Rewrite schema/README.md sentence by sentence

Rewrite the description of the JSON Schema files from scratch, without
tables. Describe the fields of a message as the HTTP API sends them:
the reply name in `command` and its number in `code`. Drop the
federation section, which describes nothing the server does. List each
place where a schema file disagrees with the HTTP API, so that a reader
is not misled. The files themselves are unchanged.

Part of #190.

Model: fable-5-1 (writing); opus-5-5 (rework)

.golangci.yml

@@ -61,6 +61,10 @@ linters:
               desc: >-
                 Test-support code belongs in test files and in packages whose
                 directory name ends in test, not in the shipped binary.
+            - pkg: sneak.berlin/go/neoirc/internal/dbtest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
     # Only decisions already recorded in the Go package defaults are
     # listed here. Every entry matches the module path exactly.
     gomodguard_v2:

README.md

@@ -268,10 +268,15 @@ rules). Case-sensitive comparison is unambiguous.
 A single user session can have multiple clients (phone, laptop, terminal).
 
 - Each client gets a **separate server-to-client (S2C) message queue**.
-- The server fans out messages and events from other users, and the user's own
+- The server fans out messages and events from other users to every client queue
-  DMs and the channel messages it sends over the HTTP API, to every client queue
+  for that user session.
-  for that user session. Replies to a command (numerics) go only to the client
+- When the user sends a `PRIVMSG`, `NOTICE`, `JOIN`, `PART`, `NICK`, `TOPIC`,
-  that sent it.
+  `MODE` or `KICK` from one of its clients, the resulting event goes to every
+  client queue of the user's own session, as well as to the other users it is
+  meant for. The one exception is an IRC listener connection that sent the
+  command, which gets nothing queued for it: it has already sent its user the
+  echo, or, for `PRIVMSG` and `NOTICE`, IRC sends none.
+- Replies to a command (numerics) go only to the client that sent it.
 - `GET /api/v1/messages` delivers from the calling client's specific queue,
   identified by the auth cookie.
 - Client queues have **independent expiry/pruning** — one client going offline
@@ -744,7 +749,7 @@ Leave a channel.
 {"command": "PART", "to": "#general", "body": ["goodbye"]}
 ```
 
-**S2C (broadcast to the other channel members):**
+**S2C (broadcast to all channel members, including the departing user):**
 
 ```json
 {
@@ -760,9 +765,8 @@ Leave a channel.
 
 **Behavior:**
 
-- The PART event goes to the other channel members, not to the departing user;
+- The PART event goes to every channel member, the departing user's own clients
-  the HTTP response confirms the part. (The IRC listener echoes the PART to its
+  included. (An IRC listener connection that sends a PART echoes it itself.)
-  own connection.)
 - If the channel is empty after the user leaves, the channel is **deleted**
   (ephemeral channels).
 - If the user is not in the channel, the server returns an error.
@@ -2607,7 +2611,7 @@ listener.
 | Variable               | Type   | Default                                                                                | Description                                                                                                                                                                                                                                                                             |
 | ---------------------- | ------ | -------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `PORT`                 | int    | `8080`                                                                                 | HTTP listen port                                                                                                                                                                                                                                                                        |
-| `DBURL`                | string | `file:///var/lib/neoirc/state.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)` | SQLite connection string. For file-based: `file:///path/to/db.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)`. For in-memory (testing): `file::memory:?cache=shared`. See [SQLite Considerations](#sqlite-considerations).                                                     |
+| `DBURL`                | string | `file:///var/lib/neoirc/state.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)` | SQLite connection string. For file-based: `file:///path/to/db.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)`. For in-memory (testing): `file::memory:?cache=shared`. It must not set `foreign_keys`. See [SQLite Considerations](#sqlite-considerations).                     |
 | `DEBUG`                | bool   | `false`                                                                                | Switch logging to debug level                                                                                                                                                                                                                                                           |
 | `MESSAGE_MAX_AGE`      | string | `720h`                                                                                 | Maximum age of messages as a Go duration string (e.g. `720h`, `24h`). Messages older than this are pruned. Default is 30 days.                                                                                                                                                          |
 | `SESSION_IDLE_TIMEOUT` | string | `720h`                                                                                 | Idle timeout as a Go duration string (e.g. `720h`, `24h`). Clients with no authenticated HTTP API request or IRC listener command for this long are removed, and a session left with none is expired and its nick released (see [Data Lifecycle](#data-lifecycle)). Default is 30 days. |
@@ -2719,7 +2723,9 @@ Each line of a multi-line `body` reaches an IRC listener user as its own
 is sent, so it cannot start a line of its own. A mode change made over the HTTP
 API reaches IRC listener members as an IRC `MODE` line with its value as a
 separate parameter, e.g. `MODE #general +k secretpass` or
-`MODE #general +o bob`.
+`MODE #general +o bob`. An `INVITE` from either transport reaches the invited
+IRC listener user as an IRC `INVITE` line from the inviter, e.g.
+`:alice!alice@* INVITE bob #general`.
 
 ### Docker Usage
 
@@ -3336,6 +3342,7 @@ neoirc/
 │   │   └── schema/
 │   │       ├── 000.sql     # schema_migrations bootstrap
 │   │       └── 001_initial.sql
+│   ├── dbtest/             # Gives each test its own database; only tests import it
 │   ├── globals/            # Application-wide metadata
 │   │   └── globals.go
 │   ├── handlers/           # HTTP request handlers

internal/cli/api/client.go

@@ -25,7 +25,10 @@ const (
 	httpErrThreshold = 400
 )
 
-var errHTTP = errors.New("HTTP error")
+var (
+	errHTTP        = errors.New("HTTP error")
+	errJoinRefused = errors.New("the server refused the join")
+)
 
 // Client wraps HTTP calls to the neoirc server API.
 type Client struct {
@@ -206,13 +209,35 @@ func (client *Client) PollMessages(
 	}, nil
 }
 
-// JoinChannel joins a channel.
+// JoinChannel joins a channel. It returns an error unless the
+// server answers that the session joined. When the server
+// refuses the join, it sends the reason to the message queue as
+// an error numeric.
 func (client *Client) JoinChannel(channel string) error {
-	return client.SendMessage(
+	data, err := client.do(
+		http.MethodPost, "/api/v1/messages",
 		&Message{ //nolint:exhaustruct // only command+to needed
 			Command: irc.CmdJoin, To: channel,
 		},
 	)
+	if err != nil {
+		return err
+	}
+
+	var resp struct {
+		Status string `json:"status"`
+	}
+
+	err = json.Unmarshal(data, &resp)
+	if err != nil {
+		return fmt.Errorf("decode join: %w", err)
+	}
+
+	if resp.Status != "joined" {
+		return errJoinRefused
+	}
+
+	return nil
 }
 
 // PartChannel leaves a channel.

internal/cli/app.go

@@ -96,20 +96,7 @@ func (a *App) handleInput(text string) {
 		a.ui.AddStatus(
 			"[red]Send error: " + err.Error(),
 		)
-
-		return
 	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
 }
 
 func (a *App) handleCommand(text string) {
@@ -301,9 +288,6 @@ func (a *App) cmdJoin(channel string) {
 	a.mu.Unlock()
 
 	a.ui.SwitchToBuffer(channel)
-	a.ui.AddLine(channel,
-		"[yellow]*** Joined "+channel,
-	)
 	a.ui.SetStatus(nick, channel, "connected")
 }
 
@@ -338,10 +322,6 @@ func (a *App) cmdPart(channel string) {
 		return
 	}
 
-	a.ui.AddLine(channel,
-		"[yellow]*** Left "+channel,
-	)
-
 	a.mu.Lock()
 	if a.target == channel {
 		a.target = ""
@@ -368,7 +348,6 @@ func (a *App) cmdMsg(args string) {
 
 	a.mu.Lock()
 	connected := a.connected
-	nick := a.nick
 	a.mu.Unlock()
 
 	if !connected {
@@ -386,16 +365,7 @@ func (a *App) cmdMsg(args string) {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Send failed: %v", err,
 		))
-
-		return
 	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
 }
 
 func (a *App) cmdQuery(nick string) {
@@ -757,7 +727,7 @@ func (a *App) handleServerMessage(msg *api.Message) {
 	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
 	case irc.CmdPart:
-		a.handlePartEvent(msg, timestamp)
+		a.handlePartEvent(msg, timestamp, myNick)
 	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
 	case irc.CmdNick:
@@ -785,12 +755,10 @@ func (a *App) handlePrivmsgEvent(
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 
-	if msg.From == myNick {
+	// A direct message shows in the buffer of the other user:
-		return
+	// the recipient of one the user sent, else the sender.
-	}
-
 	target := msg.To
-	if !strings.HasPrefix(target, "#") {
+	if !strings.HasPrefix(target, "#") && msg.From != myNick {
 		target = msg.From
 	}
 
@@ -813,8 +781,11 @@ func (a *App) handleJoinEvent(
 	))
 }
 
+// handlePartEvent shows a part in the channel's buffer. The
+// user's own part does not mark the channel unread: the user
+// has just left it.
 func (a *App) handlePartEvent(
-	msg *api.Message, timestamp string,
+	msg *api.Message, timestamp, myNick string,
 ) {
 	if msg.To == "" {
 		return
@@ -823,17 +794,22 @@ func (a *App) handlePartEvent(
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 
+	line := fmt.Sprintf(
+		"[gray]%s [yellow]*** %s has left %s",
+		timestamp, msg.From, msg.To,
+	)
+
 	if reason != "" {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
+		line += " (" + reason + ")"
-			"[gray]%s [yellow]*** %s has left %s (%s)",
-			timestamp, msg.From, msg.To, reason,
-		))
-	} else {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s",
-			timestamp, msg.From, msg.To,
-		))
 	}
+
+	if msg.From == myNick {
+		a.ui.AddLineAsRead(msg.To, line)
+
+		return
+	}
+
+	a.ui.AddLine(msg.To, line)
 }
 
 func (a *App) handleQuitEvent(

internal/cli/app_internal_test.go

@@ -1,9 +1,23 @@
 package cli
 
 import (
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
+	"github.com/gdamore/tcell/v2"
 	api "sneak.berlin/go/neoirc/internal/cli/api"
+	"sneak.berlin/go/neoirc/pkg/irc"
+)
+
+// The user's nick, a channel it is in, another user's nick and
+// a message text, for the tests below.
+const (
+	testNick      = "erin"
+	testChannel   = "#chan"
+	testOtherNick = "bob"
+	testText      = "hello"
 )
 
 func TestMemberPrefix(t *testing.T) {
@@ -49,3 +63,275 @@ func TestMemberPrefix(t *testing.T) {
 		})
 	}
 }
+
+// TestPartEvent checks that a PART event adds a line to the
+// channel's buffer and marks it unread, except that the
+// user's own part does not mark it unread.
+func TestPartEvent(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		from       string
+		wantUnread int
+	}{
+		{name: "own part", from: testNick, wantUnread: 0},
+		{name: "other member", from: testOtherNick, wantUnread: 1},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{ui: NewUI(), nick: testNick}
+			runUI(t, app.ui)
+
+			app.handleServerMessage(&api.Message{
+				Command: irc.CmdPart, From: test.from, To: testChannel,
+			})
+
+			lines, unread := bufferState(app.ui, testChannel)
+			if lines != 1 || unread != test.wantUnread {
+				t.Fatalf("got %d lines and %d unread, want 1 and %d",
+					lines, unread, test.wantUnread)
+			}
+		})
+	}
+}
+
+// TestOwnCommandShownOnce checks that a message, join or
+// part made from neoirc-cli shows as one line in the
+// channel's buffer once the server's event for it arrives,
+// and does not mark the channel unread.
+func TestOwnCommandShownOnce(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		send  func(app *App)
+		event api.Message
+	}{
+		{
+			name: "message",
+			send: func(app *App) { app.handleInput(testText) },
+			event: api.Message{
+				Command: irc.CmdPrivmsg, From: testNick, To: testChannel,
+				Body: []string{testText},
+			},
+		},
+		{
+			name: "join",
+			send: func(app *App) { app.cmdJoin(testChannel) },
+			event: api.Message{
+				Command: irc.CmdJoin, From: testNick, To: testChannel,
+			},
+		},
+		{
+			name: "part",
+			send: func(app *App) { app.cmdPart(testChannel) },
+			event: api.Message{
+				Command: irc.CmdPart, From: testNick, To: testChannel,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			// The server accepts every command. Only the response
+			// to a JOIN is read, and it says the session joined.
+			server := newServer(t, `{"status": "joined"}`)
+
+			app := &App{
+				ui:        NewUI(),
+				client:    api.NewClient(server.URL),
+				nick:      testNick,
+				target:    testChannel,
+				connected: true,
+			}
+			runUI(t, app.ui)
+			app.ui.SwitchToBuffer(testChannel)
+
+			test.send(app)
+			app.handleServerMessage(&test.event)
+
+			lines, unread := bufferState(app.ui, testChannel)
+			if lines != 1 || unread != 0 {
+				t.Fatalf("got %d lines and %d unread, want 1 and 0",
+					lines, unread)
+			}
+		})
+	}
+}
+
+// TestJoinResponse checks that /join switches to the channel's
+// buffer and makes it the target only when the server answers
+// that the session joined.
+func TestJoinResponse(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		response string
+		// The buffer shown and the target after the join.
+		want string
+	}{
+		{
+			name:     "joined",
+			response: `{"status": "joined", "channel": "#chan"}`,
+			want:     testChannel,
+		},
+		{
+			name:     "refused",
+			response: `{"status": "error"}`,
+			want:     testOtherNick,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{
+				ui:        NewUI(),
+				client:    api.NewClient(newServer(t, test.response).URL),
+				nick:      testNick,
+				target:    testOtherNick,
+				connected: true,
+			}
+			runUI(t, app.ui)
+			app.ui.SwitchToBuffer(testOtherNick)
+
+			app.cmdJoin(testChannel)
+
+			var shown string
+
+			app.ui.app.QueueUpdate(func() {
+				shown = app.ui.buffers[app.ui.currentBuffer].Name
+			})
+
+			if shown != test.want || app.target != test.want {
+				t.Fatalf("got buffer %s and target %s, want %s",
+					shown, app.target, test.want)
+			}
+		})
+	}
+}
+
+// TestOwnEventFromOtherClient checks that a message, notice,
+// join or part that the user's session makes from another
+// client shows as one line in the buffer it belongs to.
+func TestOwnEventFromOtherClient(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		event  api.Message
+		buffer string
+	}{
+		{
+			name: "channel message",
+			event: api.Message{
+				Command: irc.CmdPrivmsg, From: testNick, To: testChannel,
+				Body: []string{testText},
+			},
+			buffer: testChannel,
+		},
+		{
+			name: "direct message",
+			event: api.Message{
+				Command: irc.CmdPrivmsg, From: testNick, To: testOtherNick,
+				Body: []string{testText},
+			},
+			buffer: testOtherNick,
+		},
+		{
+			name: "notice",
+			event: api.Message{
+				Command: irc.CmdNotice, From: testNick, To: testChannel,
+				Body: []string{testText},
+			},
+			buffer: "(status)",
+		},
+		{
+			name: "join",
+			event: api.Message{
+				Command: irc.CmdJoin, From: testNick, To: testChannel,
+			},
+			buffer: testChannel,
+		},
+		{
+			name: "part",
+			event: api.Message{
+				Command: irc.CmdPart, From: testNick, To: testChannel,
+			},
+			buffer: testChannel,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{ui: NewUI(), nick: testNick}
+			runUI(t, app.ui)
+
+			app.handleServerMessage(&test.event)
+
+			lines, _ := bufferState(app.ui, test.buffer)
+			if lines != 1 {
+				t.Fatalf("got %d lines in %s, want 1", lines, test.buffer)
+			}
+		})
+	}
+}
+
+// bufferState returns the number of lines in the named
+// buffer and how many of them are unread.
+func bufferState(ui *UI, name string) (int, int) {
+	var lines, unread int
+
+	ui.app.QueueUpdate(func() {
+		buf := ui.getOrCreateBuffer(name)
+		lines = len(buf.Lines)
+		unread = buf.Unread
+	})
+
+	return lines, unread
+}
+
+// newServer starts a server that answers every request with
+// body until the test ends.
+func newServer(t *testing.T, body string) *httptest.Server {
+	t.Helper()
+
+	server := httptest.NewServer(http.HandlerFunc(
+		func(writer http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(writer, body)
+		},
+	))
+	t.Cleanup(server.Close)
+
+	return server
+}
+
+// runUI runs ui on a simulated screen until the test ends.
+func runUI(t *testing.T, ui *UI) {
+	t.Helper()
+
+	ui.app.SetScreen(tcell.NewSimulationScreen(""))
+
+	done := make(chan error)
+
+	go func() { done <- ui.Run() }()
+
+	t.Cleanup(func() {
+		ui.Stop()
+
+		err := <-done
+		if err != nil {
+			t.Errorf("run ui: %v", err)
+		}
+	})
+}

internal/cli/ui.go

@@ -95,6 +95,19 @@ func (ui *UI) AddLine(bufferName, line string) {
 	})
 }
 
+// AddLineAsRead adds a line to the specified buffer, as
+// AddLine does, but does not mark the buffer unread.
+func (ui *UI) AddLineAsRead(bufferName, line string) {
+	ui.app.QueueUpdateDraw(func() {
+		buf := ui.getOrCreateBuffer(bufferName)
+		buf.Lines = append(buf.Lines, line)
+
+		if ui.buffers[ui.currentBuffer] == buf {
+			_, _ = fmt.Fprintln(ui.messages, line)
+		}
+	})
+}
+
 // AddStatus adds a line to the status buffer.
 func (ui *UI) AddStatus(line string) {
 	ts := time.Now().Format("15:04")

internal/db/db.go

@@ -5,9 +5,11 @@ import (
 	"context"
 	"database/sql"
 	"embed"
+	"errors"
 	"fmt"
 	"io/fs"
 	"log/slog"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -22,6 +24,10 @@ import (
 
 const minMigrationParts = 2
 
+var errForeignKeysInDBURL = errors.New(
+	"DBURL must not set foreign_keys, which the server always turns on",
+)
+
 // SchemaFiles contains embedded SQL migration files.
 //
 //go:embed schema/*.sql
@@ -90,6 +96,33 @@ func (database *Database) connect(ctx context.Context) error {
 		dbURL = config.DefaultDBURL
 	}
 
