)
-	case "TOPIC":
+	case irc.CmdTopic:
 		a.handleTopicEvent(msg, timestamp)
 	default:
 		a.handleDefaultEvent(msg, timestamp)
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
 	github.com/gdamore/tcell/v2 v2.13.8
 	github.com/getsentry/sentry-go v0.42.0
-	github.com/go-chi/chi v1.5.5
+	github.com/go-chi/chi/v5 v5.2.1
 	github.com/go-chi/cors v1.2.2
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
--- a/go.sum
+++ b/go.sum
@@ -18,8 +18,8 @@ github.com/gdamore/tcell/v2 v2.13.8 h1:Mys/Kl5wfC/GcC5Cx4C2BIQH9dbnhnkPgS9/wF3Rl
 github.com/gdamore/tcell/v2 v2.13.8/go.mod h1:+Wfe208WDdB7INEtCsNrAN6O2m+wsTPk1RAovjaILlo=
 github.com/getsentry/sentry-go v0.42.0 h1:eeFMACuZTbUQf90RE8dE4tXeSe4CZyfvR1MBL7RLEt8=
 github.com/getsentry/sentry-go v0.42.0/go.mod h1:eRXCoh3uvmjQLY6qu63BjUZnaBu5L5WhMV1RwYO8W5s=
-github.com/go-chi/chi v1.5.5 h1:vOB/HbEMt9QqBqErz07QehcOKHaWFtuj87tTDVz2qXE=
-github.com/go-chi/chi v1.5.5/go.mod h1:C9JqLr3tIYjDOZpzn+BCuxY8z8vmca43EeMgyZt7irw=
+github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
+github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
--- a/internal/db/auth.go
+++ b/internal/db/auth.go
@@ -64,12 +64,14 @@ func (database *Database) RegisterUser(

 	sessionID, _ := res.LastInsertId()

+	tokenHash := hashToken(token)
+
 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
 		 (uuid, session_id, token,
 		  created_at, last_seen)
 		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, token, now, now)
+		clientUUID, sessionID, tokenHash, now, now)
 	if err != nil {
 		_ = transaction.Rollback()

@@ -137,12 +139,14 @@ func (database *Database) LoginUser(

 	now := time.Now()

+	tokenHash := hashToken(token)
+
 	res, err := database.conn.ExecContext(ctx,
 		`INSERT INTO clients
 		 (uuid, session_id, token,
 		  created_at, last_seen)
 		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, token, now, now)
+		clientUUID, sessionID, tokenHash, now, now)
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
 			"create login client: %w", err,
--- a/internal/db/errors.go
+++ b/internal/db/errors.go
@@ -0,0 +1,20 @@
+// Package db provides database access and migration management.
+package db
+
+import (
+	"errors"
+
+	"modernc.org/sqlite"
+	sqlite3 "modernc.org/sqlite/lib"
+)
+
+// IsUniqueConstraintError reports whether err is a SQLite
+// unique-constraint violation.
+func IsUniqueConstraintError(err error) bool {
+	var sqliteErr *sqlite.Error
+	if !errors.As(err, &sqliteErr) {
+		return false
+	}
+
+	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_UNIQUE
+}
--- a/internal/db/queries.go
+++ b/internal/db/queries.go
@@ -3,12 +3,15 @@ package db
 import (
 	"context"
 	"crypto/rand"
+	"crypto/sha256"
 	"database/sql"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"strconv"
 	"time"

+	"git.eeqj.de/sneak/neoirc/internal/irc"
 	"github.com/google/uuid"
 )

@@ -29,10 +32,19 @@ func generateToken() (string, error) {
 	return hex.EncodeToString(buf), nil
 }

+// hashToken returns the lowercase hex-encoded SHA-256
+// digest of a plaintext token string.
+func hashToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+
+	return hex.EncodeToString(sum[:])
+}
+
 // IRCMessage is the IRC envelope for all messages.
 type IRCMessage struct {
 	ID      string          `json:"id"`
 	Command string          `json:"command"`
+	Code    int             `json:"code,omitempty"`
 	From    string          `json:"from,omitempty"`
 	To      string          `json:"to,omitempty"`
 	Params  json.RawMessage `json:"params,omitempty"`
@@ -42,6 +54,15 @@ type IRCMessage struct {
 	DBID    int64           `json:"-"`
 }

+// isNumericCode returns true if s is exactly a 3-digit
+// IRC numeric reply code.
+func isNumericCode(s string) bool {
+	return len(s) == 3 &&
+		s[0] >= '0' && s[0] <= '9' &&
+		s[1] >= '0' && s[1] <= '9' &&
+		s[2] >= '0' && s[2] <= '9'
+}
+
 // ChannelInfo is a lightweight channel representation.
 type ChannelInfo struct {
 	ID    int64  `json:"id"`
@@ -93,12 +114,14 @@ func (database *Database) CreateSession(

 	sessionID, _ := res.LastInsertId()

+	tokenHash := hashToken(token)
+
 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
 		 (uuid, session_id, token,
 		  created_at, last_seen)
 		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, token, now, now)
+		clientUUID, sessionID, tokenHash, now, now)
 	if err != nil {
 		_ = transaction.Rollback()

@@ -131,6 +154,8 @@ func (database *Database) GetSessionByToken(
 		nick      string
 	)

+	tokenHash := hashToken(token)
+
 	err := database.conn.QueryRowContext(
 		ctx,
 		`SELECT s.id, c.id, s.nick
@@ -138,7 +163,7 @@ func (database *Database) GetSessionByToken(
 		 INNER JOIN sessions s
 		   ON s.id = c.session_id
 		 WHERE c.token = ?`,
-		token,
+		tokenHash,
 	).Scan(&sessionID, &clientID, &nick)
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
@@ -717,6 +742,15 @@ func scanMessages(
 		msg.DBID = qID
 		lastQID = qID

+		if isNumericCode(msg.Command) {
+			code, _ := strconv.Atoi(msg.Command)
+			msg.Code = code
+
+			if name := irc.Name(code); name != "" {
+				msg.Command = name
+			}
+		}
+
 		msgs = append(msgs, msg)
 	}

--- a/internal/handlers/api.go
+++ b/internal/handlers/api.go
@@ -10,7 +10,9 @@ import (
 	"strings"
 	"time"

-	"github.com/go-chi/chi"
+	"git.eeqj.de/sneak/neoirc/internal/db"
+	"git.eeqj.de/sneak/neoirc/internal/irc"
+	"github.com/go-chi/chi/v5"
 )

 var validNickRe = regexp.MustCompile(
@@ -27,7 +29,6 @@ const (
 	defaultMaxBodySize = 4096
 	defaultHistLimit   = 50
 	maxHistLimit       = 500
-	cmdPrivmsg         = "PRIVMSG"
 )

 func (hdlr *Handlers) maxBodySize() int64 {
@@ -199,7 +200,7 @@ func (hdlr *Handlers) handleCreateSessionError(
 	request *http.Request,
 	err error,
 ) {
-	if strings.Contains(err.Error(), "UNIQUE") {
+	if db.IsUniqueConstraintError(err) {
 		hdlr.respondError(
 			writer, request,
 			"nick already taken",
@@ -232,20 +233,20 @@ func (hdlr *Handlers) deliverWelcome(

 	// 001 RPL_WELCOME
 	hdlr.enqueueNumeric(
-		ctx, clientID, "001", nick, nil,
+		ctx, clientID, irc.RplWelcome, nick, nil,
 		"Welcome to the network, "+nick,
 	)

 	// 002 RPL_YOURHOST
 	hdlr.enqueueNumeric(
-		ctx, clientID, "002", nick, nil,
+		ctx, clientID, irc.RplYourHost, nick, nil,
 		"Your host is "+srvName+
 			", running version "+version,
 	)

 	// 003 RPL_CREATED
 	hdlr.enqueueNumeric(
-		ctx, clientID, "003", nick, nil,
+		ctx, clientID, irc.RplCreated, nick, nil,
 		"This server was created "+
 			hdlr.params.Globals.StartTime.
 				Format("2006-01-02"),
@@ -253,14 +254,14 @@ func (hdlr *Handlers) deliverWelcome(

 	// 004 RPL_MYINFO
 	hdlr.enqueueNumeric(
-		ctx, clientID, "004", nick,
+		ctx, clientID, irc.RplMyInfo, nick,
 		[]string{srvName, version, "", "imnst"},
 		"",
 	)

 	// 005 RPL_ISUPPORT
 	hdlr.enqueueNumeric(
-		ctx, clientID, "005", nick,
+		ctx, clientID, irc.RplIsupport, nick,
 		[]string{
 			"CHANTYPES=#",
 			"NICKLEN=32",
@@ -305,7 +306,7 @@ func (hdlr *Handlers) deliverLusers(

 	// 251 RPL_LUSERCLIENT
 	hdlr.enqueueNumeric(
-		ctx, clientID, "251", nick, nil,
+		ctx, clientID, irc.RplLuserClient, nick, nil,
 		fmt.Sprintf(
 			"There are %d users and 0 invisible on 1 servers",
 			userCount,
@@ -314,21 +315,21 @@ func (hdlr *Handlers) deliverLusers(

