Make Alt and a digit set the send target as /window does (closes #221)

In neoirc-cli, Alt and a digit switched the window but kept the send
target, so typed text went to the window the user had left. The key
now runs /window with that digit through the input handler.

/window 0 now clears the send target. The status window has no target,
but the command used to keep the previous one.

Model: opus-5-5

.golangci.yml

@@ -61,6 +61,10 @@ linters:
               desc: >-
                 Test-support code belongs in test files and in packages whose
                 directory name ends in test, not in the shipped binary.
+            - pkg: sneak.berlin/go/neoirc/internal/dbtest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
     # Only decisions already recorded in the Go package defaults are
     # listed here. Every entry matches the module path exactly.
     gomodguard_v2:

internal/broker/broker.go

@@ -47,6 +47,16 @@ func (b *Broker) Notify(userID int64) {
 	}
 }
 
+// ListenerCount returns how many channels from Wait are still
+// registered for the user: those that neither Notify nor Remove
+// has taken out.
+func (b *Broker) ListenerCount(userID int64) int {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return len(b.listeners[userID])
+}
+
 // Remove removes a specific wait channel (for cleanup on timeout).
 func (b *Broker) Remove(
 	userID int64,

internal/broker/broker_test.go

@@ -59,6 +59,39 @@ func TestRemove(t *testing.T) {
 	}
 }
 
+func TestListenerCount(t *testing.T) {
+	t.Parallel()
+
+	brk := broker.New()
+
+	wantCount := func(step string, userID int64, want int) {
+		t.Helper()
+
+		got := brk.ListenerCount(userID)
+		if got != want {
+			t.Errorf("%s: user %d: got %d, want %d",
+				step, userID, got, want)
+		}
+	}
+
+	wantCount("before Wait", 1, 0)
+
+	waitCh := brk.Wait(1)
+	brk.Wait(1)
+	brk.Wait(2)
+
+	wantCount("after two Waits", 1, 2)
+
+	brk.Remove(1, waitCh)
+
+	wantCount("after Remove", 1, 1)
+
+	brk.Notify(1)
+
+	wantCount("after Notify", 1, 0)
+	wantCount("after Notify", 2, 1)
+}
+
 func TestMultipleWaiters(t *testing.T) {
 	t.Parallel()
 

internal/cli/api/client.go

@@ -25,7 +25,10 @@ const (
 	httpErrThreshold = 400
 )
 
-var errHTTP = errors.New("HTTP error")
+var (
+	errHTTP        = errors.New("HTTP error")
+	errJoinRefused = errors.New("the server refused the join")
+)
 
 // Client wraps HTTP calls to the neoirc server API.
 type Client struct {
@@ -206,13 +209,35 @@ func (client *Client) PollMessages(
 	}, nil
 }
 
-// JoinChannel joins a channel.
+// JoinChannel joins a channel. It returns an error unless the
+// server answers that the session joined. When the server
+// refuses the join, it sends the reason to the message queue as
+// an error numeric.
 func (client *Client) JoinChannel(channel string) error {
-	return client.SendMessage(
+	data, err := client.do(
+		http.MethodPost, "/api/v1/messages",
 		&Message{ //nolint:exhaustruct // only command+to needed
 			Command: irc.CmdJoin, To: channel,
 		},
 	)
+	if err != nil {
+		return err
+	}
+
+	var resp struct {
+		Status string `json:"status"`
+	}
+
+	err = json.Unmarshal(data, &resp)
+	if err != nil {
+		return fmt.Errorf("decode join: %w", err)
+	}
+
+	if resp.Status != "joined" {
+		return errJoinRefused
+	}
+
+	return nil
 }
 
 // PartChannel leaves a channel.
@@ -250,7 +275,7 @@ func (client *Client) ListChannels() (
 // GetMembers returns members of a channel.
 func (client *Client) GetMembers(
 	channel string,
-) ([]string, error) {
+) ([]Member, error) {
 	name := strings.TrimPrefix(channel, "#")
 
 	data, err := client.do(
@@ -263,7 +288,7 @@ func (client *Client) GetMembers(
 		return nil, err
 	}
 
-	var members []string
+	var members []Member
 
 	err = json.Unmarshal(data, &members)
 	if err != nil {

internal/cli/api/client_test.go

@@ -2,18 +2,28 @@ package neoircapi_test
 
 import (
 	"context"
+	"encoding/json"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"reflect"
+	"slices"
+	"strconv"
 	"strings"
 	"testing"
 
 	api "sneak.berlin/go/neoirc/internal/cli/api"
+	"sneak.berlin/go/neoirc/internal/hashcash"
 )
 
-const cookieValue = "opaque-value"
+const (
+	cookieValue = "opaque-value"
+	testNick    = "alice"
+	testChannel = "#general"
+)
 
 // newSessionServer starts a plain-HTTP server that, like
 // neoircd, sets a Secure auth cookie when a session is
@@ -24,10 +34,16 @@ func newSessionServer(t *testing.T) *httptest.Server {
 
 	mux := http.NewServeMux()
 
+	// Without hashcash the server sends no hashcash_bits.
 	mux.HandleFunc("GET /api/v1/server", func(
 		writer http.ResponseWriter, _ *http.Request,
 	) {
-		_, _ = io.WriteString(writer, `{}`)
+		_, _ = io.WriteString(writer, `{
+			"name": "My NeoIRC Server",
+			"version": "0.1.0",
+			"motd": "Welcome! Be nice.",
+			"users": 42
+		}`)
 	})
 
 	mux.HandleFunc("POST /api/v1/session", func(
@@ -56,9 +72,14 @@ func newSessionServer(t *testing.T) *httptest.Server {
 			return
 		}
 
-		_, _ = io.WriteString(
-			writer, `{"id":1,"nick":"alice","channels":[]}`,
-		)
+		_, _ = io.WriteString(writer, `{
+			"id": 1,
+			"nick": "alice",
+			"channels": [
+				{"id": 1, "name": "#general", "topic": "Welcome!"},
+				{"id": 2, "name": "#dev", "topic": ""}
+			]
+		}`)
 	})
 
 	server := httptest.NewServer(mux)
@@ -67,6 +88,344 @@ func newSessionServer(t *testing.T) *httptest.Server {
 	return server
 }
 
+// newClientForPath starts a server that answers GET path with
+// body, and returns a client for it.
+func newClientForPath(t *testing.T, path, body string) *api.Client {
+	t.Helper()
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("GET "+path, func(
+		writer http.ResponseWriter, _ *http.Request,
+	) {
+		_, _ = io.WriteString(writer, body)
+	})
+
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	return api.NewClient(server.URL)
+}
+
+func TestGetStateDecodesFields(t *testing.T) {
+	t.Parallel()
+
+	client := api.NewClient(newSessionServer(t).URL)
+
+	_, err := client.CreateSession(testNick)
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+
+	state, err := client.GetState()
+	if err != nil {
+		t.Fatalf("state: %v", err)
+	}
+
+	want := api.StateResponse{
+		ID:   1,
+		Nick: testNick,
+		Channels: []api.Channel{
+			{Name: testChannel, Topic: "Welcome!"},
+			{Name: "#dev", Topic: ""},
+		},
+	}
+	if !reflect.DeepEqual(*state, want) {
+		t.Fatalf("state: got %+v, want %+v", *state, want)
+	}
+}
+
+func TestGetServerInfoDecodesFields(t *testing.T) {
+	t.Parallel()
+
+	client := newClientForPath(t, "/api/v1/server", `{
+		"name": "My NeoIRC Server",
+		"version": "0.1.0",
+		"motd": "Welcome! Be nice.",
+		"users": 42,
+		"hashcash_bits": 20
+	}`)
+
+	info, err := client.GetServerInfo()
+	if err != nil {
+		t.Fatalf("server info: %v", err)
+	}
+
+	want := api.ServerInfo{
+		Name:         "My NeoIRC Server",
+		MOTD:         "Welcome! Be nice.",
+		Version:      "0.1.0",
+		HashcashBits: 20,
+	}
+	if *info != want {
+		t.Fatalf("server info: got %+v, want %+v", *info, want)
+	}
+}
+
+// TestCreateSessionSendsNickAndStamp serves a server that, like
+// neoircd with hashcash on, advertises hashcash_bits and creates
+// the session only for a pow_token the server's validator in
+// internal/hashcash accepts.
+func TestCreateSessionSendsNickAndStamp(t *testing.T) {
+	t.Parallel()
+
+	const (
+		serverName = "My NeoIRC Server"
+		stampBits  = 8
+		sessionID  = 7
+	)
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("GET /api/v1/server", func(
+		writer http.ResponseWriter, _ *http.Request,
+	) {
+		_, _ = fmt.Fprintf(writer, `{
+			"name": %q,
+			"version": "0.1.0",
+			"motd": "Welcome! Be nice.",
+			"users": 42,
+			"hashcash_bits": %d
+		}`, serverName, stampBits)
+	})
+
+	validator := hashcash.NewValidator(serverName)
+
+	mux.HandleFunc("POST /api/v1/session", func(
+		writer http.ResponseWriter, request *http.Request,
+	) {
+		// Decoded with the field names handleCreateSession uses.
+		var payload struct {
+			Nick     string `json:"nick"`
+			Hashcash string `json:"pow_token"` //nolint:tagliatelle
+		}
+
+		err := json.NewDecoder(request.Body).Decode(&payload)
+		if err != nil {
+			writer.WriteHeader(http.StatusBadRequest)
+
+			return
+		}
+
+		err = validator.Claim(payload.Hashcash, stampBits)
+		if err != nil {
+			writer.WriteHeader(http.StatusPaymentRequired)
+
+			return
+		}
+
+		writer.WriteHeader(http.StatusCreated)
+
+		_ = json.NewEncoder(writer).Encode(map[string]any{
+			"id":   sessionID,
+			"nick": payload.Nick,
+		})
+	})
+
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	session, err := api.NewClient(server.URL).CreateSession(testNick)
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+
+	want := api.SessionResponse{ID: sessionID, Nick: testNick}
+	if *session != want {
+		t.Fatalf("session: got %+v, want %+v", *session, want)
+	}
+}
+
+func TestListChannelsDecodesNamesAndTopics(t *testing.T) {
+	t.Parallel()
+
+	client := newClientForPath(t, "/api/v1/channels", `[
+		{"id": 1, "name": "#general", "topic": "Welcome!"},
+		{"id": 2, "name": "#dev", "topic": "Development discussion"}
+	]`)
+
+	channels, err := client.ListChannels()
+	if err != nil {
+		t.Fatalf("list channels: %v", err)
+	}
+
+	want := []api.Channel{
+		{Name: testChannel, Topic: "Welcome!"},
+		{Name: "#dev", Topic: "Development discussion"},
+	}
+	if !slices.Equal(channels, want) {
+		t.Fatalf("channels: got %+v, want %+v", channels, want)
+	}
+}
+
+func TestGetMembersDecodesMemberObjects(t *testing.T) {
+	t.Parallel()
+
+	client := newClientForPath(t, "/api/v1/channels/general/members", `[
+		{
+			"id": 1, "nick": "alice", "username": "alice",
+			"hostname": "host.example.com",
+			"isOperator": true, "isVoiced": false,
+			"lastSeen": "2026-02-10T20:00:00Z"
+		},
+		{
+			"id": 2, "nick": "bob", "username": "bob",
+			"hostname": "host.example.com",
+			"isOperator": false, "isVoiced": true,
+			"lastSeen": "2026-02-10T20:00:00Z"
+		},
+		{
+			"id": 3, "nick": "Carol", "username": "carol",
+			"hostname": "host.example.com",
+			"isOperator": false, "isVoiced": false,
+			"lastSeen": "2026-02-10T20:00:00Z"
+		}
+	]`)
+
+	members, err := client.GetMembers(testChannel)
+	if err != nil {
+		t.Fatalf("get members: %v", err)
+	}
+
+	want := []api.Member{
+		{Nick: testNick, IsOperator: true, IsVoiced: false},
+		{Nick: "bob", IsOperator: false, IsVoiced: true},
+		{Nick: "Carol", IsOperator: false, IsVoiced: false},
+	}
+	if !slices.Equal(members, want) {
+		t.Fatalf("members: got %+v, want %+v", members, want)
+	}
+}
+
+// TestPollMessagesAdvancesCursor serves the queue as the server
+// does: entries after the cursor, and last_id as the new cursor.
+func TestPollMessagesAdvancesCursor(t *testing.T) {
+	t.Parallel()
+
+	const lastQueueID = 42
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("GET /api/v1/messages", func(
+		writer http.ResponseWriter, request *http.Request,
+	) {
+		after := request.URL.Query().Get("after")
+		if after == strconv.Itoa(lastQueueID) {
+			_, _ = io.WriteString(
+				writer, `{"messages": [], "last_id": 42}`,
+			)
+
+			return
+		}
+
+		_, _ = io.WriteString(writer, `{
+			"messages": [{
+				"id": "b7c8210f-849c-4b90-9ee8-d99c8889358e",
+				"command": "PRIVMSG",
+				"from": "alice",
+				"to": "#general",
+				"body": ["hello world"],
+				"ts": "2026-02-10T20:00:01.234567891Z",
+				"meta": {}
+			}],
+			"last_id": 42
+		}`)
+	})
+
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	client := api.NewClient(server.URL)
+
+	first, err := client.PollMessages(0, 0)
+	if err != nil {
+		t.Fatalf("first poll: %v", err)
+	}
+
+	if first.LastID != lastQueueID || len(first.Messages) != 1 {
+		t.Fatalf(
+			"first poll: got last ID %d and %d messages, "+
+				"want %d and 1",
+			first.LastID, len(first.Messages), lastQueueID,
+		)
+	}
+
+	second, err := client.PollMessages(first.LastID, 0)
+	if err != nil {
+		t.Fatalf("second poll: %v", err)
+	}
+
+	if len(second.Messages) != 0 {
+		t.Fatalf(
+			"second poll: got %d messages again, want none",
+			len(second.Messages),
+		)
+	}
+}
+
+// TestPollMessagesDecodesMessageFields serves a relayed PRIVMSG
+// with the sender's meta and a numeric, as the server queues
+// them.
+func TestPollMessagesDecodesMessageFields(t *testing.T) {
+	t.Parallel()
+
+	client := newClientForPath(t, "/api/v1/messages", `{
+		"messages": [
+			{
+				"id": "b7c8210f-849c-4b90-9ee8-d99c8889358e",
+				"command": "PRIVMSG",
+				"from": "alice",
+				"to": "#general",
+				"body": ["signed message"],
+				"ts": "2026-02-10T20:00:01.234567891Z",
+				"meta": {"sig": "base64...", "alg": "ed25519"}
+			},
+			{
+				"id": "7f5a04f8-eab4-4d2e-be55-f5cfcfaf43c5",
+				"command": "RPL_LUSEROP",
+				"code": 252,
+				"from": "neoirc",
+				"to": "alice",
+				"params": ["0"],
+				"body": ["operator(s) online"],
+				"ts": "2026-02-10T20:00:02Z",
+				"meta": {}
+			}
+		],
+		"last_id": 42
+	}`)
+
+	result, err := client.PollMessages(0, 0)
+	if err != nil {
+		t.Fatalf("poll: %v", err)
+	}
+
+	want := []api.Message{
+		{
+			ID:      "b7c8210f-849c-4b90-9ee8-d99c8889358e",
+			Command: "PRIVMSG",
+			From:    testNick,
+			To:      testChannel,
+			Body:    []any{"signed message"},
+			TS:      "2026-02-10T20:00:01.234567891Z",
+			Meta:    map[string]any{"sig": "base64...", "alg": "ed25519"},
+		},
+		{
+			ID:      "7f5a04f8-eab4-4d2e-be55-f5cfcfaf43c5",
+			Command: "RPL_LUSEROP",
+			From:    "neoirc",
+			To:      testNick,
+			Params:  []string{"0"},
+			Body:    []any{"operator(s) online"},
+			TS:      "2026-02-10T20:00:02Z",
+			Meta:    map[string]any{},
+		},
+	}
+	if !reflect.DeepEqual(result.Messages, want) {
+		t.Fatalf("messages: got %+v, want %+v", result.Messages, want)
+	}
+}
+
 func TestClientKeepsSessionOverPlainHTTPOnLocalhost(t *testing.T) {
 	t.Parallel()
 
@@ -85,7 +444,7 @@ func TestClientKeepsSessionOverPlainHTTPOnLocalhost(t *testing.T) {
 				"http://" + net.JoinHostPort(host, serverURL.Port()),
 			)
 
-			_, err := client.CreateSession("alice")
+			_, err := client.CreateSession(testNick)
 			if err != nil {
 				t.Fatalf("create session: %v", err)
 			}
@@ -118,7 +477,7 @@ func TestClientWithholdsCookieOverPlainHTTPFromOtherHosts(t *testing.T) {
 		},
 	}
 
-	_, err := client.CreateSession("alice")
+	_, err := client.CreateSession(testNick)
 	if err != nil {
 		t.Fatalf("create session: %v", err)
 	}

internal/cli/api/types.go

@@ -16,9 +16,9 @@ type SessionResponse struct {
 
 // StateResponse is the response from GET /api/v1/state.
 type StateResponse struct {
-	ID       int64    `json:"id"`
-	Nick     string   `json:"nick"`
-	Channels []string `json:"channels"`
+	ID       int64     `json:"id"`
+	Nick     string    `json:"nick"`
+	Channels []Channel `json:"channels"`
 }
 
 // Message represents a neoirc message envelope.
@@ -53,12 +53,19 @@ func (m *Message) BodyLines() []string {
 	}
 }
 
-// Channel represents a channel in the list response.
+// Channel is a channel as GET /api/v1/channels and
+// GET /api/v1/state describe it.
 type Channel struct {
-	Name      string `json:"name"`
-	Topic     string `json:"topic"`
-	Members   int    `json:"members"`
-	CreatedAt string `json:"createdAt"`
+	Name  string `json:"name"`
+	Topic string `json:"topic"`
+}
+
+// Member is one entry of the response from
+// GET /api/v1/channels/{name}/members.
+type Member struct {
+	Nick       string `json:"nick"`
+	IsOperator bool   `json:"isOperator"`
+	IsVoiced   bool   `json:"isVoiced"`
 }
 
 // ServerInfo is the response from GET /api/v1/server.
@@ -72,7 +79,7 @@ type ServerInfo struct {
 // MessagesResponse wraps polling results.
 type MessagesResponse struct {
 	Messages []Message `json:"messages"`
-	LastID   int64     `json:"lastId"`
+	LastID   int64     `json:"last_id"` //nolint:tagliatelle
 }
 
 // PollResult wraps the poll response including the cursor.

internal/cli/app.go

@@ -96,20 +96,7 @@ func (a *App) handleInput(text string) {
 		a.ui.AddStatus(
 			"[red]Send error: " + err.Error(),
 		)
-
-		return
 	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
 }
 
 func (a *App) handleCommand(text string) {
@@ -301,9 +288,6 @@ func (a *App) cmdJoin(channel string) {
 	a.mu.Unlock()
 
 	a.ui.SwitchToBuffer(channel)
-	a.ui.AddLine(channel,
-		"[yellow]*** Joined "+channel,
-	)
 	a.ui.SetStatus(nick, channel, "connected")
 }
 
@@ -338,10 +322,6 @@ func (a *App) cmdPart(channel string) {
 		return
 	}
 
-	a.ui.AddLine(channel,
-		"[yellow]*** Left "+channel,
-	)
-
 	a.mu.Lock()
 	if a.target == channel {
 		a.target = ""
@@ -368,7 +348,6 @@ func (a *App) cmdMsg(args string) {
 
 	a.mu.Lock()
 	connected := a.connected
-	nick := a.nick
 	a.mu.Unlock()
 
 	if !connected {
@@ -386,16 +365,7 @@ func (a *App) cmdMsg(args string) {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Send failed: %v", err,
 		))
-
-		return
 	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
 }
 
 func (a *App) cmdQuery(nick string) {
@@ -434,16 +404,9 @@ func (a *App) cmdTopic(args string) {
 		return
 	}
 
+	// The HTTP API has no topic query: a TOPIC needs text.
 	if args == "" {
-		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-			Command: irc.CmdTopic,
-			To:      target,
-		})
-		if err != nil {
-			a.ui.AddStatus(fmt.Sprintf(
-				"[red]Topic query failed: %v", err,
-			))
-		}
+		a.ui.AddStatus("[red]Usage: /topic <text>")
 
 		return
 	}
@@ -487,12 +450,32 @@ func (a *App) cmdNames() {
 		return
 	}
 
+	nicks := make([]string, 0, len(members))
+
+	for _, member := range members {
+		nicks = append(nicks, memberPrefix(member)+member.Nick)
+	}
+
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[cyan]*** Members of %s: %s",
-		target, strings.Join(members, " "),
+		target, strings.Join(nicks, " "),
 	))
 }
 
+// memberPrefix returns "@" for an operator, "+" for a voiced
+// member, and "" for anyone else.
+func memberPrefix(member api.Member) string {
+	if member.IsOperator {
+		return "@"
+	}
+
+	if member.IsVoiced {
+		return "+"
+	}
+
+	return ""
+}
+
 func (a *App) cmdList() {
 	a.mu.Lock()
 	connected := a.connected
@@ -517,8 +500,7 @@ func (a *App) cmdList() {
 
 	for _, ch := range channels {
 		a.ui.AddStatus(fmt.Sprintf(
-			"  %s (%d members) %s",
-			ch.Name, ch.Members, ch.Topic,
+			"  %s %s", ch.Name, ch.Topic,
 		))
 	}
 
@@ -645,6 +627,10 @@ func (a *App) cmdWindow(args string) {
 				nick, buf.Name, "connected",
 			)
 		} else {
+			a.mu.Lock()
+			a.target = ""
+			a.mu.Unlock()
+
 			a.ui.SetStatus(nick, "", "connected")
 		}
 	}
@@ -676,7 +662,7 @@ func (a *App) cmdHelp() {
 		"  /part [#chan]    — Leave channel",
 		"  /msg <nick> <text> — Send DM",
 		"  /query <nick>   — Open DM window",
-		"  /topic [text]   — View/set topic",
+		"  /topic <text>   — Set topic",
 		"  /names          — List channel members",
 		"  /list           — List channels",
 		"  /who [#channel] — List users in channel",
@@ -745,7 +731,7 @@ func (a *App) handleServerMessage(msg *api.Message) {
 	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
 	case irc.CmdPart:
-		a.handlePartEvent(msg, timestamp)
+		a.handlePartEvent(msg, timestamp, myNick)
 	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
 	case irc.CmdNick:
@@ -773,12 +759,10 @@ func (a *App) handlePrivmsgEvent(
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 
-	if msg.From == myNick {
-		return
-	}
-
+	// A direct message shows in the buffer of the other user:
+	// the recipient of one the user sent, else the sender.
 	target := msg.To
-	if !strings.HasPrefix(target, "#") {
+	if !strings.HasPrefix(target, "#") && msg.From != myNick {
 		target = msg.From
 	}
 
@@ -801,8 +785,11 @@ func (a *App) handleJoinEvent(
 	))
 }
 
+// handlePartEvent shows a part in the channel's buffer. The
+// user's own part does not mark the channel unread: the user
+// has just left it.
 func (a *App) handlePartEvent(
-	msg *api.Message, timestamp string,
+	msg *api.Message, timestamp, myNick string,
 ) {
 	if msg.To == "" {
 		return
@@ -811,17 +798,22 @@ func (a *App) handlePartEvent(
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 
+	line := fmt.Sprintf(
+		"[gray]%s [yellow]*** %s has left %s",
+		timestamp, msg.From, msg.To,
+	)
+
 	if reason != "" {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s (%s)",
-			timestamp, msg.From, msg.To, reason,
-		))
-	} else {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s",
-			timestamp, msg.From, msg.To,
-		))
+		line += " (" + reason + ")"
 	}
+
+	if msg.From == myNick {
+		a.ui.AddLineAsRead(msg.To, line)
+
+		return
+	}
+
+	a.ui.AddLine(msg.To, line)
 }
 
 func (a *App) handleQuitEvent(

internal/cli/app_internal_test.go

@@ -0,0 +1,394 @@
+package cli
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gdamore/tcell/v2"
+	api "sneak.berlin/go/neoirc/internal/cli/api"
+	"sneak.berlin/go/neoirc/pkg/irc"
+)
+
+// The user's nick, a channel it is in, another user's nick and
+// a message text, for the tests below.
+const (
+	testNick      = "erin"
+	testChannel   = "#chan"
+	testOtherNick = "bob"
+	testText      = "hello"
+)
+
+func TestMemberPrefix(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		member api.Member
+		want   string
+	}{
+		{
+			name:   "operator",
+			member: api.Member{Nick: "alice", IsOperator: true},
+			want:   "@",
+		},
+		{
+			name:   "voiced member",
+			member: api.Member{Nick: "bob", IsVoiced: true},
+			want:   "+",
+		},
+		{
+			name: "voiced operator",
+			member: api.Member{
+				Nick: "Carol", IsOperator: true, IsVoiced: true,
+			},
+			want: "@",
+		},
+		{
+			name:   "plain member",
+			member: api.Member{Nick: "dave"},
+			want:   "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := memberPrefix(test.member)
+			if got != test.want {
+				t.Fatalf("got %q, want %q", got, test.want)
+			}
+		})
+	}
+}
+
+// TestPartEvent checks that a PART event adds a line to the
+// channel's buffer and marks it unread, except that the
+// user's own part does not mark it unread.
+func TestPartEvent(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		from       string
+		wantUnread int
+	}{
+		{name: "own part", from: testNick, wantUnread: 0},
+		{name: "other member", from: testOtherNick, wantUnread: 1},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{ui: NewUI(), nick: testNick}
+			runUI(t, app.ui)
+
+			app.handleServerMessage(&api.Message{
+				Command: irc.CmdPart, From: test.from, To: testChannel,
+			})
+
+			lines, unread := bufferState(app.ui, testChannel)
+			if lines != 1 || unread != test.wantUnread {
+				t.Fatalf("got %d lines and %d unread, want 1 and %d",
+					lines, unread, test.wantUnread)
+			}
+		})
+	}
+}
+
+// TestOwnCommandShownOnce checks that a message, join or
+// part made from neoirc-cli shows as one line in the
+// channel's buffer once the server's event for it arrives,
+// and does not mark the channel unread.
+func TestOwnCommandShownOnce(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		send  func(app *App)
+		event api.Message
+	}{
+		{
+			name: "message",
+			send: func(app *App) { app.handleInput(testText) },
+			event: api.Message{
+				Command: irc.CmdPrivmsg, From: testNick, To: testChannel,
+				Body: []string{testText},
+			},
+		},
+		{
+			name: "join",
+			send: func(app *App) { app.cmdJoin(testChannel) },
+			event: api.Message{
+				Command: irc.CmdJoin, From: testNick, To: testChannel,
+			},
+		},
+		{
+			name: "part",
+			send: func(app *App) { app.cmdPart(testChannel) },
+			event: api.Message{
+				Command: irc.CmdPart, From: testNick, To: testChannel,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			// The server accepts every command. Only the response
+			// to a JOIN is read, and it says the session joined.
+			server := newServer(t, `{"status": "joined"}`)
+
+			app := &App{
+				ui:        NewUI(),
+				client:    api.NewClient(server.URL),
+				nick:      testNick,
+				target:    testChannel,
+				connected: true,
+			}
+			runUI(t, app.ui)
+			app.ui.SwitchToBuffer(testChannel)
+
+			test.send(app)
+			app.handleServerMessage(&test.event)
+
+			lines, unread := bufferState(app.ui, testChannel)
+			if lines != 1 || unread != 0 {
+				t.Fatalf("got %d lines and %d unread, want 1 and 0",
+					lines, unread)
+			}
+		})
+	}
+}
+
+// TestJoinResponse checks that /join switches to the channel's
+// buffer and makes it the target only when the server answers
+// that the session joined.
+func TestJoinResponse(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		response string
+		// The buffer shown and the target after the join.
+		want string
+	}{
+		{
+			name:     "joined",
+			response: `{"status": "joined", "channel": "#chan"}`,
+			want:     testChannel,
+		},
+		{
+			name:     "refused",
+			response: `{"status": "error"}`,
+			want:     testOtherNick,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{
+				ui:        NewUI(),
+				client:    api.NewClient(newServer(t, test.response).URL),
+				nick:      testNick,
+				target:    testOtherNick,
+				connected: true,
+			}
+			runUI(t, app.ui)
+			app.ui.SwitchToBuffer(testOtherNick)
+
+			app.cmdJoin(testChannel)
+
+			var shown string
+
+			app.ui.app.QueueUpdate(func() {
+				shown = app.ui.buffers[app.ui.currentBuffer].Name
+			})
+
+			if shown != test.want || app.target != test.want {
+				t.Fatalf("got buffer %s and target %s, want %s",
+					shown, app.target, test.want)
+			}
+		})
+	}
+}
+
+// TestAltDigit checks that Alt and a digit shows that window and
+// makes its channel or user the target, as /window does. Window
+// 0, the status window, leaves no target.
+func TestAltDigit(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name  string
+		digit rune
+		// The buffer shown and the target after the key.
+		wantBuffer string
+		wantTarget string
+	}{
+		{
+			name:       "channel window",
+			digit:      '1',
+			wantBuffer: testChannel,
+			wantTarget: testChannel,
+		},
+		{
+			name:       "status window",
+			digit:      '0',
+			wantBuffer: "(status)",
+			wantTarget: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{ui: NewUI(), nick: testNick, target: testOtherNick}
+			app.ui.OnInput(app.handleInput)
+			runUI(t, app.ui)
+
+			// Window 1 is the channel. Window 2, the one shown, is
+			// the other user's.
+			app.ui.SwitchToBuffer(testChannel)
+			app.ui.SwitchToBuffer(testOtherNick)
+
+			key := tcell.NewEventKey(tcell.KeyRune, test.digit, tcell.ModAlt)
+			app.ui.app.GetInputCapture()(key)
+
+			var shown string
+
+			app.ui.app.QueueUpdate(func() {
+				shown = app.ui.buffers[app.ui.currentBuffer].Name
+			})
+
+			if shown != test.wantBuffer || app.target != test.wantTarget {
+				t.Fatalf("got buffer %s and target %q, want %s and %q",
+					shown, app.target, test.wantBuffer, test.wantTarget)
+			}
+		})
+	}
+}
+
+// TestOwnEventFromOtherClient checks that a message, notice,
+// join or part that the user's session makes from another
+// client shows as one line in the buffer it belongs to.
+func TestOwnEventFromOtherClient(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		event  api.Message
+		buffer string
+	}{
+		{
+			name: "channel message",
+			event: api.Message{
+				Command: irc.CmdPrivmsg, From: testNick, To: testChannel,
+				Body: []string{testText},
+			},
+			buffer: testChannel,
+		},
+		{
+			name: "direct message",
+			event: api.Message{
+				Command: irc.CmdPrivmsg, From: testNick, To: testOtherNick,
+				Body: []string{testText},
+			},
+			buffer: testOtherNick,
+		},
+		{
+			name: "notice",
+			event: api.Message{
+				Command: irc.CmdNotice, From: testNick, To: testChannel,
+				Body: []string{testText},
+			},
+			buffer: "(status)",
+		},
+		{
+			name: "join",
+			event: api.Message{
+				Command: irc.CmdJoin, From: testNick, To: testChannel,
+			},
+			buffer: testChannel,
+		},
+		{
+			name: "part",
+			event: api.Message{
+				Command: irc.CmdPart, From: testNick, To: testChannel,
+			},
+			buffer: testChannel,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := &App{ui: NewUI(), nick: testNick}
+			runUI(t, app.ui)
+
+			app.handleServerMessage(&test.event)
+
+			lines, _ := bufferState(app.ui, test.buffer)
+			if lines != 1 {
+				t.Fatalf("got %d lines in %s, want 1", lines, test.buffer)
+			}
+		})
+	}
+}
+
+// bufferState returns the number of lines in the named
+// buffer and how many of them are unread.
+func bufferState(ui *UI, name string) (int, int) {
+	var lines, unread int
+
+	ui.app.QueueUpdate(func() {
+		buf := ui.getOrCreateBuffer(name)
+		lines = len(buf.Lines)
+		unread = buf.Unread
+	})
+
+	return lines, unread
+}
+
+// newServer starts a server that answers every request with
+// body until the test ends.
+func newServer(t *testing.T, body string) *httptest.Server {
+	t.Helper()
+
+	server := httptest.NewServer(http.HandlerFunc(
+		func(writer http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(writer, body)
+		},
+	))
+	t.Cleanup(server.Close)
+
+	return server
+}
+
+// runUI runs ui on a simulated screen until the test ends.
+func runUI(t *testing.T, ui *UI) {
+	t.Helper()
+
+	ui.app.SetScreen(tcell.NewSimulationScreen(""))
+
+	done := make(chan error)
+
+	go func() { done <- ui.Run() }()
+
+	t.Cleanup(func() {
+		ui.Stop()
+
+		err := <-done
+		if err != nil {
+			t.Errorf("run ui: %v", err)
+		}
+	})
+}

internal/cli/ui.go

@@ -95,6 +95,19 @@ func (ui *UI) AddLine(bufferName, line string) {
 	})
 }
 
+// AddLineAsRead adds a line to the specified buffer, as
+// AddLine does, but does not mark the buffer unread.
+func (ui *UI) AddLineAsRead(bufferName, line string) {
+	ui.app.QueueUpdateDraw(func() {
+		buf := ui.getOrCreateBuffer(bufferName)
+		buf.Lines = append(buf.Lines, line)
+
+		if ui.buffers[ui.currentBuffer] == buf {
+			_, _ = fmt.Fprintln(ui.messages, line)
+		}
+	})
+}
+
 // AddStatus adds a line to the status buffer.
 func (ui *UI) AddStatus(line string) {
 	ts := time.Now().Format("15:04")
@@ -227,10 +240,13 @@ func (ui *UI) initKeyCapture() {
 				return event
 			}
 
+			// Alt and a digit runs /window with that digit.
+			// SwitchBuffer alone would leave the target as it was.
 			r := event.Rune()
 			if r >= '0' && r <= '9' {
-				idx := int(r - '0')
-				ui.SwitchBuffer(idx)
+				if ui.onInput != nil {
+					ui.onInput("/window " + string(r))
+				}
 
 				return nil
 			}

internal/config/config.go

@@ -3,7 +3,12 @@ package config
 
 import (
 	"errors"
+	"fmt"
 	"log/slog"
+	"math"
+	"os"
+	"strconv"
+	"time"
 
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
@@ -21,6 +26,14 @@ const defaultMOTD = ` _ __   ___  ___  (_)_ __ ___
 Welcome to NeoIRC — IRC semantics over HTTP.
 Type /help for available commands.`
 
+// DefaultDBURL is the database URL used when DBURL is not set. Its
+// _pragma parameters, which the SQLite driver runs on every connection
+// it opens, set WAL mode and a 5000 ms busy timeout.
+const DefaultDBURL = "file:///var/lib/neoirc/state.db" +
+	"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)"
+
+var errOutOfRange = errors.New("setting out of range")
+
 // Params defines the dependencies for creating a Config.
 type Params struct {
 	fx.In
@@ -56,6 +69,8 @@ type Config struct {
 }
 
 // New creates a new Config by reading from files and environment variables.
+// It returns an error when a number, true/false or duration setting does
+// not parse or is out of range.
 func New(
 	_ fx.Lifecycle, params Params,
 ) (*Config, error) {
@@ -71,7 +86,7 @@ func New(
 	viper.SetDefault("DEBUG", "false")
 	viper.SetDefault("MAINTENANCE_MODE", "false")
 	viper.SetDefault("PORT", "8080")
-	viper.SetDefault("DBURL", "file:///var/lib/neoirc/state.db?_journal_mode=WAL")
+	viper.SetDefault("DBURL", DefaultDBURL)
 	viper.SetDefault("SENTRY_DSN", "")
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
@@ -100,29 +115,34 @@ func New(
 
 	cfg := &Config{
 		DBURL:              viper.GetString("DBURL"),
-		Debug:              viper.GetBool("DEBUG"),
-		Port:               viper.GetInt("PORT"),
 		SentryDSN:          viper.GetString("SENTRY_DSN"),
-		MaintenanceMode:    viper.GetBool("MAINTENANCE_MODE"),
 		MetricsUsername:    viper.GetString("METRICS_USERNAME"),
 		MetricsPassword:    viper.GetString("METRICS_PASSWORD"),
 		MessageMaxAge:      viper.GetString("MESSAGE_MAX_AGE"),
-		MaxMessageSize:     viper.GetInt("MAX_MESSAGE_SIZE"),
 		QueueMaxAge:        viper.GetString("QUEUE_MAX_AGE"),
 		MOTD:               viper.GetString("MOTD"),
 		ServerName:         viper.GetString("SERVER_NAME"),
 		FederationKey:      viper.GetString("FEDERATION_KEY"),
 		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
-		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
 		OperName:           viper.GetString("NEOIRC_OPER_NAME"),
 		OperPassword:       viper.GetString("NEOIRC_OPER_PASSWORD"),
-		LoginRateLimit:     viper.GetFloat64("LOGIN_RATE_LIMIT"),
-		LoginRateBurst:     viper.GetInt("LOGIN_RATE_BURST"),
 		IRCListenAddr:      viper.GetString("IRC_LISTEN_ADDR"),
 		log:                log,
 		params:             &params,
 	}
 