+	// SQLite keeps the foreign keys setting per connection. The driver
+	// runs each _pragma parameter on every connection it opens. So the
+	// one added below also covers the connection the pool opens after
+	// a cancelled query breaks the old one. A foreign_keys pragma in
+	// DBURL could undo it, because the driver sorts the pragmas.
+	_, query, hasQuery := strings.Cut(dbURL, "?")
+
+	urlParams, err := url.ParseQuery(query)
+	if err != nil {
+		return fmt.Errorf("parse DBURL: %w", err)
+	}
+
+	for _, pragma := range urlParams["_pragma"] {
+		if strings.Contains(strings.ToLower(pragma), "foreign_keys") {
+			return fmt.Errorf(
+				"%w: _pragma=%s", errForeignKeysInDBURL, pragma,
+			)
+		}
+	}
+
+	separator := "?"
+	if hasQuery {
+		separator = "&"
+	}
+
+	dbURL += separator + "_pragma=foreign_keys(1)"
+
 	database.log.Info(
 		"connecting to database", "url", dbURL,
 	)
@@ -109,13 +142,6 @@ func (database *Database) connect(ctx context.Context) error {
 	database.conn = conn
 	database.log.Info("database connected")
 
-	_, err = database.conn.ExecContext(
-		ctx, "PRAGMA foreign_keys = ON",
-	)
-	if err != nil {
-		return fmt.Errorf("enable foreign keys: %w", err)
-	}
-
 	return database.runMigrations(ctx)
 }
 

internal/db/db_test.go

@@ -1,19 +1,34 @@
 package db_test
 
 import (
+	"context"
+	"errors"
+	"net/url"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"go.uber.org/fx/fxtest"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
 )
 
 const wantBusyTimeoutMS = 5000
 
+const (
+	// endlessQuery counts the rows of a recursive query that never
+	// stops, so it runs until its context ends.
+	endlessQuery = `WITH RECURSIVE n(x) AS
+		(SELECT 1 UNION ALL SELECT x + 1 FROM n)
+		SELECT COUNT(*) FROM n`
+
+	endlessQueryTimeout = 100 * time.Millisecond
+)
+
 // TestDefaultDBURLSetsWALAndBusyTimeout opens a file database
 // with the default URL's parameters the way the server does,
 // and checks the journal mode and busy timeout it ends up with.
@@ -73,3 +88,191 @@ func TestDefaultDBURLSetsWALAndBusyTimeout(t *testing.T) {
 		)
 	}
 }
+
+// TestForeignKeysOnAfterCancelledQuery cancels a query while it
+// runs, which makes the pool close its only connection and open a
+// new one. A TEMP table lasts only as long as its connection, so
+// its absence shows the connection was replaced. The test then
+// checks that the file database keeps its tables and that the new
+// connection has foreign keys on.
+func TestForeignKeysOnAfterCancelledQuery(t *testing.T) {
+	t.Parallel()
+
+	_, defaultParams, _ := strings.Cut(config.DefaultDBURL, "?")
+
+	urlParams := map[string]string{
+		"default parameters": "?" + defaultParams,
+		"no parameters":      "",
+	}
+
+	for name, params := range urlParams {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			dbURL := "file://" +
+				filepath.Join(t.TempDir(), "state.db") + params
+
+			database, err := startDatabase(t, dbURL)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			_, err = database.GetDB().ExecContext(
+				t.Context(), "CREATE TEMP TABLE first_connection (x)",
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			ctx, cancel := context.WithTimeout(
+				t.Context(), endlessQueryTimeout,
+			)
+			defer cancel()
+
+			_, err = database.GetDB().ExecContext(ctx, endlessQuery)
+			if !errors.Is(err, context.DeadlineExceeded) {
+				t.Fatalf("endless query: err = %v", err)
+			}
+
+			tempTables := queryInt(
+				t, database, "SELECT COUNT(*) FROM sqlite_temp_schema",
+			)
+			if tempTables != 0 {
+				t.Fatal("the pool kept its first connection")
+			}
+
+			migrations := queryInt(
+				t, database, "SELECT COUNT(*) FROM schema_migrations",
+			)
+			if migrations == 0 {
+				t.Error("schema_migrations is empty")
+			}
+
+			foreignKeys := queryInt(t, database, "PRAGMA foreign_keys")
+			if foreignKeys != 1 {
+				t.Errorf("foreign_keys = %d, want 1", foreignKeys)
+			}
+		})
+	}
+}
+
+// TestNewURLKeepsDataAfterCancelledQuery cancels a query on a test
+// database while it runs, which makes the pool close its only
+// connection and open a new one. A TEMP table lasts only as long as
+// its connection, so its absence shows the connection was replaced.
+// The database must still have its tables and rows.
+func TestNewURLKeepsDataAfterCancelledQuery(t *testing.T) {
+	t.Parallel()
+
+	database, err := startDatabase(t, dbtest.NewURL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = database.GetOrCreateChannel(t.Context(), "#test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = database.GetDB().ExecContext(
+		t.Context(), "CREATE TEMP TABLE first_connection (x)",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), endlessQueryTimeout)
+	defer cancel()
+
+	_, err = database.GetDB().ExecContext(ctx, endlessQuery)
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("endless query: err = %v", err)
+	}
+
+	tempTables := queryInt(
+		t, database, "SELECT COUNT(*) FROM sqlite_temp_schema",
+	)
+	if tempTables != 0 {
+		t.Fatal("the pool kept its first connection")
+	}
+
+	channels := queryInt(t, database, "SELECT COUNT(*) FROM channels")
+	if channels != 1 {
+		t.Errorf("channels = %d, want 1", channels)
+	}
+}
+
+// TestDBURLSettingForeignKeysFailsStartup checks that the database
+// refuses to start when DBURL sets foreign_keys itself, however it
+// is spelled.
+func TestDBURLSettingForeignKeysFailsStartup(t *testing.T) {
+	t.Parallel()
+
+	pragmas := []string{
+		"foreign_keys(0)",
+		"foreign_keys(off)",
+		"foreign_keys=0",
+		"FOREIGN_KEYS(FALSE)",
+		" Foreign_Keys = 1",
+	}
+
+	for _, pragma := range pragmas {
+		t.Run(pragma, func(t *testing.T) {
+			t.Parallel()
+
+			dbURL := "file://" +
+				filepath.Join(t.TempDir(), "state.db") +
+				"?_pragma=" + url.QueryEscape(pragma)
+
+			_, err := startDatabase(t, dbURL)
+			if err == nil {
+				t.Fatal("the database started")
+			}
+
+			if !strings.Contains(err.Error(), "DBURL") {
+				t.Errorf("error %q does not name DBURL", err)
+			}
+		})
+	}
+}
+
+// startDatabase starts a Database for dbURL the way the server does.
+// It returns the error that stopped it from starting, if any.
+func startDatabase(t *testing.T, dbURL string) (*db.Database, error) {
+	t.Helper()
+
+	lifecycle := fxtest.NewLifecycle(t)
+
+	log, err := logger.New(lifecycle, logger.Params{
+		Globals: &globals.Globals{},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	database, err := db.New(lifecycle, db.Params{
+		Logger: log,
+		Config: &config.Config{DBURL: dbURL},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(lifecycle.RequireStop)
+
+	return database, lifecycle.Start(t.Context())
+}
+
+// queryInt runs a query that returns a single number.
+func queryInt(t *testing.T, database *db.Database, query string) int {
+	t.Helper()
+
+	var result int
+
+	err := database.GetDB().QueryRowContext(t.Context(), query).Scan(&result)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return result
+}

internal/db/export_test.go

@@ -5,21 +5,16 @@ import (
 	"database/sql"
 	"fmt"
 	"log/slog"
-	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/neoirc/internal/dbtest"
 )
 
-//nolint:gochecknoglobals // test counter
-var testDBCounter atomic.Int64
-
 // NewTestDatabase creates an in-memory database for testing.
-func NewTestDatabase() (*Database, error) {
+func NewTestDatabase(tb testing.TB) (*Database, error) {
-	counter := testDBCounter.Add(1)
+	tb.Helper()
 
-	dsn := fmt.Sprintf(
+	dsn := dbtest.NewURL(tb) + "&_pragma=foreign_keys(1)"
-		"file:testdb%d?mode=memory"+
-			"&cache=shared&_pragma=foreign_keys(1)",
-		counter,
-	)
 
 	conn, err := sql.Open("sqlite", dsn)
 	if err != nil {

internal/db/queries.go

@@ -264,6 +264,25 @@ func (database *Database) GetSessionByNick(
 	return sessionID, nil
 }
 
+// GetSessionNick returns the nick a session holds.
+func (database *Database) GetSessionNick(
+	ctx context.Context,
+	sessionID int64,
+) (string, error) {
+	var nick string
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		"SELECT nick FROM sessions WHERE id = ?",
+		sessionID,
+	).Scan(&nick)
+	if err != nil {
+		return "", fmt.Errorf("get session nick: %w", err)
+	}
+
+	return nick, nil
+}
+
 // SessionHostInfo holds the username, hostname, and IP
 // for a session.
 type SessionHostInfo struct {
@@ -1208,11 +1227,12 @@ func insertMessageInTx(
 	return dbID, msgUUID, nil
 }
 
-// EnqueueToSession adds a message to all clients of a
+// EnqueueToSession adds a message to the queues of all
-// session's queues.
+// clients of a session except client skipClientID, or of all
+// of them when skipClientID is 0.
 func (database *Database) EnqueueToSession(
 	ctx context.Context,
-	sessionID, messageID int64,
+	sessionID, messageID, skipClientID int64,
 ) error {
 	transaction, err := database.conn.BeginTx(ctx, nil)
 	if err != nil {
@@ -1221,7 +1241,9 @@ func (database *Database) EnqueueToSession(
 
 	defer func() { _ = transaction.Rollback() }()
 
-	err = enqueueToSessionInTx(ctx, transaction, sessionID, messageID)
+	err = enqueueToSessionInTx(
+		ctx, transaction, sessionID, messageID, skipClientID,
+	)
 	if err != nil {
 		return err
 	}
@@ -1239,15 +1261,15 @@ func (database *Database) EnqueueToSession(
 func enqueueToSessionInTx(
 	ctx context.Context,
 	transaction *sql.Tx,
-	sessionID, messageID int64,
+	sessionID, messageID, skipClientID int64,
 ) error {
 	_, err := transaction.ExecContext(ctx,
 		`INSERT OR IGNORE INTO client_queues
 		 (client_id, message_id, created_at)
 		 SELECT c.id, ?, ?
 		 FROM clients c
-		 WHERE c.session_id = ?`,
+		 WHERE c.session_id = ? AND c.id != ?`,
-		messageID, time.Now(), sessionID)
+		messageID, time.Now(), sessionID, skipClientID)
 	if err != nil {
 		return fmt.Errorf(
 			"enqueue to session: %w", err,
@@ -1673,7 +1695,7 @@ func quitSessionInTx(
 
 	for _, peerID := range peerIDs {
 		err = enqueueToSessionInTx(
-			ctx, transaction, peerID, messageID,
+			ctx, transaction, peerID, messageID, 0,
 		)
 		if err != nil {
 			return nil, err

internal/db/queries_test.go

@@ -13,7 +13,7 @@ import (
 func setupTestDB(t *testing.T) *db.Database {
 	t.Helper()
 
-	database, err := db.NewTestDatabase()
+	database, err := db.NewTestDatabase(t)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -675,7 +675,7 @@ func TestPollMessages(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = database.EnqueueToSession(ctx, sid, dbID)
+	err = database.EnqueueToSession(ctx, sid, dbID, 0)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/dbtest/dbtest.go

@@ -0,0 +1,39 @@
+// Package dbtest gives each test a database of its own. Only tests
+// may import it.
+package dbtest
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"testing"
+
+	_ "modernc.org/sqlite" // registers the sqlite driver
+)
+
+// NewURL returns the URL of a new, empty in-memory database for one
+// test. SQLite deletes an in-memory database when its last connection
+// closes. A pool closes a connection when a query on it is cancelled
+// while it runs. So this function holds a connection of its own open
+// until the test ends.
+func NewURL(tb testing.TB) string {
+	tb.Helper()
+
+	// A random name, so that no other test can share the database.
+	dbURL := "file:" + rand.Text() + "?mode=memory&cache=shared"
+
+	pool, err := sql.Open("sqlite", dbURL)
+	if err != nil {
+		tb.Fatalf("open test database: %v", err)
+	}
+
+	tb.Cleanup(func() { _ = pool.Close() })
+
+	conn, err := pool.Conn(tb.Context())
+	if err != nil {
+		tb.Fatalf("connect to test database: %v", err)
+	}
+
+	tb.Cleanup(func() { _ = conn.Close() })
+
+	return dbURL
+}

internal/handlers/api.go

@@ -1257,9 +1257,11 @@ func (hdlr *Handlers) handleChannelMsg(
 ) {
 	ctx := request.Context()
 
-	// Delegate validation + fan-out to service layer.
+	// Delegate validation + fan-out to service layer. The
-	dbID, uuid, err := hdlr.svc.SendChannelMessage(
+	// fan-out includes the sender's own session, so all
-		ctx, sessionID, nick,
+	// their clients see the message in long-poll responses.
+	uuid, err := hdlr.svc.SendChannelMessage(
+		ctx, sessionID, 0, nick,
 		command, target, body, meta,
 	)
 	if hdlr.handleServiceError(
@@ -1269,13 +1271,6 @@ func (hdlr *Handlers) handleChannelMsg(
 		return
 	}
 
