Fix IRC listener relay of bodies and modes, and JOIN names (closes #127)

The IRC listener relayed only the first line of a PRIVMSG or NOTICE
body; it now sends one line per body line. A MODE change reached IRC
listener members without its key, limit or mask, and "+o bob" went out
as one trailing parameter; each value is now its own parameter, in the
relay and in the echo to the IRC listener user who made the change.
CR, LF and NUL are now removed from each parameter of a line sent to an
IRC listener connection, before the leading ':' is decided, and from
the whole line, so a stored body line, key or mask cannot start a line
of its own. The channel name check moved from the HTTP handler into
service.JoinChannel, so the IRC listener's JOIN refuses the same names
with 403.

Model: opus-5-5

.golangci.yml

@@ -61,10 +61,6 @@ linters:
               desc: >-
                 Test-support code belongs in test files and in packages whose
                 directory name ends in test, not in the shipped binary.
-            - pkg: sneak.berlin/go/neoirc/internal/dbtest
-              desc: >-
-                Test-support code belongs in test files and in packages whose
-                directory name ends in test, not in the shipped binary.
     # Only decisions already recorded in the Go package defaults are
     # listed here. Every entry matches the module path exactly.
     gomodguard_v2:

AGENTS.md

@@ -1,73 +1,55 @@
-# Rules for coding agents
+# AGENTS.md — Rules for AI Agents
 
-This file holds the rules for coding agents working in this repository.
+## Before Every Commit
-`CONVENTIONS.md` defines the architecture. `REPO_POLICIES.md` defines the
-repository standards. Both are copies of shared documents. Do not edit them
-here.
 
-## Before every commit
+1. **Format**: `make fmt`
+2. **Check**: `make check` — the tests and the linter, which run in Docker, and
+   the format check: all passing, zero issues
 
-1. Run `make fmt`.
+Never run `go test`, `golangci-lint` or `gofmt` directly; use the `make`
-2. Run `make check`. It runs the tests and the linter in Docker, then the format
+targets.
-   check. All three must pass with no findings.
 
-Never run `go test`, `golangci-lint` or `gofmt` directly. Use the `make` targets
+No commit lands on main with lint errors, test failures, or formatting issues.
-instead, such as `make test` and `make lint`.
 
-## Branches and pull requests
+## Code Style
 
-- Never commit to `main` or `next` directly. Every change is a pull request from
+- Follow CONVENTIONS.md exactly — it defines the architecture
-  a feature branch into `next`.
+- All exported types, functions, methods, and vars must have doc comments
-- Only the owner merges `next` into `main`.
+- All packages must have a package doc comment
-- A pull request that closes an issue has the title `Description (closes #N)`.
+- JSON tags use camelCase (not snake_case)
-- One logical change per commit.
+- No magic numbers — use named constants
-- Commit messages are in the imperative mood and short.
+- No inline error handling (`if err := ...; err != nil`) — use plain assignment
+- Blank line before every `return` statement
+- Blank line separating embedded fields from regular fields in structs
+- Blank imports must have a justification comment
 
-## Code style
+## Git Workflow
 
-- Follow `CONVENTIONS.md`.
+- **Never commit directly to main** — all changes go on feature branches
-- Every package has a package doc comment. Test files need none.
+- Merge to main only when ready and passing all checks
-- Every exported type, function and variable has a doc comment. Test files need
+- PR titles: `Description (closes #N)` when closing an issue
-  none.
+- One logical change per commit
-- JSON tags are camelCase. The HTTP API's `last_id`, `pow_token` and
+- Commit messages: imperative mood, concise
-  `hashcash_bits` stay as they are, each with a `//nolint:tagliatelle` comment.
-- Prefer named constants to magic numbers. The `mnd` linter checks for them
-  outside test files.
-- No inline error handling such as `if err := f(); err != nil`. Assign the error
-  on its own line, then test it.
-- A `return` that follows another statement in its block has a blank line before
-  it.
-- A blank line between the embedded fields of a struct and its other fields.
-- Every blank import has a comment saying why it is there. Test files need none.
 
 ## Architecture
 
-- The server uses `go.uber.org/fx` for dependency injection.
+- Dependency injection via Uber fx — all components are fx providers
-  `cmd/neoircd/main.go` lists its `fx` providers, such as `db.New` and
+- `internal/` for all application packages — one package per concern
-  `handlers.New`.
+- Handlers return `http.HandlerFunc` using the closure pattern
-- Application packages live under `internal/`, one package per concern.
+- Request/response structs defined inside handler closures
-- `pkg/irc` holds the IRC command names and numeric reply codes.
+- Models embed `models.Base` for database access to relation methods
-- The `web` package embeds the built web client.
+- Database migrations in `internal/db/schema/` — embedded via `go:embed`
-- Each exported `Handle…` method of `Handlers` returns an `http.HandlerFunc`.
+- SQLite by default (pure Go driver: modernc.org/sqlite)
-- A request struct is defined inside the method that decodes it.
-- The server uses the database only through the methods of `db.Database`.
-- The database migrations live in `internal/db/schema/` and are embedded with
-  `go:embed`.
-- The database is SQLite, through the pure Go driver `modernc.org/sqlite`.
 
 ## Testing
 
-- Prefer table-driven tests.
+- Table-driven tests preferred
-- Use `testing.T` helpers, not assertion libraries.
+- Use `testing.T` helpers, not assertion libraries
-- A test file lives next to the code it tests and ends in `_test.go`.
+- Test files live next to the code they test
-- The linter requires each test file to be in the package's external test
+- `_test.go` suffix, same package for white-box testing
-  package, such as `handlers_test`. It allows `export_test.go` and files ending
-  in `_internal_test.go` in the package itself.
-- An `export_test.go` file gives the external tests access to the package's
-  unexported code.
 
 ## Dependencies
 
-- The required libraries are listed in `CONVENTIONS.md` §1.
+- Required libraries are listed in CONVENTIONS.md §1
-- No new dependency without a reason given in the pull request.
+- No new dependencies without justification
-- Prefer dependencies written in pure Go, which build without cgo.
+- Pure Go preferred (no CGO)

Dockerfile

@@ -33,18 +33,14 @@ RUN golangci-lint run --config .golangci.yml ./...
 # golang:1.24.13-bookworm, 2026-10-06
 FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
 WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
 # -p 4 because test runs on a shared build host cap their parallelism.
-# The modules download in this RUN rather than a layer of their own, because
+RUN go test -p 4 -timeout 90s -race -cover ./... || \
-# exporting a layer that holds them is slow. Nothing reads them or the build
-# cache afterwards, so go clean removes both.
-RUN set -e; \
-    go mod download; \
-    go test -p 4 -timeout 90s -race -cover ./... || \
     { echo "--- Rerunning with -v for details ---"; \
-      go test -p 4 -timeout 90s -race -v ./...; exit 1; }; \
+      go test -p 4 -timeout 90s -race -v ./...; exit 1; }
-    go clean -cache -modcache
 
 # Build stage. Nothing is wanted from either phase above; the copies
 # are what make BuildKit build them first, so this stage cannot run
@@ -83,15 +79,14 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoir
 # stage's chain and nothing else.
 # alpine:3.21, 2026-02-26
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
-# su-exec 0.2-r3, 2026-11-10
+RUN apk add --no-cache ca-certificates \
-RUN apk add --no-cache ca-certificates su-exec=0.2-r3 \
+    && addgroup -S neoirc && adduser -S neoirc -G neoirc \
-    && addgroup -S neoirc && adduser -S neoirc -G neoirc
+    && mkdir -p /var/lib/neoirc \
+    && chown neoirc:neoirc /var/lib/neoirc
 COPY --from=builder /neoircd /usr/local/bin/neoircd
-COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
-# No USER: the entrypoint starts as root to give /var/lib/neoirc to neoirc,
+USER neoirc
-# then runs neoircd as neoirc.
 EXPOSE 8080 6667
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD wget -qO- http://localhost:8080/.well-known/healthcheck.json || exit 1
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+ENTRYPOINT ["neoircd"]

deploy/docker-entrypoint.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-# deploy/docker-entrypoint.sh: the image's ENTRYPOINT, run as root. A host
-# directory mounted at /var/lib/neoirc keeps the host's owner, so this gives
-# it to neoirc before running neoircd as neoirc.
-set -eu
-
-main() {
-    mkdir -p /var/lib/neoirc
-    chown -R neoirc:neoirc /var/lib/neoirc
-    chmod 0700 /var/lib/neoirc
-    exec su-exec neoirc neoircd "$@"
-}
-
-main "$@"

go.mod

@@ -13,10 +13,8 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rivo/tview v0.42.0
 	github.com/slok/go-http-metrics v0.13.0
-	github.com/spf13/cast v1.10.0
 	github.com/spf13/viper v1.21.0
 	go.uber.org/fx v1.24.0
-	go4.org/netipx v0.0.0-20260823151212-3075585bcbeb
 	golang.org/x/crypto v0.48.0
 	golang.org/x/time v0.6.0
 	modernc.org/sqlite v1.45.0
@@ -42,6 +40,7 @@ require (
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	go.uber.org/dig v1.19.0 // indirect

go.sum

@@ -111,8 +111,6 @@ go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go4.org/netipx v0.0.0-20260823151212-3075585bcbeb h1:XBM4hvfwGAttkkiTIFfeigdfcL1xIfdKXqFdgiHGtDs=
-go4.org/netipx v0.0.0-20260823151212-3075585bcbeb/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=

internal/broker/broker.go

@@ -47,16 +47,6 @@ func (b *Broker) Notify(userID int64) {
 	}
 }
 
-// ListenerCount returns how many channels from Wait are still
-// registered for the user: those that neither Notify nor Remove
-// has taken out.
-func (b *Broker) ListenerCount(userID int64) int {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	return len(b.listeners[userID])
-}
-
 // Remove removes a specific wait channel (for cleanup on timeout).
 func (b *Broker) Remove(
 	userID int64,

internal/broker/broker_test.go

@@ -59,39 +59,6 @@ func TestRemove(t *testing.T) {
 	}
 }
 
-func TestListenerCount(t *testing.T) {
-	t.Parallel()
-
-	brk := broker.New()
-
-	wantCount := func(step string, userID int64, want int) {
-		t.Helper()
-
-		got := brk.ListenerCount(userID)
-		if got != want {
-			t.Errorf("%s: user %d: got %d, want %d",
-				step, userID, got, want)
-		}
-	}
-
-	wantCount("before Wait", 1, 0)
-
-	waitCh := brk.Wait(1)
-	brk.Wait(1)
-	brk.Wait(2)
-
-	wantCount("after two Waits", 1, 2)
-
-	brk.Remove(1, waitCh)
-
-	wantCount("after Remove", 1, 1)
-
-	brk.Notify(1)
-
-	wantCount("after Notify", 1, 0)
-	wantCount("after Notify", 2, 1)
-}
-
 func TestMultipleWaiters(t *testing.T) {
 	t.Parallel()
 

internal/cli/api/client.go

@@ -25,10 +25,7 @@ const (
 	httpErrThreshold = 400
 )
 
-var (
+var errHTTP = errors.New("HTTP error")
-	errHTTP        = errors.New("HTTP error")
-	errJoinRefused = errors.New("the server refused the join")
-)
 
 // Client wraps HTTP calls to the neoirc server API.
 type Client struct {
@@ -209,35 +206,13 @@ func (client *Client) PollMessages(
 	}, nil
 }
 
-// JoinChannel joins a channel. It returns an error unless the
+// JoinChannel joins a channel.
-// server answers that the session joined. When the server
-// refuses the join, it sends the reason to the message queue as
-// an error numeric.
 func (client *Client) JoinChannel(channel string) error {
-	data, err := client.do(
+	return client.SendMessage(
-		http.MethodPost, "/api/v1/messages",
 		&Message{ //nolint:exhaustruct // only command+to needed
 			Command: irc.CmdJoin, To: channel,
 		},
 	)
-	if err != nil {
-		return err
-	}
-
-	var resp struct {
-		Status string `json:"status"`
-	}
-
-	err = json.Unmarshal(data, &resp)
-	if err != nil {
-		return fmt.Errorf("decode join: %w", err)
-	}
-
-	if resp.Status != "joined" {
-		return errJoinRefused
-	}
-
-	return nil
 }
 
 // PartChannel leaves a channel.
@@ -275,7 +250,7 @@ func (client *Client) ListChannels() (
 // GetMembers returns members of a channel.
 func (client *Client) GetMembers(
 	channel string,
-) ([]Member, error) {
+) ([]string, error) {
 	name := strings.TrimPrefix(channel, "#")
 
 	data, err := client.do(
@@ -288,7 +263,7 @@ func (client *Client) GetMembers(
 		return nil, err
 	}
 
-	var members []Member
+	var members []string
 
 	err = json.Unmarshal(data, &members)
 	if err != nil {

internal/cli/api/client_test.go

@@ -2,28 +2,18 @@ package neoircapi_test
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
-	"reflect"
-	"slices"
-	"strconv"
 	"strings"
 	"testing"
 
 	api "sneak.berlin/go/neoirc/internal/cli/api"
-	"sneak.berlin/go/neoirc/internal/hashcash"
 )
 
-const (
+const cookieValue = "opaque-value"
-	cookieValue = "opaque-value"
-	testNick    = "alice"
-	testChannel = "#general"
-)
 
 // newSessionServer starts a plain-HTTP server that, like
 // neoircd, sets a Secure auth cookie when a session is
@@ -34,16 +24,10 @@ func newSessionServer(t *testing.T) *httptest.Server {
 
 	mux := http.NewServeMux()
 
-	// Without hashcash the server sends no hashcash_bits.
 	mux.HandleFunc("GET /api/v1/server", func(
 		writer http.ResponseWriter, _ *http.Request,
 	) {
-		_, _ = io.WriteString(writer, `{
+		_, _ = io.WriteString(writer, `{}`)
-			"name": "My NeoIRC Server",
-			"version": "0.1.0",
-			"motd": "Welcome! Be nice.",
-			"users": 42
-		}`)
 	})
 
 	mux.HandleFunc("POST /api/v1/session", func(
@@ -72,14 +56,9 @@ func newSessionServer(t *testing.T) *httptest.Server {
 			return
 		}
 
-		_, _ = io.WriteString(writer, `{
+		_, _ = io.WriteString(
-			"id": 1,
+			writer, `{"id":1,"nick":"alice","channels":[]}`,
-			"nick": "alice",
+		)
-			"channels": [
-				{"id": 1, "name": "#general", "topic": "Welcome!"},
-				{"id": 2, "name": "#dev", "topic": ""}
-			]
-		}`)
 	})
 
 	server := httptest.NewServer(mux)
@@ -88,344 +67,6 @@ func newSessionServer(t *testing.T) *httptest.Server {
 	return server
 }
 
-// newClientForPath starts a server that answers GET path with
-// body, and returns a client for it.
-func newClientForPath(t *testing.T, path, body string) *api.Client {
-	t.Helper()
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("GET "+path, func(
-		writer http.ResponseWriter, _ *http.Request,
-	) {
-		_, _ = io.WriteString(writer, body)
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	return api.NewClient(server.URL)
-}
-
-func TestGetStateDecodesFields(t *testing.T) {
-	t.Parallel()
-
-	client := api.NewClient(newSessionServer(t).URL)
-
-	_, err := client.CreateSession(testNick)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	state, err := client.GetState()
-	if err != nil {
-		t.Fatalf("state: %v", err)
-	}
-
-	want := api.StateResponse{
-		ID:   1,
-		Nick: testNick,
-		Channels: []api.Channel{
-			{Name: testChannel, Topic: "Welcome!"},
-			{Name: "#dev", Topic: ""},
-		},
-	}
-	if !reflect.DeepEqual(*state, want) {
-		t.Fatalf("state: got %+v, want %+v", *state, want)
-	}
-}
-
-func TestGetServerInfoDecodesFields(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/server", `{
-		"name": "My NeoIRC Server",
-		"version": "0.1.0",
-		"motd": "Welcome! Be nice.",
-		"users": 42,
-		"hashcash_bits": 20
-	}`)
-
-	info, err := client.GetServerInfo()
-	if err != nil {
-		t.Fatalf("server info: %v", err)
-	}
-
-	want := api.ServerInfo{
-		Name:         "My NeoIRC Server",
-		MOTD:         "Welcome! Be nice.",
-		Version:      "0.1.0",
-		HashcashBits: 20,
-	}
-	if *info != want {
-		t.Fatalf("server info: got %+v, want %+v", *info, want)
-	}
-}
-
-// TestCreateSessionSendsNickAndStamp serves a server that, like
-// neoircd with hashcash on, advertises hashcash_bits and creates
-// the session only for a pow_token the server's validator in
-// internal/hashcash accepts.
-func TestCreateSessionSendsNickAndStamp(t *testing.T) {
-	t.Parallel()
-
-	const (
-		serverName = "My NeoIRC Server"
-		stampBits  = 8
-		sessionID  = 7
-	)
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("GET /api/v1/server", func(
-		writer http.ResponseWriter, _ *http.Request,
-	) {
-		_, _ = fmt.Fprintf(writer, `{
-			"name": %q,
-			"version": "0.1.0",
-			"motd": "Welcome! Be nice.",
-			"users": 42,
-			"hashcash_bits": %d
-		}`, serverName, stampBits)
-	})
-
-	validator := hashcash.NewValidator(serverName)
-
-	mux.HandleFunc("POST /api/v1/session", func(
-		writer http.ResponseWriter, request *http.Request,
-	) {
-		// Decoded with the field names handleCreateSession uses.
-		var payload struct {
-			Nick     string `json:"nick"`
-			Hashcash string `json:"pow_token"` //nolint:tagliatelle
-		}
-
-		err := json.NewDecoder(request.Body).Decode(&payload)
-		if err != nil {
-			writer.WriteHeader(http.StatusBadRequest)
-
-			return
-		}
-
-		err = validator.Claim(payload.Hashcash, stampBits)
-		if err != nil {
-			writer.WriteHeader(http.StatusPaymentRequired)
-
-			return
-		}
-
-		writer.WriteHeader(http.StatusCreated)
-
-		_ = json.NewEncoder(writer).Encode(map[string]any{
-			"id":   sessionID,
-			"nick": payload.Nick,
-		})
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	session, err := api.NewClient(server.URL).CreateSession(testNick)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	want := api.SessionResponse{ID: sessionID, Nick: testNick}
-	if *session != want {
-		t.Fatalf("session: got %+v, want %+v", *session, want)
-	}
-}
-
-func TestListChannelsDecodesNamesAndTopics(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/channels", `[
-		{"id": 1, "name": "#general", "topic": "Welcome!"},
-		{"id": 2, "name": "#dev", "topic": "Development discussion"}
-	]`)
-
-	channels, err := client.ListChannels()
-	if err != nil {
-		t.Fatalf("list channels: %v", err)
-	}
-
-	want := []api.Channel{
-		{Name: testChannel, Topic: "Welcome!"},
-		{Name: "#dev", Topic: "Development discussion"},
-	}
-	if !slices.Equal(channels, want) {
-		t.Fatalf("channels: got %+v, want %+v", channels, want)
-	}
-}
-
-func TestGetMembersDecodesMemberObjects(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/channels/general/members", `[
-		{
-			"id": 1, "nick": "alice", "username": "alice",
-			"hostname": "host.example.com",
-			"isOperator": true, "isVoiced": false,
-			"lastSeen": "2026-02-10T20:00:00Z"
-		},
-		{
-			"id": 2, "nick": "bob", "username": "bob",
-			"hostname": "host.example.com",
-			"isOperator": false, "isVoiced": true,
-			"lastSeen": "2026-02-10T20:00:00Z"
-		},
-		{
-			"id": 3, "nick": "Carol", "username": "carol",
-			"hostname": "host.example.com",
-			"isOperator": false, "isVoiced": false,
-			"lastSeen": "2026-02-10T20:00:00Z"
-		}
-	]`)
-
-	members, err := client.GetMembers(testChannel)
-	if err != nil {
-		t.Fatalf("get members: %v", err)
-	}
-
-	want := []api.Member{
-		{Nick: testNick, IsOperator: true, IsVoiced: false},
-		{Nick: "bob", IsOperator: false, IsVoiced: true},
-		{Nick: "Carol", IsOperator: false, IsVoiced: false},
-	}
-	if !slices.Equal(members, want) {
-		t.Fatalf("members: got %+v, want %+v", members, want)
-	}
-}
-
-// TestPollMessagesAdvancesCursor serves the queue as the server
-// does: entries after the cursor, and last_id as the new cursor.
-func TestPollMessagesAdvancesCursor(t *testing.T) {
-	t.Parallel()
-
-	const lastQueueID = 42
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("GET /api/v1/messages", func(
-		writer http.ResponseWriter, request *http.Request,
-	) {
-		after := request.URL.Query().Get("after")
-		if after == strconv.Itoa(lastQueueID) {
-			_, _ = io.WriteString(
-				writer, `{"messages": [], "last_id": 42}`,
-			)
-
-			return
-		}
-
-		_, _ = io.WriteString(writer, `{
-			"messages": [{
-				"id": "b7c8210f-849c-4b90-9ee8-d99c8889358e",
-				"command": "PRIVMSG",
-				"from": "alice",
-				"to": "#general",
-				"body": ["hello world"],
-				"ts": "2026-02-10T20:00:01.234567891Z",
-				"meta": {}
-			}],
-			"last_id": 42
-		}`)
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	client := api.NewClient(server.URL)
-
-	first, err := client.PollMessages(0, 0)
-	if err != nil {
-		t.Fatalf("first poll: %v", err)
-	}
-
-	if first.LastID != lastQueueID || len(first.Messages) != 1 {
-		t.Fatalf(
-			"first poll: got last ID %d and %d messages, "+
-				"want %d and 1",
-			first.LastID, len(first.Messages), lastQueueID,
-		)
-	}
-
-	second, err := client.PollMessages(first.LastID, 0)
-	if err != nil {
-		t.Fatalf("second poll: %v", err)
-	}
-
-	if len(second.Messages) != 0 {
-		t.Fatalf(
-			"second poll: got %d messages again, want none",
-			len(second.Messages),
-		)
-	}
-}
-
-// TestPollMessagesDecodesMessageFields serves a relayed PRIVMSG
-// with the sender's meta and a numeric, as the server queues
-// them.
-func TestPollMessagesDecodesMessageFields(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/messages", `{
-		"messages": [
-			{
-				"id": "b7c8210f-849c-4b90-9ee8-d99c8889358e",
-				"command": "PRIVMSG",
-				"from": "alice",
-				"to": "#general",
-				"body": ["signed message"],
-				"ts": "2026-02-10T20:00:01.234567891Z",
-				"meta": {"sig": "base64...", "alg": "ed25519"}
-			},
-			{
-				"id": "7f5a04f8-eab4-4d2e-be55-f5cfcfaf43c5",
-				"command": "RPL_LUSEROP",
-				"code": 252,
-				"from": "neoirc",
-				"to": "alice",
-				"params": ["0"],
-				"body": ["operator(s) online"],
-				"ts": "2026-02-10T20:00:02Z",
-				"meta": {}
-			}
-		],
-		"last_id": 42
-	}`)
-
-	result, err := client.PollMessages(0, 0)
-	if err != nil {
-		t.Fatalf("poll: %v", err)
-	}
-
-	want := []api.Message{
-		{
-			ID:      "b7c8210f-849c-4b90-9ee8-d99c8889358e",
-			Command: "PRIVMSG",
-			From:    testNick,
-			To:      testChannel,
-			Body:    []any{"signed message"},
-			TS:      "2026-02-10T20:00:01.234567891Z",
-			Meta:    map[string]any{"sig": "base64...", "alg": "ed25519"},
-		},
-		{
-			ID:      "7f5a04f8-eab4-4d2e-be55-f5cfcfaf43c5",
-			Command: "RPL_LUSEROP",
-			From:    "neoirc",
-			To:      testNick,
-			Params:  []string{"0"},
-			Body:    []any{"operator(s) online"},
-			TS:      "2026-02-10T20:00:02Z",
-			Meta:    map[string]any{},
-		},
-	}
-	if !reflect.DeepEqual(result.Messages, want) {
-		t.Fatalf("messages: got %+v, want %+v", result.Messages, want)
-	}
-}
-
 func TestClientKeepsSessionOverPlainHTTPOnLocalhost(t *testing.T) {
 	t.Parallel()
 
@@ -444,7 +85,7 @@ func TestClientKeepsSessionOverPlainHTTPOnLocalhost(t *testing.T) {
 				"http://" + net.JoinHostPort(host, serverURL.Port()),
 			)
 
-			_, err := client.CreateSession(testNick)
+			_, err := client.CreateSession("alice")
 			if err != nil {
 				t.Fatalf("create session: %v", err)
 			}
@@ -477,7 +118,7 @@ func TestClientWithholdsCookieOverPlainHTTPFromOtherHosts(t *testing.T) {
 		},
 	}
 
-	_, err := client.CreateSession(testNick)
+	_, err := client.CreateSession("alice")
 	if err != nil {
 		t.Fatalf("create session: %v", err)
 	}

internal/cli/api/types.go

@@ -18,7 +18,7 @@ type SessionResponse struct {
 type StateResponse struct {
 	ID       int64    `json:"id"`
 	Nick     string   `json:"nick"`
-	Channels []Channel `json:"channels"`
+	Channels []string `json:"channels"`
 }
 
 // Message represents a neoirc message envelope.
@@ -53,19 +53,12 @@ func (m *Message) BodyLines() []string {
 	}
 }
 
-// Channel is a channel as GET /api/v1/channels and
+// Channel represents a channel in the list response.
-// GET /api/v1/state describe it.
 type Channel struct {
 	Name      string `json:"name"`
 	Topic     string `json:"topic"`
-}
+	Members   int    `json:"members"`
-
+	CreatedAt string `json:"createdAt"`
-// Member is one entry of the response from
-// GET /api/v1/channels/{name}/members.
-type Member struct {
-	Nick       string `json:"nick"`
-	IsOperator bool   `json:"isOperator"`
-	IsVoiced   bool   `json:"isVoiced"`
 }
 
 // ServerInfo is the response from GET /api/v1/server.
@@ -79,7 +72,7 @@ type ServerInfo struct {
 // MessagesResponse wraps polling results.
 type MessagesResponse struct {
 	Messages []Message `json:"messages"`
-	LastID   int64     `json:"last_id"` //nolint:tagliatelle
+	LastID   int64     `json:"lastId"`
 }
 
 // PollResult wraps the poll response including the cursor.

internal/cli/app.go

@@ -34,30 +34,13 @@ type App struct {
 
 // Run creates and runs the CLI application.
 func Run() {
-	err := run(NewUI())
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-// run starts the client on ui and returns when ui stops. Tests
-// call it with ui on a simulation screen.
-func run(ui *UI) error {
 	app := &App{ //nolint:exhaustruct
-		ui:   ui,
+		ui:   NewUI(),
 		nick: "guest",
 	}
 
 	app.ui.OnInput(app.handleInput)
-
+	app.ui.SetStatus(app.nick, "", "disconnected")
-	// SetStatus and AddStatus wait for the event loop, which
-	// app.ui.Run starts below, so they run on a goroutine. The
-	// nick is read first, as a typed /nick may change app.nick.
-	nick := app.nick
-
-	go func() {
-		app.ui.SetStatus(nick, "", "disconnected")
 
 	app.ui.AddStatus(
 		"Welcome to neoirc-cli — an IRC-style client",
@@ -67,9 +50,12 @@ func run(ui *UI) error {
 			"[white] to begin, " +
 			"or [yellow]/help[white] for commands",
 	)
-	}()
 
-	return app.ui.Run()
+	err := app.ui.Run()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
 }
 
 func (a *App) handleInput(text string) {
@@ -108,9 +94,22 @@ func (a *App) handleInput(text string) {
 	})
 	if err != nil {
 		a.ui.AddStatus(
-			"[red]Send error: " + escape(err.Error()),
+			"[red]Send error: " + err.Error(),
 		)
+
+		return
 	}
+
+	timestamp := time.Now().Format(timeFormat)
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, nick, text,
+	))
 }
 
 func (a *App) handleCommand(text string) {
@@ -166,7 +165,7 @@ func (a *App) dispatchInfoCommand(cmd, args string) {
 		a.cmdWhois(args)
 	default:
 		a.ui.AddStatus(
-			"[red]Unknown command: " + escape(cmd),
+			"[red]Unknown command: " + cmd,
 		)
 	}
 }
@@ -182,7 +181,7 @@ func (a *App) cmdConnect(serverURL string) {
 
 	serverURL = strings.TrimRight(serverURL, "/")
 
-	a.ui.AddStatus("Connecting to " + escape(serverURL) + "...")
+	a.ui.AddStatus("Connecting to " + serverURL + "...")
 
 	a.mu.Lock()
 	nick := a.nick
@@ -192,37 +191,29 @@ func (a *App) cmdConnect(serverURL string) {
 
 	resp, err := client.CreateSession(nick)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Connection failed: " + escape(err.Error()),
+			"[red]Connection failed: %v", err,
-		)
+		))
 
 		return
 	}
 
-	// The poll loop of an earlier connection is stopped in the same
-	// step that replaces the client, so it never polls with the new
-	// one.
 	a.mu.Lock()
 	a.client = client
 	a.nick = resp.Nick
 	a.connected = true
 	a.lastQID = 0
-
-	if a.stopPoll != nil {
-		close(a.stopPoll)
-	}
-
-	stop := make(chan struct{})
-	a.stopPoll = stop
 	a.mu.Unlock()
 
 	a.ui.AddStatus(fmt.Sprintf(
 		"[green]Connected! Nick: %s, Session: %d",
-		escape(resp.Nick), resp.ID,
+		resp.Nick, resp.ID,
 	))
 	a.ui.SetStatus(resp.Nick, "", "connected")
 
-	go a.pollLoop(stop)
+	a.stopPoll = make(chan struct{})
+
+	go a.pollLoop()
 }
 
 func (a *App) cmdNick(nick string) {
@@ -244,7 +235,7 @@ func (a *App) cmdNick(nick string) {
 		a.mu.Unlock()
 
 		a.ui.AddStatus(
-			"Nick set to " + escape(nick) +
+			"Nick set to " + nick +
 				" (will be used on connect)",
 		)
 
@@ -256,9 +247,9 @@ func (a *App) cmdNick(nick string) {
 		Body:    []string{nick},
 	})
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Nick change failed: " + escape(err.Error()),
+			"[red]Nick change failed: %v", err,
-		)
+		))
 
 		return
 	}
@@ -269,7 +260,7 @@ func (a *App) cmdNick(nick string) {
 	a.mu.Unlock()
 
 	a.ui.SetStatus(nick, target, "connected")
-	a.ui.AddStatus("Nick changed to " + escape(nick))
+	a.ui.AddStatus("Nick changed to " + nick)
 }
 
 func (a *App) cmdJoin(channel string) {
@@ -297,9 +288,9 @@ func (a *App) cmdJoin(channel string) {
 
 	err := a.client.JoinChannel(channel)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Join failed: " + escape(err.Error()),
+			"[red]Join failed: %v", err,
-		)
+		))
 
 		return
 	}
@@ -310,6 +301,9 @@ func (a *App) cmdJoin(channel string) {
 	a.mu.Unlock()
 
 	a.ui.SwitchToBuffer(channel)
+	a.ui.AddLine(channel,
+		"[yellow]*** Joined "+channel,
+	)
 	a.ui.SetStatus(nick, channel, "connected")
 }
 
@@ -337,13 +331,17 @@ func (a *App) cmdPart(channel string) {
 
 	err := a.client.PartChannel(channel)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Part failed: " + escape(err.Error()),
+			"[red]Part failed: %v", err,
-		)
+		))
 
 		return
 	}
 
+	a.ui.AddLine(channel,
+		"[yellow]*** Left "+channel,
+	)
+
 	a.mu.Lock()
 	if a.target == channel {
 		a.target = ""
@@ -370,6 +368,7 @@ func (a *App) cmdMsg(args string) {
 
 	a.mu.Lock()
 	connected := a.connected
+	nick := a.nick
 	a.mu.Unlock()
 
 	if !connected {
@@ -384,10 +383,19 @@ func (a *App) cmdMsg(args string) {
 		Body:    []string{text},
 	})
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Send failed: " + escape(err.Error()),
+			"[red]Send failed: %v", err,
-		)
+		))
+
+		return
 	}
+
+	timestamp := time.Now().Format(timeFormat)
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, nick, text,
+	))
 }
 
 func (a *App) cmdQuery(nick string) {
@@ -402,16 +410,10 @@ func (a *App) cmdQuery(nick string) {
 	a.mu.Lock()
 	a.target = nick
 	myNick := a.nick
-	connected := a.connected
 	a.mu.Unlock()
 
-	connStatus := "disconnected"
-	if connected {
-		connStatus = "connected"
-	}
-
 	a.ui.SwitchToBuffer(nick)
-	a.ui.SetStatus(myNick, nick, connStatus)
+	a.ui.SetStatus(myNick, nick, "connected")
 }
 
 func (a *App) cmdTopic(args string) {
@@ -432,9 +434,16 @@ func (a *App) cmdTopic(args string) {
 		return
 	}
 
-	// The HTTP API has no topic query: a TOPIC needs text.
 	if args == "" {
-		a.ui.AddStatus("[red]Usage: /topic <text>")
+		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdTopic,
+			To:      target,
+		})
+		if err != nil {
+			a.ui.AddStatus(fmt.Sprintf(
+				"[red]Topic query failed: %v", err,
+			))
+		}
 
 		return
 	}
@@ -445,9 +454,9 @@ func (a *App) cmdTopic(args string) {
 		Body:    []string{args},
 	})
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Topic set failed: " + escape(err.Error()),
+			"[red]Topic set failed: %v", err,
-		)
+		))
 	}
 }
 