+	err = parseSettings(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	// Viper counts an empty environment variable as unset, but an
+	// empty IRC_LISTEN_ADDR must turn the IRC listener off.
+	ircListenAddr, set := os.LookupEnv("IRC_LISTEN_ADDR")
+	if set {
+		cfg.IRCListenAddr = ircListenAddr
+	}
+
 	if cfg.Debug {
 		params.Logger.EnableDebugLogging()
 		cfg.log = params.Logger.Get()
@@ -130,3 +150,93 @@ func New(
 
 	return cfg, nil
 }
+
+// parseSettings reads the number and true/false settings into cfg and
+// checks the duration settings. Each number and duration must be above
+// zero. PORT and NEOIRC_HASHCASH_BITS may also be zero: port 0 lets the
+// system pick a port, and 0 bits turns proof of work off. The error
+// names each setting that does not parse or is out of range.
+func parseSettings(cfg *Config) error {
+	return errors.Join(
+		parseInt("PORT", 0, &cfg.Port),
+		parseInt("MAX_MESSAGE_SIZE", 1, &cfg.MaxMessageSize),
+		parseInt("NEOIRC_HASHCASH_BITS", 0, &cfg.HashcashBits),
+		parseInt("LOGIN_RATE_BURST", 1, &cfg.LoginRateBurst),
+		parseFloat("LOGIN_RATE_LIMIT", &cfg.LoginRateLimit),
+		parseBool("DEBUG", &cfg.Debug),
+		parseBool("MAINTENANCE_MODE", &cfg.MaintenanceMode),
+		checkDuration("MESSAGE_MAX_AGE", cfg.MessageMaxAge),
+		checkDuration("QUEUE_MAX_AGE", cfg.QueueMaxAge),
+		checkDuration("SESSION_IDLE_TIMEOUT", cfg.SessionIdleTimeout),
+	)
+}
+
+// parseInt sets *value to the setting key read as a whole number. It
+// returns an error when the value does not parse or is below minimum.
+func parseInt(key string, minimum int, value *int) error {
+	raw := viper.GetString(key)
+
+	parsed, err := strconv.Atoi(raw)
+	if err != nil {
+		return fmt.Errorf("cannot parse %s: %w", key, err)
+	}
+
+	if parsed < minimum {
+		return fmt.Errorf("%w: %s is %s, but must be at least %d",
+			errOutOfRange, key, raw, minimum)
+	}
+
+	*value = parsed
+
+	return nil
+}
+
+// parseFloat sets *value to the setting key read as a floating-point
+// number. It returns an error when the value does not parse or is not a
+// finite number above zero.
+func parseFloat(key string, value *float64) error {
+	raw := viper.GetString(key)
+
+	parsed, err := strconv.ParseFloat(raw, 64)
+	if err != nil {
+		return fmt.Errorf("cannot parse %s: %w", key, err)
+	}
+
+	if math.IsNaN(parsed) || math.IsInf(parsed, 0) || parsed <= 0 {
+		return fmt.Errorf(
+			"%w: %s is %s, but must be a finite number above zero",
+			errOutOfRange, key, raw)
+	}
+
+	*value = parsed
+
+	return nil
+}
+
+// parseBool sets *value to the setting key read as true or false.
+func parseBool(key string, value *bool) error {
+	parsed, err := strconv.ParseBool(viper.GetString(key))
+	if err != nil {
+		return fmt.Errorf("cannot parse %s: %w", key, err)
+	}
+
+	*value = parsed
+
+	return nil
+}
+
+// checkDuration returns an error naming the setting key when value is
+// not a Go duration above zero.
+func checkDuration(key, value string) error {
+	duration, err := time.ParseDuration(value)
+	if err != nil {
+		return fmt.Errorf("cannot parse %s: %w", key, err)
+	}
+
+	if duration <= 0 {
+		return fmt.Errorf("%w: %s is %s, but must be above zero",
+			errOutOfRange, key, value)
+	}
+
+	return nil
+}

internal/config/config_test.go

@@ -0,0 +1,208 @@
+package config_test
+
+import (
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/logger"
+)
+
+// loadConfig runs config.New and returns its result.
+func loadConfig(t *testing.T) (*config.Config, error) {
+	t.Helper()
+
+	globs := &globals.Globals{
+		Appname:   "neoirc-test",
+		Version:   "test",
+		StartTime: time.Now(),
+	}
+
+	log, err := logger.New(nil, logger.Params{Globals: globs})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return config.New(
+		nil, config.Params{Globals: globs, Logger: log},
+	)
+}
+
+func newConfig(t *testing.T) *config.Config {
+	t.Helper()
+
+	cfg, err := loadConfig(t)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return cfg
+}
+
+func TestUnsetSettingsKeepDefaults(t *testing.T) {
+	// Viper counts an empty environment variable as unset.
+	t.Setenv("PORT", "")
+	t.Setenv("MAX_MESSAGE_SIZE", "")
+	t.Setenv("NEOIRC_HASHCASH_BITS", "")
+	t.Setenv("LOGIN_RATE_BURST", "")
+	t.Setenv("LOGIN_RATE_LIMIT", "")
+	t.Setenv("DEBUG", "")
+	t.Setenv("MAINTENANCE_MODE", "")
+	t.Setenv("MESSAGE_MAX_AGE", "")
+	t.Setenv("QUEUE_MAX_AGE", "")
+	t.Setenv("SESSION_IDLE_TIMEOUT", "")
+
+	// Each duration setting defaults to 30 days.
+	const thirtyDays = "720h"
+
+	want := settings{
+		Port:               8080,
+		MaxMessageSize:     4096,
+		HashcashBits:       20,
+		LoginRateBurst:     5,
+		LoginRateLimit:     1,
+		Debug:              false,
+		MaintenanceMode:    false,
+		MessageMaxAge:      thirtyDays,
+		QueueMaxAge:        thirtyDays,
+		SessionIdleTimeout: thirtyDays,
+	}
+
+	got := settingsOf(newConfig(t))
+	if got != want {
+		t.Errorf("settings = %+v, want %+v", got, want)
+	}
+}
+
+func TestValidSettingsAreUsed(t *testing.T) {
+	// Each whole number is the lowest value its setting allows, and 1ns
+	// is the shortest duration allowed.
+	t.Setenv("PORT", "0")
+	t.Setenv("MAX_MESSAGE_SIZE", "1")
+	t.Setenv("NEOIRC_HASHCASH_BITS", "0")
+	t.Setenv("LOGIN_RATE_BURST", "1")
+	t.Setenv("LOGIN_RATE_LIMIT", "0.5")
+	t.Setenv("DEBUG", "true")
+	t.Setenv("MAINTENANCE_MODE", "true")
+	t.Setenv("MESSAGE_MAX_AGE", "1ns")
+	t.Setenv("QUEUE_MAX_AGE", "1h30m")
+	t.Setenv("SESSION_IDLE_TIMEOUT", "45m")
+
+	want := settings{
+		Port:               0,
+		MaxMessageSize:     1,
+		HashcashBits:       0,
+		LoginRateBurst:     1,
+		LoginRateLimit:     0.5,
+		Debug:              true,
+		MaintenanceMode:    true,
+		MessageMaxAge:      "1ns",
+		QueueMaxAge:        "1h30m",
+		SessionIdleTimeout: "45m",
+	}
+
+	got := settingsOf(newConfig(t))
+	if got != want {
+		t.Errorf("settings = %+v, want %+v", got, want)
+	}
+}
+
+// settings holds the Config fields whose settings config.New parses.
+type settings struct {
+	Port               int
+	MaxMessageSize     int
+	HashcashBits       int
+	LoginRateBurst     int
+	LoginRateLimit     float64
+	Debug              bool
+	MaintenanceMode    bool
+	MessageMaxAge      string
+	QueueMaxAge        string
+	SessionIdleTimeout string
+}
+
+func settingsOf(cfg *config.Config) settings {
+	return settings{
+		Port:               cfg.Port,
+		MaxMessageSize:     cfg.MaxMessageSize,
+		HashcashBits:       cfg.HashcashBits,
+		LoginRateBurst:     cfg.LoginRateBurst,
+		LoginRateLimit:     cfg.LoginRateLimit,
+		Debug:              cfg.Debug,
+		MaintenanceMode:    cfg.MaintenanceMode,
+		MessageMaxAge:      cfg.MessageMaxAge,
+		QueueMaxAge:        cfg.QueueMaxAge,
+		SessionIdleTimeout: cfg.SessionIdleTimeout,
+	}
+}
+
+func TestBadSettingStopsStartup(t *testing.T) {
+	// For each setting, the first value does not parse and the others
+	// parse but are out of range.
+	tests := []struct {
+		key    string
+		values []string
+	}{
+		{key: "PORT", values: []string{"80a", "-1"}},
+		{key: "MAX_MESSAGE_SIZE", values: []string{"4k", "0", "-4096"}},
+		{key: "NEOIRC_HASHCASH_BITS", values: []string{"twenty", "-1"}},
+		{key: "LOGIN_RATE_BURST", values: []string{"five", "0", "-5"}},
+		{key: "LOGIN_RATE_LIMIT", values: []string{
+			"fast", "0", "-1", "NaN", "Inf", "-Inf",
+		}},
+		{key: "DEBUG", values: []string{"yes"}},
+		{key: "MAINTENANCE_MODE", values: []string{"on"}},
+		{key: "MESSAGE_MAX_AGE", values: []string{"30d", "0", "-1h"}},
+		{key: "QUEUE_MAX_AGE", values: []string{"720", "0s", "-24h"}},
+		{key: "SESSION_IDLE_TIMEOUT", values: []string{"a month", "0", "-1m"}},
+	}
+
+	for _, test := range tests {
+		for _, value := range test.values {
+			t.Run(test.key+"="+value, func(t *testing.T) {
+				t.Setenv(test.key, value)
+
+				_, err := loadConfig(t)
+				if err == nil {
+					t.Fatalf("%s=%q: got no error", test.key, value)
+				}
+
+				msg := err.Error()
+				if !strings.Contains(msg, test.key) ||
+					!strings.Contains(msg, value) {
+					t.Errorf("error %q does not name %s and %q",
+						msg, test.key, value)
+				}
+			})
+		}
+	}
+}
+
+func TestIRCListenAddrUnsetKeepsDefault(t *testing.T) {
+	// t.Setenv puts back whatever value was there after the test.
+	t.Setenv("IRC_LISTEN_ADDR", "")
+
+	err := os.Unsetenv("IRC_LISTEN_ADDR")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	const want = ":6667"
+
+	cfg := newConfig(t)
+	if cfg.IRCListenAddr != want {
+		t.Errorf("IRCListenAddr = %q, want %q", cfg.IRCListenAddr, want)
+	}
+}
+
+func TestIRCListenAddrEmptyTurnsListenerOff(t *testing.T) {
+	t.Setenv("IRC_LISTEN_ADDR", "")
+
+	cfg := newConfig(t)
+	if cfg.IRCListenAddr != "" {
+		t.Errorf("IRCListenAddr = %q, want empty", cfg.IRCListenAddr)
+	}
+}

internal/db/db.go

@@ -5,9 +5,11 @@ import (
 	"context"
 	"database/sql"
 	"embed"
+	"errors"
 	"fmt"
 	"io/fs"
 	"log/slog"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -22,6 +24,10 @@ import (
 
 const minMigrationParts = 2
 
+var errForeignKeysInDBURL = errors.New(
+	"DBURL must not set foreign_keys, which the server always turns on",
+)
+
 // SchemaFiles contains embedded SQL migration files.
 //
 //go:embed schema/*.sql
@@ -87,9 +93,36 @@ func (database *Database) GetDB() *sql.DB {
 func (database *Database) connect(ctx context.Context) error {
 	dbURL := database.params.Config.DBURL
 	if dbURL == "" {
-		dbURL = "file:///var/lib/neoirc/state.db?_journal_mode=WAL&_busy_timeout=5000"
+		dbURL = config.DefaultDBURL
 	}
 
+	// SQLite keeps the foreign keys setting per connection. The driver
+	// runs each _pragma parameter on every connection it opens. So the
+	// one added below also covers the connection the pool opens after
+	// a cancelled query breaks the old one. A foreign_keys pragma in
+	// DBURL could undo it, because the driver sorts the pragmas.
+	_, query, hasQuery := strings.Cut(dbURL, "?")
+
+	urlParams, err := url.ParseQuery(query)
+	if err != nil {
+		return fmt.Errorf("parse DBURL: %w", err)
+	}
+
+	for _, pragma := range urlParams["_pragma"] {
+		if strings.Contains(strings.ToLower(pragma), "foreign_keys") {
+			return fmt.Errorf(
+				"%w: _pragma=%s", errForeignKeysInDBURL, pragma,
+			)
+		}
+	}
+
+	separator := "?"
+	if hasQuery {
+		separator = "&"
+	}
+
+	dbURL += separator + "_pragma=foreign_keys(1)"
+
 	database.log.Info(
 		"connecting to database", "url", dbURL,
 	)
@@ -109,20 +142,6 @@ func (database *Database) connect(ctx context.Context) error {
 	database.conn = conn
 	database.log.Info("database connected")
 
-	_, err = database.conn.ExecContext(
-		ctx, "PRAGMA foreign_keys = ON",
-	)
-	if err != nil {
-		return fmt.Errorf("enable foreign keys: %w", err)
-	}
-
-	_, err = database.conn.ExecContext(
-		ctx, "PRAGMA busy_timeout = 5000",
-	)
-	if err != nil {
-		return fmt.Errorf("set busy timeout: %w", err)
-	}
-
 	return database.runMigrations(ctx)
 }
 

internal/db/db_test.go

@@ -0,0 +1,278 @@
+package db_test
+
+import (
+	"context"
+	"errors"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"go.uber.org/fx/fxtest"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/logger"
+)
+
+const wantBusyTimeoutMS = 5000
+
+const (
+	// endlessQuery counts the rows of a recursive query that never
+	// stops, so it runs until its context ends.
+	endlessQuery = `WITH RECURSIVE n(x) AS
+		(SELECT 1 UNION ALL SELECT x + 1 FROM n)
+		SELECT COUNT(*) FROM n`
+
+	endlessQueryTimeout = 100 * time.Millisecond
+)
+
+// TestDefaultDBURLSetsWALAndBusyTimeout opens a file database
+// with the default URL's parameters the way the server does,
+// and checks the journal mode and busy timeout it ends up with.
+func TestDefaultDBURLSetsWALAndBusyTimeout(t *testing.T) {
+	t.Parallel()
+
+	_, params, _ := strings.Cut(config.DefaultDBURL, "?")
+	dbURL := "file://" + filepath.Join(t.TempDir(), "state.db") +
+		"?" + params
+
+	lifecycle := fxtest.NewLifecycle(t)
+
+	log, err := logger.New(lifecycle, logger.Params{
+		Globals: &globals.Globals{},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	database, err := db.New(lifecycle, db.Params{
+		Logger: log,
+		Config: &config.Config{DBURL: dbURL},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	lifecycle.RequireStart()
+	t.Cleanup(lifecycle.RequireStop)
+
+	var journalMode string
+
+	err = database.GetDB().QueryRowContext(
+		t.Context(), "PRAGMA journal_mode",
+	).Scan(&journalMode)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if journalMode != "wal" {
+		t.Errorf("journal_mode = %q, want %q", journalMode, "wal")
+	}
+
+	var busyTimeout int
+
+	err = database.GetDB().QueryRowContext(
+		t.Context(), "PRAGMA busy_timeout",
+	).Scan(&busyTimeout)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if busyTimeout != wantBusyTimeoutMS {
+		t.Errorf(
+			"busy_timeout = %d, want %d",
+			busyTimeout, wantBusyTimeoutMS,
+		)
+	}
+}
+
+// TestForeignKeysOnAfterCancelledQuery cancels a query while it
+// runs, which makes the pool close its only connection and open a
+// new one. A TEMP table lasts only as long as its connection, so
+// its absence shows the connection was replaced. The test then
+// checks that the file database keeps its tables and that the new
+// connection has foreign keys on.
+func TestForeignKeysOnAfterCancelledQuery(t *testing.T) {
+	t.Parallel()
+
+	_, defaultParams, _ := strings.Cut(config.DefaultDBURL, "?")
+
+	urlParams := map[string]string{
+		"default parameters": "?" + defaultParams,
+		"no parameters":      "",
+	}
+
+	for name, params := range urlParams {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			dbURL := "file://" +
+				filepath.Join(t.TempDir(), "state.db") + params
+
+			database, err := startDatabase(t, dbURL)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			_, err = database.GetDB().ExecContext(
+				t.Context(), "CREATE TEMP TABLE first_connection (x)",
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			ctx, cancel := context.WithTimeout(
+				t.Context(), endlessQueryTimeout,
+			)
+			defer cancel()
+
+			_, err = database.GetDB().ExecContext(ctx, endlessQuery)
+			if !errors.Is(err, context.DeadlineExceeded) {
+				t.Fatalf("endless query: err = %v", err)
+			}
+
+			tempTables := queryInt(
+				t, database, "SELECT COUNT(*) FROM sqlite_temp_schema",
+			)
+			if tempTables != 0 {
+				t.Fatal("the pool kept its first connection")
+			}
+
+			migrations := queryInt(
+				t, database, "SELECT COUNT(*) FROM schema_migrations",
+			)
+			if migrations == 0 {
+				t.Error("schema_migrations is empty")
+			}
+
+			foreignKeys := queryInt(t, database, "PRAGMA foreign_keys")
+			if foreignKeys != 1 {
+				t.Errorf("foreign_keys = %d, want 1", foreignKeys)
+			}
+		})
+	}
+}
+
+// TestNewURLKeepsDataAfterCancelledQuery cancels a query on a test
+// database while it runs, which makes the pool close its only
+// connection and open a new one. A TEMP table lasts only as long as
+// its connection, so its absence shows the connection was replaced.
+// The database must still have its tables and rows.
+func TestNewURLKeepsDataAfterCancelledQuery(t *testing.T) {
+	t.Parallel()
+
+	database, err := startDatabase(t, dbtest.NewURL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = database.GetOrCreateChannel(t.Context(), "#test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = database.GetDB().ExecContext(
+		t.Context(), "CREATE TEMP TABLE first_connection (x)",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), endlessQueryTimeout)
+	defer cancel()
+
+	_, err = database.GetDB().ExecContext(ctx, endlessQuery)
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("endless query: err = %v", err)
+	}
+
+	tempTables := queryInt(
+		t, database, "SELECT COUNT(*) FROM sqlite_temp_schema",
+	)
+	if tempTables != 0 {
+		t.Fatal("the pool kept its first connection")
+	}
+
+	channels := queryInt(t, database, "SELECT COUNT(*) FROM channels")
+	if channels != 1 {
+		t.Errorf("channels = %d, want 1", channels)
+	}
+}
+
+// TestDBURLSettingForeignKeysFailsStartup checks that the database
+// refuses to start when DBURL sets foreign_keys itself, however it
+// is spelled.
+func TestDBURLSettingForeignKeysFailsStartup(t *testing.T) {
+	t.Parallel()
+
+	pragmas := []string{
+		"foreign_keys(0)",
+		"foreign_keys(off)",
+		"foreign_keys=0",
+		"FOREIGN_KEYS(FALSE)",
+		" Foreign_Keys = 1",
+	}
+
+	for _, pragma := range pragmas {
+		t.Run(pragma, func(t *testing.T) {
+			t.Parallel()
+
+			dbURL := "file://" +
+				filepath.Join(t.TempDir(), "state.db") +
+				"?_pragma=" + url.QueryEscape(pragma)
+
+			_, err := startDatabase(t, dbURL)
+			if err == nil {
+				t.Fatal("the database started")
+			}
+
+			if !strings.Contains(err.Error(), "DBURL") {
+				t.Errorf("error %q does not name DBURL", err)
+			}
+		})
+	}
+}
+
+// startDatabase starts a Database for dbURL the way the server does.
+// It returns the error that stopped it from starting, if any.
+func startDatabase(t *testing.T, dbURL string) (*db.Database, error) {
+	t.Helper()
+
+	lifecycle := fxtest.NewLifecycle(t)
+
+	log, err := logger.New(lifecycle, logger.Params{
+		Globals: &globals.Globals{},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	database, err := db.New(lifecycle, db.Params{
+		Logger: log,
+		Config: &config.Config{DBURL: dbURL},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(lifecycle.RequireStop)
+
+	return database, lifecycle.Start(t.Context())
+}
+
+// queryInt runs a query that returns a single number.
+func queryInt(t *testing.T, database *db.Database, query string) int {
+	t.Helper()
+
+	var result int
+
+	err := database.GetDB().QueryRowContext(t.Context(), query).Scan(&result)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return result
+}

internal/db/errors.go

@@ -17,3 +17,14 @@ func IsUniqueConstraintError(err error) bool {
 
 	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_UNIQUE
 }
+
+// IsForeignKeyConstraintError reports whether err is a
+// SQLite foreign-key constraint violation.
+func IsForeignKeyConstraintError(err error) bool {
+	var sqliteErr *sqlite.Error
+	if !errors.As(err, &sqliteErr) {
+		return false
+	}
+
+	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_FOREIGNKEY
+}

internal/db/export_test.go

@@ -5,21 +5,16 @@ import (
 	"database/sql"
 	"fmt"
 	"log/slog"
-	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/neoirc/internal/dbtest"
 )
 
-//nolint:gochecknoglobals // test counter
-var testDBCounter atomic.Int64
-
 // NewTestDatabase creates an in-memory database for testing.
-func NewTestDatabase() (*Database, error) {
-	counter := testDBCounter.Add(1)
+func NewTestDatabase(tb testing.TB) (*Database, error) {
+	tb.Helper()
 
-	dsn := fmt.Sprintf(
-		"file:testdb%d?mode=memory"+
-			"&cache=shared&_pragma=foreign_keys(1)",
-		counter,
-	)
+	dsn := dbtest.NewURL(tb) + "&_pragma=foreign_keys(1)"
 
 	conn, err := sql.Open("sqlite", dsn)
 	if err != nil {
@@ -59,10 +54,8 @@ func (database *Database) Close() error {
 	return nil
 }
 
-// ExecForTest runs a raw statement against the test
-// database.  Tests use it to install SQLite triggers that
-// force a specific write to fail, so that the atomicity of
-// multi-statement helpers can be exercised.
+// ExecForTest runs a raw statement, such as a trigger that
+// makes a write fail.
 func (database *Database) ExecForTest(
 	ctx context.Context,
 	query string,

internal/db/queries_test.go

@@ -2,6 +2,7 @@ package db_test
 
 import (
 	"encoding/json"
+	"slices"
 	"testing"
 
 	"sneak.berlin/go/neoirc/internal/db"
@@ -12,7 +13,7 @@ import (
 func setupTestDB(t *testing.T) *db.Database {
 	t.Helper()
 
-	database, err := db.NewTestDatabase()
+	database, err := db.NewTestDatabase(t)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -411,7 +412,7 @@ func TestJoinAndPart(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = database.PartChannel(ctx, chID, sid)
+	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -422,7 +423,10 @@ func TestJoinAndPart(t *testing.T) {
 	}
 }
 
-func TestDeleteChannelIfEmpty(t *testing.T) {
+// TestPartChannelAndDeleteIfEmpty checks that a part keeps
+// a channel another session is still on and deletes the
+// channel when its last member parts.
+func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
@@ -435,22 +439,34 @@ func TestDeleteChannelIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	sid, _, _, err := database.CreateSession(ctx, "temp", "", "", "")
+	nicks := []string{"temp1", "temp2"}
+	sids := make([]int64, 0, len(nicks))
+
+	for _, nick := range nicks {
+		sid, _, _, createErr := database.CreateSession(ctx, nick, "", "", "")
+		if createErr != nil {
+			t.Fatal(createErr)
+		}
+
+		err = database.JoinChannel(ctx, chID, sid)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		sids = append(sids, sid)
+	}
+
+	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sids[0])
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.JoinChannel(ctx, chID, sid)
+	_, err = database.GetChannelByName(ctx, "#empty")
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("channel deleted while a member is on it: %v", err)
 	}
 
-	err = database.PartChannel(ctx, chID, sid)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = database.DeleteChannelIfEmpty(ctx, chID)
+	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sids[1])
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -619,7 +635,7 @@ func TestInsertMessage(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, msgUUID, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
+		ctx, "PRIVMSG", "poller", "#test", 0, 0, nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -653,13 +669,13 @@ func TestPollMessages(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
+		ctx, "PRIVMSG", "poller", "#test", 0, 0, nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.EnqueueToSession(ctx, sid, dbID)
+	err = database.EnqueueToSession(ctx, sid, dbID, 0)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -706,11 +722,16 @@ func TestGetHistory(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
+	chID, err := database.GetOrCreateChannel(ctx, "#hist")
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	const msgCount = 10
 
 	for range msgCount {
-		_, _, err := database.InsertMessage(
-			ctx, "PRIVMSG", "user", "#hist",
+		_, _, err = database.InsertMessage(
+			ctx, "PRIVMSG", "user", "#hist", 0, chID,
 			nil, json.RawMessage(`["msg"]`), nil,
 		)
 		if err != nil {
@@ -721,7 +742,7 @@ func TestGetHistory(t *testing.T) {
 	const histLimit = 5
 
 	msgs, err := database.GetHistory(
-		ctx, "#hist", 0, histLimit,
+		ctx, 0, chID, "", histLimit,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -737,44 +758,209 @@ func TestGetHistory(t *testing.T) {
 	}
 }
 
-func TestDeleteSession(t *testing.T) {
+// TestGetHistoryReusedNames checks that history follows the
+// session and the channel row, not the nick or the channel
+// name: a session that takes a released nick, and a channel
+// created again under a deleted one's name, start with none.
+func TestGetHistoryReusedNames(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	sid, _, _, err := database.CreateSession(
-		ctx, "deleteme", "", "", "",
+	historyLen := func(toSessionID, toChannelID int64) int {
+		t.Helper()
+
+		msgs, err := database.GetHistory(
+			ctx, toSessionID, toChannelID, "", 0,
+		)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		return len(msgs)
+	}
+
+	oldSID, _, _, err := database.CreateSession(
+		ctx, "reused", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	chID, err := database.GetOrCreateChannel(
-		ctx, "#delchan",
+	oldChID, err := database.GetOrCreateChannel(ctx, "#reused")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = database.JoinChannel(ctx, oldChID, oldSID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	body := json.RawMessage(`["hi"]`)
+
+	_, _, err = database.InsertMessage(
+		ctx, "PRIVMSG", "sender", "reused", oldSID, 0,
+		nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.JoinChannel(ctx, chID, sid)
+	_, _, err = database.InsertMessage(
+		ctx, "PRIVMSG", "sender", "#reused", 0, oldChID,
+		nil, body, nil,
+	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.DeleteSession(ctx, sid)
+	if historyLen(oldSID, 0) != 1 || historyLen(0, oldChID) != 1 {
+		t.Fatal("expected one DM and one channel message")
+	}
+
+	// The session is the channel's only member, so quitting
+	// deletes the channel too.
+	_, err = database.QuitSession(ctx, oldSID, "reused", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 
+	newSID, _, _, err := database.CreateSession(
+		ctx, "reused", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	newChID, err := database.GetOrCreateChannel(ctx, "#reused")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if historyLen(newSID, 0) != 0 || historyLen(0, newChID) != 0 {
+		t.Fatal("expected no history for the names' new holders")
+	}
+}
+
+// TestQuitSession checks that QuitSession deletes the
+// session, keeps a channel another session is still on,
+// deletes a channel it leaves with no members, and queues
+// one QUIT to the other session; and that a second call for
+// the same session changes nothing.
+func TestQuitSession(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sid, sharedID, _ := createSessionWithChannels(
+		t, database, "deleteme", "#shared", "#alone",
+	)
+
+	peerSID, peerClientID, _, err := database.CreateSession(
+		ctx, "peer", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = database.JoinChannel(ctx, sharedID, peerSID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	body := json.RawMessage(`["bye"]`)
+
+	peerIDs, err := database.QuitSession(ctx, sid, "deleteme", body)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !slices.Equal(peerIDs, []int64{peerSID}) {
+		t.Fatalf("got peers %v, want [%d]", peerIDs, peerSID)
+	}
+
 	_, err = database.GetSessionByNick(ctx, "deleteme")
 	if err == nil {
 		t.Fatal("session should be deleted")
 	}
 
-	ids, _ := database.GetChannelMemberIDs(ctx, chID)
-	if len(ids) != 0 {
-		t.Fatal("expected no members after deletion")
+	ids, _ := database.GetChannelMemberIDs(ctx, sharedID)
+	if !slices.Equal(ids, []int64{peerSID}) {
+		t.Fatalf("#shared members: got %v, want [%d]", ids, peerSID)
+	}
+
+	_, err = database.GetChannelByName(ctx, "#alone")
+	if err == nil {
+		t.Fatal("expected the emptied channel to be deleted")
+	}
+
+	checkOneQuitQueued(t, database, peerClientID, "deleteme")
+
+	peerIDs, err = database.QuitSession(ctx, sid, "deleteme", body)
+	if err != nil || len(peerIDs) != 0 {
+		t.Fatalf("second quit: got %v, %v; want none", peerIDs, err)
+	}
+
+	checkOneQuitQueued(t, database, peerClientID, "deleteme")
+}
+
+// checkOneQuitQueued fails the test unless the queue of the
+// client clientID holds one message, a QUIT from nick.
+func checkOneQuitQueued(
+	t *testing.T,
+	database *db.Database,
+	clientID int64,
+	nick string,
+) {
+	t.Helper()
+
+	msgs, _, err := database.PollMessages(t.Context(), clientID, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(msgs) != 1 || msgs[0].Command != "QUIT" || msgs[0].From != nick {
+		t.Fatalf("queue: got %v, want one QUIT from %s", msgs, nick)
+	}
+}
+
+// TestLogoutClientFailureKeepsClient checks that when the
+// session of a logout's last client cannot be deleted,
+// LogoutClient fails and the client stays logged in.
+func TestLogoutClientFailureKeepsClient(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sid, clientID, token, err := database.CreateSession(
+		ctx, "stuck", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = database.GetDB().ExecContext(ctx,
+		`CREATE TRIGGER keep_sessions
+		 BEFORE DELETE ON sessions
+		 BEGIN
+		   SELECT RAISE(ABORT, 'sessions are kept');
+		 END`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = database.LogoutClient(ctx, sid, clientID, "stuck", nil)
+	if err == nil {
+		t.Fatal("logout succeeded although the session was kept")
+	}
+
+	_, _, nick, err := database.GetSessionByToken(ctx, token)
+	if err != nil || nick != "stuck" {
+		t.Fatalf("client gone after a failed logout: %q, %v", nick, err)
 	}
 }
 
@@ -863,7 +1049,7 @@ func TestEnqueueToClient(t *testing.T) {
 	body := json.RawMessage(`["test"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "#ch", nil, body, nil,
+		ctx, "PRIVMSG", "sender", "#ch", 0, 0, nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -1253,17 +1439,6 @@ func TestChannelInviteCRUD(t *testing.T) {
 	if !has {
 		t.Fatal("should have invite")
 	}
-
-	// Clear invite.
-	err = database.ClearChannelInvite(ctx, chID, sid)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	has, _ = database.HasChannelInvite(ctx, chID, sid)
-	if has {
-		t.Fatal("invite should be cleared")
-	}
 }
 
 func TestChannelSecret(t *testing.T) {
@@ -1492,13 +1667,9 @@ func TestChannelUserLimit(t *testing.T) {
 	}
 }
 
-// TestSetSessionUserModesIsAtomic proves that a multi-mode
-// change is all-or-nothing.  A trigger makes the is_oper
-// UPDATE fail after the is_wallops UPDATE has already run,
-// which is exactly the "+w-o" partial-failure the previous
-// implementation exhibited: it issued the two UPDATEs
-// independently, so +w persisted while the caller reported
-// total failure.
+// TestSetSessionUserModesIsAtomic makes the is_oper write
+// fail after the is_wallops write has run, and checks that
+// the wallops change was rolled back.
 func TestSetSessionUserModesIsAtomic(t *testing.T) {
 	t.Parallel()
 
@@ -1540,16 +1711,12 @@ func TestSetSessionUserModesIsAtomic(t *testing.T) {
 	}
 
 	if gotWallops {
-		t.Error(
-			"wallops persisted despite the transaction " +
-				"failing; the apply stage is not atomic",
-		)
+		t.Error("wallops was stored although the change failed")
 	}
 }
 
-// TestSetSessionUserModesAppliesBoth is the success-path
-// counterpart: when nothing fails, both flags are written,
-// and a nil pointer leaves that flag untouched.
+// TestSetSessionUserModesAppliesBoth checks that both flags
+// are written, and that a nil flag is left as it is.
 func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 	t.Parallel()
 
@@ -1563,18 +1730,18 @@ func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := database.SetSessionOper(
-		ctx, sessionID, true,
-	); err != nil {
+	err = database.SetSessionOper(ctx, sessionID, true)
+	if err != nil {
 		t.Fatal(err)
 	}
 
 	wallops := true
 	oper := false
 
-	if err := database.SetSessionUserModes(
+	err = database.SetSessionUserModes(
 		ctx, sessionID, &wallops, &oper,
-	); err != nil {
+	)
+	if err != nil {
 		t.Fatal(err)
 	}
 
@@ -1597,10 +1764,10 @@ func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 		)
 	}
 
-	// A nil pointer must leave the stored value alone.
-	if err := database.SetSessionUserModes(
+	err = database.SetSessionUserModes(
 		ctx, sessionID, nil, nil,
-	); err != nil {
+	)
+	if err != nil {
 		t.Fatal(err)
 	}
 
@@ -1612,6 +1779,6 @@ func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 	}
 
 	if !gotWallops {
-		t.Error("nil pointers must not clear wallops")
+		t.Error("a nil wallops flag cleared wallops")
 	}
 }

internal/db/schema/001_initial.sql

@@ -85,19 +85,25 @@ CREATE TABLE IF NOT EXISTS channel_members (
     UNIQUE(channel_id, session_id)
 );
 
--- Messages: IRC envelope format
+-- Messages: IRC envelope format. to_session_id is the session a DM
+-- or INVITE was sent to, to_channel_id the channel a channel message
+-- was sent to. History is selected by these ids because nicks and
+-- channel names are reused once released, and ids are not.
 CREATE TABLE IF NOT EXISTS messages (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     uuid TEXT NOT NULL UNIQUE,
     command TEXT NOT NULL DEFAULT 'PRIVMSG',
     msg_from TEXT NOT NULL DEFAULT '',
     msg_to TEXT NOT NULL DEFAULT '',
+    to_session_id INTEGER REFERENCES sessions(id) ON DELETE SET NULL,
+    to_channel_id INTEGER REFERENCES channels(id) ON DELETE SET NULL,
     params TEXT NOT NULL DEFAULT '[]',
     body TEXT NOT NULL DEFAULT '[]',
     meta TEXT NOT NULL DEFAULT '{}',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
-CREATE INDEX IF NOT EXISTS idx_messages_to_id ON messages(msg_to, id);
+CREATE INDEX IF NOT EXISTS idx_messages_to_session ON messages(to_session_id, id);
+CREATE INDEX IF NOT EXISTS idx_messages_to_channel ON messages(to_channel_id, id);
 CREATE INDEX IF NOT EXISTS idx_messages_created ON messages(created_at);
 
 -- Spent hashcash tokens for replay prevention (1-year TTL)

internal/dbtest/dbtest.go

@@ -0,0 +1,39 @@
+// Package dbtest gives each test a database of its own. Only tests
+// may import it.
+package dbtest
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"testing"
+
+	_ "modernc.org/sqlite" // registers the sqlite driver
+)
+
+// NewURL returns the URL of a new, empty in-memory database for one
+// test. SQLite deletes an in-memory database when its last connection
+// closes. A pool closes a connection when a query on it is cancelled
+// while it runs. So this function holds a connection of its own open
+// until the test ends.
+func NewURL(tb testing.TB) string {
+	tb.Helper()
+
+	// A random name, so that no other test can share the database.
+	dbURL := "file:" + rand.Text() + "?mode=memory&cache=shared"
+
+	pool, err := sql.Open("sqlite", dbURL)
+	if err != nil {
+		tb.Fatalf("open test database: %v", err)
+	}
+
+	tb.Cleanup(func() { _ = pool.Close() })
+
+	conn, err := pool.Conn(tb.Context())
+	if err != nil {
+		tb.Fatalf("connect to test database: %v", err)
+	}
+
+	tb.Cleanup(func() { _ = conn.Close() })
+
+	return dbURL
+}

internal/handlers/api.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -14,24 +15,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/hashcash"
 	"sneak.berlin/go/neoirc/internal/service"
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-var (
-	errHashcashRequired = errors.New("hashcash required")
-	errHashcashReused   = errors.New("hashcash reused")
-)
-
-var validNickRe = regexp.MustCompile(
-	`^[a-zA-Z_][a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{0,31}$`,
-)
-
-var validChannelRe = regexp.MustCompile(
-	`^#[a-zA-Z0-9_\-]{1,63}$`,
-)
-
 var validUsernameRe = regexp.MustCompile(
 	`^[a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{1,32}$`,
 )
@@ -212,7 +199,7 @@ func (hdlr *Handlers) handleCreateSession(
 		return
 	}
 
-	if !hdlr.validateHashcash(
+	if !hdlr.checkHashcash(
 		writer, request, payload.Hashcash,
 	) {
 		return
@@ -220,7 +207,7 @@ func (hdlr *Handlers) handleCreateSession(
 
 	payload.Nick = strings.TrimSpace(payload.Nick)
 