-	// HTTP echo: enqueue to sender so all their clients
-	// see the message in long-poll responses.
-	_ = hdlr.params.Database.EnqueueToSession(
-		ctx, sessionID, dbID,
-	)
-	hdlr.broker.Notify(sessionID)
-
 	hdlr.respondJSON(writer, request,
 		map[string]string{"id": uuid, statusKey: "sent"},
 		http.StatusOK)
@@ -1290,7 +1285,7 @@ func (hdlr *Handlers) handleDirectMsg(
 	meta json.RawMessage,
 ) {
 	result, err := hdlr.svc.SendDirectMessage(
-		request.Context(), sessionID, nick,
+		request.Context(), sessionID, 0, nick,
 		command, target, body, meta,
 	)
 	if hdlr.handleServiceError(
@@ -1361,7 +1356,7 @@ func (hdlr *Handlers) executeJoin(
 	nick, channel, suppliedKey string,
 ) {
 	result, err := hdlr.svc.JoinChannel(
-		request.Context(), sessionID, nick,
+		request.Context(), sessionID, 0, nick,
 		channel, suppliedKey,
 	)
 	if hdlr.handleServiceError(
@@ -1545,7 +1540,7 @@ func (hdlr *Handlers) handlePart(
 	}
 
 	err := hdlr.svc.PartChannel(
-		request.Context(), sessionID,
+		request.Context(), sessionID, 0,
 		nick, channel, reason,
 	)
 	if hdlr.handleServiceError(
@@ -1616,7 +1611,7 @@ func (hdlr *Handlers) executeNickChange(
 	nick, newNick string,
 ) {
 	err := hdlr.svc.ChangeNick(
-		request.Context(), sessionID, nick, newNick,
+		request.Context(), sessionID, 0, nick, newNick,
 	)
 	if hdlr.handleServiceError(
 		writer, request,
@@ -1671,7 +1666,7 @@ func (hdlr *Handlers) handleTopic(
 	topic := strings.Join(lines, " ")
 
 	err := hdlr.svc.SetTopic(
-		request.Context(), sessionID,
+		request.Context(), sessionID, 0,
 		nick, channel, topic,
 	)
 	if hdlr.handleServiceError(
@@ -2157,7 +2152,7 @@ func (hdlr *Handlers) applyUserMode(
 
 	modeText := modeArgs[0] + " " + targetNick
 	hdlr.svc.BroadcastMode(
-		request.Context(), nick, channel, chID,
+		request.Context(), 0, nick, channel, chID,
 		modeText,
 	)
 
@@ -2203,7 +2198,7 @@ func (hdlr *Handlers) setChannelFlag(
 	}
 
 	hdlr.svc.BroadcastMode(
-		request.Context(), nick, channel, chID,
+		request.Context(), 0, nick, channel, chID,
 		modeStr,
 	)
 
@@ -3650,7 +3645,7 @@ func (hdlr *Handlers) handleKick(
 	}
 
 	err := hdlr.svc.KickUser(
-		request.Context(), sessionID, nick,
+		request.Context(), sessionID, 0, nick,
 		channel, targetNick, reason,
 	)
 	if hdlr.handleServiceError(
@@ -3723,7 +3718,7 @@ func (hdlr *Handlers) fanOut(
 
 	for _, sid := range sessionIDs {
 		enqErr := hdlr.params.Database.EnqueueToSession(
-			request.Context(), sid, dbID,
+			request.Context(), sid, dbID, 0,
 		)
 		if enqErr != nil {
 			hdlr.log.Error("enqueue failed",

internal/handlers/utility_test.go

@@ -1,4 +1,3 @@
-//nolint:paralleltest // global viper, as in api_test.go
 package handlers_test
 
 import (
@@ -72,6 +71,8 @@ func numericBody(
 }
 
 func TestUserhost(t *testing.T) {
+	t.Parallel()
+
 	tserver := newTestServer(t)
 
 	token := tserver.createSession("alice")
@@ -109,6 +110,8 @@ func TestUserhost(t *testing.T) {
 }
 
 func TestVersionAdminInfoTime(t *testing.T) {
+	t.Parallel()
+
 	tserver := newTestServer(t)
 
 	token := tserver.createSession("frank")
@@ -147,6 +150,8 @@ func TestVersionAdminInfoTime(t *testing.T) {
 }
 
 func TestKill(t *testing.T) {
+	t.Parallel()
+
 	tserver := newTestServerWithOper(t)
 
 	victimToken := tserver.createSession("victim")
@@ -213,6 +218,8 @@ func TestKill(t *testing.T) {
 }
 
 func TestWallops(t *testing.T) {
+	t.Parallel()
+
 	tserver := newTestServerWithOper(t)
 
 	receiverToken := tserver.createSession("receiver")
@@ -258,6 +265,8 @@ func TestWallops(t *testing.T) {
 }
 
 func TestUserMode(t *testing.T) {
+	t.Parallel()
+
 	const (
 		nick  = "alice"
 		other = "other"

internal/ircserver/commands.go

@@ -81,10 +81,10 @@ func (c *Conn) handleNick(
 	}
 
 	oldMask := c.hostmask()
-	oldNick := c.nick
+	oldNick := c.currentNick()
 
 	err := c.svc.ChangeNick(
-		ctx, c.sessionID, oldNick, newNick,
+		ctx, c.sessionID, c.clientID, oldNick, newNick,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -92,9 +92,10 @@ func (c *Conn) handleNick(
 		return
 	}
 
-	c.mu.Lock()
+	// Take the nick the session holds, not newNick: another
-	c.nick = newNick
+	// client of the session may have changed it again since
-	c.mu.Unlock()
+	// ChangeNick stored newNick.
+	c.loadSessionNick(ctx)
 
 	// Echo NICK change to the client on wire.
 	c.send(FormatMessage(oldMask, "NICK", newNick))
@@ -128,8 +129,8 @@ func (c *Conn) handlePrivmsg(
 	body, _ := json.Marshal([]string{text}) //nolint:errchkjson
 
 	if strings.HasPrefix(target, "#") {
-		_, _, err := c.svc.SendChannelMessage(
+		_, err := c.svc.SendChannelMessage(
-			ctx, c.sessionID, c.nick,
+			ctx, c.sessionID, c.clientID, c.currentNick(),
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -137,7 +138,7 @@ func (c *Conn) handlePrivmsg(
 		}
 	} else {
 		result, err := c.svc.SendDirectMessage(
-			ctx, c.sessionID, c.nick,
+			ctx, c.sessionID, c.clientID, c.currentNick(),
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -199,7 +200,7 @@ func (c *Conn) joinChannel(
 	channel, key string,
 ) {
 	result, err := c.svc.JoinChannel(
-		ctx, c.sessionID, c.nick, channel, key,
+		ctx, c.sessionID, c.clientID, c.currentNick(), channel, key,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -337,7 +338,7 @@ func (c *Conn) partChannel(
 	channel, reason string,
 ) {
 	err := c.svc.PartChannel(
-		ctx, c.sessionID, c.nick, channel, reason,
+		ctx, c.sessionID, c.clientID, c.currentNick(), channel, reason,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -401,7 +402,7 @@ func (c *Conn) handleTopic(
 	newTopic := msg.Params[1]
 
 	err := c.svc.SetTopic(
-		ctx, c.sessionID, c.nick, channel, newTopic,
+		ctx, c.sessionID, c.clientID, c.currentNick(), channel, newTopic,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -708,7 +709,7 @@ func (c *Conn) applyChannelModes(
 		c.send(FormatMessage(c.hostmask(), "MODE", params...))
 
 		c.svc.BroadcastMode(
-			ctx, c.nick, channel, chID, modeReply,
+			ctx, c.clientID, c.currentNick(), channel, chID, modeReply,
 		)
 	}
 }
@@ -1185,7 +1186,7 @@ func (c *Conn) handleKick(
 	}
 
 	err := c.svc.KickUser(
-		ctx, c.sessionID, c.nick,
+		ctx, c.sessionID, c.clientID, c.currentNick(),
 		channel, targetNick, reason,
 	)
 	if err != nil {
@@ -1225,7 +1226,7 @@ func (c *Conn) handlePassPostReg(
 		return
 	}
 
-	c.sendFromServer("NOTICE", c.nick,
+	c.sendFromServer("NOTICE", c.currentNick(),
 		"Password set. You can reconnect using "+
 			"PASS <password> with your nick.",
 	)
@@ -1249,7 +1250,7 @@ func (c *Conn) handleInvite(
 	channel := msg.Params[1]
 
 	targetID, err := c.svc.InviteUser(
-		ctx, c.sessionID, c.nick, targetNick, channel,
+		ctx, c.sessionID, c.currentNick(), targetNick, channel,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -1261,14 +1262,13 @@ func (c *Conn) handleInvite(
 		irc.RplInviting, targetNick, channel,
 	)
 
-	// Send INVITE notice to target via service fan-out.
+	// Queue the INVITE to the target with the body the HTTP
-	body, _ := json.Marshal( //nolint:errchkjson
+	// API uses.
-		[]string{"You have been invited to " + channel},
+	body, _ := json.Marshal([]string{channel}) //nolint:errchkjson
-	)
 
 	_, _, _ = c.svc.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, "INVITE", c.nick, targetNick, targetID, 0,
+		ctx, "INVITE", c.currentNick(), targetNick, targetID, 0,
-		nil, body, nil, []int64{targetID},
+		nil, body, nil, []int64{targetID}, 0,
 	)
 }
 

internal/ircserver/conn.go

@@ -313,6 +313,22 @@ func (c *Conn) currentNick() string {
 	return c.nick
 }
 
+// loadSessionNick sets c.nick to the nick the connection's
+// session holds in the database, read by session ID. The
+// connection's own NICK and the relay passing on a NICK line
+// both call it, and it reads and sets the nick under c.mu, so
+// whichever runs last leaves the connection on its session's
+// nick. If the read fails, c.nick is left as it is.
+func (c *Conn) loadSessionNick(ctx context.Context) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	nick, err := c.database.GetSessionNick(ctx, c.sessionID)
+	if err == nil {
+		c.nick = nick
+	}
+}
+
 // send writes a formatted IRC line to the connection.
 func (c *Conn) send(line string) {
 	c.sendWithin(writeTimeout, line)
@@ -345,7 +361,7 @@ func (c *Conn) sendNumeric(
 	code irc.IRCMessageType,
 	params ...string,
 ) {
-	nick := c.nick
+	nick := c.currentNick()
 	if nick == "" {
 		nick = "*"
 	}
@@ -369,9 +385,11 @@ func (c *Conn) sendFromServer(
 // hostmask returns the client's full hostmask
 // (nick!user@host).
 func (c *Conn) hostmask() string {
+	nick := c.currentNick()
+
 	user := c.username
 	if user == "" {
-		user = c.nick
+		user = nick
 	}
 
 	host := c.hostname
@@ -379,7 +397,7 @@ func (c *Conn) hostmask() string {
 		host = c.remoteIP
 	}
 
-	return c.nick + "!" + user + "@" + host
+	return nick + "!" + user + "@" + host
 }
 
 // handleMessage dispatches a parsed IRC message using
@@ -657,7 +675,7 @@ func (c *Conn) checkPasswordLength(pw string) bool {
 		return true
 	}
 
-	c.sendFromServer("NOTICE", c.nick,
+	c.sendFromServer("NOTICE", c.currentNick(),
 		"Password must be 8 to 72 bytes",
 	)
 

internal/ircserver/export_test.go

@@ -71,6 +71,11 @@ func (s *Server) Listener() net.Listener {
 	return s.listener
 }
 
+// Service returns the service the server's connections use.
+func (s *Server) Service() *service.Service {
+	return s.svc
+}
+
 // PingTimes returns how long the server's connections wait
 // with nothing read before they are sent a PING, and after it
 // before they are closed.

internal/ircserver/integration_test.go

@@ -1373,6 +1373,42 @@ func TestIntegrationInviteUserOnChannel(t *testing.T) {
 	)
 }
 
+// TestIntegrationInviteLine checks that an IRC listener user
+// invited by an IRC listener user, and then over the HTTP
+// API, gets an INVITE line from the inviter for the channel
+// each time.
+func TestIntegrationInviteLine(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#inv")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	alice.sendAndExpect("INVITE bob #inv", " 341 ")
+
+	got := bob.readLine()
+	want := ":alice!alice@* INVITE bob #inv"
+
+	if got != want {
+		t.Errorf("from the IRC listener: got %q, want %q", got, want)
+	}
+
+	// The HTTP API queues an INVITE with the channel as its body.
+	env.queueMessage(t, "bob", "INVITE", "carol", "bob", []string{"#inv"})
+
+	got = bob.readLine()
+	want = ":carol!carol@* INVITE bob #inv"
+
+	if got != want {
+		t.Errorf("over the HTTP API: got %q, want %q", got, want)
+	}
+}
+
 // TestIntegrationModeSecretList checks that LIST shows a +s
 // channel only to its members.
 func TestIntegrationModeSecretList(t *testing.T) {

internal/ircserver/relay.go

@@ -32,8 +32,12 @@ func (c *Conn) relayMessages(ctx context.Context) {
 		// still signals waitCh.
 		waitCh := c.brk.Wait(c.sessionID)
 
-		// Drain any available messages.
+		// Drain any available messages. The drain ignores the
-		delivered := c.drainQueue(ctx)
+		// cancel that comes when the connection ends, because a
+		// query cancelled while it runs leaves the SQLite
+		// connection marked broken, and the pool closes it. The
+		// loop still stops on ctx.
+		delivered := c.drainQueue(context.WithoutCancel(ctx))
 
 		if delivered {
 			c.brk.Remove(c.sessionID, waitCh)
@@ -92,7 +96,7 @@ func (c *Conn) drainQueue(ctx context.Context) bool {
 //
 //nolint:cyclop // dispatch table
 func (c *Conn) deliverIRCMessage(
-	_ context.Context,
+	ctx context.Context,
 	msg *db.IRCMessage,
 ) {
 	command := msg.Command
@@ -120,7 +124,7 @@ func (c *Conn) deliverIRCMessage(
 	case command == irc.CmdPart:
 		c.deliverPart(msg, text)
 	case command == irc.CmdNick:
-		c.deliverNickChange(msg, text)
+		c.deliverNickChange(ctx, msg, text)
 	case command == irc.CmdQuit:
 		c.deliverQuitMsg(msg, text)
 	case command == irc.CmdTopic:
@@ -198,15 +202,6 @@ func (c *Conn) deliverTextMessage(
 	from := msg.From
 	target := msg.To
 
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// Don't echo our own messages back.
-	if from == nick {
-		return
-	}
-
 	prefix := from
 	if !strings.Contains(prefix, "!") {
 		prefix = from + "!" + from + "@*"
@@ -219,16 +214,6 @@ func (c *Conn) deliverTextMessage(
 
 // deliverJoin sends a JOIN notification.
 func (c *Conn) deliverJoin(msg *db.IRCMessage) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// Don't echo our own JOINs (we already sent them
-	// during joinChannel).
-	if msg.From == nick {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -237,14 +222,6 @@ func (c *Conn) deliverJoin(msg *db.IRCMessage) {
 
 // deliverPart sends a PART notification.
 func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if msg.From == nick {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -257,18 +234,17 @@ func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
 	}
 }
 
-// deliverNickChange sends a NICK change notification.
+// deliverNickChange sends a NICK change notification. The
+// change may be its own session's, made from another client,
+// so the connection first takes the nick its session holds
+// now. It does not go by the line's old nick: the connection
+// may have taken that nick after another user gave it up.
 func (c *Conn) deliverNickChange(
+	ctx context.Context,
 	msg *db.IRCMessage,
 	newNick string,
 ) {
-	c.mu.Lock()
+	c.loadSessionNick(ctx)
-	nick := c.nick
-	c.mu.Unlock()
-
-	if msg.From == nick {
-		return
-	}
 
 	prefix := msg.From + "!" + msg.From + "@*"
 
@@ -280,14 +256,6 @@ func (c *Conn) deliverQuitMsg(
 	msg *db.IRCMessage,
 	text string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if msg.From == nick {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 
 	if text != "" {
@@ -304,15 +272,6 @@ func (c *Conn) deliverTopicChange(
 	msg *db.IRCMessage,
 	text string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// handleTopic already echoed our own topic change.
-	if msg.From == nick {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -324,15 +283,6 @@ func (c *Conn) deliverKickMsg(
 	msg *db.IRCMessage,
 	text string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// handleKick already echoed our own kick.
-	if msg.From == nick {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -358,16 +308,24 @@ func (c *Conn) deliverKickMsg(
 	}
 }
 
-// deliverInviteMsg sends an INVITE notification.
+// deliverInviteMsg sends an INVITE line from the inviter
+// for the channel named in text, or nothing when text names
+// no channel.
 func (c *Conn) deliverInviteMsg(
-	_ *db.IRCMessage,
+	msg *db.IRCMessage,
 	text string,
 ) {
+	if text == "" {
+		return
+	}
+
 	c.mu.Lock()
 	nick := c.nick
 	c.mu.Unlock()
 
-	c.sendFromServer("NOTICE", nick, text)
+	prefix := msg.From + "!" + msg.From + "@*"
+
+	c.send(FormatMessage(prefix, "INVITE", nick, text))
 }
 
 // deliverWallops sends a WALLOPS notification.
@@ -395,15 +353,6 @@ func (c *Conn) deliverMode(
 		return
 	}
 
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// applyChannelModes already echoed our own mode change.
-	if msg.From == nick {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 
 	params := slices.Concat(

internal/ircserver/relay_test.go

@@ -1,6 +1,7 @@
 package ircserver_test
 
 import (
+	"context"
 	"encoding/json"
 	"slices"
 	"strings"
@@ -8,6 +9,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/neoirc/internal/ircserver"
+	"sneak.berlin/go/neoirc/internal/service"
 )
 