@@ -471,39 +480,19 @@ func (a *App) cmdNames() {
 
 	members, err := a.client.GetMembers(target)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Names failed: " + escape(err.Error()),
+			"[red]Names failed: %v", err,
-		)
+		))
 
 		return
 	}
 
-	nicks := make([]string, 0, len(members))
-
-	for _, member := range members {
-		nicks = append(nicks, memberPrefix(member)+member.Nick)
-	}
-
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[cyan]*** Members of %s: %s",
-		escape(target), escape(strings.Join(nicks, " ")),
+		target, strings.Join(members, " "),
 	))
 }
 
-// memberPrefix returns "@" for an operator, "+" for a voiced
-// member, and "" for anyone else.
-func memberPrefix(member api.Member) string {
-	if member.IsOperator {
-		return "@"
-	}
-
-	if member.IsVoiced {
-		return "+"
-	}
-
-	return ""
-}
-
 func (a *App) cmdList() {
 	a.mu.Lock()
 	connected := a.connected
@@ -517,9 +506,9 @@ func (a *App) cmdList() {
 
 	channels, err := a.client.ListChannels()
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]List failed: " + escape(err.Error()),
+			"[red]List failed: %v", err,
-		)
+		))
 
 		return
 	}
@@ -528,7 +517,8 @@ func (a *App) cmdList() {
 
 	for _, ch := range channels {
 		a.ui.AddStatus(fmt.Sprintf(
-			"  %s %s", escape(ch.Name), escape(ch.Topic),
+			"  %s (%d members) %s",
+			ch.Name, ch.Members, ch.Topic,
 		))
 	}
 
@@ -550,9 +540,9 @@ func (a *App) cmdMotd() {
 		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
 	)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]MOTD failed: " + escape(err.Error()),
+			"[red]MOTD failed: %v", err,
-		)
+		))
 	}
 }
 
@@ -588,9 +578,9 @@ func (a *App) cmdWho(args string) {
 		},
 	)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]WHO failed: " + escape(err.Error()),
+			"[red]WHO failed: %v", err,
-		)
+		))
 	}
 }
 
@@ -619,9 +609,9 @@ func (a *App) cmdWhois(args string) {
 		},
 	)
 	if err != nil {
-		a.ui.AddStatus(
+		a.ui.AddStatus(fmt.Sprintf(
-			"[red]WHOIS failed: " + escape(err.Error()),
+			"[red]WHOIS failed: %v", err,
-		)
+		))
 	}
 }
 
@@ -638,37 +628,24 @@ func (a *App) cmdWindow(args string) {
 
 	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
 
-	a.mu.Lock()
-	nick := a.nick
-	connected := a.connected
-	a.mu.Unlock()
-
-	connStatus := "disconnected"
-	if connected {
-		connStatus = "connected"
-	}
-
-	// Read the name before switching. A message from the server can
-	// add a buffer at any time, but only at the end, so bufIndex
-	// still names this buffer when SwitchBuffer runs.
-	name, found := a.ui.BufferName(bufIndex)
-	if found {
 	a.ui.SwitchBuffer(bufIndex)
 
-		if name != "(status)" {
 	a.mu.Lock()
-			a.target = name
+	nick := a.nick
+	a.mu.Unlock()
+
+	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
+		buf := a.ui.buffers[bufIndex]
+		if buf.Name != "(status)" {
+			a.mu.Lock()
+			a.target = buf.Name
 			a.mu.Unlock()
 
 			a.ui.SetStatus(
-				nick, name, connStatus,
+				nick, buf.Name, "connected",
 			)
 		} else {
-			a.mu.Lock()
+			a.ui.SetStatus(nick, "", "connected")
-			a.target = ""
-			a.mu.Unlock()
-
-			a.ui.SetStatus(nick, "", connStatus)
 		}
 	}
 }
@@ -699,7 +676,7 @@ func (a *App) cmdHelp() {
 		"  /part [#chan]    — Leave channel",
 		"  /msg <nick> <text> — Send DM",
 		"  /query <nick>   — Open DM window",
-		"  /topic <text>   — Set topic",
+		"  /topic [text]   — View/set topic",
 		"  /names          — List channel members",
 		"  /list           — List channels",
 		"  /who [#channel] — List users in channel",
@@ -716,23 +693,16 @@ func (a *App) cmdHelp() {
 	}
 }
 
-// pollLoop long-polls for messages in the background until stop is
+// pollLoop long-polls for messages in the background.
-// closed. A later /connect closes stop under a.mu as it replaces the
+func (a *App) pollLoop() {
-// client and the cursor, so the loop checks stop under a.mu too. A
-// stopped loop then neither polls with the new client nor moves the
-// new cursor.
-func (a *App) pollLoop(stop <-chan struct{}) {
 	for {
-		a.mu.Lock()
-
 		select {
-		case <-stop:
+		case <-a.stopPoll:
-			a.mu.Unlock()
-
 			return
 		default:
 		}
 
+		a.mu.Lock()
 		client := a.client
 		lastQID := a.lastQID
 		a.mu.Unlock()
@@ -750,23 +720,11 @@ func (a *App) pollLoop(stop <-chan struct{}) {
 			continue
 		}
 
-		// A poll sent before stop was closed answers for the earlier
-		// connection.
-		a.mu.Lock()
-
-		select {
-		case <-stop:
-			a.mu.Unlock()
-
-			return
-		default:
-		}
-
 		if result.LastID > 0 {
+			a.mu.Lock()
 			a.lastQID = result.LastID
-		}
-
 			a.mu.Unlock()
+		}
 
 		for i := range result.Messages {
 			a.handleServerMessage(&result.Messages[i])
@@ -787,7 +745,7 @@ func (a *App) handleServerMessage(msg *api.Message) {
 	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
 	case irc.CmdPart:
-		a.handlePartEvent(msg, timestamp, myNick)
+		a.handlePartEvent(msg, timestamp)
 	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
 	case irc.CmdNick:
@@ -815,16 +773,18 @@ func (a *App) handlePrivmsgEvent(
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 
-	// A direct message shows in the buffer of the other user:
+	if msg.From == myNick {
-	// the recipient of one the user sent, else the sender.
+		return
+	}
+
 	target := msg.To
-	if !strings.HasPrefix(target, "#") && msg.From != myNick {
+	if !strings.HasPrefix(target, "#") {
 		target = msg.From
 	}
 
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
-		timestamp, escape(msg.From), escape(text),
+		timestamp, msg.From, text,
 	))
 }
 
@@ -837,15 +797,12 @@ func (a *App) handleJoinEvent(
 
 	a.ui.AddLine(msg.To, fmt.Sprintf(
 		"[gray]%s [yellow]*** %s has joined %s",
-		timestamp, escape(msg.From), escape(msg.To),
+		timestamp, msg.From, msg.To,
 	))
 }
 
-// handlePartEvent shows a part in the channel's buffer. The
-// user's own part does not mark the channel unread: the user
-// has just left it.
 func (a *App) handlePartEvent(
-	msg *api.Message, timestamp, myNick string,
+	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
@@ -854,22 +811,17 @@ func (a *App) handlePartEvent(
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 
-	line := fmt.Sprintf(
-		"[gray]%s [yellow]*** %s has left %s",
-		timestamp, escape(msg.From), escape(msg.To),
-	)
-
 	if reason != "" {
-		line += " (" + escape(reason) + ")"
+		a.ui.AddLine(msg.To, fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has left %s (%s)",
+			timestamp, msg.From, msg.To, reason,
+		))
+	} else {
+		a.ui.AddLine(msg.To, fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has left %s",
+			timestamp, msg.From, msg.To,
+		))
 	}
-
-	if msg.From == myNick {
-		a.ui.AddLineAsRead(msg.To, line)
-
-		return
-	}
-
-	a.ui.AddLine(msg.To, line)
 }
 
 func (a *App) handleQuitEvent(
@@ -881,12 +833,12 @@ func (a *App) handleQuitEvent(
 	if reason != "" {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has quit (%s)",
-			timestamp, escape(msg.From), escape(reason),
+			timestamp, msg.From, reason,
 		))
 	} else {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has quit",
-			timestamp, escape(msg.From),
+			timestamp, msg.From,
 		))
 	}
 }
@@ -913,7 +865,7 @@ func (a *App) handleNickEvent(
 
 	a.ui.AddStatus(fmt.Sprintf(
 		"[gray]%s [yellow]*** %s is now known as %s",
-		timestamp, escape(msg.From), escape(newNick),
+		timestamp, msg.From, newNick,
 	))
 }
 
@@ -925,7 +877,7 @@ func (a *App) handleNoticeEvent(
 
 	a.ui.AddStatus(fmt.Sprintf(
 		"[gray]%s [magenta]--%s-- %s",
-		timestamp, escape(msg.From), escape(text),
+		timestamp, msg.From, text,
 	))
 }
 
@@ -941,7 +893,7 @@ func (a *App) handleTopicEvent(
 
 	a.ui.AddLine(msg.To, fmt.Sprintf(
 		"[gray]%s [cyan]*** %s set topic: %s",
-		timestamp, escape(msg.From), escape(text),
+		timestamp, msg.From, text,
 	))
 }
 
@@ -951,12 +903,10 @@ func (a *App) handleDefaultEvent(
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 
-	// The brackets around the command are escaped with it, as tview
-	// reads a command such as "[MODE]" as a tag.
 	if text != "" {
 		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [white]%s %s",
+			"[gray]%s [white][%s] %s",
-			timestamp, escape("["+msg.Command+"]"), escape(text),
+			timestamp, msg.Command, text,
 		))
 	}
 }

internal/cli/ui.go

@@ -16,10 +16,7 @@ type Buffer struct {
 	Unread int
 }
 
-// UI manages the terminal interface. Most of its methods wait for
+// UI manages the terminal interface.
-// the tview event loop to run their update. Code that runs on that
-// loop, such as a key handler, must not call them: it would wait
-// for itself.
 type UI struct {
 	app       *tview.Application
 	messages  *tview.TextView
@@ -30,17 +27,7 @@ type UI struct {
 	buffers       []*Buffer
 	currentBuffer int
 
-	// The nick, target and connection state last passed to
-	// SetStatus.
-	nick       string
-	target     string
-	connStatus string
-
 	onInput func(string)
-	// inputDone is closed once the line last passed to onInput
-	// has been handled. Only callOnInput, on the event loop, uses
-	// it.
-	inputDone chan struct{}
 }
 
 // NewUI creates the tview-based IRC-like UI.
@@ -108,19 +95,6 @@ func (ui *UI) AddLine(bufferName, line string) {
 	})
 }
 
-// AddLineAsRead adds a line to the specified buffer, as
-// AddLine does, but does not mark the buffer unread.
-func (ui *UI) AddLineAsRead(bufferName, line string) {
-	ui.app.QueueUpdateDraw(func() {
-		buf := ui.getOrCreateBuffer(bufferName)
-		buf.Lines = append(buf.Lines, line)
-
-		if ui.buffers[ui.currentBuffer] == buf {
-			_, _ = fmt.Fprintln(ui.messages, line)
-		}
-	})
-}
-
 // AddStatus adds a line to the status buffer.
 func (ui *UI) AddStatus(line string) {
 	ts := time.Now().Format("15:04")
@@ -185,32 +159,13 @@ func (ui *UI) SetStatus(
 	nick, target, connStatus string,
 ) {
 	ui.app.QueueUpdateDraw(func() {
-		ui.nick = nick
+		ui.renderStatusBar(nick, target, connStatus)
-		ui.target = target
-		ui.connStatus = connStatus
-
-		ui.refreshStatusBar()
 	})
 }
 
-// BufferName returns the name of the buffer at index bufIndex,
+// BufferCount returns the number of buffers.
-// and whether there is such a buffer.
+func (ui *UI) BufferCount() int {
-func (ui *UI) BufferName(bufIndex int) (string, bool) {
+	return len(ui.buffers)
-	var (
-		name  string
-		found bool
-	)
-
-	ui.app.QueueUpdate(func() {
-		if bufIndex < 0 || bufIndex >= len(ui.buffers) {
-			return
-		}
-
-		name = ui.buffers[bufIndex].Name
-		found = true
-	})
-
-	return name, found
 }
 
 // BufferIndex returns the index of a named buffer.
@@ -235,21 +190,9 @@ func (ui *UI) initMessages() {
 	ui.messages.SetBorder(false)
 }
 
-// escape returns text so that the message window shows it exactly
-// as written. It writes each "[" as "[[:]": a "[" followed by
-// another "[" never starts a tag, and the tag "[:]" changes
-// nothing. tview.Escape is not enough: it does not escape a bracket
-// pair holding a symbol such as "|" or "^", and nothing it adds
-// stops a tag with a URL, such as "[:::y|z]".
-func escape(text string) string {
-	return strings.ReplaceAll(text, "[", "[[:]")
-}
-
 func (ui *UI) initStatusBar() {
-	// Colour tags stay off. With them on, tview reads text in
+	ui.statusBar = tview.NewTextView().
-	// square brackets, such as "[connected]" or part of a nick,
+		SetDynamicColors(true)
-	// as a tag and drops it.
-	ui.statusBar = tview.NewTextView()
 	ui.statusBar.SetBackgroundColor(tcell.ColorNavy)
 	ui.statusBar.SetTextColor(tcell.ColorWhite)
 }
@@ -270,7 +213,10 @@ func (ui *UI) initInput() {
 		}
 
 		ui.input.SetText("")
-		ui.callOnInput(text)
+
+		if ui.onInput != nil {
+			ui.onInput(text)
+		}
 	})
 }
 
@@ -281,11 +227,10 @@ func (ui *UI) initKeyCapture() {
 				return event
 			}
 
-			// Alt and a digit runs /window with that digit.
-			// SwitchBuffer alone would leave the target as it was.
 			r := event.Rune()
 			if r >= '0' && r <= '9' {
-				ui.callOnInput("/window " + string(r))
+				idx := int(r - '0')
+				ui.SwitchBuffer(idx)
 
 				return nil
 			}
@@ -295,35 +240,8 @@ func (ui *UI) initKeyCapture() {
 	)
 }
 
-// callOnInput passes text to the input callback on a new
-// goroutine. The key handlers call it on the event loop, and the
-// callback waits for that loop to update the screen, so they must
-// not wait for the callback. The goroutine first waits for the
-// line before it to be handled, which keeps lines in the order
-// they were typed.
-func (ui *UI) callOnInput(text string) {
-	if ui.onInput == nil {
-		return
-	}
-
-	previous := ui.inputDone
-	done := make(chan struct{})
-	ui.inputDone = done
-
-	go func() {
-		if previous != nil {
-			<-previous
-		}
-
-		ui.onInput(text)
-		close(done)
-	}()
-}
-
-// refreshStatusBar redraws the status bar with the nick, target
-// and connection state last passed to SetStatus.
 func (ui *UI) refreshStatusBar() {
-	ui.renderStatusBar(ui.nick, ui.target, ui.connStatus)
+	// Placeholder; full refresh needs nick/target context.
 }
 
 func (ui *UI) renderStatusBar(

internal/config/config.go

@@ -3,19 +3,11 @@ package config
 
 import (
 	"errors"
-	"fmt"
 	"log/slog"
-	"math"
-	"net/netip"
 	"os"
-	"strconv"
-	"strings"
-	"time"
 
-	"github.com/spf13/cast"
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
-	"go4.org/netipx"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
 
@@ -36,16 +28,6 @@ Type /help for available commands.`
 const DefaultDBURL = "file:///var/lib/neoirc/state.db" +
 	"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)"
 
-// DefaultTrustedProxies is TRUSTED_PROXIES when it is not set: the
-// private address ranges of RFC 1918.
-const DefaultTrustedProxies = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
-
-var errOutOfRange = errors.New("setting out of range")
-
-var errNeverMatches = errors.New("entry can never match a connection")
-
-var errListOrMap = errors.New("a list or a map")
-
 // Params defines the dependencies for creating a Config.
 type Params struct {
 	fx.In
@@ -76,15 +58,11 @@ type Config struct {
 	LoginRateLimit     float64
 	LoginRateBurst     int
 	IRCListenAddr      string
-	TrustedProxies     *netipx.IPSet
 	params             *Params
 	log                *slog.Logger
 }
 
 // New creates a new Config by reading from files and environment variables.
-// It returns an error when the config file does not parse, when the file
-// gives a setting a list or a map, and when a number, true/false,
-// duration or address setting does not parse or is out of range.
 func New(
 	_ fx.Lifecycle, params Params,
 ) (*Config, error) {
@@ -117,25 +95,46 @@ func New(
 	viper.SetDefault("LOGIN_RATE_LIMIT", "1")
 	viper.SetDefault("LOGIN_RATE_BURST", "5")
 	viper.SetDefault("IRC_LISTEN_ADDR", ":6667")
-	viper.SetDefault("TRUSTED_PROXIES", DefaultTrustedProxies)
 
 	err := viper.ReadInConfig()
 	if err != nil {
 		var notFound viper.ConfigFileNotFoundError
 		if !errors.As(err, &notFound) {
-			return nil, fmt.Errorf("cannot read %s: %w",
+			log.Error("config file malformed", "error", err)
-				viper.ConfigFileUsed(), err)
+			panic(err)
 		}
 	}
 
 	cfg := &Config{
+		DBURL:              viper.GetString("DBURL"),
+		Debug:              viper.GetBool("DEBUG"),
+		Port:               viper.GetInt("PORT"),
+		SentryDSN:          viper.GetString("SENTRY_DSN"),
+		MaintenanceMode:    viper.GetBool("MAINTENANCE_MODE"),
+		MetricsUsername:    viper.GetString("METRICS_USERNAME"),
+		MetricsPassword:    viper.GetString("METRICS_PASSWORD"),
+		MessageMaxAge:      viper.GetString("MESSAGE_MAX_AGE"),
+		MaxMessageSize:     viper.GetInt("MAX_MESSAGE_SIZE"),
+		QueueMaxAge:        viper.GetString("QUEUE_MAX_AGE"),
+		MOTD:               viper.GetString("MOTD"),
+		ServerName:         viper.GetString("SERVER_NAME"),
+		FederationKey:      viper.GetString("FEDERATION_KEY"),
+		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
+		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
+		OperName:           viper.GetString("NEOIRC_OPER_NAME"),
+		OperPassword:       viper.GetString("NEOIRC_OPER_PASSWORD"),
+		LoginRateLimit:     viper.GetFloat64("LOGIN_RATE_LIMIT"),
+		LoginRateBurst:     viper.GetInt("LOGIN_RATE_BURST"),
+		IRCListenAddr:      viper.GetString("IRC_LISTEN_ADDR"),
 		log:                log,
 		params:             &params,
 	}
 
-	err = parseSettings(cfg)
+	// Viper counts an empty environment variable as unset, but an
-	if err != nil {
+	// empty IRC_LISTEN_ADDR must turn the IRC listener off.
-		return nil, err
+	ircListenAddr, set := os.LookupEnv("IRC_LISTEN_ADDR")
+	if set {
+		cfg.IRCListenAddr = ircListenAddr
 	}
 
 	if cfg.Debug {
@@ -145,239 +144,3 @@ func New(
 
 	return cfg, nil
 }
-
-// parseSettings reads every setting into cfg. Each number and duration
-// must be above zero. PORT and NEOIRC_HASHCASH_BITS may also be zero:
-// port 0 lets the system pick a port, and 0 bits turns proof of work off.
-// The error names each setting that is a list or a map, does not parse or
-// is out of range.
-func parseSettings(cfg *Config) error {
-	return errors.Join(
-		parseString("DBURL", &cfg.DBURL),
-		parseString("SENTRY_DSN", &cfg.SentryDSN),
-		parseString("METRICS_USERNAME", &cfg.MetricsUsername),
-		parseString("METRICS_PASSWORD", &cfg.MetricsPassword),
-		parseString("MOTD", &cfg.MOTD),
-		parseString("SERVER_NAME", &cfg.ServerName),
-		parseString("FEDERATION_KEY", &cfg.FederationKey),
-		parseString("NEOIRC_OPER_NAME", &cfg.OperName),
-		parseString("NEOIRC_OPER_PASSWORD", &cfg.OperPassword),
-		// The empty string turns the IRC listener off.
-		parseStringAllowEmptyEnv("IRC_LISTEN_ADDR", &cfg.IRCListenAddr),
-		parseInt("PORT", 0, &cfg.Port),
-		parseInt("MAX_MESSAGE_SIZE", 1, &cfg.MaxMessageSize),
-		parseInt("NEOIRC_HASHCASH_BITS", 0, &cfg.HashcashBits),
-		parseInt("LOGIN_RATE_BURST", 1, &cfg.LoginRateBurst),
-		parseFloat("LOGIN_RATE_LIMIT", &cfg.LoginRateLimit),
-		parseBool("DEBUG", &cfg.Debug),
-		parseBool("MAINTENANCE_MODE", &cfg.MaintenanceMode),
-		parseDuration("MESSAGE_MAX_AGE", &cfg.MessageMaxAge),
-		parseDuration("QUEUE_MAX_AGE", &cfg.QueueMaxAge),
-		parseDuration("SESSION_IDLE_TIMEOUT", &cfg.SessionIdleTimeout),
-		parseTrustedProxies(&cfg.TrustedProxies),
-	)
-}
-
-// getString returns the setting key as a string. A number or a true/false
-// value in the config file becomes its text, as with viper.GetString. A
-// list or a map in the config file is an error, where viper.GetString
-// would return the empty string. The error leaves out the value, which
-// may be a password.
-func getString(key string) (string, error) {
-	raw, err := cast.ToStringE(viper.Get(key))
-	if err != nil {
-		return "", fmt.Errorf("%s is %w", key, errListOrMap)
-	}
-
-	return raw, nil
-}
-
-// parseString sets *value to the setting key.
-func parseString(key string, value *string) error {
-	raw, err := getString(key)
-	if err != nil {
-		return err
-	}
-
-	*value = raw
-
-	return nil
-}
-
-// parseStringAllowEmptyEnv sets *value to the setting key, as parseString
-// does, but an environment variable set to the empty string counts as
-// set. Viper counts such a variable as unset and uses the config file or
-// the default instead.
-func parseStringAllowEmptyEnv(key string, value *string) error {
-	fromEnv, set := os.LookupEnv(key)
-	if set {
-		*value = fromEnv
-
-		return nil
-	}
-
-	return parseString(key, value)
-}
-
-// parseTrustedProxies sets *value to the addresses in TRUSTED_PROXIES.
-func parseTrustedProxies(value **netipx.IPSet) error {
-	var raw string
-
-	err := parseStringAllowEmptyEnv("TRUSTED_PROXIES", &raw)
-	if err != nil {
-		return err
-	}
-
-	ipSet, err := ParseTrustedProxies(raw)
-	if err != nil {
-		return fmt.Errorf("cannot parse TRUSTED_PROXIES: %w", err)
-	}
-
-	*value = ipSet
-
-	return nil
-}
-
-// ParseTrustedProxies returns the addresses in list, which has the form
-// of TRUSTED_PROXIES: a comma-separated list of networks such as
-// 10.0.0.0/8 and single addresses such as 192.0.2.1. The empty string
-// trusts nothing.
-func ParseTrustedProxies(list string) (*netipx.IPSet, error) {
-	var builder netipx.IPSetBuilder
-
-	if strings.TrimSpace(list) != "" {
-		for entry := range strings.SplitSeq(list, ",") {
-			err := addTrustedProxy(&builder, strings.TrimSpace(entry))
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	return builder.IPSet()
-}
-
-// addTrustedProxy adds entry, a network with a slash or a single
-// address, to builder. An IPv4 address written in IPv6 form, such as
-// ::ffff:192.0.2.1, is added as IPv4. A network in that form and an
-// address with a zone are errors, since no connection could match them.
-func addTrustedProxy(builder *netipx.IPSetBuilder, entry string) error {
-	if strings.Contains(entry, "/") {
-		prefix, err := netip.ParsePrefix(entry)
-		if err != nil {
-			return err //nolint:wrapcheck // the caller names the setting
-		}
-
-		// A connection from an IPv4 address is checked in IPv4 form.
-		if prefix.Addr().Is4In6() {
-			return fmt.Errorf("%w: %s is an IPv4 network in IPv6 form",
-				errNeverMatches, entry)
-		}
-
-		builder.AddPrefix(prefix)
-
-		return nil
-	}
-
-	addr, err := netip.ParseAddr(entry)
-	if err != nil {
-		return err //nolint:wrapcheck // the caller names the setting
-	}
-
-	// IPSet.Contains is false for every address with a zone.
-	if addr.Zone() != "" {
-		return fmt.Errorf("%w: %s has a zone", errNeverMatches, entry)
-	}
-
-	builder.Add(addr.Unmap())
-
-	return nil
-}
-
-// parseInt sets *value to the setting key read as a whole number. It
-// returns an error when the value does not parse or is below minimum.
-func parseInt(key string, minimum int, value *int) error {
-	raw, err := getString(key)
-	if err != nil {
-		return err
-	}
-
-	parsed, err := strconv.Atoi(raw)
-	if err != nil {
-		return fmt.Errorf("cannot parse %s: %w", key, err)
-	}
-
-	if parsed < minimum {
-		return fmt.Errorf("%w: %s is %s, but must be at least %d",
-			errOutOfRange, key, raw, minimum)
-	}
-
-	*value = parsed
-
-	return nil
-}
-
-// parseFloat sets *value to the setting key read as a floating-point
-// number. It returns an error when the value does not parse or is not a
-// finite number above zero.
-func parseFloat(key string, value *float64) error {
-	raw, err := getString(key)
-	if err != nil {
-		return err
-	}
-
-	parsed, err := strconv.ParseFloat(raw, 64)
-	if err != nil {
-		return fmt.Errorf("cannot parse %s: %w", key, err)
-	}
-
-	if math.IsNaN(parsed) || math.IsInf(parsed, 0) || parsed <= 0 {
-		return fmt.Errorf(
-			"%w: %s is %s, but must be a finite number above zero",
-			errOutOfRange, key, raw)
-	}
-
-	*value = parsed
-
-	return nil
-}
-
-// parseBool sets *value to the setting key read as true or false.
-func parseBool(key string, value *bool) error {
-	raw, err := getString(key)
-	if err != nil {
-		return err
-	}
-
-	parsed, err := strconv.ParseBool(raw)
-	if err != nil {
-		return fmt.Errorf("cannot parse %s: %w", key, err)
-	}
-
-	*value = parsed
-
-	return nil
-}
-
-// parseDuration sets *value to the setting key. It returns an error when
-// the value is not a Go duration above zero.
-func parseDuration(key string, value *string) error {
-	raw, err := getString(key)
-	if err != nil {
-		return err
-	}
-
-	duration, err := time.ParseDuration(raw)
-	if err != nil {
-		return fmt.Errorf("cannot parse %s: %w", key, err)
-	}
-
-	if duration <= 0 {
-		return fmt.Errorf("%w: %s is %s, but must be above zero",
-			errOutOfRange, key, raw)
-	}
-
-	*value = raw
-
-	return nil
-}

internal/config/config_test.go

@@ -1,21 +1,16 @@
 package config_test
 
 import (
-	"net/netip"
 	"os"
-	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 
-	"github.com/spf13/viper"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
 )
 
-// loadConfig runs config.New and returns its result.
+func newConfig(t *testing.T) *config.Config {
-func loadConfig(t *testing.T) (*config.Config, error) {
 	t.Helper()
 
 	globs := &globals.Globals{
@@ -29,15 +24,9 @@ func loadConfig(t *testing.T) (*config.Config, error) {
 		t.Fatal(err)
 	}
 
-	return config.New(
+	cfg, err := config.New(
 		nil, config.Params{Globals: globs, Logger: log},
 	)
-}
-
-func newConfig(t *testing.T) *config.Config {
-	t.Helper()
-
-	cfg, err := loadConfig(t)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -45,148 +34,6 @@ func newConfig(t *testing.T) *config.Config {
 	return cfg
 }
 