-	if !validNickRe.MatchString(payload.Nick) {
+	if !service.ValidNick(payload.Nick) {
 		hdlr.respondError(
 			writer, request,
 			"invalid nick format",
@@ -245,14 +232,15 @@ func (hdlr *Handlers) handleCreateSession(
 	}
 
 	hdlr.executeCreateSession(
-		writer, request, payload.Nick, username,
+		writer, request,
+		payload.Nick, username, payload.Hashcash,
 	)
 }
 
 func (hdlr *Handlers) executeCreateSession(
 	writer http.ResponseWriter,
 	request *http.Request,
-	nick, username string,
+	nick, username, stamp string,
 ) {
 	remoteIP := clientIP(request)
 
@@ -260,12 +248,17 @@ func (hdlr *Handlers) executeCreateSession(
 		request.Context(), remoteIP,
 	)
 
+	if !hdlr.claimHashcash(writer, request, stamp) {
+		return
+	}
+
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.CreateSession(
 			request.Context(),
 			nick, username, hostname, remoteIP,
 		)
 	if err != nil {
+		hdlr.hashcashVal.Release(stamp)
 		hdlr.handleCreateSessionError(
 			writer, request, err,
 		)
@@ -286,10 +279,10 @@ func (hdlr *Handlers) executeCreateSession(
 	}, http.StatusCreated)
 }
 
-// validateHashcash validates a hashcash stamp if required.
-// Returns false if validation failed and a response was
-// already sent.
-func (hdlr *Handlers) validateHashcash(
+// checkHashcash checks a hashcash stamp if required,
+// without spending it. Returns false if the check failed
+// and a response was already sent.
+func (hdlr *Handlers) checkHashcash(
 	writer http.ResponseWriter,
 	request *http.Request,
 	stamp string,
@@ -308,7 +301,31 @@ func (hdlr *Handlers) validateHashcash(
 		return false
 	}
 
-	err := hdlr.hashcashVal.Validate(
+	err := hdlr.hashcashVal.Check(
+		stamp, hdlr.params.Config.HashcashBits,
+	)
+	if err != nil {
+		hdlr.respondError(
+			writer, request,
+			"invalid hashcash stamp: "+err.Error(),
+			http.StatusPaymentRequired,
+		)
+
+		return false
+	}
+
+	return true
+}
+
+// claimHashcash spends a stamp that checkHashcash accepted.
+// Returns false if Claim refused the stamp, normally because
+// it was already spent, and a response was already sent.
+func (hdlr *Handlers) claimHashcash(
+	writer http.ResponseWriter,
+	request *http.Request,
+	stamp string,
+) bool {
+	err := hdlr.hashcashVal.Claim(
 		stamp, hdlr.params.Config.HashcashBits,
 	)
 	if err != nil {
@@ -579,7 +596,7 @@ func (hdlr *Handlers) enqueueNumeric(
 	}
 
 	dbID, _, insertErr := hdlr.params.Database.InsertMessage(
-		ctx, command, hdlr.serverName(), nick,
+		ctx, command, hdlr.serverName(), nick, 0, 0,
 		paramsJSON, json.RawMessage(body), nil,
 	)
 	if insertErr != nil {
@@ -665,7 +682,7 @@ func (hdlr *Handlers) initChannelState(
 		dbID, _, insErr := hdlr.params.Database.
 			InsertMessage(
 				ctx, "JOIN", nick, chanInfo.Name,
-				nil, nil, nil,
+				0, chanInfo.ID, nil, nil, nil,
 			)
 		if insErr != nil {
 			hdlr.log.Error(
@@ -796,7 +813,14 @@ func (hdlr *Handlers) HandleGetMessages() http.HandlerFunc {
 			timeout = maxLongPollTimeout
 		}
 
-		msgs, lastQID, err := hdlr.params.Database.PollMessages(
+		// Register with the broker before reading the queue.
+		// Notify wakes only the channels registered at that
+		// moment, so a message queued after the read below
+		// must find this one there already.
+		waitCh := hdlr.broker.Wait(sessionID)
+		defer hdlr.broker.Remove(sessionID, waitCh)
+
+		msgs, lastQID, err := hdlr.pollMessages(
 			request.Context(), clientID,
 			afterID, pollMessageLimit,
 		)
@@ -824,19 +848,22 @@ func (hdlr *Handlers) HandleGetMessages() http.HandlerFunc {
 
 		hdlr.longPoll(
 			writer, request,
-			sessionID, clientID, afterID, timeout,
+			waitCh, clientID, afterID, timeout,
 		)
 	}
 }
 
+// longPoll waits up to timeout seconds for the broker to
+// signal waitCh, then answers with the messages queued for
+// clientID after afterID. It answers nothing if the client
+// goes away first.
 func (hdlr *Handlers) longPoll(
 	writer http.ResponseWriter,
 	request *http.Request,
-	sessionID, clientID, afterID int64,
+	waitCh <-chan struct{},
+	clientID, afterID int64,
 	timeout int,
 ) {
-	waitCh := hdlr.broker.Wait(sessionID)
-
 	timer := time.NewTimer(
 		time.Duration(timeout) * time.Second,
 	)
@@ -847,14 +874,10 @@ func (hdlr *Handlers) longPoll(
 	case <-waitCh:
 	case <-timer.C:
 	case <-request.Context().Done():
-		hdlr.broker.Remove(sessionID, waitCh)
-
 		return
 	}
 
-	hdlr.broker.Remove(sessionID, waitCh)
-
-	msgs, lastQID, err := hdlr.params.Database.PollMessages(
+	msgs, lastQID, err := hdlr.pollMessages(
 		request.Context(), clientID,
 		afterID, pollMessageLimit,
 	)
@@ -962,12 +985,10 @@ func (hdlr *Handlers) dispatchCommand(
 	bodyLines func() []string,
 ) {
 	switch command {
-	case irc.CmdAway, irc.CmdNick,
-		irc.CmdPass, irc.CmdInvite:
-		hdlr.dispatchBodyOnlyCommand(
+	case irc.CmdAway:
+		hdlr.handleAway(
 			writer, request,
-			sessionID, clientID, nick,
-			command, bodyLines,
+			sessionID, clientID, nick, bodyLines,
 		)
 	case irc.CmdPrivmsg, irc.CmdNotice:
 		hdlr.handlePrivmsg(
@@ -986,12 +1007,27 @@ func (hdlr *Handlers) dispatchCommand(
 			writer, request,
 			sessionID, clientID, nick, target, body,
 		)
+	case irc.CmdNick:
+		hdlr.handleNick(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdPass:
+		hdlr.handlePass(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
 	case irc.CmdTopic:
 		hdlr.handleTopic(
 			writer, request,
 			sessionID, clientID, nick,
 			target, body, bodyLines,
 		)
+	case irc.CmdInvite:
+		hdlr.handleInvite(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
 	case irc.CmdKick:
 		hdlr.handleKick(
 			writer, request,
@@ -1005,12 +1041,9 @@ func (hdlr *Handlers) dispatchCommand(
 	case irc.CmdOper, irc.CmdKill, irc.CmdWallops:
 		hdlr.dispatchOperCommand(
 			writer, request,
-			sessionID, clientID, nick,
-			command, bodyLines,
+			sessionID, clientID, nick, command, bodyLines,
 		)
-	case irc.CmdMotd, irc.CmdPing,
-		irc.CmdVersion, irc.CmdAdmin,
-		irc.CmdInfo, irc.CmdTime:
+	case irc.CmdMotd, irc.CmdPing:
 		hdlr.dispatchInfoCommand(
 			writer, request,
 			sessionID, clientID, nick,
@@ -1070,6 +1103,22 @@ func (hdlr *Handlers) dispatchQueryCommand(
 			writer, request,
 			sessionID, clientID, nick, bodyLines,
 		)
+	case irc.CmdVersion:
+		hdlr.handleVersion(
+			writer, request, sessionID, clientID, nick,
+		)
+	case irc.CmdAdmin:
+		hdlr.handleAdmin(
+			writer, request, sessionID, clientID, nick,
+		)
+	case irc.CmdInfo:
+		hdlr.handleInfo(
+			writer, request, sessionID, clientID, nick,
+		)
+	case irc.CmdTime:
+		hdlr.handleTime(
+			writer, request, sessionID, clientID, nick,
+		)
 	default:
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
@@ -1208,26 +1257,11 @@ func (hdlr *Handlers) handleChannelMsg(
 ) {
 	ctx := request.Context()
 
-	// Hashcash validation is HTTP-specific; needs chID.
-	isNotice := command == irc.CmdNotice
-
-	if !isNotice {
-		chID, chErr := hdlr.params.Database.
-			GetChannelByName(ctx, target)
-		if chErr == nil {
-			hashcashErr := hdlr.validateChannelHashcash(
-				request, clientID, sessionID,
-				writer, nick, target, body, meta, chID,
-			)
-			if hashcashErr != nil {
-				return
-			}
-		}
-	}
-
-	// Delegate validation + fan-out to service layer.
-	dbID, uuid, err := hdlr.svc.SendChannelMessage(
-		ctx, sessionID, nick,
+	// Delegate validation + fan-out to service layer. The
+	// fan-out includes the sender's own session, so all
+	// their clients see the message in long-poll responses.
+	uuid, err := hdlr.svc.SendChannelMessage(
+		ctx, sessionID, 0, nick,
 		command, target, body, meta,
 	)
 	if hdlr.handleServiceError(
@@ -1237,172 +1271,11 @@ func (hdlr *Handlers) handleChannelMsg(
 		return
 	}
 
-	// HTTP echo: enqueue to sender so all their clients
-	// see the message in long-poll responses.
-	_ = hdlr.params.Database.EnqueueToSession(
-		ctx, sessionID, dbID,
-	)
-	hdlr.broker.Notify(sessionID)
-
 	hdlr.respondJSON(writer, request,
 		map[string]string{"id": uuid, statusKey: "sent"},
 		http.StatusOK)
 }
 
-// validateChannelHashcash checks whether the channel
-// requires hashcash proof-of-work for messages and
-// validates the stamp from the message meta field.
-// Returns nil on success or if the channel has no
-// hashcash requirement. On failure, it sends the
-// appropriate IRC error and returns a non-nil error.
-func (hdlr *Handlers) validateChannelHashcash(
-	request *http.Request,
-	clientID, sessionID int64,
-	writer http.ResponseWriter,
-	nick, target string,
-	body json.RawMessage,
-	meta json.RawMessage,
-	chID int64,
-) error {
-	ctx := request.Context()
-
-	bits, bitsErr := hdlr.params.Database.GetChannelHashcashBits(
-		ctx, chID,
-	)
-	if bitsErr != nil {
-		hdlr.log.Error(
-			"get channel hashcash bits", "error", bitsErr,
-		)
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
-		)
-
-		return fmt.Errorf("channel hashcash bits: %w", bitsErr)
-	}
-
-	if bits <= 0 {
-		return nil
-	}
-
-	stamp := hdlr.extractHashcashFromMeta(meta)
-	if stamp == "" {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrCannotSendToChan, nick, []string{target},
-			"Channel requires hashcash proof-of-work",
-		)
-
-		return errHashcashRequired
-	}
-
-	return hdlr.verifyChannelStamp(
-		request, writer,
-		clientID, sessionID,
-		nick, target, body, stamp, bits,
-	)
-}
-
-// verifyChannelStamp validates a channel hashcash stamp
-// and checks for replay attacks.
-func (hdlr *Handlers) verifyChannelStamp(
-	request *http.Request,
-	writer http.ResponseWriter,
-	clientID, sessionID int64,
-	nick, target string,
-	body json.RawMessage,
-	stamp string,
-	bits int,
-) error {
-	ctx := request.Context()
-	bodyHashStr := hashcash.BodyHash(body)
-
-	valErr := hdlr.channelHashcash.ValidateStamp(
-		stamp, bits, target, bodyHashStr,
-	)
-	if valErr != nil {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrCannotSendToChan, nick, []string{target},
-			"Invalid hashcash: "+valErr.Error(),
-		)
-
-		return fmt.Errorf("channel hashcash: %w", valErr)
-	}
-
-	stampKey := hashcash.StampHash(stamp)
-
-	spent, spentErr := hdlr.params.Database.IsHashcashSpent(
-		ctx, stampKey,
-	)
-	if spentErr != nil {
-		hdlr.log.Error(
-			"check spent hashcash", "error", spentErr,
-		)
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
-		)
-
-		return fmt.Errorf("check spent hashcash: %w", spentErr)
-	}
-
-	if spent {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrCannotSendToChan, nick, []string{target},
-			"Hashcash stamp already used",
-		)
-
-		return errHashcashReused
-	}
-
-	recordErr := hdlr.params.Database.RecordSpentHashcash(
-		ctx, stampKey,
-	)
-	if recordErr != nil {
-		hdlr.log.Error(
-			"record spent hashcash", "error", recordErr,
-		)
-	}
-
-	return nil
-}
-
-// extractHashcashFromMeta parses the meta JSON and
-// returns the hashcash stamp string, or empty string
-// if not present.
-func (hdlr *Handlers) extractHashcashFromMeta(
-	meta json.RawMessage,
-) string {
-	if len(meta) == 0 {
-		return ""
-	}
-
-	var metaMap map[string]json.RawMessage
-
-	err := json.Unmarshal(meta, &metaMap)
-	if err != nil {
-		return ""
-	}
-
-	raw, ok := metaMap["hashcash"]
-	if !ok {
-		return ""
-	}
-
-	var stamp string
-
-	err = json.Unmarshal(raw, &stamp)
-	if err != nil {
-		return ""
-	}
-
-	return stamp
-}
-
 func (hdlr *Handlers) handleDirectMsg(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -1412,7 +1285,7 @@ func (hdlr *Handlers) handleDirectMsg(
 	meta json.RawMessage,
 ) {
 	result, err := hdlr.svc.SendDirectMessage(
-		request.Context(), sessionID, nick,
+		request.Context(), sessionID, 0, nick,
 		command, target, body, meta,
 	)
 	if hdlr.handleServiceError(
@@ -1462,16 +1335,6 @@ func (hdlr *Handlers) handleJoin(
 		channel = "#" + channel
 	}
 
-	if !validChannelRe.MatchString(channel) {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNoSuchChannel, nick, []string{channel},
-			"No such channel",
-		)
-
-		return
-	}
-
 	// Extract key from body lines (JOIN #channel key).
 	var suppliedKey string
 
@@ -1493,7 +1356,7 @@ func (hdlr *Handlers) executeJoin(
 	nick, channel, suppliedKey string,
 ) {
 	result, err := hdlr.svc.JoinChannel(
-		request.Context(), sessionID, nick,
+		request.Context(), sessionID, 0, nick,
 		channel, suppliedKey,
 	)
 	if hdlr.handleServiceError(
@@ -1677,7 +1540,7 @@ func (hdlr *Handlers) handlePart(
 	}
 
 	err := hdlr.svc.PartChannel(
-		request.Context(), sessionID,
+		request.Context(), sessionID, 0,
 		nick, channel, reason,
 	)
 	if hdlr.handleServiceError(
@@ -1715,7 +1578,7 @@ func (hdlr *Handlers) handleNick(
 
 	newNick := strings.TrimSpace(lines[0])
 
-	if !validNickRe.MatchString(newNick) {
+	if !service.ValidNick(newNick) {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrErroneusNickname, nick, []string{newNick},
@@ -1748,7 +1611,7 @@ func (hdlr *Handlers) executeNickChange(
 	nick, newNick string,
 ) {
 	err := hdlr.svc.ChangeNick(
-		request.Context(), sessionID, nick, newNick,
+		request.Context(), sessionID, 0, nick, newNick,
 	)
 	if hdlr.handleServiceError(
 		writer, request,
@@ -1803,7 +1666,7 @@ func (hdlr *Handlers) handleTopic(
 	topic := strings.Join(lines, " ")
 
 	err := hdlr.svc.SetTopic(
-		request.Context(), sessionID,
+		request.Context(), sessionID, 0,
 		nick, channel, topic,
 	)
 	if hdlr.handleServiceError(
@@ -1863,8 +1726,7 @@ func (hdlr *Handlers) deliverSetTopicNumerics(
 }
 
 // dispatchInfoCommand handles informational IRC commands
-// that produce server-side numerics (MOTD, PING,
-// VERSION, ADMIN, INFO, TIME).
+// that produce server-side numerics (MOTD, PING).
 func (hdlr *Handlers) dispatchInfoCommand(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -1890,34 +1752,6 @@ func (hdlr *Handlers) dispatchInfoCommand(
 			},
 			http.StatusOK)
 
-		return
-	case irc.CmdVersion:
-		hdlr.handleVersion(
-			writer, request,
-			sessionID, clientID, nick,
-		)
-
-		return
-	case irc.CmdAdmin:
-		hdlr.handleAdmin(
-			writer, request,
-			sessionID, clientID, nick,
-		)
-
-		return
-	case irc.CmdInfo:
-		hdlr.handleInfo(
-			writer, request,
-			sessionID, clientID, nick,
-		)
-
-		return
-	case irc.CmdTime:
-		hdlr.handleTime(
-			writer, request,
-			sessionID, clientID, nick,
-		)
-
 		return
 	}
 
@@ -1954,8 +1788,9 @@ func (hdlr *Handlers) handleQuit(
 		http.StatusOK)
 }
 
-// handleMode handles the MODE command for channels and
-// users. Currently supports query-only (no mode changes).
+// handleMode handles the MODE command: a target that starts
+// with # is a channel, handled by handleChannelMode, and any
+// other target a nick, handled by handleUserMode.
 func (hdlr *Handlers) handleMode(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -2317,7 +2152,7 @@ func (hdlr *Handlers) applyUserMode(
 
 	modeText := modeArgs[0] + " " + targetNick
 	hdlr.svc.BroadcastMode(
-		request.Context(), nick, channel, chID,
+		request.Context(), 0, nick, channel, chID,
 		modeText,
 	)
 
@@ -2363,7 +2198,7 @@ func (hdlr *Handlers) setChannelFlag(
 	}
 
 	hdlr.svc.BroadcastMode(
-		request.Context(), nick, channel, chID,
+		request.Context(), 0, nick, channel, chID,
 		modeStr,
 	)
 
@@ -2600,7 +2435,7 @@ func (hdlr *Handlers) executeBanChange(
 	)
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel,
+			request, irc.CmdMode, nick, channel, 0, chID,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2718,7 +2553,7 @@ func (hdlr *Handlers) setChannelKeyMode(
 	modeBody, mErr := json.Marshal([]string{"+k", key})
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel,
+			request, irc.CmdMode, nick, channel, 0, chID,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2767,7 +2602,7 @@ func (hdlr *Handlers) clearChannelKeyMode(
 	modeBody, mErr := json.Marshal([]string{"-k", "*"})
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel,
+			request, irc.CmdMode, nick, channel, 0, chID,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2842,7 +2677,7 @@ func (hdlr *Handlers) setChannelLimitMode(
 	)
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel,
+			request, irc.CmdMode, nick, channel, 0, chID,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2892,7 +2727,7 @@ func (hdlr *Handlers) clearChannelLimitMode(
 	modeBody, mErr := json.Marshal([]string{"-l"})
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel,
+			request, irc.CmdMode, nick, channel, 0, chID,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2929,123 +2764,15 @@ func (hdlr *Handlers) handleInvite(
 		channel = "#" + channel
 	}
 
-	chID, targetSID, ok := hdlr.validateInvite(
-		writer, request,
-		sessionID, clientID, nick,
-		targetNick, channel,
-	)
-	if !ok {
-		return
-	}
-
-	hdlr.executeInvite(
-		writer, request,
-		sessionID, clientID, nick,
-		targetNick, channel, chID, targetSID,
-	)
-}
-
-// validateInvite checks channel, membership, permissions,
-// and target for an INVITE command.
-func (hdlr *Handlers) validateInvite(
-	writer http.ResponseWriter,
-	request *http.Request,
-	sessionID, clientID int64,
-	nick, targetNick, channel string,
-) (int64, int64, bool) {
 	ctx := request.Context()
 
-	chID, err := hdlr.params.Database.GetChannelByName(
-		ctx, channel,
+	targetSID, err := hdlr.svc.InviteUser(
+		ctx, sessionID, nick, targetNick, channel,
 	)
-	if err != nil {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNoSuchChannel, nick,
-			[]string{channel}, "No such channel",
-		)
-
-		return 0, 0, false
-	}
-
-	isMember, memErr := hdlr.params.Database.IsChannelMember(
-		ctx, chID, sessionID,
-	)
-	if memErr != nil || !isMember {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNotOnChannel, nick,
-			[]string{channel},
-			"You're not on that channel",
-		)
-
-		return 0, 0, false
-	}
-
-	isInviteOnly, ioErr := hdlr.params.Database.
-		IsChannelInviteOnly(ctx, chID)
-	if ioErr == nil && isInviteOnly {
-		if !hdlr.requireChannelOp(
-			writer, request,
-			sessionID, clientID, nick, channel, chID,
-		) {
-			return 0, 0, false
-		}
-	}
-
-	targetSID, nickErr := hdlr.params.Database.
-		GetSessionByNick(ctx, targetNick)
-	if nickErr != nil {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNoSuchNick, nick,
-			[]string{targetNick},
-			"No such nick/channel",
-		)
-
-		return 0, 0, false
-	}
-
-	alreadyIn, aiErr := hdlr.params.Database.
-		IsChannelMember(ctx, chID, targetSID)
-	if aiErr == nil && alreadyIn {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrUserOnChannel, nick,
-			[]string{targetNick, channel},
-			"is already on channel",
-		)
-
-		return 0, 0, false
-	}
-
-	return chID, targetSID, true
-}
-
-// executeInvite records the invite and sends
-// notifications.
-func (hdlr *Handlers) executeInvite(
-	writer http.ResponseWriter,
-	request *http.Request,
-	sessionID, clientID int64,
-	nick, targetNick, channel string,
-	chID, targetSID int64,
-) {
-	ctx := request.Context()
-
-	invErr := hdlr.params.Database.AddChannelInvite(
-		ctx, chID, targetSID, nick,
-	)
-	if invErr != nil {
-		hdlr.log.Error(
-			"add invite failed", "error", invErr,
-		)
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
-		)
-
+	if hdlr.handleServiceError(
+		writer, request,
+		clientID, sessionID, nick, err,
+	) {
 		return
 	}
 
@@ -3059,7 +2786,7 @@ func (hdlr *Handlers) executeInvite(
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
 			request, irc.CmdInvite, nick, targetNick,
-			json.RawMessage(invBody),
+			targetSID, 0, json.RawMessage(invBody),
 			[]int64{targetSID},
 		)
 	}
@@ -3554,16 +3281,13 @@ func (hdlr *Handlers) HandleGetHistory() http.HandlerFunc {
 			return
 		}
 
-		if !hdlr.canAccessHistory(
+		toSessionID, toChannelID, ok := hdlr.canAccessHistory(
 			writer, request, sessionID, nick, target,
-		) {
+		)
+		if !ok {
 			return
 		}
 
-		beforeID, _ := strconv.ParseInt(
-			request.URL.Query().Get("before"), 10, 64,
-		)
-
 		limit, _ := strconv.Atoi(
 			request.URL.Query().Get("limit"),
 		)
@@ -3572,8 +3296,19 @@ func (hdlr *Handlers) HandleGetHistory() http.HandlerFunc {
 		}
 
 		msgs, err := hdlr.params.Database.GetHistory(
-			request.Context(), target, beforeID, limit,
+			request.Context(), toSessionID, toChannelID,
+			request.URL.Query().Get("before"), limit,
 		)
+		if errors.Is(err, sql.ErrNoRows) {
+			hdlr.respondError(
+				writer, request,
+				"unknown before id",
+				http.StatusBadRequest,
+			)
+
+			return
+		}
+
 		if err != nil {
 			hdlr.log.Error(
 				"get history failed", "error", err,
@@ -3594,17 +3329,23 @@ func (hdlr *Handlers) HandleGetHistory() http.HandlerFunc {
 }
 
 // canAccessHistory verifies the user can read history
-// for the given target (channel or DM participant).
+// for the given target (channel or DM participant) and
+// returns the session id and channel id to pass to
+// GetHistory: the user's own session for its nick, or the
+// channel's id, with 0 for the other. On false it has
+// written the error response.
 func (hdlr *Handlers) canAccessHistory(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID int64,
 	nick, target string,
-) bool {
+) (int64, int64, bool) {
 	if strings.HasPrefix(target, "#") {
-		return hdlr.canAccessChannelHistory(
+		chID, ok := hdlr.canAccessChannelHistory(
 			writer, request, sessionID, target,
 		)
+
+		return 0, chID, ok
 	}
 
 	// DM history: only allow if the target is the
@@ -3616,18 +3357,20 @@ func (hdlr *Handlers) canAccessHistory(
 			http.StatusForbidden,
 		)
 
-		return false
+		return 0, 0, false
 	}
 
-	return true
+	return sessionID, 0, true
 }
 
+// canAccessChannelHistory returns the id of the channel
+// named target if the user is a member of it.
 func (hdlr *Handlers) canAccessChannelHistory(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID int64,
 	target string,
-) bool {
+) (int64, bool) {
 	chID, err := hdlr.params.Database.GetChannelByName(
 		request.Context(), target,
 	)
@@ -3638,7 +3381,7 @@ func (hdlr *Handlers) canAccessChannelHistory(
 			http.StatusNotFound,
 		)
 
-		return false
+		return 0, false
 	}
 
 	isMember, err := hdlr.params.Database.IsChannelMember(
@@ -3654,7 +3397,7 @@ func (hdlr *Handlers) canAccessChannelHistory(
 			http.StatusInternalServerError,
 		)
 
-		return false
+		return 0, false
 	}
 
 	if !isMember {
@@ -3664,10 +3407,10 @@ func (hdlr *Handlers) canAccessChannelHistory(
 			http.StatusForbidden,
 		)
 
-		return false
+		return 0, false
 	}
 
-	return true
+	return chID, true
 }
 
 // HandleLogout deletes the authenticated client's token
@@ -3683,15 +3426,11 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 			return
 		}
 
-		ctx := request.Context()
-
-		err := hdlr.params.Database.DeleteClient(
-			ctx, clientID,
+		err := hdlr.svc.Logout(
+			request.Context(), sessionID, clientID, nick,
 		)
 		if err != nil {
-			hdlr.log.Error(
-				"delete client failed", "error", err,
-			)
+			hdlr.log.Error("logout failed", "error", err)
 			hdlr.respondError(
 				writer, request,
 				"internal error",
@@ -3701,23 +3440,6 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 			return
 		}
 
-		// If no clients remain, clean up the user fully:
-		// part all channels (notifying members) and
-		// delete the session.
-		remaining, err := hdlr.params.Database.
-			ClientCountForSession(ctx, sessionID)
-		if err != nil {
-			hdlr.log.Error(
-				"client count check failed", "error", err,
-			)
-		}
-
-		if remaining == 0 {
-			hdlr.cleanupUser(
-				ctx, sessionID, nick,
-			)
-		}
-
 		hdlr.clearAuthCookie(writer)
 
 		hdlr.respondJSON(writer, request,
@@ -3923,7 +3645,7 @@ func (hdlr *Handlers) handleKick(
 	}
 
 	err := hdlr.svc.KickUser(
-		request.Context(), sessionID, nick,
+		request.Context(), sessionID, 0, nick,
 		channel, targetNick, reason,
 	)
 	if hdlr.handleServiceError(
@@ -3976,17 +3698,19 @@ func (hdlr *Handlers) deliverWhoisIdle(
 }
 
 // fanOut inserts a message and enqueues it to all given
-// sessions.
+// sessions. toSessionID and toChannelID are the recipient
+// InsertMessage records for history, 0 when there is none.
 func (hdlr *Handlers) fanOut(
 	request *http.Request,
 	command, from, target string,
+	toSessionID, toChannelID int64,
 	body json.RawMessage,
 	meta json.RawMessage,
 	sessionIDs []int64,
 ) (string, error) {
 	dbID, msgUUID, err := hdlr.params.Database.InsertMessage(
 		request.Context(), command, from, target,
-		nil, body, meta,
+		toSessionID, toChannelID, nil, body, meta,
 	)
 	if err != nil {
 		return "", fmt.Errorf("insert message: %w", err)
@@ -3994,7 +3718,7 @@ func (hdlr *Handlers) fanOut(
 
 	for _, sid := range sessionIDs {
 		enqErr := hdlr.params.Database.EnqueueToSession(
-			request.Context(), sid, dbID,
+			request.Context(), sid, dbID, 0,
 		)
 		if enqErr != nil {
 			hdlr.log.Error("enqueue failed",
@@ -4011,12 +3735,13 @@ func (hdlr *Handlers) fanOut(
 func (hdlr *Handlers) fanOutSilent(
 	request *http.Request,
 	command, from, target string,
+	toSessionID, toChannelID int64,
 	body json.RawMessage,
 	sessionIDs []int64,
 ) error {
 	_, err := hdlr.fanOut(
 		request, command, from, target,
-		body, nil, sessionIDs,
+		toSessionID, toChannelID, body, nil, sessionIDs,
 	)
 
 	return err

internal/handlers/auth.go

@@ -8,7 +8,12 @@ import (
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-const minPasswordLength = 8
+// A session password is 8 to 72 bytes; bcrypt cannot hash
+// a longer one.
+const (
+	minPasswordLength = 8
+	maxPasswordLength = 72
+)
 
 // HandleLogin authenticates a user with nick and password.
 func (hdlr *Handlers) HandleLogin() http.HandlerFunc {
@@ -149,12 +154,13 @@ func (hdlr *Handlers) handlePass(
 
 	password := lines[0]
 
-	if len(password) < minPasswordLength {
+	if len(password) < minPasswordLength ||
+		len(password) > maxPasswordLength {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNeedMoreParams, nick,
 			[]string{irc.CmdPass},
-			"Password must be at least 8 characters",
+			"Password must be 8 to 72 bytes",
 		)
 
 		return

internal/handlers/export_test.go

@@ -0,0 +1,19 @@
+package handlers
+
+import (
+	"context"
+
+	"sneak.berlin/go/neoirc/internal/db"
+)
+
+// SetPollMessages makes HandleGetMessages read the client
+// output queue with poll in place of Database.PollMessages.
+func (hdlr *Handlers) SetPollMessages(
+	poll func(
+		ctx context.Context,
+		clientID, afterQueueID int64,
+		limit int,
+	) ([]db.IRCMessage, int64, error),
+) {
+	hdlr.pollMessages = poll
+}

internal/handlers/handlers.go

@@ -55,16 +55,25 @@ const spentHashcashTTL = 365 * 24 * time.Hour
 
 // Handlers manages HTTP request handling.
 type Handlers struct {
-	params          *Params
-	log             *slog.Logger
-	hc              *healthcheck.Healthcheck
-	broker          *broker.Broker
-	svc             *service.Service
-	hashcashVal     *hashcash.Validator
-	channelHashcash *hashcash.ChannelValidator
-	loginLimiter    *ratelimit.Limiter
-	stats           *stats.Tracker
-	cancelCleanup   context.CancelFunc
+	params        *Params
+	log           *slog.Logger
+	hc            *healthcheck.Healthcheck
+	broker        *broker.Broker
+	svc           *service.Service
+	hashcashVal   *hashcash.Validator
+	loginLimiter  *ratelimit.Limiter
+	stats         *stats.Tracker
+	cancelCleanup context.CancelFunc
+
+	// pollMessages is Database.PollMessages, with which
+	// HandleGetMessages reads the client output queue. Tests
+	// replace it to act just after a read, or to make a read
+	// fail.
+	pollMessages func(
+		ctx context.Context,
+		clientID, afterQueueID int64,
+		limit int,
+	) ([]db.IRCMessage, int64, error)
 }
 
 // New creates a new Handlers instance.
@@ -88,15 +97,15 @@ func New(
 	}
 
 	hdlr := &Handlers{ //nolint:exhaustruct // cancelCleanup set in startCleanup
-		params:          &params,
-		log:             params.Logger.Get(),
-		hc:              params.Healthcheck,
-		broker:          params.Broker,
-		svc:             params.Service,
-		hashcashVal:     hashcash.NewValidator(resource),
-		channelHashcash: hashcash.NewChannelValidator(),
-		loginLimiter:    ratelimit.New(loginRate, loginBurst),
-		stats:           params.Stats,
+		params:       &params,
+		log:          params.Logger.Get(),
+		hc:           params.Healthcheck,
+		broker:       params.Broker,
+		svc:          params.Service,
+		hashcashVal:  hashcash.NewValidator(resource),
+		loginLimiter: ratelimit.New(loginRate, loginBurst),
+		stats:        params.Stats,
+		pollMessages: params.Database.PollMessages,
 	}
 
 	lifecycle.Append(fx.Hook{

internal/handlers/utility.go

@@ -1,56 +1,15 @@
 package handlers
 
 import (
-	"encoding/json"
-	"errors"
 	"net/http"
 	"strings"
 	"time"
 
-	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/service"
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-// maxUserhostNicks is the maximum number of nicks allowed
-// in a single USERHOST query (RFC 2812).
-const maxUserhostNicks = 5
-
-// dispatchBodyOnlyCommand routes commands that take
-// (writer, request, sessionID, clientID, nick, bodyLines).
-func (hdlr *Handlers) dispatchBodyOnlyCommand(
-	writer http.ResponseWriter,
-	request *http.Request,
-	sessionID, clientID int64,
-	nick, command string,
-	bodyLines func() []string,
-) {
-	switch command {
-	case irc.CmdAway:
-		hdlr.handleAway(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
-	case irc.CmdNick:
-		hdlr.handleNick(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
-	case irc.CmdPass:
-		hdlr.handlePass(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
-	case irc.CmdInvite:
-		hdlr.handleInvite(
-			writer, request,
-			sessionID, clientID, nick, bodyLines,
-		)
-	}
-}
-
-// dispatchOperCommand routes oper-related commands (OPER,
-// KILL, WALLOPS) to their handlers.
+// dispatchOperCommand routes the server operator commands
+// OPER, KILL and WALLOPS to their handlers.
 func (hdlr *Handlers) dispatchOperCommand(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -77,8 +36,8 @@ func (hdlr *Handlers) dispatchOperCommand(
 	}
 }
 
-// handleUserhost handles the USERHOST command.
-// Returns user@host info for up to 5 nicks.
+// handleUserhost handles USERHOST: user@host for each of
+// up to five nicks given in the body.
 func (hdlr *Handlers) handleUserhost(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -86,8 +45,6 @@ func (hdlr *Handlers) handleUserhost(
 	nick string,
 	bodyLines func() []string,
 ) {
-	ctx := request.Context()
-
 	lines := bodyLines()
 	if len(lines) == 0 {
 		hdlr.respondIRCError(
@@ -100,107 +57,47 @@ func (hdlr *Handlers) handleUserhost(
 		return
 	}
 
-	// Limit to 5 nicks per RFC 2812.
-	nicks := lines
-	if len(nicks) > maxUserhostNicks {
-		nicks = nicks[:maxUserhostNicks]
-	}
-
-	infos, err := hdlr.params.Database.GetUserhostInfo(
-		ctx, nicks,
+	reply, err := hdlr.svc.UserhostReply(
+		request.Context(), lines, hdlr.serverName(),
 	)
-	if err != nil {
-		hdlr.log.Error(
-			"userhost query failed", "error", err,
-		)
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
-		)
-
+	if hdlr.handleServiceError(
+		writer, request, clientID, sessionID, nick, err,
+	) {
 		return
 	}
 
-	replyStr := hdlr.buildUserhostReply(infos)
-
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplUserHost, nick, nil,
-		replyStr,
+		request.Context(), clientID,
+		irc.RplUserHost, nick, nil, reply,
 	)
-
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// buildUserhostReply builds the RPL_USERHOST reply
-// string per RFC 2812.
-func (hdlr *Handlers) buildUserhostReply(
-	infos []db.UserhostInfo,
-) string {
-	replies := make([]string, 0, len(infos))
-
-	for idx := range infos {
-		info := &infos[idx]
-
-		username := info.Username
-		if username == "" {
-			username = info.Nick
-		}
-
-		hostname := info.Hostname
-		if hostname == "" {
-			hostname = hdlr.serverName()
-		}
-
-		operStar := ""
-		if info.IsOper {
-			operStar = "*"
-		}
-
-		awayPrefix := "+"
-		if info.AwayMessage != "" {
-			awayPrefix = "-"
-		}
-
-		replies = append(replies,
-			info.Nick+operStar+"="+
-				awayPrefix+username+"@"+hostname,
-		)
-	}
-
-	return strings.Join(replies, " ")
-}
-
-// handleVersion handles the VERSION command.
-// Returns the server version string.
+// handleVersion handles VERSION.
 func (hdlr *Handlers) handleVersion(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick string,
 ) {
-	ctx := request.Context()
-	srvName := hdlr.serverName()
-	version := hdlr.svc.ServerVersion()
-
-	// 351 RPL_VERSION
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplVersion, nick,
-		[]string{version + ".", srvName},
+		request.Context(), clientID, irc.RplVersion, nick,
+		[]string{
+			hdlr.svc.ServerVersion() + ".",
+			hdlr.serverName(),
+		},
 		"",
 	)
-
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// handleAdmin handles the ADMIN command.
-// Returns server admin contact info.
+// handleAdmin handles ADMIN.
 func (hdlr *Handlers) handleAdmin(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -209,40 +106,28 @@ func (hdlr *Handlers) handleAdmin(
 ) {
 	ctx := request.Context()
 	srvName := hdlr.serverName()
+	location1, location2, email := hdlr.svc.AdminLines(srvName)
 