 // queueMessage queues a message for the user with nick
@@ -39,7 +41,7 @@ func (env *testEnv) queueMessage(
 		t.Fatalf("get session of %s: %v", recipient, err)
 	}
 
-	err = env.database.EnqueueToSession(ctx, sessionID, msgID)
+	err = env.database.EnqueueToSession(ctx, sessionID, msgID, 0)
 	if err != nil {
 		t.Fatalf("enqueue: %v", err)
 	}
@@ -211,6 +213,38 @@ func TestRelayModeParameters(t *testing.T) {
 	}
 }
 
+// TestRelayInviteWithoutChannel checks that an INVITE whose
+// body names no channel sends the invited IRC listener user
+// no INVITE line.
+func TestRelayInviteWithoutChannel(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	// A nil body is stored as JSON null, which is not an array.
+	for _, body := range [][]string{nil, {}, {""}} {
+		env.queueMessage(t, "bob", "INVITE", "carol", "bob", body)
+	}
+
+	// The relay sends a user's queue in order, so this arrives
+	// after anything sent for the INVITEs above.
+	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
+		[]string{"the end"})
+
+	lines := bob.readUntil(func(l string) bool {
+		return strings.HasSuffix(l, " :the end")
+	})
+
+	for _, line := range lines {
+		if strings.Contains(line, " INVITE ") {
+			t.Errorf("got %q, want no INVITE line", line)
+		}
+	}
+}
+
 // TestRelayLineBreaks checks that a CR, LF or NUL in a stored
 // body line, key or mask never reaches an IRC listener user
 // as a line break, so no extra line arrives, and that a body
@@ -359,3 +393,305 @@ func TestRelayOwnChangeOnce(t *testing.T) {
 		})
 	}
 }
+
+// TestRelayOwnSessionOnce checks that a command a user makes
+// from one client of their session reaches each of the
+// session's clients once: an IRC listener connection and an
+// HTTP API client. The connection that sent a command gets
+// only its own echo, and none for PRIVMSG and NOTICE, which
+// IRC does not echo.
+//
+//nolint:funlen // table-driven test
+func TestRelayOwnSessionOnce(t *testing.T) {
+	t.Parallel()
+
+	hello := json.RawMessage(`["hello"]`)
+
+	for _, step := range []struct {
+		// line is the command as alice sends it on the IRC
+		// listener.
+		line string
+		// api makes the same command for her session the way
+		// the HTTP API does.
+		api func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error
+		// echoes is how many copies alice's connection gets of
+		// line when it sends line itself.
+		echoes int
+	}{
+		{"PRIVMSG #chan :hello", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			_, err := svc.SendChannelMessage(
+				ctx, sessionID, 0, "alice", "PRIVMSG", "#chan", hello, nil,
+			)
+
+			return err
+		}, 0},
+		{"NOTICE bob :hello", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			_, err := svc.SendDirectMessage(
+				ctx, sessionID, 0, "alice", "NOTICE", "bob", hello, nil,
+			)
+
+			return err
+		}, 0},
+		{"JOIN #other", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			_, err := svc.JoinChannel(ctx, sessionID, 0, "alice", "#other", "")
+
+			return err
+		}, 1},
+		{"PART #chan :bye", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.PartChannel(ctx, sessionID, 0, "alice", "#chan", "bye")
+		}, 1},
+		{"NICK alice2", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.ChangeNick(ctx, sessionID, 0, "alice", "alice2")
+		}, 1},
+		{"TOPIC #chan :new topic", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.SetTopic(
+				ctx, sessionID, 0, "alice", "#chan", "new topic",
+			)
+		}, 1},
+		{"MODE #chan +m", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			chID, err := svc.ValidateChannelOp(ctx, sessionID, "#chan")
+			if err != nil {
+				return err
+			}
+
+			err = svc.SetChannelFlag(ctx, chID, 'm', true)
+			if err != nil {
+				return err
+			}
+
+			svc.BroadcastMode(ctx, 0, "alice", "#chan", chID, "+m")
+
+			return nil
+		}, 1},
+		{"KICK #chan bob :bye", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.KickUser(
+				ctx, sessionID, 0, "alice", "#chan", "bob", "bye",
+			)
+		}, 1},
+	} {
+		command := strings.Fields(step.line)[0]
+
+		t.Run(command+" from IRC", func(t *testing.T) {
+			t.Parallel()
+
+			ircCopies, httpCopies := ownSessionCopies(t, step.line, nil)
+			if ircCopies != step.echoes || httpCopies != 1 {
+				t.Errorf("connection got %d, HTTP client got %d, want %d and 1",
+					ircCopies, httpCopies, step.echoes)
+			}
+		})
+
+		t.Run(command+" from the HTTP API", func(t *testing.T) {
+			t.Parallel()
+
+			ircCopies, httpCopies := ownSessionCopies(t, step.line, step.api)
+			if ircCopies != 1 || httpCopies != 1 {
+				t.Errorf("connection got %d, HTTP client got %d, want 1 and 1",
+					ircCopies, httpCopies)
+			}
+		})
+	}
+}
+
+// ownSessionCopies sets up alice with aliceWithHTTPClient. It
+// makes the command line from her connection, or with api from
+// the HTTP API client when api is not nil, and returns how many
+// copies of it her connection and her HTTP API client got.
+func ownSessionCopies(
+	t *testing.T,
+	line string,
+	api func(ctx context.Context, svc *service.Service, sessionID int64) error,
+) (int, int) {
+	t.Helper()
+
+	ctx := t.Context()
+	env := newTestEnv(t)
+	alice, _, sessionID, httpClientID := aliceWithHTTPClient(t, env)
+
+	var lines []string
+
+	if api == nil {
+		alice.send(line)
+
+		// Her echo comes before the reply to her next command.
+		lines = alice.sendAndExpect("PING :done", "PONG")
+	} else {
+		err := api(ctx, env.srv.Service(), sessionID)
+		if err != nil {
+			t.Fatalf("%s over the HTTP API: %v", line, err)
+		}
+	}
+
+	msgs, _, err := env.database.PollMessages(ctx, httpClientID, 0, 0)
+	if err != nil {
+		t.Fatalf("poll the HTTP API client: %v", err)
+	}
+
+	httpCopies := 0
+
+	for _, msg := range msgs {
+		if msg.Command == strings.Fields(line)[0] {
+			httpCopies++
+		}
+	}
+
+	// The relay sends a queue in order, so this arrives after any
+	// copy. It is queued by session, as NICK changes her nick.
+	endID, _, err := env.database.InsertMessage(
+		ctx, "PRIVMSG", "dave", "alice", 0, 0,
+		nil, json.RawMessage(`["the end"]`), nil,
+	)
+	if err != nil {
+		t.Fatalf("insert message: %v", err)
+	}
+
+	err = env.database.EnqueueToSession(ctx, sessionID, endID, 0)
+	if err != nil {
+		t.Fatalf("enqueue: %v", err)
+	}
+
+	env.brk.Notify(sessionID)
+
+	lines = append(lines, alice.readUntil(func(l string) bool {
+		return strings.HasSuffix(l, " :the end")
+	})...)
+
+	// A copy starts with the command and its first parameter.
+	start := " " + strings.Join(strings.Fields(line)[:2], " ")
+	ircCopies := strings.Count(strings.Join(lines, "\n"), start)
+
+	return ircCopies, httpCopies
+}
+
+// aliceWithHTTPClient connects alice to the IRC listener and
+// has her join #chan, which bob is on too, then adds an HTTP API
+// client to her session with the password her connection set,
+// as POST /api/v1/login does. It returns her connection, bob's
+// connection, her session and her HTTP API client.
+func aliceWithHTTPClient(
+	t *testing.T, env *testEnv,
+) (*testClient, *testClient, int64, int64) {
+	t.Helper()
+
+	const password = "alicepass"
+
+	alice := env.dial(t)
+	alice.send("PASS " + password)
+	alice.register("alice")
+	// Registration stores the password before the JOIN runs.
+	alice.joinAndDrain("#chan")
+
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.joinAndDrain("#chan")
+
+	sessionID, httpClientID, _, err := env.database.LoginUser(
+		t.Context(), "alice", password, "127.0.0.1", "localhost",
+	)
+	if err != nil {
+		t.Fatalf("log in as alice: %v", err)
+	}
+
+	return alice, bob, sessionID, httpClientID
+}
+
+// TestRelayNickChangeFromHTTPAPI checks that once alice's nick
+// is changed from her HTTP API client, her IRC listener
+// connection uses the new nick: what she then sends from it
+// reaches bob under the new nick.
+func TestRelayNickChangeFromHTTPAPI(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+	alice, bob, sessionID, _ := aliceWithHTTPClient(t, env)
+
+	bob.joinAndDrain("#other")
+
+	// As the HTTP API does.
+	err := env.srv.Service().ChangeNick(
+		t.Context(), sessionID, 0, "alice", "alice2",
+	)
+	if err != nil {
+		t.Fatalf("change nick over the HTTP API: %v", err)
+	}
+
+	// Her connection has taken the new nick once it has sent her
+	// the change.
+	const change = ":alice!alice@* NICK alice2"
+
+	alice.readUntil(func(l string) bool { return l == change })
+	bob.readUntil(func(l string) bool { return l == change })
+
+	for _, step := range []struct {
+		line, want string
+	}{
+		{"PRIVMSG #chan :hi there", ":alice2!alice2@* PRIVMSG #chan :hi there"},
+		{"JOIN #other", ":alice2!alice2@* JOIN #other"},
+		{"NICK alice3", ":alice2!alice2@* NICK alice3"},
+	} {
+		alice.send(step.line)
+
+		got := bob.readLine()
+		if got != step.want {
+			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
+		}
+	}
+}
+
+// TestRelayNickChangeKeepsTakenNick checks that an IRC
+// listener connection which takes a nick another user has
+// given up keeps it when that user's change reaches it
+// afterwards: what it then sends goes out under the nick its
+// session holds.
+func TestRelayNickChangeKeepsTakenNick(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.sendAndExpect("NICK bob2", " NICK bob2")
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.sendAndExpect("NICK bob", " NICK bob")
+	alice.joinAndDrain("#chan")
+
+	bob.joinAndDrain("#chan")
+
+	// Bob's change reaches alice only now, as it does when she
+	// takes his old nick before her connection has passed the
+	// change on. She holds bob now, so it is queued to bob.
+	env.queueMessage(t, "bob", "NICK", "bob", "", []string{"bob2"})
+
+	alice.readUntil(func(l string) bool {
+		return l == ":bob!bob@* NICK bob2"
+	})
+
+	alice.send("PRIVMSG #chan :hi there")
+
+	const want = ":bob!bob@* PRIVMSG #chan :hi there"
+
+	got := bob.readLine()
+	if got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}

internal/ircserver/server_test.go

@@ -3,7 +3,6 @@ package ircserver_test
 import (
 	"bufio"
 	"context"
-	"crypto/rand"
 	"database/sql"
 	"errors"
 	"fmt"
@@ -20,6 +19,7 @@ import (
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/ircserver"
 	"sneak.berlin/go/neoirc/internal/logger"
@@ -107,14 +107,7 @@ func newTestEnvWithResolver(
 ) *testEnv {
 	t.Helper()
 
-	// A random name, so that no other test environment, not
+	conn, err := sql.Open("sqlite", dbtest.NewURL(t))
-	// even an earlier run of the same test, can share it.
-	dsn := fmt.Sprintf(
-		"file:%s?mode=memory&cache=shared",
-		rand.Text(),
-	)
-
-	conn, err := sql.Open("sqlite", dsn)
 	if err != nil {
 		t.Fatalf("open db: %v", err)
 	}
@@ -144,20 +137,6 @@ func newTestEnvWithResolver(
 
 	brk := broker.New()
 
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	addr := listener.Addr().String()
-
-	err = listener.Close()
-	if err != nil {
-		t.Fatalf("close listener: %v", err)
-	}
-
 	log := slog.New(slog.NewTextHandler(
 		os.Stderr,
 		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
@@ -167,7 +146,9 @@ func newTestEnvWithResolver(
 		log, cfg, database, brk, interval, deadline, resolve,
 	)
 
-	err = srv.Start(addr)
+	// Port 0 makes the system pick a free port. dial reads it
+	// back from the server's listener.
+	err = srv.Start("127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("start irc server: %v", err)
 	}
@@ -645,8 +626,6 @@ func TestNewPingTimes(t *testing.T) {
 func TestIdleCleanupKeepsActiveUser(t *testing.T) {
 	t.Parallel()
 
-	const idleTimeout = 500 * time.Millisecond
-
 	env := newTestEnv(t)
 
 	active := env.dial(t)
@@ -655,13 +634,17 @@ func TestIdleCleanupKeepsActiveUser(t *testing.T) {
 	idle := env.dial(t)
 	idle.register("idle")
 
-	time.Sleep(idleTimeout)
+	// Both users were last seen before cutoff, and only active
+	// sends a command after it, so the result does not depend
+	// on how long the PONG takes to arrive.
+	cutoff := time.Now()
+
 	active.sendAndExpect("PING :still here", "PONG")
 
 	// The idle cleanup in internal/handlers removes exactly
 	// the users this returns.
 	stale, err := env.database.GetStaleOrphanSessions(
-		t.Context(), time.Now().Add(-idleTimeout),
+		t.Context(), cutoff,
 	)
 	if err != nil {
 		t.Fatalf("get stale sessions: %v", err)

internal/server/export_test.go

@@ -15,6 +15,12 @@ func NewTestSPAServer() *Server {
 	return srv
 }
 
+// Listener returns the listener the start hook bound for the
+// HTTP server.
+func (srv *Server) Listener() net.Listener {
+	return srv.listener
+}
+
 // ServeUntilShutdown runs serveUntilShutdown, which serves the
 // HTTP server on listener, and returns when it does.
 func (srv *Server) ServeUntilShutdown(listener net.Listener) {

internal/server/server.go

@@ -50,6 +50,7 @@ type Server struct {
 	sentryEnabled bool
 	log           *slog.Logger
 	httpServer    *http.Server
+	listener      net.Listener
 	router        *chi.Mux
 	params        Params
 	mw            *middleware.Middleware
@@ -179,6 +180,8 @@ func (srv *Server) startHTTP(ctx context.Context) error {
 		return fmt.Errorf("http listen: %w", err)
 	}
 
+	srv.listener = listener
+
 	srv.httpServer = &http.Server{ //nolint:exhaustruct // optional fields
 		Addr:           listenAddr,
 		ReadTimeout:    httpReadTimeout,

internal/server/server_test.go

@@ -5,7 +5,6 @@
 package server_test
 
 import (
-	"crypto/rand"
 	"fmt"
 	"net"
 	"net/http"
@@ -19,6 +18,7 @@ import (
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/handlers"
 	"sneak.berlin/go/neoirc/internal/healthcheck"
@@ -45,10 +45,9 @@ const (
 // for a long poll the HTTP server is serving to finish, and
 // that the poll gets its response.
 func TestStopWaitsForRequestInProgress(t *testing.T) {
-	port := freePort(t)
+	var srv *server.Server
-	addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(port))
 
-	app, brk, database := startApp(t, port)
+	app, brk, database := startApp(t, fx.Populate(&srv))
 
 	sessionID, _, token, err := database.CreateSession(
 		t.Context(), "poller", "poller", "", "",
@@ -57,9 +56,12 @@ func TestStopWaitsForRequestInProgress(t *testing.T) {
 		t.Fatalf("create session: %v", err)
 	}
 
-	waitUntil(t, "the HTTP server to listen", func() bool {
+	tcpAddr, ok := srv.Listener().Addr().(*net.TCPAddr)
-		return canConnect(t, addr)
+	if !ok {
-	})
+		t.Fatalf("listener address %v is not TCP", srv.Listener().Addr())
+	}
+
+	addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(tcpAddr.Port))
 
 	statuses := make(chan int, 1)
 
@@ -145,7 +147,7 @@ func TestStartFailsWhenHTTPPortIsTaken(t *testing.T) {
 func TestServeFailureStopsApp(t *testing.T) {
 	var srv *server.Server
 
-	app, _, _ := startApp(t, freePort(t), fx.Populate(&srv))
+	app, _, _ := startApp(t, fx.Populate(&srv))
 
 	shutdowns := app.Wait()
 