-func TestUnsetSettingsKeepDefaults(t *testing.T) {
-	// Viper counts an empty environment variable as unset.
-	t.Setenv("PORT", "")
-	t.Setenv("MAX_MESSAGE_SIZE", "")
-	t.Setenv("NEOIRC_HASHCASH_BITS", "")
-	t.Setenv("LOGIN_RATE_BURST", "")
-	t.Setenv("LOGIN_RATE_LIMIT", "")
-	t.Setenv("DEBUG", "")
-	t.Setenv("MAINTENANCE_MODE", "")
-	t.Setenv("MESSAGE_MAX_AGE", "")
-	t.Setenv("QUEUE_MAX_AGE", "")
-	t.Setenv("SESSION_IDLE_TIMEOUT", "")
-
-	// Each duration setting defaults to 30 days.
-	const thirtyDays = "720h"
-
-	want := settings{
-		Port:               8080,
-		MaxMessageSize:     4096,
-		HashcashBits:       20,
-		LoginRateBurst:     5,
-		LoginRateLimit:     1,
-		Debug:              false,
-		MaintenanceMode:    false,
-		MessageMaxAge:      thirtyDays,
-		QueueMaxAge:        thirtyDays,
-		SessionIdleTimeout: thirtyDays,
-	}
-
-	got := settingsOf(newConfig(t))
-	if got != want {
-		t.Errorf("settings = %+v, want %+v", got, want)
-	}
-}
-
-func TestValidSettingsAreUsed(t *testing.T) {
-	// Each whole number is the lowest value its setting allows, and 1ns
-	// is the shortest duration allowed.
-	t.Setenv("PORT", "0")
-	t.Setenv("MAX_MESSAGE_SIZE", "1")
-	t.Setenv("NEOIRC_HASHCASH_BITS", "0")
-	t.Setenv("LOGIN_RATE_BURST", "1")
-	t.Setenv("LOGIN_RATE_LIMIT", "0.5")
-	t.Setenv("DEBUG", "true")
-	t.Setenv("MAINTENANCE_MODE", "true")
-	t.Setenv("MESSAGE_MAX_AGE", "1ns")
-	t.Setenv("QUEUE_MAX_AGE", "1h30m")
-	t.Setenv("SESSION_IDLE_TIMEOUT", "45m")
-
-	want := settings{
-		Port:               0,
-		MaxMessageSize:     1,
-		HashcashBits:       0,
-		LoginRateBurst:     1,
-		LoginRateLimit:     0.5,
-		Debug:              true,
-		MaintenanceMode:    true,
-		MessageMaxAge:      "1ns",
-		QueueMaxAge:        "1h30m",
-		SessionIdleTimeout: "45m",
-	}
-
-	got := settingsOf(newConfig(t))
-	if got != want {
-		t.Errorf("settings = %+v, want %+v", got, want)
-	}
-}
-
-// settings holds the Config fields whose settings config.New parses.
-type settings struct {
-	Port               int
-	MaxMessageSize     int
-	HashcashBits       int
-	LoginRateBurst     int
-	LoginRateLimit     float64
-	Debug              bool
-	MaintenanceMode    bool
-	MessageMaxAge      string
-	QueueMaxAge        string
-	SessionIdleTimeout string
-}
-
-func settingsOf(cfg *config.Config) settings {
-	return settings{
-		Port:               cfg.Port,
-		MaxMessageSize:     cfg.MaxMessageSize,
-		HashcashBits:       cfg.HashcashBits,
-		LoginRateBurst:     cfg.LoginRateBurst,
-		LoginRateLimit:     cfg.LoginRateLimit,
-		Debug:              cfg.Debug,
-		MaintenanceMode:    cfg.MaintenanceMode,
-		MessageMaxAge:      cfg.MessageMaxAge,
-		QueueMaxAge:        cfg.QueueMaxAge,
-		SessionIdleTimeout: cfg.SessionIdleTimeout,
-	}
-}
-
-func TestBadSettingStopsStartup(t *testing.T) {
-	// Each value is invalid for its setting.
-	tests := []struct {
-		key    string
-		values []string
-	}{
-		{key: "PORT", values: []string{"80a", "-1"}},
-		{key: "MAX_MESSAGE_SIZE", values: []string{"4k", "0", "-4096"}},
-		{key: "NEOIRC_HASHCASH_BITS", values: []string{"twenty", "-1"}},
-		{key: "LOGIN_RATE_BURST", values: []string{"five", "0", "-5"}},
-		{key: "LOGIN_RATE_LIMIT", values: []string{
-			"fast", "0", "-1", "NaN", "Inf", "-Inf",
-		}},
-		{key: "DEBUG", values: []string{"yes"}},
-		{key: "MAINTENANCE_MODE", values: []string{"on"}},
-		{key: "MESSAGE_MAX_AGE", values: []string{"30d", "0", "-1h"}},
-		{key: "QUEUE_MAX_AGE", values: []string{"720", "0s", "-24h"}},
-		{key: "SESSION_IDLE_TIMEOUT", values: []string{"a month", "0", "-1m"}},
-		{key: "TRUSTED_PROXIES", values: []string{
-			"proxy.example.com", "10.0.0.0/33", "192.0.2.1:8080",
-			"::ffff:10.0.0.0/104", "fe80::1%eth0",
-		}},
-	}
-
-	for _, test := range tests {
-		for _, value := range test.values {
-			t.Run(test.key+"="+value, func(t *testing.T) {
-				t.Setenv(test.key, value)
-
-				_, err := loadConfig(t)
-				if err == nil {
-					t.Fatalf("%s=%q: got no error", test.key, value)
-				}
-
-				msg := err.Error()
-				if !strings.Contains(msg, test.key) ||
-					!strings.Contains(msg, value) {
-					t.Errorf("error %q does not name %s and %q",
-						msg, test.key, value)
-				}
-			})
-		}
-	}
-}
-
 func TestIRCListenAddrUnsetKeepsDefault(t *testing.T) {
 	// t.Setenv puts back whatever value was there after the test.
 	t.Setenv("IRC_LISTEN_ADDR", "")
@@ -212,228 +59,3 @@ func TestIRCListenAddrEmptyTurnsListenerOff(t *testing.T) {
 		t.Errorf("IRCListenAddr = %q, want empty", cfg.IRCListenAddr)
 	}
 }
-
-func TestTrustedProxies(t *testing.T) {
-	// Each case lists addresses that must be in the trusted set and
-	// addresses that must not.
-	tests := []struct {
-		name      string
-		set       bool
-		value     string
-		trusted   []string
-		untrusted []string
-	}{
-		{
-			name:  "unset trusts the RFC 1918 ranges",
-			set:   false,
-			value: "",
-			trusted: []string{
-				"10.1.2.3", "172.16.0.1", "172.31.255.254", "192.168.1.1",
-			},
-			untrusted: []string{
-				"127.0.0.1", "172.32.0.1", "192.0.2.1", "2001:db8::1",
-			},
-		},
-		{
-			name:      "a value replaces the default",
-			set:       true,
-			value:     "198.51.100.0/24, 192.0.2.7,2001:db8::/32",
-			trusted:   []string{"198.51.100.200", "192.0.2.7", "2001:db8::5"},
-			untrusted: []string{"10.4.5.6", "192.168.4.4", "192.0.2.8"},
-		},
-		{
-			name:      "a mapped IPv6 address is trusted as IPv4",
-			set:       true,
-			value:     "::ffff:192.0.2.7",
-			trusted:   []string{"192.0.2.7"},
-			untrusted: []string{"10.7.8.9"},
-		},
-		{
-			name:      "the empty string trusts nothing",
-			set:       true,
-			value:     "",
-			trusted:   nil,
-			untrusted: []string{"10.0.0.1", "192.168.0.1", "::1"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			// t.Setenv puts back whatever value was there after the
-			// test, including when Unsetenv removes it.
-			t.Setenv("TRUSTED_PROXIES", test.value)
-
-			if !test.set {
-				err := os.Unsetenv("TRUSTED_PROXIES")
-				if err != nil {
-					t.Fatal(err)
-				}
-			}
-
-			proxies := newConfig(t).TrustedProxies
-
-			for _, addr := range test.trusted {
-				if !proxies.Contains(netip.MustParseAddr(addr)) {
-					t.Errorf("%s is not trusted", addr)
-				}
-			}
-
-			for _, addr := range test.untrusted {
-				if proxies.Contains(netip.MustParseAddr(addr)) {
-					t.Errorf("%s is trusted", addr)
-				}
-			}
-		})
-	}
-}
-
-// unsetEnv removes the environment variable key for the rest of the
-// test, so that config.New reads key from the config file.
-func unsetEnv(t *testing.T, key string) {
-	t.Helper()
-
-	// t.Setenv puts back whatever value was there after the test,
-	// including when Unsetenv removes it.
-	t.Setenv(key, "")
-
-	err := os.Unsetenv(key)
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-// writeConfigFile writes content to the config file config.New reads
-// when HOME is home, and returns the file's path.
-func writeConfigFile(t *testing.T, home, content string) string {
-	t.Helper()
-
-	// loadConfig names the app neoirc-test, so config.New reads
-	// $HOME/.config/neoirc-test/neoirc-test.yaml.
-	dir := filepath.Join(home, ".config", "neoirc-test")
-
-	err := os.MkdirAll(dir, 0o700)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	path := filepath.Join(dir, "neoirc-test.yaml")
-
-	err = os.WriteFile(path, []byte(content), 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Viper keeps the file and the values it read from it after the
-	// file is gone. Reset clears them for later tests.
-	t.Cleanup(viper.Reset)
-
-	return path
-}
-
-func TestListOrMapInConfigFileStopsStartup(t *testing.T) {
-	// YAML reads the first value as a list and the second as a map.
-	values := []string{`[":6667"]`, `{addr: ":6667"}`}
-	keys := []string{"IRC_LISTEN_ADDR", "MOTD", "TRUSTED_PROXIES"}
-
-	for _, key := range keys {
-		for _, value := range values {
-			t.Run(key+"="+value, func(t *testing.T) {
-				home := t.TempDir()
-				t.Setenv("HOME", home)
-				unsetEnv(t, key)
-				writeConfigFile(t, home, key+": "+value+"\n")
-
-				_, err := loadConfig(t)
-				if err == nil || !strings.Contains(err.Error(), key) {
-					t.Errorf("error = %v, want one naming %s", err, key)
-				}
-			})
-		}
-	}
-}
-
-func TestListOrMapErrorLeavesOutValue(t *testing.T) {
-	const key = "NEOIRC_OPER_PASSWORD"
-
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	unsetEnv(t, key)
-	// YAML reads an unquoted {hunter2} as a map.
-	writeConfigFile(t, home, key+": {hunter2}\n")
-
-	_, err := loadConfig(t)
-	if err == nil || !strings.Contains(err.Error(), key) {
-		t.Fatalf("error = %v, want one naming %s", err, key)
-	}
-
-	if strings.Contains(err.Error(), "hunter2") {
-		t.Errorf("error %q shows the password", err)
-	}
-}
-
-func TestEmptyEnvironmentValueWinsOverConfigFile(t *testing.T) {
-	const (
-		ircListenAddr  = "IRC_LISTEN_ADDR"
-		trustedProxies = "TRUSTED_PROXIES"
-	)
-
-	// Each setting is the empty string in the environment and a list in
-	// the config file. The environment wins, so the list is never read.
-	tests := []struct {
-		key   string
-		empty func(cfg *config.Config) bool
-	}{
-		{
-			key: ircListenAddr,
-			empty: func(cfg *config.Config) bool {
-				return cfg.IRCListenAddr == ""
-			},
-		},
-		{
-			key: trustedProxies,
-			empty: func(cfg *config.Config) bool {
-				return len(cfg.TrustedProxies.Prefixes()) == 0
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.key, func(t *testing.T) {
-			home := t.TempDir()
-			t.Setenv("HOME", home)
-			t.Setenv(test.key, "")
-			writeConfigFile(t, home, test.key+": [\":6667\"]\n")
-
-			cfg := newConfig(t)
-			if !test.empty(cfg) {
-				t.Errorf("%s is not the empty string", test.key)
-			}
-		})
-	}
-}
-
-func TestSingleValuesInConfigFileAreUsed(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	unsetEnv(t, "PORT")
-	unsetEnv(t, "DEBUG")
-	unsetEnv(t, "MOTD")
-	writeConfigFile(t, home, "PORT: 9000\nDEBUG: true\nMOTD: hello\n")
-
-	cfg := newConfig(t)
-	if cfg.Port != 9000 || !cfg.Debug || cfg.MOTD != "hello" {
-		t.Errorf("Port, Debug, MOTD = %d, %t, %q, want 9000, true, %q",
-			cfg.Port, cfg.Debug, cfg.MOTD, "hello")
-	}
-}
-
-func TestConfigFileThatDoesNotParseStopsStartup(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	path := writeConfigFile(t, home, "MOTD: [unclosed\n")
-
-	_, err := loadConfig(t)
-	if err == nil || !strings.Contains(err.Error(), path) {
-		t.Errorf("error = %v, want one naming %s", err, path)
-	}
-}

internal/db/auth.go

@@ -10,6 +10,13 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
+//nolint:gochecknoglobals // var so tests can override via SetBcryptCost
+var bcryptCost = bcrypt.DefaultCost
+
+// SetBcryptCost overrides the bcrypt cost.
+// Use bcrypt.MinCost in tests to avoid slow hashing.
+func SetBcryptCost(cost int) { bcryptCost = cost }
+
 var errNoPassword = errors.New(
 	"account has no password set",
 )
@@ -22,7 +29,7 @@ func (database *Database) SetPassword(
 	password string,
 ) error {
 	hash, err := bcrypt.GenerateFromPassword(
-		[]byte(password), database.passwordCost,
+		[]byte(password), bcryptCost,
 	)
 	if err != nil {
 		return fmt.Errorf("hash password: %w", err)

internal/db/db.go

@@ -5,17 +5,14 @@ import (
 	"context"
 	"database/sql"
 	"embed"
-	"errors"
 	"fmt"
 	"io/fs"
 	"log/slog"
-	"net/url"
 	"sort"
 	"strconv"
 	"strings"
 
 	"go.uber.org/fx"
-	"golang.org/x/crypto/bcrypt"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/logger"
 
@@ -25,10 +22,6 @@ import (
 
 const minMigrationParts = 2
 
-var errForeignKeysInDBURL = errors.New(
-	"DBURL must not set foreign_keys, which the server always turns on",
-)
-
 // SchemaFiles contains embedded SQL migration files.
 //
 //go:embed schema/*.sql
@@ -40,11 +33,6 @@ type Params struct {
 
 	Logger *logger.Logger
 	Config *config.Config
-
-	// PasswordCost is the bcrypt cost at which SetPassword hashes
-	// a password. The server leaves it unset, which means
-	// bcrypt.DefaultCost. Tests set a lower cost to save time.
-	PasswordCost int `optional:"true"`
 }
 
 // Database manages the SQLite connection and migrations.
@@ -52,7 +40,6 @@ type Database struct {
 	conn   *sql.DB
 	log    *slog.Logger
 	params *Params
-	passwordCost int
 }
 
 // New creates a new Database and registers lifecycle hooks.
@@ -60,15 +47,9 @@ func New(
 	lifecycle fx.Lifecycle,
 	params Params,
 ) (*Database, error) {
-	passwordCost := params.PasswordCost
-	if passwordCost == 0 {
-		passwordCost = bcrypt.DefaultCost
-	}
-
 	database := &Database{ //nolint:exhaustruct // conn set in OnStart
 		params: &params,
 		log:    params.Logger.Get(),
-		passwordCost: passwordCost,
 	}
 
 	database.log.Info("Database instantiated")
@@ -98,39 +79,17 @@ func New(
 	return database, nil
 }
 
+// GetDB returns the underlying sql.DB connection.
+func (database *Database) GetDB() *sql.DB {
+	return database.conn
+}
+
 func (database *Database) connect(ctx context.Context) error {
 	dbURL := database.params.Config.DBURL
 	if dbURL == "" {
 		dbURL = config.DefaultDBURL
 	}
 
-	// SQLite keeps the foreign keys setting per connection. The driver
-	// runs each _pragma parameter on every connection it opens. So the
-	// one added below also covers the connection the pool opens after
-	// a cancelled query breaks the old one. A foreign_keys pragma in
-	// DBURL could undo it, because the driver sorts the pragmas.
-	_, query, hasQuery := strings.Cut(dbURL, "?")
-
-	urlParams, err := url.ParseQuery(query)
-	if err != nil {
-		return fmt.Errorf("parse DBURL: %w", err)
-	}
-
-	for _, pragma := range urlParams["_pragma"] {
-		if strings.Contains(strings.ToLower(pragma), "foreign_keys") {
-			return fmt.Errorf(
-				"%w: _pragma=%s", errForeignKeysInDBURL, pragma,
-			)
-		}
-	}
-
-	separator := "?"
-	if hasQuery {
-		separator = "&"
-	}
-
-	dbURL += separator + "_pragma=foreign_keys(1)"
-
 	database.log.Info(
 		"connecting to database", "url", dbURL,
 	)
@@ -150,6 +109,13 @@ func (database *Database) connect(ctx context.Context) error {
 	database.conn = conn
 	database.log.Info("database connected")
 
+	_, err = database.conn.ExecContext(
+		ctx, "PRAGMA foreign_keys = ON",
+	)
+	if err != nil {
+		return fmt.Errorf("enable foreign keys: %w", err)
+	}
+
 	return database.runMigrations(ctx)
 }
 

internal/db/db_test.go

@@ -1,39 +1,19 @@
 package db_test
 
 import (
-	"context"
-	"errors"
-	"net/url"
 	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
 	"go.uber.org/fx/fxtest"
-	"golang.org/x/crypto/bcrypt"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/dbtest"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
 )
 
 const wantBusyTimeoutMS = 5000
 
-const (
-	// endlessQuery counts the rows of a recursive query that never
-	// stops, so it runs until its context ends.
-	endlessQuery = `WITH RECURSIVE n(x) AS
-		(SELECT 1 UNION ALL SELECT x + 1 FROM n)
-		SELECT COUNT(*) FROM n`
-
-	// endlessQueryTimeout is how long the endless query runs
-	// before its context ends. A query whose context ends before
-	// it starts is never run, and the pool keeps its connection,
-	// so the timeout leaves a loaded host time to start it.
-	endlessQueryTimeout = 2 * time.Second
-)
-
 // TestDefaultDBURLSetsWALAndBusyTimeout opens a file database
 // with the default URL's parameters the way the server does,
 // and checks the journal mode and busy timeout it ends up with.
@@ -93,270 +73,3 @@ func TestDefaultDBURLSetsWALAndBusyTimeout(t *testing.T) {
 		)
 	}
 }
-
-// TestForeignKeysOnAfterCancelledQuery cancels a query while it
-// runs, which makes the pool close its only connection and open a
-// new one. A TEMP table lasts only as long as its connection, so
-// its absence shows the connection was replaced. The test then
-// checks that the file database keeps its tables and that the new
-// connection has foreign keys on.
-func TestForeignKeysOnAfterCancelledQuery(t *testing.T) {
-	t.Parallel()
-
-	_, defaultParams, _ := strings.Cut(config.DefaultDBURL, "?")
-
-	urlParams := map[string]string{
-		"default parameters": "?" + defaultParams,
-		"no parameters":      "",
-	}
-
-	for name, params := range urlParams {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			dbURL := "file://" +
-				filepath.Join(t.TempDir(), "state.db") + params
-
-			database, err := startDatabase(t, dbURL)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			_, err = database.GetDB().ExecContext(
-				t.Context(), "CREATE TEMP TABLE first_connection (x)",
-			)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			ctx, cancel := context.WithTimeout(
-				t.Context(), endlessQueryTimeout,
-			)
-			defer cancel()
-
-			_, err = database.GetDB().ExecContext(ctx, endlessQuery)
-			if !errors.Is(err, context.DeadlineExceeded) {
-				t.Fatalf("endless query: err = %v", err)
-			}
-
-			tempTables := queryInt(
-				t, database, "SELECT COUNT(*) FROM sqlite_temp_schema",
-			)
-			if tempTables != 0 {
-				t.Fatal("the pool kept its first connection")
-			}
-
-			migrations := queryInt(
-				t, database, "SELECT COUNT(*) FROM schema_migrations",
-			)
-			if migrations == 0 {
-				t.Error("schema_migrations is empty")
-			}
-
-			foreignKeys := queryInt(t, database, "PRAGMA foreign_keys")
-			if foreignKeys != 1 {
-				t.Errorf("foreign_keys = %d, want 1", foreignKeys)
-			}
-		})
-	}
-}
-
-// TestNewURLKeepsDataAfterCancelledQuery cancels a query on a test
-// database while it runs, which makes the pool close its only
-// connection and open a new one. A TEMP table lasts only as long as
-// its connection, so its absence shows the connection was replaced.
-// The database must still have its tables and rows.
-func TestNewURLKeepsDataAfterCancelledQuery(t *testing.T) {
-	t.Parallel()
-
-	database, err := startDatabase(t, dbtest.NewURL(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = database.GetOrCreateChannel(t.Context(), "#test")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = database.GetDB().ExecContext(
-		t.Context(), "CREATE TEMP TABLE first_connection (x)",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithTimeout(t.Context(), endlessQueryTimeout)
-	defer cancel()
-
-	_, err = database.GetDB().ExecContext(ctx, endlessQuery)
-	if !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatalf("endless query: err = %v", err)
-	}
-
-	tempTables := queryInt(
-		t, database, "SELECT COUNT(*) FROM sqlite_temp_schema",
-	)
-	if tempTables != 0 {
-		t.Fatal("the pool kept its first connection")
-	}
-
-	channels := queryInt(t, database, "SELECT COUNT(*) FROM channels")
-	if channels != 1 {
-		t.Errorf("channels = %d, want 1", channels)
-	}
-}
-
-// TestDBURLSettingForeignKeysFailsStartup checks that the database
-// refuses to start when DBURL sets foreign_keys itself, however it
-// is spelled.
-func TestDBURLSettingForeignKeysFailsStartup(t *testing.T) {
-	t.Parallel()
-
-	pragmas := []string{
-		"foreign_keys(0)",
-		"foreign_keys(off)",
-		"foreign_keys=0",
-		"FOREIGN_KEYS(FALSE)",
-		" Foreign_Keys = 1",
-	}
-
-	for _, pragma := range pragmas {
-		t.Run(pragma, func(t *testing.T) {
-			t.Parallel()
-
-			dbURL := "file://" +
-				filepath.Join(t.TempDir(), "state.db") +
-				"?_pragma=" + url.QueryEscape(pragma)
-
-			_, err := startDatabase(t, dbURL)
-			if err == nil {
-				t.Fatal("the database started")
-			}
-
-			if !strings.Contains(err.Error(), "DBURL") {
-				t.Errorf("error %q does not name DBURL", err)
-			}
-		})
-	}
-}
-
-// TestPasswordCost checks the bcrypt cost of the hash that SetPassword
-// stores: bcrypt.DefaultCost when db.Params leaves PasswordCost unset,
-// as the server does, and PasswordCost when it is set.
-func TestPasswordCost(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name         string
-		passwordCost int
-		wantCost     int
-	}{
-		{name: "unset", wantCost: bcrypt.DefaultCost},
-		{
-			name:         "bcrypt.MinCost",
-			passwordCost: bcrypt.MinCost,
-			wantCost:     bcrypt.MinCost,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			lifecycle := fxtest.NewLifecycle(t)
-
-			log, err := logger.New(lifecycle, logger.Params{
-				Globals: &globals.Globals{},
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			database, err := db.New(lifecycle, db.Params{
-				Logger:       log,
-				Config:       &config.Config{DBURL: dbtest.NewURL(t)},
-				PasswordCost: test.passwordCost,
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			lifecycle.RequireStart()
-			t.Cleanup(lifecycle.RequireStop)
-
-			sessionID, _, _, err := database.CreateSession(
-				t.Context(), "costuser", "", "", "",
-			)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			err = database.SetPassword(t.Context(), sessionID, "password123")
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			var hash string
-
-			err = database.GetDB().QueryRowContext(
-				t.Context(),
-				"SELECT password_hash FROM sessions WHERE id = ?",
-				sessionID,
-			).Scan(&hash)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			cost, err := bcrypt.Cost([]byte(hash))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if cost != test.wantCost {
-				t.Errorf("cost = %d, want %d", cost, test.wantCost)
-			}
-		})
-	}
-}
-
-// startDatabase starts a Database for dbURL the way the server does.
-// It returns the error that stopped it from starting, if any.
-func startDatabase(t *testing.T, dbURL string) (*db.Database, error) {
-	t.Helper()
-
-	lifecycle := fxtest.NewLifecycle(t)
-
-	log, err := logger.New(lifecycle, logger.Params{
-		Globals: &globals.Globals{},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	database, err := db.New(lifecycle, db.Params{
-		Logger: log,
-		Config: &config.Config{DBURL: dbURL},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	t.Cleanup(lifecycle.RequireStop)
-
-	return database, lifecycle.Start(t.Context())
-}
-
-// queryInt runs a query that returns a single number.
-func queryInt(t *testing.T, database *db.Database, query string) int {
-	t.Helper()
-
-	var result int
-
-	err := database.GetDB().QueryRowContext(t.Context(), query).Scan(&result)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return result
-}

internal/db/errors.go

@@ -17,14 +17,3 @@ func IsUniqueConstraintError(err error) bool {
 
 	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_UNIQUE
 }
-
-// IsForeignKeyConstraintError reports whether err is a
-// SQLite foreign-key constraint violation.
-func IsForeignKeyConstraintError(err error) bool {
-	var sqliteErr *sqlite.Error
-	if !errors.As(err, &sqliteErr) {
-		return false
-	}
-
-	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_FOREIGNKEY
-}

internal/db/export_test.go

@@ -5,19 +5,21 @@ import (
 	"database/sql"
 	"fmt"
 	"log/slog"
-	"testing"
+	"sync/atomic"
-	"time"
-
-	"golang.org/x/crypto/bcrypt"
-	"sneak.berlin/go/neoirc/internal/dbtest"
 )
 
-// NewTestDatabase creates an in-memory database for testing. It
+//nolint:gochecknoglobals // test counter
-// hashes passwords at bcrypt.MinCost.
+var testDBCounter atomic.Int64
-func NewTestDatabase(tb testing.TB) (*Database, error) {
-	tb.Helper()
 
-	dsn := dbtest.NewURL(tb) + "&_pragma=foreign_keys(1)"
+// NewTestDatabase creates an in-memory database for testing.
+func NewTestDatabase() (*Database, error) {
+	counter := testDBCounter.Add(1)
+
+	dsn := fmt.Sprintf(
+		"file:testdb%d?mode=memory"+
+			"&cache=shared&_pragma=foreign_keys(1)",
+		counter,
+	)
 
 	conn, err := sql.Open("sqlite", dsn)
 	if err != nil {
@@ -27,7 +29,6 @@ func NewTestDatabase(tb testing.TB) (*Database, error) {
 	database := &Database{ //nolint:exhaustruct // test helper, params not needed
 		conn: conn,
 		log:  slog.Default(),
-		passwordCost: bcrypt.MinCost,
 	}
 
 	err = database.runMigrations(context.Background())
@@ -71,78 +72,3 @@ func (database *Database) ExecForTest(
 
 	return nil
 }
-
-// GetDB returns the underlying sql.DB connection.
-func (database *Database) GetDB() *sql.DB {
-	return database.conn
-}
-
-// GetOrCreateChannel returns channel id, creating if needed.
-// Uses INSERT OR IGNORE to avoid TOCTOU races.
-func (database *Database) GetOrCreateChannel(
-	ctx context.Context,
-	name string,
-) (int64, error) {
-	now := time.Now()
-
-	_, err := database.conn.ExecContext(ctx,
-		`INSERT OR IGNORE INTO channels
-		 (name, created_at, updated_at)
-		 VALUES (?, ?, ?)`,
-		name, now, now)
-	if err != nil {
-		return 0, fmt.Errorf("create channel: %w", err)
-	}
-
-	var channelID int64
-
-	err = database.conn.QueryRowContext(
-		ctx,
-		"SELECT id FROM channels WHERE name = ?",
-		name,
-	).Scan(&channelID)
-	if err != nil {
-		return 0, fmt.Errorf("get channel: %w", err)
-	}
-
-	return channelID, nil
-}
-
-// JoinChannel adds a session to a channel.
-func (database *Database) JoinChannel(
-	ctx context.Context,
-	channelID, sessionID int64,
-) error {
-	_, err := database.conn.ExecContext(ctx,
-		`INSERT OR IGNORE INTO channel_members
-		 (channel_id, session_id, joined_at)
-		 VALUES (?, ?, ?)`,
-		channelID, sessionID, time.Now())
-	if err != nil {
-		return fmt.Errorf("join channel: %w", err)
-	}
-
-	return nil
-}
-
-// HasChannelInvite checks if a session has been invited
-// to a channel.
-func (database *Database) HasChannelInvite(
-	ctx context.Context,
-	channelID, sessionID int64,
-) (bool, error) {
-	var count int
-
-	err := database.conn.QueryRowContext(ctx,
-		`SELECT COUNT(*) FROM channel_invites
-		 WHERE channel_id = ? AND session_id = ?`,
-		channelID, sessionID,
-	).Scan(&count)
-	if err != nil {
-		return false, fmt.Errorf(
-			"check invite: %w", err,
-		)
-	}
-
-	return count > 0, nil
-}

internal/db/main_test.go

@@ -0,0 +1,14 @@
+package db_test
+
+import (
+	"os"
+	"testing"
+
+	"golang.org/x/crypto/bcrypt"
+	"sneak.berlin/go/neoirc/internal/db"
+)
+
+func TestMain(m *testing.M) {
+	db.SetBcryptCost(bcrypt.MinCost)
+	os.Exit(m.Run())
+}

internal/db/queries.go

@@ -9,7 +9,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"math"
 	"strconv"
 	"strings"
 	"time"
@@ -264,25 +263,6 @@ func (database *Database) GetSessionByNick(
 	return sessionID, nil
 }
 
-// GetSessionNick returns the nick a session holds.
-func (database *Database) GetSessionNick(
-	ctx context.Context,
-	sessionID int64,
-) (string, error) {
-	var nick string
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		"SELECT nick FROM sessions WHERE id = ?",
-		sessionID,
-	).Scan(&nick)
-	if err != nil {
-		return "", fmt.Errorf("get session nick: %w", err)
-	}
-
-	return nick, nil
-}
-
 // SessionHostInfo holds the username, hostname, and IP
 // for a session.
 type SessionHostInfo struct {
@@ -320,6 +300,29 @@ type ClientHostInfo struct {
 	Hostname string
 }
 
+// GetClientHostInfo returns the IP and hostname for a
+// client.
+func (database *Database) GetClientHostInfo(
+	ctx context.Context,
+	clientID int64,
+) (*ClientHostInfo, error) {
+	var info ClientHostInfo
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		`SELECT ip, hostname
+		 FROM clients WHERE id = ?`,
+		clientID,
+	).Scan(&info.IP, &info.Hostname)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get client host info: %w", err,
+		)
+	}
+
+	return &info, nil
+}
+
 // SetSessionOper sets the is_oper flag on a session.
 func (database *Database) SetSessionOper(
 	ctx context.Context,
@@ -410,207 +413,94 @@ func (database *Database) GetChannelByName(
 	return channelID, nil
 }
 
-// Errors that CreateOrJoinChannel refuses a join with.
+// GetOrCreateChannel returns channel id, creating if needed.
-var (
+// Uses INSERT OR IGNORE to avoid TOCTOU races.
-	ErrBannedFromChannel = errors.New("banned from channel")
+func (database *Database) GetOrCreateChannel(
-	ErrInviteOnlyChannel = errors.New("channel is invite-only")
-	ErrBadChannelKey     = errors.New("wrong channel key")
-	ErrChannelIsFull     = errors.New("channel is full")
-)
-
-// CreateOrJoinChannel adds a session to the channel called
-// name, creating the channel if it does not exist. The
-// session is made operator if the channel has no members;
-// otherwise checkJoinRestrictions may refuse it. A join
-// uses up the session's invite to the channel. It returns
-// the channel ID and whether the session was made operator.
-// All of it is one transaction, and the database has one
-// connection, so every other statement waits until the
-// join is decided.
-func (database *Database) CreateOrJoinChannel(
 	ctx context.Context,
 	name string,
-	sessionID int64,
+) (int64, error) {
-	suppliedKey string,
-) (int64, bool, error) {
-	transaction, err := database.conn.BeginTx(ctx, nil)
-	if err != nil {
-		return 0, false, fmt.Errorf("begin join: %w", err)
-	}
-
-	defer func() { _ = transaction.Rollback() }()
-
 	now := time.Now()
 
-	_, err = transaction.ExecContext(ctx,
+	_, err := database.conn.ExecContext(ctx,
 		`INSERT OR IGNORE INTO channels
 		 (name, created_at, updated_at)
 		 VALUES (?, ?, ?)`,
 		name, now, now)
 	if err != nil {
-		return 0, false, fmt.Errorf("create channel: %w", err)
+		return 0, fmt.Errorf("create channel: %w", err)
 	}
 
-	var channelID, memberCount int64
+	var channelID int64
 
-	err = transaction.QueryRowContext(ctx,
+	err = database.conn.QueryRowContext(
-		`SELECT id,
+		ctx,
-		   (SELECT COUNT(*) FROM channel_members
+		"SELECT id FROM channels WHERE name = ?",
-		    WHERE channel_id = channels.id)
-		 FROM channels WHERE name = ?`,
 		name,
-	).Scan(&channelID, &memberCount)
+	).Scan(&channelID)
 	if err != nil {
-		return 0, false, fmt.Errorf("get channel: %w", err)
+		return 0, fmt.Errorf("get channel: %w", err)
 	}
 
-	isOperator := memberCount == 0
+	return channelID, nil
-	if !isOperator {
-		err = checkJoinRestrictions(
-			ctx, transaction, channelID, sessionID,
-			suppliedKey, memberCount,
-		)
-		if err != nil {
-			return 0, false, err
-		}
-	}
-
-	_, err = transaction.ExecContext(ctx,
-		`INSERT OR IGNORE INTO channel_members
-		 (channel_id, session_id, is_operator, joined_at)
-		 VALUES (?, ?, ?, ?)`,
-		channelID, sessionID, isOperator, now)
-	if err != nil {
-		return 0, false, fmt.Errorf("join channel: %w", err)
-	}
-
-	_, err = transaction.ExecContext(ctx,
-		`DELETE FROM channel_invites
-		 WHERE channel_id = ? AND session_id = ?`,
-		channelID, sessionID)
-	if err != nil {
-		return 0, false, fmt.Errorf("clear invite: %w", err)
-	}
-
-	err = transaction.Commit()
-	if err != nil {
-		return 0, false, fmt.Errorf("commit join: %w", err)
-	}
-
-	return channelID, isOperator, nil
 }
 
-// checkJoinRestrictions returns the error that refuses a
+// JoinChannel adds a session to a channel.
-// session's join of a channel with memberCount members:
+func (database *Database) JoinChannel(
-// ErrBannedFromChannel when a ban matches its hostmask,
-// ErrInviteOnlyChannel when the channel is +i and the
-// session has no invite, ErrBadChannelKey when suppliedKey
-// is not the +k key, or ErrChannelIsFull when the channel
-// has at least its +l number of members. It returns nil
-// when none applies.
-func checkJoinRestrictions(
 	ctx context.Context,
-	transaction *sql.Tx,
 	channelID, sessionID int64,
-	suppliedKey string,
-	memberCount int64,
 ) error {
-	banned, err := isSessionBannedInTx(
+	_, err := database.conn.ExecContext(ctx,
-		ctx, transaction, channelID, sessionID,
+		`INSERT OR IGNORE INTO channel_members
-	)
+		 (channel_id, session_id, joined_at)
+		 VALUES (?, ?, ?)`,
+		channelID, sessionID, time.Now())
 	if err != nil {
-		return err
+		return fmt.Errorf("join channel: %w", err)
-	}
-
-	if banned {
-		return ErrBannedFromChannel
-	}
-
-	var (
-		inviteOnly, invited bool
-		key                 string
-		userLimit           int64
-	)
-
-	err = transaction.QueryRowContext(ctx,
-		`SELECT is_invite_only, channel_key, user_limit,
-		   EXISTS (SELECT 1 FROM channel_invites
-		           WHERE channel_id = channels.id
-		             AND session_id = ?)
-		 FROM channels WHERE id = ?`,
-		sessionID, channelID,
-	).Scan(&inviteOnly, &key, &userLimit, &invited)
-	if err != nil {
-		return fmt.Errorf("get channel modes: %w", err)
-	}
-
-	switch {
-	case inviteOnly && !invited:
-		return ErrInviteOnlyChannel
-	case key != "" && suppliedKey != key:
-		return ErrBadChannelKey
-	case userLimit > 0 && memberCount >= userLimit:
-		return ErrChannelIsFull
 	}
 
 	return nil
 }
 
-// isSessionBannedInTx is IsSessionBanned, reading through
+// JoinChannelAsOperator adds a session to a channel with
-// transaction.
+// operator status. Used when a user creates a new channel.
-func isSessionBannedInTx(
+func (database *Database) JoinChannelAsOperator(
 	ctx context.Context,
-	transaction *sql.Tx,
 	channelID, sessionID int64,
-) (bool, error) {
+) error {
-	var nick, username, hostname string
+	_, err := database.conn.ExecContext(ctx,
-
+		`INSERT OR IGNORE INTO channel_members
-	err := transaction.QueryRowContext(ctx,
+		 (channel_id, session_id, is_operator, joined_at)
-		`SELECT nick, username, hostname
+		 VALUES (?, ?, 1, ?)`,
-		 FROM sessions WHERE id = ?`,
+		channelID, sessionID, time.Now())
-		sessionID,
-	).Scan(&nick, &username, &hostname)
 	if err != nil {
-		return false, fmt.Errorf(
+		return fmt.Errorf(
-			"get session hostmask: %w", err,
+			"join channel as operator: %w", err,
 		)
 	}
 
-	hostmask := FormatHostmask(nick, username, hostname)
+	return nil
+}
 
-	rows, err := transaction.QueryContext(ctx,
+// CountChannelMembers returns the number of members in
-		`SELECT mask FROM channel_bans
+// a channel.
+func (database *Database) CountChannelMembers(
+	ctx context.Context,
+	channelID int64,
+) (int64, error) {
+	var count int64
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM channel_members
 		 WHERE channel_id = ?`,
-		channelID)
+		channelID,
+	).Scan(&count)
 	if err != nil {
-		return false, fmt.Errorf("list channel bans: %w", err)
+		return 0, fmt.Errorf(
-	}
+			"count channel members: %w", err,
-
-	defer func() { _ = rows.Close() }()
-
-	for rows.Next() {
-		var mask string
-
-		err = rows.Scan(&mask)
-		if err != nil {
-			return false, fmt.Errorf(
-				"scan channel ban: %w", err,
 		)
 	}
 