-	// 256 RPL_ADMINME
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplAdminMe, nick,
-		[]string{srvName},
-		"Administrative info",
+		[]string{srvName}, "Administrative info",
 	)
-
-	// 257 RPL_ADMINLOC1
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplAdminLoc1, nick, nil,
-		"neoirc server",
+		ctx, clientID, irc.RplAdminLoc1, nick, nil, location1,
 	)
-
-	// 258 RPL_ADMINLOC2
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplAdminLoc2, nick, nil,
-		"IRC over HTTP",
+		ctx, clientID, irc.RplAdminLoc2, nick, nil, location2,
 	)
-
-	// 259 RPL_ADMINEMAIL
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplAdminEmail, nick, nil,
-		"admin@"+srvName,
+		ctx, clientID, irc.RplAdminEmail, nick, nil, email,
 	)
-
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// handleInfo handles the INFO command.
-// Returns server software information.
+// handleInfo handles INFO.
 func (hdlr *Handlers) handleInfo(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -252,51 +137,41 @@ func (hdlr *Handlers) handleInfo(
 	ctx := request.Context()
 
 	for _, line := range hdlr.svc.InfoLines() {
-		// 371 RPL_INFO
 		hdlr.enqueueNumeric(
-			ctx, clientID, irc.RplInfo, nick, nil,
-			line,
+			ctx, clientID, irc.RplInfo, nick, nil, line,
 		)
 	}
 
-	// 374 RPL_ENDOFINFO
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplEndOfInfo, nick, nil,
 		"End of /INFO list",
 	)
-
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// handleTime handles the TIME command.
-// Returns the server's local time in RFC format.
+// handleTime handles TIME: the server's local time.
 func (hdlr *Handlers) handleTime(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick string,
 ) {
-	ctx := request.Context()
-	srvName := hdlr.serverName()
-
-	// 391 RPL_TIME
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplTime, nick,
-		[]string{srvName},
+		request.Context(), clientID, irc.RplTime, nick,
+		[]string{hdlr.serverName()},
 		time.Now().Format(time.RFC1123),
 	)
-
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// handleKill handles the KILL command.
-// Forcibly disconnects a user (oper only).
+// handleKill handles KILL: the body is the target nick and
+// an optional reason.
 func (hdlr *Handlers) handleKill(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -304,25 +179,9 @@ func (hdlr *Handlers) handleKill(
 	nick string,
 	bodyLines func() []string,
 ) {
-	ctx := request.Context()
-
-	// Check oper status.
-	isOper, err := hdlr.params.Database.IsSessionOper(
-		ctx, sessionID,
-	)
-	if err != nil || !isOper {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNoPrivileges, nick, nil,
-			"Permission Denied- You're not an IRC operator",
-		)
-
-		return
-	}
-
 	lines := bodyLines()
 
-	var targetNick string
+	targetNick := ""
 	if len(lines) > 0 {
 		targetNick = strings.TrimSpace(lines[0])
 	}
@@ -338,52 +197,27 @@ func (hdlr *Handlers) handleKill(
 		return
 	}
 
-	reason := "KILLed"
+	reason := ""
 	if len(lines) > 1 {
 		reason = lines[1]
 	}
 
-	targetSID, lookupErr := hdlr.params.Database.
-		GetSessionByNick(ctx, targetNick)
-	if lookupErr != nil {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNoSuchNick, nick,
-			[]string{targetNick},
-			"No such nick/channel",
-		)
-
-		return
-	}
-
-	// Do not allow killing yourself.
-	if targetSID == sessionID {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrCantKillServer, nick, nil,
-			"You cannot KILL yourself",
-		)
-
-		return
-	}
-
-	quitReason := "Killed (" + nick + " (" + reason + "))"
-
-	// KillSession broadcasts the QUIT, deletes the session
-	// and disconnects the victim's wire connection if it
-	// holds one.
-	hdlr.svc.KillSession(
-		ctx, targetSID, targetNick, quitReason,
+	err := hdlr.svc.KillUser(
+		request.Context(), sessionID, nick,
+		targetNick, reason,
 	)
+	if hdlr.handleServiceError(
+		writer, request, clientID, sessionID, nick, err,
+	) {
+		return
+	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// handleWallops handles the WALLOPS command.
-// Broadcasts a message to all users with +w usermode
-// (oper only).
+// handleWallops handles WALLOPS: the body is the message.
 func (hdlr *Handlers) handleWallops(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -391,22 +225,6 @@ func (hdlr *Handlers) handleWallops(
 	nick string,
 	bodyLines func() []string,
 ) {
-	ctx := request.Context()
-
-	// Check oper status.
-	isOper, err := hdlr.params.Database.IsSessionOper(
-		ctx, sessionID,
-	)
-	if err != nil || !isOper {
-		hdlr.respondIRCError(
-			writer, request, clientID, sessionID,
-			irc.ErrNoPrivileges, nick, nil,
-			"Permission Denied- You're not an IRC operator",
-		)
-
-		return
-	}
-
 	lines := bodyLines()
 	if len(lines) == 0 {
 		hdlr.respondIRCError(
@@ -419,54 +237,24 @@ func (hdlr *Handlers) handleWallops(
 		return
 	}
 
-	message := strings.Join(lines, " ")
-
-	wallopsSIDs, err := hdlr.params.Database.
-		GetWallopsSessionIDs(ctx)
-	if err != nil {
-		hdlr.log.Error(
-			"get wallops sessions failed", "error", err,
-		)
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
-		)
-
+	err := hdlr.svc.SendWallops(
+		request.Context(), sessionID, nick,
+		strings.Join(lines, " "),
+	)
+	if hdlr.handleServiceError(
+		writer, request, clientID, sessionID, nick, err,
+	) {
 		return
 	}
 
-	if len(wallopsSIDs) > 0 {
-		body, mErr := json.Marshal([]string{message})
-		if mErr != nil {
-			hdlr.log.Error(
-				"marshal wallops body", "error", mErr,
-			)
-			hdlr.respondError(
-				writer, request,
-				"internal error",
-				http.StatusInternalServerError,
-			)
-
-			return
-		}
-
-		_ = hdlr.fanOutSilent(
-			request, irc.CmdWallops, nick, "*",
-			json.RawMessage(body), wallopsSIDs,
-		)
-	}
-
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }
 
-// handleUserMode handles user mode queries and changes
-// (e.g., MODE nick, MODE nick +w). Delegates to the
-// shared service.ApplyUserMode / service.QueryUserMode so
-// that mode string processing is identical for both the
-// HTTP API and IRC wire protocol.
+// handleUserMode handles MODE for a nick: a query when the
+// body is empty, otherwise a change by the mode string in
+// the body. Only the caller's own nick is allowed.
 func (hdlr *Handlers) handleUserMode(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -474,14 +262,7 @@ func (hdlr *Handlers) handleUserMode(
 	nick, target string,
 	bodyLines func() []string,
 ) {
-	ctx := request.Context()
-
-	// Users can only query or change their own modes. The
-	// check is above the query/change split so that both
-	// forms are rejected, and uses EqualFold because IRC
-	// nicks are case-insensitive — matching the wire path
-	// in ircserver.handleUserMode.
-	if target != "" && !strings.EqualFold(target, nick) {
+	if target != nick {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrUsersDoNotMatch, nick, nil,
@@ -491,86 +272,33 @@ func (hdlr *Handlers) handleUserMode(
 		return
 	}
 
-	lines := bodyLines()
-
-	// Mode change requested.
-	if len(lines) > 0 {
-		hdlr.changeUserMode(
-			writer, request,
-			sessionID, clientID, nick, lines[0],
-		)
-
-		return
-	}
-
-	// Mode query — delegate to shared service.
-	modeStr, err := hdlr.svc.QueryUserMode(ctx, sessionID)
-	if err != nil {
-		hdlr.log.Error(
-			"query user mode failed", "error", err,
-		)
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
-		)
-
-		return
-	}
-
-	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplUmodeIs, nick, nil,
-		modeStr,
-	)
-	hdlr.broker.Notify(sessionID)
-	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
-		http.StatusOK)
-}
-
-// changeUserMode applies a mode string to the caller's own
-// session. The caller has already verified that the target
-// nick is the caller's own.
-func (hdlr *Handlers) changeUserMode(
-	writer http.ResponseWriter,
-	request *http.Request,
-	sessionID, clientID int64,
-	nick, modeStr string,
-) {
 	ctx := request.Context()
 
-	newModes, err := hdlr.svc.ApplyUserMode(
-		ctx, sessionID, modeStr,
+	var (
+		modes string
+		err   error
 	)
-	if err != nil {
-		var ircErr *service.IRCError
-		if errors.As(err, &ircErr) {
-			hdlr.respondIRCError(
-				writer, request,
-				clientID, sessionID,
-				ircErr.Code, nick, ircErr.Params,
-				ircErr.Message,
-			)
 
-			return
-		}
-
-		hdlr.respondError(
-			writer, request,
-			"internal error",
-			http.StatusInternalServerError,
+	lines := bodyLines()
+	if len(lines) > 0 {
+		modes, err = hdlr.svc.ApplyUserMode(
+			ctx, sessionID, lines[0],
 		)
+	} else {
+		modes, err = hdlr.svc.QueryUserMode(ctx, sessionID)
+	}
 
+	if hdlr.handleServiceError(
+		writer, request, clientID, sessionID, nick, err,
+	) {
 		return
 	}
 
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplUmodeIs, nick, nil,
-		newModes,
+		ctx, clientID, irc.RplUmodeIs, nick, nil, modes,
 	)
-
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{"status": "ok"},
+		map[string]string{statusKey: "ok"},
 		http.StatusOK)
 }

internal/hashcash/hashcash.go

@@ -77,9 +77,13 @@ func NewValidator(resource string) *Validator {
 	return validator
 }
 
-// Validate checks a hashcash stamp. It returns nil if the
-// stamp is valid and has not been seen before.
-func (v *Validator) Validate(
+// Check returns nil if requiredBits is not positive, or if
+// the stamp is a well-formed, recently dated proof of work
+// for this resource with at least requiredBits. It does not
+// look at or change the set of spent stamps, so a request
+// can check its stamp first and Claim it after its other
+// checks.
+func (v *Validator) Check(
 	stamp string,
 	requiredBits int,
 ) error {
@@ -87,9 +91,49 @@ func (v *Validator) Validate(
 		return nil
 	}
 
+	_, err := v.check(stamp, requiredBits)
+
+	return err
+}
+
+// Claim checks the stamp as Check does and, when
+// requiredBits is positive, records it as spent until it
+// expires. It returns an error if the stamp is already
+// spent. Release gives a claimed stamp back.
+func (v *Validator) Claim(
+	stamp string,
+	requiredBits int,
+) error {
+	if requiredBits <= 0 {
+		return nil
+	}
+
+	stampTime, err := v.check(stamp, requiredBits)
+	if err != nil {
+		return err
+	}
+
+	return v.checkAndRecordStamp(stamp, stampTime)
+}
+
+// Release forgets a claimed stamp so that it can be claimed
+// again, for a request that failed after its Claim.
+// Releasing a stamp that is not claimed does nothing.
+func (v *Validator) Release(stamp string) {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+
+	delete(v.spent, stamp)
+}
+
+// check returns the stamp's date if Check accepts it.
+func (v *Validator) check(
+	stamp string,
+	requiredBits int,
+) (time.Time, error) {
 	parts := strings.Split(stamp, ":")
 	if len(parts) != stampFields {
-		return fmt.Errorf(
+		return time.Time{}, fmt.Errorf(
 			"%w: expected %d, got %d",
 			errInvalidFields, stampFields, len(parts),
 		)
@@ -104,25 +148,25 @@ func (v *Validator) Validate(
 		version, bitsStr, resource, requiredBits,
 	)
 	if err != nil {
-		return err
+		return time.Time{}, err
 	}
 
 	stampTime, err := parseStampDate(dateStr)
 	if err != nil {
-		return err
+		return time.Time{}, err
 	}
 
 	err = validateTime(stampTime)
 	if err != nil {
-		return err
+		return time.Time{}, err
 	}
 
 	err = validateProof(stamp, requiredBits)
 	if err != nil {
-		return err
+		return time.Time{}, err
 	}
 
-	return v.checkAndRecordStamp(stamp, stampTime)
+	return stampTime, nil
 }
 
 func (v *Validator) validateHeader(

internal/hashcash/hashcash_test.go

@@ -85,7 +85,7 @@ func TestMintAndValidate(t *testing.T) {
 		t, testBits, "test-resource", todayDate(),
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err != nil {
 		t.Fatalf("valid stamp rejected: %v", err)
 	}
@@ -99,17 +99,74 @@ func TestReplayDetection(t *testing.T) {
 		t, testBits, "test-resource", todayDate(),
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err != nil {
 		t.Fatalf("first use failed: %v", err)
 	}
 
-	err = validator.Validate(stamp, testBits)
+	err = validator.Claim(stamp, testBits)
 	if err == nil {
 		t.Fatal("replay not detected")
 	}
 }
 
+// TestCheckDoesNotSpendStamp checks that a stamp Check
+// accepts can still be claimed, and only once, and that
+// Check still accepts it once it is spent.
+func TestCheckDoesNotSpendStamp(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	stamp := mintStampWithDate(
+		t, testBits, "test-resource", todayDate(),
+	)
+
+	for range 2 {
+		err := validator.Check(stamp, testBits)
+		if err != nil {
+			t.Fatalf("valid stamp rejected: %v", err)
+		}
+	}
+
+	err := validator.Claim(stamp, testBits)
+	if err != nil {
+		t.Fatalf("claim after check failed: %v", err)
+	}
+
+	err = validator.Claim(stamp, testBits)
+	if err == nil {
+		t.Fatal("replay not detected")
+	}
+
+	err = validator.Check(stamp, testBits)
+	if err != nil {
+		t.Fatalf("spent stamp rejected by Check: %v", err)
+	}
+}
+
+// TestReleasedStampCanBeClaimedAgain checks that Release
+// gives a claimed stamp back.
+func TestReleasedStampCanBeClaimedAgain(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	stamp := mintStampWithDate(
+		t, testBits, "test-resource", todayDate(),
+	)
+
+	err := validator.Claim(stamp, testBits)
+	if err != nil {
+		t.Fatalf("first claim failed: %v", err)
+	}
+
+	validator.Release(stamp)
+
+	err = validator.Claim(stamp, testBits)
+	if err != nil {
+		t.Fatalf("claim after release failed: %v", err)
+	}
+}
+
 func TestResourceMismatch(t *testing.T) {
 	t.Parallel()
 
@@ -118,7 +175,7 @@ func TestResourceMismatch(t *testing.T) {
 		t, testBits, "wrong-resource", todayDate(),
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected resource mismatch error")
 	}
@@ -129,7 +186,7 @@ func TestInvalidStampFormat(t *testing.T) {
 
 	validator := hashcash.NewValidator("test-resource")
 
-	err := validator.Validate(
+	err := validator.Claim(
 		"not:a:valid:stamp", testBits,
 	)
 	if err == nil {
@@ -146,7 +203,7 @@ func TestBadVersion(t *testing.T) {
 		testBits, todayDate(), "test-resource",
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad version error")
 	}
@@ -162,7 +219,7 @@ func TestInsufficientDifficulty(t *testing.T) {
 		todayDate(), "test-resource",
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected insufficient bits error")
 	}
@@ -178,7 +235,7 @@ func TestExpiredStamp(t *testing.T) {
 		t, testBits, "test-resource", oldDate,
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected expired stamp error")
 	}
@@ -189,9 +246,14 @@ func TestZeroBitsSkipsValidation(t *testing.T) {
 
 	validator := hashcash.NewValidator("test-resource")
 
-	err := validator.Validate("garbage", 0)
+	err := validator.Check("garbage", 0)
 	if err != nil {
-		t.Fatalf("zero bits should skip: %v", err)
+		t.Fatalf("zero bits should skip the check: %v", err)
+	}
+
+	err = validator.Claim("garbage", 0)
+	if err != nil {
+		t.Fatalf("zero bits should skip the claim: %v", err)
 	}
 }
 
@@ -204,7 +266,7 @@ func TestLongDateFormat(t *testing.T) {
 		t, testBits, "test-resource", longDate,
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err != nil {
 		t.Fatalf("long date stamp rejected: %v", err)
 	}
@@ -219,7 +281,7 @@ func TestBadDateFormat(t *testing.T) {
 		testBits, "test-resource",
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad date error")
 	}
@@ -235,7 +297,7 @@ func TestMultipleUniqueStamps(t *testing.T) {
 			t, testBits, "test-resource", todayDate(),
 		)
 
-		err := validator.Validate(stamp, testBits)
+		err := validator.Claim(stamp, testBits)
 		if err != nil {
 			t.Fatalf("unique stamp rejected: %v", err)
 		}
@@ -251,7 +313,7 @@ func TestHigherBitsStillValid(t *testing.T) {
 		t, 4, "test-resource", todayDate(),
 	)
 
-	err := validator.Validate(stamp, testBits)
+	err := validator.Claim(stamp, testBits)
 	if err != nil {
 		t.Fatalf(
 			"higher-difficulty stamp rejected: %v",

internal/ircserver/commands.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -13,7 +14,7 @@ import (
 )
 
 // sendIRCError maps a service.IRCError to an IRC numeric
-// reply on the wire.
+// reply on the wire, and logs any other error.
 func (c *Conn) sendIRCError(err error) {
 	var ircErr *service.IRCError
 	if errors.As(err, &ircErr) {
@@ -21,7 +22,11 @@ func (c *Conn) sendIRCError(err error) {
 		args = append(args, ircErr.Params...)
 		args = append(args, ircErr.Message)
 		c.sendNumeric(ircErr.Code, args...)
+
+		return
 	}
+
+	c.log.Error("command failed", "error", err)
 }
 
 // handleCAP silently acknowledges CAP negotiation.
@@ -66,15 +71,20 @@ func (c *Conn) handleNick(
 	}
 
 	newNick := msg.Params[0]
-	if len(newNick) > maxNickLen {
-		newNick = newNick[:maxNickLen]
+	if !service.ValidNick(newNick) {
+		c.sendNumeric(
+			irc.ErrErroneusNickname,
+			newNick, "Erroneous nickname",
+		)
+
+		return
 	}
 
 	oldMask := c.hostmask()
-	oldNick := c.nick
+	oldNick := c.currentNick()
 
 	err := c.svc.ChangeNick(
-		ctx, c.sessionID, oldNick, newNick,
+		ctx, c.sessionID, c.clientID, oldNick, newNick,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -82,9 +92,10 @@ func (c *Conn) handleNick(
 		return
 	}
 
-	c.mu.Lock()
-	c.nick = newNick
-	c.mu.Unlock()
+	// Take the nick the session holds, not newNick: another
+	// client of the session may have changed it again since
+	// ChangeNick stored newNick.
+	c.loadSessionNick(ctx)
 
 	// Echo NICK change to the client on wire.
 	c.send(FormatMessage(oldMask, "NICK", newNick))
@@ -118,8 +129,8 @@ func (c *Conn) handlePrivmsg(
 	body, _ := json.Marshal([]string{text}) //nolint:errchkjson
 
 	if strings.HasPrefix(target, "#") {
-		_, _, err := c.svc.SendChannelMessage(
-			ctx, c.sessionID, c.nick,
+		_, err := c.svc.SendChannelMessage(
+			ctx, c.sessionID, c.clientID, c.currentNick(),
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -127,7 +138,7 @@ func (c *Conn) handlePrivmsg(
 		}
 	} else {
 		result, err := c.svc.SendDirectMessage(
-			ctx, c.sessionID, c.nick,
+			ctx, c.sessionID, c.clientID, c.currentNick(),
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -145,7 +156,9 @@ func (c *Conn) handlePrivmsg(
 }
 
 // handleJoin joins one or more channels via the shared
-// service layer.
+// service layer. The optional second parameter holds the
+// channel keys, comma-separated in the order of the
+// channels.
 func (c *Conn) handleJoin(
 	ctx context.Context,
 	msg *Message,
@@ -159,14 +172,24 @@ func (c *Conn) handleJoin(
 		return
 	}
 
-	for chanName := range strings.SplitSeq(msg.Params[0], ",") {
+	var keys []string
+	if len(msg.Params) > 1 {
+		keys = strings.Split(msg.Params[1], ",")
+	}
+
+	for idx, chanName := range strings.Split(msg.Params[0], ",") {
 		chanName = strings.TrimSpace(chanName)
 
 		if !strings.HasPrefix(chanName, "#") {
 			chanName = "#" + chanName
 		}
 
-		c.joinChannel(ctx, chanName)
+		key := ""
+		if idx < len(keys) {
+			key = keys[idx]
+		}
+
+		c.joinChannel(ctx, chanName, key)
 	}
 }
 
@@ -174,10 +197,10 @@ func (c *Conn) handleJoin(
 // and delivers topic/names on the wire.
 func (c *Conn) joinChannel(
 	ctx context.Context,
-	channel string,
+	channel, key string,
 ) {
 	result, err := c.svc.JoinChannel(
-		ctx, c.sessionID, c.nick, channel, "",
+		ctx, c.sessionID, c.clientID, c.currentNick(), channel, key,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -315,7 +338,7 @@ func (c *Conn) partChannel(
 	channel, reason string,
 ) {
 	err := c.svc.PartChannel(
-		ctx, c.sessionID, c.nick, channel, reason,
+		ctx, c.sessionID, c.clientID, c.currentNick(), channel, reason,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -379,7 +402,7 @@ func (c *Conn) handleTopic(
 	newTopic := msg.Params[1]
 
 	err := c.svc.SetTopic(
-		ctx, c.sessionID, c.nick, channel, newTopic,
+		ctx, c.sessionID, c.clientID, c.currentNick(), channel, newTopic,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -679,24 +702,26 @@ func (c *Conn) applyChannelModes(
 	if applied.Len() > 0 {
 		modeReply := applied.String() + appliedArgs.String()
 
-		c.send(FormatMessage(
-			c.hostmask(), "MODE", channel, modeReply,
-		))
+		params := slices.Concat(
+			[]string{channel}, strings.Fields(modeReply),
+		)
+
+		c.send(FormatMessage(c.hostmask(), "MODE", params...))
 
 		c.svc.BroadcastMode(
-			ctx, c.nick, channel, chID, modeReply,
+			ctx, c.clientID, c.currentNick(), channel, chID, modeReply,
 		)
 	}
 }
 
-// handleUserMode handles MODE for users.
+// handleUserMode handles MODE for a nick: a query without a
+// mode string, otherwise a change. Only the client's own
+// nick is allowed.
 func (c *Conn) handleUserMode(
 	ctx context.Context,
 	msg *Message,
 ) {
-	target := msg.Params[0]
-
-	if !strings.EqualFold(target, c.currentNick()) {
+	if msg.Params[0] != c.currentNick() {
 		c.sendNumeric(
 			irc.ErrUsersDoNotMatch,
 			"Can't change mode for other users",
@@ -705,48 +730,26 @@ func (c *Conn) handleUserMode(
 		return
 	}
 
-	// Mode query (no mode string).
-	if len(msg.Params) < 2 { //nolint:mnd
-		modes, err := c.svc.QueryUserMode(
-			ctx, c.sessionID,
-		)
-		if err != nil {
-			c.log.Error(
-				"query user mode failed", "error", err,
-			)
-			c.sendNumeric(
-				irc.ErrUmodeUnknownFlag,
-				"Unable to read user modes",
-			)
-
-			return
-		}
-
-		c.sendNumeric(irc.RplUmodeIs, modes)
-
-		return
-	}
-
-	newModes, err := c.svc.ApplyUserMode(
-		ctx, c.sessionID, msg.Params[1],
+	var (
+		modes string
+		err   error
 	)
-	if err != nil {
-		var ircErr *service.IRCError
-		if errors.As(err, &ircErr) {
-			c.sendNumeric(ircErr.Code, ircErr.Message)
 
-			return
-		}
-
-		c.sendNumeric(
-			irc.ErrUmodeUnknownFlag,
-			"Unknown MODE flag",
+	if len(msg.Params) == 1 {
+		modes, err = c.svc.QueryUserMode(ctx, c.sessionID)
+	} else {
+		modes, err = c.svc.ApplyUserMode(
+			ctx, c.sessionID, msg.Params[1],
 		)
+	}
+
+	if err != nil {
+		c.sendIRCError(err)
 
 		return
 	}
 
-	c.sendNumeric(irc.RplUmodeIs, newModes)
+	c.sendNumeric(irc.RplUmodeIs, modes)
 }
 
 // handleNames replies with channel member list.
@@ -778,10 +781,11 @@ func (c *Conn) handleNames(
 	c.deliverNames(ctx, channel, chID)
 }
 
-// handleList sends the channel list.
+// handleList sends the channel list, leaving out +s
+// channels the user is not on.
 func (c *Conn) handleList(ctx context.Context) {
-	channels, err := c.database.ListAllChannelsWithCounts(
-		ctx,
+	channels, err := c.database.ListAllChannelsWithCountsFiltered(
+		ctx, c.sessionID,
 	)
 	if err != nil {
 		c.sendNumeric(
@@ -901,14 +905,15 @@ func (c *Conn) whoisOper(
 	}
 }
 
-// whoisChannels sends 319 RPL_WHOISCHANNELS.
+// whoisChannels sends 319 RPL_WHOISCHANNELS, leaving out
+// +s channels the querier is not on.
 func (c *Conn) whoisChannels(
 	ctx context.Context,
 	target string,
 	targetID int64,
 ) {
-	userChannels, _ := c.database.GetSessionChannels(
-		ctx, targetID,
+	userChannels, _ := c.database.GetSessionChannelsFiltered(
+		ctx, targetID, c.sessionID,
 	)
 	if len(userChannels) == 0 {
 		return
@@ -1181,7 +1186,7 @@ func (c *Conn) handleKick(
 	}
 
 	err := c.svc.KickUser(
-		ctx, c.sessionID, c.nick,
+		ctx, c.sessionID, c.clientID, c.currentNick(),
 		channel, targetNick, reason,
 	)
 	if err != nil {
@@ -1212,17 +1217,16 @@ func (c *Conn) handlePassPostReg(
 	}
 
 	password := msg.Params[0]
-	if len(password) < minPasswordLen {
-		c.sendFromServer("NOTICE", c.nick,
-			"Password must be at least 8 characters",
-		)
-
+	if !c.checkPasswordLength(password) {
 		return
 	}
 
-	c.setPassword(ctx, password)
+	err := c.setPassword(ctx, password)
+	if err != nil {
+		return
+	}
 
-	c.sendFromServer("NOTICE", c.nick,
+	c.sendFromServer("NOTICE", c.currentNick(),
 		"Password set. You can reconnect using "+
 			"PASS <password> with your nick.",
 	)
@@ -1245,36 +1249,11 @@ func (c *Conn) handleInvite(
 	targetNick := msg.Params[0]
 	channel := msg.Params[1]
 
-	chID, err := c.database.GetChannelByName(ctx, channel)
-	if err != nil {
-		c.sendNumeric(
-			irc.ErrNoSuchChannel,
-			channel, "No such channel",
-		)
-
-		return
-	}
-
-	isMember, _ := c.database.IsChannelMember(
-		ctx, chID, c.sessionID,
-	)
-	if !isMember {
-		c.sendNumeric(
-			irc.ErrNotOnChannel,
-			channel, "You're not on that channel",
-		)
-
-		return
-	}
-
-	targetID, err := c.database.GetSessionByNick(
-		ctx, targetNick,
+	targetID, err := c.svc.InviteUser(
+		ctx, c.sessionID, c.currentNick(), targetNick, channel,
 	)
 	if err != nil {
-		c.sendNumeric(
-			irc.ErrNoSuchNick,
-			targetNick, "No such nick",
-		)
+		c.sendIRCError(err)
 
 		return
 	}
@@ -1283,235 +1262,126 @@ func (c *Conn) handleInvite(
 		irc.RplInviting, targetNick, channel,
 	)
 
-	// Send INVITE notice to target via service fan-out.
-	body, _ := json.Marshal( //nolint:errchkjson
-		[]string{"You have been invited to " + channel},
-	)
+	// Queue the INVITE to the target with the body the HTTP
+	// API uses.
+	body, _ := json.Marshal([]string{channel}) //nolint:errchkjson
 
 	_, _, _ = c.svc.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, "INVITE", c.nick, targetNick,
-		nil, body, nil, []int64{targetID},
+		ctx, "INVITE", c.currentNick(), targetNick, targetID, 0,
+		nil, body, nil, []int64{targetID}, 0,
 	)
 }
 
-// handleUserhost replies with USERHOST info.
+// handleUserhost replies with user@host for each of up to
+// five nicks.
 func (c *Conn) handleUserhost(
 	ctx context.Context,
 	msg *Message,
 ) {
 	if len(msg.Params) < 1 {
+		c.sendNumeric(
+			irc.ErrNeedMoreParams,
+			irc.CmdUserhost, "Not enough parameters",
+		)
+
 		return
 	}
 
-	replies := make([]string, 0, len(msg.Params))
+	reply, err := c.svc.UserhostReply(
+		ctx, msg.Params, c.serverSfx,
+	)
+	if err != nil {
+		c.sendIRCError(err)
 
-	for _, nick := range msg.Params {
-		sid, err := c.database.GetSessionByNick(ctx, nick)
-		if err != nil {
-			continue
-		}
-
-		hostInfo, _ := c.database.GetSessionHostInfo(
-			ctx, sid,
-		)
-
-		host := "*"
-		if hostInfo != nil {
-			host = hostInfo.Hostname
-		}
-
-		isOper, _ := c.database.IsSessionOper(ctx, sid)
-
-		operStar := ""
-		if isOper {
-			operStar = "*"
-		}
-
-		replies = append(
-			replies,
-			nick+operStar+"=+"+nick+"@"+host,
-		)
+		return
 	}
 
-	c.sendNumeric(
-		irc.RplUserHost,
-		strings.Join(replies, " "),
-	)
+	c.sendNumeric(irc.RplUserHost, reply)
 }
 
-// handleVersion replies with the server version string.
+// handleVersion replies with the server version.
 func (c *Conn) handleVersion() {
 	c.sendNumeric(
 		irc.RplVersion,
-		c.svc.ServerVersion()+".", c.serverSfx,
-		"",
+		c.svc.ServerVersion()+".", c.serverSfx, "",
 	)
 }
 
-// handleAdmin replies with server admin info.
+// handleAdmin replies with the server's admin info.
 func (c *Conn) handleAdmin() {
-	srvName := c.serverSfx
+	location1, location2, email := c.svc.AdminLines(c.serverSfx)
 
 	c.sendNumeric(
-		irc.RplAdminMe,
-		srvName, "Administrative info",
-	)
-
-	c.sendNumeric(
-		irc.RplAdminLoc1,
-		"neoirc server",
-	)
-
-	c.sendNumeric(
-		irc.RplAdminLoc2,
-		"IRC over HTTP",
-	)
-
-	c.sendNumeric(
-		irc.RplAdminEmail,
-		"admin@"+srvName,
+		irc.RplAdminMe, c.serverSfx, "Administrative info",
 	)
+	c.sendNumeric(irc.RplAdminLoc1, location1)
+	c.sendNumeric(irc.RplAdminLoc2, location2)
+	c.sendNumeric(irc.RplAdminEmail, email)
 }
 
-// handleInfo replies with server software info.
+// handleInfo replies with the server's software info.
 func (c *Conn) handleInfo() {
 	for _, line := range c.svc.InfoLines() {
 		c.sendNumeric(irc.RplInfo, line)
 	}
 
-	c.sendNumeric(
-		irc.RplEndOfInfo,
-		"End of /INFO list",
-	)
+	c.sendNumeric(irc.RplEndOfInfo, "End of /INFO list")
 }
 
-// handleTime replies with the server's current time.
+// handleTime replies with the server's local time.
 func (c *Conn) handleTime() {
-	srvName := c.serverSfx
-
 	c.sendNumeric(
 		irc.RplTime,
-		srvName, time.Now().Format(time.RFC1123),
+		c.serverSfx, time.Now().Format(time.RFC1123),
 	)
 }
 
-// handleKillCmd forcibly disconnects a target user (oper
-// only).
-func (c *Conn) handleKillCmd(
+// handleKill handles KILL <nick> [<reason>].
+func (c *Conn) handleKill(
 	ctx context.Context,
 	msg *Message,
 ) {
-	isOper, err := c.database.IsSessionOper(
-		ctx, c.sessionID,
-	)
-	if err != nil || !isOper {
-		c.sendNumeric(
-			irc.ErrNoPrivileges,
-			"Permission Denied- "+
-				"You're not an IRC operator",
-		)
-
-		return
-	}
-
 	if len(msg.Params) < 1 {
 		c.sendNumeric(
 			irc.ErrNeedMoreParams,
-			"KILL", "Not enough parameters",
+			irc.CmdKill, "Not enough parameters",
 		)
 
 		return
 	}
 
-	targetNick := msg.Params[0]
-
-	reason := "KILLed"
+	reason := ""
 	if len(msg.Params) > 1 {
 		reason = msg.Params[1]
 	}
 
-	killerNick := c.currentNick()
-
-	if strings.EqualFold(targetNick, killerNick) {
-		c.sendNumeric(
-			irc.ErrCantKillServer,
-			"You cannot KILL yourself",
-		)
-
-		return
-	}
-
-	targetSID, lookupErr := c.database.GetSessionByNick(
-		ctx, targetNick,
+	err := c.svc.KillUser(
+		ctx, c.sessionID, c.currentNick(),
+		msg.Params[0], reason,
 	)
-	if lookupErr != nil {
-		c.sendNumeric(
-			irc.ErrNoSuchNick,
-			targetNick, "No such nick/channel",
-		)
-
-		return
+	if err != nil {
+		c.sendIRCError(err)
 	}
-
-	quitReason := "Killed (" + killerNick +
-		" (" + reason + "))"
-
-	// KillSession broadcasts the QUIT, deletes the session
-	// and disconnects the victim's wire connection.
-	c.svc.KillSession(
-		ctx, targetSID, targetNick, quitReason,
-	)
 }
 
-// handleWallopsCmd broadcasts to all +w users (oper only).
-func (c *Conn) handleWallopsCmd(
+// handleWallops handles WALLOPS <message>.
+func (c *Conn) handleWallops(
 	ctx context.Context,
 	msg *Message,
 ) {
-	isOper, err := c.database.IsSessionOper(
-		ctx, c.sessionID,
-	)
-	if err != nil || !isOper {
-		c.sendNumeric(
-			irc.ErrNoPrivileges,
-			"Permission Denied- "+
-				"You're not an IRC operator",
-		)
-
-		return
-	}
-
 	if len(msg.Params) < 1 {
 		c.sendNumeric(
 			irc.ErrNeedMoreParams,
-			"WALLOPS", "Not enough parameters",
+			irc.CmdWallops, "Not enough parameters",
 		)
 
 		return
 	}
 
-	message := msg.Params[0]
-
-	wallopsSIDs, wallErr := c.database.
-		GetWallopsSessionIDs(ctx)
-	if wallErr != nil {
-		c.log.Error(
-			"get wallops sessions failed",
-			"error", wallErr,
-		)
-
-		return
-	}
-
-	if len(wallopsSIDs) > 0 {
-		body, mErr := json.Marshal([]string{message})
-		if mErr != nil {
-			return
-		}
-
-		_, _, _ = c.svc.FanOut(
-			ctx, irc.CmdWallops, c.currentNick(), "*",
-			nil, body, nil, wallopsSIDs,
-		)
+	err := c.svc.SendWallops(
+		ctx, c.sessionID, c.currentNick(), msg.Params[0],
+	)
+	if err != nil {
+		c.sendIRCError(err)
 	}
 }

internal/ircserver/conn.go

@@ -20,15 +20,14 @@ import (
 
 const (
 	maxLineLen      = 512
-	readTimeout     = 5 * time.Minute
 	writeTimeout    = 30 * time.Second
 	killWriteWindow = 2 * time.Second
 	dnsTimeout      = 3 * time.Second
 	pollInterval    = 100 * time.Millisecond
 	pingInterval    = 90 * time.Second
 	pongDeadline    = 30 * time.Second
-	maxNickLen      = 32
 	minPasswordLen  = 8
+	maxPasswordLen  = 72 // bcrypt cannot hash a longer one
 	maxHashcashBits = 40
 )
 
@@ -47,10 +46,9 @@ type Conn struct {
 	serverSfx string
 	commands  map[string]cmdHandler
 