 	// 252 RPL_LUSEROP
 	hdlr.enqueueNumeric(
-		ctx, clientID, "252", nick,
+		ctx, clientID, irc.RplLuserOp, nick,
 		[]string{"0"},
 		"operator(s) online",
 	)

 	// 254 RPL_LUSERCHANNELS
 	hdlr.enqueueNumeric(
-		ctx, clientID, "254", nick,
+		ctx, clientID, irc.RplLuserChannels, nick,
 		[]string{strconv.FormatInt(chanCount, 10)},
 		"channels formed",
 	)

 	// 255 RPL_LUSERME
 	hdlr.enqueueNumeric(
-		ctx, clientID, "255", nick, nil,
+		ctx, clientID, irc.RplLuserMe, nick, nil,
 		fmt.Sprintf(
 			"I have %d clients and 1 servers",
 			userCount,
@@ -366,19 +367,19 @@ func (hdlr *Handlers) deliverMOTD(
 	}

 	hdlr.enqueueNumeric(
-		ctx, clientID, "375", nick, nil,
+		ctx, clientID, irc.RplMotdStart, nick, nil,
 		"- "+srvName+" Message of the Day -",
 	)

 	for line := range strings.SplitSeq(motd, "\n") {
 		hdlr.enqueueNumeric(
-			ctx, clientID, "372", nick, nil,
+			ctx, clientID, irc.RplMotd, nick, nil,
 			"- "+line,
 		)
 	}

 	hdlr.enqueueNumeric(
-		ctx, clientID, "376", nick, nil,
+		ctx, clientID, irc.RplEndOfMotd, nick, nil,
 		"End of /MOTD command.",
 	)

@@ -397,10 +398,13 @@ func (hdlr *Handlers) serverName() string {
 func (hdlr *Handlers) enqueueNumeric(
 	ctx context.Context,
 	clientID int64,
-	command, nick string,
+	code int,
+	nick string,
 	params []string,
 	text string,
 ) {
+	command := fmt.Sprintf("%03d", code)
+
 	body, err := json.Marshal([]string{text})
 	if err != nil {
 		hdlr.log.Error(
@@ -441,13 +445,17 @@ func (hdlr *Handlers) enqueueNumeric(
 }

 // HandleState returns the current session's info and
-// channels.
+// channels.  When called with ?initChannelState=1, it also
+// enqueues synthetic JOIN + TOPIC + NAMES messages for
+// every channel the session belongs to so that a
+// reconnecting client can rebuild its channel tabs from
+// the message stream.
 func (hdlr *Handlers) HandleState() http.HandlerFunc {
 	return func(
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		sessionID, _, nick, ok :=
+		sessionID, clientID, nick, ok :=
 			hdlr.requireAuth(writer, request)
 		if !ok {
 			return
@@ -469,6 +477,12 @@ func (hdlr *Handlers) HandleState() http.HandlerFunc {
 			return
 		}

+		if request.URL.Query().Get("initChannelState") == "1" {
+			hdlr.initChannelState(
+				request, clientID, sessionID, nick,
+			)
+		}
+
 		hdlr.respondJSON(writer, request, map[string]any{
 			"id":       sessionID,
 			"nick":     nick,
@@ -477,6 +491,52 @@ func (hdlr *Handlers) HandleState() http.HandlerFunc {
 	}
 }

+// initChannelState enqueues synthetic JOIN messages and
+// join-numerics (TOPIC, NAMES) for every channel the
+// session belongs to.  Messages are enqueued only to the
+// specified client so other clients/sessions are not
+// affected.
+func (hdlr *Handlers) initChannelState(
+	request *http.Request,
+	clientID, sessionID int64,
+	nick string,
+) {
+	ctx := request.Context()
+
+	channels, err := hdlr.params.Database.
+		GetSessionChannels(ctx, sessionID)
+	if err != nil || len(channels) == 0 {
+		return
+	}
+
+	for _, chanInfo := range channels {
+		// Enqueue a synthetic JOIN (only to this client).
+		dbID, _, insErr := hdlr.params.Database.
+			InsertMessage(
+				ctx, "JOIN", nick, chanInfo.Name,
+				nil, nil, nil,
+			)
+		if insErr != nil {
+			hdlr.log.Error(
+				"initChannelState: insert JOIN",
+				"error", insErr,
+			)
+
+			continue
+		}
+
+		_ = hdlr.params.Database.EnqueueToClient(
+			ctx, clientID, dbID,
+		)
+
+		// Enqueue TOPIC + NAMES numerics.
+		hdlr.deliverJoinNumerics(
+			request, clientID, sessionID,
+			nick, chanInfo.Name, chanInfo.ID,
+		)
+	}
+}
+
 // HandleListAllChannels returns all channels on the server.
 func (hdlr *Handlers) HandleListAllChannels() http.HandlerFunc {
 	return func(
@@ -750,38 +810,38 @@ func (hdlr *Handlers) dispatchCommand(
 	bodyLines func() []string,
 ) {
 	switch command {
-	case cmdPrivmsg, "NOTICE":
+	case irc.CmdPrivmsg, irc.CmdNotice:
 		hdlr.handlePrivmsg(
 			writer, request,
 			sessionID, clientID, nick,
 			command, target, body, bodyLines,
 		)
-	case "JOIN":
+	case irc.CmdJoin:
 		hdlr.handleJoin(
 			writer, request,
 			sessionID, clientID, nick, target,
 		)
-	case "PART":
+	case irc.CmdPart:
 		hdlr.handlePart(
 			writer, request,
 			sessionID, clientID, nick, target, body,
 		)
-	case "NICK":
+	case irc.CmdNick:
 		hdlr.handleNick(
 			writer, request,
 			sessionID, clientID, nick, bodyLines,
 		)
-	case "TOPIC":
+	case irc.CmdTopic:
 		hdlr.handleTopic(
 			writer, request,
 			sessionID, clientID, nick,
 			target, body, bodyLines,
 		)
-	case "QUIT":
+	case irc.CmdQuit:
 		hdlr.handleQuit(
 			writer, request, sessionID, nick, body,
 		)
-	case "MOTD", "LIST", "WHO", "WHOIS", "PING":
+	case irc.CmdMotd, irc.CmdPing:
 		hdlr.dispatchInfoCommand(
 			writer, request,
 			sessionID, clientID, nick,
@@ -804,34 +864,34 @@ func (hdlr *Handlers) dispatchQueryCommand(
 	bodyLines func() []string,
 ) {
 	switch command {
-	case "MODE":
+	case irc.CmdMode:
 		hdlr.handleMode(
 			writer, request,
 			sessionID, clientID, nick,
 			target, bodyLines,
 		)
-	case "NAMES":
+	case irc.CmdNames:
 		hdlr.handleNames(
 			writer, request,
 			sessionID, clientID, nick, target,
 		)
-	case "LIST":
+	case irc.CmdList:
 		hdlr.handleList(
 			writer, request,
 			sessionID, clientID, nick,
 		)
-	case "WHOIS":
+	case irc.CmdWhois:
 		hdlr.handleWhois(
 			writer, request,
 			sessionID, clientID, nick,
 			target, bodyLines,
 		)
-	case "WHO":
+	case irc.CmdWho:
 		hdlr.handleWho(
 			writer, request,
 			sessionID, clientID, nick, target,
 		)
-	case "LUSERS":
+	case irc.CmdLusers:
 		hdlr.handleLusers(
 			writer, request,
 			sessionID, clientID, nick,
@@ -839,7 +899,7 @@ func (hdlr *Handlers) dispatchQueryCommand(
 	default:
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"421", nick, []string{command},
+			irc.ErrUnknownCommand, nick, []string{command},
 			"Unknown command",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -860,7 +920,7 @@ func (hdlr *Handlers) handlePrivmsg(
 	if target == "" {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"461", nick, []string{command},
+			irc.ErrNeedMoreParams, nick, []string{command},
 			"Not enough parameters",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -875,7 +935,7 @@ func (hdlr *Handlers) handlePrivmsg(
 	if len(lines) == 0 {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"461", nick, []string{command},
+			irc.ErrNeedMoreParams, nick, []string{command},
 			"Not enough parameters",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -909,13 +969,14 @@ func (hdlr *Handlers) respondIRCError(
 	writer http.ResponseWriter,
 	request *http.Request,
 	clientID, sessionID int64,
-	numeric, nick string,
+	code int,
+	nick string,
 	params []string,
 	text string,
 ) {
 	hdlr.enqueueNumeric(
 		request.Context(), clientID,
-		numeric, nick, params, text,
+		code, nick, params, text,
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
@@ -936,7 +997,7 @@ func (hdlr *Handlers) handleChannelMsg(
 	if err != nil {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"403", nick, []string{target},
+			irc.ErrNoSuchChannel, nick, []string{target},
 			"No such channel",
 		)

@@ -962,7 +1023,7 @@ func (hdlr *Handlers) handleChannelMsg(
 	if !isMember {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"442", nick, []string{target},
+			irc.ErrNotOnChannel, nick, []string{target},
 			"You're not on that channel",
 		)