-		if MatchBanMask(mask, hostmask) {
+	return count, nil
-			return true, nil
-		}
-	}
-
-	err = rows.Err()
-	if err != nil {
-		return false, fmt.Errorf(
-			"iterate channel bans: %w", err,
-		)
-	}
-
-	return false, nil
 }
 
 // IsChannelOperator checks if a session has operator
@@ -802,44 +692,12 @@ func (database *Database) SetChannelTopicLocked(
 	return nil
 }
 
-// PartChannelAndDeleteIfEmpty removes a session from a
+// PartChannel removes a session from a channel.
-// channel and deletes the channel if that left it with no
+func (database *Database) PartChannel(
-// members, in one transaction, so that no JOIN lands
-// between the two.
-func (database *Database) PartChannelAndDeleteIfEmpty(
 	ctx context.Context,
 	channelID, sessionID int64,
 ) error {
-	transaction, err := database.conn.BeginTx(ctx, nil)
+	_, err := database.conn.ExecContext(ctx,
-	if err != nil {
-		return fmt.Errorf("begin part: %w", err)
-	}
-
-	defer func() { _ = transaction.Rollback() }()
-
-	err = partChannelAndDeleteIfEmptyInTx(
-		ctx, transaction, channelID, sessionID,
-	)
-	if err != nil {
-		return err
-	}
-
-	err = transaction.Commit()
-	if err != nil {
-		return fmt.Errorf("commit part: %w", err)
-	}
-
-	return nil
-}
-
-// partChannelAndDeleteIfEmptyInTx is
-// PartChannelAndDeleteIfEmpty, writing through transaction.
-func partChannelAndDeleteIfEmptyInTx(
-	ctx context.Context,
-	transaction *sql.Tx,
-	channelID, sessionID int64,
-) error {
-	_, err := transaction.ExecContext(ctx,
 		`DELETE FROM channel_members
 		 WHERE channel_id = ? AND session_id = ?`,
 		channelID, sessionID)
@@ -847,7 +705,15 @@ func partChannelAndDeleteIfEmptyInTx(
 		return fmt.Errorf("part channel: %w", err)
 	}
 
-	_, err = transaction.ExecContext(ctx,
+	return nil
+}
+
+// DeleteChannelIfEmpty removes a channel with no members.
+func (database *Database) DeleteChannelIfEmpty(
+	ctx context.Context,
+	channelID int64,
+) error {
+	_, err := database.conn.ExecContext(ctx,
 		`DELETE FROM channels WHERE id = ?
 		 AND NOT EXISTS
 		 (SELECT 1 FROM channel_members
@@ -1056,49 +922,27 @@ func (database *Database) GetChannelMemberIDs(
 	return scanInt64s(rows)
 }
 
+// GetSessionChannelIDs returns channel IDs for a session.
+func (database *Database) GetSessionChannelIDs(
+	ctx context.Context,
+	sessionID int64,
+) ([]int64, error) {
+	rows, err := database.conn.QueryContext(ctx,
+		`SELECT channel_id FROM channel_members
+		 WHERE session_id = ?`, sessionID)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get session channel ids: %w", err,
+		)
+	}
+
+	return scanInt64s(rows)
+}
+
 // InsertMessage stores a message and returns its DB ID.
-// toSessionID is the session a DM or INVITE is sent to and
-// toChannelID the channel a channel message is sent to;
-// GetHistory selects by them. Pass 0 for one that does not
-// apply, which stores NULL.
 func (database *Database) InsertMessage(
 	ctx context.Context,
 	command, from, target string,
-	toSessionID, toChannelID int64,
-	params json.RawMessage,
-	body json.RawMessage,
-	meta json.RawMessage,
-) (int64, string, error) {
-	transaction, err := database.conn.BeginTx(ctx, nil)
-	if err != nil {
-		return 0, "", fmt.Errorf("begin insert message: %w", err)
-	}
-
-	defer func() { _ = transaction.Rollback() }()
-
-	dbID, msgUUID, err := insertMessageInTx(
-		ctx, transaction, command, from, target,
-		toSessionID, toChannelID, params, body, meta,
-	)
-	if err != nil {
-		return 0, "", err
-	}
-
-	err = transaction.Commit()
-	if err != nil {
-		return 0, "", fmt.Errorf("commit insert message: %w", err)
-	}
-
-	return dbID, msgUUID, nil
-}
-
-// insertMessageInTx is InsertMessage, writing through
-// transaction.
-func insertMessageInTx(
-	ctx context.Context,
-	transaction *sql.Tx,
-	command, from, target string,
-	toSessionID, toChannelID int64,
 	params json.RawMessage,
 	body json.RawMessage,
 	meta json.RawMessage,
@@ -1118,15 +962,12 @@ func insertMessageInTx(
 		meta = json.RawMessage("{}")
 	}
 
-	res, err := transaction.ExecContext(ctx,
+	res, err := database.conn.ExecContext(ctx,
 		`INSERT INTO messages
 		 (uuid, command, msg_from, msg_to,
-		  to_session_id, to_channel_id,
 		  params, body, meta, created_at)
-		 VALUES (?, ?, ?, ?, NULLIF(?, 0), NULLIF(?, 0),
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-		  ?, ?, ?, ?)`,
 		msgUUID, command, from, target,
-		toSessionID, toChannelID,
 		string(params), string(body), string(meta), now)
 	if err != nil {
 		return 0, "", fmt.Errorf(
@@ -1139,49 +980,19 @@ func insertMessageInTx(
 	return dbID, msgUUID, nil
 }
 
-// EnqueueToSession adds a message to the queues of all
+// EnqueueToSession adds a message to all clients of a
-// clients of a session except client skipClientID, or of all
+// session's queues.
-// of them when skipClientID is 0.
 func (database *Database) EnqueueToSession(
 	ctx context.Context,
-	sessionID, messageID, skipClientID int64,
+	sessionID, messageID int64,
 ) error {
-	transaction, err := database.conn.BeginTx(ctx, nil)
+	_, err := database.conn.ExecContext(ctx,
-	if err != nil {
-		return fmt.Errorf("begin enqueue: %w", err)
-	}
-
-	defer func() { _ = transaction.Rollback() }()
-
-	err = enqueueToSessionInTx(
-		ctx, transaction, sessionID, messageID, skipClientID,
-	)
-	if err != nil {
-		return err
-	}
-
-	err = transaction.Commit()
-	if err != nil {
-		return fmt.Errorf("commit enqueue: %w", err)
-	}
-
-	return nil
-}
-
-// enqueueToSessionInTx is EnqueueToSession, writing through
-// transaction.
-func enqueueToSessionInTx(
-	ctx context.Context,
-	transaction *sql.Tx,
-	sessionID, messageID, skipClientID int64,
-) error {
-	_, err := transaction.ExecContext(ctx,
 		`INSERT OR IGNORE INTO client_queues
 		 (client_id, message_id, created_at)
 		 SELECT c.id, ?, ?
 		 FROM clients c
-		 WHERE c.session_id = ? AND c.id != ?`,
+		 WHERE c.session_id = ?`,
-		messageID, time.Now(), sessionID, skipClientID)
+		messageID, time.Now(), sessionID)
 	if err != nil {
 		return fmt.Errorf(
 			"enqueue to session: %w", err,
@@ -1247,31 +1058,26 @@ func (database *Database) PollMessages(
 	return msgs, lastQID, nil
 }
 
-// GetHistory returns the PRIVMSG history of one recipient:
+// GetHistory returns message history for a target. A
-// the DMs sent to session toSessionID, or the messages sent
+// non-empty before is the id of a message sent to target,
-// to channel toChannelID. Pass 0 for the other. A non-empty
+// and only messages older than it are returned; an id with
-// before is the id of a PRIVMSG in that history, and only
+// no such message gives an error wrapping sql.ErrNoRows.
-// messages older than it are returned; an id with no such
-// message gives an error wrapping sql.ErrNoRows.
 func (database *Database) GetHistory(
 	ctx context.Context,
-	toSessionID, toChannelID int64,
+	target, before string,
-	before string,
 	limit int,
 ) ([]IRCMessage, error) {
 	if limit <= 0 {
 		limit = defaultHistLimit
 	}
 
-	// With no before, every message is older than this.
+	var beforeID int64
-	beforeID := int64(math.MaxInt64)
 
 	if before != "" {
 		err := database.conn.QueryRowContext(ctx,
 			`SELECT id FROM messages
-			 WHERE uuid = ? AND command = 'PRIVMSG'
+			 WHERE uuid = ? AND msg_to = ?`,
-			   AND (to_session_id = ? OR to_channel_id = ?)`,
+			before, target,
-			before, toSessionID, toChannelID,
 		).Scan(&beforeID)
 		if err != nil {
 			return nil, fmt.Errorf(
@@ -1281,7 +1087,7 @@ func (database *Database) GetHistory(
 	}
 
 	rows, err := database.queryHistory(
-		ctx, toSessionID, toChannelID, beforeID, limit,
+		ctx, target, beforeID, limit,
 	)
 	if err != nil {
 		return nil, err
@@ -1301,23 +1107,21 @@ func (database *Database) GetHistory(
 	return msgs, nil
 }
 
-// queryHistory selects by to_session_id when toSessionID is
-// set and by to_channel_id otherwise, so that the column's
-// (column, id) index serves the order and the limit.
 func (database *Database) queryHistory(
 	ctx context.Context,
-	toSessionID, toChannelID, beforeID int64,
+	target string,
+	beforeID int64,
 	limit int,
 ) (*sql.Rows, error) {
-	if toSessionID != 0 {
+	if beforeID > 0 {
 		rows, err := database.conn.QueryContext(ctx,
 			`SELECT id, uuid, command, msg_from,
 			   msg_to, params, body, meta, created_at
 			 FROM messages
-			 WHERE to_session_id = ? AND id < ?
+			 WHERE msg_to = ? AND id < ?
 			   AND command = 'PRIVMSG'
 			 ORDER BY id DESC LIMIT ?`,
-			toSessionID, beforeID, limit)
+			target, beforeID, limit)
 		if err != nil {
 			return nil, fmt.Errorf(
 				"query history: %w", err,
@@ -1331,10 +1135,10 @@ func (database *Database) queryHistory(
 		`SELECT id, uuid, command, msg_from,
 		   msg_to, params, body, meta, created_at
 		 FROM messages
-		 WHERE to_channel_id = ? AND id < ?
+		 WHERE msg_to = ?
 		   AND command = 'PRIVMSG'
 		 ORDER BY id DESC LIMIT ?`,
-		toChannelID, beforeID, limit)
+		target, limit)
 	if err != nil {
 		return nil, fmt.Errorf("query history: %w", err)
 	}
@@ -1446,175 +1250,38 @@ func (database *Database) SetTopic(
 	return nil
 }
 
-// QuitSession ends a session in one transaction: it parts
+// DeleteSession removes a session and all its data.
-// the session from its channels, deleting each channel this
+func (database *Database) DeleteSession(
-// leaves with no members, deletes the session with its
-// clients, and stores a QUIT from nick with body and queues
-// it to the other sessions that were on those channels. It
-// returns those sessions, for the caller to wake once the
-// QUIT is committed. Of several calls for one session at
-// once, only the first finds the session; the others change
-// nothing and return none.
-func (database *Database) QuitSession(
 	ctx context.Context,
 	sessionID int64,
-	nick string,
+) error {
-	body json.RawMessage,
+	_, err := database.conn.ExecContext(
-) ([]int64, error) {
+		ctx,
-	transaction, err := database.conn.BeginTx(ctx, nil)
+		"DELETE FROM sessions WHERE id = ?",
-	if err != nil {
-		return nil, fmt.Errorf("begin quit: %w", err)
-	}
-
-	defer func() { _ = transaction.Rollback() }()
-
-	peerIDs, err := quitSessionInTx(
-		ctx, transaction, sessionID, nick, body,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	err = transaction.Commit()
-	if err != nil {
-		return nil, fmt.Errorf("commit quit: %w", err)
-	}
-
-	return peerIDs, nil
-}
-
-// LogoutClient deletes a client of a session and, if that
-// leaves the session with no clients, does what QuitSession
-// does, in one transaction. It returns what QuitSession
-// returns, or none if the session keeps a client.
-func (database *Database) LogoutClient(
-	ctx context.Context,
-	sessionID, clientID int64,
-	nick string,
-	body json.RawMessage,
-) ([]int64, error) {
-	transaction, err := database.conn.BeginTx(ctx, nil)
-	if err != nil {
-		return nil, fmt.Errorf("begin logout: %w", err)
-	}
-
-	defer func() { _ = transaction.Rollback() }()
-
-	_, err = transaction.ExecContext(ctx,
-		"DELETE FROM clients WHERE id = ?", clientID)
-	if err != nil {
-		return nil, fmt.Errorf("delete client: %w", err)
-	}
-
-	var remaining int64
-
-	err = transaction.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM clients WHERE session_id = ?",
 		sessionID,
-	).Scan(&remaining)
-	if err != nil {
-		return nil, fmt.Errorf("count clients: %w", err)
-	}
-
-	var peerIDs []int64
-
-	if remaining == 0 {
-		peerIDs, err = quitSessionInTx(
-			ctx, transaction, sessionID, nick, body,
 	)
 	if err != nil {
-			return nil, err
+		return fmt.Errorf("delete session: %w", err)
-		}
 	}
 
-	err = transaction.Commit()
+	return nil
-	if err != nil {
-		return nil, fmt.Errorf("commit logout: %w", err)
-	}
-
-	return peerIDs, nil
 }
 
-// quitSessionInTx is QuitSession, writing through
+// DeleteClient removes a single client record by ID.
-// transaction.
+func (database *Database) DeleteClient(
-func quitSessionInTx(
 	ctx context.Context,
-	transaction *sql.Tx,
+	clientID int64,
-	sessionID int64,
+) error {
-	nick string,
+	_, err := database.conn.ExecContext(
-	body json.RawMessage,
+		ctx,
-) ([]int64, error) {
+		"DELETE FROM clients WHERE id = ?",
-	rows, err := transaction.QueryContext(ctx,
+		clientID,
-		`SELECT DISTINCT session_id FROM channel_members
-		 WHERE session_id != ? AND channel_id IN
-		 (SELECT channel_id FROM channel_members
-		  WHERE session_id = ?)`,
-		sessionID, sessionID)
-	if err != nil {
-		return nil, fmt.Errorf("get channel peers: %w", err)
-	}
-
-	peerIDs, err := scanInt64s(rows)
-	if err != nil {
-		return nil, err
-	}
-
-	rows, err = transaction.QueryContext(ctx,
-		`SELECT channel_id FROM channel_members
-		 WHERE session_id = ?`, sessionID)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"get session channel ids: %w", err,
-		)
-	}
-
-	channelIDs, err := scanInt64s(rows)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, channelID := range channelIDs {
-		err = partChannelAndDeleteIfEmptyInTx(
-			ctx, transaction, channelID, sessionID,
 	)
 	if err != nil {
-			return nil, err
+		return fmt.Errorf("delete client: %w", err)
-		}
 	}
 
-	result, err := transaction.ExecContext(ctx,
+	return nil
-		"DELETE FROM sessions WHERE id = ?", sessionID)
-	if err != nil {
-		return nil, fmt.Errorf("delete session: %w", err)
-	}
-
-	deletedRows, err := result.RowsAffected()
-	if err != nil {
-		return nil, fmt.Errorf("delete session: %w", err)
-	}
-
-	if deletedRows == 0 || len(peerIDs) == 0 {
-		return nil, nil
-	}
-
-	messageID, _, err := insertMessageInTx(
-		ctx, transaction, irc.CmdQuit, nick, "", 0, 0,
-		nil, body, nil,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, peerID := range peerIDs {
-		err = enqueueToSessionInTx(
-			ctx, transaction, peerID, messageID, 0,
-		)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return peerIDs, nil
 }
 
 // GetUserCount returns the number of active users.
@@ -1656,6 +1323,29 @@ func (database *Database) GetOperCount(
 	return count, nil
 }
 
+// ClientCountForSession returns the number of clients
+// belonging to a session.
+func (database *Database) ClientCountForSession(
+	ctx context.Context,
+	sessionID int64,
+) (int64, error) {
+	var count int64
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		`SELECT COUNT(*) FROM clients
+		 WHERE session_id = ?`,
+		sessionID,
+	).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"client count for session: %w", err,
+		)
+	}
+
+	return count, nil
+}
+
 // DeleteStaleUsers removes clients not seen since the
 // cutoff and cleans up orphaned users (sessions).
 func (database *Database) DeleteStaleUsers(
@@ -1792,6 +1482,57 @@ type ChannelInfoFull struct {
 	MemberCount int64  `json:"memberCount"`
 }
 
+// ListAllChannelsWithCounts returns every channel
+// with its member count.
+func (database *Database) ListAllChannelsWithCounts(
+	ctx context.Context,
+) ([]ChannelInfoFull, error) {
+	rows, err := database.conn.QueryContext(ctx,
+		`SELECT c.id, c.name, c.topic,
+		   COUNT(cm.session_id) AS member_count
+		 FROM channels c
+		 LEFT JOIN channel_members cm
+		   ON cm.channel_id = c.id
+		 GROUP BY c.id
+		 ORDER BY c.name`)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"list channels with counts: %w", err,
+		)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var out []ChannelInfoFull
+
+	for rows.Next() {
+		var chanInfo ChannelInfoFull
+
+		err = rows.Scan(
+			&chanInfo.ID, &chanInfo.Name,
+			&chanInfo.Topic, &chanInfo.MemberCount,
+		)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"scan channel full: %w", err,
+			)
+		}
+
+		out = append(out, chanInfo)
+	}
+
+	err = rows.Err()
+	if err != nil {
+		return nil, fmt.Errorf("rows error: %w", err)
+	}
+
+	if out == nil {
+		out = []ChannelInfoFull{}
+	}
+
+	return out, nil
+}
+
 // GetChannelCreatedAt returns the creation time of a
 // channel.
 func (database *Database) GetChannelCreatedAt(
@@ -2077,33 +1818,45 @@ func (database *Database) SetChannelHashcashBits(
 }
 
 // RecordSpentHashcash stores a spent hashcash stamp hash
-// for replay prevention. It returns false when the hash was
+// for replay prevention.
-// already stored. The one INSERT is both the check and the
-// record, so of several concurrent callers with the same
-// hash exactly one gets true.
 func (database *Database) RecordSpentHashcash(
 	ctx context.Context,
 	stampHash string,
-) (bool, error) {
+) error {
-	res, err := database.conn.ExecContext(ctx,
+	_, err := database.conn.ExecContext(ctx,
 		`INSERT OR IGNORE INTO spent_hashcash
 		 (stamp_hash, created_at)
 		 VALUES (?, ?)`,
 		stampHash, time.Now())
 	if err != nil {
-		return false, fmt.Errorf(
+		return fmt.Errorf(
 			"record spent hashcash: %w", err,
 		)
 	}
 
-	inserted, err := res.RowsAffected()
+	return nil
+}
+
+// IsHashcashSpent checks whether a hashcash stamp hash
+// has already been used.
+func (database *Database) IsHashcashSpent(
+	ctx context.Context,
+	stampHash string,
+) (bool, error) {
+	var count int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM spent_hashcash
+		 WHERE stamp_hash = ?`,
+		stampHash,
+	).Scan(&count)
 	if err != nil {
 		return false, fmt.Errorf(
-			"record spent hashcash: %w", err,
+			"check spent hashcash: %w", err,
 		)
 	}
 
-	return inserted > 0, nil
+	return count > 0, nil
 }
 
 // PruneSpentHashcash deletes spent hashcash tokens older
@@ -2372,6 +2125,45 @@ func (database *Database) AddChannelInvite(
 	return nil
 }
 
+// HasChannelInvite checks if a session has been invited
+// to a channel.
+func (database *Database) HasChannelInvite(
+	ctx context.Context,
+	channelID, sessionID int64,
+) (bool, error) {
+	var count int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM channel_invites
+		 WHERE channel_id = ? AND session_id = ?`,
+		channelID, sessionID,
+	).Scan(&count)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check invite: %w", err,
+		)
+	}
+
+	return count > 0, nil
+}
+
+// ClearChannelInvite removes a session's invite to a
+// channel (called after successful JOIN).
+func (database *Database) ClearChannelInvite(
+	ctx context.Context,
+	channelID, sessionID int64,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		`DELETE FROM channel_invites
+		 WHERE channel_id = ? AND session_id = ?`,
+		channelID, sessionID)
+	if err != nil {
+		return fmt.Errorf("clear invite: %w", err)
+	}
+
+	return nil
+}
+
 // --- Tier 2: Secret (+s) ---
 
 // IsChannelSecret checks if a channel has +s mode.

internal/db/queries_test.go

@@ -2,7 +2,6 @@ package db_test
 
 import (
 	"encoding/json"
-	"slices"
 	"testing"
 
 	"sneak.berlin/go/neoirc/internal/db"
@@ -13,7 +12,7 @@ import (
 func setupTestDB(t *testing.T) *db.Database {
 	t.Helper()
 
-	database, err := db.NewTestDatabase(t)
+	database, err := db.NewTestDatabase()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -125,7 +124,7 @@ func TestCreateSessionStoresIP(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	sessionID, _, _, err := database.CreateSession(
+	sessionID, clientID, _, err := database.CreateSession(
 		ctx, "ipuser", "ident", "host.example.com",
 		"192.168.1.42",
 	)
@@ -147,8 +146,8 @@ func TestCreateSessionStoresIP(t *testing.T) {
 		)
 	}
 
-	clientInfo, err := database.GetLatestClientForSession(
+	clientInfo, err := database.GetClientHostInfo(
-		ctx, sessionID,
+		ctx, clientID,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -169,6 +168,19 @@ func TestCreateSessionStoresIP(t *testing.T) {
 	}
 }
 
+func TestGetClientHostInfoNotFound(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+
+	_, err := database.GetClientHostInfo(
+		t.Context(), 99999,
+	)
+	if err == nil {
+		t.Fatal("expected error for nonexistent client")
+	}
+}
+
 func TestGetSessionHostInfoNotFound(t *testing.T) {
 	t.Parallel()
 
@@ -399,7 +411,7 @@ func TestJoinAndPart(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sid)
+	err = database.PartChannel(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -410,10 +422,7 @@ func TestJoinAndPart(t *testing.T) {
 	}
 }
 
-// TestPartChannelAndDeleteIfEmpty checks that a part keeps
+func TestDeleteChannelIfEmpty(t *testing.T) {
-// a channel another session is still on and deletes the
-// channel when its last member parts.
-func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
@@ -426,13 +435,9 @@ func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	nicks := []string{"temp1", "temp2"}
+	sid, _, _, err := database.CreateSession(ctx, "temp", "", "", "")
-	sids := make([]int64, 0, len(nicks))
+	if err != nil {
-
+		t.Fatal(err)
-	for _, nick := range nicks {
-		sid, _, _, createErr := database.CreateSession(ctx, nick, "", "", "")
-		if createErr != nil {
-			t.Fatal(createErr)
 	}
 
 	err = database.JoinChannel(ctx, chID, sid)
@@ -440,20 +445,12 @@ func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-		sids = append(sids, sid)
+	err = database.PartChannel(ctx, chID, sid)
-	}
-
-	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sids[0])
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	_, err = database.GetChannelByName(ctx, "#empty")
+	err = database.DeleteChannelIfEmpty(ctx, chID)
-	if err != nil {
-		t.Fatalf("channel deleted while a member is on it: %v", err)
-	}
-
-	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sids[1])
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -622,7 +619,7 @@ func TestInsertMessage(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, msgUUID, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", 0, 0, nil, body, nil,
+		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -656,13 +653,13 @@ func TestPollMessages(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", 0, 0, nil, body, nil,
+		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.EnqueueToSession(ctx, sid, dbID, 0)
+	err = database.EnqueueToSession(ctx, sid, dbID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -709,16 +706,11 @@ func TestGetHistory(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	chID, err := database.GetOrCreateChannel(ctx, "#hist")
-	if err != nil {
-		t.Fatal(err)
-	}
-
 	const msgCount = 10
 
 	for range msgCount {
-		_, _, err = database.InsertMessage(
+		_, _, err := database.InsertMessage(
-			ctx, "PRIVMSG", "user", "#hist", 0, chID,
+			ctx, "PRIVMSG", "user", "#hist",
 			nil, json.RawMessage(`["msg"]`), nil,
 		)
 		if err != nil {
@@ -729,7 +721,7 @@ func TestGetHistory(t *testing.T) {
 	const histLimit = 5
 
 	msgs, err := database.GetHistory(
-		ctx, 0, chID, "", histLimit,
+		ctx, "#hist", "", histLimit,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -745,209 +737,44 @@ func TestGetHistory(t *testing.T) {
 	}
 }
 
-// TestGetHistoryReusedNames checks that history follows the
+func TestDeleteSession(t *testing.T) {
-// session and the channel row, not the nick or the channel
-// name: a session that takes a released nick, and a channel
-// created again under a deleted one's name, start with none.
-func TestGetHistoryReusedNames(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	historyLen := func(toSessionID, toChannelID int64) int {
+	sid, _, _, err := database.CreateSession(
-		t.Helper()
+		ctx, "deleteme", "", "", "",
-
-		msgs, err := database.GetHistory(
-			ctx, toSessionID, toChannelID, "", 0,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-		return len(msgs)
+	chID, err := database.GetOrCreateChannel(
-	}
+		ctx, "#delchan",
-
-	oldSID, _, _, err := database.CreateSession(
-		ctx, "reused", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	oldChID, err := database.GetOrCreateChannel(ctx, "#reused")
+	err = database.JoinChannel(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.JoinChannel(ctx, oldChID, oldSID)
+	err = database.DeleteSession(ctx, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	body := json.RawMessage(`["hi"]`)
-
-	_, _, err = database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "reused", oldSID, 0,
-		nil, body, nil,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, _, err = database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "#reused", 0, oldChID,
-		nil, body, nil,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if historyLen(oldSID, 0) != 1 || historyLen(0, oldChID) != 1 {
-		t.Fatal("expected one DM and one channel message")
-	}
-
-	// The session is the channel's only member, so quitting
-	// deletes the channel too.
-	_, err = database.QuitSession(ctx, oldSID, "reused", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	newSID, _, _, err := database.CreateSession(
-		ctx, "reused", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	newChID, err := database.GetOrCreateChannel(ctx, "#reused")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if historyLen(newSID, 0) != 0 || historyLen(0, newChID) != 0 {
-		t.Fatal("expected no history for the names' new holders")
-	}
-}
-
-// TestQuitSession checks that QuitSession deletes the
-// session, keeps a channel another session is still on,
-// deletes a channel it leaves with no members, and queues
-// one QUIT to the other session; and that a second call for
-// the same session changes nothing.
-func TestQuitSession(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sid, sharedID, _ := createSessionWithChannels(
-		t, database, "deleteme", "#shared", "#alone",
-	)
-
-	peerSID, peerClientID, _, err := database.CreateSession(
-		ctx, "peer", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = database.JoinChannel(ctx, sharedID, peerSID)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	body := json.RawMessage(`["bye"]`)
-
-	peerIDs, err := database.QuitSession(ctx, sid, "deleteme", body)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !slices.Equal(peerIDs, []int64{peerSID}) {
-		t.Fatalf("got peers %v, want [%d]", peerIDs, peerSID)
-	}
-
 	_, err = database.GetSessionByNick(ctx, "deleteme")
 	if err == nil {
 		t.Fatal("session should be deleted")
 	}
 
-	ids, _ := database.GetChannelMemberIDs(ctx, sharedID)
+	ids, _ := database.GetChannelMemberIDs(ctx, chID)
-	if !slices.Equal(ids, []int64{peerSID}) {
+	if len(ids) != 0 {
-		t.Fatalf("#shared members: got %v, want [%d]", ids, peerSID)
+		t.Fatal("expected no members after deletion")
-	}
-
-	_, err = database.GetChannelByName(ctx, "#alone")
-	if err == nil {
-		t.Fatal("expected the emptied channel to be deleted")
-	}
-
-	checkOneQuitQueued(t, database, peerClientID, "deleteme")
-
-	peerIDs, err = database.QuitSession(ctx, sid, "deleteme", body)
-	if err != nil || len(peerIDs) != 0 {
-		t.Fatalf("second quit: got %v, %v; want none", peerIDs, err)
-	}
-
-	checkOneQuitQueued(t, database, peerClientID, "deleteme")
-}
-
-// checkOneQuitQueued fails the test unless the queue of the
-// client clientID holds one message, a QUIT from nick.
-func checkOneQuitQueued(
-	t *testing.T,
-	database *db.Database,
-	clientID int64,
-	nick string,
-) {
-	t.Helper()
-
-	msgs, _, err := database.PollMessages(t.Context(), clientID, 0, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(msgs) != 1 || msgs[0].Command != "QUIT" || msgs[0].From != nick {
-		t.Fatalf("queue: got %v, want one QUIT from %s", msgs, nick)
-	}
-}
-
-// TestLogoutClientFailureKeepsClient checks that when the
-// session of a logout's last client cannot be deleted,
-// LogoutClient fails and the client stays logged in.
-func TestLogoutClientFailureKeepsClient(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sid, clientID, token, err := database.CreateSession(
-		ctx, "stuck", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = database.GetDB().ExecContext(ctx,
-		`CREATE TRIGGER keep_sessions
-		 BEFORE DELETE ON sessions
-		 BEGIN
-		   SELECT RAISE(ABORT, 'sessions are kept');
-		 END`)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = database.LogoutClient(ctx, sid, clientID, "stuck", nil)
-	if err == nil {
-		t.Fatal("logout succeeded although the session was kept")
-	}
-
-	_, _, nick, err := database.GetSessionByToken(ctx, token)
-	if err != nil || nick != "stuck" {
-		t.Fatalf("client gone after a failed logout: %q, %v", nick, err)
 	}
 }
 
@@ -1036,7 +863,7 @@ func TestEnqueueToClient(t *testing.T) {
 	body := json.RawMessage(`["test"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "#ch", 0, 0, nil, body, nil,
+		ctx, "PRIVMSG", "sender", "#ch", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -1426,6 +1253,17 @@ func TestChannelInviteCRUD(t *testing.T) {
 	if !has {
 		t.Fatal("should have invite")
 	}
+
+	// Clear invite.
+	err = database.ClearChannelInvite(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	has, _ = database.HasChannelInvite(ctx, chID, sid)
+	if has {
+		t.Fatal("invite should be cleared")
+	}
 }
 
 func TestChannelSecret(t *testing.T) {

internal/db/schema/001_initial.sql

@@ -85,25 +85,19 @@ CREATE TABLE IF NOT EXISTS channel_members (
     UNIQUE(channel_id, session_id)
 );
 
--- Messages: IRC envelope format. to_session_id is the session a DM
+-- Messages: IRC envelope format
--- or INVITE was sent to, to_channel_id the channel a channel message
--- was sent to. History is selected by these ids because nicks and
--- channel names are reused once released, and ids are not.
 CREATE TABLE IF NOT EXISTS messages (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     uuid TEXT NOT NULL UNIQUE,
     command TEXT NOT NULL DEFAULT 'PRIVMSG',
     msg_from TEXT NOT NULL DEFAULT '',
     msg_to TEXT NOT NULL DEFAULT '',
-    to_session_id INTEGER REFERENCES sessions(id) ON DELETE SET NULL,
-    to_channel_id INTEGER REFERENCES channels(id) ON DELETE SET NULL,
     params TEXT NOT NULL DEFAULT '[]',
     body TEXT NOT NULL DEFAULT '[]',
     meta TEXT NOT NULL DEFAULT '{}',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
-CREATE INDEX IF NOT EXISTS idx_messages_to_session ON messages(to_session_id, id);
+CREATE INDEX IF NOT EXISTS idx_messages_to_id ON messages(msg_to, id);
-CREATE INDEX IF NOT EXISTS idx_messages_to_channel ON messages(to_channel_id, id);
 CREATE INDEX IF NOT EXISTS idx_messages_created ON messages(created_at);
 
 -- Spent hashcash tokens for replay prevention (1-year TTL)

internal/db/testing.go

@@ -0,0 +1,25 @@
+package db
+
+import (
+	"context"
+	"database/sql"
+	"log/slog"
+)
+
+// NewTestDatabaseFromConn creates a Database wrapping an
+// existing *sql.DB connection.  Intended for integration
+// tests in other packages.
+func NewTestDatabaseFromConn(conn *sql.DB) *Database {
+	return &Database{ //nolint:exhaustruct
+		conn: conn,
+		log:  slog.Default(),
+	}
+}
+
+// RunMigrations applies all schema migrations.  Exposed
+// for integration tests in other packages.
+func (database *Database) RunMigrations(
+	ctx context.Context,
+) error {
+	return database.runMigrations(ctx)
+}

internal/dbtest/dbtest.go

@@ -1,59 +0,0 @@
-// Package dbtest gives each test a database of its own and runs raw
-// SQL on it. Only tests may import it.
-package dbtest
-
-import (
-	"crypto/rand"
-	"database/sql"
-	"testing"
-
-	_ "modernc.org/sqlite" // registers the sqlite driver
-)
-
-// NewURL returns the URL of a new, empty in-memory database for one
-// test. SQLite deletes an in-memory database when its last connection
-// closes. A pool closes a connection when a query on it is cancelled
-// while it runs. So this function holds a connection of its own open
-// until the test ends.
-func NewURL(tb testing.TB) string {
-	tb.Helper()
-
-	// A random name, so that no other test can share the database.
-	dbURL := "file:" + rand.Text() + "?mode=memory&cache=shared"
-
-	pool, err := sql.Open("sqlite", dbURL)
-	if err != nil {
-		tb.Fatalf("open test database: %v", err)
-	}
-
-	tb.Cleanup(func() { _ = pool.Close() })
-
-	conn, err := pool.Conn(tb.Context())
-	if err != nil {
-		tb.Fatalf("connect to test database: %v", err)
-	}
-
-	tb.Cleanup(func() { _ = conn.Close() })
-
-	return dbURL
-}
-
-// Exec runs one raw SQL statement on the database at dbURL, over a
-// connection of its own. A test uses it for what the methods of
-// db.Database cannot do, such as creating a trigger that makes a
-// write fail.
-func Exec(tb testing.TB, dbURL, statement string) {
-	tb.Helper()
-
-	pool, err := sql.Open("sqlite", dbURL)
-	if err != nil {
-		tb.Fatalf("open test database: %v", err)
-	}
-
-	defer func() { _ = pool.Close() }()
-
-	_, err = pool.ExecContext(tb.Context(), statement)
-	if err != nil {
-		tb.Fatalf("run %q: %v", statement, err)
-	}
-}

internal/handlers/api.go

@@ -15,10 +15,20 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/hashcash"
 	"sneak.berlin/go/neoirc/internal/service"
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
+var (
+	errHashcashRequired = errors.New("hashcash required")
+	errHashcashReused   = errors.New("hashcash reused")
+)
+
+var validNickRe = regexp.MustCompile(
+	`^[a-zA-Z_][a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{0,31}$`,
+)
+
 var validUsernameRe = regexp.MustCompile(
 	`^[a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{1,32}$`,
 )
@@ -42,9 +52,25 @@ func (hdlr *Handlers) maxBodySize() int64 {
 	return defaultMaxBodySize
 }
 