-	// writeMu serializes writes to conn.  A connection is
-	// written to by its own read loop, by its relay
-	// goroutine, and — when an operator KILLs it — by
-	// another client's goroutine.
+	// writeMu serializes writes to conn, which come from
+	// serve(), from the relay goroutine and, for KILL, from
+	// Disconnect.
 	writeMu sync.Mutex
 
 	mu        sync.Mutex
@@ -65,6 +63,7 @@ type Conn struct {
 	registered bool
 	gotNick    bool
 	gotUser    bool
+	gotPass    bool
 	passWord   string
 
 	lastQueueID int64
@@ -73,7 +72,6 @@ type Conn struct {
 }
 
 func newConn(
-	ctx context.Context,
 	tcpConn net.Conn,
 	log *slog.Logger,
 	database *db.Database,
@@ -97,7 +95,6 @@ func newConn(
 		svc:       svc,
 		serverSfx: srvName,
 		remoteIP:  host,
-		hostname:  resolveHost(ctx, host),
 	}
 
 	conn.commands = conn.buildCommandMap()
@@ -141,7 +138,7 @@ func (c *Conn) Disconnect(reason string) {
 func (c *Conn) notifyKilledAndClose(
 	nick, host, reason string,
 ) {
-	defer c.conn.Close() //nolint:errcheck
+	defer func() { _ = c.conn.Close() }()
 
 	c.sendWithin(
 		killWriteWindow,
@@ -188,13 +185,13 @@ func (c *Conn) buildCommandMap() map[string]cmdHandler {
 		"CAP": func(_ context.Context, msg *Message) {
 			c.handleCAP(msg)
 		},
-		"USERHOST":     c.handleUserhost,
-		irc.CmdVersion: func(context.Context, *Message) { c.handleVersion() },
-		irc.CmdAdmin:   func(context.Context, *Message) { c.handleAdmin() },
-		irc.CmdInfo:    func(context.Context, *Message) { c.handleInfo() },
-		irc.CmdTime:    func(context.Context, *Message) { c.handleTime() },
-		irc.CmdKill:    c.handleKillCmd,
-		irc.CmdWallops: c.handleWallopsCmd,
+		irc.CmdUserhost: c.handleUserhost,
+		irc.CmdVersion:  func(context.Context, *Message) { c.handleVersion() },
+		irc.CmdAdmin:    func(context.Context, *Message) { c.handleAdmin() },
+		irc.CmdInfo:     func(context.Context, *Message) { c.handleInfo() },
+		irc.CmdTime:     func(context.Context, *Message) { c.handleTime() },
+		irc.CmdKill:     c.handleKill,
+		irc.CmdWallops:  c.handleWallops,
 	}
 }
 
@@ -215,18 +212,42 @@ func resolveHost(ctx context.Context, addr string) string {
 }
 
 // serve is the main loop for a single IRC client connection.
+// It first sets the client's hostname to what resolve returns
+// for the client's address.
 // Cancelling ctx when it returns stops the relay goroutine.
-func (c *Conn) serve(ctx context.Context) {
+// When nothing has been read for interval the client is sent
+// a PING, and when nothing is read within deadline after that
+// the connection is closed.
+func (c *Conn) serve(
+	ctx context.Context,
+	resolve func(ctx context.Context, addr string) string,
+	interval, deadline time.Duration,
+) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
-	defer c.cleanup(ctx)
+	// Stopping the server cancels ctx, and the cleanup must
+	// still end the session then.
+	defer c.cleanup(context.WithoutCancel(ctx))
+
+	// The hostname is looked up here, on this connection's
+	// goroutine, and not when the connection is accepted, so
+	// that a slow lookup holds up only this client.
+	c.hostname = resolve(ctx, c.remoteIP)
+
+	ping := time.AfterFunc(interval, func() {
+		c.send("PING :" + c.serverSfx)
+	})
+	defer ping.Stop()
 
 	scanner := bufio.NewScanner(c.conn)
 	scanner.Buffer(make([]byte, maxLineLen), maxLineLen)
 
 	for {
+		// Every line read starts both waits again.
+		ping.Reset(interval)
+
 		_ = c.conn.SetReadDeadline(
-			time.Now().Add(readTimeout),
+			time.Now().Add(interval + deadline),
 		)
 
 		if !scanner.Scan() {
@@ -263,9 +284,8 @@ func (c *Conn) cleanup(ctx context.Context) {
 	if wasRegistered && sessID > 0 {
 		c.svc.UnregisterWireConn(sessID, c)
 
-		// A KILLed session has already been broadcast and
-		// deleted by the killer; broadcasting again would
-		// fan out a QUIT for a session row that is gone.
+		// KILL has already sent the QUIT and deleted the
+		// session.
 		if !wasKilled {
 			c.svc.BroadcastQuit(
 				ctx, sessID, nick, "Connection closed",
@@ -276,8 +296,8 @@ func (c *Conn) cleanup(ctx context.Context) {
 	c.conn.Close() //nolint:errcheck,gosec
 }
 
-// isClosed reports whether the connection has been marked
-// for teardown, either by QUIT or by an operator KILL.
+// isClosed reports whether QUIT or KILL has ended the
+// connection.
 func (c *Conn) isClosed() bool {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -285,9 +305,7 @@ func (c *Conn) isClosed() bool {
 	return c.closed
 }
 
-// currentNick returns the connection's registered nick.
-// c.nick is written under c.mu during registration and
-// NICK changes, so every read must take the mutex.
+// currentNick returns c.nick, read under c.mu.
 func (c *Conn) currentNick() string {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -295,19 +313,39 @@ func (c *Conn) currentNick() string {
 	return c.nick
 }
 
+// loadSessionNick sets c.nick to the nick the connection's
+// session holds in the database, read by session ID. The
+// connection's own NICK and the relay passing on a NICK line
+// both call it, and it reads and sets the nick under c.mu, so
+// whichever runs last leaves the connection on its session's
+// nick. If the read fails, c.nick is left as it is.
+func (c *Conn) loadSessionNick(ctx context.Context) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	nick, err := c.database.GetSessionNick(ctx, c.sessionID)
+	if err == nil {
+		c.nick = nick
+	}
+}
+
 // send writes a formatted IRC line to the connection.
 func (c *Conn) send(line string) {
 	c.sendWithin(writeTimeout, line)
 }
 
-// sendWithin writes a formatted IRC line to the connection
-// under the given write deadline.  Callers that must not be
-// held hostage by an unresponsive peer pass a shorter window
-// than writeTimeout.
+// sendWithin writes a formatted IRC line to the connection,
+// giving up after timeout. CR, LF and NUL are removed first,
+// as FormatMessage does for each parameter, so that a line
+// built without it cannot end early either.
 func (c *Conn) sendWithin(
 	timeout time.Duration,
 	line string,
 ) {
+	line = strings.ReplaceAll(line, "\r", "")
+	line = strings.ReplaceAll(line, "\n", "")
+	line = strings.ReplaceAll(line, "\x00", "")
+
 	c.writeMu.Lock()
 	defer c.writeMu.Unlock()
 
@@ -323,7 +361,7 @@ func (c *Conn) sendNumeric(
 	code irc.IRCMessageType,
 	params ...string,
 ) {
-	nick := c.nick
+	nick := c.currentNick()
 	if nick == "" {
 		nick = "*"
 	}
@@ -347,9 +385,11 @@ func (c *Conn) sendFromServer(
 // hostmask returns the client's full hostmask
 // (nick!user@host).
 func (c *Conn) hostmask() string {
+	nick := c.currentNick()
+
 	user := c.username
 	if user == "" {
-		user = c.nick
+		user = nick
 	}
 
 	host := c.hostname
@@ -357,7 +397,7 @@ func (c *Conn) hostmask() string {
 		host = c.remoteIP
 	}
 
-	return c.nick + "!" + user + "@" + host
+	return nick + "!" + user + "@" + host
 }
 
 // handleMessage dispatches a parsed IRC message using
@@ -367,13 +407,24 @@ func (c *Conn) handleMessage(
 	msg *Message,
 ) {
 	// Before registration, only NICK, USER, PASS, PING,
-	// QUIT, and CAP are accepted.
+	// PONG, QUIT, and CAP are accepted.
 	if !c.registered {
 		c.handlePreRegistration(ctx, msg)
 
 		return
 	}
 
+	// Every command is activity, so the idle cleanup must not
+	// remove this user.
+	err := c.database.UpdateLastSeen(
+		ctx, c.sessionID, c.clientID,
+	)
+	if err != nil {
+		c.log.Error(
+			"failed to update last_seen", "error", err,
+		)
+	}
+
 	handler, ok := c.commands[msg.Command]
 	if !ok {
 		c.sendNumeric(
@@ -405,6 +456,7 @@ func (c *Conn) handlePreRegistration(
 		}
 
 		c.passWord = msg.Params[0]
+		c.gotPass = true
 	case irc.CmdNick:
 		if len(msg.Params) < 1 {
 			c.sendNumeric(
@@ -415,11 +467,16 @@ func (c *Conn) handlePreRegistration(
 			return
 		}
 
-		c.nick = msg.Params[0]
-		if len(c.nick) > maxNickLen {
-			c.nick = c.nick[:maxNickLen]
+		if !service.ValidNick(msg.Params[0]) {
+			c.sendNumeric(
+				irc.ErrErroneusNickname,
+				msg.Params[0], "Erroneous nickname",
+			)
+
+			return
 		}
 
+		c.nick = msg.Params[0]
 		c.gotNick = true
 	case irc.CmdUser:
 		if len(msg.Params) < 4 { //nolint:mnd
@@ -437,6 +494,10 @@ func (c *Conn) handlePreRegistration(
 	case irc.CmdPing:
 		c.handlePing(msg)
 
+		return
+	case irc.CmdPong:
+		// The answer to serve's PING, which unregistered
+		// clients are sent too.
 		return
 	case irc.CmdQuit:
 		c.handleQuit(msg)
@@ -507,21 +568,23 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 	c.registered = true
 	c.mu.Unlock()
 
-	// Make this connection reachable by session ID so that
-	// KILL from either transport can disconnect it.
+	// So that KILL, from either transport, can close it.
 	c.svc.RegisterWireConn(sessionID, c)
 
-	// If PASS was provided before registration, set the
-	// session password.
-	if c.passWord != "" && len(c.passWord) >= minPasswordLen {
-		c.setPassword(ctx, c.passWord)
-	}
-
 	// Send welcome burst.
 	c.deliverWelcome()
 	c.deliverLusers(ctx)
 	c.deliverMOTD()
 
+	// If PASS was given before registration, store its
+	// password now, after the welcome burst, so that a
+	// NOTICE refusing it reaches a registered client. A
+	// failure to store it is only logged, as it is for PASS
+	// after registration.
+	if c.gotPass && c.checkPasswordLength(c.passWord) {
+		_ = c.setPassword(ctx, c.passWord)
+	}
+
 	// Start the message relay goroutine.
 	go c.relayMessages(ctx)
 }
@@ -604,13 +667,33 @@ func (c *Conn) deliverMOTD() {
 	)
 }
 
-// setPassword sets a bcrypt password on the session.
-func (c *Conn) setPassword(ctx context.Context, pw string) {
+// checkPasswordLength reports whether pw is 8 to 72 bytes
+// long, and sends the client a NOTICE saying so when it is
+// not.
+func (c *Conn) checkPasswordLength(pw string) bool {
+	if len(pw) >= minPasswordLen && len(pw) <= maxPasswordLen {
+		return true
+	}
+
+	c.sendFromServer("NOTICE", c.currentNick(),
+		"Password must be 8 to 72 bytes",
+	)
+
+	return false
+}
+
+// setPassword sets a bcrypt password on the session, and
+// logs and returns the error when it was not stored.
+func (c *Conn) setPassword(ctx context.Context, pw string) error {
 	// Use the database's auth module to hash and store.
 	err := c.database.SetPassword(ctx, c.sessionID, pw)
 	if err != nil {
 		c.log.Error(
 			"failed to set password", "error", err,
 		)
+
+		return err
 	}
+
+	return nil
 }

internal/ircserver/conn_test.go

@@ -5,6 +5,7 @@ import (
 	"log/slog"
 	"net"
 	"os"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -13,43 +14,39 @@ import (
 	"sneak.berlin/go/neoirc/internal/ircserver"
 )
 
-// disconnectBudget is how long Disconnect is allowed to
-// take when the victim never reads.  It is far below the
-// 30s writeTimeout that the old synchronous implementation
-// would have burned on each of its two writes.
-const disconnectBudget = 2 * time.Second
+// newKillVictim returns a Conn for the nick victim whose
+// socket is one end of a net.Pipe, and the other end, from
+// which the test reads what the victim is sent. A write to
+// the pipe blocks until the other end reads.
+func newKillVictim(t *testing.T) (*ircserver.Conn, net.Conn) {
+	t.Helper()
 
-// TestDisconnectDoesNotBlockOnUnresponsiveVictim proves
-// that an operator KILL cannot be stalled by its target.
-// The victim's socket is a net.Pipe, so every write blocks
-// until the peer reads and the peer here never does.  The
-// old implementation performed both notification writes on
-// the killer's goroutine, which wedged the operator's own
-// serve() loop on the IRC path and the API request on the
-// HTTP path for as long as the victim cared to stay silent.
+	serverSide, clientSide := net.Pipe()
+
+	t.Cleanup(func() { _ = clientSide.Close() })
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError},
+	))
+	cfg := &config.Config{ServerName: testServerName}
+
+	return ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	), clientSide
+}
+
+// TestDisconnectDoesNotBlockOnUnresponsiveVictim checks
+// that Disconnect returns although the victim never reads,
+// so a KILL cannot stall the operator who sent it. The
+// limit is well below one KillWriteWindow, so a Disconnect
+// that waits on any write to the victim fails.
 func TestDisconnectDoesNotBlockOnUnresponsiveVictim(
 	t *testing.T,
 ) {
 	t.Parallel()
 
-	serverSide, clientSide := net.Pipe()
-
-	t.Cleanup(func() {
-		_ = clientSide.Close()
-	})
-
-	log := slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
-	))
-	cfg := &config.Config{ //nolint:exhaustruct
-		ServerName: "test.irc",
-	}
-
-	victim := ircserver.NewTestConn(
-		log, cfg, serverSide, "victim",
-	)
-
+	victim, _ := newKillVictim(t)
 	returned := make(chan struct{})
 
 	go func() {
@@ -59,66 +56,44 @@ func TestDisconnectDoesNotBlockOnUnresponsiveVictim(
 
 	select {
 	case <-returned:
-	case <-time.After(disconnectBudget):
-		t.Fatal(
-			"Disconnect blocked on the victim's socket; " +
-				"the killer must not be held hostage",
-		)
+	case <-time.After(ircserver.KillWriteWindow / 4):
+		t.Fatal("Disconnect waited for the victim to read")
 	}
 }
 
-// TestDisconnectNotifiesAndClosesVictim is the other half
-// of the contract: moving the notification off the killer's
-// goroutine must not lose it.  A victim that does read gets
-// both the KILL and the ERROR line, and then its socket is
-// closed so its read loop unblocks.
+// TestDisconnectNotifiesAndClosesVictim checks that a
+// victim that reads is sent KILL and ERROR, and that its
+// connection is then closed.
 func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
 	t.Parallel()
 
-	serverSide, clientSide := net.Pipe()
-
-	t.Cleanup(func() {
-		_ = clientSide.Close()
-	})
-
-	log := slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
-	))
-	cfg := &config.Config{ //nolint:exhaustruct
-		ServerName: "test.irc",
-	}
-
-	victim := ircserver.NewTestConn(
-		log, cfg, serverSide, "victim",
-	)
-
-	lines := make(chan []string, 1)
+	victim, clientSide := newKillVictim(t)
+	received := make(chan []string, 1)
 
 	go func() {
-		var got []string
+		var lines []string
 
 		scanner := bufio.NewScanner(clientSide)
 		for scanner.Scan() {
-			got = append(got, scanner.Text())
+			lines = append(lines, scanner.Text())
 		}
 
-		lines <- got
+		received <- lines
 	}()
 
 	victim.Disconnect("killed by oper")
 
-	var got []string
+	var lines []string
 
 	select {
-	case got = <-lines:
-	case <-time.After(5 * time.Second):
-		t.Fatal("victim socket was never closed")
+	case lines = <-received:
+	case <-time.After(testTimeout):
+		t.Fatal("the victim's connection was not closed")
 	}
 
-	joined := strings.Join(got, "\n")
+	joined := strings.Join(lines, "\n")
 
-	if !strings.Contains(joined, "KILL victim") {
+	if !strings.Contains(joined, "KILL victim :killed by oper") {
 		t.Errorf("missing KILL line, got: %q", joined)
 	}
 
@@ -126,3 +101,48 @@ func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
 		t.Errorf("missing ERROR line, got: %q", joined)
 	}
 }
+
+// TestDisconnectReasonCannotStartLine checks that CR, LF and
+// NUL in a KILL reason are removed from both the KILL line
+// and the ERROR line, so the victim gets exactly those two
+// lines. The ERROR line is not built with FormatMessage, so
+// only the removal in sendWithin protects it.
+func TestDisconnectReasonCannotStartLine(t *testing.T) {
+	t.Parallel()
+
+	victim, clientSide := newKillVictim(t)
+	received := make(chan []string, 1)
+
+	go func() {
+		var lines []string
+
+		scanner := bufio.NewScanner(clientSide)
+		for scanner.Scan() {
+			lines = append(lines, scanner.Text())
+		}
+
+		received <- lines
+	}()
+
+	victim.Disconnect("bye\r\nPRIVMSG victim :forged\x00")
+
+	var lines []string
+
+	select {
+	case lines = <-received:
+	case <-time.After(testTimeout):
+		t.Fatal("the victim's connection was not closed")
+	}
+
+	// The test connection has no host name, hence the two
+	// spaces after "Closing Link:".
+	want := []string{
+		":" + testServerName +
+			" KILL victim :byePRIVMSG victim :forged",
+		"ERROR :Closing Link:  (byePRIVMSG victim :forged)",
+	}
+
+	if !slices.Equal(lines, want) {
+		t.Errorf("got lines %q, want %q", lines, want)
+	}
+}

internal/ircserver/export_test.go

@@ -13,13 +13,18 @@ import (
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
-// NewTestServer creates a Server suitable for testing.
+// NewTestServer creates a Server suitable for testing, whose
+// connections use interval and deadline in place of
+// pingInterval and pongDeadline, and resolve in place of
+// resolveHost.
 // The caller must call Stop() when finished.
 func NewTestServer(
 	log *slog.Logger,
 	cfg *config.Config,
 	database *db.Database,
 	brk *broker.Broker,
+	interval, deadline time.Duration,
+	resolve func(ctx context.Context, addr string) string,
 ) *Server {
 	globs := &globals.Globals{
 		Appname:   "neoirc",
@@ -38,9 +43,19 @@ func NewTestServer(
 		brk:      brk,
 		svc:      svc,
 		conns:    make(map[*Conn]struct{}),
+
+		pingInterval: interval,
+		pongDeadline: deadline,
+		resolveHost:  resolve,
 	}
 }
 
+// ResolveHost is the reverse DNS lookup that a server made by
+// New does for each client.
+func ResolveHost(ctx context.Context, addr string) string {
+	return resolveHost(ctx, addr)
+}
+
 // Start exposes the unexported start method for tests.
 func (s *Server) Start(addr string) error {
 	return s.start(context.Background(), addr)
@@ -56,19 +71,47 @@ func (s *Server) Listener() net.Listener {
 	return s.listener
 }
 
-// NewTestConn wraps an already-established net.Conn in a
-// Conn so tests can drive connection-level behaviour such
-// as Disconnect without standing up a whole server.
+// Service returns the service the server's connections use.
+func (s *Server) Service() *service.Service {
+	return s.svc
+}
+
+// PingTimes returns how long the server's connections wait
+// with nothing read before they are sent a PING, and after it
+// before they are closed.
+func (s *Server) PingTimes() (time.Duration, time.Duration) {
+	return s.pingInterval, s.pongDeadline
+}
+
+// KillWriteWindow is how long Disconnect allows each write
+// to a killed victim.
+const KillWriteWindow = killWriteWindow
+
+// PollInterval is how often the relay checks the client
+// output queue when no broker notification arrives.
+const PollInterval = pollInterval
+
+// PingInterval is how long the server waits with nothing read
+// from a connection before it sends a PING.
+const PingInterval = pingInterval
+
+// PongDeadline is how long the server waits after the PING
+// for a line before it closes the connection.
+const PongDeadline = pongDeadline
+
+// StopTimeout is the longest Stop waits for the connections'
+// cleanup.
+const StopTimeout = stopTimeout
+
+// NewTestConn returns a Conn for nick on tcpConn, without a
+// server, database or service behind it.
 func NewTestConn(
 	log *slog.Logger,
 	cfg *config.Config,
 	tcpConn net.Conn,
 	nick string,
 ) *Conn {
-	conn := newConn(
-		context.Background(), tcpConn, log,
-		nil, nil, cfg, nil,
-	)
+	conn := newConn(tcpConn, log, nil, nil, cfg, nil)
 	conn.nick = nick
 
 	return conn

internal/ircserver/integration_test.go

@@ -4,6 +4,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"sneak.berlin/go/neoirc/internal/config"
 )
 
 // TestIntegrationTwoClients is a comprehensive integration
@@ -777,39 +779,28 @@ func TestIntegrationUserhost(t *testing.T) {
 	bob := env.dial(t)
 	bob.register("bob")
 
-	// Query single nick.
-	alice.send("USERHOST bob")
-
-	aliceReply := alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 302 ")
+	bob.send("AWAY :lunch")
+	bob.readUntil(func(l string) bool {
+		return strings.Contains(l, " 306 ")
 	})
-	assertContains(
-		t, aliceReply, " 302 ",
-		"RPL_USERHOST",
-	)
-	assertContains(
-		t, aliceReply, "bob",
-		"USERHOST contains queried nick",
-	)
 
-	// Query multiple nicks.
-	bob.send("USERHOST alice bob")
+	for _, step := range []struct {
+		line, want string
+	}{
+		{"USERHOST alice", " 302 alice alice=+alice@"},
+		{"USERHOST alice bob", " :alice=+alice@"},
+		{"USERHOST alice bob", " bob=-bob@"},
+		{"USERHOST nobody", " 302 alice :"},
+		{"USERHOST", " 461 alice USERHOST :"},
+	} {
+		alice.send(step.line)
 
-	bobReply := bob.readUntil(func(l string) bool {
-		return strings.Contains(l, " 302 ")
-	})
-	assertContains(
-		t, bobReply, " 302 ",
-		"RPL_USERHOST multi-nick",
-	)
-	assertContains(
-		t, bobReply, "alice",
-		"USERHOST multi contains alice",
-	)
-	assertContains(
-		t, bobReply, "bob",
-		"USERHOST multi contains bob",
-	)
+		reply := alice.readUntil(func(l string) bool {
+			return strings.Contains(l, " 302 ") ||
+				strings.Contains(l, " 461 ")
+		})
+		assertContains(t, reply, step.want, step.line)
+	}
 }
 
 // TestIntegrationVersion verifies the VERSION command
@@ -919,17 +910,54 @@ func TestIntegrationTime(t *testing.T) {
 		"RPL_TIME",
 	)
 	assertContains(
-		t, aliceReply, "test.irc",
+		t, aliceReply, testServerName,
 		"TIME reply includes server name",
 	)
 }
 
-// TestIntegrationKill verifies the KILL command: oper can
-// kill a user, non-oper cannot, and — most importantly —
-// that the victim is actually disconnected rather than
-// merely announced as having quit.
-//
-//nolint:funlen // one KILL scenario asserted end to end
+// becomeOper sends OPER with newTestEnvWithOper's
+// credentials and waits for RPL_YOUREOPER.
+func (tc *testClient) becomeOper() {
+	tc.t.Helper()
+
+	tc.send("OPER testoper testpass")
+	tc.readUntil(func(l string) bool {
+		return strings.Contains(l, " 381 ")
+	})
+}
+
+// TestIntegrationKillRefused covers the KILL errors: not an
+// operator, no such nick, and killing yourself.
+func TestIntegrationKillRefused(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnvWithOper(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	for _, step := range []struct {
+		line, numeric string
+	}{
+		{"KILL bob :nope", " 481 "},
+		{"OPER testoper testpass", " 381 "},
+		{"KILL nobody123 :gone", " 401 "},
+		{"KILL alice :me", " 483 "},
+	} {
+		alice.send(step.line)
+
+		reply := alice.readUntil(func(l string) bool {
+			return strings.Contains(l, step.numeric)
+		})
+		assertContains(t, reply, step.numeric, step.line)
+	}
+}
+
+// TestIntegrationKill checks that the victim of a KILL is
+// told why, is disconnected, and is gone from its channels.
 func TestIntegrationKill(t *testing.T) {
 	t.Parallel()
 
@@ -941,7 +969,6 @@ func TestIntegrationKill(t *testing.T) {
 	bob := env.dial(t)
 	bob.register("bob")
 
-	// Both join a channel so KILL's QUIT is visible.
 	alice.joinAndDrain("#killtest")
 	bob.joinAndDrain("#killtest")
 
@@ -951,30 +978,9 @@ func TestIntegrationKill(t *testing.T) {
 			strings.Contains(l, "bob")
 	})
 
-	// Non-oper KILL should fail.
-	alice.send("KILL bob :nope")
-
-	aliceKillFail := alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 481 ")
-	})
-	assertContains(
-		t, aliceKillFail, " 481 ",
-		"ERR_NOPRIVILEGES for non-oper KILL",
-	)
-
-	// alice becomes oper.
-	alice.send("OPER testoper testpass")
-	alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 381 ")
-	})
-
-	// Oper KILL should succeed.
+	alice.becomeOper()
 	alice.send("KILL bob :bad behavior")
 
-	// The victim must be told why and then disconnected.
-	// Reading to EOF is the assertion that matters: a KILL
-	// that only broadcasts a QUIT leaves bob holding a
-	// socket that looks alive but delivers nothing.
 	bobLines := bob.readUntilClosed()
 	assertContains(
 		t, bobLines, "KILL",
@@ -1024,17 +1030,6 @@ func TestIntegrationKill(t *testing.T) {
 		t, aliceWho, "bob",
 		"killed user must not appear in WHO",
 	)
-
-	// KILL nonexistent nick.
-	alice.send("KILL nobody123 :gone")
-
-	aliceNoSuch := alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 401 ")
-	})
-	assertContains(
-		t, aliceNoSuch, " 401 ",
-		"ERR_NOSUCHNICK for KILL missing target",
-	)
 }
 
 // TestIntegrationWallops verifies the WALLOPS command:
@@ -1061,11 +1056,7 @@ func TestIntegrationWallops(t *testing.T) {
 		"ERR_NOPRIVILEGES for non-oper WALLOPS",
 	)
 
-	// alice becomes oper.
-	alice.send("OPER testoper testpass")
-	alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 381 ")
-	})
+	alice.becomeOper()
 
 	// bob sets +w to receive wallops.
 	bob.send("MODE bob +w")
@@ -1092,6 +1083,54 @@ func TestIntegrationWallops(t *testing.T) {
 	)
 }
 
+// TestIntegrationUserMode covers MODE for a nick: changes
+// and queries of your own modes, refusal for another nick,
+// even one that differs from yours only in letter case, and
+// a rejected mode string changing nothing.
+func TestIntegrationUserMode(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	const (
+		notYours = " 502 alice :Can't change mode for other users"
+		unknown  = " 501 alice :Unknown MODE flag"
+	)
+
+	for _, step := range []struct {
+		line, want string
+	}{
+		{"MODE alice +w", " 221 alice +w"},
+		{"MODE Alice", notYours},
+		{"MODE Alice -w", notYours},
+		{"MODE bob", notYours},
+		{"MODE bob -w", notYours},
+		{"MODE alice xw", unknown},
+		{"MODE alice -w+z", unknown},
+		{"MODE alice", " 221 alice +w"},
+		{"MODE alice +w-w", " 221 alice +"},
+	} {
+		alice.send(step.line)
+
+		reply := alice.readUntil(func(l string) bool {
+			return strings.Contains(l, " 221 ") ||
+				strings.Contains(l, " 501 ") ||
+				strings.Contains(l, " 502 ")
+		})
+
+		last := reply[len(reply)-1]
+		if !strings.HasSuffix(last, step.want) {
+			t.Errorf("%s: want %q, got %q", step.line, step.want, last)
+		}
+	}
+}
+
 // TestIntegrationModeSecret tests +s (secret) channel
 // mode — verifies that +s can be set and the mode is
 // reflected in MODE queries.
@@ -1202,6 +1241,252 @@ func TestIntegrationModeModerated(t *testing.T) {
 	)
 }
 
+// TestIntegrationModeKey checks that JOIN takes the key of
+// a +k channel as its second parameter, and that with
+// several channels each key goes to the channel in the
+// same position.
+func TestIntegrationModeKey(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#keyed")
+	alice.joinAndDrain("#vault")
+
+	// The IRC listener cannot set +k, so the test sets the
+	// keys directly.
+	for channel, key := range map[string]string{
+		"#keyed": "sesame",
+		"#vault": "barley",
+	} {
+		chID, err := env.database.GetChannelByName(
+			t.Context(), channel,
+		)
+		if err != nil {
+			t.Fatalf("get channel %s: %v", channel, err)
+		}
+
+		err = env.database.SetChannelKey(t.Context(), chID, key)
+		if err != nil {
+			t.Fatalf("set key of %s: %v", channel, err)
+		}
+	}
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	bob.sendAndExpect("JOIN #keyed", " 475 ")
+	bob.sendAndExpect("JOIN #keyed wrong", " 475 ")
+
+	lines := bob.sendAndExpect("JOIN #keyed sesame", " 366 ")
+	assertContains(
+		t, lines, "JOIN #keyed", "bob joins with the key",
+	)
+
+	carol := env.dial(t)
+	carol.register("carol")
+
+	lines = carol.sendAndExpect(
+		"JOIN #keyed,#vault sesame,barley", " 366 carol #vault ",
+	)
+	assertContains(t, lines, "JOIN #keyed", "carol joins #keyed")
+	assertContains(t, lines, "JOIN #vault", "carol joins #vault")
+	assertNotContains(t, lines, " 475 ", "carol's JOIN")
+}
+
+// TestIntegrationModeInviteOnly checks that INVITE lets a
+// user into a +i channel.
+func TestIntegrationModeInviteOnly(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#invonly")
+	alice.sendAndExpect("MODE #invonly +i", "+i")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	bob.sendAndExpect("JOIN #invonly", " 473 ")
+
+	alice.sendAndExpect("INVITE bob #invonly", " 341 ")
+
+	lines := bob.sendAndExpect("JOIN #invonly", " 366 ")
+	assertContains(
+		t, lines, "JOIN #invonly", "bob joins once invited",
+	)
+}
+
+// TestIntegrationModeInviteOnlyNeedsOperator checks that on
+// a +i channel an INVITE from a member who is not a channel
+// operator gets 482 and does not let the invited user in.
+func TestIntegrationModeInviteOnlyNeedsOperator(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#invonly")
+
+	// Bob joins before +i is set, so he is a member but
+	// not an operator.
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.joinAndDrain("#invonly")
+
+	alice.sendAndExpect("MODE #invonly +i", "+i")
+
+	carol := env.dial(t)
+	carol.register("carol")
+
+	lines := bob.sendAndExpect("INVITE carol #invonly", " 482 ")
+	assertContains(
+		t, lines, " 482 bob #invonly ", "bob's INVITE refused",
+	)
+
+	carol.sendAndExpect("JOIN #invonly", " 473 ")
+}
+
+// TestIntegrationInviteUserOnChannel checks that inviting a
+// user who is already on the channel gets 443.
+func TestIntegrationInviteUserOnChannel(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#room")
+
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.joinAndDrain("#room")
+
+	lines := alice.sendAndExpect("INVITE bob #room", " 443 ")
+	assertContains(
+		t, lines, " 443 alice bob #room ", "alice's INVITE refused",
+	)
+}
+
+// TestIntegrationInviteLine checks that an IRC listener user
+// invited by an IRC listener user, and then over the HTTP
+// API, gets an INVITE line from the inviter for the channel
+// each time.
+func TestIntegrationInviteLine(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#inv")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	alice.sendAndExpect("INVITE bob #inv", " 341 ")
+
+	got := bob.readLine()
+	want := ":alice!alice@* INVITE bob #inv"
+
+	if got != want {
+		t.Errorf("from the IRC listener: got %q, want %q", got, want)
+	}
+
+	// The HTTP API queues an INVITE with the channel as its body.
+	env.queueMessage(t, "bob", "INVITE", "carol", "bob", []string{"#inv"})
+
+	got = bob.readLine()
+	want = ":carol!carol@* INVITE bob #inv"
+
+	if got != want {
+		t.Errorf("over the HTTP API: got %q, want %q", got, want)
+	}
+}
+
+// TestIntegrationModeSecretList checks that LIST shows a +s
+// channel only to its members.
+func TestIntegrationModeSecretList(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#hidden")
+	alice.joinAndDrain("#visible")
+	alice.sendAndExpect("MODE #hidden +s", "+s")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	bobList := bob.sendAndExpect("LIST", " 323 ")
+	assertContains(
+		t, bobList, " 322 bob #visible ", "bob's LIST",
+	)
+	assertNotContains(t, bobList, "#hidden", "bob's LIST")
+
+	aliceList := alice.sendAndExpect("LIST", " 323 ")
+	assertContains(
+		t, aliceList, " 322 alice #hidden ", "alice's LIST",
+	)
+}
+
+// TestIntegrationModeSecretWhois checks that WHOIS names a
+// +s channel only to users on it.
+func TestIntegrationModeSecretWhois(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#hidden")
+	alice.joinAndDrain("#visible")
+	alice.sendAndExpect("MODE #hidden +s", "+s")
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	bobWhois := bob.sendAndExpect("WHOIS alice", " 318 ")
+	assertContains(t, bobWhois, "@#visible", "bob's WHOIS")
+	assertNotContains(t, bobWhois, "#hidden", "bob's WHOIS")
+
+	carol := env.dial(t)
+	carol.register("carol")
+	carol.joinAndDrain("#hidden")
+
+	carolWhois := carol.sendAndExpect("WHOIS alice", " 318 ")
+	assertContains(t, carolWhois, "@#hidden", "carol's WHOIS")
+}
+
+// TestIntegrationModeHashcash checks that PRIVMSG to a +H
+// channel is refused, since an IRC client cannot attach a
+// hashcash stamp.
+func TestIntegrationModeHashcash(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#stamped")
+	alice.sendAndExpect("MODE #stamped +H 2", "+H")
+
+	lines := alice.sendAndExpect(
+		"PRIVMSG #stamped :hello", " 404 ",
+	)
+	assertContains(
+		t, lines, " 404 alice #stamped :Channel requires hashcash",
+		"PRIVMSG refused",
+	)
+}
+
 // TestIntegrationThirdClientObserver verifies that a third
 // client observing the same channel receives messages from
 // the other two.
@@ -1246,79 +1531,29 @@ func TestIntegrationThirdClientObserver(t *testing.T) {
 	)
 }
 
-// assertNoEmptyParam fails if any line contains a doubled
-// space, which is what FormatMessage emits for an empty
-// non-trailing parameter.  A numeric whose server-name
-// parameter came out empty is malformed on the wire even
-// though it still contains the numeric code, so the other
-// assertions in this file would not catch it.
-func assertNoEmptyParam(
-	t *testing.T,
-	lines []string,
-	context string,
-) {
-	t.Helper()
-
-	for _, line := range lines {
-		if strings.Contains(line, "  ") {
-			t.Errorf(
-				"%s: empty parameter in wire line: %q",
-				context, line,
-			)
-		}
-	}
-}
-
-// TestIntegrationDefaultServerNameFallback runs the wire
-// server with SERVER_NAME unset, which is the shipped
-// default from config.go, and verifies that VERSION, ADMIN
-// and TIME fall back to "neoirc" exactly as the HTTP path
-// does instead of emitting an empty server-name parameter.
-//
-// Every other wire test hardcodes ServerName: "test.irc",
-// so none of them exercise the default configuration.
+// TestIntegrationDefaultServerNameFallback checks that with
+// SERVER_NAME unset, as it is by default, VERSION, ADMIN and
+// TIME name the server "neoirc".
 func TestIntegrationDefaultServerNameFallback(t *testing.T) {
 	t.Parallel()
 
-	env := newTestEnvWithServerName(t, "")
+	env := newTestEnvWithConfig(t, &config.Config{})
 
 	alice := env.dial(t)
 	alice.register("alice")
 
-	alice.send("VERSION")
+	for _, step := range []struct {
+		line, lastNumeric, want string
+	}{
+		{"VERSION", " 351 ", " 351 alice neoirc-test. neoirc "},
+		{"ADMIN", " 259 ", " 256 alice neoirc "},
+		{"TIME", " 391 ", " 391 alice neoirc "},
+	} {
+		alice.send(step.line)
 
-	versionReply := alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 351 ")
-	})
-	assertNoEmptyParam(t, versionReply, "VERSION")
-	assertContains(
-		t, versionReply, "neoirc",
-		"VERSION falls back to default server name",
-	)
-
-	alice.send("ADMIN")
-
-	adminReply := alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 259 ")
-	})
-	assertNoEmptyParam(t, adminReply, "ADMIN")
-	assertContains(
-		t, adminReply, " 256 alice neoirc ",
-		"RPL_ADMINME names the default server",
-	)
-	assertContains(
-		t, adminReply, "admin@neoirc",
-		"RPL_ADMINEMAIL is a well-formed address",
-	)
-
-	alice.send("TIME")
-
-	timeReply := alice.readUntil(func(l string) bool {
-		return strings.Contains(l, " 391 ")
-	})
-	assertNoEmptyParam(t, timeReply, "TIME")
-	assertContains(
-		t, timeReply, " 391 alice neoirc ",
-		"RPL_TIME names the default server",
-	)
+		reply := alice.readUntil(func(l string) bool {
+			return strings.Contains(l, step.lastNumeric)
+		})
+		assertContains(t, reply, step.want, step.line)
+	}
 }

internal/ircserver/parser.go

@@ -90,7 +90,10 @@ func ParseMessage(line string) *Message {
 }
 
 // FormatMessage formats an IRC message into wire protocol
-// format (without the trailing CR-LF).
+// format (without the trailing CR-LF). CR, LF and NUL are
+// removed from each parameter, because on the wire they would
+// end the line early; this happens before deciding whether
+// the last parameter needs a leading ':'.
 func FormatMessage(
 	prefix, command string,
 	params ...string,
@@ -106,6 +109,10 @@ func FormatMessage(
 	buf.WriteString(command)
 
 	for i, param := range params {
+		param = strings.ReplaceAll(param, "\r", "")
+		param = strings.ReplaceAll(param, "\n", "")
+		param = strings.ReplaceAll(param, "\x00", "")
+
 		buf.WriteByte(' ')
 
 		isLast := i == len(params)-1

internal/ircserver/relay.go

@@ -3,6 +3,7 @@ package ircserver
 import (
 	"context"
 	"encoding/json"
+	"slices"
 	"strings"
 	"time"
 