@@ -1029,7 +1090,7 @@ func (hdlr *Handlers) handleDirectMsg(
 	if err != nil {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"401", nick, []string{target},
+			irc.ErrNoSuchNick, nick, []string{target},
 			"No such nick/channel",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -1073,7 +1134,7 @@ func (hdlr *Handlers) handleJoin(
 	if target == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"JOIN"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdJoin},
 			"Not enough parameters",
 		)

@@ -1088,7 +1149,7 @@ func (hdlr *Handlers) handleJoin(
 	if !validChannelRe.MatchString(channel) {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"403", nick, []string{channel},
+			irc.ErrNoSuchChannel, nick, []string{channel},
 			"No such channel",
 		)

@@ -1144,7 +1205,7 @@ func (hdlr *Handlers) executeJoin(
 	)

 	_ = hdlr.fanOutSilent(
-		request, "JOIN", nick, channel, nil, memberIDs,
+		request, irc.CmdJoin, nick, channel, nil, memberIDs,
 	)

 	hdlr.deliverJoinNumerics(
@@ -1195,12 +1256,12 @@ func (hdlr *Handlers) deliverJoinNumerics(

 	if topic != "" {
 		hdlr.enqueueNumeric(
-			ctx, clientID, "332", nick,
+			ctx, clientID, irc.RplTopic, nick,
 			[]string{channel}, topic,
 		)
 	} else {
 		hdlr.enqueueNumeric(
-			ctx, clientID, "331", nick,
+			ctx, clientID, irc.RplNoTopic, nick,
 			[]string{channel}, "No topic is set",
 		)
 	}
@@ -1218,14 +1279,14 @@ func (hdlr *Handlers) deliverJoinNumerics(
 		}

 		hdlr.enqueueNumeric(
-			ctx, clientID, "353", nick,
+			ctx, clientID, irc.RplNamReply, nick,
 			[]string{"=", channel},
 			strings.Join(nicks, " "),
 		)
 	}

 	hdlr.enqueueNumeric(
-		ctx, clientID, "366", nick,
+		ctx, clientID, irc.RplEndOfNames, nick,
 		[]string{channel}, "End of /NAMES list",
 	)

@@ -1242,7 +1303,7 @@ func (hdlr *Handlers) handlePart(
 	if target == "" {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"461", nick, []string{"PART"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdPart},
 			"Not enough parameters",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -1264,7 +1325,7 @@ func (hdlr *Handlers) handlePart(
 	if err != nil {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"403", nick, []string{channel},
+			irc.ErrNoSuchChannel, nick, []string{channel},
 			"No such channel",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -1280,7 +1341,7 @@ func (hdlr *Handlers) handlePart(
 	)

 	_ = hdlr.fanOutSilent(
-		request, "PART", nick, channel, body, memberIDs,
+		request, irc.CmdPart, nick, channel, body, memberIDs,
 	)

 	err = hdlr.params.Database.PartChannel(
@@ -1322,7 +1383,7 @@ func (hdlr *Handlers) handleNick(
 	if len(lines) == 0 {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"NICK"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdNick},
 			"Not enough parameters",
 		)

@@ -1334,7 +1395,7 @@ func (hdlr *Handlers) handleNick(
 	if !validNickRe.MatchString(newNick) {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"432", nick, []string{newNick},
+			irc.ErrErroneusNickname, nick, []string{newNick},
 			"Erroneous nickname",
 		)

@@ -1367,10 +1428,10 @@ func (hdlr *Handlers) executeNickChange(
 		request.Context(), sessionID, newNick,
 	)
 	if err != nil {
-		if strings.Contains(err.Error(), "UNIQUE") {
+		if db.IsUniqueConstraintError(err) {
 			hdlr.respondIRCError(
 				writer, request, clientID, sessionID,
-				"433", nick, []string{newNick},
+				irc.ErrNicknameInUse, nick, []string{newNick},
 				"Nickname is already in use",
 			)

@@ -1420,7 +1481,7 @@ func (hdlr *Handlers) broadcastNick(
 	}

 	dbID, _, _ := hdlr.params.Database.InsertMessage(
-		request.Context(), "NICK", oldNick, "",
+		request.Context(), irc.CmdNick, oldNick, "",
 		nil, json.RawMessage(nickBody), nil,
 	)

@@ -1461,7 +1522,7 @@ func (hdlr *Handlers) handleTopic(
 	if target == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"TOPIC"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdTopic},
 			"Not enough parameters",
 		)

@@ -1472,7 +1533,7 @@ func (hdlr *Handlers) handleTopic(
 	if len(lines) == 0 {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"TOPIC"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdTopic},
 			"Not enough parameters",
 		)

@@ -1490,7 +1551,7 @@ func (hdlr *Handlers) handleTopic(
 	if err != nil {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"403", nick, []string{channel},
+			irc.ErrNoSuchChannel, nick, []string{channel},
 			"No such channel",
 		)

@@ -1534,12 +1595,12 @@ func (hdlr *Handlers) executeTopic(
 	)

 	_ = hdlr.fanOutSilent(
-		request, "TOPIC", nick, channel, body, memberIDs,
+		request, irc.CmdTopic, nick, channel, body, memberIDs,
 	)

 	hdlr.enqueueNumeric(
 		request.Context(), clientID,
-		"332", nick, []string{channel}, topic,
+		irc.RplTopic, nick, []string{channel}, topic,
 	)
 	hdlr.broker.Notify(sessionID)

@@ -1551,8 +1612,7 @@ func (hdlr *Handlers) executeTopic(
 }

 // dispatchInfoCommand handles informational IRC commands
-// that produce server-side numerics (MOTD, LIST, WHO,
-// WHOIS, PING).
+// that produce server-side numerics (MOTD, PING).
 func (hdlr *Handlers) dispatchInfoCommand(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -1560,31 +1620,20 @@ func (hdlr *Handlers) dispatchInfoCommand(
 	nick, command, target string,
 	bodyLines func() []string,
 ) {
+	_ = target
+	_ = bodyLines
+
 	okResp := map[string]string{"status": "ok"}

 	switch command {
-	case "MOTD":
+	case irc.CmdMotd:
 		hdlr.deliverMOTD(
 			request, clientID, sessionID, nick,
 		)
-	case "LIST":
-		hdlr.handleListCmd(
-			request, clientID, sessionID, nick,
-		)
-	case "WHO":
-		hdlr.handleWhoCmd(
-			request, clientID, sessionID, nick,
-			target,
-		)
-	case "WHOIS":
-		hdlr.handleWhoisCmd(
-			request, clientID, sessionID, nick,
-			target, bodyLines,
-		)
-	case "PING":
+	case irc.CmdPing:
 		hdlr.respondJSON(writer, request,
 			map[string]string{
-				"command": "PONG",
+				"command": irc.CmdPong,
 				"from":    hdlr.serverName(),
 			},
 			http.StatusOK)
@@ -1597,222 +1646,6 @@ func (hdlr *Handlers) dispatchInfoCommand(
 	)
 }