-// clientIP returns the IP address in request.RemoteAddr, which the
+// clientIP extracts the connecting client's IP address
-// ClientIP middleware has set to the client's address.
+// from the request, checking X-Forwarded-For and
+// X-Real-IP headers before falling back to RemoteAddr.
 func clientIP(request *http.Request) string {
+	if forwarded := request.Header.Get("X-Forwarded-For"); forwarded != "" {
+		// X-Forwarded-For can contain a comma-separated list;
+		// the first entry is the original client.
+		parts := strings.SplitN(forwarded, ",", 2) //nolint:mnd
+		ip := strings.TrimSpace(parts[0])
+
+		if ip != "" {
+			return ip
+		}
+	}
+
+	if realIP := request.Header.Get("X-Real-IP"); realIP != "" {
+		return strings.TrimSpace(realIP)
+	}
+
 	host, _, err := net.SplitHostPort(request.RemoteAddr)
 	if err != nil {
 		return request.RemoteAddr
@@ -172,7 +198,7 @@ func (hdlr *Handlers) handleCreateSession(
 
 	var payload createRequest
 
-	err := decodeJSON(request, &payload)
+	err := json.NewDecoder(request.Body).Decode(&payload)
 	if err != nil {
 		hdlr.respondError(
 			writer, request,
@@ -183,7 +209,7 @@ func (hdlr *Handlers) handleCreateSession(
 		return
 	}
 
-	if !hdlr.checkHashcash(
+	if !hdlr.validateHashcash(
 		writer, request, payload.Hashcash,
 	) {
 		return
@@ -191,7 +217,7 @@ func (hdlr *Handlers) handleCreateSession(
 
 	payload.Nick = strings.TrimSpace(payload.Nick)
 
-	if !service.ValidNick(payload.Nick) {
+	if !validNickRe.MatchString(payload.Nick) {
 		hdlr.respondError(
 			writer, request,
 			"invalid nick format",
@@ -216,15 +242,14 @@ func (hdlr *Handlers) handleCreateSession(
 	}
 
 	hdlr.executeCreateSession(
-		writer, request,
+		writer, request, payload.Nick, username,
-		payload.Nick, username, payload.Hashcash,
 	)
 }
 
 func (hdlr *Handlers) executeCreateSession(
 	writer http.ResponseWriter,
 	request *http.Request,
-	nick, username, stamp string,
+	nick, username string,
 ) {
 	remoteIP := clientIP(request)
 
@@ -232,17 +257,12 @@ func (hdlr *Handlers) executeCreateSession(
 		request.Context(), remoteIP,
 	)
 
-	if !hdlr.claimHashcash(writer, request, stamp) {
-		return
-	}
-
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.CreateSession(
 			request.Context(),
 			nick, username, hostname, remoteIP,
 		)
 	if err != nil {
-		hdlr.hashcashVal.Release(stamp)
 		hdlr.handleCreateSessionError(
 			writer, request, err,
 		)
@@ -263,10 +283,10 @@ func (hdlr *Handlers) executeCreateSession(
 	}, http.StatusCreated)
 }
 
-// checkHashcash checks a hashcash stamp if required,
+// validateHashcash validates a hashcash stamp if required.
-// without spending it. Returns false if the check failed
+// Returns false if validation failed and a response was
-// and a response was already sent.
+// already sent.
-func (hdlr *Handlers) checkHashcash(
+func (hdlr *Handlers) validateHashcash(
 	writer http.ResponseWriter,
 	request *http.Request,
 	stamp string,
@@ -285,31 +305,7 @@ func (hdlr *Handlers) checkHashcash(
 		return false
 	}
 
-	err := hdlr.hashcashVal.Check(
+	err := hdlr.hashcashVal.Validate(
-		stamp, hdlr.params.Config.HashcashBits,
-	)
-	if err != nil {
-		hdlr.respondError(
-			writer, request,
-			"invalid hashcash stamp: "+err.Error(),
-			http.StatusPaymentRequired,
-		)
-
-		return false
-	}
-
-	return true
-}
-
-// claimHashcash spends a stamp that checkHashcash accepted.
-// Returns false if Claim refused the stamp, normally because
-// it was already spent, and a response was already sent.
-func (hdlr *Handlers) claimHashcash(
-	writer http.ResponseWriter,
-	request *http.Request,
-	stamp string,
-) bool {
-	err := hdlr.hashcashVal.Claim(
 		stamp, hdlr.params.Config.HashcashBits,
 	)
 	if err != nil {
@@ -396,7 +392,7 @@ func (hdlr *Handlers) deliverWelcome(
 	// 004 RPL_MYINFO
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplMyInfo, nick,
-		[]string{srvName, version, service.UserModes, "Hbiklmnostv"},
+		[]string{srvName, version, "", "ikmnostl"},
 		"",
 	)
 
@@ -580,7 +576,7 @@ func (hdlr *Handlers) enqueueNumeric(
 	}
 
 	dbID, _, insertErr := hdlr.params.Database.InsertMessage(
-		ctx, command, hdlr.serverName(), nick, 0, 0,
+		ctx, command, hdlr.serverName(), nick,
 		paramsJSON, json.RawMessage(body), nil,
 	)
 	if insertErr != nil {
@@ -666,7 +662,7 @@ func (hdlr *Handlers) initChannelState(
 		dbID, _, insErr := hdlr.params.Database.
 			InsertMessage(
 				ctx, "JOIN", nick, chanInfo.Name,
-				0, chanInfo.ID, nil, nil, nil,
+				nil, nil, nil,
 			)
 		if insErr != nil {
 			hdlr.log.Error(
@@ -797,14 +793,7 @@ func (hdlr *Handlers) HandleGetMessages() http.HandlerFunc {
 			timeout = maxLongPollTimeout
 		}
 
-		// Register with the broker before reading the queue.
+		msgs, lastQID, err := hdlr.params.Database.PollMessages(
-		// Notify wakes only the channels registered at that
-		// moment, so a message queued after the read below
-		// must find this one there already.
-		waitCh := hdlr.broker.Wait(sessionID)
-		defer hdlr.broker.Remove(sessionID, waitCh)
-
-		msgs, lastQID, err := hdlr.pollMessages(
 			request.Context(), clientID,
 			afterID, pollMessageLimit,
 		)
@@ -832,22 +821,19 @@ func (hdlr *Handlers) HandleGetMessages() http.HandlerFunc {
 
 		hdlr.longPoll(
 			writer, request,
-			waitCh, clientID, afterID, timeout,
+			sessionID, clientID, afterID, timeout,
 		)
 	}
 }
 
-// longPoll waits up to timeout seconds for the broker to
-// signal waitCh, then answers with the messages queued for
-// clientID after afterID. It answers nothing if the client
-// goes away first.
 func (hdlr *Handlers) longPoll(
 	writer http.ResponseWriter,
 	request *http.Request,
-	waitCh <-chan struct{},
+	sessionID, clientID, afterID int64,
-	clientID, afterID int64,
 	timeout int,
 ) {
+	waitCh := hdlr.broker.Wait(sessionID)
+
 	timer := time.NewTimer(
 		time.Duration(timeout) * time.Second,
 	)
@@ -858,10 +844,14 @@ func (hdlr *Handlers) longPoll(
 	case <-waitCh:
 	case <-timer.C:
 	case <-request.Context().Done():
+		hdlr.broker.Remove(sessionID, waitCh)
+
 		return
 	}
 
-	msgs, lastQID, err := hdlr.pollMessages(
+	hdlr.broker.Remove(sessionID, waitCh)
+
+	msgs, lastQID, err := hdlr.params.Database.PollMessages(
 		request.Context(), clientID,
 		afterID, pollMessageLimit,
 	)
@@ -909,7 +899,7 @@ func (hdlr *Handlers) HandleSendCommand() http.HandlerFunc {
 
 		var payload commandRequest
 
-		err := decodeJSON(request, &payload)
+		err := json.NewDecoder(request.Body).Decode(&payload)
 		if err != nil {
 			hdlr.respondError(
 				writer, request,
@@ -978,7 +968,7 @@ func (hdlr *Handlers) dispatchCommand(
 		hdlr.handlePrivmsg(
 			writer, request,
 			sessionID, clientID, nick,
-			command, target, body, meta,
+			command, target, body, meta, bodyLines,
 		)
 	case irc.CmdJoin:
 		hdlr.handleJoin(
@@ -1123,18 +1113,8 @@ func (hdlr *Handlers) handlePrivmsg(
 	nick, command, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
+	bodyLines func() []string,
 ) {
-	lines, ok := checkBodyAndMeta(body, meta)
-	if !ok {
-		hdlr.respondError(
-			writer, request,
-			"invalid request body",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
 	if target == "" {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
@@ -1149,6 +1129,7 @@ func (hdlr *Handlers) handlePrivmsg(
 		return
 	}
 
+	lines := bodyLines()
 	if len(lines) == 0 {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
@@ -1182,44 +1163,6 @@ func (hdlr *Handlers) handlePrivmsg(
 	)
 }
 
-// checkBodyAndMeta returns the lines in body. It returns false
-// when body is present and is not an array of strings, or meta
-// is present and is not an object. Each line is decoded as any
-// because decoding into []string turns a null line into "". A
-// null body or meta decodes without an error into nil.
-func checkBodyAndMeta(body, meta json.RawMessage) ([]string, bool) {
-	var lines []string
-
-	if body != nil {
-		var values []any
-
-		err := json.Unmarshal(body, &values)
-		if err != nil || values == nil {
-			return nil, false
-		}
-
-		for _, value := range values {
-			line, isString := value.(string)
-			if !isString {
-				return nil, false
-			}
-
-			lines = append(lines, line)
-		}
-	}
-
-	if meta != nil {
-		var fields map[string]any
-
-		err := json.Unmarshal(meta, &fields)
-		if err != nil || fields == nil {
-			return nil, false
-		}
-	}
-
-	return lines, true
-}
-
 // respondIRCError enqueues a numeric error reply, notifies
 // the broker, and sends HTTP 200 with {"status":"error"}.
 func (hdlr *Handlers) respondIRCError(
@@ -1288,11 +1231,26 @@ func (hdlr *Handlers) handleChannelMsg(
 ) {
 	ctx := request.Context()
 
-	// Delegate validation + fan-out to service layer. The
+	// Hashcash validation is HTTP-specific; needs chID.
-	// fan-out includes the sender's own session, so all
+	isNotice := command == irc.CmdNotice
-	// their clients see the message in long-poll responses.
+
-	uuid, err := hdlr.svc.SendChannelMessage(
+	if !isNotice {
-		ctx, sessionID, 0, nick,
+		chID, chErr := hdlr.params.Database.
+			GetChannelByName(ctx, target)
+		if chErr == nil {
+			hashcashErr := hdlr.validateChannelHashcash(
+				request, clientID, sessionID,
+				writer, nick, target, body, meta, chID,
+			)
+			if hashcashErr != nil {
+				return
+			}
+		}
+	}
+
+	// Delegate validation + fan-out to service layer.
+	dbID, uuid, err := hdlr.svc.SendChannelMessage(
+		ctx, sessionID, nick,
 		command, target, body, meta,
 	)
 	if hdlr.handleServiceError(
@@ -1302,11 +1260,172 @@ func (hdlr *Handlers) handleChannelMsg(
 		return
 	}
 
+	// HTTP echo: enqueue to sender so all their clients
+	// see the message in long-poll responses.
+	_ = hdlr.params.Database.EnqueueToSession(
+		ctx, sessionID, dbID,
+	)
+	hdlr.broker.Notify(sessionID)
+
 	hdlr.respondJSON(writer, request,
 		map[string]string{"id": uuid, statusKey: "sent"},
 		http.StatusOK)
 }
 
+// validateChannelHashcash checks whether the channel
+// requires hashcash proof-of-work for messages and
+// validates the stamp from the message meta field.
+// Returns nil on success or if the channel has no
+// hashcash requirement. On failure, it sends the
+// appropriate IRC error and returns a non-nil error.
+func (hdlr *Handlers) validateChannelHashcash(
+	request *http.Request,
+	clientID, sessionID int64,
+	writer http.ResponseWriter,
+	nick, target string,
+	body json.RawMessage,
+	meta json.RawMessage,
+	chID int64,
+) error {
+	ctx := request.Context()
+
+	bits, bitsErr := hdlr.params.Database.GetChannelHashcashBits(
+		ctx, chID,
+	)
+	if bitsErr != nil {
+		hdlr.log.Error(
+			"get channel hashcash bits", "error", bitsErr,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return fmt.Errorf("channel hashcash bits: %w", bitsErr)
+	}
+
+	if bits <= 0 {
+		return nil
+	}
+
+	stamp := hdlr.extractHashcashFromMeta(meta)
+	if stamp == "" {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrCannotSendToChan, nick, []string{target},
+			"Channel requires hashcash proof-of-work",
+		)
+
+		return errHashcashRequired
+	}
+
+	return hdlr.verifyChannelStamp(
+		request, writer,
+		clientID, sessionID,
+		nick, target, body, stamp, bits,
+	)
+}
+
+// verifyChannelStamp validates a channel hashcash stamp
+// and checks for replay attacks.
+func (hdlr *Handlers) verifyChannelStamp(
+	request *http.Request,
+	writer http.ResponseWriter,
+	clientID, sessionID int64,
+	nick, target string,
+	body json.RawMessage,
+	stamp string,
+	bits int,
+) error {
+	ctx := request.Context()
+	bodyHashStr := hashcash.BodyHash(body)
+
+	valErr := hdlr.channelHashcash.ValidateStamp(
+		stamp, bits, target, bodyHashStr,
+	)
+	if valErr != nil {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrCannotSendToChan, nick, []string{target},
+			"Invalid hashcash: "+valErr.Error(),
+		)
+
+		return fmt.Errorf("channel hashcash: %w", valErr)
+	}
+
+	stampKey := hashcash.StampHash(stamp)
+
+	spent, spentErr := hdlr.params.Database.IsHashcashSpent(
+		ctx, stampKey,
+	)
+	if spentErr != nil {
+		hdlr.log.Error(
+			"check spent hashcash", "error", spentErr,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return fmt.Errorf("check spent hashcash: %w", spentErr)
+	}
+
+	if spent {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrCannotSendToChan, nick, []string{target},
+			"Hashcash stamp already used",
+		)
+
+		return errHashcashReused
+	}
+
+	recordErr := hdlr.params.Database.RecordSpentHashcash(
+		ctx, stampKey,
+	)
+	if recordErr != nil {
+		hdlr.log.Error(
+			"record spent hashcash", "error", recordErr,
+		)
+	}
+
+	return nil
+}
+
+// extractHashcashFromMeta parses the meta JSON and
+// returns the hashcash stamp string, or empty string
+// if not present.
+func (hdlr *Handlers) extractHashcashFromMeta(
+	meta json.RawMessage,
+) string {
+	if len(meta) == 0 {
+		return ""
+	}
+
+	var metaMap map[string]json.RawMessage
+
+	err := json.Unmarshal(meta, &metaMap)
+	if err != nil {
+		return ""
+	}
+
+	raw, ok := metaMap["hashcash"]
+	if !ok {
+		return ""
+	}
+
+	var stamp string
+
+	err = json.Unmarshal(raw, &stamp)
+	if err != nil {
+		return ""
+	}
+
+	return stamp
+}
+
 func (hdlr *Handlers) handleDirectMsg(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -1316,7 +1435,7 @@ func (hdlr *Handlers) handleDirectMsg(
 	meta json.RawMessage,
 ) {
 	result, err := hdlr.svc.SendDirectMessage(
-		request.Context(), sessionID, 0, nick,
+		request.Context(), sessionID, nick,
 		command, target, body, meta,
 	)
 	if hdlr.handleServiceError(
@@ -1387,7 +1506,7 @@ func (hdlr *Handlers) executeJoin(
 	nick, channel, suppliedKey string,
 ) {
 	result, err := hdlr.svc.JoinChannel(
-		request.Context(), sessionID, 0, nick,
+		request.Context(), sessionID, nick,
 		channel, suppliedKey,
 	)
 	if hdlr.handleServiceError(
@@ -1571,7 +1690,7 @@ func (hdlr *Handlers) handlePart(
 	}
 
 	err := hdlr.svc.PartChannel(
-		request.Context(), sessionID, 0,
+		request.Context(), sessionID,
 		nick, channel, reason,
 	)
 	if hdlr.handleServiceError(
@@ -1609,7 +1728,7 @@ func (hdlr *Handlers) handleNick(
 
 	newNick := strings.TrimSpace(lines[0])
 
-	if !service.ValidNick(newNick) {
+	if !validNickRe.MatchString(newNick) {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrErroneusNickname, nick, []string{newNick},
@@ -1642,7 +1761,7 @@ func (hdlr *Handlers) executeNickChange(
 	nick, newNick string,
 ) {
 	err := hdlr.svc.ChangeNick(
-		request.Context(), sessionID, 0, nick, newNick,
+		request.Context(), sessionID, nick, newNick,
 	)
 	if hdlr.handleServiceError(
 		writer, request,
@@ -1697,7 +1816,7 @@ func (hdlr *Handlers) handleTopic(
 	topic := strings.Join(lines, " ")
 
 	err := hdlr.svc.SetTopic(
-		request.Context(), sessionID, 0,
+		request.Context(), sessionID,
 		nick, channel, topic,
 	)
 	if hdlr.handleServiceError(
@@ -2183,7 +2302,7 @@ func (hdlr *Handlers) applyUserMode(
 
 	modeText := modeArgs[0] + " " + targetNick
 	hdlr.svc.BroadcastMode(
-		request.Context(), 0, nick, channel, chID,
+		request.Context(), nick, channel, chID,
 		modeText,
 	)
 
@@ -2229,7 +2348,7 @@ func (hdlr *Handlers) setChannelFlag(
 	}
 
 	hdlr.svc.BroadcastMode(
-		request.Context(), 0, nick, channel, chID,
+		request.Context(), nick, channel, chID,
 		modeStr,
 	)
 
@@ -2466,7 +2585,7 @@ func (hdlr *Handlers) executeBanChange(
 	)
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel, 0, chID,
+			request, irc.CmdMode, nick, channel,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2584,7 +2703,7 @@ func (hdlr *Handlers) setChannelKeyMode(
 	modeBody, mErr := json.Marshal([]string{"+k", key})
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel, 0, chID,
+			request, irc.CmdMode, nick, channel,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2633,7 +2752,7 @@ func (hdlr *Handlers) clearChannelKeyMode(
 	modeBody, mErr := json.Marshal([]string{"-k", "*"})
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel, 0, chID,
+			request, irc.CmdMode, nick, channel,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2708,7 +2827,7 @@ func (hdlr *Handlers) setChannelLimitMode(
 	)
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel, 0, chID,
+			request, irc.CmdMode, nick, channel,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2758,7 +2877,7 @@ func (hdlr *Handlers) clearChannelLimitMode(
 	modeBody, mErr := json.Marshal([]string{"-l"})
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
-			request, irc.CmdMode, nick, channel, 0, chID,
+			request, irc.CmdMode, nick, channel,
 			json.RawMessage(modeBody), memberIDs,
 		)
 	}
@@ -2795,15 +2914,123 @@ func (hdlr *Handlers) handleInvite(
 		channel = "#" + channel
 	}
 
+	chID, targetSID, ok := hdlr.validateInvite(
+		writer, request,
+		sessionID, clientID, nick,
+		targetNick, channel,
+	)
+	if !ok {
+		return
+	}
+
+	hdlr.executeInvite(
+		writer, request,
+		sessionID, clientID, nick,
+		targetNick, channel, chID, targetSID,
+	)
+}
+
+// validateInvite checks channel, membership, permissions,
+// and target for an INVITE command.
+func (hdlr *Handlers) validateInvite(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, targetNick, channel string,
+) (int64, int64, bool) {
 	ctx := request.Context()
 
-	targetSID, err := hdlr.svc.InviteUser(
+	chID, err := hdlr.params.Database.GetChannelByName(
-		ctx, sessionID, nick, targetNick, channel,
+		ctx, channel,
 	)
-	if hdlr.handleServiceError(
+	if err != nil {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoSuchChannel, nick,
+			[]string{channel}, "No such channel",
+		)
+
+		return 0, 0, false
+	}
+
+	isMember, memErr := hdlr.params.Database.IsChannelMember(
+		ctx, chID, sessionID,
+	)
+	if memErr != nil || !isMember {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNotOnChannel, nick,
+			[]string{channel},
+			"You're not on that channel",
+		)
+
+		return 0, 0, false
+	}
+
+	isInviteOnly, ioErr := hdlr.params.Database.
+		IsChannelInviteOnly(ctx, chID)
+	if ioErr == nil && isInviteOnly {
+		if !hdlr.requireChannelOp(
 			writer, request,
-		clientID, sessionID, nick, err,
+			sessionID, clientID, nick, channel, chID,
 		) {
+			return 0, 0, false
+		}
+	}
+
+	targetSID, nickErr := hdlr.params.Database.
+		GetSessionByNick(ctx, targetNick)
+	if nickErr != nil {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoSuchNick, nick,
+			[]string{targetNick},
+			"No such nick/channel",
+		)
+
+		return 0, 0, false
+	}
+
+	alreadyIn, aiErr := hdlr.params.Database.
+		IsChannelMember(ctx, chID, targetSID)
+	if aiErr == nil && alreadyIn {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrUserOnChannel, nick,
+			[]string{targetNick, channel},
+			"is already on channel",
+		)
+
+		return 0, 0, false
+	}
+
+	return chID, targetSID, true
+}
+
+// executeInvite records the invite and sends
+// notifications.
+func (hdlr *Handlers) executeInvite(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, targetNick, channel string,
+	chID, targetSID int64,
+) {
+	ctx := request.Context()
+
+	invErr := hdlr.params.Database.AddChannelInvite(
+		ctx, chID, targetSID, nick,
+	)
+	if invErr != nil {
+		hdlr.log.Error(
+			"add invite failed", "error", invErr,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
 		return
 	}
 
@@ -2817,7 +3044,7 @@ func (hdlr *Handlers) handleInvite(
 	if mErr == nil {
 		_ = hdlr.fanOutSilent(
 			request, irc.CmdInvite, nick, targetNick,
-			targetSID, 0, json.RawMessage(invBody),
+			json.RawMessage(invBody),
 			[]int64{targetSID},
 		)
 	}
@@ -3222,7 +3449,7 @@ func (hdlr *Handlers) handleWho(
 		// 315 RPL_ENDOFWHO (empty result)
 		hdlr.enqueueNumeric(
 			ctx, clientID, irc.RplEndOfWho, nick,
-			[]string{channel},
+			[]string{target},
 			"End of /WHO list",
 		)
 		hdlr.broker.Notify(sessionID)
@@ -3312,10 +3539,9 @@ func (hdlr *Handlers) HandleGetHistory() http.HandlerFunc {
 			return
 		}
 
-		toSessionID, toChannelID, ok := hdlr.canAccessHistory(
+		if !hdlr.canAccessHistory(
 			writer, request, sessionID, nick, target,
-		)
+		) {
-		if !ok {
 			return
 		}
 
@@ -3327,7 +3553,7 @@ func (hdlr *Handlers) HandleGetHistory() http.HandlerFunc {
 		}
 
 		msgs, err := hdlr.params.Database.GetHistory(
-			request.Context(), toSessionID, toChannelID,
+			request.Context(), target,
 			request.URL.Query().Get("before"), limit,
 		)
 		if errors.Is(err, sql.ErrNoRows) {
@@ -3360,23 +3586,17 @@ func (hdlr *Handlers) HandleGetHistory() http.HandlerFunc {
 }
 
 // canAccessHistory verifies the user can read history
-// for the given target (channel or DM participant) and
+// for the given target (channel or DM participant).
-// returns the session id and channel id to pass to
-// GetHistory: the user's own session for its nick, or the
-// channel's id, with 0 for the other. On false it has
-// written the error response.
 func (hdlr *Handlers) canAccessHistory(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID int64,
 	nick, target string,
-) (int64, int64, bool) {
+) bool {
 	if strings.HasPrefix(target, "#") {
-		chID, ok := hdlr.canAccessChannelHistory(
+		return hdlr.canAccessChannelHistory(
 			writer, request, sessionID, target,
 		)
-
-		return 0, chID, ok
 	}
 
 	// DM history: only allow if the target is the
@@ -3388,20 +3608,18 @@ func (hdlr *Handlers) canAccessHistory(
 			http.StatusForbidden,
 		)
 
-		return 0, 0, false
+		return false
 	}
 
-	return sessionID, 0, true
+	return true
 }
 
-// canAccessChannelHistory returns the id of the channel
-// named target if the user is a member of it.
 func (hdlr *Handlers) canAccessChannelHistory(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID int64,
 	target string,
-) (int64, bool) {
+) bool {
 	chID, err := hdlr.params.Database.GetChannelByName(
 		request.Context(), target,
 	)
@@ -3412,7 +3630,7 @@ func (hdlr *Handlers) canAccessChannelHistory(
 			http.StatusNotFound,
 		)
 
-		return 0, false
+		return false
 	}
 
 	isMember, err := hdlr.params.Database.IsChannelMember(
@@ -3428,7 +3646,7 @@ func (hdlr *Handlers) canAccessChannelHistory(
 			http.StatusInternalServerError,
 		)
 
-		return 0, false
+		return false
 	}
 
 	if !isMember {
@@ -3438,10 +3656,10 @@ func (hdlr *Handlers) canAccessChannelHistory(
 			http.StatusForbidden,
 		)
 
-		return 0, false
+		return false
 	}
 
-	return chID, true
+	return true
 }
 
 // HandleLogout deletes the authenticated client's token
@@ -3457,11 +3675,15 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 			return
 		}
 
-		err := hdlr.svc.Logout(
+		ctx := request.Context()
-			request.Context(), sessionID, clientID, nick,
+
+		err := hdlr.params.Database.DeleteClient(
+			ctx, clientID,
 		)
 		if err != nil {
-			hdlr.log.Error("logout failed", "error", err)
+			hdlr.log.Error(
+				"delete client failed", "error", err,
+			)
 			hdlr.respondError(
 				writer, request,
 				"internal error",
@@ -3471,6 +3693,23 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 			return
 		}
 
+		// If no clients remain, clean up the user fully:
+		// part all channels (notifying members) and
+		// delete the session.
+		remaining, err := hdlr.params.Database.
+			ClientCountForSession(ctx, sessionID)
+		if err != nil {
+			hdlr.log.Error(
+				"client count check failed", "error", err,
+			)
+		}
+
+		if remaining == 0 {
+			hdlr.cleanupUser(
+				ctx, sessionID, nick,
+			)
+		}
+
 		hdlr.clearAuthCookie(writer)
 
 		hdlr.respondJSON(writer, request,
@@ -3676,7 +3915,7 @@ func (hdlr *Handlers) handleKick(
 	}
 
 	err := hdlr.svc.KickUser(
-		request.Context(), sessionID, 0, nick,
+		request.Context(), sessionID, nick,
 		channel, targetNick, reason,
 	)
 	if hdlr.handleServiceError(
@@ -3729,19 +3968,17 @@ func (hdlr *Handlers) deliverWhoisIdle(
 }
 
 // fanOut inserts a message and enqueues it to all given
-// sessions. toSessionID and toChannelID are the recipient
+// sessions.
-// InsertMessage records for history, 0 when there is none.
 func (hdlr *Handlers) fanOut(
 	request *http.Request,
 	command, from, target string,
-	toSessionID, toChannelID int64,
 	body json.RawMessage,
 	meta json.RawMessage,
 	sessionIDs []int64,
 ) (string, error) {
 	dbID, msgUUID, err := hdlr.params.Database.InsertMessage(
 		request.Context(), command, from, target,
-		toSessionID, toChannelID, nil, body, meta,
+		nil, body, meta,
 	)
 	if err != nil {
 		return "", fmt.Errorf("insert message: %w", err)
@@ -3749,7 +3986,7 @@ func (hdlr *Handlers) fanOut(
 
 	for _, sid := range sessionIDs {
 		enqErr := hdlr.params.Database.EnqueueToSession(
-			request.Context(), sid, dbID, 0,
+			request.Context(), sid, dbID,
 		)
 		if enqErr != nil {
 			hdlr.log.Error("enqueue failed",
@@ -3766,13 +4003,12 @@ func (hdlr *Handlers) fanOut(
 func (hdlr *Handlers) fanOutSilent(
 	request *http.Request,
 	command, from, target string,
-	toSessionID, toChannelID int64,
 	body json.RawMessage,
 	sessionIDs []int64,
 ) error {
 	_, err := hdlr.fanOut(
 		request, command, from, target,
-		toSessionID, toChannelID, body, nil, sessionIDs,
+		body, nil, sessionIDs,
 	)
 
 	return err

internal/handlers/auth.go

@@ -1,18 +1,14 @@
 package handlers
 
 import (
+	"encoding/json"
 	"net/http"
 	"strings"
 
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-// A session password is 8 to 72 bytes; bcrypt cannot hash
+const minPasswordLength = 8
-// a longer one.
-const (
-	minPasswordLength = 8
-	maxPasswordLength = 72
-)
 
 // HandleLogin authenticates a user with nick and password.
 func (hdlr *Handlers) HandleLogin() http.HandlerFunc {
@@ -54,7 +50,7 @@ func (hdlr *Handlers) handleLogin(
 
 	var payload loginRequest
 
-	err := decodeJSON(request, &payload)
+	err := json.NewDecoder(request.Body).Decode(&payload)
 	if err != nil {
 		hdlr.respondError(
 			writer, request,
@@ -153,13 +149,12 @@ func (hdlr *Handlers) handlePass(
 
 	password := lines[0]
 
-	if len(password) < minPasswordLength ||
+	if len(password) < minPasswordLength {
-		len(password) > maxPasswordLength {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNeedMoreParams, nick,
 			[]string{irc.CmdPass},
-			"Password must be 8 to 72 bytes",
+			"Password must be at least 8 characters",
 		)
 
 		return

internal/handlers/export_test.go

@@ -1,23 +0,0 @@
-package handlers
-
-import (
-	"context"
-
-	"sneak.berlin/go/neoirc/internal/db"
-)
-
-// MaxLongPollTimeout is the longest HandleGetMessages waits, in
-// seconds.
-const MaxLongPollTimeout = maxLongPollTimeout
-
-// SetPollMessages makes HandleGetMessages read the client
-// output queue with poll in place of Database.PollMessages.
-func (hdlr *Handlers) SetPollMessages(
-	poll func(
-		ctx context.Context,
-		clientID, afterQueueID int64,
-		limit int,
-	) ([]db.IRCMessage, int64, error),
-) {
-	hdlr.pollMessages = poll
-}

internal/handlers/handlers.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"io"
 	"log/slog"
 	"net/http"
 	"time"
@@ -62,19 +61,10 @@ type Handlers struct {
 	broker          *broker.Broker
 	svc             *service.Service
 	hashcashVal     *hashcash.Validator
+	channelHashcash *hashcash.ChannelValidator
 	loginLimiter    *ratelimit.Limiter
 	stats           *stats.Tracker
 	cancelCleanup   context.CancelFunc
-
-	// pollMessages is Database.PollMessages, with which
-	// HandleGetMessages reads the client output queue. Tests
-	// replace it to act just after a read, or to make a read
-	// fail.
-	pollMessages func(
-		ctx context.Context,
-		clientID, afterQueueID int64,
-		limit int,
-	) ([]db.IRCMessage, int64, error)
 }
 
 // New creates a new Handlers instance.
@@ -104,9 +94,9 @@ func New(
 		broker:          params.Broker,
 		svc:             params.Service,
 		hashcashVal:     hashcash.NewValidator(resource),
+		channelHashcash: hashcash.NewChannelValidator(),
 		loginLimiter:    ratelimit.New(loginRate, loginBurst),
 		stats:           params.Stats,
-		pollMessages: params.Database.PollMessages,
 	}
 
 	lifecycle.Append(fx.Hook{
@@ -160,18 +150,6 @@ func (hdlr *Handlers) respondError(
 	)
 }
 