@@ -168,7 +170,7 @@ func TestServeFailureStopsApp(t *testing.T) {
 func TestServeAfterStopDoesNotStopApp(t *testing.T) {
 	var srv *server.Server
 
-	app, _, _ := startApp(t, freePort(t), fx.Populate(&srv))
+	app, _, _ := startApp(t, fx.Populate(&srv))
 
 	shutdowns := app.Wait()
 
@@ -186,16 +188,15 @@ func TestServeAfterStopDoesNotStopApp(t *testing.T) {
 	}
 }
 
-// startApp starts the app newApp builds, with the HTTP server
+// startApp starts the app newApp builds, with the HTTP port
-// listening on port.
+// set to 0, so the system gives the server a free port.
 func startApp(
 	t *testing.T,
-	port int,
 	options ...fx.Option,
 ) (*fxtest.App, *broker.Broker, *db.Database) {
 	t.Helper()
 
-	app, brk, database := newApp(t, port, options...)
+	app, brk, database := newApp(t, 0, options...)
 
 	app.RequireStart()
 
@@ -241,10 +242,7 @@ func newApp(
 			stats.New,
 		),
 		fx.Decorate(func(cfg *config.Config) *config.Config {
-			// A random name, so that no other test can share it.
+			cfg.DBURL = dbtest.NewURL(t)
-			cfg.DBURL = fmt.Sprintf(
-				"file:%s?mode=memory&cache=shared", rand.Text(),
-			)
 			cfg.Port = port
 
 			return cfg
@@ -257,21 +255,6 @@ func newApp(
 	return app, brk, database
 }
 
-// freePort returns a TCP port that nothing was listening on a
-// moment ago.
-func freePort(t *testing.T) int {
-	t.Helper()
-
-	listener := closedListener(t)
-
-	tcpAddr, ok := listener.Addr().(*net.TCPAddr)
-	if !ok {
-		t.Fatalf("listener address %v is not TCP", listener.Addr())
-	}
-
-	return tcpAddr.Port
-}
-
 // closedListener returns a TCP listener that has already been
 // closed, so that accepting a connection on it fails.
 func closedListener(t *testing.T) net.Listener {
@@ -294,22 +277,6 @@ func closedListener(t *testing.T) net.Listener {
 	return listener
 }
 
-// canConnect reports whether addr accepts a TCP connection.
-func canConnect(t *testing.T, addr string) bool {
-	t.Helper()
-
-	var dialer net.Dialer
-
-	conn, err := dialer.DialContext(t.Context(), "tcp", addr)
-	if err != nil {
-		return false
-	}
-
-	_ = conn.Close()
-
-	return true
-}
-
 // waitUntil calls done every checkStep until it returns true,
 // and fails the test if it does not within testTimeout.
 func waitUntil(t *testing.T, what string, done func() bool) {

internal/service/service.go

@@ -312,7 +312,7 @@ func (s *Service) SendWallops(
 
 	_, _, err = s.FanOut(
 		ctx, irc.CmdWallops, nick, "*", 0, 0,
-		nil, body, nil, recipients,
+		nil, body, nil, recipients, 0,
 	)
 	if err != nil {
 		return fmt.Errorf("wallops: %w", err)
@@ -347,12 +347,19 @@ type DirectMsgResult struct {
 // session IDs, notifying each via the broker. toSessionID
 // and toChannelID are the recipient InsertMessage records
 // for history, 0 when there is none.
+//
+// skipClientID is the client whose queue the message is
+// not added to: the IRC listener connection that sent the
+// command, which has already shown it to its user. The HTTP
+// API passes 0, as its clients see their own commands
+// through their queues.
 func (s *Service) FanOut(
 	ctx context.Context,
 	command, from, to string,
 	toSessionID, toChannelID int64,
 	params, body, meta json.RawMessage,
 	sessionIDs []int64,
+	skipClientID int64,
 ) (int64, string, error) {
 	dbID, msgUUID, err := s.db.InsertMessage(
 		ctx, command, from, to,
@@ -363,58 +370,40 @@ func (s *Service) FanOut(
 	}
 
 	for _, sid := range sessionIDs {
-		_ = s.db.EnqueueToSession(ctx, sid, dbID)
+		_ = s.db.EnqueueToSession(ctx, sid, dbID, skipClientID)
 		s.broker.Notify(sid)
 	}
 
 	return dbID, msgUUID, nil
 }
 
-// excludeSession returns a copy of ids without the given
-// session.
-func excludeSession(
-	ids []int64,
-	exclude int64,
-) []int64 {
-	out := make([]int64, 0, len(ids))
-
-	for _, id := range ids {
-		if id != exclude {
-			out = append(out, id)
-		}
-	}
-
-	return out
-}
-
 // SendChannelMessage checks membership, bans and
 // moderation, then the hashcash stamp of a PRIVMSG to a +H
-// channel, then fans out a message to all channel members
+// channel, then fans out a message to all channel members,
-// except the sender. The stamp is checked after the other
+// the sender's session included, skipping client
-// checks so that a message they refuse does not spend it.
+// skipClientID as FanOut does. The stamp is checked after
-// Returns the database row ID, message UUID, and any error.
+// the other checks so that a message they refuse does not
-// The dbID lets callers enqueue the same message to the
+// spend it. Returns the message UUID and any error.
-// sender when echo is needed (HTTP transport).
 func (s *Service) SendChannelMessage(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	nick, command, channel string,
 	body, meta json.RawMessage,
-) (int64, string, error) {
+) (string, error) {
 	noSuchChannel := &IRCError{
 		irc.ErrNoSuchChannel, []string{channel}, msgNoSuchChannel,
 	}
 
 	chID, err := s.db.GetChannelByName(ctx, channel)
 	if err != nil {
-		return 0, "", noSuchChannel
+		return "", noSuchChannel
 	}
 
 	isMember, _ := s.db.IsChannelMember(
 		ctx, chID, sessionID,
 	)
 	if !isMember {
-		return 0, "", &IRCError{
+		return "", &IRCError{
 			irc.ErrCannotSendToChan,
 			[]string{channel},
 			"Cannot send to channel",
@@ -426,7 +415,7 @@ func (s *Service) SendChannelMessage(
 		ctx, chID, sessionID,
 	)
 	if banErr == nil && isBanned {
-		return 0, "", &IRCError{
+		return "", &IRCError{
 			irc.ErrCannotSendToChan,
 			[]string{channel},
 			"Cannot send to channel (+b)",
@@ -443,7 +432,7 @@ func (s *Service) SendChannelMessage(
 		)
 
 		if !isOp && !isVoiced {
-			return 0, "", &IRCError{
+			return "", &IRCError{
 				irc.ErrCannotSendToChan,
 				[]string{channel},
 				"Cannot send to channel (+m)",
@@ -456,35 +445,35 @@ func (s *Service) SendChannelMessage(
 			ctx, chID, channel, body, meta,
 		)
 		if err != nil {
-			return 0, "", err
+			return "", err
 		}
 	}
 
 	memberIDs, _ := s.db.GetChannelMemberIDs(ctx, chID)
-	recipients := excludeSession(memberIDs, sessionID)
 
-	dbID, uuid, fanErr := s.FanOut(
+	_, uuid, fanErr := s.FanOut(
 		ctx, command, nick, channel, 0, chID,
-		nil, body, meta, recipients,
+		nil, body, meta, memberIDs, skipClientID,
 	)
 	// The channel was deleted after the lookup above.
 	if db.IsForeignKeyConstraintError(fanErr) {
-		return 0, "", noSuchChannel
+		return "", noSuchChannel
 	}
 
 	if fanErr != nil {
-		return 0, "", fanErr
+		return "", fanErr
 	}
 
-	return dbID, uuid, nil
+	return uuid, nil
 }
 
 // SendDirectMessage validates the target and sends a
-// direct message, returning the message UUID and any away
+// direct message to the target and the sender's session,
-// message set on the target.
+// skipping client skipClientID as FanOut does, and returns
+// the message UUID and any away message set on the target.
 func (s *Service) SendDirectMessage(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	nick, command, target string,
 	body, meta json.RawMessage,
 ) (*DirectMsgResult, error) {
@@ -506,7 +495,7 @@ func (s *Service) SendDirectMessage(
 
 	_, uuid, fanErr := s.FanOut(
 		ctx, command, nick, target, targetSID, 0,
-		nil, body, meta, recipients,
+		nil, body, meta, recipients, skipClientID,
 	)
 	// The target's session was deleted after the lookup above.
 	if db.IsForeignKeyConstraintError(fanErr) {
@@ -522,11 +511,12 @@ func (s *Service) SendDirectMessage(
 
 // JoinChannel creates or joins a channel, making the
 // first joiner the operator. Fans out the JOIN to all
-// channel members. A channel name that validChannelRe
+// channel members, skipping client skipClientID as FanOut
-// does not match gets ERR_NOSUCHCHANNEL.
+// does. A channel name that validChannelRe does not match
+// gets ERR_NOSUCHCHANNEL.
 func (s *Service) JoinChannel(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	nick, channel, suppliedKey string,
 ) (*JoinResult, error) {
 	if !validChannelRe.MatchString(channel) {
@@ -549,7 +539,7 @@ func (s *Service) JoinChannel(
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
 		ctx, irc.CmdJoin, nick, channel, 0, chID,
-		nil, body, nil, memberIDs,
+		nil, body, nil, memberIDs, skipClientID,
 	)
 
 	return &JoinResult{
@@ -558,12 +548,12 @@ func (s *Service) JoinChannel(
 	}, nil
 }
 
-// PartChannel validates membership, broadcasts PART to
+// PartChannel validates membership, broadcasts PART to all
-// remaining members, removes the user, and cleans up empty
+// channel members, skipping client skipClientID as FanOut
-// channels.
+// does, removes the user, and cleans up empty channels.
 func (s *Service) PartChannel(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	nick, channel, reason string,
 ) error {
 	chID, err := s.db.GetChannelByName(ctx, channel)
@@ -587,12 +577,11 @@ func (s *Service) PartChannel(
 	}
 
 	memberIDs, _ := s.db.GetChannelMemberIDs(ctx, chID)
-	recipients := excludeSession(memberIDs, sessionID)
 	body, _ := json.Marshal([]string{reason}) //nolint:errchkjson
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
 		ctx, irc.CmdPart, nick, channel, 0, chID,
-		nil, body, nil, recipients,
+		nil, body, nil, memberIDs, skipClientID,
 	)
 
 	s.db.PartChannelAndDeleteIfEmpty(ctx, chID, sessionID) //nolint:errcheck,gosec
@@ -601,10 +590,11 @@ func (s *Service) PartChannel(
 }
 
 // SetTopic validates membership and topic-lock, sets the
-// topic, and broadcasts the change.
+// topic, and broadcasts the change to all channel members,
+// skipping client skipClientID as FanOut does.
 func (s *Service) SetTopic(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	nick, channel, topic string,
 ) error {
 	chID, err := s.db.GetChannelByName(ctx, channel)
@@ -653,18 +643,19 @@ func (s *Service) SetTopic(
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
 		ctx, irc.CmdTopic, nick, channel, 0, chID,
-		nil, body, nil, memberIDs,
+		nil, body, nil, memberIDs, skipClientID,
 	)
 
 	return nil
 }
 
 // KickUser validates operator status and target
-// membership, broadcasts the KICK, removes the target,
+// membership, broadcasts the KICK to all channel members,
-// and cleans up empty channels.
+// skipping client skipClientID as FanOut does, removes the
+// target, and cleans up empty channels.
 func (s *Service) KickUser(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	nick, channel, targetNick, reason string,
 ) error {
 	chID, err := s.db.GetChannelByName(ctx, channel)
@@ -717,7 +708,7 @@ func (s *Service) KickUser(
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
 		ctx, irc.CmdKick, nick, channel, 0, chID,
-		params, body, nil, memberIDs,
+		params, body, nil, memberIDs, skipClientID,
 	)
 
 	s.db.PartChannelAndDeleteIfEmpty(ctx, chID, targetSID) //nolint:errcheck,gosec
@@ -798,10 +789,11 @@ func (s *Service) InviteUser(
 }
 
 // ChangeNick changes a user's nickname and broadcasts the
-// change to all users sharing channels.
+// change to the user's own session and all users sharing
+// channels, skipping client skipClientID as FanOut does.
 func (s *Service) ChangeNick(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	oldNick, newNick string,
 ) error {
 	err := s.db.ChangeNick(ctx, sessionID, newNick)
@@ -822,7 +814,9 @@ func (s *Service) ChangeNick(
 		}
 	}
 
-	s.broadcastNickChange(ctx, sessionID, oldNick, newNick)
+	s.broadcastNickChange(
+		ctx, sessionID, skipClientID, oldNick, newNick,
+	)
 
 	return nil
 }
@@ -1042,9 +1036,10 @@ func (s *Service) SetChannelFlag(
 }
 
 // BroadcastMode fans out a MODE change to all channel
-// members.
+// members, skipping client skipClientID as FanOut does.
 func (s *Service) BroadcastMode(
 	ctx context.Context,
+	skipClientID int64,
 	nick, channel string,
 	chID int64,
 	modeText string,
@@ -1054,7 +1049,7 @@ func (s *Service) BroadcastMode(
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
 		ctx, irc.CmdMode, nick, channel, 0, chID,
-		nil, body, nil, memberIDs,
+		nil, body, nil, memberIDs, skipClientID,
 	)
 }
 
@@ -1306,11 +1301,12 @@ func (s *Service) checkChannelHashcash(
 	return nil
 }
 
-// broadcastNickChange notifies channel peers of a nick
+// broadcastNickChange notifies the user's own session,
+// except client skipClientID, and channel peers of a nick
 // change.
 func (s *Service) broadcastNickChange(
 	ctx context.Context,
-	sessionID int64,
+	sessionID, skipClientID int64,
 	oldNick, newNick string,
 ) {
 	channels, err := s.db.GetSessionChannels(
@@ -1332,7 +1328,7 @@ func (s *Service) broadcastNickChange(
 	}
 
 	// Notify the user themselves (for multi-client sync).
-	_ = s.db.EnqueueToSession(ctx, sessionID, dbID)
+	_ = s.db.EnqueueToSession(ctx, sessionID, dbID, skipClientID)
 	s.broker.Notify(sessionID)
 	notified[sessionID] = true
 
@@ -1351,7 +1347,7 @@ func (s *Service) broadcastNickChange(
 
 			notified[mid] = true
 
-			_ = s.db.EnqueueToSession(ctx, mid, dbID)
+			_ = s.db.EnqueueToSession(ctx, mid, dbID, 0)
 			s.broker.Notify(mid)
 		}
 	}

internal/service/service_test.go

@@ -6,7 +6,6 @@ package service_test
 
 import (
 	"context"
-	"crypto/rand"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -23,6 +22,7 @@ import (
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/hashcash"
 	"sneak.berlin/go/neoirc/internal/logger"
@@ -46,13 +46,7 @@ type testEnv struct {
 func newTestEnv(t *testing.T) *testEnv {
 	t.Helper()
 
-	// A random name, so that no other test can share it, not
+	dbURL := dbtest.NewURL(t)
-	// even one that has finished but still holds its database
-	// open.
-	dbURL := fmt.Sprintf(
-		"file:%s?mode=memory&cache=shared",
-		rand.Text(),
-	)
 
 	var (
 		database *db.Database
@@ -168,7 +162,7 @@ func TestFanOut(t *testing.T) {
 	dbID, uuid, err := env.svc.FanOut(
 		ctx, irc.CmdPrivmsg, "alice", "#test", 0, 0,
 		nil, body, nil,
-		[]int64{sid1, sid2},
+		[]int64{sid1, sid2}, 0,
 	)
 	if err != nil {
 		t.Fatalf("FanOut: %v", err)
@@ -190,7 +184,7 @@ func TestJoinChannel(t *testing.T) {
 	sid := createSession(ctx, t, env.db, "alice")
 
 	result, err := env.svc.JoinChannel(
-		ctx, sid, "alice", "#general", "",
+		ctx, sid, 0, "alice", "#general", "",
 	)
 	if err != nil {
 		t.Fatalf("JoinChannel: %v", err)
@@ -208,7 +202,7 @@ func TestJoinChannel(t *testing.T) {
 	sid2 := createSession(ctx, t, env.db, "bob")
 
 	result2, err := env.svc.JoinChannel(
-		ctx, sid2, "bob", "#general", "",
+		ctx, sid2, 0, "bob", "#general", "",
 	)
 	if err != nil {
 		t.Fatalf("JoinChannel bob: %v", err)
@@ -230,14 +224,14 @@ func TestPartChannel(t *testing.T) {
 	sid := createSession(ctx, t, env.db, "alice")
 