-// handleListCmd sends RPL_LIST (322) for each channel,
-// then sends 323 to signal the end of the list.
-func (hdlr *Handlers) handleListCmd(
-	request *http.Request,
-	clientID, sessionID int64,
-	nick string,
-) {
-	ctx := request.Context()
-
-	channels, err := hdlr.params.Database.ListAllChannels(
-		ctx,
-	)
-	if err != nil {
-		hdlr.enqueueNumeric(
-			ctx, clientID, "323", nick, nil,
-			"End of /LIST",
-		)
-		hdlr.broker.Notify(sessionID)
-
-		return
-	}
-
-	for _, channel := range channels {
-		memberIDs, _ :=
-			hdlr.params.Database.GetChannelMemberIDs(
-				ctx, channel.ID,
-			)
-
-		count := strconv.Itoa(len(memberIDs))
-		topic := channel.Topic
-
-		if topic == "" {
-			topic = " "
-		}
-
-		hdlr.enqueueNumeric(
-			ctx, clientID, "322", nick,
-			[]string{channel.Name, count}, topic,
-		)
-	}
-
-	hdlr.enqueueNumeric(
-		ctx, clientID, "323", nick, nil,
-		"End of /LIST",
-	)
-	hdlr.broker.Notify(sessionID)
-}
-
-// handleWhoCmd sends RPL_WHOREPLY (352) for each member
-// of the target channel, followed by RPL_ENDOFWHO (315).
-func (hdlr *Handlers) handleWhoCmd(
-	request *http.Request,
-	clientID, sessionID int64,
-	nick, target string,
-) {
-	ctx := request.Context()
-
-	if target == "" {
-		hdlr.enqueueNumeric(
-			ctx, clientID, "461", nick,
-			[]string{"WHO"}, "Not enough parameters",
-		)
-		hdlr.broker.Notify(sessionID)
-
-		return
-	}
-
-	channel := target
-	if !strings.HasPrefix(channel, "#") {
-		channel = "#" + channel
-	}
-
-	chID, err := hdlr.params.Database.GetChannelByName(
-		ctx, channel,
-	)
-	if err != nil {
-		hdlr.enqueueNumeric(
-			ctx, clientID, "315", nick,
-			[]string{channel}, "End of /WHO list",
-		)
-		hdlr.broker.Notify(sessionID)
-
-		return
-	}
-
-	members, err := hdlr.params.Database.ChannelMembers(
-		ctx, chID,
-	)
-	if err == nil {
-		srvName := hdlr.serverName()
-
-		for _, mem := range members {
-			hdlr.enqueueNumeric(
-				ctx, clientID, "352", nick,
-				[]string{
-					channel, mem.Nick, "neoirc",
-					srvName, mem.Nick, "H",
-				},
-				"0 "+mem.Nick,
-			)
-		}
-	}
-
-	hdlr.enqueueNumeric(
-		ctx, clientID, "315", nick,
-		[]string{channel}, "End of /WHO list",
-	)
-	hdlr.broker.Notify(sessionID)
-}
-
-// handleWhoisCmd sends WHOIS reply numerics (311, 312,
-// 319, 318) for the target nick.
-func (hdlr *Handlers) handleWhoisCmd(
-	request *http.Request,
-	clientID, sessionID int64,
-	nick, target string,
-	bodyLines func() []string,
-) {
-	ctx := request.Context()
-
-	whoisNick := target
-	if whoisNick == "" {
-		lines := bodyLines()
-		if len(lines) > 0 {
-			whoisNick = strings.TrimSpace(lines[0])
-		}
-	}
-
-	if whoisNick == "" {
-		hdlr.enqueueNumeric(
-			ctx, clientID, "461", nick,
-			[]string{"WHOIS"}, "Not enough parameters",
-		)
-		hdlr.broker.Notify(sessionID)
-
-		return
-	}
-
-	targetSID, err :=
-		hdlr.params.Database.GetSessionByNick(
-			ctx, whoisNick,
-		)
-	if err != nil {
-		hdlr.enqueueNumeric(
-			ctx, clientID, "401", nick,
-			[]string{whoisNick},
-			"No such nick/channel",
-		)
-		hdlr.enqueueNumeric(
-			ctx, clientID, "318", nick,
-			[]string{whoisNick},
-			"End of /WHOIS list",
-		)
-		hdlr.broker.Notify(sessionID)
-
-		return
-	}
-
-	hdlr.sendWhoisNumerics(
-		ctx, clientID, sessionID, nick,
-		whoisNick, targetSID,
-	)
-}
-
-// sendWhoisNumerics emits 311/312/319/318 for a
-// resolved WHOIS target.
-func (hdlr *Handlers) sendWhoisNumerics(
-	ctx context.Context,
-	clientID, sessionID int64,
-	nick, whoisNick string,
-	targetSID int64,
-) {
-	srvName := hdlr.serverName()
-
-	// 311 RPL_WHOISUSER
-	hdlr.enqueueNumeric(
-		ctx, clientID, "311", nick,
-		[]string{whoisNick, whoisNick, "neoirc", "*"},
-		whoisNick,
-	)
-
-	// 312 RPL_WHOISSERVER
-	hdlr.enqueueNumeric(
-		ctx, clientID, "312", nick,
-		[]string{whoisNick, srvName},
-		srvName,
-	)
-
-	// 319 RPL_WHOISCHANNELS
-	channels, _ := hdlr.params.Database.GetSessionChannels(
-		ctx, targetSID,
-	)
-
-	if len(channels) > 0 {
-		names := make([]string, 0, len(channels))
-
-		for _, chanInfo := range channels {
-			names = append(names, chanInfo.Name)
-		}
-
-		hdlr.enqueueNumeric(
-			ctx, clientID, "319", nick,
-			[]string{whoisNick},
-			strings.Join(names, " "),
-		)
-	}
-
-	// 318 RPL_ENDOFWHOIS
-	hdlr.enqueueNumeric(
-		ctx, clientID, "318", nick,
-		[]string{whoisNick},
-		"End of /WHOIS list",
-	)
-	hdlr.broker.Notify(sessionID)
-}
-
 func (hdlr *Handlers) handleQuit(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -1831,7 +1664,7 @@ func (hdlr *Handlers) handleQuit(

 	if len(channels) > 0 {
 		dbID, _, _ = hdlr.params.Database.InsertMessage(
-			request.Context(), "QUIT", nick, "",
+			request.Context(), irc.CmdQuit, nick, "",
 			nil, body, nil,
 		)
 	}
@@ -1884,7 +1717,7 @@ func (hdlr *Handlers) handleMode(
 	if target == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"MODE"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdMode},
 			"Not enough parameters",
 		)

@@ -1896,7 +1729,7 @@ func (hdlr *Handlers) handleMode(
 		// User mode query — return empty modes.
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			"221", nick, nil, "+",
+			irc.RplUmodeIs, nick, nil, "+",
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
@@ -1928,7 +1761,7 @@ func (hdlr *Handlers) handleChannelMode(
 	if err != nil {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"403", nick, []string{channel},
+			irc.ErrNoSuchChannel, nick, []string{channel},
 			"No such channel",
 		)

@@ -1937,7 +1770,7 @@ func (hdlr *Handlers) handleChannelMode(

 	// 324 RPL_CHANNELMODEIS
 	hdlr.enqueueNumeric(
-		ctx, clientID, "324", nick,
+		ctx, clientID, irc.RplChannelModeIs, nick,
 		[]string{channel, "+n"}, "",
 	)

@@ -1946,7 +1779,7 @@ func (hdlr *Handlers) handleChannelMode(
 		GetChannelCreatedAt(ctx, chID)
 	if timeErr == nil {
 		hdlr.enqueueNumeric(
-			ctx, clientID, "329", nick,
+			ctx, clientID, irc.RplCreationTime, nick,
 			[]string{
 				channel,
 				strconv.FormatInt(
@@ -1973,7 +1806,7 @@ func (hdlr *Handlers) handleNames(
 	if target == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"NAMES"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdNames},
 			"Not enough parameters",
 		)

@@ -1993,7 +1826,7 @@ func (hdlr *Handlers) handleNames(
 	if err != nil {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"403", nick, []string{channel},
+			irc.ErrNoSuchChannel, nick, []string{channel},
 			"No such channel",
 		)

@@ -2011,14 +1844,14 @@ func (hdlr *Handlers) handleNames(
 		}

 		hdlr.enqueueNumeric(
-			ctx, clientID, "353", nick,
+			ctx, clientID, irc.RplNamReply, nick,
 			[]string{"=", channel},
 			strings.Join(nicks, " "),
 		)
 	}

 	hdlr.enqueueNumeric(
-		ctx, clientID, "366", nick,
+		ctx, clientID, irc.RplEndOfNames, nick,
 		[]string{channel}, "End of /NAMES list",
 	)

@@ -2056,7 +1889,7 @@ func (hdlr *Handlers) handleList(
 	for _, chanInfo := range channels {
 		// 322 RPL_LIST
 		hdlr.enqueueNumeric(
-			ctx, clientID, "322", nick,
+			ctx, clientID, irc.RplList, nick,
 			[]string{
 				chanInfo.Name,
 				strconv.FormatInt(
@@ -2069,7 +1902,7 @@ func (hdlr *Handlers) handleList(

 	// 323 — end of channel list.
 	hdlr.enqueueNumeric(
-		ctx, clientID, "323", nick, nil,
+		ctx, clientID, irc.RplListEnd, nick, nil,
 		"End of /LIST",
 	)

@@ -2100,7 +1933,7 @@ func (hdlr *Handlers) handleWhois(
 	if queryNick == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"WHOIS"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdWhois},
 			"Not enough parameters",
 		)

@@ -2127,12 +1960,12 @@ func (hdlr *Handlers) executeWhois(
 	)
 	if err != nil {
 		hdlr.enqueueNumeric(
-			ctx, clientID, "401", nick,
+			ctx, clientID, irc.ErrNoSuchNick, nick,
 			[]string{queryNick},
 			"No such nick/channel",
 		)
 		hdlr.enqueueNumeric(
-			ctx, clientID, "318", nick,
+			ctx, clientID, irc.RplEndOfWhois, nick,
 			[]string{queryNick},
 			"End of /WHOIS list",
 		)
@@ -2146,14 +1979,14 @@ func (hdlr *Handlers) executeWhois(

 	// 311 RPL_WHOISUSER
 	hdlr.enqueueNumeric(
-		ctx, clientID, "311", nick,
+		ctx, clientID, irc.RplWhoisUser, nick,
 		[]string{queryNick, queryNick, srvName, "*"},
 		queryNick,
 	)

 	// 312 RPL_WHOISSERVER
 	hdlr.enqueueNumeric(
-		ctx, clientID, "312", nick,
+		ctx, clientID, irc.RplWhoisServer, nick,
 		[]string{queryNick, srvName},
 		"neoirc server",
 	)
@@ -2165,7 +1998,7 @@ func (hdlr *Handlers) executeWhois(