-// decodeJSON reads the whole request body and decodes it into dest.
-// It fails if the body is larger than the http.MaxBytesReader limit,
-// or holds anything other than one JSON value and whitespace.
-func decodeJSON(request *http.Request, dest any) error {
-	body, err := io.ReadAll(request.Body)
-	if err != nil {
-		return err
-	}
-
-	return json.Unmarshal(body, dest)
-}
-
 func (hdlr *Handlers) idleTimeout() time.Duration {
 	raw := hdlr.params.Config.SessionIdleTimeout
 	if raw == "" {

internal/handlers/utility.go

@@ -254,7 +254,8 @@ func (hdlr *Handlers) handleWallops(
 
 // handleUserMode handles MODE for a nick: a query when the
 // body is empty, otherwise a change by the mode string in
-// the body. Only the caller's own nick is allowed.
+// the body. Only the caller's own nick, in any letter case,
+// is allowed.
 func (hdlr *Handlers) handleUserMode(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -262,7 +263,7 @@ func (hdlr *Handlers) handleUserMode(
 	nick, target string,
 	bodyLines func() []string,
 ) {
-	if target != nick {
+	if !strings.EqualFold(target, nick) {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrUsersDoNotMatch, nick, nil,

internal/handlers/utility_test.go

@@ -1,3 +1,4 @@
+//nolint:paralleltest // global viper, as in api_test.go
 package handlers_test
 
 import (
@@ -71,8 +72,6 @@ func numericBody(
 }
 
 func TestUserhost(t *testing.T) {
-	t.Parallel()
-
 	tserver := newTestServer(t)
 
 	token := tserver.createSession("alice")
@@ -110,8 +109,6 @@ func TestUserhost(t *testing.T) {
 }
 
 func TestVersionAdminInfoTime(t *testing.T) {
-	t.Parallel()
-
 	tserver := newTestServer(t)
 
 	token := tserver.createSession("frank")
@@ -150,8 +147,6 @@ func TestVersionAdminInfoTime(t *testing.T) {
 }
 
 func TestKill(t *testing.T) {
-	t.Parallel()
-
 	tserver := newTestServerWithOper(t)
 
 	victimToken := tserver.createSession("victim")
@@ -218,8 +213,6 @@ func TestKill(t *testing.T) {
 }
 
 func TestWallops(t *testing.T) {
-	t.Parallel()
-
 	tserver := newTestServerWithOper(t)
 
 	receiverToken := tserver.createSession("receiver")
@@ -265,8 +258,6 @@ func TestWallops(t *testing.T) {
 }
 
 func TestUserMode(t *testing.T) {
-	t.Parallel()
-
 	const (
 		nick  = "alice"
 		other = "other"
@@ -299,10 +290,8 @@ func TestUserMode(t *testing.T) {
 		target, modeStr, numeric, modes string
 	}{
 		{nick, "+w", "221", "+w"},
-		{"Alice", "", "502", ""},
-		{"Alice", "-w", "502", ""},
 		{nick, "", "221", "+w"},
-		{nick, "-w", "221", "+"},
+		{strings.ToUpper(nick), "-w", "221", "+"},
 		{nick, "+z", "501", ""},
 		{nick, "+o", "501", ""},
 		{other, "", "502", ""},

internal/hashcash/hashcash.go

@@ -77,13 +77,9 @@ func NewValidator(resource string) *Validator {
 	return validator
 }
 
-// Check returns nil if requiredBits is not positive, or if
+// Validate checks a hashcash stamp. It returns nil if the
-// the stamp is a well-formed, recently dated proof of work
+// stamp is valid and has not been seen before.
-// for this resource with at least requiredBits. It does not
+func (v *Validator) Validate(
-// look at or change the set of spent stamps, so a request
-// can check its stamp first and Claim it after its other
-// checks.
-func (v *Validator) Check(
 	stamp string,
 	requiredBits int,
 ) error {
@@ -91,49 +87,9 @@ func (v *Validator) Check(
 		return nil
 	}
 
-	_, err := v.check(stamp, requiredBits)
-
-	return err
-}
-
-// Claim checks the stamp as Check does and, when
-// requiredBits is positive, records it as spent until it
-// expires. It returns an error if the stamp is already
-// spent. Release gives a claimed stamp back.
-func (v *Validator) Claim(
-	stamp string,
-	requiredBits int,
-) error {
-	if requiredBits <= 0 {
-		return nil
-	}
-
-	stampTime, err := v.check(stamp, requiredBits)
-	if err != nil {
-		return err
-	}
-
-	return v.checkAndRecordStamp(stamp, stampTime)
-}
-
-// Release forgets a claimed stamp so that it can be claimed
-// again, for a request that failed after its Claim.
-// Releasing a stamp that is not claimed does nothing.
-func (v *Validator) Release(stamp string) {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
-	delete(v.spent, stamp)
-}
-
-// check returns the stamp's date if Check accepts it.
-func (v *Validator) check(
-	stamp string,
-	requiredBits int,
-) (time.Time, error) {
 	parts := strings.Split(stamp, ":")
 	if len(parts) != stampFields {
-		return time.Time{}, fmt.Errorf(
+		return fmt.Errorf(
 			"%w: expected %d, got %d",
 			errInvalidFields, stampFields, len(parts),
 		)
@@ -148,25 +104,25 @@ func (v *Validator) check(
 		version, bitsStr, resource, requiredBits,
 	)
 	if err != nil {
-		return time.Time{}, err
+		return err
 	}
 
 	stampTime, err := parseStampDate(dateStr)
 	if err != nil {
-		return time.Time{}, err
+		return err
 	}
 
 	err = validateTime(stampTime)
 	if err != nil {
-		return time.Time{}, err
+		return err
 	}
 
 	err = validateProof(stamp, requiredBits)
 	if err != nil {
-		return time.Time{}, err
+		return err
 	}
 
-	return stampTime, nil
+	return v.checkAndRecordStamp(stamp, stampTime)
 }
 
 func (v *Validator) validateHeader(

internal/hashcash/hashcash_test.go

@@ -85,7 +85,7 @@ func TestMintAndValidate(t *testing.T) {
 		t, testBits, "test-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("valid stamp rejected: %v", err)
 	}
@@ -99,74 +99,17 @@ func TestReplayDetection(t *testing.T) {
 		t, testBits, "test-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("first use failed: %v", err)
 	}
 
-	err = validator.Claim(stamp, testBits)
+	err = validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("replay not detected")
 	}
 }
 
-// TestCheckDoesNotSpendStamp checks that a stamp Check
-// accepts can still be claimed, and only once, and that
-// Check still accepts it once it is spent.
-func TestCheckDoesNotSpendStamp(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewValidator("test-resource")
-	stamp := mintStampWithDate(
-		t, testBits, "test-resource", todayDate(),
-	)
-
-	for range 2 {
-		err := validator.Check(stamp, testBits)
-		if err != nil {
-			t.Fatalf("valid stamp rejected: %v", err)
-		}
-	}
-
-	err := validator.Claim(stamp, testBits)
-	if err != nil {
-		t.Fatalf("claim after check failed: %v", err)
-	}
-
-	err = validator.Claim(stamp, testBits)
-	if err == nil {
-		t.Fatal("replay not detected")
-	}
-
-	err = validator.Check(stamp, testBits)
-	if err != nil {
-		t.Fatalf("spent stamp rejected by Check: %v", err)
-	}
-}
-
-// TestReleasedStampCanBeClaimedAgain checks that Release
-// gives a claimed stamp back.
-func TestReleasedStampCanBeClaimedAgain(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewValidator("test-resource")
-	stamp := mintStampWithDate(
-		t, testBits, "test-resource", todayDate(),
-	)
-
-	err := validator.Claim(stamp, testBits)
-	if err != nil {
-		t.Fatalf("first claim failed: %v", err)
-	}
-
-	validator.Release(stamp)
-
-	err = validator.Claim(stamp, testBits)
-	if err != nil {
-		t.Fatalf("claim after release failed: %v", err)
-	}
-}
-
 func TestResourceMismatch(t *testing.T) {
 	t.Parallel()
 
@@ -175,7 +118,7 @@ func TestResourceMismatch(t *testing.T) {
 		t, testBits, "wrong-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected resource mismatch error")
 	}
@@ -186,7 +129,7 @@ func TestInvalidStampFormat(t *testing.T) {
 
 	validator := hashcash.NewValidator("test-resource")
 
-	err := validator.Claim(
+	err := validator.Validate(
 		"not:a:valid:stamp", testBits,
 	)
 	if err == nil {
@@ -203,7 +146,7 @@ func TestBadVersion(t *testing.T) {
 		testBits, todayDate(), "test-resource",
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad version error")
 	}
@@ -219,7 +162,7 @@ func TestInsufficientDifficulty(t *testing.T) {
 		todayDate(), "test-resource",
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected insufficient bits error")
 	}
@@ -235,7 +178,7 @@ func TestExpiredStamp(t *testing.T) {
 		t, testBits, "test-resource", oldDate,
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected expired stamp error")
 	}
@@ -246,14 +189,9 @@ func TestZeroBitsSkipsValidation(t *testing.T) {
 
 	validator := hashcash.NewValidator("test-resource")
 
-	err := validator.Check("garbage", 0)
+	err := validator.Validate("garbage", 0)
 	if err != nil {
-		t.Fatalf("zero bits should skip the check: %v", err)
+		t.Fatalf("zero bits should skip: %v", err)
-	}
-
-	err = validator.Claim("garbage", 0)
-	if err != nil {
-		t.Fatalf("zero bits should skip the claim: %v", err)
 	}
 }
 
@@ -266,7 +204,7 @@ func TestLongDateFormat(t *testing.T) {
 		t, testBits, "test-resource", longDate,
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("long date stamp rejected: %v", err)
 	}
@@ -281,7 +219,7 @@ func TestBadDateFormat(t *testing.T) {
 		testBits, "test-resource",
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad date error")
 	}
@@ -297,7 +235,7 @@ func TestMultipleUniqueStamps(t *testing.T) {
 			t, testBits, "test-resource", todayDate(),
 		)
 
-		err := validator.Claim(stamp, testBits)
+		err := validator.Validate(stamp, testBits)
 		if err != nil {
 			t.Fatalf("unique stamp rejected: %v", err)
 		}
@@ -313,7 +251,7 @@ func TestHigherBitsStillValid(t *testing.T) {
 		t, 4, "test-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf(
 			"higher-difficulty stamp rejected: %v",

internal/ircserver/commands.go

@@ -71,20 +71,15 @@ func (c *Conn) handleNick(
 	}
 
 	newNick := msg.Params[0]
-	if !service.ValidNick(newNick) {
+	if len(newNick) > maxNickLen {
-		c.sendNumeric(
+		newNick = newNick[:maxNickLen]
-			irc.ErrErroneusNickname,
-			newNick, "Erroneous nickname",
-		)
-
-		return
 	}
 
 	oldMask := c.hostmask()
-	oldNick := c.currentNick()
+	oldNick := c.nick
 
 	err := c.svc.ChangeNick(
-		ctx, c.sessionID, c.clientID, oldNick, newNick,
+		ctx, c.sessionID, oldNick, newNick,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -92,10 +87,9 @@ func (c *Conn) handleNick(
 		return
 	}
 
-	// Take the nick the session holds, not newNick: another
+	c.mu.Lock()
-	// client of the session may have changed it again since
+	c.nick = newNick
-	// ChangeNick stored newNick.
+	c.mu.Unlock()
-	c.loadSessionNick(ctx)
 
 	// Echo NICK change to the client on wire.
 	c.send(FormatMessage(oldMask, "NICK", newNick))
@@ -129,8 +123,8 @@ func (c *Conn) handlePrivmsg(
 	body, _ := json.Marshal([]string{text}) //nolint:errchkjson
 
 	if strings.HasPrefix(target, "#") {
-		_, err := c.svc.SendChannelMessage(
+		_, _, err := c.svc.SendChannelMessage(
-			ctx, c.sessionID, c.clientID, c.currentNick(),
+			ctx, c.sessionID, c.nick,
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -138,7 +132,7 @@ func (c *Conn) handlePrivmsg(
 		}
 	} else {
 		result, err := c.svc.SendDirectMessage(
-			ctx, c.sessionID, c.clientID, c.currentNick(),
+			ctx, c.sessionID, c.nick,
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -156,9 +150,7 @@ func (c *Conn) handlePrivmsg(
 }
 
 // handleJoin joins one or more channels via the shared
-// service layer. The optional second parameter holds the
+// service layer.
-// channel keys, comma-separated in the order of the
-// channels.
 func (c *Conn) handleJoin(
 	ctx context.Context,
 	msg *Message,
@@ -172,24 +164,14 @@ func (c *Conn) handleJoin(
 		return
 	}
 
-	var keys []string
+	for chanName := range strings.SplitSeq(msg.Params[0], ",") {
-	if len(msg.Params) > 1 {
-		keys = strings.Split(msg.Params[1], ",")
-	}
-
-	for idx, chanName := range strings.Split(msg.Params[0], ",") {
 		chanName = strings.TrimSpace(chanName)
 
 		if !strings.HasPrefix(chanName, "#") {
 			chanName = "#" + chanName
 		}
 
-		key := ""
+		c.joinChannel(ctx, chanName)
-		if idx < len(keys) {
-			key = keys[idx]
-		}
-
-		c.joinChannel(ctx, chanName, key)
 	}
 }
 
@@ -197,10 +179,10 @@ func (c *Conn) handleJoin(
 // and delivers topic/names on the wire.
 func (c *Conn) joinChannel(
 	ctx context.Context,
-	channel, key string,
+	channel string,
 ) {
 	result, err := c.svc.JoinChannel(
-		ctx, c.sessionID, c.clientID, c.currentNick(), channel, key,
+		ctx, c.sessionID, c.nick, channel, "",
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -338,7 +320,7 @@ func (c *Conn) partChannel(
 	channel, reason string,
 ) {
 	err := c.svc.PartChannel(
-		ctx, c.sessionID, c.clientID, c.currentNick(), channel, reason,
+		ctx, c.sessionID, c.nick, channel, reason,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -371,7 +353,6 @@ func (c *Conn) handleQuit(msg *Message) {
 
 	c.mu.Lock()
 	c.closed = true
-	c.quitReason = reason
 	c.mu.Unlock()
 }
 
@@ -403,7 +384,7 @@ func (c *Conn) handleTopic(
 	newTopic := msg.Params[1]
 
 	err := c.svc.SetTopic(
-		ctx, c.sessionID, c.clientID, c.currentNick(), channel, newTopic,
+		ctx, c.sessionID, c.nick, channel, newTopic,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -710,19 +691,19 @@ func (c *Conn) applyChannelModes(
 		c.send(FormatMessage(c.hostmask(), "MODE", params...))
 
 		c.svc.BroadcastMode(
-			ctx, c.clientID, c.currentNick(), channel, chID, modeReply,
+			ctx, c.nick, channel, chID, modeReply,
 		)
 	}
 }
 
 // handleUserMode handles MODE for a nick: a query without a
 // mode string, otherwise a change. Only the client's own
-// nick is allowed.
+// nick, in any letter case, is allowed.
 func (c *Conn) handleUserMode(
 	ctx context.Context,
 	msg *Message,
 ) {
-	if msg.Params[0] != c.currentNick() {
+	if !strings.EqualFold(msg.Params[0], c.currentNick()) {
 		c.sendNumeric(
 			irc.ErrUsersDoNotMatch,
 			"Can't change mode for other users",
@@ -782,11 +763,10 @@ func (c *Conn) handleNames(
 	c.deliverNames(ctx, channel, chID)
 }
 
-// handleList sends the channel list, leaving out +s
+// handleList sends the channel list.
-// channels the user is not on.
 func (c *Conn) handleList(ctx context.Context) {
-	channels, err := c.database.ListAllChannelsWithCountsFiltered(
+	channels, err := c.database.ListAllChannelsWithCounts(
-		ctx, c.sessionID,
+		ctx,
 	)
 	if err != nil {
 		c.sendNumeric(
@@ -906,15 +886,14 @@ func (c *Conn) whoisOper(
 	}
 }
 
-// whoisChannels sends 319 RPL_WHOISCHANNELS, leaving out
+// whoisChannels sends 319 RPL_WHOISCHANNELS.
-// +s channels the querier is not on.
 func (c *Conn) whoisChannels(
 	ctx context.Context,
 	target string,
 	targetID int64,
 ) {
-	userChannels, _ := c.database.GetSessionChannelsFiltered(
+	userChannels, _ := c.database.GetSessionChannels(
-		ctx, targetID, c.sessionID,
+		ctx, targetID,
 	)
 	if len(userChannels) == 0 {
 		return
@@ -1187,7 +1166,7 @@ func (c *Conn) handleKick(
 	}
 
 	err := c.svc.KickUser(
-		ctx, c.sessionID, c.clientID, c.currentNick(),
+		ctx, c.sessionID, c.nick,
 		channel, targetNick, reason,
 	)
 	if err != nil {
@@ -1218,21 +1197,19 @@ func (c *Conn) handlePassPostReg(
 	}
 
 	password := msg.Params[0]
-	if !c.checkPasswordLength(password) {
+	if len(password) < minPasswordLen {
+		c.sendFromServer("NOTICE", c.nick,
+			"Password must be at least 8 characters",
+		)
+
 		return
 	}
 
-	err := c.setPassword(ctx, password)
+	c.setPassword(ctx, password)
-	if err != nil {
-		return
-	}
 
-	// The IRC listener cannot add a connection to an existing
+	c.sendFromServer("NOTICE", c.nick,
-	// session; only the HTTP API login can.
+		"Password set. You can reconnect using "+
-	c.sendFromServer("NOTICE", c.currentNick(),
+			"PASS <password> with your nick.",
-		"Password set. Another client can log in to this "+
-			"session over the HTTP API: POST /api/v1/login "+
-			"with your nick and this password.",
 	)
 }
 
@@ -1253,11 +1230,36 @@ func (c *Conn) handleInvite(
 	targetNick := msg.Params[0]
 	channel := msg.Params[1]
 
-	targetID, err := c.svc.InviteUser(
+	chID, err := c.database.GetChannelByName(ctx, channel)
-		ctx, c.sessionID, c.currentNick(), targetNick, channel,
+	if err != nil {
+		c.sendNumeric(
+			irc.ErrNoSuchChannel,
+			channel, "No such channel",
+		)
+
+		return
+	}
+
+	isMember, _ := c.database.IsChannelMember(
+		ctx, chID, c.sessionID,
+	)
+	if !isMember {
+		c.sendNumeric(
+			irc.ErrNotOnChannel,
+			channel, "You're not on that channel",
+		)
+
+		return
+	}
+
+	targetID, err := c.database.GetSessionByNick(
+		ctx, targetNick,
 	)
 	if err != nil {
-		c.sendIRCError(err)
+		c.sendNumeric(
+			irc.ErrNoSuchNick,
+			targetNick, "No such nick",
+		)
 
 		return
 	}
@@ -1266,13 +1268,14 @@ func (c *Conn) handleInvite(
 		irc.RplInviting, targetNick, channel,
 	)
 
-	// Queue the INVITE to the target with the body the HTTP
+	// Send INVITE notice to target via service fan-out.
-	// API uses.
+	body, _ := json.Marshal( //nolint:errchkjson
-	body, _ := json.Marshal([]string{channel}) //nolint:errchkjson
+		[]string{"You have been invited to " + channel},
+	)
 
 	_, _, _ = c.svc.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, "INVITE", c.currentNick(), targetNick, targetID, 0,
+		ctx, "INVITE", c.nick, targetNick,
-		nil, body, nil, []int64{targetID}, 0,
+		nil, body, nil, []int64{targetID},
 	)
 }
 

internal/ircserver/conn.go

@@ -20,14 +20,15 @@ import (
 
 const (
 	maxLineLen      = 512
+	readTimeout     = 5 * time.Minute
 	writeTimeout    = 30 * time.Second
 	killWriteWindow = 2 * time.Second
 	dnsTimeout      = 3 * time.Second
 	pollInterval    = 100 * time.Millisecond
 	pingInterval    = 90 * time.Second
 	pongDeadline    = 30 * time.Second
+	maxNickLen      = 32
 	minPasswordLen  = 8
-	maxPasswordLen  = 72 // bcrypt cannot hash a longer one
 	maxHashcashBits = 40
 )
 
@@ -63,31 +64,21 @@ type Conn struct {
 	registered bool
 	gotNick    bool
 	gotUser    bool
-	gotPass    bool
 	passWord   string
 
 	lastQueueID int64
 	closed      bool
 	killed      bool
-
-	// pollInterval is how often the relay checks the client
-	// output queue when no broker notification arrives.
-	pollInterval time.Duration
-
-	// quitReason is the reason in the QUIT that peers are
-	// sent when the connection ends. The client's QUIT
-	// replaces it.
-	quitReason string
 }
 
 func newConn(
+	ctx context.Context,
 	tcpConn net.Conn,
 	log *slog.Logger,
 	database *db.Database,
 	brk *broker.Broker,
 	cfg *config.Config,
 	svc *service.Service,
-	poll time.Duration,
 ) *Conn {
 	host, _, _ := net.SplitHostPort(tcpConn.RemoteAddr().String())
 
@@ -105,9 +96,7 @@ func newConn(
 		svc:       svc,
 		serverSfx: srvName,
 		remoteIP:  host,
-		quitReason: "Connection closed",
+		hostname:  resolveHost(ctx, host),
-
-		pollInterval: poll,
 	}
 
 	conn.commands = conn.buildCommandMap()
@@ -225,42 +214,18 @@ func resolveHost(ctx context.Context, addr string) string {
 }
 
 // serve is the main loop for a single IRC client connection.
-// It first sets the client's hostname to what resolve returns
-// for the client's address.
 // Cancelling ctx when it returns stops the relay goroutine.
-// When nothing has been read for interval the client is sent
+func (c *Conn) serve(ctx context.Context) {
-// a PING, and when nothing is read within deadline after that
-// the connection is closed.
-func (c *Conn) serve(
-	ctx context.Context,
-	resolve func(ctx context.Context, addr string) string,
-	interval, deadline time.Duration,
-) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
-	// Stopping the server cancels ctx, and the cleanup must
+	defer c.cleanup(ctx)
-	// still end the session then.
-	defer c.cleanup(context.WithoutCancel(ctx))
-
-	// The hostname is looked up here, on this connection's
-	// goroutine, and not when the connection is accepted, so
-	// that a slow lookup holds up only this client.
-	c.hostname = resolve(ctx, c.remoteIP)
-
-	ping := time.AfterFunc(interval, func() {
-		c.send("PING :" + c.serverSfx)
-	})
-	defer ping.Stop()
 
 	scanner := bufio.NewScanner(c.conn)
 	scanner.Buffer(make([]byte, maxLineLen), maxLineLen)
 
 	for {
-		// Every line read starts both waits again.
-		ping.Reset(interval)
-
 		_ = c.conn.SetReadDeadline(
-			time.Now().Add(interval + deadline),
+			time.Now().Add(readTimeout),
 		)
 
 		if !scanner.Scan() {
@@ -291,7 +256,6 @@ func (c *Conn) cleanup(ctx context.Context) {
 	wasKilled := c.killed
 	sessID := c.sessionID
 	nick := c.nick
-	quitReason := c.quitReason
 	c.closed = true
 	c.mu.Unlock()
 
@@ -301,7 +265,9 @@ func (c *Conn) cleanup(ctx context.Context) {
 		// KILL has already sent the QUIT and deleted the
 		// session.
 		if !wasKilled {
-			c.svc.BroadcastQuit(ctx, sessID, nick, quitReason)
+			c.svc.BroadcastQuit(
+				ctx, sessID, nick, "Connection closed",
+			)
 		}
 	}
 
@@ -325,22 +291,6 @@ func (c *Conn) currentNick() string {
 	return c.nick
 }
 
-// loadSessionNick sets c.nick to the nick the connection's
-// session holds in the database, read by session ID. The
-// connection's own NICK and the relay passing on a NICK line
-// both call it, and it reads and sets the nick under c.mu, so
-// whichever runs last leaves the connection on its session's
-// nick. If the read fails, c.nick is left as it is.
-func (c *Conn) loadSessionNick(ctx context.Context) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	nick, err := c.database.GetSessionNick(ctx, c.sessionID)
-	if err == nil {
-		c.nick = nick
-	}
-}
-
 // send writes a formatted IRC line to the connection.
 func (c *Conn) send(line string) {
 	c.sendWithin(writeTimeout, line)
@@ -373,7 +323,7 @@ func (c *Conn) sendNumeric(
 	code irc.IRCMessageType,
 	params ...string,
 ) {
-	nick := c.currentNick()
+	nick := c.nick
 	if nick == "" {
 		nick = "*"
 	}
@@ -397,11 +347,9 @@ func (c *Conn) sendFromServer(
 // hostmask returns the client's full hostmask
 // (nick!user@host).
 func (c *Conn) hostmask() string {
-	nick := c.currentNick()
-
 	user := c.username
 	if user == "" {
-		user = nick
+		user = c.nick
 	}
 
 	host := c.hostname
@@ -409,7 +357,7 @@ func (c *Conn) hostmask() string {
 		host = c.remoteIP
 	}
 
-	return nick + "!" + user + "@" + host
+	return c.nick + "!" + user + "@" + host
 }
 
 // handleMessage dispatches a parsed IRC message using
@@ -419,7 +367,7 @@ func (c *Conn) handleMessage(
 	msg *Message,
 ) {
 	// Before registration, only NICK, USER, PASS, PING,
-	// PONG, QUIT, and CAP are accepted.
+	// QUIT, and CAP are accepted.
 	if !c.registered {
 		c.handlePreRegistration(ctx, msg)
 
@@ -468,7 +416,6 @@ func (c *Conn) handlePreRegistration(
 		}
 
 		c.passWord = msg.Params[0]
-		c.gotPass = true
 	case irc.CmdNick:
 		if len(msg.Params) < 1 {
 			c.sendNumeric(
@@ -479,16 +426,11 @@ func (c *Conn) handlePreRegistration(
 			return
 		}
 
-		if !service.ValidNick(msg.Params[0]) {
+		c.nick = msg.Params[0]
-			c.sendNumeric(
+		if len(c.nick) > maxNickLen {
-				irc.ErrErroneusNickname,
+			c.nick = c.nick[:maxNickLen]
-				msg.Params[0], "Erroneous nickname",
-			)
-
-			return
 		}
 
-		c.nick = msg.Params[0]
 		c.gotNick = true
 	case irc.CmdUser:
 		if len(msg.Params) < 4 { //nolint:mnd
@@ -506,10 +448,6 @@ func (c *Conn) handlePreRegistration(
 	case irc.CmdPing:
 		c.handlePing(msg)
 
-		return
-	case irc.CmdPong:
-		// The answer to serve's PING, which unregistered
-		// clients are sent too.
 		return
 	case irc.CmdQuit:
 		c.handleQuit(msg)
@@ -583,20 +521,17 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 	// So that KILL, from either transport, can close it.
 	c.svc.RegisterWireConn(sessionID, c)
 
+	// If PASS was provided before registration, set the
+	// session password.
+	if c.passWord != "" && len(c.passWord) >= minPasswordLen {
+		c.setPassword(ctx, c.passWord)
+	}
+
 	// Send welcome burst.
 	c.deliverWelcome()
 	c.deliverLusers(ctx)
 	c.deliverMOTD()
 
-	// If PASS was given before registration, store its
-	// password now, after the welcome burst, so that a
-	// NOTICE refusing it reaches a registered client. A
-	// failure to store it is only logged, as it is for PASS
-	// after registration.
-	if c.gotPass && c.checkPasswordLength(c.passWord) {
-		_ = c.setPassword(ctx, c.passWord)
-	}
-
 	// Start the message relay goroutine.
 	go c.relayMessages(ctx)
 }
@@ -617,7 +552,7 @@ func (c *Conn) deliverWelcome() {
 	)
 	c.sendNumeric(
 		irc.RplMyInfo,
-		c.serverSfx, "neoirc", service.UserModes, "Himnostv",
+		c.serverSfx, "neoirc", "", "mnst",
 	)
 	c.sendNumeric(
 		irc.RplIsupport,
@@ -679,33 +614,13 @@ func (c *Conn) deliverMOTD() {
 	)
 }
 
-// checkPasswordLength reports whether pw is 8 to 72 bytes
+// setPassword sets a bcrypt password on the session.
-// long, and sends the client a NOTICE saying so when it is
+func (c *Conn) setPassword(ctx context.Context, pw string) {
-// not.
-func (c *Conn) checkPasswordLength(pw string) bool {
-	if len(pw) >= minPasswordLen && len(pw) <= maxPasswordLen {
-		return true
-	}
-
-	c.sendFromServer("NOTICE", c.currentNick(),
-		"Password must be 8 to 72 bytes",
-	)
-
-	return false
-}
-
-// setPassword sets a bcrypt password on the session, and
-// logs and returns the error when it was not stored.
-func (c *Conn) setPassword(ctx context.Context, pw string) error {
 	// Use the database's auth module to hash and store.
 	err := c.database.SetPassword(ctx, c.sessionID, pw)
 	if err != nil {
 		c.log.Error(
 			"failed to set password", "error", err,
 		)
-
-		return err
 	}
-
-	return nil
 }

internal/ircserver/conn_test.go

@@ -5,7 +5,6 @@ import (
 	"log/slog"
 	"net"
 	"os"
-	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -101,48 +100,3 @@ func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
 		t.Errorf("missing ERROR line, got: %q", joined)
 	}
 }
-
-// TestDisconnectReasonCannotStartLine checks that CR, LF and
-// NUL in a KILL reason are removed from both the KILL line
-// and the ERROR line, so the victim gets exactly those two
-// lines. The ERROR line is not built with FormatMessage, so
-// only the removal in sendWithin protects it.
-func TestDisconnectReasonCannotStartLine(t *testing.T) {
-	t.Parallel()
-
-	victim, clientSide := newKillVictim(t)
-	received := make(chan []string, 1)
-
-	go func() {
-		var lines []string
-
-		scanner := bufio.NewScanner(clientSide)
-		for scanner.Scan() {
-			lines = append(lines, scanner.Text())
-		}
-
-		received <- lines
-	}()
-
-	victim.Disconnect("bye\r\nPRIVMSG victim :forged\x00")
-
-	var lines []string
-
-	select {
-	case lines = <-received:
-	case <-time.After(testTimeout):
-		t.Fatal("the victim's connection was not closed")
-	}
-
-	// The test connection has no host name, hence the two
-	// spaces after "Closing Link:".
-	want := []string{
-		":" + testServerName +
-			" KILL victim :byePRIVMSG victim :forged",
-		"ERROR :Closing Link:  (byePRIVMSG victim :forged)",
-	}
-
-	if !slices.Equal(lines, want) {
-		t.Errorf("got lines %q, want %q", lines, want)
-	}
-}

internal/ircserver/export_test.go

@@ -13,18 +13,13 @@ import (
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
-// NewTestServer creates a Server suitable for testing, whose
+// NewTestServer creates a Server suitable for testing.
-// connections use interval, deadline and poll in place of
-// pingInterval, pongDeadline and pollInterval, and resolve in
-// place of resolveHost.
 // The caller must call Stop() when finished.
 func NewTestServer(
 	log *slog.Logger,
 	cfg *config.Config,
 	database *db.Database,
 	brk *broker.Broker,
-	interval, deadline, poll time.Duration,
-	resolve func(ctx context.Context, addr string) string,
 ) *Server {
 	globs := &globals.Globals{
 		Appname:   "neoirc",
@@ -43,27 +38,9 @@ func NewTestServer(
 		brk:      brk,
 		svc:      svc,
 		conns:    make(map[*Conn]struct{}),
-
-		pingInterval: interval,
-		pongDeadline: deadline,
-		pollInterval: poll,
-		stopTimeout:  stopTimeout,
-		resolveHost:  resolve,
 	}
 }
 
-// SetStopTimeout makes Stop wait at most timeout for the
-// connections' cleanup.
-func (s *Server) SetStopTimeout(timeout time.Duration) {
-	s.stopTimeout = timeout
-}
-
-// ResolveHost is the reverse DNS lookup that a server made by
-// New does for each client.
-func ResolveHost(ctx context.Context, addr string) string {
-	return resolveHost(ctx, addr)
-}
-
 // Start exposes the unexported start method for tests.
 func (s *Server) Start(addr string) error {
 	return s.start(context.Background(), addr)
@@ -79,34 +56,10 @@ func (s *Server) Listener() net.Listener {
 	return s.listener
 }
 
-// Service returns the service the server's connections use.
-func (s *Server) Service() *service.Service {
-	return s.svc
-}
-
-// PingTimes returns how long the server's connections wait
-// with nothing read before they are sent a PING, and after it
-// before they are closed.
-func (s *Server) PingTimes() (time.Duration, time.Duration) {
-	return s.pingInterval, s.pongDeadline
-}
-
 // KillWriteWindow is how long Disconnect allows each write
 // to a killed victim.
 const KillWriteWindow = killWriteWindow
 
-// PollInterval is how often the relay checks the client
-// output queue when no broker notification arrives.
-const PollInterval = pollInterval
-
-// PingInterval is how long the server waits with nothing read
-// from a connection before it sends a PING.
-const PingInterval = pingInterval
-
-// PongDeadline is how long the server waits after the PING
-// for a line before it closes the connection.
-const PongDeadline = pongDeadline
-
 // NewTestConn returns a Conn for nick on tcpConn, without a
 // server, database or service behind it.
 func NewTestConn(
@@ -115,7 +68,10 @@ func NewTestConn(
 	tcpConn net.Conn,
 	nick string,
 ) *Conn {
-	conn := newConn(tcpConn, log, nil, nil, cfg, nil, pollInterval)
+	conn := newConn(
+		context.Background(), tcpConn, log,
+		nil, nil, cfg, nil,
+	)
 	conn.nick = nick
 
 	return conn

internal/ircserver/integration_test.go

@@ -3,6 +3,7 @@ package ircserver_test
 import (
 	"strings"
 	"testing"
+	"time"
 