 	_, err := env.svc.JoinChannel(
-		ctx, sid, "alice", "#general", "",
+		ctx, sid, 0, "alice", "#general", "",
 	)
 	if err != nil {
 		t.Fatalf("JoinChannel: %v", err)
 	}
 
 	err = env.svc.PartChannel(
-		ctx, sid, "alice", "#general", "bye",
+		ctx, sid, 0, "alice", "#general", "bye",
 	)
 	if err != nil {
 		t.Fatalf("PartChannel: %v", err)
@@ -245,7 +239,7 @@ func TestPartChannel(t *testing.T) {
 
 	// Parting a non-existent channel returns error.
 	err = env.svc.PartChannel(
-		ctx, sid, "alice", "#nonexistent", "",
+		ctx, sid, 0, "alice", "#nonexistent", "",
 	)
 	if err == nil {
 		t.Error("expected error for non-existent channel")
@@ -309,7 +303,7 @@ func joinConcurrently(
 
 		joins[i] = func() error {
 			result, err := env.svc.JoinChannel(
-				ctx, sessionID, nick, channel, "",
+				ctx, sessionID, 0, nick, channel, "",
 			)
 			results[i] = result
 
@@ -335,7 +329,7 @@ func TestConcurrentJoinsRespectUserLimit(t *testing.T) {
 		opSID := createSession(ctx, t, env.db, opNick)
 
 		created, err := env.svc.JoinChannel(
-			ctx, opSID, opNick, channel, "",
+			ctx, opSID, 0, opNick, channel, "",
 		)
 		if err != nil {
 			t.Fatalf("join %s: %v", opNick, err)
@@ -448,7 +442,7 @@ func TestJoinConcurrentWithLastPart(t *testing.T) {
 		joinerSID := createSession(ctx, t, env.db, joinerNick)
 
 		_, err := env.svc.JoinChannel(
-			ctx, leaverSID, leaverNick, channel, "",
+			ctx, leaverSID, 0, leaverNick, channel, "",
 		)
 		if err != nil {
 			t.Fatalf("join %s: %v", leaverNick, err)
@@ -457,12 +451,12 @@ func TestJoinConcurrentWithLastPart(t *testing.T) {
 		errs := runConcurrently(
 			func() error {
 				return env.svc.PartChannel(
-					ctx, leaverSID, leaverNick, channel, "",
+					ctx, leaverSID, 0, leaverNick, channel, "",
 				)
 			},
 			func() error {
 				_, joinErr := env.svc.JoinChannel(
-					ctx, joinerSID, joinerNick, channel, "",
+					ctx, joinerSID, 0, joinerNick, channel, "",
 				)
 
 				return joinErr
@@ -513,7 +507,7 @@ func TestJoinConcurrentWithLastQuit(t *testing.T) {
 		joinerSID := createSession(ctx, t, env.db, joinerNick)
 
 		created, err := env.svc.JoinChannel(
-			ctx, leaverSID, leaverNick, channel, "",
+			ctx, leaverSID, 0, leaverNick, channel, "",
 		)
 		if err != nil {
 			t.Fatalf("join %s: %v", leaverNick, err)
@@ -545,7 +539,7 @@ func TestJoinConcurrentWithLastQuit(t *testing.T) {
 					)
 
 					joined, joinErr = env.svc.JoinChannel(
-						ctx, joinerSID, joinerNick, channel, "",
+						ctx, joinerSID, 0, joinerNick, channel, "",
 					)
 					if !errors.As(joinErr, &ircErr) ||
 						ircErr.Code != irc.ErrBadChannelKey {
@@ -592,7 +586,7 @@ func TestQuitQueuedAheadOfNewNickHoldersJoin(t *testing.T) {
 		quitterSID := createSession(ctx, t, env.db, nick)
 
 		for _, channel := range []string{crowd, shared} {
-			_, err := env.svc.JoinChannel(ctx, quitterSID, nick, channel, "")
+			_, err := env.svc.JoinChannel(ctx, quitterSID, 0, nick, channel, "")
 			if err != nil {
 				t.Fatalf("join %s: %v", channel, err)
 			}
@@ -602,7 +596,7 @@ func TestQuitQueuedAheadOfNewNickHoldersJoin(t *testing.T) {
 			memberNick := fmt.Sprintf("crowd%dx%d", trial, member)
 			memberSID := createSession(ctx, t, env.db, memberNick)
 
-			_, err := env.svc.JoinChannel(ctx, memberSID, memberNick, crowd, "")
+			_, err := env.svc.JoinChannel(ctx, memberSID, 0, memberNick, crowd, "")
 			if err != nil {
 				t.Fatalf("join %s: %v", memberNick, err)
 			}
@@ -617,7 +611,7 @@ func TestQuitQueuedAheadOfNewNickHoldersJoin(t *testing.T) {
 			t.Fatalf("create session %s: %v", watcherNick, err)
 		}
 
-		_, err = env.svc.JoinChannel(ctx, watcherSID, watcherNick, shared, "")
+		_, err = env.svc.JoinChannel(ctx, watcherSID, 0, watcherNick, shared, "")
 		if err != nil {
 			t.Fatalf("join %s: %v", watcherNick, err)
 		}
@@ -678,7 +672,7 @@ func takeNickAndJoin(
 			return err
 		}
 
-		_, err = env.svc.JoinChannel(ctx, sessionID, nick, channel, "")
+		_, err = env.svc.JoinChannel(ctx, sessionID, 0, nick, channel, "")
 
 		return err
 	}
@@ -710,7 +704,7 @@ func TestJoinUsesUpInvite(t *testing.T) {
 	opSID := createSession(ctx, t, env.db, "op")
 	guestSID := createSession(ctx, t, env.db, "guest")
 
-	created, err := env.svc.JoinChannel(ctx, opSID, "op", channel, "")
+	created, err := env.svc.JoinChannel(ctx, opSID, 0, "op", channel, "")
 	if err != nil {
 		t.Fatalf("join op: %v", err)
 	}
@@ -725,17 +719,17 @@ func TestJoinUsesUpInvite(t *testing.T) {
 		t.Fatalf("invite guest: %v", err)
 	}
 
-	_, err = env.svc.JoinChannel(ctx, guestSID, "guest", channel, "")
+	_, err = env.svc.JoinChannel(ctx, guestSID, 0, "guest", channel, "")
 	if err != nil {
 		t.Fatalf("invited join: %v", err)
 	}
 
-	err = env.svc.PartChannel(ctx, guestSID, "guest", channel, "")
+	err = env.svc.PartChannel(ctx, guestSID, 0, "guest", channel, "")
 	if err != nil {
 		t.Fatalf("part guest: %v", err)
 	}
 
-	_, err = env.svc.JoinChannel(ctx, guestSID, "guest", channel, "")
+	_, err = env.svc.JoinChannel(ctx, guestSID, 0, "guest", channel, "")
 
 	var ircErr *service.IRCError
 	if !errors.As(err, &ircErr) || ircErr.Code != irc.ErrInviteOnlyChan {
@@ -754,7 +748,7 @@ func TestJoinRefusedByHostmaskBan(t *testing.T) {
 
 	opSID := createSession(ctx, t, env.db, "op")
 
-	created, err := env.svc.JoinChannel(ctx, opSID, "op", channel, "")
+	created, err := env.svc.JoinChannel(ctx, opSID, 0, "op", channel, "")
 	if err != nil {
 		t.Fatalf("join op: %v", err)
 	}
@@ -773,7 +767,7 @@ func TestJoinRefusedByHostmaskBan(t *testing.T) {
 		t.Fatalf("create session guest: %v", err)
 	}
 
-	_, err = env.svc.JoinChannel(ctx, guestSID, "guest", channel, "")
+	_, err = env.svc.JoinChannel(ctx, guestSID, 0, "guest", channel, "")
 
 	var ircErr *service.IRCError
 	if !errors.As(err, &ircErr) || ircErr.Code != irc.ErrBannedFromChan {
@@ -793,17 +787,17 @@ func TestPartDeletesChannelOnlyWhenEmpty(t *testing.T) {
 	aliceSID := createSession(ctx, t, env.db, "alice")
 	bobSID := createSession(ctx, t, env.db, "bob")
 
-	_, err := env.svc.JoinChannel(ctx, aliceSID, "alice", channel, "")
+	_, err := env.svc.JoinChannel(ctx, aliceSID, 0, "alice", channel, "")
 	if err != nil {
 		t.Fatalf("join alice: %v", err)
 	}
 
-	_, err = env.svc.JoinChannel(ctx, bobSID, "bob", channel, "")
+	_, err = env.svc.JoinChannel(ctx, bobSID, 0, "bob", channel, "")
 	if err != nil {
 		t.Fatalf("join bob: %v", err)
 	}
 
-	err = env.svc.PartChannel(ctx, aliceSID, "alice", channel, "")
+	err = env.svc.PartChannel(ctx, aliceSID, 0, "alice", channel, "")
 	if err != nil {
 		t.Fatalf("part alice: %v", err)
 	}
@@ -818,7 +812,7 @@ func TestPartDeletesChannelOnlyWhenEmpty(t *testing.T) {
 		t.Fatal("bob is not on the channel after alice parted")
 	}
 
-	err = env.svc.PartChannel(ctx, bobSID, "bob", channel, "")
+	err = env.svc.PartChannel(ctx, bobSID, 0, "bob", channel, "")
 	if err != nil {
 		t.Fatalf("part bob: %v", err)
 	}
@@ -839,12 +833,12 @@ func TestKickOfLastMemberDeletesChannel(t *testing.T) {
 
 	sid := createSession(ctx, t, env.db, "alice")
 
-	_, err := env.svc.JoinChannel(ctx, sid, "alice", channel, "")
+	_, err := env.svc.JoinChannel(ctx, sid, 0, "alice", channel, "")
 	if err != nil {
 		t.Fatalf("join alice: %v", err)
 	}
 
-	err = env.svc.KickUser(ctx, sid, "alice", channel, "alice", "")
+	err = env.svc.KickUser(ctx, sid, 0, "alice", channel, "alice", "")
 	if err != nil {
 		t.Fatalf("kick alice: %v", err)
 	}
@@ -863,14 +857,14 @@ func TestSendChannelMessage(t *testing.T) {
 	sid2 := createSession(ctx, t, env.db, "bob")
 
 	_, err := env.svc.JoinChannel(
-		ctx, sid1, "alice", "#chat", "",
+		ctx, sid1, 0, "alice", "#chat", "",
 	)
 	if err != nil {
 		t.Fatalf("join alice: %v", err)
 	}
 
 	_, err = env.svc.JoinChannel(
-		ctx, sid2, "bob", "#chat", "",
+		ctx, sid2, 0, "bob", "#chat", "",
 	)
 	if err != nil {
 		t.Fatalf("join bob: %v", err)
@@ -878,18 +872,14 @@ func TestSendChannelMessage(t *testing.T) {
 
 	body, _ := json.Marshal([]string{"hello world"}) //nolint:errchkjson
 
-	dbID, uuid, err := env.svc.SendChannelMessage(
+	uuid, err := env.svc.SendChannelMessage(
-		ctx, sid1, "alice",
+		ctx, sid1, 0, "alice",
 		irc.CmdPrivmsg, "#chat", body, nil,
 	)
 	if err != nil {
 		t.Fatalf("SendChannelMessage: %v", err)
 	}
 
-	if dbID == 0 {
-		t.Error("expected non-zero dbID")
-	}
-
 	if uuid == "" {
 		t.Error("expected non-empty UUID")
 	}
@@ -897,8 +887,8 @@ func TestSendChannelMessage(t *testing.T) {
 	// Non-member cannot send.
 	sid3 := createSession(ctx, t, env.db, "charlie")
 
-	_, _, err = env.svc.SendChannelMessage(
+	_, err = env.svc.SendChannelMessage(
-		ctx, sid3, "charlie",
+		ctx, sid3, 0, "charlie",
 		irc.CmdPrivmsg, "#chat", body, nil,
 	)
 	if err == nil {
@@ -914,14 +904,14 @@ func TestBroadcastQuit(t *testing.T) {
 	sid2 := createSession(ctx, t, env.db, "bob")
 
 	_, err := env.svc.JoinChannel(
-		ctx, sid1, "alice", "#room", "",
+		ctx, sid1, 0, "alice", "#room", "",
 	)
 	if err != nil {
 		t.Fatalf("join alice: %v", err)
 	}
 
 	_, err = env.svc.JoinChannel(
-		ctx, sid2, "bob", "#room", "",
+		ctx, sid2, 0, "bob", "#room", "",
 	)
 	if err != nil {
 		t.Fatalf("join bob: %v", err)
@@ -963,7 +953,7 @@ func TestSendDirectMessageTargetQuits(t *testing.T) {
 	body, _ := json.Marshal([]string{"hi"}) //nolint:errchkjson
 
 	_, err = env.svc.SendDirectMessage(
-		ctx, sid, "alice", irc.CmdPrivmsg, "bob", body, nil,
+		ctx, sid, 0, "alice", irc.CmdPrivmsg, "bob", body, nil,
 	)
 
 	var ircErr *service.IRCError
@@ -983,7 +973,7 @@ func TestSendChannelMessageChannelDeleted(t *testing.T) {
 
 	sid := createSession(ctx, t, env.db, "alice")
 
-	_, err := env.svc.JoinChannel(ctx, sid, "alice", "#gone", "")
+	_, err := env.svc.JoinChannel(ctx, sid, 0, "alice", "#gone", "")
 	if err != nil {
 		t.Fatalf("join alice: %v", err)
 	}
@@ -1000,8 +990,8 @@ func TestSendChannelMessageChannelDeleted(t *testing.T) {
 
 	body, _ := json.Marshal([]string{"hi"}) //nolint:errchkjson
 
-	_, _, err = env.svc.SendChannelMessage(
+	_, err = env.svc.SendChannelMessage(
-		ctx, sid, "alice", irc.CmdPrivmsg, "#gone", body, nil,
+		ctx, sid, 0, "alice", irc.CmdPrivmsg, "#gone", body, nil,
 	)
 
 	var ircErr *service.IRCError
@@ -1019,14 +1009,14 @@ func TestSendChannelMessage_Moderated(t *testing.T) {
 	sid2 := createSession(ctx, t, env.db, "bob")
 
 	result, err := env.svc.JoinChannel(
-		ctx, sid1, "alice", "#modchat", "",
+		ctx, sid1, 0, "alice", "#modchat", "",
 	)
 	if err != nil {
 		t.Fatalf("join alice: %v", err)
 	}
 
 	_, err = env.svc.JoinChannel(
-		ctx, sid2, "bob", "#modchat", "",
+		ctx, sid2, 0, "bob", "#modchat", "",
 	)
 	if err != nil {
 		t.Fatalf("join bob: %v", err)
@@ -1039,8 +1029,8 @@ func TestSendChannelMessage_Moderated(t *testing.T) {
 	body, _ := json.Marshal([]string{"test"}) //nolint:errchkjson
 
 	// Bob (non-op, non-voiced) should fail to send.
-	_, _, err = env.svc.SendChannelMessage(
+	_, err = env.svc.SendChannelMessage(
-		ctx, sid2, "bob",
+		ctx, sid2, 0, "bob",
 		irc.CmdPrivmsg, "#modchat", body, nil,
 	)
 	if err == nil {
@@ -1048,8 +1038,8 @@ func TestSendChannelMessage_Moderated(t *testing.T) {
 	}
 
 	// Alice (operator) should succeed.
-	_, _, err = env.svc.SendChannelMessage(
+	_, err = env.svc.SendChannelMessage(
-		ctx, sid1, "alice",
+		ctx, sid1, 0, "alice",
 		irc.CmdPrivmsg, "#modchat", body, nil,
 	)
 	if err != nil {
@@ -1074,7 +1064,7 @@ func TestRefusedChannelMessageLeavesStampUnspent(t *testing.T) {
 		refuse func(ctx context.Context, env *testEnv, chID, bobSID int64) error
 	}{
 		{"not a member", func(ctx context.Context, env *testEnv, _, bobSID int64) error {
-			return env.svc.PartChannel(ctx, bobSID, "bob", channel, "")
+			return env.svc.PartChannel(ctx, bobSID, 0, "bob", channel, "")
 		}},
 		{"banned", func(ctx context.Context, env *testEnv, chID, _ int64) error {
 			return env.db.AddChannelBan(ctx, chID, "bob!*@*", "alice")
@@ -1094,12 +1084,12 @@ func TestRefusedChannelMessageLeavesStampUnspent(t *testing.T) {
 			aliceSID := createSession(ctx, t, env.db, "alice")
 			bobSID := createSession(ctx, t, env.db, "bob")
 