 	// 318 RPL_ENDOFWHOIS
 	hdlr.enqueueNumeric(
-		ctx, clientID, "318", nick,
+		ctx, clientID, irc.RplEndOfWhois, nick,
 		[]string{queryNick},
 		"End of /WHOIS list",
 	)
@@ -2195,7 +2028,7 @@ func (hdlr *Handlers) deliverWhoisChannels(
 	}

 	hdlr.enqueueNumeric(
-		ctx, clientID, "319", nick,
+		ctx, clientID, irc.RplWhoisChannels, nick,
 		[]string{queryNick},
 		strings.Join(chanNames, " "),
 	)
@@ -2211,7 +2044,7 @@ func (hdlr *Handlers) handleWho(
 	if target == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			"461", nick, []string{"WHO"},
+			irc.ErrNeedMoreParams, nick, []string{irc.CmdWho},
 			"Not enough parameters",
 		)

@@ -2232,7 +2065,7 @@ func (hdlr *Handlers) handleWho(
 	if err != nil {
 		// 315 RPL_ENDOFWHO (empty result)
 		hdlr.enqueueNumeric(
-			ctx, clientID, "315", nick,
+			ctx, clientID, irc.RplEndOfWho, nick,
 			[]string{target},
 			"End of /WHO list",
 		)
@@ -2251,7 +2084,7 @@ func (hdlr *Handlers) handleWho(
 		for _, mem := range members {
 			// 352 RPL_WHOREPLY
 			hdlr.enqueueNumeric(
-				ctx, clientID, "352", nick,
+				ctx, clientID, irc.RplWhoReply, nick,
 				[]string{
 					channel, mem.Nick, srvName,
 					srvName, mem.Nick, "H",
@@ -2263,7 +2096,7 @@ func (hdlr *Handlers) handleWho(

 	// 315 RPL_ENDOFWHO
 	hdlr.enqueueNumeric(
-		ctx, clientID, "315", nick,
+		ctx, clientID, irc.RplEndOfWho, nick,
 		[]string{channel},
 		"End of /WHO list",
 	)
@@ -2499,7 +2332,7 @@ func (hdlr *Handlers) cleanupUser(

 	if len(channels) > 0 {
 		quitDBID, _, _ = hdlr.params.Database.InsertMessage(
-			ctx, "QUIT", nick, "",
+			ctx, irc.CmdQuit, nick, "",
 			nil, nil, nil,
 		)
 	}
@@ -2560,9 +2393,10 @@ func (hdlr *Handlers) HandleServerInfo() http.HandlerFunc {
 		}

 		hdlr.respondJSON(writer, request, map[string]any{
-			"name":  hdlr.params.Config.ServerName,
-			"motd":  hdlr.params.Config.MOTD,
-			"users": users,
+			"name":    hdlr.params.Config.ServerName,
+			"version": hdlr.params.Globals.Version,
+			"motd":    hdlr.params.Config.MOTD,
+			"users":   users,
 		}, http.StatusOK)
 	}
 }
--- a/internal/handlers/api_test.go
+++ b/internal/handlers/api_test.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -467,8 +468,11 @@ func findNumeric(
 	msgs []map[string]any,
 	numeric string,
 ) bool {
+	want, _ := strconv.Atoi(numeric)
+
 	for _, msg := range msgs {
-		if msg[commandKey] == numeric {
+		code, ok := msg["code"].(float64)
+		if ok && int(code) == want {
 			return true
 		}
 	}
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"net/http"
 	"strings"
+
+	"git.eeqj.de/sneak/neoirc/internal/db"
 )

 const minPasswordLength = 8
@@ -94,7 +96,7 @@ func (hdlr *Handlers) handleRegisterError(
 	request *http.Request,
 	err error,
 ) {
-	if strings.Contains(err.Error(), "UNIQUE") {
+	if db.IsUniqueConstraintError(err) {
 		hdlr.respondError(
 			writer, request,
 			"nick already taken",
@@ -182,6 +184,12 @@ func (hdlr *Handlers) handleLogin(
 		request, clientID, sessionID, payload.Nick,
 	)

+	// Initialize channel state so the new client knows
+	// which channels the session already belongs to.
+	hdlr.initChannelState(
+		request, clientID, sessionID, payload.Nick,
+	)
+
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
 		"nick":  payload.Nick,
--- a/internal/irc/commands.go
+++ b/internal/irc/commands.go
@@ -0,0 +1,21 @@
+package irc
+
+// IRC command names (RFC 1459 / RFC 2812).
+const (
+	CmdJoin    = "JOIN"
+	CmdList    = "LIST"
+	CmdLusers  = "LUSERS"
+	CmdMode    = "MODE"
+	CmdMotd    = "MOTD"
+	CmdNames   = "NAMES"
+	CmdNick    = "NICK"
+	CmdNotice  = "NOTICE"
+	CmdPart    = "PART"
+	CmdPing    = "PING"
+	CmdPong    = "PONG"
+	CmdPrivmsg = "PRIVMSG"
+	CmdQuit    = "QUIT"
+	CmdTopic   = "TOPIC"
+	CmdWho     = "WHO"
+	CmdWhois   = "WHOIS"
+)
--- a/internal/irc/numerics.go
+++ b/internal/irc/numerics.go
@@ -0,0 +1,150 @@
+// Package irc provides constants and utilities for the
+// IRC protocol, including numeric reply codes from
+// RFC 1459 and RFC 2812, and standard command names.
+package irc
+
+// Connection registration replies (001-005).
+const (
+	RplWelcome  = 1
+	RplYourHost = 2
+	RplCreated  = 3
+	RplMyInfo   = 4
+	RplIsupport = 5
+)
+
+// Command responses (200-399).
+const (
+	RplUmodeIs       = 221
+	RplLuserClient   = 251
+	RplLuserOp       = 252
+	RplLuserUnknown  = 253
+	RplLuserChannels = 254
+	RplLuserMe       = 255
+	RplAway          = 301
+	RplUserHost      = 302
+	RplIson          = 303
+	RplUnaway        = 305
+	RplNowAway       = 306
+	RplWhoisUser     = 311
+	RplWhoisServer   = 312
+	RplWhoisOperator = 313
+	RplEndOfWho      = 315
+	RplWhoisIdle     = 317
+	RplEndOfWhois    = 318
+	RplWhoisChannels = 319
+	RplList          = 322
+	RplListEnd       = 323
+	RplChannelModeIs = 324
+	RplCreationTime  = 329
+	RplNoTopic       = 331
+	RplTopic         = 332
+	RplTopicWhoTime  = 333
+	RplInviting      = 341
+	RplWhoReply      = 352
+	RplNamReply      = 353
+	RplEndOfNames    = 366
+	RplBanList       = 367
+	RplEndOfBanList  = 368
+	RplMotd          = 372
+	RplMotdStart     = 375
+	RplEndOfMotd     = 376
+)
+
+// Error replies (400-599).
+const (
+	ErrNoSuchNick        = 401
+	ErrNoSuchServer      = 402
+	ErrNoSuchChannel     = 403
+	ErrCannotSendToChan  = 404
+	ErrTooManyChannels   = 405
+	ErrNoRecipient       = 411
+	ErrNoTextToSend      = 412
+	ErrUnknownCommand    = 421
+	ErrNoNicknameGiven   = 431
+	ErrErroneusNickname  = 432
+	ErrNicknameInUse     = 433
+	ErrUserNotInChannel  = 441
+	ErrNotOnChannel      = 442
+	ErrNotRegistered     = 451
+	ErrNeedMoreParams    = 461
+	ErrAlreadyRegistered = 462
+	ErrChannelIsFull     = 471
+	ErrInviteOnlyChan    = 473
+	ErrBannedFromChan    = 474
+	ErrBadChannelKey     = 475
+	ErrChanOpPrivsNeeded = 482
+)
+
+// names maps numeric codes to their standard IRC names.
+//
+//nolint:gochecknoglobals
+var names = map[int]string{
+	RplWelcome:       "RPL_WELCOME",
+	RplYourHost:      "RPL_YOURHOST",
+	RplCreated:       "RPL_CREATED",
+	RplMyInfo:        "RPL_MYINFO",
+	RplIsupport:      "RPL_ISUPPORT",
+	RplUmodeIs:       "RPL_UMODEIS",
+	RplLuserClient:   "RPL_LUSERCLIENT",
+	RplLuserOp:       "RPL_LUSEROP",
+	RplLuserUnknown:  "RPL_LUSERUNKNOWN",
+	RplLuserChannels: "RPL_LUSERCHANNELS",
+	RplLuserMe:       "RPL_LUSERME",
+	RplAway:          "RPL_AWAY",
+	RplUserHost:      "RPL_USERHOST",
+	RplIson:          "RPL_ISON",
+	RplUnaway:        "RPL_UNAWAY",
+	RplNowAway:       "RPL_NOWAWAY",
+	RplWhoisUser:     "RPL_WHOISUSER",
+	RplWhoisServer:   "RPL_WHOISSERVER",
+	RplWhoisOperator: "RPL_WHOISOPERATOR",
+	RplEndOfWho:      "RPL_ENDOFWHO",
+	RplWhoisIdle:     "RPL_WHOISIDLE",
+	RplEndOfWhois:    "RPL_ENDOFWHOIS",
+	RplWhoisChannels: "RPL_WHOISCHANNELS",
+	RplList:          "RPL_LIST",
+	RplListEnd:       "RPL_LISTEND", //nolint:misspell
+	RplChannelModeIs: "RPL_CHANNELMODEIS",
+	RplCreationTime:  "RPL_CREATIONTIME",
+	RplNoTopic:       "RPL_NOTOPIC",
+	RplTopic:         "RPL_TOPIC",
+	RplTopicWhoTime:  "RPL_TOPICWHOTIME",
+	RplInviting:      "RPL_INVITING",
+	RplWhoReply:      "RPL_WHOREPLY",
+	RplNamReply:      "RPL_NAMREPLY",
+	RplEndOfNames:    "RPL_ENDOFNAMES",
+	RplBanList:       "RPL_BANLIST",
+	RplEndOfBanList:  "RPL_ENDOFBANLIST",
+	RplMotd:          "RPL_MOTD",
+	RplMotdStart:     "RPL_MOTDSTART",
+	RplEndOfMotd:     "RPL_ENDOFMOTD",
+
+	ErrNoSuchNick:        "ERR_NOSUCHNICK",
+	ErrNoSuchServer:      "ERR_NOSUCHSERVER",
+	ErrNoSuchChannel:     "ERR_NOSUCHCHANNEL",
+	ErrCannotSendToChan:  "ERR_CANNOTSENDTOCHAN",
+	ErrTooManyChannels:   "ERR_TOOMANYCHANNELS",
+	ErrNoRecipient:       "ERR_NORECIPIENT",
+	ErrNoTextToSend:      "ERR_NOTEXTTOSEND",
+	ErrUnknownCommand:    "ERR_UNKNOWNCOMMAND",
+	ErrNoNicknameGiven:   "ERR_NONICKNAMEGIVEN",
+	ErrErroneusNickname:  "ERR_ERRONEUSNICKNAME",
+	ErrNicknameInUse:     "ERR_NICKNAMEINUSE",
+	ErrUserNotInChannel:  "ERR_USERNOTINCHANNEL",
+	ErrNotOnChannel:      "ERR_NOTONCHANNEL",
+	ErrNotRegistered:     "ERR_NOTREGISTERED",
+	ErrNeedMoreParams:    "ERR_NEEDMOREPARAMS",
+	ErrAlreadyRegistered: "ERR_ALREADYREGISTERED",
+	ErrChannelIsFull:     "ERR_CHANNELISFULL",
+	ErrInviteOnlyChan:    "ERR_INVITEONLYCHAN",
+	ErrBannedFromChan:    "ERR_BANNEDFROMCHAN",
+	ErrBadChannelKey:     "ERR_BADCHANNELKEY",
+	ErrChanOpPrivsNeeded: "ERR_CHANOPRIVSNEEDED",
+}
+
+// Name returns the standard IRC name for a numeric code
+// (e.g., Name(2) returns "RPL_YOURHOST"). Returns an
+// empty string if the code is unknown.
+func Name(code int) string {
+	return names[code]
+}
--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -11,7 +11,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	basicauth "github.com/99designs/basicauth-go"
-	chimw "github.com/go-chi/chi/middleware"
+	chimw "github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
 	metrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	ghmm "github.com/slok/go-http-metrics/middleware"
@@ -142,20 +142,6 @@ func (mware *Middleware) CORS() func(http.Handler) http.Handler {
 	})
 }