 	"sneak.berlin/go/neoirc/internal/config"
 )
@@ -1083,9 +1084,9 @@ func TestIntegrationWallops(t *testing.T) {
 }
 
 // TestIntegrationUserMode covers MODE for a nick: changes
-// and queries of your own modes, refusal for another nick,
+// and queries of your own modes in any letter case, refusal
-// even one that differs from yours only in letter case, and
+// for another nick, and a rejected mode string changing
-// a rejected mode string changing nothing.
+// nothing.
 func TestIntegrationUserMode(t *testing.T) {
 	t.Parallel()
 
@@ -1105,9 +1106,7 @@ func TestIntegrationUserMode(t *testing.T) {
 	for _, step := range []struct {
 		line, want string
 	}{
-		{"MODE alice +w", " 221 alice +w"},
+		{"MODE ALICE +w", " 221 alice +w"},
-		{"MODE Alice", notYours},
-		{"MODE Alice -w", notYours},
 		{"MODE bob", notYours},
 		{"MODE bob -w", notYours},
 		{"MODE alice xw", unknown},
@@ -1240,252 +1239,6 @@ func TestIntegrationModeModerated(t *testing.T) {
 	)
 }
 
-// TestIntegrationModeKey checks that JOIN takes the key of
-// a +k channel as its second parameter, and that with
-// several channels each key goes to the channel in the
-// same position.
-func TestIntegrationModeKey(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#keyed")
-	alice.joinAndDrain("#vault")
-
-	// The IRC listener cannot set +k, so the test sets the
-	// keys directly.
-	for channel, key := range map[string]string{
-		"#keyed": "sesame",
-		"#vault": "barley",
-	} {
-		chID, err := env.database.GetChannelByName(
-			t.Context(), channel,
-		)
-		if err != nil {
-			t.Fatalf("get channel %s: %v", channel, err)
-		}
-
-		err = env.database.SetChannelKey(t.Context(), chID, key)
-		if err != nil {
-			t.Fatalf("set key of %s: %v", channel, err)
-		}
-	}
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bob.sendAndExpect("JOIN #keyed", " 475 ")
-	bob.sendAndExpect("JOIN #keyed wrong", " 475 ")
-
-	lines := bob.sendAndExpect("JOIN #keyed sesame", " 366 ")
-	assertContains(
-		t, lines, "JOIN #keyed", "bob joins with the key",
-	)
-
-	carol := env.dial(t)
-	carol.register("carol")
-
-	lines = carol.sendAndExpect(
-		"JOIN #keyed,#vault sesame,barley", " 366 carol #vault ",
-	)
-	assertContains(t, lines, "JOIN #keyed", "carol joins #keyed")
-	assertContains(t, lines, "JOIN #vault", "carol joins #vault")
-	assertNotContains(t, lines, " 475 ", "carol's JOIN")
-}
-
-// TestIntegrationModeInviteOnly checks that INVITE lets a
-// user into a +i channel.
-func TestIntegrationModeInviteOnly(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#invonly")
-	alice.sendAndExpect("MODE #invonly +i", "+i")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bob.sendAndExpect("JOIN #invonly", " 473 ")
-
-	alice.sendAndExpect("INVITE bob #invonly", " 341 ")
-
-	lines := bob.sendAndExpect("JOIN #invonly", " 366 ")
-	assertContains(
-		t, lines, "JOIN #invonly", "bob joins once invited",
-	)
-}
-
-// TestIntegrationModeInviteOnlyNeedsOperator checks that on
-// a +i channel an INVITE from a member who is not a channel
-// operator gets 482 and does not let the invited user in.
-func TestIntegrationModeInviteOnlyNeedsOperator(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#invonly")
-
-	// Bob joins before +i is set, so he is a member but
-	// not an operator.
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#invonly")
-
-	alice.sendAndExpect("MODE #invonly +i", "+i")
-
-	carol := env.dial(t)
-	carol.register("carol")
-
-	lines := bob.sendAndExpect("INVITE carol #invonly", " 482 ")
-	assertContains(
-		t, lines, " 482 bob #invonly ", "bob's INVITE refused",
-	)
-
-	carol.sendAndExpect("JOIN #invonly", " 473 ")
-}
-
-// TestIntegrationInviteUserOnChannel checks that inviting a
-// user who is already on the channel gets 443.
-func TestIntegrationInviteUserOnChannel(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#room")
-
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#room")
-
-	lines := alice.sendAndExpect("INVITE bob #room", " 443 ")
-	assertContains(
-		t, lines, " 443 alice bob #room ", "alice's INVITE refused",
-	)
-}
-
-// TestIntegrationInviteLine checks that an IRC listener user
-// invited by an IRC listener user, and then over the HTTP
-// API, gets an INVITE line from the inviter for the channel
-// each time.
-func TestIntegrationInviteLine(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#inv")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	alice.sendAndExpect("INVITE bob #inv", " 341 ")
-
-	got := bob.readLine()
-	want := ":alice!alice@* INVITE bob #inv"
-
-	if got != want {
-		t.Errorf("from the IRC listener: got %q, want %q", got, want)
-	}
-
-	// The HTTP API queues an INVITE with the channel as its body.
-	env.queueMessage(t, "bob", "INVITE", "carol", "bob", []string{"#inv"})
-
-	got = bob.readLine()
-	want = ":carol!carol@* INVITE bob #inv"
-
-	if got != want {
-		t.Errorf("over the HTTP API: got %q, want %q", got, want)
-	}
-}
-
-// TestIntegrationModeSecretList checks that LIST shows a +s
-// channel only to its members.
-func TestIntegrationModeSecretList(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#hidden")
-	alice.joinAndDrain("#visible")
-	alice.sendAndExpect("MODE #hidden +s", "+s")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bobList := bob.sendAndExpect("LIST", " 323 ")
-	assertContains(
-		t, bobList, " 322 bob #visible ", "bob's LIST",
-	)
-	assertNotContains(t, bobList, "#hidden", "bob's LIST")
-
-	aliceList := alice.sendAndExpect("LIST", " 323 ")
-	assertContains(
-		t, aliceList, " 322 alice #hidden ", "alice's LIST",
-	)
-}
-
-// TestIntegrationModeSecretWhois checks that WHOIS names a
-// +s channel only to users on it.
-func TestIntegrationModeSecretWhois(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#hidden")
-	alice.joinAndDrain("#visible")
-	alice.sendAndExpect("MODE #hidden +s", "+s")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bobWhois := bob.sendAndExpect("WHOIS alice", " 318 ")
-	assertContains(t, bobWhois, "@#visible", "bob's WHOIS")
-	assertNotContains(t, bobWhois, "#hidden", "bob's WHOIS")
-
-	carol := env.dial(t)
-	carol.register("carol")
-	carol.joinAndDrain("#hidden")
-
-	carolWhois := carol.sendAndExpect("WHOIS alice", " 318 ")
-	assertContains(t, carolWhois, "@#hidden", "carol's WHOIS")
-}
-
-// TestIntegrationModeHashcash checks that PRIVMSG to a +H
-// channel is refused, since an IRC client cannot attach a
-// hashcash stamp.
-func TestIntegrationModeHashcash(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#stamped")
-	alice.sendAndExpect("MODE #stamped +H 2", "+H")
-
-	lines := alice.sendAndExpect(
-		"PRIVMSG #stamped :hello", " 404 ",
-	)
-	assertContains(
-		t, lines, " 404 alice #stamped :Channel requires hashcash",
-		"PRIVMSG refused",
-	)
-}
-
 // TestIntegrationThirdClientObserver verifies that a third
 // client observing the same channel receives messages from
 // the other two.
@@ -1507,6 +1260,9 @@ func TestIntegrationThirdClientObserver(t *testing.T) {
 	bob.joinAndDrain("#trio")
 	carol.joinAndDrain("#trio")
 
+	// Drain join notifications.
+	time.Sleep(100 * time.Millisecond)
+
 	// alice sends; both bob and carol should receive.
 	alice.send("PRIVMSG #trio :hello trio")
 

internal/ircserver/relay.go

@@ -17,7 +17,7 @@ import (
 func (c *Conn) relayMessages(ctx context.Context) {
 	// Use a ticker as a fallback; primary wakeup is via
 	// broker notification.
-	ticker := time.NewTicker(c.pollInterval)
+	ticker := time.NewTicker(pollInterval)
 	defer ticker.Stop()
 
 	for {
@@ -27,34 +27,22 @@ func (c *Conn) relayMessages(ctx context.Context) {
 		default:
 		}
 
-		// Register with the broker before draining, so that a
+		// Drain any available messages.
-		// message queued after the drain has read the queue
+		delivered := c.drainQueue(ctx)
-		// still signals waitCh.
-		waitCh := c.brk.Wait(c.sessionID)
-
-		// Drain any available messages. The drain ignores the
-		// cancel that comes when the connection ends, because a
-		// query cancelled while it runs leaves the SQLite
-		// connection marked broken, and the pool closes it. The
-		// loop still stops on ctx.
-		delivered := c.drainQueue(context.WithoutCancel(ctx))
 
 		if delivered {
-			c.brk.Remove(c.sessionID, waitCh)
-
 			// Tight loop while there are messages.
 			continue
 		}
 
 		// Wait for notification or timeout.
+		waitCh := c.brk.Wait(c.sessionID)
+
 		select {
 		case <-waitCh:
 			// New message notification — loop back.
 		case <-ticker.C:
-			// Periodic check. Nothing used waitCh, so take it
+			// Periodic check.
-			// out of the broker before the next pass adds
-			// another.
-			c.brk.Remove(c.sessionID, waitCh)
 		case <-ctx.Done():
 			c.brk.Remove(c.sessionID, waitCh)
 
@@ -96,7 +84,7 @@ func (c *Conn) drainQueue(ctx context.Context) bool {
 //
 //nolint:cyclop // dispatch table
 func (c *Conn) deliverIRCMessage(
-	ctx context.Context,
+	_ context.Context,
 	msg *db.IRCMessage,
 ) {
 	command := msg.Command
@@ -124,7 +112,7 @@ func (c *Conn) deliverIRCMessage(
 	case command == irc.CmdPart:
 		c.deliverPart(msg, text)
 	case command == irc.CmdNick:
-		c.deliverNickChange(ctx, msg, text)
+		c.deliverNickChange(msg, text)
 	case command == irc.CmdQuit:
 		c.deliverQuitMsg(msg, text)
 	case command == irc.CmdTopic:
@@ -202,6 +190,15 @@ func (c *Conn) deliverTextMessage(
 	from := msg.From
 	target := msg.To
 
+	c.mu.Lock()
+	nick := c.nick
+	c.mu.Unlock()
+
+	// Don't echo our own messages back.
+	if strings.EqualFold(from, nick) {
+		return
+	}
+
 	prefix := from
 	if !strings.Contains(prefix, "!") {
 		prefix = from + "!" + from + "@*"
@@ -214,6 +211,16 @@ func (c *Conn) deliverTextMessage(
 
 // deliverJoin sends a JOIN notification.
 func (c *Conn) deliverJoin(msg *db.IRCMessage) {
+	c.mu.Lock()
+	nick := c.nick
+	c.mu.Unlock()
+
+	// Don't echo our own JOINs (we already sent them
+	// during joinChannel).
+	if strings.EqualFold(msg.From, nick) {
+		return
+	}
+
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -222,6 +229,14 @@ func (c *Conn) deliverJoin(msg *db.IRCMessage) {
 
 // deliverPart sends a PART notification.
 func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
+	c.mu.Lock()
+	nick := c.nick
+	c.mu.Unlock()
+
+	if strings.EqualFold(msg.From, nick) {
+		return
+	}
+
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -234,17 +249,18 @@ func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
 	}
 }
 
-// deliverNickChange sends a NICK change notification. The
+// deliverNickChange sends a NICK change notification.
-// change may be its own session's, made from another client,
-// so the connection first takes the nick its session holds
-// now. It does not go by the line's old nick: the connection
-// may have taken that nick after another user gave it up.
 func (c *Conn) deliverNickChange(
-	ctx context.Context,
 	msg *db.IRCMessage,
 	newNick string,
 ) {
-	c.loadSessionNick(ctx)
+	c.mu.Lock()
+	nick := c.nick
+	c.mu.Unlock()
+
+	if strings.EqualFold(msg.From, nick) {
+		return
+	}
 
 	prefix := msg.From + "!" + msg.From + "@*"
 
@@ -256,6 +272,14 @@ func (c *Conn) deliverQuitMsg(
 	msg *db.IRCMessage,
 	text string,
 ) {
+	c.mu.Lock()
+	nick := c.nick
+	c.mu.Unlock()
+
+	if strings.EqualFold(msg.From, nick) {
+		return
+	}
+
 	prefix := msg.From + "!" + msg.From + "@*"
 
 	if text != "" {
@@ -308,24 +332,16 @@ func (c *Conn) deliverKickMsg(
 	}
 }
 
-// deliverInviteMsg sends an INVITE line from the inviter
+// deliverInviteMsg sends an INVITE notification.
-// for the channel named in text, or nothing when text names
-// no channel.
 func (c *Conn) deliverInviteMsg(
-	msg *db.IRCMessage,
+	_ *db.IRCMessage,
 	text string,
 ) {
-	if text == "" {
-		return
-	}
-
 	c.mu.Lock()
 	nick := c.nick
 	c.mu.Unlock()
 
-	prefix := msg.From + "!" + msg.From + "@*"
+	c.sendFromServer("NOTICE", nick, text)
-
-	c.send(FormatMessage(prefix, "INVITE", nick, text))
 }
 
 // deliverWallops sends a WALLOPS notification.

internal/ircserver/relay_test.go

@@ -1,18 +1,10 @@
 package ircserver_test
 
 import (
-	"context"
 	"encoding/json"
 	"slices"
 	"strings"
 	"testing"
-	"time"
-
-	"golang.org/x/crypto/bcrypt"
-	"sneak.berlin/go/neoirc/internal/config"
-	"sneak.berlin/go/neoirc/internal/dbtest"
-	"sneak.berlin/go/neoirc/internal/ircserver"
-	"sneak.berlin/go/neoirc/internal/service"
 )
 
 // queueMessage queues a message for the user with nick
@@ -33,7 +25,7 @@ func (env *testEnv) queueMessage(
 	}
 
 	msgID, _, err := env.database.InsertMessage(
-		ctx, command, from, to, 0, 0, nil, bodyJSON, nil,
+		ctx, command, from, to, nil, bodyJSON, nil,
 	)
 	if err != nil {
 		t.Fatalf("insert message: %v", err)
@@ -44,7 +36,7 @@ func (env *testEnv) queueMessage(
 		t.Fatalf("get session of %s: %v", recipient, err)
 	}
 
-	err = env.database.EnqueueToSession(ctx, sessionID, msgID, 0)
+	err = env.database.EnqueueToSession(ctx, sessionID, msgID)
 	if err != nil {
 		t.Fatalf("enqueue: %v", err)
 	}
@@ -52,135 +44,6 @@ func (env *testEnv) queueMessage(
 	env.brk.Notify(sessionID)
 }
 
-// TestRelayKeepsOneWaitChannel checks that an IRC listener
-// connection holds at most one broker wait channel across
-// several relay ticks, both while idle and after the relay
-// has delivered it a message, and none once it closes.
-func TestRelayKeepsOneWaitChannel(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnvWithResolver(
-		t, &config.Config{ServerName: testServerName},
-		ircserver.PingInterval, ircserver.PongDeadline,
-		ircserver.PollInterval, ircserver.ResolveHost,
-	)
-
-	client := env.dial(t)
-	client.register("idle")
-
-	sessionID, err := env.database.GetSessionByNick(t.Context(), "idle")
-	if err != nil {
-		t.Fatalf("get session of idle: %v", err)
-	}
-
-	env.checkOneWaitChannel(t, sessionID)
-
-	env.queueMessage(
-		t, "idle", "PRIVMSG", "carol", "idle", []string{"hello"},
-	)
-
-	client.readUntil(func(l string) bool {
-		return strings.Contains(l, "hello")
-	})
-
-	env.checkOneWaitChannel(t, sessionID)
-
-	err = client.conn.Close()
-	if err != nil {
-		t.Fatalf("close: %v", err)
-	}
-
-	deadline := time.Now().Add(testTimeout)
-
-	for env.brk.ListenerCount(sessionID) != 0 {
-		if time.Now().After(deadline) {
-			t.Fatalf("after close: got %d wait channels, want 0",
-				env.brk.ListenerCount(sessionID))
-		}
-
-		time.Sleep(relayCheckStep)
-	}
-}
-
-// checkOneWaitChannel fails the test if the session
-// sessionID holds more than one broker wait channel at any of
-// several relay ticks.
-func (env *testEnv) checkOneWaitChannel(
-	t *testing.T,
-	sessionID int64,
-) {
-	t.Helper()
-
-	const ticks = 5
-
-	for tick := range ticks {
-		time.Sleep(ircserver.PollInterval)
-
-		got := env.brk.ListenerCount(sessionID)
-		if got > 1 {
-			t.Fatalf("tick %d: got %d wait channels, want at most 1",
-				tick+1, got)
-		}
-	}
-}
-
-// TestRelayDeliversAfterFailedRead checks that when the relay
-// cannot read the client output queue, it waits for the next
-// notification, and delivers once the queue can be read again.
-func TestRelayDeliversAfterFailedRead(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-	client := env.dial(t)
-	client.register("reader")
-
-	sessionID, err := env.database.GetSessionByNick(t.Context(), "reader")
-	if err != nil {
-		t.Fatalf("get session of reader: %v", err)
-	}
-
-	dbtest.Exec(t, env.dbURL,
-		"ALTER TABLE client_queues RENAME TO hidden_queues")
-
-	// Each pass of the relay takes a wait channel and then reads
-	// the queue. Once it holds a channel after the second
-	// notification, the read after the first one has failed.
-	for range 2 {
-		env.waitForWaitChannel(t, sessionID)
-		env.brk.Notify(sessionID)
-	}
-
-	env.waitForWaitChannel(t, sessionID)
-
-	dbtest.Exec(t, env.dbURL,
-		"ALTER TABLE hidden_queues RENAME TO client_queues")
-
-	env.queueMessage(
-		t, "reader", "PRIVMSG", "carol", "reader", []string{"readable"},
-	)
-
-	client.readUntil(func(l string) bool {
-		return strings.Contains(l, "readable")
-	})
-}
-
-// waitForWaitChannel waits until the session sessionID holds a
-// broker wait channel, and fails the test if it does not
-// within testTimeout.
-func (env *testEnv) waitForWaitChannel(t *testing.T, sessionID int64) {
-	t.Helper()
-
-	deadline := time.Now().Add(testTimeout)
-
-	for env.brk.ListenerCount(sessionID) == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the relay is not waiting for a notification")
-		}
-
-		time.Sleep(relayCheckStep)
-	}
-}
-
 // TestRelayMultiLineBody checks that each line of a PRIVMSG
 // or NOTICE body sent over the HTTP API reaches an IRC
 // listener user as its own line.
@@ -277,38 +140,6 @@ func TestRelayModeParameters(t *testing.T) {
 	}
 }
 
-// TestRelayInviteWithoutChannel checks that an INVITE whose
-// body names no channel sends the invited IRC listener user
-// no INVITE line.
-func TestRelayInviteWithoutChannel(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	// A nil body is stored as JSON null, which is not an array.
-	for _, body := range [][]string{nil, {}, {""}} {
-		env.queueMessage(t, "bob", "INVITE", "carol", "bob", body)
-	}
-
-	// The relay sends a user's queue in order, so this arrives
-	// after anything sent for the INVITEs above.
-	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
-		[]string{"the end"})
-
-	lines := bob.readUntil(func(l string) bool {
-		return strings.HasSuffix(l, " :the end")
-	})
-
-	for _, line := range lines {
-		if strings.Contains(line, " INVITE ") {
-			t.Errorf("got %q, want no INVITE line", line)
-		}
-	}
-}
-
 // TestRelayLineBreaks checks that a CR, LF or NUL in a stored
 // body line, key or mask never reaches an IRC listener user
 // as a line break, so no extra line arrives, and that a body
@@ -354,419 +185,3 @@ func TestRelayLineBreaks(t *testing.T) {
 		t.Errorf("got %q, want %q", got, want)
 	}
 }
-
-// TestRelayNickDiffersOnlyInCase checks that an IRC listener
-// user alice receives a JOIN, PRIVMSG, PART, NICK and QUIT
-// from Alice in a channel they share: nicks are
-// case-sensitive, so Alice is someone else.
-func TestRelayNickDiffersOnlyInCase(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#case")
-
-	capitalAlice := env.dial(t)
-	capitalAlice.register("Alice")
-
-	for _, step := range []struct {
-		line, want string
-	}{
-		{"JOIN #case", ":Alice!Alice@* JOIN #case"},
-		{"PRIVMSG #case :hi there", ":Alice!Alice@* PRIVMSG #case :hi there"},
-		{"PART #case :see you", ":Alice!Alice@* PART #case :see you"},
-		{"JOIN #case", ":Alice!Alice@* JOIN #case"},
-		{"NICK Alicia", ":Alice!Alice@* NICK Alicia"},
-		{"NICK Alice", ":Alicia!Alicia@* NICK Alice"}, // back for QUIT
-		{"QUIT", ":Alice!Alice@* QUIT :Quit: Client quit"},
-	} {
-		capitalAlice.send(step.line)
-
-		got := alice.readLine()
-		if got != step.want {
-			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
-		}
-	}
-}
-
-// TestRelayOwnChangeOnce checks that an IRC listener user who
-// sets a topic, changes a channel mode or kicks gets one TOPIC,
-// MODE or KICK line for it, and so does the other member.
-func TestRelayOwnChangeOnce(t *testing.T) {
-	t.Parallel()
-
-	for _, step := range []struct {
-		command, line string
-	}{
-		{"TOPIC", "TOPIC #dup :new topic"},
-		{"MODE", "MODE #dup +m"},
-		{"KICK", "KICK #dup carl :bye"},
-	} {
-		t.Run(step.command, func(t *testing.T) {
-			t.Parallel()
-
-			env := newTestEnv(t)
-
-			alice := env.dial(t)
-			alice.register("alice")
-			alice.joinAndDrain("#dup")
-
-			carl := env.dial(t)
-			carl.register("carl")
-			carl.joinAndDrain("#dup")
-
-			alice.send(step.line)
-
-			// The reply to alice's next command comes after her
-			// command has finished, so her own copy comes before it.
-			beforePong := alice.sendAndExpect("PING :done", "PONG")
-
-			// The relay sends a user's queue in order, so a message
-			// queued now arrives after any relayed copy.
-			for nick, client := range map[string]*testClient{
-				"alice": alice, "carl": carl,
-			} {
-				env.queueMessage(
-					t, nick, "PRIVMSG", "dave", nick,
-					[]string{"after the change"},
-				)
-
-				lines := client.readUntil(func(l string) bool {
-					return strings.HasSuffix(l, " :after the change")
-				})
-
-				if client == alice {
-					lines = slices.Concat(beforePong, lines)
-				}
-
-				var changes []string
-
-				for _, line := range lines {
-					if strings.Contains(line, " "+step.command+" #dup ") {
-						changes = append(changes, line)
-					}
-				}
-
-				if len(changes) != 1 {
-					t.Errorf("%s got %q, want one %s line",
-						nick, changes, step.command)
-				}
-			}
-		})
-	}
-}
-
-// TestRelayOwnSessionOnce checks that a command a user makes
-// from one client of their session reaches each of the
-// session's clients once: an IRC listener connection and an
-// HTTP API client. The connection that sent a command gets
-// only its own echo, and none for PRIVMSG and NOTICE, which
-// IRC does not echo.
-//
-//nolint:funlen // table-driven test
-func TestRelayOwnSessionOnce(t *testing.T) {
-	t.Parallel()
-
-	hello := json.RawMessage(`["hello"]`)
-
-	for _, step := range []struct {
-		// line is the command as alice sends it on the IRC
-		// listener.
-		line string
-		// api makes the same command for her session the way
-		// the HTTP API does.
-		api func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error
-		// echoes is how many copies alice's connection gets of
-		// line when it sends line itself.
-		echoes int
-	}{
-		{"PRIVMSG #chan :hello", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			_, err := svc.SendChannelMessage(
-				ctx, sessionID, 0, "alice", "PRIVMSG", "#chan", hello, nil,
-			)
-
-			return err
-		}, 0},
-		{"NOTICE bob :hello", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			_, err := svc.SendDirectMessage(
-				ctx, sessionID, 0, "alice", "NOTICE", "bob", hello, nil,
-			)
-
-			return err
-		}, 0},
-		{"JOIN #other", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			_, err := svc.JoinChannel(ctx, sessionID, 0, "alice", "#other", "")
-
-			return err
-		}, 1},
-		{"PART #chan :bye", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.PartChannel(ctx, sessionID, 0, "alice", "#chan", "bye")
-		}, 1},
-		{"NICK alice2", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.ChangeNick(ctx, sessionID, 0, "alice", "alice2")
-		}, 1},
-		{"TOPIC #chan :new topic", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.SetTopic(
-				ctx, sessionID, 0, "alice", "#chan", "new topic",
-			)
-		}, 1},
-		{"MODE #chan +m", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			chID, err := svc.ValidateChannelOp(ctx, sessionID, "#chan")
-			if err != nil {
-				return err
-			}
-
-			err = svc.SetChannelFlag(ctx, chID, 'm', true)
-			if err != nil {
-				return err
-			}
-
-			svc.BroadcastMode(ctx, 0, "alice", "#chan", chID, "+m")
-
-			return nil
-		}, 1},
-		{"KICK #chan bob :bye", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.KickUser(
-				ctx, sessionID, 0, "alice", "#chan", "bob", "bye",
-			)
-		}, 1},
-	} {
-		command := strings.Fields(step.line)[0]
-
-		t.Run(command+" from IRC", func(t *testing.T) {
-			t.Parallel()
-
-			ircCopies, httpCopies := ownSessionCopies(t, step.line, nil)
-			if ircCopies != step.echoes || httpCopies != 1 {
-				t.Errorf("connection got %d, HTTP client got %d, want %d and 1",
-					ircCopies, httpCopies, step.echoes)
-			}
-		})
-
-		t.Run(command+" from the HTTP API", func(t *testing.T) {
-			t.Parallel()
-
-			ircCopies, httpCopies := ownSessionCopies(t, step.line, step.api)
-			if ircCopies != 1 || httpCopies != 1 {
-				t.Errorf("connection got %d, HTTP client got %d, want 1 and 1",
-					ircCopies, httpCopies)
-			}
-		})
-	}
-}
-
-// ownSessionCopies sets up alice with aliceWithHTTPClient. It
-// makes the command line from her connection, or with api from
-// the HTTP API client when api is not nil, and returns how many
-// copies of it her connection and her HTTP API client got.
-func ownSessionCopies(
-	t *testing.T,
-	line string,
-	api func(ctx context.Context, svc *service.Service, sessionID int64) error,
-) (int, int) {
-	t.Helper()
-
-	ctx := t.Context()
-	env := newTestEnv(t)
-	alice, _, sessionID, httpClientID := aliceWithHTTPClient(t, env)
-
-	var lines []string
-
-	if api == nil {
-		alice.send(line)
-
-		// Her echo comes before the reply to her next command.
-		lines = alice.sendAndExpect("PING :done", "PONG")
-	} else {
-		err := api(ctx, env.srv.Service(), sessionID)
-		if err != nil {
-			t.Fatalf("%s over the HTTP API: %v", line, err)
-		}
-	}
-
-	msgs, _, err := env.database.PollMessages(ctx, httpClientID, 0, 0)
-	if err != nil {
-		t.Fatalf("poll the HTTP API client: %v", err)
-	}
-
-	httpCopies := 0
-
-	for _, msg := range msgs {
-		if msg.Command == strings.Fields(line)[0] {
-			httpCopies++
-		}
-	}
-
-	// The relay sends a queue in order, so this arrives after any
-	// copy. It is queued by session, as NICK changes her nick.
-	endID, _, err := env.database.InsertMessage(
-		ctx, "PRIVMSG", "dave", "alice", 0, 0,
-		nil, json.RawMessage(`["the end"]`), nil,
-	)
-	if err != nil {
-		t.Fatalf("insert message: %v", err)
-	}
-
-	err = env.database.EnqueueToSession(ctx, sessionID, endID, 0)
-	if err != nil {
-		t.Fatalf("enqueue: %v", err)
-	}
-
-	env.brk.Notify(sessionID)
-
-	lines = append(lines, alice.readUntil(func(l string) bool {
-		return strings.HasSuffix(l, " :the end")
-	})...)
-
-	// A copy starts with the command and its first parameter.
-	start := " " + strings.Join(strings.Fields(line)[:2], " ")
-	ircCopies := strings.Count(strings.Join(lines, "\n"), start)
-
-	return ircCopies, httpCopies
-}
-
-// aliceWithHTTPClient connects alice to the IRC listener and
-// has her join #chan, which bob is on too, then adds an HTTP API
-// client to her session with a password, as POST /api/v1/login
-// does. It stores that password without sending PASS. It hashes
-// at bcrypt.MinCost, and a login compares at the cost stored in
-// the hash, so both are fast. It returns her connection, bob's
-// connection, her session and her HTTP API client.
-func aliceWithHTTPClient(
-	t *testing.T, env *testEnv,
-) (*testClient, *testClient, int64, int64) {
-	t.Helper()
-
-	const password = "alicepass"
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#chan")
-
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#chan")
-
-	hash, err := bcrypt.GenerateFromPassword(
-		[]byte(password), bcrypt.MinCost,
-	)
-	if err != nil {
-		t.Fatalf("hash password: %v", err)
-	}
-
-	dbtest.Exec(t, env.dbURL,
-		"UPDATE sessions SET password_hash = '"+string(hash)+
-			"' WHERE nick = 'alice'")
-
-	sessionID, httpClientID, _, err := env.database.LoginUser(
-		t.Context(), "alice", password, "127.0.0.1", "localhost",
-	)
-	if err != nil {
-		t.Fatalf("log in as alice: %v", err)
-	}
-
-	return alice, bob, sessionID, httpClientID
-}
-
-// TestRelayNickChangeFromHTTPAPI checks that once alice's nick
-// is changed from her HTTP API client, her IRC listener
-// connection uses the new nick: what she then sends from it
-// reaches bob under the new nick.
-func TestRelayNickChangeFromHTTPAPI(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-	alice, bob, sessionID, _ := aliceWithHTTPClient(t, env)
-
-	bob.joinAndDrain("#other")
-
-	// As the HTTP API does.
-	err := env.srv.Service().ChangeNick(
-		t.Context(), sessionID, 0, "alice", "alice2",
-	)
-	if err != nil {
-		t.Fatalf("change nick over the HTTP API: %v", err)
-	}
-
-	// Her connection has taken the new nick once it has sent her
-	// the change.
-	const change = ":alice!alice@* NICK alice2"
-
-	alice.readUntil(func(l string) bool { return l == change })
-	bob.readUntil(func(l string) bool { return l == change })
-
-	for _, step := range []struct {
-		line, want string
-	}{
-		{"PRIVMSG #chan :hi there", ":alice2!alice2@* PRIVMSG #chan :hi there"},
-		{"JOIN #other", ":alice2!alice2@* JOIN #other"},
-		{"NICK alice3", ":alice2!alice2@* NICK alice3"},
-	} {
-		alice.send(step.line)
-
-		got := bob.readLine()
-		if got != step.want {
-			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
-		}
-	}
-}
-
-// TestRelayNickChangeKeepsTakenNick checks that an IRC
-// listener connection which takes a nick another user has
-// given up keeps it when that user's change reaches it
-// afterwards: what it then sends goes out under the nick its
-// session holds.
-func TestRelayNickChangeKeepsTakenNick(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.sendAndExpect("NICK bob2", " NICK bob2")
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.sendAndExpect("NICK bob", " NICK bob")
-	alice.joinAndDrain("#chan")
-
-	bob.joinAndDrain("#chan")
-
-	// Bob's change reaches alice only now, as it does when she
-	// takes his old nick before her connection has passed the
-	// change on. She holds bob now, so it is queued to bob.
-	env.queueMessage(t, "bob", "NICK", "bob", "", []string{"bob2"})
-
-	alice.readUntil(func(l string) bool {
-		return l == ":bob!bob@* NICK bob2"
-	})
-
-	alice.send("PRIVMSG #chan :hi there")
-
-	const want = ":bob!bob@* PRIVMSG #chan :hi there"
-
-	got := bob.readLine()
-	if got != want {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}

internal/ircserver/server.go

@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"net"
 	"sync"
-	"time"
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/neoirc/internal/broker"
@@ -16,10 +15,6 @@ import (
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
-// stopTimeout is the longest stop waits for the connections'
-// cleanup, which ends their sessions.
-const stopTimeout = 5 * time.Second
-
 // Params defines the dependencies for creating an IRC
 // Server.
 type Params struct {
@@ -43,24 +38,6 @@ type Server struct {
 	mu       sync.Mutex
 	conns    map[*Conn]struct{}
 	cancel   context.CancelFunc
-
-	// serving counts the connections whose serve, cleanup
-	// included, has not returned yet.
-	serving sync.WaitGroup
-
-	// pingInterval and pongDeadline are the constants of the
-	// same names, except in tests, which shorten them.
-	pingInterval time.Duration
-	pongDeadline time.Duration
-
-	// pollInterval and stopTimeout are the constants of the
-	// same names, except in tests, which change them.
-	pollInterval time.Duration
-	stopTimeout  time.Duration
-
-	// resolveHost is the function of the same name, except in
-	// tests, which replace it with one that blocks.
-	resolveHost func(ctx context.Context, addr string) string
 }
 