@@ -26,22 +27,34 @@ func (c *Conn) relayMessages(ctx context.Context) {
 		default:
 		}
 
-		// Drain any available messages.
-		delivered := c.drainQueue(ctx)
+		// Register with the broker before draining, so that a
+		// message queued after the drain has read the queue
+		// still signals waitCh.
+		waitCh := c.brk.Wait(c.sessionID)
+
+		// Drain any available messages. The drain ignores the
+		// cancel that comes when the connection ends, because a
+		// query cancelled while it runs leaves the SQLite
+		// connection marked broken, and the pool closes it. The
+		// loop still stops on ctx.
+		delivered := c.drainQueue(context.WithoutCancel(ctx))
 
 		if delivered {
+			c.brk.Remove(c.sessionID, waitCh)
+
 			// Tight loop while there are messages.
 			continue
 		}
 
 		// Wait for notification or timeout.
-		waitCh := c.brk.Wait(c.sessionID)
-
 		select {
 		case <-waitCh:
 			// New message notification — loop back.
 		case <-ticker.C:
-			// Periodic check.
+			// Periodic check. Nothing used waitCh, so take it
+			// out of the broker before the next pass adds
+			// another.
+			c.brk.Remove(c.sessionID, waitCh)
 		case <-ctx.Done():
 			c.brk.Remove(c.sessionID, waitCh)
 
@@ -83,7 +96,7 @@ func (c *Conn) drainQueue(ctx context.Context) bool {
 //
 //nolint:cyclop // dispatch table
 func (c *Conn) deliverIRCMessage(
-	_ context.Context,
+	ctx context.Context,
 	msg *db.IRCMessage,
 ) {
 	command := msg.Command
@@ -105,13 +118,13 @@ func (c *Conn) deliverIRCMessage(
 	case isNumeric(command):
 		c.deliverNumeric(msg, text)
 	case command == irc.CmdPrivmsg || command == irc.CmdNotice:
-		c.deliverTextMessage(msg, command, text)
+		c.deliverTextMessage(msg, command, bodyLines)
 	case command == irc.CmdJoin:
 		c.deliverJoin(msg)
 	case command == irc.CmdPart:
 		c.deliverPart(msg, text)
 	case command == irc.CmdNick:
-		c.deliverNickChange(msg, text)
+		c.deliverNickChange(ctx, msg, text)
 	case command == irc.CmdQuit:
 		c.deliverQuitMsg(msg, text)
 	case command == irc.CmdTopic:
@@ -123,7 +136,7 @@ func (c *Conn) deliverIRCMessage(
 	case command == irc.CmdWallops:
 		c.deliverWallops(msg, text)
 	case command == irc.CmdMode:
-		c.deliverMode(msg, text)
+		c.deliverMode(msg, bodyLines)
 	case command == irc.CmdPing:
 		// Server-originated PING — reply with PONG.
 		c.sendFromServer("PING", c.serverSfx)
@@ -179,43 +192,28 @@ func (c *Conn) deliverNumeric(
 	c.send(FormatMessage(from, msg.Command, allParams...))
 }
 
-// deliverTextMessage sends PRIVMSG or NOTICE.
+// deliverTextMessage sends PRIVMSG or NOTICE, one line for
+// each line of the body.
 func (c *Conn) deliverTextMessage(
 	msg *db.IRCMessage,
-	command, text string,
+	command string,
+	bodyLines []string,
 ) {
 	from := msg.From
 	target := msg.To
 
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// Don't echo our own messages back.
-	if strings.EqualFold(from, nick) {
-		return
-	}
-
 	prefix := from
 	if !strings.Contains(prefix, "!") {
 		prefix = from + "!" + from + "@*"
 	}
 
-	c.send(FormatMessage(prefix, command, target, text))
+	for _, line := range bodyLines {
+		c.send(FormatMessage(prefix, command, target, line))
+	}
 }
 
 // deliverJoin sends a JOIN notification.
 func (c *Conn) deliverJoin(msg *db.IRCMessage) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	// Don't echo our own JOINs (we already sent them
-	// during joinChannel).
-	if strings.EqualFold(msg.From, nick) {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -224,14 +222,6 @@ func (c *Conn) deliverJoin(msg *db.IRCMessage) {
 
 // deliverPart sends a PART notification.
 func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if strings.EqualFold(msg.From, nick) {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -244,18 +234,17 @@ func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
 	}
 }
 
-// deliverNickChange sends a NICK change notification.
+// deliverNickChange sends a NICK change notification. The
+// change may be its own session's, made from another client,
+// so the connection first takes the nick its session holds
+// now. It does not go by the line's old nick: the connection
+// may have taken that nick after another user gave it up.
 func (c *Conn) deliverNickChange(
+	ctx context.Context,
 	msg *db.IRCMessage,
 	newNick string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if strings.EqualFold(msg.From, nick) {
-		return
-	}
+	c.loadSessionNick(ctx)
 
 	prefix := msg.From + "!" + msg.From + "@*"
 
@@ -267,14 +256,6 @@ func (c *Conn) deliverQuitMsg(
 	msg *db.IRCMessage,
 	text string,
 ) {
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	if strings.EqualFold(msg.From, nick) {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
 
 	if text != "" {
@@ -327,16 +308,24 @@ func (c *Conn) deliverKickMsg(
 	}
 }
 
-// deliverInviteMsg sends an INVITE notification.
+// deliverInviteMsg sends an INVITE line from the inviter
+// for the channel named in text, or nothing when text names
+// no channel.
 func (c *Conn) deliverInviteMsg(
-	_ *db.IRCMessage,
+	msg *db.IRCMessage,
 	text string,
 ) {
+	if text == "" {
+		return
+	}
+
 	c.mu.Lock()
 	nick := c.nick
 	c.mu.Unlock()
 
-	c.sendFromServer("NOTICE", nick, text)
+	prefix := msg.From + "!" + msg.From + "@*"
+
+	c.send(FormatMessage(prefix, "INVITE", nick, text))
 }
 
 // deliverWallops sends a WALLOPS notification.
@@ -351,15 +340,26 @@ func (c *Conn) deliverWallops(
 	))
 }
 
-// deliverMode sends a MODE change notification.
+// deliverMode sends a MODE change notification. The first
+// body line is the change, possibly followed by its values
+// separated by spaces ("+o bob"); any further lines are
+// values ("+k", "secret"). Each goes out as its own
+// parameter, as IRC sends them.
 func (c *Conn) deliverMode(
 	msg *db.IRCMessage,
-	text string,
+	bodyLines []string,
 ) {
-	prefix := msg.From + "!" + msg.From + "@*"
-	target := msg.To
-
-	if text != "" {
-		c.send(FormatMessage(prefix, "MODE", target, text))
+	if len(bodyLines) == 0 || bodyLines[0] == "" {
+		return
 	}
+
+	prefix := msg.From + "!" + msg.From + "@*"
+
+	params := slices.Concat(
+		[]string{msg.To},
+		strings.Fields(bodyLines[0]),
+		bodyLines[1:],
+	)
+
+	c.send(FormatMessage(prefix, "MODE", params...))
 }

internal/ircserver/relay_test.go

@@ -0,0 +1,697 @@
+package ircserver_test
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/neoirc/internal/ircserver"
+	"sneak.berlin/go/neoirc/internal/service"
+)
+
+// queueMessage queues a message for the user with nick
+// recipient the way the HTTP API sends one: stored once, then
+// queued to the recipient's session.
+func (env *testEnv) queueMessage(
+	t *testing.T,
+	recipient, command, from, to string,
+	body []string,
+) {
+	t.Helper()
+
+	ctx := t.Context()
+
+	bodyJSON, err := json.Marshal(body)
+	if err != nil {
+		t.Fatalf("marshal body: %v", err)
+	}
+
+	msgID, _, err := env.database.InsertMessage(
+		ctx, command, from, to, 0, 0, nil, bodyJSON, nil,
+	)
+	if err != nil {
+		t.Fatalf("insert message: %v", err)
+	}
+
+	sessionID, err := env.database.GetSessionByNick(ctx, recipient)
+	if err != nil {
+		t.Fatalf("get session of %s: %v", recipient, err)
+	}
+
+	err = env.database.EnqueueToSession(ctx, sessionID, msgID, 0)
+	if err != nil {
+		t.Fatalf("enqueue: %v", err)
+	}
+
+	env.brk.Notify(sessionID)
+}
+
+// TestRelayKeepsOneWaitChannel checks that an IRC listener
+// connection holds at most one broker wait channel across
+// several relay ticks, both while idle and after the relay
+// has delivered it a message, and none once it closes.
+func TestRelayKeepsOneWaitChannel(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	client := env.dial(t)
+	client.register("idle")
+
+	sessionID, err := env.database.GetSessionByNick(t.Context(), "idle")
+	if err != nil {
+		t.Fatalf("get session of idle: %v", err)
+	}
+
+	env.checkOneWaitChannel(t, sessionID)
+
+	env.queueMessage(
+		t, "idle", "PRIVMSG", "carol", "idle", []string{"hello"},
+	)
+
+	client.readUntil(func(l string) bool {
+		return strings.Contains(l, "hello")
+	})
+
+	env.checkOneWaitChannel(t, sessionID)
+
+	err = client.conn.Close()
+	if err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	deadline := time.Now().Add(testTimeout)
+
+	for env.brk.ListenerCount(sessionID) != 0 {
+		if time.Now().After(deadline) {
+			t.Fatalf("after close: got %d wait channels, want 0",
+				env.brk.ListenerCount(sessionID))
+		}
+
+		time.Sleep(relayCheckStep)
+	}
+}
+
+// checkOneWaitChannel fails the test if the session
+// sessionID holds more than one broker wait channel at any of
+// several relay ticks.
+func (env *testEnv) checkOneWaitChannel(
+	t *testing.T,
+	sessionID int64,
+) {
+	t.Helper()
+
+	const ticks = 5
+
+	for tick := range ticks {
+		time.Sleep(ircserver.PollInterval)
+
+		got := env.brk.ListenerCount(sessionID)
+		if got > 1 {
+			t.Fatalf("tick %d: got %d wait channels, want at most 1",
+				tick+1, got)
+		}
+	}
+}
+
+// TestRelayMultiLineBody checks that each line of a PRIVMSG
+// or NOTICE body sent over the HTTP API reaches an IRC
+// listener user as its own line.
+func TestRelayMultiLineBody(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	for _, command := range []string{"PRIVMSG", "NOTICE"} {
+		env.queueMessage(
+			t, "alice", command, "carol", "alice",
+			[]string{"first line", "second line"},
+		)
+
+		lines := alice.readUntil(func(l string) bool {
+			return strings.Contains(l, "second line")
+		})
+
+		want := []string{
+			":carol!carol@* " + command + " alice :first line",
+			":carol!carol@* " + command + " alice :second line",
+		}
+
+		got := lines[max(0, len(lines)-len(want)):]
+		if !slices.Equal(got, want) {
+			t.Errorf("%s: got %q, want %q", command, got, want)
+		}
+	}
+}
+
+// TestRelayModeParameters checks that a MODE change reaches
+// IRC listener members with its values as separate
+// parameters, both for the bodies the HTTP API stores and
+// for a change made on the IRC listener.
+func TestRelayModeParameters(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+
+	for _, step := range []struct {
+		body []string
+		want string
+	}{
+		{[]string{"+k", "secret"}, "+k secret"},
+		{[]string{"-k", "*"}, "-k *"},
+		{[]string{"+l", "50"}, "+l 50"},
+		{[]string{"-l"}, "-l"},
+		{[]string{"+b", "*!*@*.example.com"}, "+b *!*@*.example.com"},
+		{[]string{"-b", "*!*@*.example.com"}, "-b *!*@*.example.com"},
+		{[]string{"+o bob"}, "+o bob"},
+		{[]string{"+m"}, "+m"},
+	} {
+		env.queueMessage(t, "alice", "MODE", "op", "#modes", step.body)
+
+		lines := alice.readUntil(func(l string) bool {
+			return strings.Contains(l, " MODE ")
+		})
+
+		got := lines[len(lines)-1]
+		want := ":op!op@* MODE #modes " + step.want
+
+		if got != want {
+			t.Errorf("body %q: got %q, want %q", step.body, got, want)
+		}
+	}
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	alice.joinAndDrain("#modes")
+	bob.joinAndDrain("#modes")
+
+	alice.send("MODE #modes +v bob")
+
+	const change = " MODE #modes +v bob"
+
+	for name, client := range map[string]*testClient{
+		"alice": alice, "bob": bob,
+	} {
+		lines := client.readUntil(func(l string) bool {
+			return strings.Contains(l, " MODE ")
+		})
+
+		got := lines[len(lines)-1]
+		if !strings.HasSuffix(got, change) {
+			t.Errorf("%s: got %q, want it to end in %q", name, got, change)
+		}
+	}
+}
+
+// TestRelayInviteWithoutChannel checks that an INVITE whose
+// body names no channel sends the invited IRC listener user
+// no INVITE line.
+func TestRelayInviteWithoutChannel(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	// A nil body is stored as JSON null, which is not an array.
+	for _, body := range [][]string{nil, {}, {""}} {
+		env.queueMessage(t, "bob", "INVITE", "carol", "bob", body)
+	}
+
+	// The relay sends a user's queue in order, so this arrives
+	// after anything sent for the INVITEs above.
+	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
+		[]string{"the end"})
+
+	lines := bob.readUntil(func(l string) bool {
+		return strings.HasSuffix(l, " :the end")
+	})
+
+	for _, line := range lines {
+		if strings.Contains(line, " INVITE ") {
+			t.Errorf("got %q, want no INVITE line", line)
+		}
+	}
+}
+
+// TestRelayLineBreaks checks that a CR, LF or NUL in a stored
+// body line, key or mask never reaches an IRC listener user
+// as a line break, so no extra line arrives, and that a body
+// line keeps its parameter and leading ':' once they are
+// removed.
+func TestRelayLineBreaks(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	bob := env.dial(t)
+	bob.register("bob")
+
+	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob", []string{
+		"one\r\n:admin!a@b PRIVMSG bob :hi",
+		"two\n:admin!a@b NOTICE bob :hi\x00",
+	})
+	env.queueMessage(t, "bob", "MODE", "op", "#breaks",
+		[]string{"+k", "key\r\nERROR :Closing link"})
+	env.queueMessage(t, "bob", "MODE", "op", "#breaks",
+		[]string{"+b", "*!*@*\r\n:admin!a@b KICK #breaks bob"})
+	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
+		[]string{"\r\n", "\x00:hi"})
+	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
+		[]string{"the end"})
+
+	lines := bob.readUntil(func(l string) bool {
+		return strings.HasSuffix(l, " :the end")
+	})
+
+	want := []string{
+		":carol!carol@* PRIVMSG bob :one:admin!a@b PRIVMSG bob :hi",
+		":carol!carol@* PRIVMSG bob :two:admin!a@b NOTICE bob :hi",
+		":op!op@* MODE #breaks +k :keyERROR :Closing link",
+		":op!op@* MODE #breaks +b :*!*@*:admin!a@b KICK #breaks bob",
+		":carol!carol@* PRIVMSG bob :",
+		":carol!carol@* PRIVMSG bob ::hi",
+		":carol!carol@* PRIVMSG bob :the end",
+	}
+
+	got := lines[max(0, len(lines)-len(want)):]
+	if !slices.Equal(got, want) {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+// TestRelayNickDiffersOnlyInCase checks that an IRC listener
+// user alice receives a JOIN, PRIVMSG, PART, NICK and QUIT
+// from Alice in a channel they share: nicks are
+// case-sensitive, so Alice is someone else.
+func TestRelayNickDiffersOnlyInCase(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.joinAndDrain("#case")
+
+	capitalAlice := env.dial(t)
+	capitalAlice.register("Alice")
+
+	for _, step := range []struct {
+		line, want string
+	}{
+		{"JOIN #case", ":Alice!Alice@* JOIN #case"},
+		{"PRIVMSG #case :hi there", ":Alice!Alice@* PRIVMSG #case :hi there"},
+		{"PART #case :see you", ":Alice!Alice@* PART #case :see you"},
+		{"JOIN #case", ":Alice!Alice@* JOIN #case"},
+		{"NICK Alicia", ":Alice!Alice@* NICK Alicia"},
+		{"NICK Alice", ":Alicia!Alicia@* NICK Alice"}, // back for QUIT
+		{"QUIT", ":Alice!Alice@* QUIT :Quit: Connection closed"},
+	} {
+		capitalAlice.send(step.line)
+
+		got := alice.readLine()
+		if got != step.want {
+			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
+		}
+	}
+}
+
+// TestRelayOwnChangeOnce checks that an IRC listener user who
+// sets a topic, changes a channel mode or kicks gets one TOPIC,
+// MODE or KICK line for it, and so does the other member.
+func TestRelayOwnChangeOnce(t *testing.T) {
+	t.Parallel()
+
+	for _, step := range []struct {
+		command, line string
+	}{
+		{"TOPIC", "TOPIC #dup :new topic"},
+		{"MODE", "MODE #dup +m"},
+		{"KICK", "KICK #dup carl :bye"},
+	} {
+		t.Run(step.command, func(t *testing.T) {
+			t.Parallel()
+
+			env := newTestEnv(t)
+
+			alice := env.dial(t)
+			alice.register("alice")
+			alice.joinAndDrain("#dup")
+
+			carl := env.dial(t)
+			carl.register("carl")
+			carl.joinAndDrain("#dup")
+
+			alice.send(step.line)
+
+			// The reply to alice's next command comes after her
+			// command has finished, so her own copy comes before it.
+			beforePong := alice.sendAndExpect("PING :done", "PONG")
+
+			// The relay sends a user's queue in order, so a message
+			// queued now arrives after any relayed copy.
+			for nick, client := range map[string]*testClient{
+				"alice": alice, "carl": carl,
+			} {
+				env.queueMessage(
+					t, nick, "PRIVMSG", "dave", nick,
+					[]string{"after the change"},
+				)
+
+				lines := client.readUntil(func(l string) bool {
+					return strings.HasSuffix(l, " :after the change")
+				})
+
+				if client == alice {
+					lines = slices.Concat(beforePong, lines)
+				}
+
+				var changes []string
+
+				for _, line := range lines {
+					if strings.Contains(line, " "+step.command+" #dup ") {
+						changes = append(changes, line)
+					}
+				}
+
+				if len(changes) != 1 {
+					t.Errorf("%s got %q, want one %s line",
+						nick, changes, step.command)
+				}
+			}
+		})
+	}
+}
+
+// TestRelayOwnSessionOnce checks that a command a user makes
+// from one client of their session reaches each of the
+// session's clients once: an IRC listener connection and an
+// HTTP API client. The connection that sent a command gets
+// only its own echo, and none for PRIVMSG and NOTICE, which
+// IRC does not echo.
+//
+//nolint:funlen // table-driven test
+func TestRelayOwnSessionOnce(t *testing.T) {
+	t.Parallel()
+
+	hello := json.RawMessage(`["hello"]`)
+
+	for _, step := range []struct {
+		// line is the command as alice sends it on the IRC
+		// listener.
+		line string
+		// api makes the same command for her session the way
+		// the HTTP API does.
+		api func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error
+		// echoes is how many copies alice's connection gets of
+		// line when it sends line itself.
+		echoes int
+	}{
+		{"PRIVMSG #chan :hello", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			_, err := svc.SendChannelMessage(
+				ctx, sessionID, 0, "alice", "PRIVMSG", "#chan", hello, nil,
+			)
+
+			return err
+		}, 0},
+		{"NOTICE bob :hello", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			_, err := svc.SendDirectMessage(
+				ctx, sessionID, 0, "alice", "NOTICE", "bob", hello, nil,
+			)
+
+			return err
+		}, 0},
+		{"JOIN #other", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			_, err := svc.JoinChannel(ctx, sessionID, 0, "alice", "#other", "")
+
+			return err
+		}, 1},
+		{"PART #chan :bye", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.PartChannel(ctx, sessionID, 0, "alice", "#chan", "bye")
+		}, 1},
+		{"NICK alice2", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.ChangeNick(ctx, sessionID, 0, "alice", "alice2")
+		}, 1},
+		{"TOPIC #chan :new topic", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.SetTopic(
+				ctx, sessionID, 0, "alice", "#chan", "new topic",
+			)
+		}, 1},
+		{"MODE #chan +m", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			chID, err := svc.ValidateChannelOp(ctx, sessionID, "#chan")
+			if err != nil {
+				return err
+			}
+
+			err = svc.SetChannelFlag(ctx, chID, 'm', true)
+			if err != nil {
+				return err
+			}
+
+			svc.BroadcastMode(ctx, 0, "alice", "#chan", chID, "+m")
+
+			return nil
+		}, 1},
+		{"KICK #chan bob :bye", func(
+			ctx context.Context, svc *service.Service, sessionID int64,
+		) error {
+			return svc.KickUser(
+				ctx, sessionID, 0, "alice", "#chan", "bob", "bye",
+			)
+		}, 1},
+	} {
+		command := strings.Fields(step.line)[0]
+
+		t.Run(command+" from IRC", func(t *testing.T) {
+			t.Parallel()
+
+			ircCopies, httpCopies := ownSessionCopies(t, step.line, nil)
+			if ircCopies != step.echoes || httpCopies != 1 {
+				t.Errorf("connection got %d, HTTP client got %d, want %d and 1",
+					ircCopies, httpCopies, step.echoes)
+			}
+		})
+
+		t.Run(command+" from the HTTP API", func(t *testing.T) {
+			t.Parallel()
+
+			ircCopies, httpCopies := ownSessionCopies(t, step.line, step.api)
+			if ircCopies != 1 || httpCopies != 1 {
+				t.Errorf("connection got %d, HTTP client got %d, want 1 and 1",
+					ircCopies, httpCopies)
+			}
+		})
+	}
+}
+
+// ownSessionCopies sets up alice with aliceWithHTTPClient. It
+// makes the command line from her connection, or with api from
+// the HTTP API client when api is not nil, and returns how many
+// copies of it her connection and her HTTP API client got.
+func ownSessionCopies(
+	t *testing.T,
+	line string,
+	api func(ctx context.Context, svc *service.Service, sessionID int64) error,
+) (int, int) {
+	t.Helper()
+
+	ctx := t.Context()
+	env := newTestEnv(t)
+	alice, _, sessionID, httpClientID := aliceWithHTTPClient(t, env)
+
+	var lines []string
+
+	if api == nil {
+		alice.send(line)
+
+		// Her echo comes before the reply to her next command.
+		lines = alice.sendAndExpect("PING :done", "PONG")
+	} else {
+		err := api(ctx, env.srv.Service(), sessionID)
+		if err != nil {
+			t.Fatalf("%s over the HTTP API: %v", line, err)
+		}
+	}
+
+	msgs, _, err := env.database.PollMessages(ctx, httpClientID, 0, 0)
+	if err != nil {
+		t.Fatalf("poll the HTTP API client: %v", err)
+	}
+
+	httpCopies := 0
+
+	for _, msg := range msgs {
+		if msg.Command == strings.Fields(line)[0] {
+			httpCopies++
+		}
+	}
+
+	// The relay sends a queue in order, so this arrives after any
+	// copy. It is queued by session, as NICK changes her nick.
+	endID, _, err := env.database.InsertMessage(
+		ctx, "PRIVMSG", "dave", "alice", 0, 0,
+		nil, json.RawMessage(`["the end"]`), nil,
+	)
+	if err != nil {
+		t.Fatalf("insert message: %v", err)
+	}
+
+	err = env.database.EnqueueToSession(ctx, sessionID, endID, 0)
+	if err != nil {
+		t.Fatalf("enqueue: %v", err)
+	}
+
+	env.brk.Notify(sessionID)
+
+	lines = append(lines, alice.readUntil(func(l string) bool {
+		return strings.HasSuffix(l, " :the end")
+	})...)
+
+	// A copy starts with the command and its first parameter.
+	start := " " + strings.Join(strings.Fields(line)[:2], " ")
+	ircCopies := strings.Count(strings.Join(lines, "\n"), start)
+
+	return ircCopies, httpCopies
+}
+
+// aliceWithHTTPClient connects alice to the IRC listener and
+// has her join #chan, which bob is on too, then adds an HTTP API
+// client to her session with the password her connection set,
+// as POST /api/v1/login does. It returns her connection, bob's
+// connection, her session and her HTTP API client.
+func aliceWithHTTPClient(
+	t *testing.T, env *testEnv,
+) (*testClient, *testClient, int64, int64) {
+	t.Helper()
+
+	const password = "alicepass"
+
+	alice := env.dial(t)
+	alice.send("PASS " + password)
+	alice.register("alice")
+	// Registration stores the password before the JOIN runs.
+	alice.joinAndDrain("#chan")
+
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.joinAndDrain("#chan")
+
+	sessionID, httpClientID, _, err := env.database.LoginUser(
+		t.Context(), "alice", password, "127.0.0.1", "localhost",
+	)
+	if err != nil {
+		t.Fatalf("log in as alice: %v", err)
+	}
+
+	return alice, bob, sessionID, httpClientID
+}
+
+// TestRelayNickChangeFromHTTPAPI checks that once alice's nick
+// is changed from her HTTP API client, her IRC listener
+// connection uses the new nick: what she then sends from it
+// reaches bob under the new nick.
+func TestRelayNickChangeFromHTTPAPI(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+	alice, bob, sessionID, _ := aliceWithHTTPClient(t, env)
+
+	bob.joinAndDrain("#other")
+
+	// As the HTTP API does.
+	err := env.srv.Service().ChangeNick(
+		t.Context(), sessionID, 0, "alice", "alice2",
+	)
+	if err != nil {
+		t.Fatalf("change nick over the HTTP API: %v", err)
+	}
+
+	// Her connection has taken the new nick once it has sent her
+	// the change.
+	const change = ":alice!alice@* NICK alice2"
+
+	alice.readUntil(func(l string) bool { return l == change })
+	bob.readUntil(func(l string) bool { return l == change })
+
+	for _, step := range []struct {
+		line, want string
+	}{
+		{"PRIVMSG #chan :hi there", ":alice2!alice2@* PRIVMSG #chan :hi there"},
+		{"JOIN #other", ":alice2!alice2@* JOIN #other"},
+		{"NICK alice3", ":alice2!alice2@* NICK alice3"},
+	} {
+		alice.send(step.line)
+
+		got := bob.readLine()
+		if got != step.want {
+			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
+		}
+	}
+}
+
+// TestRelayNickChangeKeepsTakenNick checks that an IRC
+// listener connection which takes a nick another user has
+// given up keeps it when that user's change reaches it
+// afterwards: what it then sends goes out under the nick its
+// session holds.
+func TestRelayNickChangeKeepsTakenNick(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.sendAndExpect("NICK bob2", " NICK bob2")
+
+	alice := env.dial(t)
+	alice.register("alice")
+	alice.sendAndExpect("NICK bob", " NICK bob")
+	alice.joinAndDrain("#chan")
+
+	bob.joinAndDrain("#chan")
+
+	// Bob's change reaches alice only now, as it does when she
+	// takes his old nick before her connection has passed the
+	// change on. She holds bob now, so it is queued to bob.
+	env.queueMessage(t, "bob", "NICK", "bob", "", []string{"bob2"})
+
+	alice.readUntil(func(l string) bool {
+		return l == ":bob!bob@* NICK bob2"
+	})
+
+	alice.send("PRIVMSG #chan :hi there")
+
+	const want = ":bob!bob@* PRIVMSG #chan :hi there"
+
+	got := bob.readLine()
+	if got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}

internal/ircserver/server.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net"
 	"sync"
+	"time"
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/neoirc/internal/broker"
@@ -15,6 +16,10 @@ import (
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
+// stopTimeout is the longest stop waits for the connections'
+// cleanup, which ends their sessions.
+const stopTimeout = 5 * time.Second
+
 // Params defines the dependencies for creating an IRC
 // Server.
 type Params struct {
@@ -38,6 +43,19 @@ type Server struct {
 	mu       sync.Mutex
 	conns    map[*Conn]struct{}
 	cancel   context.CancelFunc
+
+	// serving counts the connections whose serve, cleanup
+	// included, has not returned yet.
+	serving sync.WaitGroup
+
+	// pingInterval and pongDeadline are the constants of the
+	// same names, except in tests, which shorten them.
+	pingInterval time.Duration
+	pongDeadline time.Duration
+
+	// resolveHost is the function of the same name, except in
+	// tests, which replace it with one that blocks.
+	resolveHost func(ctx context.Context, addr string) string
 }
 
 // New creates a new IRC Server and registers its lifecycle
@@ -57,6 +75,11 @@ func New(
 		listener: nil,
 		cancel:   nil,
 		mu:       sync.Mutex{},
+		serving:  sync.WaitGroup{},
+
+		pingInterval: pingInterval,
+		pongDeadline: pongDeadline,
+		resolveHost:  resolveHost,
 	}
 
 	listenAddr := params.Config.IRCListenAddr
@@ -103,7 +126,10 @@ func (s *Server) start(ctx context.Context, addr string) error {
 	return nil
 }
 
-// stop shuts down the listener and all connections.
+// stop shuts down the listener and all connections, then
+// waits up to stopTimeout for every connection's cleanup to
+// finish, so that their sessions are ended before the
+// database closes.
 func (s *Server) stop() {
 	if s.cancel != nil {
 		s.cancel()
@@ -118,6 +144,22 @@ func (s *Server) stop() {
 		c.conn.Close() //nolint:errcheck,gosec
 	}
 	s.mu.Unlock()
+
+	done := make(chan struct{})
+
+	go func() {
+		s.serving.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(stopTimeout):
+		s.log.Error(
+			"irc connections not cleaned up before stop timeout",
+			"timeout", stopTimeout,
+		)
+	}
 }
 
 // acceptLoop accepts new connections.
@@ -138,22 +180,39 @@ func (s *Server) acceptLoop(ctx context.Context) {
 		}
 
 		client := newConn(
-			ctx, tcpConn, s.log,
+			tcpConn, s.log,
 			s.database, s.brk, s.cfg, s.svc,
 		)
 
 		s.mu.Lock()
+
+		// stop cancels ctx before it takes s.mu to close the
+		// connections, so a connection accepted while stop
+		// runs is either closed and waited for by stop or
+		// closed here.
+		if ctx.Err() != nil {
+			s.mu.Unlock()
+			tcpConn.Close() //nolint:errcheck,gosec
+
+			return
+		}
+
 		s.conns[client] = struct{}{}
+		s.serving.Add(1)
 		s.mu.Unlock()
 
 		go func() {
+			defer s.serving.Done()
 			defer func() {
 				s.mu.Lock()
 				delete(s.conns, client)
 				s.mu.Unlock()
 			}()
 
-			client.serve(ctx)
+			client.serve(
+				ctx, s.resolveHost,
+				s.pingInterval, s.pongDeadline,
+			)
 		}()
 	}
 }

internal/ircserver/server_test.go

@@ -2,20 +2,27 @@ package ircserver_test
 
 import (
 	"bufio"
+	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net"
 	"os"
 	"runtime"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
+	"go.uber.org/fx/fxtest"
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
+	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/ircserver"
+	"sneak.berlin/go/neoirc/internal/logger"
 
 	_ "modernc.org/sqlite"
 )
@@ -36,114 +43,82 @@ type testEnv struct {
 	srv      *ircserver.Server
 }
 
+// testServerName is the SERVER_NAME of newTestEnv.
+const testServerName = "test.irc"
+
 func newTestEnv(t *testing.T) *testEnv {
 	t.Helper()
 
-	return newTestEnvWithServerName(t, "test.irc")
-}
-
-// newTestEnvWithServerName creates a test environment with
-// an explicit SERVER_NAME. Passing "" exercises the shipped
-// default from config.go, under which the server must fall
-// back to "neoirc" rather than emitting an empty
-// server-name parameter.
-func newTestEnvWithServerName(
-	t *testing.T,
-	serverName string,
-) *testEnv {
-	t.Helper()
-
-	dsn := fmt.Sprintf(
-		"file:%s?mode=memory&cache=shared&_journal_mode=WAL",
-		t.Name(),
-	)
-
-	conn, err := sql.Open("sqlite", dsn)
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-
-	conn.SetMaxOpenConns(1)
-
-	_, err = conn.ExecContext(
-		t.Context(), "PRAGMA foreign_keys = ON",
-	)
-	if err != nil {
-		t.Fatalf("pragma: %v", err)
-	}
-
-	database := db.NewTestDatabaseFromConn(conn)
-
-	err = database.RunMigrations(t.Context())
-	if err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-
-	brk := broker.New()
-
-	cfg := &config.Config{ //nolint:exhaustruct
-		ServerName: serverName,
+	return newTestEnvWithConfig(t, &config.Config{
+		ServerName: testServerName,
 		MOTD:       "Welcome to test IRC",
-	}
-
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	addr := listener.Addr().String()
-
-	err = listener.Close()
-	if err != nil {
-		t.Fatalf("close listener: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(
-		os.Stderr,
-		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
-	))
-
-	srv := ircserver.NewTestServer(log, cfg, database, brk)
-
-	err = srv.Start(addr)
-	if err != nil {
-		t.Fatalf("start irc server: %v", err)
-	}
-
-	t.Cleanup(func() {
-		srv.Stop()
-
-		err := conn.Close()
-		if err != nil {
-			t.Logf("close db: %v", err)
-		}
 	})
-
-	return &testEnv{
-		database: database,
-		brk:      brk,
-		cfg:      cfg,
-		srv:      srv,
-	}
 }
 
-// newTestEnvWithOper creates a test environment with oper
-// credentials configured.
+// newTestEnvWithOper is newTestEnv with the operator name
+// testoper and password testpass.
 func newTestEnvWithOper(t *testing.T) *testEnv {
 	t.Helper()
 
-	dsn := fmt.Sprintf(
-		"file:%s?mode=memory&cache=shared&_journal_mode=WAL",
-		t.Name(),
-	)
+	return newTestEnvWithConfig(t, &config.Config{
+		ServerName:   testServerName,
+		MOTD:         "Welcome to test IRC",
+		OperName:     "testoper",
+		OperPassword: "testpass",
+	})
+}
 
-	conn, err := sql.Open("sqlite", dsn)
+// newTestEnvWithConfig starts an IRC server with cfg on a
+// fresh database.
+func newTestEnvWithConfig(
+	t *testing.T,
+	cfg *config.Config,
+) *testEnv {
+	t.Helper()
+
+	return newTestEnvWithPingTimes(
+		t, cfg, ircserver.PingInterval, ircserver.PongDeadline,
+	)
+}
+
+// newTestEnvWithPingTimes is newTestEnvWithConfig, except
+// that the server sends a connection a PING after interval
+// with nothing read, and closes it when nothing is read
+// within deadline after that.
+func newTestEnvWithPingTimes(
+	t *testing.T,
+	cfg *config.Config,
+	interval, deadline time.Duration,
+) *testEnv {
+	t.Helper()
+
+	return newTestEnvWithResolver(
+		t, cfg, interval, deadline, ircserver.ResolveHost,
+	)
+}
+
+// newTestEnvWithResolver is newTestEnvWithPingTimes, except
+// that the server looks up a client's hostname with resolve.
+func newTestEnvWithResolver(
+	t *testing.T,
+	cfg *config.Config,
+	interval, deadline time.Duration,
+	resolve func(ctx context.Context, addr string) string,
+) *testEnv {
+	t.Helper()
+
+	conn, err := sql.Open("sqlite", dbtest.NewURL(t))
 	if err != nil {
 		t.Fatalf("open db: %v", err)
 	}
 
+	t.Cleanup(func() {
+		err := conn.Close()
+		if err != nil {
+			t.Logf("close db: %v", err)
+		}
+	})
+
 	conn.SetMaxOpenConns(1)
 
 	_, err = conn.ExecContext(
@@ -162,45 +137,25 @@ func newTestEnvWithOper(t *testing.T) *testEnv {
 
 	brk := broker.New()
 
-	cfg := &config.Config{ //nolint:exhaustruct
-		ServerName:   "test.irc",
-		MOTD:         "Welcome to test IRC",
-		OperName:     "testoper",
-		OperPassword: "testpass",
-	}
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	addr := listener.Addr().String()
-
-	err = listener.Close()
-	if err != nil {
-		t.Fatalf("close listener: %v", err)
-	}
-
 	log := slog.New(slog.NewTextHandler(
 		os.Stderr,
 		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
 	))
 
-	srv := ircserver.NewTestServer(log, cfg, database, brk)
+	srv := ircserver.NewTestServer(
+		log, cfg, database, brk, interval, deadline, resolve,
+	)
 
-	err = srv.Start(addr)
+	// Port 0 makes the system pick a free port. dial reads it
+	// back from the server's listener.
+	err = srv.Start("127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("start irc server: %v", err)
 	}
 