-// Auth returns middleware that performs authentication.
-func (mware *Middleware) Auth() func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(
-			func(
-				writer http.ResponseWriter,
-				request *http.Request,
-			) {
-				mware.log.Info("AUTH: before request")
-				next.ServeHTTP(writer, request)
-			})
-	}
-}
-
 // Metrics returns middleware that records HTTP metrics.
 func (mware *Middleware) Metrics() func(http.Handler) http.Handler {
 	metricsMiddleware := ghmm.New(ghmm.Config{ //nolint:exhaustruct // optional fields
@@ -180,3 +166,36 @@ func (mware *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 		},
 	)
 }
+
+// cspPolicy is the Content-Security-Policy header value applied to all
+// responses.  The embedded SPA loads scripts and styles from same-origin
+// files only (no inline scripts or inline style attributes), so a strict
+// policy works without 'unsafe-inline'.
+const cspPolicy = "default-src 'self'; " +
+	"script-src 'self'; " +
+	"style-src 'self'; " +
+	"connect-src 'self'; " +
+	"img-src 'self'; " +
+	"font-src 'self'; " +
+	"object-src 'none'; " +
+	"frame-ancestors 'none'; " +
+	"base-uri 'self'; " +
+	"form-action 'self'"
+
+// CSP returns middleware that sets the Content-Security-Policy header on
+// every response for defense-in-depth against XSS.
+func (mware *Middleware) CSP() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(
+			func(
+				writer http.ResponseWriter,
+				request *http.Request,
+			) {
+				writer.Header().Set(
+					"Content-Security-Policy",
+					cspPolicy,
+				)
+				next.ServeHTTP(writer, request)
+			})
+	}
+}
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -8,8 +8,8 @@ import (
 	"git.eeqj.de/sneak/neoirc/web"

 	sentryhttp "github.com/getsentry/sentry-go/http"
-	"github.com/go-chi/chi"
-	"github.com/go-chi/chi/middleware"
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/spf13/viper"
 )
@@ -29,6 +29,7 @@ func (srv *Server) SetupRoutes() {
 	}

 	srv.router.Use(srv.mw.CORS())
+	srv.router.Use(srv.mw.CSP())
 	srv.router.Use(middleware.Timeout(routeTimeout))

 	if srv.sentryEnabled {
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -20,7 +20,7 @@ import (
 	"go.uber.org/fx"

 	"github.com/getsentry/sentry-go"
-	"github.com/go-chi/chi"
+	"github.com/go-chi/chi/v5"