-			joined, err := env.svc.JoinChannel(ctx, aliceSID, "alice", channel, "")
+			joined, err := env.svc.JoinChannel(ctx, aliceSID, 0, "alice", channel, "")
 			if err != nil {
 				t.Fatalf("join alice: %v", err)
 			}
 
-			_, err = env.svc.JoinChannel(ctx, bobSID, "bob", channel, "")
+			_, err = env.svc.JoinChannel(ctx, bobSID, 0, "bob", channel, "")
 			if err != nil {
 				t.Fatalf("join bob: %v", err)
 			}
@@ -1119,8 +1109,8 @@ func TestRefusedChannelMessageLeavesStampUnspent(t *testing.T) {
 			)
 			meta, _ := json.Marshal(map[string]string{"hashcash": stamp})
 
-			_, _, err = env.svc.SendChannelMessage(
+			_, err = env.svc.SendChannelMessage(
-				ctx, bobSID, "bob", irc.CmdPrivmsg, channel, body, meta,
+				ctx, bobSID, 0, "bob", irc.CmdPrivmsg, channel, body, meta,
 			)
 
 			var ircErr *service.IRCError
@@ -1129,8 +1119,8 @@ func TestRefusedChannelMessageLeavesStampUnspent(t *testing.T) {
 				t.Fatalf("bob: want ERR_CANNOTSENDTOCHAN, got %v", err)
 			}
 
-			_, _, err = env.svc.SendChannelMessage(
+			_, err = env.svc.SendChannelMessage(
-				ctx, aliceSID, "alice", irc.CmdPrivmsg, channel, body, meta,
+				ctx, aliceSID, 0, "alice", irc.CmdPrivmsg, channel, body, meta,
 			)
 			if err != nil {
 				t.Fatalf("alice with the same stamp: %v", err)

schema/README.md

@@ -1,98 +1,166 @@
-# Message Schemas
+# Message schemas
 
-JSON Schema definitions (draft 2020-12) for the neoirc protocol. Messages use
+This directory holds JSON Schema files (draft 2020-12) for the messages that the
-**IRC command names and numeric reply codes** (RFC 1459/2812) encoded as JSON
+neoirc HTTP API carries. `message.json` describes the fields that every message
-over HTTP.
+can have. `commands/` has files for some commands. `numerics/` has files for
+some of the numeric replies. A numeric reply is a server reply named by a
+three-digit number, such as `001`. `README.md` at the repository root documents
+the protocol.
 
-## Envelope
+The server can also run an IRC listener for ordinary IRC clients. The IRC
+listener sends plain IRC lines, which these files do not describe.
 
-Every message is a JSON object with a `command` field. The format maps directly
+## Message fields
-to IRC wire format:
+
+Every message is one JSON object, which `message.json` calls the envelope. These
+are the fields it can have:
+
+- `command`: the IRC command name, such as `PRIVMSG`, or the name of a numeric
+  reply, such as `RPL_WELCOME`. Always present.
+- `code`: the number of a numeric reply, such as `1` for `RPL_WELCOME`. Absent
+  on other messages.
+- `id`: the message's UUID, a unique ID that the server assigns.
+- `from`: the sender's nick, or the server name on a server message.
+- `to`: the target, such as a channel name starting with `#` or a nick.
+- `params`: an array of strings with the message's other parameters, in order.
+  `KICK` events and many numeric replies have it. The HTTP API ignores `params`
+  sent by a client.
+- `body`: an array of strings. It is never a bare string. In a `PRIVMSG` or
+  `NOTICE`, each string is one line of text.
+- `ts`: the time the server stored the message. It is an RFC 3339 time in UTC,
+  such as `2026-10-27T12:00:00.123Z`.
+- `meta`: an object of extra data, such as a hashcash stamp in `meta.hashcash`.
+  A hashcash stamp is a short string that takes a computer some work to make. A
+  `PRIVMSG` to a channel with mode `+H` needs one. The HTTP API relays the
+  `meta` of a `PRIVMSG` or `NOTICE` unchanged. It drops the `meta` of every
+  other command.
+
+Here is one `PRIVMSG` as the IRC listener sends it and as the HTTP API sends it.
+The JSON leaves out `id`, `ts` and `meta`:
 
 ```
-IRC:  :nick PRIVMSG #channel :hello world
+IRC:  :alice!alice@* PRIVMSG #general :hello world
-JSON: {"command": "PRIVMSG", "from": "nick", "to": "#channel", "body": ["hello world"]}
+JSON: {"command": "PRIVMSG", "from": "alice", "to": "#general", "body": ["hello world"]}
-
-IRC:  :server 353 nick = #channel :user1 @op1 +voice1
-JSON: {"command": "353", "to": "nick", "params": ["=", "#channel"], "body": ["user1 @op1 +voice1"]}
-
-Multiline:  {"command": "PRIVMSG", "to": "#ch", "body": ["line 1", "line 2"]}
-Structured: {"command": "PUBKEY", "body": {"alg": "ed25519", "key": "base64..."}}
 ```
 
-Common fields (see `message.json` for full schema):
+In the JSON, a numeric reply has its name in `command` and its number in `code`.
+This `353` reply lists the members of `#general`. The JSON again leaves out
+`id`, `ts` and `meta`:
 
-| Field     | Type            | Description                                          |
+```
-| --------- | --------------- | ---------------------------------------------------- |
+{"command": "RPL_NAMREPLY", "code": 353, "from": "neoirc", "to": "alice",
-| `id`      | string (uuid)   | Server-assigned message UUID                         |
+ "params": ["=", "#general"], "body": ["@op1!op1@host1 alice!alice@host2"]}
-| `command` | string          | IRC command or 3-digit numeric code                  |
+```
-| `from`    | string          | Source nick or server name (IRC prefix)              |
-| `to`      | string          | Target: #channel or nick                             |
-| `params`  | string[]        | Middle parameters (mainly for numerics)              |
-| `body`    | array \| object | Structured body — never a raw string (see below)     |
-| `ts`      | string          | ISO 8601 timestamp (server-assigned, not in raw IRC) |
-| `meta`    | object          | Extensible metadata (signatures, hashes, etc.)       |
 
-**Structured bodies:** `body` is always an array of strings (for text) or an
+A `PRIVMSG` whose `body` has two strings is a two-line message:
-object (for structured data like PUBKEY). Never a raw string. This enables:
 
-- Multiline messages without escape sequences
+```
-- Deterministic canonicalization via RFC 8785 JCS for signing
+{"command": "PRIVMSG", "to": "#general", "body": ["line one", "line two"]}
-- Structured data where needed
+```
 
-## Commands
+## Files
 
-IRC commands used for client↔server and server↔server communication.
+Commands, in `commands/`:
 
-| Command   | File                    | RFC         | Description                |
+- `PRIVMSG.json`: a message to a channel or a user.
-| --------- | ----------------------- | ----------- | -------------------------- |
+- `NOTICE.json`: a notice, which is a message that a client must not answer
-| `PRIVMSG` | `commands/PRIVMSG.json` | 1459 §4.4.1 | Message to channel or user |
+  automatically.
-| `NOTICE`  | `commands/NOTICE.json`  | 1459 §4.4.2 | Notice (no auto-reply)     |
+- `JOIN.json`: a user joined a channel.
-| `JOIN`    | `commands/JOIN.json`    | 1459 §4.2.1 | Join a channel             |
+- `PART.json`: a user left a channel.
-| `PART`    | `commands/PART.json`    | 1459 §4.2.2 | Leave a channel            |
+- `QUIT.json`: a user left the server.
-| `QUIT`    | `commands/QUIT.json`    | 1459 §4.1.6 | User disconnected          |
+- `NICK.json`: a user changed nick.
-| `NICK`    | `commands/NICK.json`    | 1459 §4.1.2 | Change nickname            |
+- `TOPIC.json`: a channel topic was set.
-| `TOPIC`   | `commands/TOPIC.json`   | 1459 §4.2.4 | Get/set channel topic      |
+- `MODE.json`: a channel mode was changed.
-| `MODE`    | `commands/MODE.json`    | 1459 §4.2.3 | Set channel/user modes     |
+- `KICK.json`: a channel operator removed a user from a channel.
-| `KICK`    | `commands/KICK.json`    | 1459 §4.2.8 | Kick user from channel     |
+- `PING.json`: a check that the server still answers.
-| `PING`    | `commands/PING.json`    | 1459 §4.6.2 | Keepalive                  |
+- `PONG.json`: the answer to a `PING`.
-| `PONG`    | `commands/PONG.json`    | 1459 §4.6.3 | Keepalive response         |
+- `PUBKEY.json`: an announcement of a user's public signing key. The server has
-| `PUBKEY`  | `commands/PUBKEY.json`  | (extension) | Announce/relay signing key |
+  no such command. It answers a `PUBKEY` with `ERR_UNKNOWNCOMMAND` (`421`).
 
-## Numeric Replies
+Numeric replies, in `numerics/`:
 
-Three-digit codes for server responses, per IRC convention.
+- `001.json`: `RPL_WELCOME`, which welcomes a new user.
+- `002.json`: `RPL_YOURHOST`, the server's name and version.
+- `003.json`: `RPL_CREATED`, which says when the server was created.
+- `004.json`: `RPL_MYINFO`, the server's version and its lists of modes.
+- `322.json`: `RPL_LIST`, one channel in the answer to `LIST`.
+- `323.json`: `RPL_LISTEND`, the end of the answer to `LIST`.
+- `332.json`: `RPL_TOPIC`, a channel's topic.
+- `353.json`: `RPL_NAMREPLY`, a channel's members.
+- `366.json`: `RPL_ENDOFNAMES`, the end of the member list.
+- `372.json`: `RPL_MOTD`, one line of the message of the day.
+- `375.json`: `RPL_MOTDSTART`, the start of the message of the day.
+- `376.json`: `RPL_ENDOFMOTD`, the end of the message of the day.
+- `401.json`: `ERR_NOSUCHNICK`, the nick does not exist.
+- `403.json`: `ERR_NOSUCHCHANNEL`, the channel does not exist.
+- `433.json`: `ERR_NICKNAMEINUSE`, the nick is taken.
+- `442.json`: `ERR_NOTONCHANNEL`, the user is not on that channel.
+- `482.json`: `ERR_CHANOPRIVSNEEDED`, the user is not a channel operator.
 
-### Success / Informational (0xx–3xx)
+## Where the files differ from the HTTP API
 
-| Code  | Name           | File                | Description                    |
+Where a schema file and the HTTP API disagree, the HTTP API is right:
-| ----- | -------------- | ------------------- | ------------------------------ |
-| `001` | RPL_WELCOME    | `numerics/001.json` | Welcome after session creation |
-| `002` | RPL_YOURHOST   | `numerics/002.json` | Server host info               |
-| `003` | RPL_CREATED    | `numerics/003.json` | Server creation date           |
-| `004` | RPL_MYINFO     | `numerics/004.json` | Server info and modes          |
-| `322` | RPL_LIST       | `numerics/322.json` | Channel list entry             |
-| `323` | RPL_LISTEND    | `numerics/323.json` | End of channel list            |
-| `332` | RPL_TOPIC      | `numerics/332.json` | Channel topic                  |
-| `353` | RPL_NAMREPLY   | `numerics/353.json` | Channel member list            |
-| `366` | RPL_ENDOFNAMES | `numerics/366.json` | End of NAMES list              |
-| `372` | RPL_MOTD       | `numerics/372.json` | MOTD line                      |
-| `375` | RPL_MOTDSTART  | `numerics/375.json` | Start of MOTD                  |
-| `376` | RPL_ENDOFMOTD  | `numerics/376.json` | End of MOTD                    |
 
-### Errors (4xx)
+- `message.json` and the files in `numerics/` put the three-digit code in
+  `command`. They have no `code` field. The HTTP API puts the reply's name in
+  `command` and its number in `code`.
+- `message.json` allows an object as `body`. The HTTP API reads only arrays of
+  strings. A `PRIVMSG` with an object as `body` gets `ERR_NOTEXTTOSEND` (`412`).
+- `message.json` says `to` is a channel or a nick. A `WALLOPS` message has `*`
+  there.
+- `message.json` allows `meta` on every message. The HTTP API keeps a client's
+  `meta` only on a `PRIVMSG` or `NOTICE`.
+- `message.json` describes signature fields in `meta`. The server never checks a
+  signature.
+- `message.json` does not describe `meta.hashcash`. The HTTP API reads it in a
+  `PRIVMSG` to a channel with mode `+H`.
+- `JOIN.json` has no `body`. A client's `JOIN` can carry the channel key in
+  `body`. When a user joins, the `JOIN` event repeats the channel name in
+  `body`.
+- `JOIN.json` allows a channel name of any length. The server allows at most 63
+  characters after the `#`. It answers a longer name with `ERR_NOSUCHCHANNEL`
+  (`403`).
+- `KICK.json` puts the kicked nick in `params`. The HTTP API reads a client's
+  `KICK` from `body`: the nick, then an optional reason.
+- `MODE.json` puts the mode change in `params`. The HTTP API uses `body`
+  instead. A client sends the change and any value as separate strings, such as
+  `"+o"` and `"bob"`. In a `MODE` event, `body` holds the change as one string,
+  such as `"+o bob"`, or as two strings, such as `"+k"` and `"secret"`.
+- `NOTICE.json` allows `*` as `to`. The server answers a `NOTICE` to `*` with
+  `ERR_NOSUCHNICK` (`401`).
+- `NOTICE.json` has an example notice from the server to `*`. The server sends
+  no such notice.
+- `PING.json` and `PONG.json` describe a token that the `PONG` repeats. The HTTP
+  API ignores the `body` of a `PING`. Its answer is the HTTP response
+  `{"command": "PONG", "from": "<server name>"}`.
+- `PING.json` and `PONG.json` also describe messages between servers. The server
+  does not connect to other IRC servers.
+- `PUBKEY.json` describes a command the server does not have.
+- `QUIT.json` says that `QUIT` comes only from the server. A client can send it
+  too, to end its session. A client's `QUIT` can carry a reason in `body`.
+- `TOPIC.json` says a `TOPIC` without a `body` queries the topic. The HTTP API
+  answers such a `TOPIC` with `ERR_NEEDMOREPARAMS` (`461`).
+- `TOPIC.json` says an empty array clears the topic. The HTTP API answers `[]`
+  with `ERR_NEEDMOREPARAMS` (`461`). A `body` of `[""]` clears the topic.
+- `003.json` describes the server's creation date. The HTTP API sends the date
+  the server last started.
+- `004.json` has example mode lists. The HTTP API sends an empty string as the
+  user modes and `ikmnostl` as the channel modes.
+- `322.json` says `LIST` gets one reply per channel. The server leaves out a
+  secret channel, one with mode `+s`, unless the user is on it.
+- `332.json` says `RPL_TOPIC` answers a `TOPIC` query. The HTTP API has no such
+  query. It sends `RPL_TOPIC` after a client sets the topic, and after a `JOIN`
+  to a channel that has one.
+- `353.json` says `body` lists nicks. The HTTP API lists `nick!user@host` in
+  place of each nick, such as `@op1!op1@host1`.
+- `353.json` says the first parameter marks a channel as public, private or
+  secret. The server always sends `=`, the mark for a public channel.
+- `376.json` gives the text as `End of /MOTD command`. The HTTP API adds a full
+  stop.
+- `401.json` gives the text as `No such nick/channel`. The server sends
+  `No such nick` in answer to a `PRIVMSG` or `NOTICE` to an unknown nick.
+- `433.json` has an example with `*` as `to`. The HTTP API sends `433` only in
+  answer to a `NICK`, with the user's nick as `to`.
 