-	t.Cleanup(func() {
-		srv.Stop()
-
-		err := conn.Close()
-		if err != nil {
-			t.Logf("close db: %v", err)
-		}
-	})
+	// Cleanups run last registered first, so the server stops
+	// before its database is closed.
+	t.Cleanup(srv.Stop)
 
 	return &testEnv{
 		database: database,
@@ -239,6 +194,34 @@ func (env *testEnv) dial(t *testing.T) *testClient {
 	}
 }
 
+// The ping interval and PONG deadline for
+// newTestEnvWithShortPings. They differ, so that a test can
+// tell them apart; the PONG deadline is how long a test
+// client has to answer a PING.
+const (
+	testPingInterval = time.Second
+	testPongDeadline = 300 * time.Millisecond
+)
+
+// newTestEnvWithShortPings starts an IRC server that uses
+// testPingInterval and testPongDeadline in place of
+// pingInterval and pongDeadline.
+func newTestEnvWithShortPings(t *testing.T) *testEnv {
+	t.Helper()
+
+	return newTestEnvWithPingTimes(
+		t,
+		&config.Config{ServerName: testServerName},
+		testPingInterval, testPongDeadline,
+	)
+}
+
+// isServerPing reports whether line is the PING the test
+// server sends a quiet client.
+func isServerPing(line string) bool {
+	return line == "PING :"+testServerName
+}
+
 // testClient wraps a raw TCP connection with helpers.
 type testClient struct {
 	t       *testing.T
@@ -310,11 +293,9 @@ func (tc *testClient) register(nick string) []string {
 	})
 }
 
-// readUntilClosed reads until the peer closes the
-// connection, returning the lines received first.  It
-// fails the test if the connection is still open when the
-// read deadline expires, which is what a KILL that never
-// terminates the victim's socket looks like.
+// readUntilClosed returns the lines received until the
+// server closes the connection, and fails the test if it is
+// still open after testTimeout.
 func (tc *testClient) readUntilClosed() []string {
 	tc.t.Helper()
 
@@ -331,8 +312,7 @@ func (tc *testClient) readUntilClosed() []string {
 	err := tc.scanner.Err()
 	if err != nil {
 		tc.t.Fatalf(
-			"expected EOF on victim socket, got %v "+
-				"(lines: %v)",
+			"connection not closed: %v (lines: %v)",
 			err, lines,
 		)
 	}
@@ -340,6 +320,24 @@ func (tc *testClient) readUntilClosed() []string {
 	return lines
 }
 
+// readServerPing reads until the PING the test server sends a
+// quiet client, and fails the test if it came sooner than
+// testPingInterval after lastSent, a time just before the
+// client sent its last line.
+func (tc *testClient) readServerPing(lastSent time.Time) {
+	tc.t.Helper()
+
+	tc.readUntil(isServerPing)
+
+	waited := time.Since(lastSent)
+	if waited < testPingInterval {
+		tc.t.Errorf(
+			"PING came %v after the client's last line, want at least %v",
+			waited, testPingInterval,
+		)
+	}
+}
+
 // assertContains checks that at least one line matches the
 // given substring.
 func assertContains(
@@ -415,6 +413,63 @@ func TestRegistration(t *testing.T) {
 	assertContains(t, lines, " 001 ", "RPL_WELCOME")
 }
 
+// TestRegistrationWhileAnotherLookupIsPending checks that a
+// client is accepted and registered while the hostname lookup
+// of an earlier client has not returned, and that it
+// registers with the hostname its own lookup returned.
+func TestRegistrationWhileAnotherLookupIsPending(t *testing.T) {
+	t.Parallel()
+
+	const lookedUpHost = "client.example"
+
+	var lookups atomic.Int32
+
+	firstLookupStarted := make(chan struct{})
+
+	// The first lookup returns only when the server stops.
+	resolve := func(ctx context.Context, _ string) string {
+		if lookups.Add(1) == 1 {
+			close(firstLookupStarted)
+			<-ctx.Done()
+		}
+
+		return lookedUpHost
+	}
+
+	env := newTestEnvWithResolver(
+		t, &config.Config{ServerName: testServerName},
+		ircserver.PingInterval, ircserver.PongDeadline, resolve,
+	)
+
+	env.dial(t)
+
+	select {
+	case <-firstLookupStarted:
+	case <-time.After(testTimeout):
+		t.Fatal("the first client's lookup did not start")
+	}
+
+	lines := env.dial(t).register("second")
+	assertContains(
+		t, lines, "second!second@"+lookedUpHost,
+		"RPL_WELCOME with the looked-up hostname",
+	)
+}
+
+// TestEachTestEnvHasItsOwnDatabase checks that a test
+// environment starts on an empty database while another one
+// is still open.
+func TestEachTestEnvHasItsOwnDatabase(t *testing.T) {
+	t.Parallel()
+
+	first := newTestEnv(t)
+	first.dial(t).register("samenick")
+
+	second := newTestEnv(t)
+	lines := second.dial(t).register("samenick")
+	assertContains(t, lines, " 001 ", "RPL_WELCOME")
+}
+
 func TestWelcomeContainsNick(t *testing.T) {
 	t.Parallel()
 
@@ -442,6 +497,164 @@ func TestPingPong(t *testing.T) {
 	assertContains(t, lines, "PONG", "PONG response")
 }
 
+// TestQuietClientAnsweringPingStaysConnected checks that a
+// registered client that sends nothing is sent a PING once
+// the ping interval has passed since its last line, and stays
+// connected as long as it answers each one, whether with a
+// PONG or with another line.
+func TestQuietClientAnsweringPingStaysConnected(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		answer string
+	}{
+		{name: "PONG", answer: "PONG :" + testServerName},
+		{name: "PING of its own", answer: "PING :answer"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := newTestEnvWithShortPings(t)
+			client := env.dial(t)
+
+			lastSent := time.Now()
+
+			client.register("answers")
+
+			// The second PING comes later than a client that
+			// answers none stays connected.
+			for range 2 {
+				client.readServerPing(lastSent)
+
+				lastSent = time.Now()
+
+				client.send(tt.answer)
+			}
+
+			client.sendAndExpect("PING :still here", "still here")
+		})
+	}
+}
+
+// TestQuietClientNotAnsweringPingIsClosed checks that a
+// registered client that does not answer the PING is
+// disconnected once the PONG deadline has passed after it.
+func TestQuietClientNotAnsweringPingIsClosed(t *testing.T) {
+	t.Parallel()
+
+	// latest leaves room for a loaded host, but is sooner than
+	// a read deadline of two ping intervals would close it.
+	const (
+		earliest = testPingInterval + testPongDeadline
+		latest   = 2 * testPingInterval
+	)
+
+	env := newTestEnvWithShortPings(t)
+	client := env.dial(t)
+
+	lastSent := time.Now()
+
+	client.register("silent")
+	client.readServerPing(lastSent)
+	client.readUntilClosed()
+
+	waited := time.Since(lastSent)
+	if waited < earliest || waited >= latest {
+		t.Errorf(
+			"closed %v after the client's last line, want %v to %v",
+			waited, earliest, latest,
+		)
+	}
+}
+
+// TestUnregisteredClientAnswersPing checks that a PONG before
+// registration, the answer to the PING unregistered clients
+// are sent too, gets no ERR_NOTREGISTERED.
+func TestUnregisteredClientAnswersPing(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnvWithShortPings(t)
+	client := env.dial(t)
+
+	client.readUntil(isServerPing)
+	client.send("PONG :" + testServerName)
+
+	lines := client.sendAndExpect("PING :after", "PONG")
+	assertNotContains(t, lines, " 451 ", "ERR_NOTREGISTERED")
+}
+
+// TestNewPingTimes checks that a server made by New sends a
+// PING after 90 seconds with nothing read, and closes the
+// connection 30 seconds after that, as README.md states.
+func TestNewPingTimes(t *testing.T) {
+	t.Parallel()
+
+	const (
+		wantInterval = 90 * time.Second
+		wantDeadline = 30 * time.Second
+	)
+
+	log, err := logger.New(nil, logger.Params{
+		Globals: &globals.Globals{},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// With no IRC_LISTEN_ADDR, New starts no listener and
+	// uses nothing else from its params.
+	srv := ircserver.New(fxtest.NewLifecycle(t), ircserver.Params{
+		Logger: log,
+		Config: &config.Config{},
+	})
+
+	interval, deadline := srv.PingTimes()
+	if interval != wantInterval || deadline != wantDeadline {
+		t.Errorf(
+			"PING after %v and close %v later, want %v and %v",
+			interval, deadline, wantInterval, wantDeadline,
+		)
+	}
+}
+
+// TestIdleCleanupKeepsActiveUser checks that a user who
+// sends commands is kept by the idle cleanup, and a user who
+// sends nothing is not.
+func TestIdleCleanupKeepsActiveUser(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	active := env.dial(t)
+	active.register("active")
+
+	idle := env.dial(t)
+	idle.register("idle")
+
+	// Both users were last seen before cutoff, and only active
+	// sends a command after it, so the result does not depend
+	// on how long the PONG takes to arrive.
+	cutoff := time.Now()
+
+	active.sendAndExpect("PING :still here", "PONG")
+
+	// The idle cleanup in internal/handlers removes exactly
+	// the users this returns.
+	stale, err := env.database.GetStaleOrphanSessions(
+		t.Context(), cutoff,
+	)
+	if err != nil {
+		t.Fatalf("get stale sessions: %v", err)
+	}
+
+	if len(stale) != 1 || stale[0].Nick != "idle" {
+		t.Errorf("cleanup removes %v, want only idle", stale)
+	}
+}
+
 func TestJoinChannel(t *testing.T) {
 	t.Parallel()
 
@@ -459,6 +672,37 @@ func TestJoinChannel(t *testing.T) {
 	assertContains(t, lines, " 366 ", "RPL_ENDOFNAMES")
 }
 
+// TestJoinInvalidChannelName checks that JOIN refuses a name
+// that is not # followed by 1 to 63 letters, digits, _ or -
+// with ERR_NOSUCHCHANNEL, and creates no such channel.
+func TestJoinInvalidChannelName(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+	client := env.dial(t)
+
+	client.register("joiner")
+
+	for _, channel := range []string{
+		"#bad.name",
+		"#",
+		"#" + strings.Repeat("a", 64),
+	} {
+		lines := client.sendAndExpect("JOIN "+channel, " 403 ")
+
+		assertContains(
+			t, lines,
+			" 403 joiner "+channel+" :No such channel",
+			channel,
+		)
+
+		_, err := env.database.GetChannelByName(t.Context(), channel)
+		if err == nil {
+			t.Errorf("channel %q was created", channel)
+		}
+	}
+}
+
 func TestPrivmsgBetweenClients(t *testing.T) {
 	t.Parallel()
 
@@ -509,6 +753,68 @@ func TestDuplicateNick(t *testing.T) {
 	assertContains(t, lines, " 433 ", "ERR_NICKNAMEINUSE")
 }
 
+// TestNickRefused checks that NICK, before and after
+// registration, answers a nick the HTTP API refuses with
+// ERR_ERRONEUSNICKNAME and keeps the nick as it was, and
+// that another member of the channel sees no line from it.
+func TestNickRefused(t *testing.T) {
+	t.Parallel()
+
+	// Each is what follows "NICK " on the wire.
+	refused := []string{
+		":bob PRIVMSG #inj :hi", // contains spaces
+		":",                     // empty
+		strings.Repeat("a", 33), // one character too long
+		"bob!x",
+		"bob@x",
+		"#bob",
+	}
+
+	env := newTestEnv(t)
+
+	// Before registration: the 432 is addressed to the nick
+	// sent first, and USER registers with that nick.
+	early := env.dial(t)
+	early.send("NICK early")
+
+	for _, param := range refused {
+		lines := early.sendAndExpect("NICK "+param, " 432 ")
+		assertContains(t, lines, " 432 early ", "before: "+param)
+	}
+
+	welcome := early.sendAndExpect("USER early 0 * :Test", " 001 ")
+	assertContains(t, welcome, " 001 early ", "registered as early")
+
+	// After registration.
+	bob := env.dial(t)
+	bob.register("bob")
+	bob.joinAndDrain("#inj")
+
+	mallory := env.dial(t)
+	mallory.register("mallory")
+	mallory.joinAndDrain("#inj")
+
+	bob.readUntil(func(l string) bool {
+		return strings.Contains(l, "JOIN") &&
+			strings.Contains(l, "mallory")
+	})
+
+	for _, param := range refused {
+		lines := mallory.sendAndExpect("NICK "+param, " 432 ")
+		assertContains(t, lines, " 432 mallory ", "after: "+param)
+	}
+
+	mallory.send("PRIVMSG #inj :still mallory")
+
+	bobLines := bob.readUntil(func(l string) bool {
+		return strings.Contains(l, "still mallory")
+	})
+	assertNotContains(t, bobLines, " NICK ", "bob sees no NICK")
+	assertContains(
+		t, bobLines, ":mallory!", "bob sees mallory's message",
+	)
+}
+
 func TestListChannels(t *testing.T) {
 	t.Parallel()
 
@@ -550,6 +856,120 @@ func TestQuit(t *testing.T) {
 	assertContains(t, lines, "goodbye", "QUIT reason")
 }
 
+// TestStopEndsSessions checks that stopping the server ends
+// a registered connection's session before Stop returns, as
+// closing the connection does: the session, its client and
+// its channel membership are gone from the database, and a
+// channel peer has been sent the QUIT.
+func TestStopEndsSessions(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+	client := env.dial(t)
+
+	client.register("shutirc")
+	client.joinAndDrain("#shut")
+
+	ctx := t.Context()
+
+	// A peer on the HTTP API, whose session outlives the stop.
+	peerID, peerClientID, _, err := env.database.CreateSession(
+		ctx, "peer", "peer", "", "",
+	)
+	if err != nil {
+		t.Fatalf("create peer session: %v", err)
+	}
+
+	channelID, err := env.database.GetChannelByName(ctx, "#shut")
+	if err != nil {
+		t.Fatalf("get channel: %v", err)
+	}
+
+	err = env.database.JoinChannel(ctx, channelID, peerID)
+	if err != nil {
+		t.Fatalf("join peer: %v", err)
+	}
+
+	env.srv.Stop()
+
+	_, err = env.database.GetSessionByNick(ctx, "shutirc")
+	if !errors.Is(err, sql.ErrNoRows) {
+		t.Errorf("look up shutirc after stop: %v, want no rows", err)
+	}
+
+	clients, err := env.database.GetClientCount(ctx)
+	if err != nil {
+		t.Fatalf("count clients: %v", err)
+	}
+
+	if clients != 1 {
+		t.Errorf("%d clients after stop, want only the peer's", clients)
+	}
+
+	members, err := env.database.GetChannelMemberIDs(ctx, channelID)
+	if err != nil {
+		t.Fatalf("get members: %v", err)
+	}
+
+	if len(members) != 1 || members[0] != peerID {
+		t.Errorf(
+			"members of #shut after stop: %v, want only the peer %d",
+			members, peerID,
+		)
+	}
+
+	msgs, _, err := env.database.PollMessages(ctx, peerClientID, 0, 0)
+	if err != nil {
+		t.Fatalf("poll peer: %v", err)
+	}
+
+	for _, msg := range msgs {
+		if msg.Command == "QUIT" && msg.From == "shutirc" {
+			return
+		}
+	}
+
+	t.Errorf("peer was not sent the QUIT of shutirc: %v", msgs)
+}
+
+// TestStopReturnsWhileCleanupIsStuck checks that Stop stops
+// waiting for a connection's cleanup after StopTimeout, so a
+// cleanup that cannot finish does not hold up stopping.
+func TestStopReturnsWhileCleanupIsStuck(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+	client := env.dial(t)
+
+	client.register("stuck")
+
+	// The test database has one connection. While the test
+	// holds it, the cleanup's first query waits for it.
+	held, err := env.database.GetDB().Conn(t.Context())
+	if err != nil {
+		t.Fatalf("take the database connection: %v", err)
+	}
+
+	stopped := make(chan struct{})
+
+	go func() {
+		env.srv.Stop()
+		close(stopped)
+	}()
+
+	select {
+	case <-stopped:
+	case <-time.After(ircserver.StopTimeout + testTimeout):
+		t.Error("Stop did not return while a cleanup was stuck")
+	}
+
+	// Lets the cleanup finish before the database is closed.
+	err = held.Close()
+	if err != nil {
+		t.Errorf("release the database connection: %v", err)
+	}
+}
+
 func TestTopicSetAndGet(t *testing.T) {
 	t.Parallel()
 
@@ -721,6 +1141,165 @@ func TestHandlePassPostRegistration(t *testing.T) {
 	)
 }
 
+// The shortest and longest password PASS accepts; bcrypt
+// cannot hash more than 72 bytes.
+const (
+	minPasswordBytes = 8
+	maxPasswordBytes = 72
+)
+
+// passwordLengthNotice is the NOTICE text for a password that
+// is too short or too long.
+const passwordLengthNotice = "Password must be 8 to 72 bytes"
+
+// passwordCase is a password a PASS test sends, and whether
+// the server should store it.
+type passwordCase struct {
+	name     string
+	password string
+	stored   bool
+}
+
+// passwordCases returns the passwords the PASS length tests
+// send: one of 8 to 72 bytes is stored and any other is
+// refused. The limit counts bytes: "é" is two bytes in UTF-8,
+// so 72 of them are refused.
+func passwordCases() []passwordCase {
+	return []passwordCase{
+		{"empty", "", false},
+		{"7 bytes", strings.Repeat("a", minPasswordBytes-1), false},
+		{"8 bytes", strings.Repeat("a", minPasswordBytes), true},
+		{"72 bytes", strings.Repeat("a", maxPasswordBytes), true},
+		{"73 bytes", strings.Repeat("a", maxPasswordBytes+1), false},
+		{"72 characters", strings.Repeat("é", maxPasswordBytes), false},
+	}
+}
+
+// assertStored fails the test unless nick can log in with
+// password exactly when stored is true.
+func assertStored(
+	t *testing.T, env *testEnv, nick, password string, stored bool,
+) {
+	t.Helper()
+
+	_, _, token, err := env.database.LoginUser(
+		t.Context(), nick, password, "127.0.0.1", "localhost",
+	)
+
+	loggedIn := err == nil && token != ""
+	if loggedIn != stored {
+		t.Errorf(
+			"log in as %s: logged in %v, want %v (error: %v)",
+			nick, loggedIn, stored, err,
+		)
+	}
+}
+
+// TestPassPostRegistrationLength checks that PASS after
+// registration stores and confirms a password of 8 to 72
+// bytes, and refuses any other with a NOTICE.
+func TestPassPostRegistrationLength(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	for i, tc := range passwordCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			nick := fmt.Sprintf("postpass%d", i)
+			client := env.dial(t)
+
+			client.register(nick)
+			client.send("PASS :" + tc.password)
+
+			// The server answers commands in order, so its
+			// reply to PASS comes before the PONG.
+			lines := client.sendAndExpect("PING :after", "PONG")
+
+			reply := passwordLengthNotice
+			if tc.stored {
+				reply = "Password set"
+			}
+
+			assertContains(t, lines, reply, "reply to PASS")
+			assertStored(t, env, nick, tc.password, tc.stored)
+		})
+	}
+}
+
+// TestPassPostRegistrationNotStored checks that PASS is not
+// confirmed when the password could not be stored.
+func TestPassPostRegistrationNotStored(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+	client := env.dial(t)
+
+	client.register("failpass")
+
+	_, err := env.database.GetDB().ExecContext(t.Context(),
+		`CREATE TRIGGER refuse_password
+		 BEFORE UPDATE OF password_hash ON sessions
+		 BEGIN SELECT RAISE(ABORT, 'refused'); END`,
+	)
+	if err != nil {
+		t.Fatalf("create trigger: %v", err)
+	}
+
+	client.send("PASS :mypassword123")
+
+	// The server answers commands in order, so anything it
+	// sent about PASS comes before the PONG.
+	lines := client.sendAndExpect("PING :after", "PONG")
+
+	assertNotContains(
+		t, lines, "Password set",
+		"confirmation of a password that was not stored",
+	)
+}
+
+// TestPassBeforeRegistrationLength checks that a PASS before
+// registration stores a password of 8 to 72 bytes, and that
+// any other is refused with a NOTICE once registration
+// completes.
+func TestPassBeforeRegistrationLength(t *testing.T) {
+	t.Parallel()
+
+	env := newTestEnv(t)
+
+	for i, tc := range passwordCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			nick := fmt.Sprintf("prepass%d", i)
+			client := env.dial(t)
+
+			client.send("PASS :" + tc.password)
+			client.register(nick)
+
+			// The password is checked after the welcome
+			// burst, which register reads; the PONG comes
+			// after that.
+			lines := client.sendAndExpect("PING :after", "PONG")
+
+			if tc.stored {
+				assertNotContains(
+					t, lines, passwordLengthNotice,
+					"refusal of a valid password",
+				)
+			} else {
+				assertContains(
+					t, lines, passwordLengthNotice,
+					"refusal after registration",
+				)
+			}
+
+			assertStored(t, env, nick, tc.password, tc.stored)
+		})
+	}
+}
+
 func TestPreRegistrationNotRegistered(t *testing.T) {
 	t.Parallel()
 

internal/server/export_test.go

@@ -0,0 +1,28 @@
+package server
+
+import (
+	"net"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// NewTestSPAServer creates a Server whose router serves only
+// the embedded web client.
+func NewTestSPAServer() *Server {
+	srv := &Server{router: chi.NewRouter()}
+	srv.setupSPA()
+
+	return srv
+}
+
+// Listener returns the listener the start hook bound for the
+// HTTP server.
+func (srv *Server) Listener() net.Listener {
+	return srv.listener
+}
+
+// ServeUntilShutdown runs serveUntilShutdown, which serves the
+// HTTP server on listener, and returns when it does.
+func (srv *Server) ServeUntilShutdown(listener net.Listener) {
+	srv.serveUntilShutdown(listener)
+}

internal/server/routes.go

@@ -3,6 +3,7 @@ package server
 import (
 	"io/fs"
 	"net/http"
+	"strings"
 	"time"
 
 	"sneak.berlin/go/neoirc/web"
@@ -137,8 +138,10 @@ func (srv *Server) setupSPA() {
 			return
 		}
 
+		// The path is empty, not "/", for a request line such
+		// as "GET http://host HTTP/1.1".
 		fileData, readErr := readFS.ReadFile(
-			request.URL.Path[1:],
+			strings.TrimPrefix(request.URL.Path, "/"),
 		)
 		if readErr != nil || len(fileData) == 0 {
 			indexHTML, indexErr := readFS.ReadFile(

internal/server/routes_test.go

@@ -0,0 +1,41 @@
+package server_test
+
+import (
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"sneak.berlin/go/neoirc/internal/server"
+	"sneak.berlin/go/neoirc/web"
+)
+
+// An absolute-form request line with no path, such as
+// "GET http://example.com HTTP/1.1", leaves URL.Path empty.
+func TestSPAServesIndexForEmptyPath(t *testing.T) {
+	t.Parallel()
+
+	request := httptest.NewRequestWithContext(
+		t.Context(), http.MethodGet, "http://example.com", nil,
+	)
+	if request.URL.Path != "" {
+		t.Fatalf("URL.Path is %q, want it empty", request.URL.Path)
+	}
+
+	recorder := httptest.NewRecorder()
+
+	server.NewTestSPAServer().ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status %d, want %d", recorder.Code, http.StatusOK)
+	}
+
+	indexHTML, err := fs.ReadFile(web.Dist, "dist/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if recorder.Body.String() != string(indexHTML) {
+		t.Errorf("body is not the index page")
+	}
+}

internal/server/server.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -39,18 +40,17 @@ type Params struct {
 	Config     *config.Config
 	Middleware *middleware.Middleware
 	Handlers   *handlers.Handlers
+	Shutdowner fx.Shutdowner
 }
 
 // Server is the main HTTP server.
 // It manages routing, middleware, and lifecycle.
 type Server struct {
 	startupTime   time.Time
-	exitCode      int
 	sentryEnabled bool
 	log           *slog.Logger
-	ctx           context.Context //nolint:containedctx // signal handling pattern
-	cancelFunc    context.CancelFunc
 	httpServer    *http.Server
+	listener      net.Listener
 	router        *chi.Mux
 	params        Params
 	mw            *middleware.Middleware
@@ -69,7 +69,7 @@ func New(
 	}
 
 	lifecycle.Append(fx.Hook{
-		OnStart: func(_ context.Context) error {
+		OnStart: func(ctx context.Context) error {
 			srv.startupTime = time.Now()
 
 			// Build the router before OnStart returns, so srv can
@@ -78,13 +78,14 @@ func New(
 			srv.enableSentry()
 			srv.SetupRoutes()
 
-			// The start hook's context ends when the hook
-			// returns; serving must outlive it.
-			go srv.serve() //nolint:contextcheck,gosec // G118
+			// A closed stdout or stderr must not end the process.
+			signal.Ignore(syscall.SIGPIPE)
 
-			return nil
+			return srv.startHTTP(ctx)
 		},
-		OnStop: func(_ context.Context) error {
+		OnStop: func(ctx context.Context) error {
+			srv.cleanShutdown(ctx)
+
 			return nil
 		},
 	})
@@ -129,44 +130,15 @@ func (srv *Server) enableSentry() {
 	srv.sentryEnabled = true
 }
 
-func (srv *Server) serve() int {
-	srv.ctx, srv.cancelFunc = context.WithCancel(
-		context.Background(),
-	)
-
-	go func() {
-		sigCh := make(chan os.Signal, 1)
-
-		signal.Ignore(syscall.SIGPIPE)
-		signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
-
-		sig := <-sigCh
-
-		srv.log.Info("signal received", "signal", sig)
-
-		if srv.cancelFunc != nil {
-			srv.cancelFunc()
-		}
-	}()
-
-	go srv.serveUntilShutdown()
-
-	<-srv.ctx.Done()
-
-	srv.cleanShutdown()
-
-	return srv.exitCode
-}
-
 func (srv *Server) cleanupForExit() {
 	srv.log.Info("cleaning up")
 }
 
-func (srv *Server) cleanShutdown() {
-	srv.exitCode = 0
-
+// cleanShutdown stops the HTTP server, waiting up to
+// shutdownTimeout for the requests in progress to finish.
+func (srv *Server) cleanShutdown(ctx context.Context) {
 	ctxShutdown, shutdownCancel := context.WithTimeout(
-		context.Background(), shutdownTimeout,
+		ctx, shutdownTimeout,
 	)
 
 	err := srv.httpServer.Shutdown(ctxShutdown)
@@ -191,11 +163,25 @@ func (srv *Server) configure() {
 	// Server configuration placeholder.
 }
 
-func (srv *Server) serveUntilShutdown() {
+// startHTTP binds the HTTP listen address, so that a port
+// that is taken fails startup, then serves the HTTP server
+// from a new goroutine. srv.httpServer is set before that
+// goroutine starts and never changes, so it and cleanShutdown
+// read it without a lock.
+func (srv *Server) startHTTP(ctx context.Context) error {
 	listenAddr := fmt.Sprintf(
 		":%d", srv.params.Config.Port,
 	)
 
+	var listenConfig net.ListenConfig
+
+	listener, err := listenConfig.Listen(ctx, "tcp", listenAddr)
+	if err != nil {
+		return fmt.Errorf("http listen: %w", err)
+	}
+
+	srv.listener = listener
+
 	srv.httpServer = &http.Server{ //nolint:exhaustruct // optional fields
 		Addr:           listenAddr,
 		ReadTimeout:    httpReadTimeout,
@@ -204,16 +190,30 @@ func (srv *Server) serveUntilShutdown() {
 		Handler:        srv,
 	}
 
+	go func() {
+		srv.serveUntilShutdown(listener)
+	}()
+
+	return nil
+}
+
+// serveUntilShutdown serves the HTTP server on listener until
+// cleanShutdown stops it. If serving fails before then, it
+// stops the app with exit code 1.
+func (srv *Server) serveUntilShutdown(listener net.Listener) {
 	srv.log.Info(
-		"http begin listen", "listenaddr", listenAddr,
+		"http begin listen", "listenaddr", srv.httpServer.Addr,
 	)
 
-	err := srv.httpServer.ListenAndServe()
-	if err != nil && !errors.Is(err, http.ErrServerClosed) {
-		srv.log.Error("listen error", "error", err)
+	err := srv.httpServer.Serve(listener)
+	if errors.Is(err, http.ErrServerClosed) {
+		return
+	}
 
-		if srv.cancelFunc != nil {
-			srv.cancelFunc()
-		}
+	srv.log.Error("listen error", "error", err)
+
+	err = srv.params.Shutdowner.Shutdown(fx.ExitCode(1))
+	if err != nil {
+		srv.log.Error("shutdown failed", "error", err)
 	}
 }

internal/server/server_test.go

@@ -0,0 +1,325 @@
+// Tests use a global viper instance for configuration,
+// making parallel execution unsafe.
+//
+//nolint:paralleltest
+package server_test
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"go.uber.org/fx"
+	"go.uber.org/fx/fxtest"
+	"sneak.berlin/go/neoirc/internal/broker"
+	"sneak.berlin/go/neoirc/internal/config"
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/dbtest"
+	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/handlers"
+	"sneak.berlin/go/neoirc/internal/healthcheck"
+	"sneak.berlin/go/neoirc/internal/logger"
+	"sneak.berlin/go/neoirc/internal/middleware"
+	"sneak.berlin/go/neoirc/internal/server"
+	"sneak.berlin/go/neoirc/internal/service"
+	"sneak.berlin/go/neoirc/internal/stats"
+)
+
+const (
+	testTimeout = 5 * time.Second
+
+	// checkStep is how often waitUntil checks again.
+	checkStep = 10 * time.Millisecond
+
+	// stopHoldTime is how long a test waits to see that the
+	// app has not stopped.
+	stopHoldTime = 200 * time.Millisecond
+)
+
+// TestStopWaitsForRequestInProgress checks that stopping the
+// app, which runs the stop hook server.New registers, waits
+// for a long poll the HTTP server is serving to finish, and
+// that the poll gets its response.
+func TestStopWaitsForRequestInProgress(t *testing.T) {
+	var srv *server.Server
+
+	app, brk, database := startApp(t, fx.Populate(&srv))
+
+	sessionID, _, token, err := database.CreateSession(
+		t.Context(), "poller", "poller", "", "",
+	)
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+
+	tcpAddr, ok := srv.Listener().Addr().(*net.TCPAddr)
+	if !ok {
+		t.Fatalf("listener address %v is not TCP", srv.Listener().Addr())
+	}
+
+	addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(tcpAddr.Port))
+
+	statuses := make(chan int, 1)
+
+	go func() {
+		statuses <- getAuthenticated(
+			t, "http://"+addr+"/api/v1/messages?timeout=30", token,
+		)
+	}()
+
+	waitUntil(t, "the long poll to wait for a message", func() bool {
+		return brk.ListenerCount(sessionID) == 1
+	})
+
+	var stopErr error
+
+	stopped := make(chan struct{})
+
+	go func() {
+		stopErr = app.Stop(t.Context())
+
+		close(stopped)
+	}()
+
+	select {
+	case <-stopped:
+		t.Error("the app stopped while a request was in progress")
+	case <-time.After(stopHoldTime):
+	}
+
+	brk.Notify(sessionID)
+
+	status := <-statuses
+	if status != http.StatusOK {
+		t.Errorf("status %d, want %d", status, http.StatusOK)
+	}
+
+	select {
+	case <-stopped:
+		if stopErr != nil {
+			t.Errorf("stop: %v", stopErr)
+		}
+	case <-time.After(testTimeout):
+		t.Fatal("the app did not stop after the request finished")
+	}
+}
+
+// TestStartFailsWhenHTTPPortIsTaken checks that starting the
+// app, which runs the start hook server.New registers,
+// returns an error naming the HTTP listen address when
+// something else is already listening on its port.
+func TestStartFailsWhenHTTPPortIsTaken(t *testing.T) {
+	var listenConfig net.ListenConfig
+
+	taken, err := listenConfig.Listen(t.Context(), "tcp", ":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	t.Cleanup(func() { _ = taken.Close() })
+
+	tcpAddr, ok := taken.Addr().(*net.TCPAddr)
+	if !ok {
+		t.Fatalf("listener address %v is not TCP", taken.Addr())
+	}
+
+	app, _, _ := newApp(t, tcpAddr.Port)
+
+	err = app.Start(t.Context())
+	if err == nil {
+		app.RequireStop()
+		t.Fatal("the app started while its HTTP port was taken")
+	}
+
+	listenAddr := fmt.Sprintf(":%d", tcpAddr.Port)
+	if !strings.Contains(err.Error(), listenAddr) {
+		t.Errorf("start error %q does not name %s", err, listenAddr)
+	}
+}
+
+// TestServeFailureStopsApp checks that when serving HTTP fails
+// after the start hook has bound the listen address, the
+// server stops the app with exit code 1.
+func TestServeFailureStopsApp(t *testing.T) {
+	var srv *server.Server
+
+	app, _, _ := startApp(t, fx.Populate(&srv))
+
+	shutdowns := app.Wait()
+
+	srv.ServeUntilShutdown(closedListener(t))
+
+	select {
+	case shutdown := <-shutdowns:
+		if shutdown.ExitCode != 1 {
+			t.Errorf("exit code %d, want 1", shutdown.ExitCode)
+		}
+	default:
+		t.Error("the server did not stop the app")
+	}
+}
+
+// TestServeAfterStopDoesNotStopApp checks that serving HTTP
+// after the app has stopped, which ends at once because the
+// stop hook has shut the HTTP server down, does not stop the
+// app. Serving ends the same way on every normal stop.
+func TestServeAfterStopDoesNotStopApp(t *testing.T) {
+	var srv *server.Server
+
+	app, _, _ := startApp(t, fx.Populate(&srv))
+
+	shutdowns := app.Wait()
+
+	app.RequireStop()
+
+	srv.ServeUntilShutdown(closedListener(t))
+
+	select {
+	case shutdown := <-shutdowns:
+		t.Errorf(
+			"the server stopped the app with exit code %d",
+			shutdown.ExitCode,
+		)
+	default:
+	}
+}
+
+// startApp starts the app newApp builds, with the HTTP port
+// set to 0, so the system gives the server a free port.
+func startApp(
+	t *testing.T,
+	options ...fx.Option,
+) (*fxtest.App, *broker.Broker, *db.Database) {
+	t.Helper()
+
+	app, brk, database := newApp(t, 0, options...)
+
+	app.RequireStart()
+
+	// Stops the app if the test ends before stopping it.
+	t.Cleanup(app.RequireStop)
+
+	return app, brk, database
+}
+
+// newApp builds, without starting it, an app that runs the
+// server with the dependencies cmd/neoircd gives it, on a
+// fresh in-memory database, with the HTTP port set to port.
+// options are added to the app, for a test that needs more
+// from it than the broker and the database.
+func newApp(
+	t *testing.T,
+	port int,
+	options ...fx.Option,
+) (*fxtest.App, *broker.Broker, *db.Database) {
+	t.Helper()
+
+	var (
+		brk      *broker.Broker
+		database *db.Database
+	)
+
+	app := fxtest.New(t,
+		fx.Supply(&globals.Globals{
+			Appname:   "neoirc-test",
+			Version:   "test",
+			StartTime: time.Now(),
+		}),
+		fx.Provide(
+			broker.New,
+			config.New,
+			db.New,
+			handlers.New,
+			healthcheck.New,
+			logger.New,
+			middleware.New,
+			server.New,
+			service.New,
+			stats.New,
+		),
+		fx.Decorate(func(cfg *config.Config) *config.Config {
+			cfg.DBURL = dbtest.NewURL(t)
+			cfg.Port = port
+
+			return cfg
+		}),
+		fx.Invoke(func(*server.Server) {}),
+		fx.Populate(&brk, &database),
+		fx.Options(options...),
+	)
+
+	return app, brk, database
+}
+
+// closedListener returns a TCP listener that has already been
+// closed, so that accepting a connection on it fails.
+func closedListener(t *testing.T) net.Listener {
+	t.Helper()
+
+	var listenConfig net.ListenConfig
+
+	listener, err := listenConfig.Listen(
+		t.Context(), "tcp", "127.0.0.1:0",
+	)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	err = listener.Close()
+	if err != nil {
+		t.Fatalf("close listener: %v", err)
+	}
+
+	return listener
+}
+
+// waitUntil calls done every checkStep until it returns true,
+// and fails the test if it does not within testTimeout.
+func waitUntil(t *testing.T, what string, done func() bool) {
+	t.Helper()
+
+	deadline := time.Now().Add(testTimeout)
+
+	for !done() {
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s", what)
+		}
+
+		time.Sleep(checkStep)
+	}
+}
+
+// getAuthenticated sends a GET request to url as the session
+// whose auth token is token, and returns the response status,
+// or 0 if there was no response.
+func getAuthenticated(t *testing.T, url, token string) int {
+	t.Helper()
+
+	request, err := http.NewRequestWithContext(
+		t.Context(), http.MethodGet, url, nil,
+	)
+	if err != nil {
+		t.Errorf("new request: %v", err)
+
+		return 0
+	}
+
+	request.Header.Set("Cookie", "neoirc_auth="+token)
+
+	client := http.Client{Timeout: testTimeout}
+
+	response, err := client.Do(request)
+	if err != nil {
+		t.Errorf("get %s: %v", url, err)
+
+		return 0
+	}
+
+	_ = response.Body.Close()
+
+	return response.StatusCode
+}

schema/README.md

@@ -1,98 +1,166 @@
-# Message Schemas
+# Message schemas
 
-JSON Schema definitions (draft 2020-12) for the neoirc protocol. Messages use
-**IRC command names and numeric reply codes** (RFC 1459/2812) encoded as JSON
-over HTTP.
+This directory holds JSON Schema files (draft 2020-12) for the messages that the
+neoirc HTTP API carries. `message.json` describes the fields that every message
+can have. `commands/` has files for some commands. `numerics/` has files for
+some of the numeric replies. A numeric reply is a server reply named by a
+three-digit number, such as `001`. `README.md` at the repository root documents
+the protocol.
 