 	_ "github.com/joho/godotenv/autoload" // loads .env file
 )
--- a/web/dist/app.js
+++ b/web/dist/app.js
--- a/web/dist/index.html
+++ b/web/dist/index.html
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>NeoIRC</title>
-  <link rel="stylesheet" href="/style.css">
-</head>
-<body>
-  <div id="root"></div>
-  <script type="module" src="/app.js"></script>
-</body>
-</html>
--- a/web/dist/style.css
+++ b/web/dist/style.css
@@ -1,466 +0,0 @@
-* {
-  margin: 0;
-  padding: 0;
-  box-sizing: border-box;
-}
-
-:root {
-  --bg: #0a0e14;
-  --bg-panel: #0d1117;
-  --bg-input: #0d1117;
-  --bg-tab: #161b22;
-  --bg-tab-active: #0d1117;
-  --bg-topic: #0d1117;
-  --text: #c9d1d9;
-  --text-dim: #6e7681;
-  --text-bright: #e6edf3;
-  --accent: #58a6ff;
-  --accent-dim: #1f6feb;
-  --border: #21262d;
-  --system: #7d8590;
-  --action: #d2a8ff;
-  --warn: #d29922;
-  --error: #f85149;
-  --unread: #f0883e;
-  --nick-brackets: #6e7681;
-  --timestamp: #484f58;
-  --input-bg: #161b22;
-  --prompt: #3fb950;
-  --tab-indicator: #58a6ff;
-  --user-list-bg: #0d1117;
-  --user-list-header: #484f58;
-}
-
-html,
-body,
-#root {
-  height: 100%;
-  font-family: "JetBrains Mono", "Cascadia Code", "Fira Code", "SF Mono",
-    "Consolas", "Liberation Mono", "Courier New", monospace;
-  font-size: 13px;
-  background: var(--bg);
-  color: var(--text);
-  overflow: hidden;
-}
-
-/* ============================================
-   Login Screen
-   ============================================ */
-
-.login-screen {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  height: 100%;
-  background: var(--bg);
-}
-
-.login-box {
-  text-align: center;
-  max-width: 360px;
-  width: 100%;
-  padding: 32px;
-}
-
-.login-box h1 {
-  color: var(--accent);
-  font-size: 1.8em;
-  margin-bottom: 16px;
-  font-weight: 400;
-}
-
-.login-box .motd {
-  color: var(--accent);
-  font-size: 11px;
-  margin-bottom: 20px;
-  text-align: left;
-  white-space: pre;
-  font-family: inherit;
-  line-height: 1.2;
-  overflow-x: auto;
-}
-
-.login-box form {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  align-items: stretch;
-}
-
-.login-box label {
-  color: var(--text-dim);
-  text-align: left;
-  font-size: 12px;
-}
-
-.login-box input {
-  padding: 8px 12px;
-  font-family: inherit;
-  font-size: 14px;
-  background: var(--input-bg);
-  border: 1px solid var(--border);
-  color: var(--text-bright);
-  border-radius: 3px;
-  outline: none;
-}
-
-.login-box input:focus {
-  border-color: var(--accent-dim);
-}
-
-.login-box button {
-  padding: 8px 16px;
-  font-family: inherit;
-  font-size: 14px;
-  background: var(--accent-dim);
-  border: none;
-  color: var(--text-bright);
-  border-radius: 3px;
-  cursor: pointer;
-  margin-top: 4px;
-}
-
-.login-box button:hover {
-  background: var(--accent);
-}
-
-.login-box .error {
-  color: var(--error);
-  font-size: 12px;
-  margin-top: 8px;
-}
-
-/* ============================================
-   IRC App Layout
-   ============================================ */
-
-.irc-app {
-  display: flex;
-  flex-direction: column;
-  height: 100%;
-  overflow: hidden;
-}
-
-/* ============================================
-   Tab Bar
-   ============================================ */
-
-.tab-bar {
-  display: flex;
-  background: var(--bg-tab);
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 32px;
-  align-items: stretch;
-}
-
-.tabs {
-  display: flex;
-  overflow-x: auto;
-  flex: 1;
-  scrollbar-width: none;
-}
-
-.tabs::-webkit-scrollbar {
-  display: none;
-}
-
-.tab {
-  display: flex;
-  align-items: center;
-  padding: 0 12px;
-  cursor: pointer;
-  color: var(--text-dim);
-  white-space: nowrap;
-  user-select: none;
-  border-right: 1px solid var(--border);
-  font-size: 12px;
-  gap: 4px;
-  position: relative;
-}
-
-.tab:hover {
-  color: var(--text);
-  background: rgba(255, 255, 255, 0.03);
-}
-
-.tab.active {
-  color: var(--text-bright);
-  background: var(--bg-tab-active);
-  border-bottom: 2px solid var(--tab-indicator);
-  margin-bottom: -1px;
-}
-
-.tab.has-unread .tab-label {
-  color: var(--unread);
-  font-weight: bold;
-}
-
-.tab .unread-count {
-  color: var(--unread);
-  font-size: 11px;
-  font-weight: bold;
-}
-
-.tab-close {
-  color: var(--text-dim);
-  font-size: 14px;
-  line-height: 1;
-  margin-left: 2px;
-}
-
-.tab-close:hover {
-  color: var(--error);
-}
-
-.status-area {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  padding: 0 12px;
-  flex-shrink: 0;
-  font-size: 12px;
-}
-
-.status-nick {
-  color: var(--accent);
-  font-weight: bold;
-}
-
-.status-warn {
-  color: var(--warn);
-  animation: blink 1.5s ease-in-out infinite;
-}
-
-@keyframes blink {
-  0%,
-  100% {
-    opacity: 1;
-  }
-  50% {
-    opacity: 0.4;
-  }
-}
-
-/* ============================================
-   Topic Bar
-   ============================================ */
-
-.topic-bar {
-  padding: 4px 12px;
-  background: var(--bg-topic);
-  border-bottom: 1px solid var(--border);
-  font-size: 12px;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  flex-shrink: 0;
-  line-height: 1.5;
-}
-
-.topic-label {
-  color: var(--text-dim);
-}
-
-.topic-text {
-  color: var(--text);
-}
-
-/* ============================================
-   Main Content Area
-   ============================================ */
-
-.main-area {
-  display: flex;
-  flex: 1;
-  overflow: hidden;
-  min-height: 0;
-}
-
-/* ============================================
-   Messages Panel
-   ============================================ */
-
-.messages-panel {
-  flex: 1;
-  display: flex;
-  flex-direction: column;
-  overflow: hidden;
-  min-width: 0;
-}
-
-.messages-scroll {
-  flex: 1;
-  overflow-y: auto;
-  padding: 4px 8px;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
-}
-
-.messages-scroll::-webkit-scrollbar {
-  width: 8px;
-}
-
-.messages-scroll::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-.messages-scroll::-webkit-scrollbar-thumb {
-  background: var(--border);
-  border-radius: 4px;
-}
-
-/* ============================================
-   Message Lines
-   ============================================ */
-
-.message {
-  padding: 1px 0;
-  line-height: 1.4;
-  white-space: pre-wrap;
-  word-wrap: break-word;
-  font-size: 13px;
-}
-
-.message .timestamp {
-  color: var(--timestamp);
-  font-size: 12px;
-}
-
-.message .nick {
-  font-weight: bold;
-}
-
-.message .content {
-  color: var(--text);
-}
-
-/* System messages (joins, parts, quits, etc.) */
-.system-message {
-  color: var(--system);
-}
-
-.system-message .system-text {
-  color: var(--system);
-}
-
-/* /me action messages */
-.action-message .action-text {
-  color: var(--action);
-}
-
-/* ============================================
-   User List (Right Panel)
-   ============================================ */
-
-.user-list {
-  width: 160px;
-  background: var(--user-list-bg);
-  border-left: 1px solid var(--border);
-  display: flex;
-  flex-direction: column;
-  flex-shrink: 0;
-  overflow: hidden;
-}
-
-.user-list-header {
-  padding: 6px 10px;
-  color: var(--user-list-header);
-  font-size: 11px;
-  text-transform: uppercase;
-  letter-spacing: 0.5px;
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-}
-
-.user-list-entries {
-  overflow-y: auto;
-  padding: 4px 0;
-  flex: 1;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
-}
-
-.nick-entry {
-  padding: 2px 10px;
-  font-size: 12px;
-  cursor: pointer;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  line-height: 1.5;
-}
-
-.nick-entry:hover {
-  background: rgba(255, 255, 255, 0.04);
-}
-
-.nick-prefix {
-  color: var(--text-dim);
-  display: inline-block;
-  width: 1ch;
-  text-align: right;
-  margin-right: 1px;
-}
-
-.nick-name {
-  font-weight: normal;
-}
-
-/* ============================================
-   Input Line (Bottom)
-   ============================================ */
-
-.input-line {
-  display: flex;
-  align-items: center;
-  background: var(--input-bg);
-  border-top: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 36px;
-  padding: 0 8px;
-  gap: 6px;
-}
-
-.input-prompt {
-  color: var(--prompt);
-  font-size: 13px;
-  flex-shrink: 0;
-  white-space: nowrap;
-}
-
-.input-line input {
-  flex: 1;
-  padding: 4px 0;
-  font-family: inherit;
-  font-size: 13px;
-  background: transparent;
-  border: none;
-  color: var(--text-bright);
-  outline: none;
-  caret-color: var(--accent);
-}
-
-.input-line input::placeholder {
-  color: var(--text-dim);
-  font-style: italic;
-}
-
-/* ============================================
-   Responsive
-   ============================================ */
-
-@media (max-width: 600px) {
-  .user-list {
-    display: none;
-  }
-
-  .tab {
-    padding: 0 8px;
-    font-size: 11px;
-  }
-
-  .input-prompt {
-    font-size: 12px;
-  }
-}
--- a/web/src/app.jsx
+++ b/web/src/app.jsx
@@ -70,7 +70,7 @@ function LoginScreen({ onLogin }) {
      .catch(() => {});
    const saved = localStorage.getItem("neoirc_token");
    if (saved) {
-      api("/state")
+      api("/state?initChannelState=1")
        .then((u) => onLogin(u.nick, true))
        .catch(() => localStorage.removeItem("neoirc_token"));
    }
@@ -333,7 +333,24 @@ function App() {
        case "JOIN": {
          const text = `${msg.from} has joined ${msg.to}`;
          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
-          if (msg.to && msg.to.startsWith("#")) refreshMembers(msg.to);
+          if (msg.to && msg.to.startsWith("#")) {
+            // Create a tab when the current user joins a channel
+            // (including JOINs from initChannelState on reconnect).
+            if (msg.from === nickRef.current) {
+              setTabs((prev) => {
+                if (
+                  prev.find(
+                    (t) => t.type === "channel" && t.name === msg.to,
+                  )
+                )
+                  return prev;
+
+                return [...prev, { type: "channel", name: msg.to }];
+              });
+            }
+
+            refreshMembers(msg.to);
+          }

          break;
        }
@@ -636,9 +653,13 @@ function App() {
      setLoggedIn(true);
      addSystemMessage("Server", `Connected as ${userNick}`);

-      // Request MOTD on resumed sessions (new sessions get
-      // it automatically from the server during creation).
      if (isResumed) {
+        // Request MOTD on resumed sessions (new sessions
+        // get it automatically from the server during
+        // creation).  Channel state is initialized by the
+        // server via the message queue
+        // (?initChannelState=1), so we do not need to
+        // re-JOIN channels here.
        try {
          await api("/messages", {
            method: "POST",
@@ -647,8 +668,11 @@ function App() {
        } catch (e) {
          // MOTD is non-critical.
        }
+
+        return;
      }