-| Code  | Name                 | File                | Description             |
+The HTTP API also accepts some messages that the files do not allow, such as a
-| ----- | -------------------- | ------------------- | ----------------------- |
+`JOIN` whose `to` has no `#`.
-| `401` | ERR_NOSUCHNICK       | `numerics/401.json` | No such nick/channel    |
-| `403` | ERR_NOSUCHCHANNEL    | `numerics/403.json` | No such channel         |
-| `433` | ERR_NICKNAMEINUSE    | `numerics/433.json` | Nickname already in use |
-| `442` | ERR_NOTONCHANNEL     | `numerics/442.json` | Not on that channel     |
-| `482` | ERR_CHANOPRIVSNEEDED | `numerics/482.json` | Not channel operator    |
-
-## Federation (S2S)
-
-Server-to-server messages use the same command format. Federated servers relay
-messages with an additional `origin` field in `meta` to track the source server.
-The PING/PONG commands serve as inter-server keepalives. State sync after link
-establishment uses a burst of JOIN, NICK, TOPIC, and MODE commands.

web/src/app.jsx

@@ -7,6 +7,11 @@ const RECONNECT_DELAY = 3000;
 const MEMBER_REFRESH_INTERVAL = 10000;
 const ACTION_PREFIX = "\x01ACTION ";
 const ACTION_SUFFIX = "\x01";
+// SERVER_TAB is the Server tab's name, under which its messages and
+// unread count are stored. No nick or channel name can contain *, so a
+// user with the nick Server gets a direct-message tab of its own. The
+// tab bar labels this tab Server.
+const SERVER_TAB = "*server*";
 
 // Hashcash proof-of-work helpers using Web Crypto API.
 
@@ -270,9 +275,9 @@ function UserList({ members, onNickClick }) {
 function App() {
   const [loggedIn, setLoggedIn] = useState(false);
   const [nick, setNick] = useState("");
-  const [tabs, setTabs] = useState([{ type: "server", name: "Server" }]);
+  const [tabs, setTabs] = useState([{ type: "server", name: SERVER_TAB }]);
   const [activeTab, setActiveTab] = useState(0);
-  const [messages, setMessages] = useState({ Server: [] });
+  const [messages, setMessages] = useState({ [SERVER_TAB]: [] });
   const [members, setMembers] = useState({});
   const [topics, setTopics] = useState({});
   const [unread, setUnread] = useState({});
@@ -300,11 +305,14 @@ function App() {
     nickRef.current = nick;
   }, [nick]);
 
-  // Persist joined channels.
+  // Persist joined channels, once logged in: before then only the
+  // Server tab exists, and writing would erase the saved channels
+  // that onLogin rejoins.
   useEffect(() => {
+    if (!loggedIn) return;
     const channels = tabs.filter((t) => t.type === "channel").map((t) => t.name);
     localStorage.setItem("neoirc_channels", JSON.stringify(channels));
-  }, [tabs]);
+  }, [loggedIn, tabs]);
 
   // Clear unread on tab switch.
   useEffect(() => {
@@ -352,6 +360,26 @@ function App() {
       .catch(() => {});
   }, []);
 
+  // removeChannelTab closes a channel's tab. The tab the user was
+  // reading stays active, found by its name; when it was the closed tab,
+  // the Server tab shows.
+  const removeChannelTab = useCallback((name) => {
+    setTabs((prev) => {
+      const remaining = prev.filter(
+        (t) => !(t.type === "channel" && t.name === name),
+      );
+      // Preact runs this update at once, on the newest active tab.
+      setActiveTab((active) => {
+        const reading = prev[active]?.name;
+        const idx = remaining.findIndex((t) => t.name === reading);
+
+        return idx >= 0 ? idx : 0;
+      });
+
+      return remaining;
+    });
+  }, []);
+
   const processMessage = useCallback(
     (msg) => {
       const body = Array.isArray(msg.body) ? msg.body.join("\n") : "";
@@ -421,6 +449,13 @@ function App() {
           break;
         }
         case "PART": {
+          // The user's own PART, sent from this client or another,
+          // closes the tab and adds no message or unread count.
+          if (msg.from === nickRef.current) {
+            removeChannelTab(msg.to);
+
+            break;
+          }
           const reason = body ? " (" + body + ")" : "";
           const text = `${msg.from} has parted ${msg.to}${reason}`;
           if (msg.to) addMessage(msg.to, { ...base, text, system: true });
@@ -428,6 +463,29 @@ function App() {
 
           break;
         }
+        case "KICK": {
+          // The kicked nick is in params; the body is the reason.
+          const kicked = Array.isArray(msg.params) ? msg.params[0] : "";
+          const reason = body ? " (" + body + ")" : "";
+          const text = `${kicked} was kicked from ${msg.to} by ${msg.from}${reason}`;
+          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
+          if (kicked === nickRef.current) {
+            // The channel's tab closes, so the Server tab gets the line
+            // too. It needs an id of its own: addMessage drops a message
+            // whose id it has already seen.
+            addMessage(SERVER_TAB, {
+              ...base,
+              id: msg.id + "-server",
+              text,
+              system: true,
+            });
+            removeChannelTab(msg.to);
+          } else if (msg.to && msg.to.startsWith("#")) {
+            refreshMembers(msg.to);
+          }
+
+          break;
+        }
         case "QUIT": {
           const reason = body ? " (" + body + ")" : "";
           const text = `${msg.from} has quit${reason}`;
@@ -463,6 +521,15 @@ function App() {
 
           break;
         }
+        case "MODE": {
+          // The body is the change, with its value where it has one:
+          // ["+o bob"], ["+m"], ["+k", "secretpass"].
+          const modes = Array.isArray(msg.body) ? msg.body.join(" ") : "";
+          const text = `${msg.from} sets mode ${modes} on ${msg.to}`;
+          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
+
+          break;
+        }
         case 353: {
           // RPL_NAMREPLY — each name is a hostmask (nick!user@host),
           // prefixed with @ for an operator or + for a voiced member.
@@ -506,7 +573,7 @@ function App() {
             const chName = msg.params[0];
             const count = msg.params[1];
             const chTopic = body || "";
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${chName} (${count} users): ${chTopic.trim()}`,
               system: true,
@@ -516,7 +583,7 @@ function App() {
           break;
         }
         case 323:
-          addMessage("Server", {
+          addMessage(SERVER_TAB, {
             ...base,
             text: body || "End of channel list",
             system: true,
@@ -529,7 +596,7 @@ function App() {
             const whoCh = msg.params[0];
             const whoNick = msg.params[4];
             const whoFlags = msg.params.length > 5 ? msg.params[5] : "";
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${whoCh} ${whoNick} ${whoFlags}`,
               system: true,
@@ -539,7 +606,7 @@ function App() {
           break;
         }
         case 315:
-          addMessage("Server", {
+          addMessage(SERVER_TAB, {
             ...base,
             text: body || "End of /WHO list",
             system: true,
@@ -550,7 +617,7 @@ function App() {
           // RPL_WHOISUSER — params nick, user, host, *; body realname.
           if (Array.isArray(msg.params) && msg.params.length >= 3) {
             const [wiNick, wiUser, wiHost] = msg.params;
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${wiNick} is ${wiUser}@${wiHost} (${body})`,
               system: true,
@@ -564,7 +631,7 @@ function App() {
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const wiNick = msg.params[0];
             const wiServer = msg.params[1];
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${wiNick} on ${wiServer}`,
               system: true,
@@ -576,7 +643,7 @@ function App() {
         case 313: {
           // RPL_WHOISOPERATOR — nick; body "is an IRC operator".
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${msg.params[0]} ${body}`,
               system: true,
@@ -590,7 +657,7 @@ function App() {
           if (Array.isArray(msg.params) && msg.params.length >= 3) {
             const [wiNick, idle, signon] = msg.params;
             const signedOn = new Date(Number(signon) * 1000).toLocaleString();
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${wiNick} has been idle ${idle}s, signed on ${signedOn}`,
               system: true,
@@ -603,7 +670,7 @@ function App() {
           // RPL_WHOISCHANNELS — nick, channels.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const wiNick = msg.params[0];
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${wiNick} is on: ${body}`,
               system: true,
@@ -613,7 +680,7 @@ function App() {
           break;
         }
         case 318:
-          addMessage("Server", {
+          addMessage(SERVER_TAB, {
             ...base,
             text: body || "End of /WHOIS list",
             system: true,
@@ -623,7 +690,7 @@ function App() {
         case 324: {
           // RPL_CHANNELMODEIS — channel, mode string.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${msg.params[0]} modes: ${msg.params[1]}`,
               system: true,
@@ -635,16 +702,16 @@ function App() {
         case 375:
         case 372:
         case 376:
-          addMessage("Server", { ...base, text: body, system: true });
+          addMessage(SERVER_TAB, { ...base, text: body, system: true });
 
           break;
         default:
           if (body) {
-            addMessage("Server", { ...base, text: body, system: true });
+            addMessage(SERVER_TAB, { ...base, text: body, system: true });
           }
       }
     },
-    [addMessage, refreshMembers],
+    [addMessage, refreshMembers, removeChannelTab],
   );
 
   // Long-poll loop.
@@ -759,9 +826,14 @@ function App() {
 
   const onLogin = useCallback(
     async (userNick, isResumed) => {
+      // Read before setLoggedIn(true): from then on the effect under
+      // "Persist joined channels" writes the open channel tabs over it.
+      const saved = JSON.parse(
+        localStorage.getItem("neoirc_channels") || "[]",
+      );
       setNick(userNick);
       setLoggedIn(true);
-      addSystemMessage("Server", `Connected as ${userNick}`);
+      addSystemMessage(SERVER_TAB, `Connected as ${userNick}`);
 
       if (isResumed) {
         // Request MOTD on resumed sessions (new sessions
@@ -783,15 +855,13 @@ function App() {
       }
 
       // Fresh session — join any previously saved channels.
-      const saved = JSON.parse(
-        localStorage.getItem("neoirc_channels") || "[]",
-      );
       for (const ch of saved) {
         try {
-          await api("/messages", {
+          const res = await api("/messages", {
             method: "POST",
             body: JSON.stringify({ command: "JOIN", to: ch }),
           });
+          if (res?.status !== "joined") continue;
           setTabs((prev) => {
             if (prev.find((t) => t.type === "channel" && t.name === ch))
               return prev;
@@ -811,18 +881,30 @@ function App() {
     name = name.trim();
     if (!name.startsWith("#")) name = "#" + name;
     try {
-      await api("/messages", {
+      const res = await api("/messages", {
         method: "POST",
         body: JSON.stringify({ command: "JOIN", to: name }),
       });
+      // A refused join opens no tab. The error numeric that the
+      // server sends to the message queue tells the user why.
+      if (res?.status !== "joined") return;
+      // Show the channel's tab. Preact runs this update at once on the
+      // newest tab list, so the tab is found there by name: the user's
+      // own JOIN event may already have added it, and other tabs may
+      // have closed.
       setTabs((prev) => {
-        if (prev.find((t) => t.type === "channel" && t.name === name))
+        const idx = prev.findIndex(
+          (t) => t.type === "channel" && t.name === name,
+        );
+        if (idx >= 0) {
+          setActiveTab(idx);
+
           return prev;
+        }
+        setActiveTab(prev.length);
 
         return [...prev, { type: "channel", name }];
       });
-      const newIdx = tabsRef.current.length;
-      setActiveTab(newIdx);
       try {
         const hist = await api(
           `/history?target=${encodeURIComponent(name)}&limit=50`,
@@ -835,7 +917,7 @@ function App() {
       }
     } catch (err) {
       addSystemMessage(
-        "Server",
+        SERVER_TAB,
         `Failed to join ${name}: ${err.data?.error || "error"}`,
       );
     }
@@ -851,10 +933,7 @@ function App() {
     } catch (e) {
       // Ignore.
     }
-    setTabs((prev) =>
+    removeChannelTab(name);
-      prev.filter((t) => !(t.type === "channel" && t.name === name)),
-    );
-    setActiveTab(0);
   };
 
   const closeTab = (idx) => {
@@ -869,16 +948,23 @@ function App() {
 
   const openDM = (targetNick) => {
     if (targetNick === nickRef.current) return;
+    // Show the direct-message tab. Preact runs this update at once on
+    // the newest tab list, so the tab is found there by name: the
+    // server's copy of the user's message may already have added it,
+    // and other tabs may have opened or closed.
     setTabs((prev) => {
-      if (prev.find((t) => t.type === "dm" && t.name === targetNick))
+      const idx = prev.findIndex(
+        (t) => t.type === "dm" && t.name === targetNick,
+      );
+      if (idx >= 0) {
+        setActiveTab(idx);
+
         return prev;
+      }
+      setActiveTab(prev.length);
 
       return [...prev, { type: "dm", name: targetNick }];
     });
-    const idx = tabs.findIndex(
-      (t) => t.type === "dm" && t.name === targetNick,
-    );
-    setActiveTab(idx >= 0 ? idx : tabs.length);
   };
 
   const handleCommand = async (text) => {
@@ -889,7 +975,7 @@ function App() {
     switch (cmd) {
       case "/join": {
         if (parts[1]) joinChannel(parts[1]);
-        else addSystemMessage("Server", "Usage: /join #channel");
+        else addSystemMessage(SERVER_TAB, "Usage: /join #channel");
 
         break;
       }
@@ -898,7 +984,7 @@ function App() {
           const reason = parts.slice(1).join(" ") || undefined;
           partChannel(tab.name, reason);
         } else {
-          addSystemMessage("Server", "You are not in a channel");
+          addSystemMessage(SERVER_TAB, "You are not in a channel");
         }
 
         break;
@@ -919,19 +1005,19 @@ function App() {
             openDM(target);
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `Message failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /msg <nick> <message>");
+          addSystemMessage(SERVER_TAB, "Usage: /msg <nick> <message>");
         }
 
         break;
       }
       case "/me": {
         if (tab.type === "server") {
-          addSystemMessage("Server", "Cannot use /me in server window");
+          addSystemMessage(SERVER_TAB, "Cannot use /me in server window");
 
           break;
         }
@@ -953,7 +1039,7 @@ function App() {
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /me <action>");
+          addSystemMessage(SERVER_TAB, "Usage: /me <action>");
         }
 
         break;
@@ -967,19 +1053,19 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `Nick change failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /nick <newnick>");
+          addSystemMessage(SERVER_TAB, "Usage: /nick <newnick>");
         }
 
         break;
       }
       case "/topic": {
         if (tab.type !== "channel") {
-          addSystemMessage("Server", "You are not in a channel");
+          addSystemMessage(SERVER_TAB, "You are not in a channel");
 
           break;
         }
@@ -996,13 +1082,13 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `Topic change failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `Current topic for ${tab.name}: ${topics[tab.name] || "(none)"}`,
           );
         }
@@ -1011,7 +1097,7 @@ function App() {
       }
       case "/mode": {
         if (tab.type !== "channel") {
-          addSystemMessage("Server", "You are not in a channel");
+          addSystemMessage(SERVER_TAB, "You are not in a channel");
 
           break;
         }
@@ -1029,7 +1115,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `MODE failed: ${err.data?.error || "error"}`,
           );
         }
@@ -1060,7 +1146,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `Failed to request MOTD: ${err.data?.error || "error"}`,
           );
         }
@@ -1084,13 +1170,13 @@ function App() {
               });
             } catch (err) {
               addSystemMessage(
-                "Server",
+                SERVER_TAB,
                 `Message failed: ${err.data?.error || "error"}`,
               );
             }
           }
         } else {
-          addSystemMessage("Server", "Usage: /query <nick> [message]");
+          addSystemMessage(SERVER_TAB, "Usage: /query <nick> [message]");
         }
 
         break;
@@ -1103,7 +1189,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `Failed to list channels: ${err.data?.error || "error"}`,
           );
         }
@@ -1120,12 +1206,12 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `WHO failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /who #channel");
+          addSystemMessage(SERVER_TAB, "Usage: /who #channel");
         }
 
         break;
@@ -1139,12 +1225,12 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `WHOIS failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /whois <nick>");
+          addSystemMessage(SERVER_TAB, "Usage: /whois <nick>");
         }
 
         break;
@@ -1175,13 +1261,13 @@ function App() {
           "  /help                 — Show this help",
         ];
         for (const line of helpLines) {
-          addSystemMessage("Server", line);
+          addSystemMessage(SERVER_TAB, line);
         }
 
         break;
       }
       default:
-        addSystemMessage("Server", `Unknown command: ${cmd}`);
+        addSystemMessage(SERVER_TAB, `Unknown command: ${cmd}`);
     }
   };
 
@@ -1210,7 +1296,7 @@ function App() {
 
     if (tab.type === "server") {
       addSystemMessage(
-        "Server",
+        SERVER_TAB,
         "Cannot send messages to the server window. Use /join #channel first.",
       );
 
@@ -1281,7 +1367,7 @@ function App() {
               key={tab.name}
             >
               <span class="tab-label">
-                {tab.type === "dm" ? tab.name : tab.name}
+                {tab.type === "server" ? "Server" : tab.name}
               </span>
               {unread[tab.name] > 0 && i !== activeTab && (
                 <span class="unread-count">({unread[tab.name]})</span>