-## Envelope
+The server can also run an IRC listener for ordinary IRC clients. The IRC
+listener sends plain IRC lines, which these files do not describe.
 
-Every message is a JSON object with a `command` field. The format maps directly
-to IRC wire format:
+## Message fields
+
+Every message is one JSON object, which `message.json` calls the envelope. These
+are the fields it can have:
+
+- `command`: the IRC command name, such as `PRIVMSG`, or the name of a numeric
+  reply, such as `RPL_WELCOME`. Always present.
+- `code`: the number of a numeric reply, such as `1` for `RPL_WELCOME`. Absent
+  on other messages.
+- `id`: the message's UUID, a unique ID that the server assigns.
+- `from`: the sender's nick, or the server name on a server message.
+- `to`: the target, such as a channel name starting with `#` or a nick.
+- `params`: an array of strings with the message's other parameters, in order.
+  `KICK` events and many numeric replies have it. The HTTP API ignores `params`
+  sent by a client.
+- `body`: an array of strings. It is never a bare string. In a `PRIVMSG` or
+  `NOTICE`, each string is one line of text.
+- `ts`: the time the server stored the message. It is an RFC 3339 time in UTC,
+  such as `2026-10-27T12:00:00.123Z`.
+- `meta`: an object of extra data, such as a hashcash stamp in `meta.hashcash`.
+  A hashcash stamp is a short string that takes a computer some work to make. A
+  `PRIVMSG` to a channel with mode `+H` needs one. The HTTP API relays the
+  `meta` of a `PRIVMSG` or `NOTICE` unchanged. It drops the `meta` of every
+  other command.
+
+Here is one `PRIVMSG` as the IRC listener sends it and as the HTTP API sends it.
+The JSON leaves out `id`, `ts` and `meta`:
 
 ```
-IRC:  :nick PRIVMSG #channel :hello world
-JSON: {"command": "PRIVMSG", "from": "nick", "to": "#channel", "body": ["hello world"]}
-
-IRC:  :server 353 nick = #channel :user1 @op1 +voice1
-JSON: {"command": "353", "to": "nick", "params": ["=", "#channel"], "body": ["user1 @op1 +voice1"]}
-
-Multiline:  {"command": "PRIVMSG", "to": "#ch", "body": ["line 1", "line 2"]}
-Structured: {"command": "PUBKEY", "body": {"alg": "ed25519", "key": "base64..."}}
+IRC:  :alice!alice@* PRIVMSG #general :hello world
+JSON: {"command": "PRIVMSG", "from": "alice", "to": "#general", "body": ["hello world"]}
 ```
 
-Common fields (see `message.json` for full schema):
+In the JSON, a numeric reply has its name in `command` and its number in `code`.
+This `353` reply lists the members of `#general`. The JSON again leaves out
+`id`, `ts` and `meta`:
 
-| Field     | Type            | Description                                          |
-| --------- | --------------- | ---------------------------------------------------- |
-| `id`      | string (uuid)   | Server-assigned message UUID                         |
-| `command` | string          | IRC command or 3-digit numeric code                  |
-| `from`    | string          | Source nick or server name (IRC prefix)              |
-| `to`      | string          | Target: #channel or nick                             |
-| `params`  | string[]        | Middle parameters (mainly for numerics)              |
-| `body`    | array \| object | Structured body — never a raw string (see below)     |
-| `ts`      | string          | ISO 8601 timestamp (server-assigned, not in raw IRC) |
-| `meta`    | object          | Extensible metadata (signatures, hashes, etc.)       |
+```
+{"command": "RPL_NAMREPLY", "code": 353, "from": "neoirc", "to": "alice",
+ "params": ["=", "#general"], "body": ["@op1!op1@host1 alice!alice@host2"]}
+```
 
-**Structured bodies:** `body` is always an array of strings (for text) or an
-object (for structured data like PUBKEY). Never a raw string. This enables:
+A `PRIVMSG` whose `body` has two strings is a two-line message:
 
-- Multiline messages without escape sequences
-- Deterministic canonicalization via RFC 8785 JCS for signing
-- Structured data where needed
+```
+{"command": "PRIVMSG", "to": "#general", "body": ["line one", "line two"]}
+```
 
-## Commands
+## Files
 
-IRC commands used for client↔server and server↔server communication.
+Commands, in `commands/`:
 
-| Command   | File                    | RFC         | Description                |
-| --------- | ----------------------- | ----------- | -------------------------- |
-| `PRIVMSG` | `commands/PRIVMSG.json` | 1459 §4.4.1 | Message to channel or user |
-| `NOTICE`  | `commands/NOTICE.json`  | 1459 §4.4.2 | Notice (no auto-reply)     |
-| `JOIN`    | `commands/JOIN.json`    | 1459 §4.2.1 | Join a channel             |
-| `PART`    | `commands/PART.json`    | 1459 §4.2.2 | Leave a channel            |
-| `QUIT`    | `commands/QUIT.json`    | 1459 §4.1.6 | User disconnected          |
-| `NICK`    | `commands/NICK.json`    | 1459 §4.1.2 | Change nickname            |
-| `TOPIC`   | `commands/TOPIC.json`   | 1459 §4.2.4 | Get/set channel topic      |
-| `MODE`    | `commands/MODE.json`    | 1459 §4.2.3 | Set channel/user modes     |
-| `KICK`    | `commands/KICK.json`    | 1459 §4.2.8 | Kick user from channel     |
-| `PING`    | `commands/PING.json`    | 1459 §4.6.2 | Keepalive                  |
-| `PONG`    | `commands/PONG.json`    | 1459 §4.6.3 | Keepalive response         |
-| `PUBKEY`  | `commands/PUBKEY.json`  | (extension) | Announce/relay signing key |
+- `PRIVMSG.json`: a message to a channel or a user.
+- `NOTICE.json`: a notice, which is a message that a client must not answer
+  automatically.
+- `JOIN.json`: a user joined a channel.
+- `PART.json`: a user left a channel.
+- `QUIT.json`: a user left the server.
+- `NICK.json`: a user changed nick.
+- `TOPIC.json`: a channel topic was set.
+- `MODE.json`: a channel mode was changed.
+- `KICK.json`: a channel operator removed a user from a channel.
+- `PING.json`: a check that the server still answers.
+- `PONG.json`: the answer to a `PING`.
+- `PUBKEY.json`: an announcement of a user's public signing key. The server has
+  no such command. It answers a `PUBKEY` with `ERR_UNKNOWNCOMMAND` (`421`).
 
-## Numeric Replies
+Numeric replies, in `numerics/`:
 
-Three-digit codes for server responses, per IRC convention.
+- `001.json`: `RPL_WELCOME`, which welcomes a new user.
+- `002.json`: `RPL_YOURHOST`, the server's name and version.
+- `003.json`: `RPL_CREATED`, which says when the server was created.
+- `004.json`: `RPL_MYINFO`, the server's version and its lists of modes.
+- `322.json`: `RPL_LIST`, one channel in the answer to `LIST`.
+- `323.json`: `RPL_LISTEND`, the end of the answer to `LIST`.
+- `332.json`: `RPL_TOPIC`, a channel's topic.
+- `353.json`: `RPL_NAMREPLY`, a channel's members.
+- `366.json`: `RPL_ENDOFNAMES`, the end of the member list.
+- `372.json`: `RPL_MOTD`, one line of the message of the day.
+- `375.json`: `RPL_MOTDSTART`, the start of the message of the day.
+- `376.json`: `RPL_ENDOFMOTD`, the end of the message of the day.
+- `401.json`: `ERR_NOSUCHNICK`, the nick does not exist.
+- `403.json`: `ERR_NOSUCHCHANNEL`, the channel does not exist.
+- `433.json`: `ERR_NICKNAMEINUSE`, the nick is taken.
+- `442.json`: `ERR_NOTONCHANNEL`, the user is not on that channel.
+- `482.json`: `ERR_CHANOPRIVSNEEDED`, the user is not a channel operator.
 
-### Success / Informational (0xx–3xx)
+## Where the files differ from the HTTP API
 
-| Code  | Name           | File                | Description                    |
-| ----- | -------------- | ------------------- | ------------------------------ |
-| `001` | RPL_WELCOME    | `numerics/001.json` | Welcome after session creation |
-| `002` | RPL_YOURHOST   | `numerics/002.json` | Server host info               |
-| `003` | RPL_CREATED    | `numerics/003.json` | Server creation date           |
-| `004` | RPL_MYINFO     | `numerics/004.json` | Server info and modes          |
-| `322` | RPL_LIST       | `numerics/322.json` | Channel list entry             |
-| `323` | RPL_LISTEND    | `numerics/323.json` | End of channel list            |
-| `332` | RPL_TOPIC      | `numerics/332.json` | Channel topic                  |
-| `353` | RPL_NAMREPLY   | `numerics/353.json` | Channel member list            |
-| `366` | RPL_ENDOFNAMES | `numerics/366.json` | End of NAMES list              |
-| `372` | RPL_MOTD       | `numerics/372.json` | MOTD line                      |
-| `375` | RPL_MOTDSTART  | `numerics/375.json` | Start of MOTD                  |
-| `376` | RPL_ENDOFMOTD  | `numerics/376.json` | End of MOTD                    |
+Where a schema file and the HTTP API disagree, the HTTP API is right:
 
-### Errors (4xx)
+- `message.json` and the files in `numerics/` put the three-digit code in
+  `command`. They have no `code` field. The HTTP API puts the reply's name in
+  `command` and its number in `code`.
+- `message.json` allows an object as `body`. The HTTP API reads only arrays of
+  strings. A `PRIVMSG` with an object as `body` gets `ERR_NOTEXTTOSEND` (`412`).
+- `message.json` says `to` is a channel or a nick. A `WALLOPS` message has `*`
+  there.
+- `message.json` allows `meta` on every message. The HTTP API keeps a client's
+  `meta` only on a `PRIVMSG` or `NOTICE`.
+- `message.json` describes signature fields in `meta`. The server never checks a
+  signature.
+- `message.json` does not describe `meta.hashcash`. The HTTP API reads it in a
+  `PRIVMSG` to a channel with mode `+H`.
+- `JOIN.json` has no `body`. A client's `JOIN` can carry the channel key in
+  `body`. When a user joins, the `JOIN` event repeats the channel name in
+  `body`.
+- `JOIN.json` allows a channel name of any length. The server allows at most 63
+  characters after the `#`. It answers a longer name with `ERR_NOSUCHCHANNEL`
+  (`403`).
+- `KICK.json` puts the kicked nick in `params`. The HTTP API reads a client's
+  `KICK` from `body`: the nick, then an optional reason.
+- `MODE.json` puts the mode change in `params`. The HTTP API uses `body`
+  instead. A client sends the change and any value as separate strings, such as
+  `"+o"` and `"bob"`. In a `MODE` event, `body` holds the change as one string,
+  such as `"+o bob"`, or as two strings, such as `"+k"` and `"secret"`.
+- `NOTICE.json` allows `*` as `to`. The server answers a `NOTICE` to `*` with
+  `ERR_NOSUCHNICK` (`401`).
+- `NOTICE.json` has an example notice from the server to `*`. The server sends
+  no such notice.
+- `PING.json` and `PONG.json` describe a token that the `PONG` repeats. The HTTP
+  API ignores the `body` of a `PING`. Its answer is the HTTP response
+  `{"command": "PONG", "from": "<server name>"}`.
+- `PING.json` and `PONG.json` also describe messages between servers. The server
+  does not connect to other IRC servers.
+- `PUBKEY.json` describes a command the server does not have.
+- `QUIT.json` says that `QUIT` comes only from the server. A client can send it
+  too, to end its session. A client's `QUIT` can carry a reason in `body`.
+- `TOPIC.json` says a `TOPIC` without a `body` queries the topic. The HTTP API
+  answers such a `TOPIC` with `ERR_NEEDMOREPARAMS` (`461`).
+- `TOPIC.json` says an empty array clears the topic. The HTTP API answers `[]`
+  with `ERR_NEEDMOREPARAMS` (`461`). A `body` of `[""]` clears the topic.
+- `003.json` describes the server's creation date. The HTTP API sends the date
+  the server last started.
+- `004.json` has example mode lists. The HTTP API sends an empty string as the
+  user modes and `ikmnostl` as the channel modes.
+- `322.json` says `LIST` gets one reply per channel. The server leaves out a
+  secret channel, one with mode `+s`, unless the user is on it.
+- `332.json` says `RPL_TOPIC` answers a `TOPIC` query. The HTTP API has no such
+  query. It sends `RPL_TOPIC` after a client sets the topic, and after a `JOIN`
+  to a channel that has one.
+- `353.json` says `body` lists nicks. The HTTP API lists `nick!user@host` in
+  place of each nick, such as `@op1!op1@host1`.
+- `353.json` says the first parameter marks a channel as public, private or
+  secret. The server always sends `=`, the mark for a public channel.
+- `376.json` gives the text as `End of /MOTD command`. The HTTP API adds a full
+  stop.
+- `401.json` gives the text as `No such nick/channel`. The server sends
+  `No such nick` in answer to a `PRIVMSG` or `NOTICE` to an unknown nick.
+- `433.json` has an example with `*` as `to`. The HTTP API sends `433` only in
+  answer to a `NICK`, with the user's nick as `to`.
 
-| Code  | Name                 | File                | Description             |
-| ----- | -------------------- | ------------------- | ----------------------- |
-| `401` | ERR_NOSUCHNICK       | `numerics/401.json` | No such nick/channel    |
-| `403` | ERR_NOSUCHCHANNEL    | `numerics/403.json` | No such channel         |
-| `433` | ERR_NICKNAMEINUSE    | `numerics/433.json` | Nickname already in use |
-| `442` | ERR_NOTONCHANNEL     | `numerics/442.json` | Not on that channel     |
-| `482` | ERR_CHANOPRIVSNEEDED | `numerics/482.json` | Not channel operator    |
-
-## Federation (S2S)
-
-Server-to-server messages use the same command format. Federated servers relay
-messages with an additional `origin` field in `meta` to track the source server.
-The PING/PONG commands serve as inter-server keepalives. State sync after link
-establishment uses a burst of JOIN, NICK, TOPIC, and MODE commands.
+The HTTP API also accepts some messages that the files do not allow, such as a
+`JOIN` whose `to` has no `#`.

web/src/app.jsx

@@ -7,6 +7,11 @@ const RECONNECT_DELAY = 3000;
 const MEMBER_REFRESH_INTERVAL = 10000;
 const ACTION_PREFIX = "\x01ACTION ";
 const ACTION_SUFFIX = "\x01";
+// SERVER_TAB is the Server tab's name, under which its messages and
+// unread count are stored. No nick or channel name can contain *, so a
+// user with the nick Server gets a direct-message tab of its own. The
+// tab bar labels this tab Server.
+const SERVER_TAB = "*server*";
 
 // Hashcash proof-of-work helpers using Web Crypto API.
 
@@ -58,13 +63,13 @@ async function mintHashcash(bits, resource) {
   }
 }
 
+// Requests are authenticated by the auth cookie, which the browser
+// sends on its own.
 function api(path, opts = {}) {
-  const token = localStorage.getItem("neoirc_token");
   const headers = {
     "Content-Type": "application/json",
     ...(opts.headers || {}),
   };
-  if (token) headers["Authorization"] = `Bearer ${token}`;
   const { signal, ...rest } = opts;
 
   return fetch(API + path, { ...rest, headers, signal }).then(async (r) => {
@@ -122,12 +127,11 @@ function LoginScreen({ onLogin }) {
         if (s.name) hashcashResourceRef.current = s.name;
       })
       .catch(() => {});
-    const saved = localStorage.getItem("neoirc_token");
-    if (saved) {
-      api("/state?initChannelState=1")
-        .then((u) => onLogin(u.nick, true))
-        .catch(() => localStorage.removeItem("neoirc_token"));
-    }
+    // Resume the session if the browser still holds a valid auth
+    // cookie; a 401 leaves the login form up.
+    api("/state?initChannelState=1")
+      .then((u) => onLogin(u.nick, true))
+      .catch(() => {});
     inputRef.current?.focus();
   }, []);
 
@@ -152,7 +156,6 @@ function LoginScreen({ onLogin }) {
         method: "POST",
         body: JSON.stringify(reqBody),
       });
-      localStorage.setItem("neoirc_token", res.token);
       onLogin(res.nick);
     } catch (err) {
       setError(err.data?.error || "Connection failed");
@@ -227,10 +230,9 @@ function UserList({ members, onNickClick }) {
   const regular = [];
 
   for (const m of members) {
-    const mode = m.mode || "";
-    if (mode === "o") {
+    if (m.isOperator) {
       ops.push(m);
-    } else if (mode === "v") {
+    } else if (m.isVoiced) {
       voiced.push(m);
     } else {
       regular.push(m);
@@ -273,9 +275,9 @@ function UserList({ members, onNickClick }) {
 function App() {
   const [loggedIn, setLoggedIn] = useState(false);
   const [nick, setNick] = useState("");
-  const [tabs, setTabs] = useState([{ type: "server", name: "Server" }]);
+  const [tabs, setTabs] = useState([{ type: "server", name: SERVER_TAB }]);
   const [activeTab, setActiveTab] = useState(0);
-  const [messages, setMessages] = useState({ Server: [] });
+  const [messages, setMessages] = useState({ [SERVER_TAB]: [] });
   const [members, setMembers] = useState({});
   const [topics, setTopics] = useState({});
   const [unread, setUnread] = useState({});
@@ -303,11 +305,14 @@ function App() {
     nickRef.current = nick;
   }, [nick]);
 
-  // Persist joined channels.
+  // Persist joined channels, once logged in: before then only the
+  // Server tab exists, and writing would erase the saved channels
+  // that onLogin rejoins.
   useEffect(() => {
+    if (!loggedIn) return;
     const channels = tabs.filter((t) => t.type === "channel").map((t) => t.name);
     localStorage.setItem("neoirc_channels", JSON.stringify(channels));
-  }, [tabs]);
+  }, [loggedIn, tabs]);
 
   // Clear unread on tab switch.
   useEffect(() => {
@@ -355,6 +360,26 @@ function App() {
       .catch(() => {});
   }, []);
 
+  // removeChannelTab closes a channel's tab. The tab the user was
+  // reading stays active, found by its name; when it was the closed tab,
+  // the Server tab shows.
+  const removeChannelTab = useCallback((name) => {
+    setTabs((prev) => {
+      const remaining = prev.filter(
+        (t) => !(t.type === "channel" && t.name === name),
+      );
+      // Preact runs this update at once, on the newest active tab.
+      setActiveTab((active) => {
+        const reading = prev[active]?.name;
+        const idx = remaining.findIndex((t) => t.name === reading);
+
+        return idx >= 0 ? idx : 0;
+      });
+
+      return remaining;
+    });
+  }, []);
+
   const processMessage = useCallback(
     (msg) => {
       const body = Array.isArray(msg.body) ? msg.body.join("\n") : "";
@@ -366,7 +391,9 @@ function App() {
         command: msg.command,
       };
 
-      switch (msg.command) {
+      // A numeric reply carries its number in `code` and its name in
+      // `command`; other messages have no `code`.
+      switch (msg.code || msg.command) {
         case "PRIVMSG":
         case "NOTICE": {
           let text = body;
@@ -422,6 +449,13 @@ function App() {
           break;
         }
         case "PART": {
+          // The user's own PART, sent from this client or another,
+          // closes the tab and adds no message or unread count.
+          if (msg.from === nickRef.current) {
+            removeChannelTab(msg.to);
+
+            break;
+          }
           const reason = body ? " (" + body + ")" : "";
           const text = `${msg.from} has parted ${msg.to}${reason}`;
           if (msg.to) addMessage(msg.to, { ...base, text, system: true });
@@ -429,6 +463,29 @@ function App() {
 
           break;
         }
+        case "KICK": {
+          // The kicked nick is in params; the body is the reason.
+          const kicked = Array.isArray(msg.params) ? msg.params[0] : "";
+          const reason = body ? " (" + body + ")" : "";
+          const text = `${kicked} was kicked from ${msg.to} by ${msg.from}${reason}`;
+          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
+          if (kicked === nickRef.current) {
+            // The channel's tab closes, so the Server tab gets the line
+            // too. It needs an id of its own: addMessage drops a message
+            // whose id it has already seen.
+            addMessage(SERVER_TAB, {
+              ...base,
+              id: msg.id + "-server",
+              text,
+              system: true,
+            });
+            removeChannelTab(msg.to);
+          } else if (msg.to && msg.to.startsWith("#")) {
+            refreshMembers(msg.to);
+          }
+
+          break;
+        }
         case "QUIT": {
           const reason = body ? " (" + body + ")" : "";
           const text = `${msg.from} has quit${reason}`;
@@ -464,8 +521,18 @@ function App() {
 
           break;
         }
-        case "353": {
-          // RPL_NAMREPLY — parse mode prefixes from names list.
+        case "MODE": {
+          // The body is the change, with its value where it has one:
+          // ["+o bob"], ["+m"], ["+k", "secretpass"].
+          const modes = Array.isArray(msg.body) ? msg.body.join(" ") : "";
+          const text = `${msg.from} sets mode ${modes} on ${msg.to}`;
+          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
+
+          break;
+        }
+        case 353: {
+          // RPL_NAMREPLY — each name is a hostmask (nick!user@host),
+          // prefixed with @ for an operator or + for a voiced member.
           if (
             Array.isArray(msg.params) &&
             msg.params.length >= 2 &&
@@ -477,21 +544,18 @@ function App() {
               : String(msg.body);
             const names = namesStr.split(/\s+/).filter(Boolean);
             const parsed = names.map((n) => {
-              if (n.startsWith("@")) {
-                return { nick: n.slice(1), mode: "o" };
-              }
-              if (n.startsWith("+")) {
-                return { nick: n.slice(1), mode: "v" };
-              }
+              const isOperator = n.startsWith("@");
+              const isVoiced = n.startsWith("+");
+              const hostmask = isOperator || isVoiced ? n.slice(1) : n;
 
-              return { nick: n, mode: "" };
+              return { nick: hostmask.split("!")[0], isOperator, isVoiced };
             });
             setMembers((prev) => ({ ...prev, [channel]: parsed }));
           }
 
           break;
         }
-        case "332": {
+        case 332: {
           // RPL_TOPIC — set topic from server.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const channel = msg.params[0];
@@ -503,13 +567,13 @@ function App() {
 
           break;
         }
-        case "322": {
+        case 322: {
           // RPL_LIST — channel, member count, topic.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const chName = msg.params[0];
             const count = msg.params[1];
             const chTopic = body || "";
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${chName} (${count} users): ${chTopic.trim()}`,
               system: true,
@@ -518,21 +582,21 @@ function App() {
 
           break;
         }
-        case "323":
-          addMessage("Server", {
+        case 323:
+          addMessage(SERVER_TAB, {
             ...base,
             text: body || "End of channel list",
             system: true,
           });
 
           break;
-        case "352": {
+        case 352: {
           // RPL_WHOREPLY — channel, user, host, server, nick, flags.
           if (Array.isArray(msg.params) && msg.params.length >= 5) {
             const whoCh = msg.params[0];
             const whoNick = msg.params[4];
             const whoFlags = msg.params.length > 5 ? msg.params[5] : "";
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${whoCh} ${whoNick} ${whoFlags}`,
               system: true,
@@ -541,33 +605,33 @@ function App() {
 
           break;
         }
-        case "315":
-          addMessage("Server", {
+        case 315:
+          addMessage(SERVER_TAB, {
             ...base,
             text: body || "End of /WHO list",
             system: true,
           });
 
           break;
-        case "311": {
-          // RPL_WHOISUSER — nick, user, host, *, realname.
-          if (Array.isArray(msg.params) && msg.params.length >= 1) {
-            const wiNick = msg.params[0];
-            addMessage("Server", {
+        case 311: {
+          // RPL_WHOISUSER — params nick, user, host, *; body realname.
+          if (Array.isArray(msg.params) && msg.params.length >= 3) {
+            const [wiNick, wiUser, wiHost] = msg.params;
+            addMessage(SERVER_TAB, {
               ...base,
-              text: `${wiNick} (${body})`,
+              text: `${wiNick} is ${wiUser}@${wiHost} (${body})`,
               system: true,
             });
           }
 
           break;
         }
-        case "312": {
+        case 312: {
           // RPL_WHOISSERVER — nick, server, server info.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const wiNick = msg.params[0];
             const wiServer = msg.params[1];
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${wiNick} on ${wiServer}`,
               system: true,
@@ -576,11 +640,37 @@ function App() {
 
           break;
         }
-        case "319": {
+        case 313: {
+          // RPL_WHOISOPERATOR — nick; body "is an IRC operator".
+          if (Array.isArray(msg.params) && msg.params.length >= 1) {
+            addMessage(SERVER_TAB, {
+              ...base,
+              text: `${msg.params[0]} ${body}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case 317: {
+          // RPL_WHOISIDLE — nick, idle seconds, signon time (Unix).
+          if (Array.isArray(msg.params) && msg.params.length >= 3) {
+            const [wiNick, idle, signon] = msg.params;
+            const signedOn = new Date(Number(signon) * 1000).toLocaleString();
+            addMessage(SERVER_TAB, {
+              ...base,
+              text: `${wiNick} has been idle ${idle}s, signed on ${signedOn}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case 319: {
           // RPL_WHOISCHANNELS — nick, channels.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const wiNick = msg.params[0];
-            addMessage("Server", {
+            addMessage(SERVER_TAB, {
               ...base,
               text: `${wiNick} is on: ${body}`,
               system: true,
@@ -589,27 +679,39 @@ function App() {
 
           break;
         }
-        case "318":
-          addMessage("Server", {
+        case 318:
+          addMessage(SERVER_TAB, {
             ...base,
             text: body || "End of /WHOIS list",
             system: true,
           });
 
           break;
-        case "375":
-        case "372":
-        case "376":
-          addMessage("Server", { ...base, text: body, system: true });
+        case 324: {
+          // RPL_CHANNELMODEIS — channel, mode string.
+          if (Array.isArray(msg.params) && msg.params.length >= 2) {
+            addMessage(SERVER_TAB, {
+              ...base,
+              text: `${msg.params[0]} modes: ${msg.params[1]}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case 375:
+        case 372:
+        case 376:
+          addMessage(SERVER_TAB, { ...base, text: body, system: true });
 
           break;
         default:
           if (body) {
-            addMessage("Server", { ...base, text: body, system: true });
+            addMessage(SERVER_TAB, { ...base, text: body, system: true });
           }
       }
     },
-    [addMessage, refreshMembers],
+    [addMessage, refreshMembers, removeChannelTab],
   );
 
   // Long-poll loop.
@@ -637,6 +739,14 @@ function App() {
         } catch (err) {
           if (!alive) break;
           if (err.name === "AbortError") continue;
+          // 401: the session is gone (QUIT from another client, or
+          // expiry). Reloading drops this page's state and brings
+          // back the login screen.
+          if (err.status === 401) {
+            window.location.reload();
+
+            return;
+          }
           setConnected(false);
           await new Promise((r) => setTimeout(r, RECONNECT_DELAY));
         }
@@ -716,9 +826,14 @@ function App() {
 
   const onLogin = useCallback(
     async (userNick, isResumed) => {
+      // Read before setLoggedIn(true): from then on the effect under
+      // "Persist joined channels" writes the open channel tabs over it.
+      const saved = JSON.parse(
+        localStorage.getItem("neoirc_channels") || "[]",
+      );
       setNick(userNick);
       setLoggedIn(true);
-      addSystemMessage("Server", `Connected as ${userNick}`);
+      addSystemMessage(SERVER_TAB, `Connected as ${userNick}`);
 
       if (isResumed) {
         // Request MOTD on resumed sessions (new sessions
@@ -740,15 +855,13 @@ function App() {
       }
 
       // Fresh session — join any previously saved channels.
-      const saved = JSON.parse(
-        localStorage.getItem("neoirc_channels") || "[]",
-      );
       for (const ch of saved) {
         try {
-          await api("/messages", {
+          const res = await api("/messages", {
             method: "POST",
             body: JSON.stringify({ command: "JOIN", to: ch }),
           });
+          if (res?.status !== "joined") continue;
           setTabs((prev) => {
             if (prev.find((t) => t.type === "channel" && t.name === ch))
               return prev;
@@ -768,18 +881,30 @@ function App() {
     name = name.trim();
     if (!name.startsWith("#")) name = "#" + name;
     try {
-      await api("/messages", {
+      const res = await api("/messages", {
         method: "POST",
         body: JSON.stringify({ command: "JOIN", to: name }),
       });
+      // A refused join opens no tab. The error numeric that the
+      // server sends to the message queue tells the user why.
+      if (res?.status !== "joined") return;
+      // Show the channel's tab. Preact runs this update at once on the
+      // newest tab list, so the tab is found there by name: the user's
+      // own JOIN event may already have added it, and other tabs may
+      // have closed.
       setTabs((prev) => {
-        if (prev.find((t) => t.type === "channel" && t.name === name))
+        const idx = prev.findIndex(
+          (t) => t.type === "channel" && t.name === name,
+        );
+        if (idx >= 0) {
+          setActiveTab(idx);
+
           return prev;
+        }
+        setActiveTab(prev.length);
 
         return [...prev, { type: "channel", name }];
       });
-      const newIdx = tabsRef.current.length;
-      setActiveTab(newIdx);
       try {
         const hist = await api(
           `/history?target=${encodeURIComponent(name)}&limit=50`,
@@ -792,7 +917,7 @@ function App() {
       }
     } catch (err) {
       addSystemMessage(
-        "Server",
+        SERVER_TAB,
         `Failed to join ${name}: ${err.data?.error || "error"}`,
       );
     }
@@ -808,10 +933,7 @@ function App() {
     } catch (e) {
       // Ignore.
     }
-    setTabs((prev) =>
-      prev.filter((t) => !(t.type === "channel" && t.name === name)),
-    );
-    setActiveTab(0);
+    removeChannelTab(name);
   };
 
   const closeTab = (idx) => {
@@ -826,16 +948,23 @@ function App() {
 
   const openDM = (targetNick) => {
     if (targetNick === nickRef.current) return;
+    // Show the direct-message tab. Preact runs this update at once on
+    // the newest tab list, so the tab is found there by name: the
+    // server's copy of the user's message may already have added it,
+    // and other tabs may have opened or closed.
     setTabs((prev) => {
-      if (prev.find((t) => t.type === "dm" && t.name === targetNick))
+      const idx = prev.findIndex(
+        (t) => t.type === "dm" && t.name === targetNick,
+      );
+      if (idx >= 0) {
+        setActiveTab(idx);
+
         return prev;
+      }
+      setActiveTab(prev.length);
 
       return [...prev, { type: "dm", name: targetNick }];
     });
-    const idx = tabs.findIndex(
-      (t) => t.type === "dm" && t.name === targetNick,
-    );
-    setActiveTab(idx >= 0 ? idx : tabs.length);
   };
 
   const handleCommand = async (text) => {
@@ -846,7 +975,7 @@ function App() {
     switch (cmd) {
       case "/join": {
         if (parts[1]) joinChannel(parts[1]);
-        else addSystemMessage("Server", "Usage: /join #channel");
+        else addSystemMessage(SERVER_TAB, "Usage: /join #channel");
 
         break;
       }
@@ -855,7 +984,7 @@ function App() {
           const reason = parts.slice(1).join(" ") || undefined;
           partChannel(tab.name, reason);
         } else {
-          addSystemMessage("Server", "You are not in a channel");
+          addSystemMessage(SERVER_TAB, "You are not in a channel");
         }
 
         break;
@@ -876,19 +1005,19 @@ function App() {
             openDM(target);
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `Message failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /msg <nick> <message>");
+          addSystemMessage(SERVER_TAB, "Usage: /msg <nick> <message>");
         }
 
         break;
       }
       case "/me": {
         if (tab.type === "server") {
-          addSystemMessage("Server", "Cannot use /me in server window");
+          addSystemMessage(SERVER_TAB, "Cannot use /me in server window");
 
           break;
         }
@@ -910,7 +1039,7 @@ function App() {
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /me <action>");
+          addSystemMessage(SERVER_TAB, "Usage: /me <action>");
         }
 
         break;
@@ -924,19 +1053,19 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `Nick change failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /nick <newnick>");
+          addSystemMessage(SERVER_TAB, "Usage: /nick <newnick>");
         }
 
         break;
       }
       case "/topic": {
         if (tab.type !== "channel") {
-          addSystemMessage("Server", "You are not in a channel");
+          addSystemMessage(SERVER_TAB, "You are not in a channel");
 
           break;
         }
@@ -953,13 +1082,13 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `Topic change failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `Current topic for ${tab.name}: ${topics[tab.name] || "(none)"}`,
           );
         }
@@ -968,31 +1097,26 @@ function App() {
       }
       case "/mode": {
         if (tab.type !== "channel") {
-          addSystemMessage("Server", "You are not in a channel");
+          addSystemMessage(SERVER_TAB, "You are not in a channel");
 
           break;
         }
+        // With no arguments MODE is a query. A change is one sign and
+        // letter, then its value where it takes one: +m, +o nick.
         const modeArgs = parts.slice(1);
-        if (modeArgs.length > 0) {
-          try {
-            await api("/messages", {
-              method: "POST",
-              body: JSON.stringify({
-                command: "MODE",
-                to: tab.name,
-                params: modeArgs,
-              }),
-            });
-          } catch (err) {
-            addSystemMessage(
-              "Server",
-              `Mode change failed: ${err.data?.error || "error"}`,
-            );
-          }
-        } else {
+        const body =
+          modeArgs.length > 0
+            ? { command: "MODE", to: tab.name, body: modeArgs }
+            : { command: "MODE", to: tab.name };
+        try {
+          await api("/messages", {
+            method: "POST",
+            body: JSON.stringify(body),
+          });
+        } catch (err) {
           addSystemMessage(
-            "Server",
-            "Usage: /mode <+/-mode> [params]",
+            SERVER_TAB,
+            `MODE failed: ${err.data?.error || "error"}`,
           );
         }
 
@@ -1009,7 +1133,6 @@ function App() {
         } catch (e) {
           // Ignore.
         }
-        localStorage.removeItem("neoirc_token");
         localStorage.removeItem("neoirc_channels");
         window.location.reload();
 
@@ -1023,7 +1146,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `Failed to request MOTD: ${err.data?.error || "error"}`,
           );
         }
@@ -1047,13 +1170,13 @@ function App() {
               });
             } catch (err) {
               addSystemMessage(
-                "Server",
+                SERVER_TAB,
                 `Message failed: ${err.data?.error || "error"}`,
               );
             }
           }
         } else {
-          addSystemMessage("Server", "Usage: /query <nick> [message]");
+          addSystemMessage(SERVER_TAB, "Usage: /query <nick> [message]");
         }
 
         break;
@@ -1066,7 +1189,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            "Server",
+            SERVER_TAB,
             `Failed to list channels: ${err.data?.error || "error"}`,
           );
         }
@@ -1083,12 +1206,12 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `WHO failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /who #channel");
+          addSystemMessage(SERVER_TAB, "Usage: /who #channel");
         }
 
         break;
@@ -1102,12 +1225,12 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              "Server",
+              SERVER_TAB,
               `WHOIS failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage("Server", "Usage: /whois <nick>");
+          addSystemMessage(SERVER_TAB, "Usage: /whois <nick>");
         }
 
         break;
@@ -1128,7 +1251,7 @@ function App() {
           "  /me action            — Send an action",
           "  /nick newnick         — Change your nickname",
           "  /topic [text]         — View or set channel topic",
-          "  /mode +/-flags        — Set channel modes",
+          "  /mode [+/-flag [arg]] — View or set channel modes",
           "  /motd                 — Display the message of the day",
           "  /list                 — List all channels",
           "  /who [#channel]       — List users in a channel",
@@ -1138,13 +1261,13 @@ function App() {
           "  /help                 — Show this help",
         ];
         for (const line of helpLines) {
-          addSystemMessage("Server", line);
+          addSystemMessage(SERVER_TAB, line);
         }
 
         break;
       }
       default:
-        addSystemMessage("Server", `Unknown command: ${cmd}`);
+        addSystemMessage(SERVER_TAB, `Unknown command: ${cmd}`);
     }
   };
 
@@ -1173,7 +1296,7 @@ function App() {
 
     if (tab.type === "server") {
       addSystemMessage(
-        "Server",
+        SERVER_TAB,
         "Cannot send messages to the server window. Use /join #channel first.",
       );
 
@@ -1244,7 +1367,7 @@ function App() {
               key={tab.name}
             >
               <span class="tab-label">
-                {tab.type === "dm" ? tab.name : tab.name}
+                {tab.type === "server" ? "Server" : tab.name}
               </span>
               {unread[tab.name] > 0 && i !== activeTab && (
                 <span class="unread-count">({unread[tab.name]})</span>