+      // Fresh session — join any previously saved channels.
      const saved = JSON.parse(
        localStorage.getItem("neoirc_channels") || "[]",
      );
Author	SHA1	Message	Date
clawbot	73cae71171	deps: migrate from go-chi/chi v1 to go-chi/chi/v5 All checks were successful check / check (push) Successful in 1m2s Details Migrate all import paths from github.com/go-chi/chi to github.com/go-chi/chi/v5 and github.com/go-chi/chi/middleware to github.com/go-chi/chi/v5/middleware. This resolves GO-2026-4316 (open redirect vulnerability in RedirectSlashes middleware) by moving to the maintained v5 module path. Files changed: - go.mod: chi v1.5.5 → chi/v5 v5.2.1 - internal/server/server.go: updated import - internal/server/routes.go: updated imports - internal/middleware/middleware.go: updated import - internal/handlers/api.go: updated import - README.md: updated Required Libraries table	2026-03-10 07:27:26 -07:00
clawbot	67446b36a1	feat: store auth tokens as SHA-256 hashes instead of plaintext (#69 ) All checks were successful check / check (push) Successful in 5s Details ## Summary Hash client auth tokens with SHA-256 before storing in the database. When validating tokens, hash the incoming token and compare against the stored hash. This prevents token exposure if the database is compromised. Existing plaintext tokens are implicitly invalidated since they will not match the new hashed lookups — users will need to create new sessions. ## Changes - `internal/db/queries.go`: Added `hashToken()` helper using `crypto/sha256`. Updated `CreateSession` to store hashed token. Updated `GetSessionByToken` to hash the incoming token before querying. - `internal/db/auth.go`: Updated `RegisterUser` and `LoginUser` to store hashed tokens. ## Migration No schema changes needed. The `token` column remains `TEXT` but now stores 64-char hex SHA-256 digests instead of 64-char hex random tokens. Existing plaintext tokens are effectively invalidated. closes #34 Co-authored-by: user <user@Mac.lan guest wan> Reviewed-on: #69 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-10 12:44:29 +01:00
clawbot	b1fd2f1b96	Replace string-matching error detection with typed SQLite errors (closes #39 ) (#66 ) All checks were successful check / check (push) Successful in 4s Details ## Summary Replaces fragile `strings.Contains(err.Error(), "UNIQUE")` checks with typed error detection using `errors.As` and the SQLite driver's `sqlite.Error` type. ## Changes - `internal/db/errors.go`* (new): Adds `IsUniqueConstraintError(err)` helper that uses `errors.As` to unwrap the error into `sqlite.Error` and checks for `SQLITE_CONSTRAINT_UNIQUE` (code 2067). - `internal/handlers/api.go`: Replaces two `strings.Contains(err.Error(), "UNIQUE")` calls with `db.IsUniqueConstraintError(err)` — in `handleCreateSessionError` and `executeNickChange`. - `internal/handlers/auth.go`*: Replaces one `strings.Contains(err.Error(), "UNIQUE")` call with `db.IsUniqueConstraintError(err)` — in `handleRegisterError`. ## Why String matching on error messages is fragile — if the SQLite driver changes its error message format, the detection silently breaks. Using `errors.As` with the driver's typed error and checking the specific SQLite error code is robust, idiomatic Go, and immune to message format changes. closes #39 <!-- session: agent:sdlc-manager:subagent:3fb0b8e2-d635-4848-a5bd-131c5033cdb1 --> Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #66 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-10 11:54:27 +01:00
clawbot	c07f94a432	Remove dead Auth() middleware method (#68 ) All checks were successful check / check (push) Successful in 5s Details Remove the unused `Auth()` method from `internal/middleware/middleware.go`. This method only logged "AUTH: before request" and passed through to the next handler — it performed no actual authentication. It was never referenced anywhere in the codebase; authentication is handled per-handler via `requireAuth` in the handlers package. closes #38 <!-- session: agent:sdlc-manager:subagent:629a7621-ec4b-49af-b7e8-03141664d682 --> Co-authored-by: user <user@Mac.lan guest wan> Reviewed-on: #68 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-10 11:41:43 +01:00
clawbot	a98e0ca349	feat: add Content-Security-Policy middleware (#64 ) All checks were successful check / check (push) Successful in 4s Details Add CSP header to all HTTP responses for defense-in-depth against XSS. The policy restricts all resource loading to same-origin and disables dangerous features (object embeds, framing, base tag injection). The embedded SPA requires no inline scripts or inline style attributes (Preact applies styles programmatically via DOM properties), so a strict policy without `unsafe-inline` works correctly. Directives: - `default-src 'self'` — baseline same-origin restriction - `script-src 'self'` — same-origin scripts only - `style-src 'self'` — same-origin stylesheets only - `connect-src 'self'` — same-origin fetch/XHR only - `img-src 'self'` — same-origin images only - `font-src 'self'` — same-origin fonts only - `object-src 'none'` — no plugin content - `frame-ancestors 'none'` — prevent clickjacking - `base-uri 'self'` — prevent base tag injection - `form-action 'self'` — restrict form submissions closes #41 Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Reviewed-on: #64 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-10 11:20:15 +01:00
clawbot	f287fdf6d1	fix: replay channel state on SPA reconnect (#61 ) All checks were successful check / check (push) Successful in 4s Details ## Summary When closing and reopening the SPA, channel tabs were not restored because the client relied on localStorage to remember joined channels and re-sent JOIN commands on reconnect. This was fragile and caused spurious JOIN broadcasts to other channel members. ## Changes ### Server (`internal/handlers/api.go`, `internal/handlers/auth.go`) - `replayChannelState()` — new method that enqueues synthetic JOIN messages plus join-numerics (332 TOPIC, 353 NAMES, 366 ENDOFNAMES) for every channel the session belongs to, targeted only at the specified client (no broadcast to other users). - `HandleState` — accepts `?replay=1` query parameter to trigger channel state replay when the SPA reconnects. - `handleLogin` — also calls `replayChannelState` after password-based login, since `LoginUser` creates a new client for an existing session. ### SPA (`web/src/app.jsx`, `web/dist/app.js`) - On resume, calls `/state?replay=1` instead of `/state` so the server enqueues channel state into the message queue. - `processMessage` now creates channel tabs when receiving a JOIN where `msg.from` matches the current nick (handles both live joins and replayed joins on reconnect). - `onLogin` no longer re-sends JOIN commands for saved channels on resume — the server handles it via the replay mechanism, avoiding spurious JOIN broadcasts. ## How It Works 1. SPA loads, finds saved token in localStorage 2. Calls `GET /api/v1/state?replay=1` — server validates token and enqueues synthetic JOIN + TOPIC + NAMES for all session channels into the client's queue 3. `onLogin(nick, true)` sets `loggedIn = true` and requests MOTD (no re-JOIN needed) 4. Poll loop starts, picks up replayed channel messages 5. `processMessage` handles the JOIN messages, creating tabs and refreshing members/topics naturally closes #60 Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #61 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-10 11:08:13 +01:00
clawbot	687c958bd1	fix: add version field to /api/v1/server response (#62 ) All checks were successful check / check (push) Successful in 4s Details Add `version` field from `globals.Version` to the `handleServerInfo` response and update README documentation to include the new field. Closes #43 <!-- session: agent:sdlc-manager:subagent:35f84819-55dd-4bb6-a94b-8103777cc433 --> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Reviewed-on: #62 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-10 11:05:10 +01:00
clawbot	946f208ac2	feat: implement IRC numerics batch 2 — connection registration, channel ops, user queries (#59 ) All checks were successful check / check (push) Successful in 5s Details ## Summary Implements the remaining important/commonly-used IRC numeric reply codes, as requested in [issue #52](#52). ### Connection Registration (001-005) - 002 RPL_YOURHOST — "Your host is <server>, running version <ver>" - 003 RPL_CREATED — "This server was created <date>" - 004 RPL_MYINFO — "<server> <version> <usermodes> <chanmodes>" - 005 RPL_ISUPPORT — CHANTYPES=#, NICKLEN=32, CHANMODES, NETWORK=neoirc, CASEMAPPING=ascii All sent automatically after RPL_WELCOME during session creation/login. ### Server Statistics (251-255) - 251 RPL_LUSERCLIENT — user count - 252 RPL_LUSEROP — operator count - 254 RPL_LUSERCHANNELS — channel count - 255 RPL_LUSERME — local client count Sent during connection registration and available via LUSERS command. ### Channel Operations - MODE command — query channel modes (324 RPL_CHANNELMODEIS + 329 RPL_CREATIONTIME) and user modes (221 RPL_UMODEIS) - NAMES command — query channel member list (reuses 353/366) - LIST command — list all channels with member counts (322 RPL_LIST + 323 end) ### User Queries - WHOIS command — 311 RPL_WHOISUSER, 312 RPL_WHOISSERVER, 319 RPL_WHOISCHANNELS, 318 RPL_ENDOFWHOIS - WHO command — 352 RPL_WHOREPLY, 315 RPL_ENDOFWHO ### Database Additions - `GetChannelCount()` — total channel count for LUSERS - `ListAllChannelsWithCounts()` — channels with member counts for LIST - `GetChannelCreatedAt()` — channel creation time for RPL_CREATIONTIME - `GetSessionCreatedAt()` — session creation time ### Other Changes - Added `StartTime` to `Globals` struct for RPL_CREATED - Updated README with comprehensive documentation of all new commands and numerics - Updated roadmap to reflect implemented features `docker build .` passes (lint, tests, build all green). closes [#52](#52) <!-- session: agent:sdlc-manager:subagent:1f3dcab8-ad6a-4c4c-af72-34a617640c9d --> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: clawbot <clawbot@git.eeqj.de> Reviewed-on: #59 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud> Co-committed-by: clawbot <sneak+clawbot@sneak.cloud>	2026-03-10 00:53:46 +01:00