 // New creates a new IRC Server and registers its lifecycle
@@ -80,13 +57,6 @@ func New(
 		listener: nil,
 		cancel:   nil,
 		mu:       sync.Mutex{},
-		serving:  sync.WaitGroup{},
-
-		pingInterval: pingInterval,
-		pongDeadline: pongDeadline,
-		pollInterval: pollInterval,
-		stopTimeout:  stopTimeout,
-		resolveHost:  resolveHost,
 	}
 
 	listenAddr := params.Config.IRCListenAddr
@@ -133,10 +103,7 @@ func (s *Server) start(ctx context.Context, addr string) error {
 	return nil
 }
 
-// stop shuts down the listener and all connections, then
+// stop shuts down the listener and all connections.
-// waits up to stopTimeout for every connection's cleanup to
-// finish, so that their sessions are ended before the
-// database closes.
 func (s *Server) stop() {
 	if s.cancel != nil {
 		s.cancel()
@@ -151,22 +118,6 @@ func (s *Server) stop() {
 		c.conn.Close() //nolint:errcheck,gosec
 	}
 	s.mu.Unlock()
-
-	done := make(chan struct{})
-
-	go func() {
-		s.serving.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-	case <-time.After(s.stopTimeout):
-		s.log.Error(
-			"irc connections not cleaned up before stop timeout",
-			"timeout", s.stopTimeout,
-		)
-	}
 }
 
 // acceptLoop accepts new connections.
@@ -187,39 +138,22 @@ func (s *Server) acceptLoop(ctx context.Context) {
 		}
 
 		client := newConn(
-			tcpConn, s.log,
+			ctx, tcpConn, s.log,
-			s.database, s.brk, s.cfg, s.svc, s.pollInterval,
+			s.database, s.brk, s.cfg, s.svc,
 		)
 
 		s.mu.Lock()
-
-		// stop cancels ctx before it takes s.mu to close the
-		// connections, so a connection accepted while stop
-		// runs is either closed and waited for by stop or
-		// closed here.
-		if ctx.Err() != nil {
-			s.mu.Unlock()
-			tcpConn.Close() //nolint:errcheck,gosec
-
-			return
-		}
-
 		s.conns[client] = struct{}{}
-		s.serving.Add(1)
 		s.mu.Unlock()
 
 		go func() {
-			defer s.serving.Done()
 			defer func() {
 				s.mu.Lock()
 				delete(s.conns, client)
 				s.mu.Unlock()
 			}()
 
-			client.serve(
+			client.serve(ctx)
-				ctx, s.resolveHost,
-				s.pingInterval, s.pongDeadline,
-			)
 		}()
 	}
 }

internal/ircserver/server_test.go

@@ -2,49 +2,35 @@ package ircserver_test
 
 import (
 	"bufio"
-	"context"
+	"crypto/rand"
 	"database/sql"
-	"encoding/json"
-	"errors"
 	"fmt"
 	"log/slog"
 	"net"
 	"os"
 	"runtime"
-	"slices"
 	"strings"
-	"sync/atomic"
 	"testing"
 	"time"
 
-	"go.uber.org/fx/fxtest"
-	"golang.org/x/crypto/bcrypt"
 	"sneak.berlin/go/neoirc/internal/broker"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/dbtest"
-	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/ircserver"
-	"sneak.berlin/go/neoirc/internal/logger"
-	"sneak.berlin/go/neoirc/pkg/irc"
 
 	_ "modernc.org/sqlite"
 )
 
-// testTimeout is how long a test waits for something before it
+const testTimeout = 5 * time.Second
-// fails. A passing test never waits this long, so it is generous
-// enough for a heavily loaded host.
-const testTimeout = 30 * time.Second
 
-// testPollInterval is how often the relay of a test server
+func TestMain(m *testing.M) {
-// checks the client output queue without a broker
+	db.SetBcryptCost(4)
-// notification. It is so long that the relay delivers only on
+
-// notification, and a test fails when one is missing.
+	os.Exit(m.Run())
-const testPollInterval = time.Hour
+}
 
 // testEnv holds the shared test infrastructure.
 type testEnv struct {
-	dbURL    string
 	database *db.Database
 	brk      *broker.Broker
 	cfg      *config.Config
@@ -84,76 +70,65 @@ func newTestEnvWithConfig(
 ) *testEnv {
 	t.Helper()
 
-	return newTestEnvWithPingTimes(
+	// A random name, so that no other test environment, not
-		t, cfg, ircserver.PingInterval, ircserver.PongDeadline,
+	// even an earlier run of the same test, can share it.
+	dsn := fmt.Sprintf(
+		"file:%s?mode=memory&cache=shared",
+		rand.Text(),
 	)
-}
 
-// newTestEnvWithPingTimes is newTestEnvWithConfig, except
+	conn, err := sql.Open("sqlite", dsn)
-// that the server sends a connection a PING after interval
-// with nothing read, and closes it when nothing is read
-// within deadline after that.
-func newTestEnvWithPingTimes(
-	t *testing.T,
-	cfg *config.Config,
-	interval, deadline time.Duration,
-) *testEnv {
-	t.Helper()
-
-	return newTestEnvWithResolver(
-		t, cfg, interval, deadline, testPollInterval,
-		ircserver.ResolveHost,
-	)
-}
-
-// newTestEnvWithResolver is newTestEnvWithPingTimes, except
-// that the relay checks the client output queue every poll
-// without a broker notification, and the server looks up a
-// client's hostname with resolve.
-func newTestEnvWithResolver(
-	t *testing.T,
-	cfg *config.Config,
-	interval, deadline, poll time.Duration,
-	resolve func(ctx context.Context, addr string) string,
-) *testEnv {
-	t.Helper()
-
-	dbURL := dbtest.NewURL(t)
-	lifecycle := fxtest.NewLifecycle(t)
-
-	dbLog, err := logger.New(lifecycle, logger.Params{
-		Globals: &globals.Globals{},
-	})
 	if err != nil {
-		t.Fatalf("new logger: %v", err)
+		t.Fatalf("open db: %v", err)
 	}
 
-	database, err := db.New(lifecycle, db.Params{
+	t.Cleanup(func() {
-		Logger:       dbLog,
+		err := conn.Close()
-		Config:       &config.Config{DBURL: dbURL},
-		PasswordCost: bcrypt.MinCost,
-	})
 		if err != nil {
-		t.Fatalf("new database: %v", err)
+			t.Logf("close db: %v", err)
+		}
+	})
+
+	conn.SetMaxOpenConns(1)
+
+	_, err = conn.ExecContext(
+		t.Context(), "PRAGMA foreign_keys = ON",
+	)
+	if err != nil {
+		t.Fatalf("pragma: %v", err)
 	}
 
-	lifecycle.RequireStart()
+	database := db.NewTestDatabaseFromConn(conn)
-	t.Cleanup(lifecycle.RequireStop)
+
+	err = database.RunMigrations(t.Context())
+	if err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
 
 	brk := broker.New()
 
+	var listenConfig net.ListenConfig
+
+	listener, err := listenConfig.Listen(t.Context(), "tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	addr := listener.Addr().String()
+
+	err = listener.Close()
+	if err != nil {
+		t.Fatalf("close listener: %v", err)
+	}
+
 	log := slog.New(slog.NewTextHandler(
 		os.Stderr,
 		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
 	))
 
-	srv := ircserver.NewTestServer(
+	srv := ircserver.NewTestServer(log, cfg, database, brk)
-		log, cfg, database, brk, interval, deadline, poll, resolve,
-	)
 
-	// Port 0 makes the system pick a free port. dial reads it
+	err = srv.Start(addr)
-	// back from the server's listener.
-	err = srv.Start("127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("start irc server: %v", err)
 	}
@@ -163,7 +138,6 @@ func newTestEnvWithResolver(
 	t.Cleanup(srv.Stop)
 
 	return &testEnv{
-		dbURL:    dbURL,
 		database: database,
 		brk:      brk,
 		cfg:      cfg,
@@ -200,34 +174,6 @@ func (env *testEnv) dial(t *testing.T) *testClient {
 	}
 }
 
-// The ping interval and PONG deadline for
-// newTestEnvWithShortPings. They differ, so that a test can
-// tell them apart; the PONG deadline is how long a test
-// client has to answer a PING.
-const (
-	testPingInterval = time.Second
-	testPongDeadline = 300 * time.Millisecond
-)
-
-// newTestEnvWithShortPings starts an IRC server that uses
-// testPingInterval and testPongDeadline in place of
-// pingInterval and pongDeadline.
-func newTestEnvWithShortPings(t *testing.T) *testEnv {
-	t.Helper()
-
-	return newTestEnvWithPingTimes(
-		t,
-		&config.Config{ServerName: testServerName},
-		testPingInterval, testPongDeadline,
-	)
-}
-
-// isServerPing reports whether line is the PING the test
-// server sends a quiet client.
-func isServerPing(line string) bool {
-	return line == "PING :"+testServerName
-}
-
 // testClient wraps a raw TCP connection with helpers.
 type testClient struct {
 	t       *testing.T
@@ -326,24 +272,6 @@ func (tc *testClient) readUntilClosed() []string {
 	return lines
 }
 
-// readServerPing reads until the PING the test server sends a
-// quiet client, and fails the test if it came sooner than
-// testPingInterval after lastSent, a time just before the
-// client sent its last line.
-func (tc *testClient) readServerPing(lastSent time.Time) {
-	tc.t.Helper()
-
-	tc.readUntil(isServerPing)
-
-	waited := time.Since(lastSent)
-	if waited < testPingInterval {
-		tc.t.Errorf(
-			"PING came %v after the client's last line, want at least %v",
-			waited, testPingInterval,
-		)
-	}
-}
-
 // assertContains checks that at least one line matches the
 // given substring.
 func assertContains(
@@ -419,50 +347,6 @@ func TestRegistration(t *testing.T) {
 	assertContains(t, lines, " 001 ", "RPL_WELCOME")
 }
 
-// TestRegistrationWhileAnotherLookupIsPending checks that a
-// client is accepted and registered while the hostname lookup
-// of an earlier client has not returned, and that it
-// registers with the hostname its own lookup returned.
-func TestRegistrationWhileAnotherLookupIsPending(t *testing.T) {
-	t.Parallel()
-
-	const lookedUpHost = "client.example"
-
-	var lookups atomic.Int32
-
-	firstLookupStarted := make(chan struct{})
-
-	// The first lookup returns only when the server stops.
-	resolve := func(ctx context.Context, _ string) string {
-		if lookups.Add(1) == 1 {
-			close(firstLookupStarted)
-			<-ctx.Done()
-		}
-
-		return lookedUpHost
-	}
-
-	env := newTestEnvWithResolver(
-		t, &config.Config{ServerName: testServerName},
-		ircserver.PingInterval, ircserver.PongDeadline,
-		testPollInterval, resolve,
-	)
-
-	env.dial(t)
-
-	select {
-	case <-firstLookupStarted:
-	case <-time.After(testTimeout):
-		t.Fatal("the first client's lookup did not start")
-	}
-
-	lines := env.dial(t).register("second")
-	assertContains(
-		t, lines, "second!second@"+lookedUpHost,
-		"RPL_WELCOME with the looked-up hostname",
-	)
-}
-
 // TestEachTestEnvHasItsOwnDatabase checks that a test
 // environment starts on an empty database while another one
 // is still open.
@@ -493,22 +377,6 @@ func TestWelcomeContainsNick(t *testing.T) {
 	}
 }
 
-// TestMyInfoListsModes checks that RPL_MYINFO lists the user
-// modes o and w, then the channel modes MODE accepts on the
-// IRC listener. It compares the whole line, so a missing or
-// extra mode fails it.
-func TestMyInfoListsModes(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-	lines := env.dial(t).register("carol")
-
-	want := ":test.irc 004 carol test.irc neoirc ow Himnostv"
-	if !slices.Contains(lines, want) {
-		t.Errorf("no line %q in %v", want, lines)
-	}
-}
-
 func TestPingPong(t *testing.T) {
 	t.Parallel()
 
@@ -520,157 +388,14 @@ func TestPingPong(t *testing.T) {
 	assertContains(t, lines, "PONG", "PONG response")
 }
 
-// TestQuietClientAnsweringPingStaysConnected checks that a
-// registered client that sends nothing is sent a PING once
-// the ping interval has passed since its last line, and stays
-// connected as long as it answers each one, whether with a
-// PONG or with another line.
-func TestQuietClientAnsweringPingStaysConnected(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		answer string
-	}{
-		{name: "PONG", answer: "PONG :" + testServerName},
-		{name: "PING of its own", answer: "PING :answer"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			env := newTestEnvWithShortPings(t)
-			client := env.dial(t)
-
-			lastSent := time.Now()
-
-			client.register("answers")
-
-			// The second PING comes later than a client that
-			// answers none stays connected.
-			for range 2 {
-				client.readServerPing(lastSent)
-
-				lastSent = time.Now()
-
-				client.send(tt.answer)
-			}
-
-			client.sendAndExpect("PING :still here", "still here")
-		})
-	}
-}
-
-// TestQuietClientNotAnsweringPingIsClosed checks that a
-// registered client that does not answer the PING is
-// disconnected once the PONG deadline has passed after it.
-func TestQuietClientNotAnsweringPingIsClosed(t *testing.T) {
-	t.Parallel()
-
-	// A read deadline of two ping intervals would close the
-	// connection a second after latest. The ping interval is
-	// longer than testPingInterval, so that the time between
-	// the expected close and latest leaves room for a loaded
-	// host.
-	const (
-		interval = 4 * time.Second
-		earliest = interval + testPongDeadline
-		latest   = 2*interval - time.Second
-	)
-
-	env := newTestEnvWithPingTimes(
-		t,
-		&config.Config{ServerName: testServerName},
-		interval, testPongDeadline,
-	)
-	client := env.dial(t)
-
-	lastSent := time.Now()
-
-	client.register("silent")
-
-	// The server starts both waits once it has handled the
-	// registration, so the time registration took does not
-	// count against latest.
-	registered := time.Now()
-
-	client.readUntil(isServerPing)
-	client.readUntilClosed()
-
-	waited := time.Since(lastSent)
-	if waited < earliest {
-		t.Errorf(
-			"closed %v after the client's last line, want at least %v",
-			waited, earliest,
-		)
-	}
-
-	sinceRegistered := time.Since(registered)
-	if sinceRegistered >= latest {
-		t.Errorf(
-			"closed %v after registration, want less than %v",
-			sinceRegistered, latest,
-		)
-	}
-}
-
-// TestUnregisteredClientAnswersPing checks that a PONG before
-// registration, the answer to the PING unregistered clients
-// are sent too, gets no ERR_NOTREGISTERED.
-func TestUnregisteredClientAnswersPing(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnvWithShortPings(t)
-	client := env.dial(t)
-
-	client.readUntil(isServerPing)
-	client.send("PONG :" + testServerName)
-
-	lines := client.sendAndExpect("PING :after", "PONG")
-	assertNotContains(t, lines, " 451 ", "ERR_NOTREGISTERED")
-}
-
-// TestNewPingTimes checks that a server made by New sends a
-// PING after 90 seconds with nothing read, and closes the
-// connection 30 seconds after that, as README.md states.
-func TestNewPingTimes(t *testing.T) {
-	t.Parallel()
-
-	const (
-		wantInterval = 90 * time.Second
-		wantDeadline = 30 * time.Second
-	)
-
-	log, err := logger.New(nil, logger.Params{
-		Globals: &globals.Globals{},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// With no IRC_LISTEN_ADDR, New starts no listener and
-	// uses nothing else from its params.
-	srv := ircserver.New(fxtest.NewLifecycle(t), ircserver.Params{
-		Logger: log,
-		Config: &config.Config{},
-	})
-
-	interval, deadline := srv.PingTimes()
-	if interval != wantInterval || deadline != wantDeadline {
-		t.Errorf(
-			"PING after %v and close %v later, want %v and %v",
-			interval, deadline, wantInterval, wantDeadline,
-		)
-	}
-}
-
 // TestIdleCleanupKeepsActiveUser checks that a user who
 // sends commands is kept by the idle cleanup, and a user who
 // sends nothing is not.
 func TestIdleCleanupKeepsActiveUser(t *testing.T) {
 	t.Parallel()
 
+	const idleTimeout = 500 * time.Millisecond
+
 	env := newTestEnv(t)
 
 	active := env.dial(t)
@@ -679,17 +404,13 @@ func TestIdleCleanupKeepsActiveUser(t *testing.T) {
 	idle := env.dial(t)
 	idle.register("idle")
 
-	// Both users were last seen before cutoff, and only active
+	time.Sleep(idleTimeout)
-	// sends a command after it, so the result does not depend
-	// on how long the PONG takes to arrive.
-	cutoff := time.Now()
-
 	active.sendAndExpect("PING :still here", "PONG")
 
 	// The idle cleanup in internal/handlers removes exactly
 	// the users this returns.
 	stale, err := env.database.GetStaleOrphanSessions(
-		t.Context(), cutoff,
+		t.Context(), time.Now().Add(-idleTimeout),
 	)
 	if err != nil {
 		t.Fatalf("get stale sessions: %v", err)
@@ -798,68 +519,6 @@ func TestDuplicateNick(t *testing.T) {
 	assertContains(t, lines, " 433 ", "ERR_NICKNAMEINUSE")
 }
 
-// TestNickRefused checks that NICK, before and after
-// registration, answers a nick the HTTP API refuses with
-// ERR_ERRONEUSNICKNAME and keeps the nick as it was, and
-// that another member of the channel sees no line from it.
-func TestNickRefused(t *testing.T) {
-	t.Parallel()
-
-	// Each is what follows "NICK " on the wire.
-	refused := []string{
-		":bob PRIVMSG #inj :hi", // contains spaces
-		":",                     // empty
-		strings.Repeat("a", 33), // one character too long
-		"bob!x",
-		"bob@x",
-		"#bob",
-	}
-
-	env := newTestEnv(t)
-
-	// Before registration: the 432 is addressed to the nick
-	// sent first, and USER registers with that nick.
-	early := env.dial(t)
-	early.send("NICK early")
-
-	for _, param := range refused {
-		lines := early.sendAndExpect("NICK "+param, " 432 ")
-		assertContains(t, lines, " 432 early ", "before: "+param)
-	}
-
-	welcome := early.sendAndExpect("USER early 0 * :Test", " 001 ")
-	assertContains(t, welcome, " 001 early ", "registered as early")
-
-	// After registration.
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#inj")
-
-	mallory := env.dial(t)
-	mallory.register("mallory")
-	mallory.joinAndDrain("#inj")
-
-	bob.readUntil(func(l string) bool {
-		return strings.Contains(l, "JOIN") &&
-			strings.Contains(l, "mallory")
-	})
-
-	for _, param := range refused {
-		lines := mallory.sendAndExpect("NICK "+param, " 432 ")
-		assertContains(t, lines, " 432 mallory ", "after: "+param)
-	}
-
-	mallory.send("PRIVMSG #inj :still mallory")
-
-	bobLines := bob.readUntil(func(l string) bool {
-		return strings.Contains(l, "still mallory")
-	})
-	assertNotContains(t, bobLines, " NICK ", "bob sees no NICK")
-	assertContains(
-		t, bobLines, ":mallory!", "bob sees mallory's message",
-	)
-}
-
 func TestListChannels(t *testing.T) {
 	t.Parallel()
 
@@ -901,228 +560,6 @@ func TestQuit(t *testing.T) {
 	assertContains(t, lines, "goodbye", "QUIT reason")
 }
 
-// TestQuitReasonReachesPeers checks the reason that an IRC
-// listener user's channel peers see in its QUIT, on both the
-// IRC listener and the HTTP API. It is the reason the user
-// gave, Client quit for a QUIT without one, or Connection
-// closed when the connection ends without a QUIT.
-func TestQuitReasonReachesPeers(t *testing.T) {
-	t.Parallel()
-
-	for _, step := range []struct {
-		name, quit, want string
-	}{
-		{"QUIT with a reason", "QUIT :gone home", "gone home"},
-		{"QUIT without a reason", irc.CmdQuit, "Client quit"},
-		{"connection closed without QUIT", "", "Connection closed"},
-	} {
-		t.Run(step.name, func(t *testing.T) {
-			t.Parallel()
-
-			ircLine, apiBody := quitSeenByPeers(t, step.quit)
-
-			want := ":quitter!quitter@* QUIT :Quit: " + step.want
-			if ircLine != want {
-				t.Errorf("IRC peer got %q, want %q", ircLine, want)
-			}
-
-			if len(apiBody) != 1 || apiBody[0] != step.want {
-				t.Errorf("HTTP API peer got %q, want [%q]", apiBody, step.want)
-			}
-		})
-	}
-}
-
-// quitSeenByPeers starts a server on which quitter, ircpeer on
-// the IRC listener and apipeer on the HTTP API share a channel.
-// quitter sends the line quit, or closes its connection when
-// quit is empty. It returns the QUIT line ircpeer is sent and
-// the body of the QUIT apipeer is sent.
-func quitSeenByPeers(t *testing.T, quit string) (string, []string) {
-	t.Helper()
-
-	env := newTestEnv(t)
-	ctx := t.Context()
-
-	ircPeer := env.dial(t)
-	ircPeer.register("ircpeer")
-	ircPeer.joinAndDrain("#bye")
-
-	apiPeerID, apiPeerClientID, _, err := env.database.CreateSession(
-		ctx, "apipeer", "apipeer", "", "",
-	)
-	if err != nil {
-		t.Fatalf("create peer session: %v", err)
-	}
-
-	_, _, err = env.database.CreateOrJoinChannel(ctx, "#bye", apiPeerID, "")
-	if err != nil {
-		t.Fatalf("join peer: %v", err)
-	}
-
-	quitter := env.dial(t)
-	quitter.register("quitter")
-	quitter.joinAndDrain("#bye")
-
-	if quit == "" {
-		err = quitter.conn.Close()
-		if err != nil {
-			t.Fatalf("close: %v", err)
-		}
-	} else {
-		quitter.send(quit)
-	}
-
-	lines := ircPeer.readUntil(func(l string) bool {
-		return strings.Contains(l, " QUIT ")
-	})
-
-	// The QUIT is queued to both peers at once, so apipeer has
-	// it by now.
-	msgs, _, err := env.database.PollMessages(ctx, apiPeerClientID, 0, 0)
-	if err != nil {
-		t.Fatalf("poll peer: %v", err)
-	}
-
-	for _, msg := range msgs {
-		if msg.Command == irc.CmdQuit && msg.From == "quitter" {
-			var body []string
-
-			err = json.Unmarshal(msg.Body, &body)
-			if err != nil {
-				t.Fatalf("decode QUIT body %s: %v", msg.Body, err)
-			}
-
-			return lines[len(lines)-1], body
-		}
-	}
-
-	t.Fatalf("apipeer was not sent the QUIT: %v", msgs)
-
-	return "", nil
-}
-
-// TestStopEndsSessions checks that stopping the server ends
-// a registered connection's session before Stop returns, as
-// closing the connection does: the session, its client and
-// its channel membership are gone from the database, and a
-// channel peer has been sent the QUIT.
-func TestStopEndsSessions(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-	client := env.dial(t)
-
-	client.register("shutirc")
-	client.joinAndDrain("#shut")
-
-	ctx := t.Context()
-
-	// A peer on the HTTP API, whose session outlives the stop.
-	peerID, peerClientID, _, err := env.database.CreateSession(
-		ctx, "peer", "peer", "", "",
-	)
-	if err != nil {
-		t.Fatalf("create peer session: %v", err)
-	}
-
-	channelID, _, err := env.database.CreateOrJoinChannel(
-		ctx, "#shut", peerID, "",
-	)
-	if err != nil {
-		t.Fatalf("join peer: %v", err)
-	}
-
-	env.srv.Stop()
-
-	_, err = env.database.GetSessionByNick(ctx, "shutirc")
-	if !errors.Is(err, sql.ErrNoRows) {
-		t.Errorf("look up shutirc after stop: %v, want no rows", err)
-	}
-
-	clients, err := env.database.GetClientCount(ctx)
-	if err != nil {
-		t.Fatalf("count clients: %v", err)
-	}
-
-	if clients != 1 {
-		t.Errorf("%d clients after stop, want only the peer's", clients)
-	}
-
-	members, err := env.database.GetChannelMemberIDs(ctx, channelID)
-	if err != nil {
-		t.Fatalf("get members: %v", err)
-	}
-
-	if len(members) != 1 || members[0] != peerID {
-		t.Errorf(
-			"members of #shut after stop: %v, want only the peer %d",
-			members, peerID,
-		)
-	}
-
-	msgs, _, err := env.database.PollMessages(ctx, peerClientID, 0, 0)
-	if err != nil {
-		t.Fatalf("poll peer: %v", err)
-	}
-
-	for _, msg := range msgs {
-		if msg.Command == "QUIT" && msg.From == "shutirc" {
-			return
-		}
-	}
-
-	t.Errorf("peer was not sent the QUIT of shutirc: %v", msgs)
-}
-
-// TestStopReturnsWhileCleanupIsStuck checks that Stop stops
-// waiting for a connection's cleanup after its stop timeout,
-// so a cleanup that cannot finish does not hold up stopping.
-func TestStopReturnsWhileCleanupIsStuck(t *testing.T) {
-	t.Parallel()
-
-	const stopTimeout = 100 * time.Millisecond
-
-	env := newTestEnv(t)
-	env.srv.SetStopTimeout(stopTimeout)
-
-	client := env.dial(t)
-
-	client.register("stuck")
-
-	// While a connection of the test's own holds a write
-	// transaction, the cleanup's first write waits for it to end.
-	holder, err := sql.Open("sqlite", env.dbURL)
-	if err != nil {
-		t.Fatalf("open a second database connection: %v", err)
-	}
-
-	_, err = holder.ExecContext(t.Context(), "BEGIN IMMEDIATE")
-	if err != nil {
-		t.Fatalf("begin a write transaction: %v", err)
-	}
-
-	stopped := make(chan struct{})
-
-	go func() {
-		env.srv.Stop()
-		close(stopped)
-	}()
-
-	select {
-	case <-stopped:
-	case <-time.After(stopTimeout + testTimeout):
-		t.Error("Stop did not return while a cleanup was stuck")
-	}
-
-	// Closing ends the transaction, which lets the cleanup finish
-	// before the database is closed.
-	err = holder.Close()
-	if err != nil {
-		t.Errorf("close the second database connection: %v", err)
-	}
-}
-
 func TestTopicSetAndGet(t *testing.T) {
 	t.Parallel()
 
@@ -1163,6 +600,9 @@ func TestDirectMessage(t *testing.T) {
 	receiver := env.dial(t)
 	receiver.register("dmreceiver")
 
+	// Give relay goroutines time to start.
+	time.Sleep(100 * time.Millisecond)
+
 	sender.send("PRIVMSG dmreceiver :hello privately")
 
 	lines := receiver.readUntil(func(line string) bool {
@@ -1275,9 +715,6 @@ func TestAwaySetAndClear(t *testing.T) {
 	assertContains(t, clearLines, " 305 ", "RPL_UNAWAY")
 }
 
-// TestHandlePassPostRegistration checks the NOTICE that
-// confirms PASS after registration. It points to the HTTP API
-// login, the only way to add a client to an existing session.
 func TestHandlePassPostRegistration(t *testing.T) {
 	t.Parallel()
 
@@ -1290,170 +727,10 @@ func TestHandlePassPostRegistration(t *testing.T) {
 	)
 
 	assertContains(
-		t, lines,
+		t, lines, "Password set", "password confirmation",
-		" NOTICE passuser :Password set. Another client can log "+
-			"in to this session over the HTTP API: "+
-			"POST /api/v1/login with your nick and this password.",
-		"password confirmation",
 	)
 }
 
-// The shortest and longest password PASS accepts; bcrypt
-// cannot hash more than 72 bytes.
-const (
-	minPasswordBytes = 8
-	maxPasswordBytes = 72
-)
-
-// passwordLengthNotice is the NOTICE text for a password that
-// is too short or too long.
-const passwordLengthNotice = "Password must be 8 to 72 bytes"
-
-// passwordCase is a password a PASS test sends, and whether
-// the server should store it.
-type passwordCase struct {
-	name     string
-	password string
-	stored   bool
-}
-
-// passwordCases returns the passwords the PASS length tests
-// send: one of 8 to 72 bytes is stored and any other is
-// refused. The limit counts bytes: "é" is two bytes in UTF-8,
-// so 72 of them are refused.
-func passwordCases() []passwordCase {
-	return []passwordCase{
-		{"empty", "", false},
-		{"7 bytes", strings.Repeat("a", minPasswordBytes-1), false},
-		{"8 bytes", strings.Repeat("a", minPasswordBytes), true},
-		{"72 bytes", strings.Repeat("a", maxPasswordBytes), true},
-		{"73 bytes", strings.Repeat("a", maxPasswordBytes+1), false},
-		{"72 characters", strings.Repeat("é", maxPasswordBytes), false},
-	}
-}
-
-// assertStored fails the test unless nick can log in with
-// password exactly when stored is true.
-func assertStored(
-	t *testing.T, env *testEnv, nick, password string, stored bool,
-) {
-	t.Helper()
-
-	_, _, token, err := env.database.LoginUser(
-		t.Context(), nick, password, "127.0.0.1", "localhost",
-	)
-
-	loggedIn := err == nil && token != ""
-	if loggedIn != stored {
-		t.Errorf(
-			"log in as %s: logged in %v, want %v (error: %v)",
-			nick, loggedIn, stored, err,
-		)
-	}
-}
-
-// TestPassPostRegistrationLength checks that PASS after
-// registration stores and confirms a password of 8 to 72
-// bytes, and refuses any other with a NOTICE.
-func TestPassPostRegistrationLength(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	for i, tc := range passwordCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			nick := fmt.Sprintf("postpass%d", i)
-			client := env.dial(t)
-
-			client.register(nick)
-			client.send("PASS :" + tc.password)
-
-			// The server answers commands in order, so its
-			// reply to PASS comes before the PONG.
-			lines := client.sendAndExpect("PING :after", "PONG")
-
-			reply := passwordLengthNotice
-			if tc.stored {
-				reply = "Password set"
-			}
-
-			assertContains(t, lines, reply, "reply to PASS")
-			assertStored(t, env, nick, tc.password, tc.stored)
-		})
-	}
-}
-
-// TestPassPostRegistrationNotStored checks that PASS is not
-// confirmed when the password could not be stored.
-func TestPassPostRegistrationNotStored(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-	client := env.dial(t)
-
-	client.register("failpass")
-
-	dbtest.Exec(t, env.dbURL,
-		`CREATE TRIGGER refuse_password
-		 BEFORE UPDATE OF password_hash ON sessions
-		 BEGIN SELECT RAISE(ABORT, 'refused'); END`,
-	)
-
-	client.send("PASS :mypassword123")
-
-	// The server answers commands in order, so anything it
-	// sent about PASS comes before the PONG.
-	lines := client.sendAndExpect("PING :after", "PONG")
-
-	assertNotContains(
-		t, lines, "Password set",
-		"confirmation of a password that was not stored",
-	)
-}
-
-// TestPassBeforeRegistrationLength checks that a PASS before
-// registration stores a password of 8 to 72 bytes, and that
-// any other is refused with a NOTICE once registration
-// completes.
-func TestPassBeforeRegistrationLength(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	for i, tc := range passwordCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			nick := fmt.Sprintf("prepass%d", i)
-			client := env.dial(t)
-
-			client.send("PASS :" + tc.password)
-			client.register(nick)
-
-			// The password is checked after the welcome
-			// burst, which register reads; the PONG comes
-			// after that.
-			lines := client.sendAndExpect("PING :after", "PONG")
-
-			if tc.stored {
-				assertNotContains(
-					t, lines, passwordLengthNotice,
-					"refusal of a valid password",
-				)
-			} else {
-				assertContains(
-					t, lines, passwordLengthNotice,
-					"refusal after registration",
-				)
-			}
-
-			assertStored(t, env, nick, tc.password, tc.stored)
-		})
-	}
-}
-
 func TestPreRegistrationNotRegistered(t *testing.T) {
 	t.Parallel()
 

internal/middleware/middleware.go

@@ -5,9 +5,6 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
-	"net/netip"
-	"slices"
-	"strings"
 	"time"
 
 	basicauth "github.com/99designs/basicauth-go"
@@ -18,7 +15,6 @@ import (
 	"github.com/slok/go-http-metrics/middleware/std"
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
-	"go4.org/netipx"
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/globals"
 	"sneak.berlin/go/neoirc/internal/logger"
@@ -66,77 +62,6 @@ func ipFromHostPort(hostPort string) string {
 	return host
 }
 
-// ClientIP returns middleware that replaces request.RemoteAddr with the
-// client's address and keeps the port of the TCP connection. The
-// X-Forwarded-For and X-Real-IP headers count only when the connection
-// comes from an address in TRUSTED_PROXIES.
-func (mware *Middleware) ClientIP() func(http.Handler) http.Handler {
-	trusted := mware.params.Config.TrustedProxies
-
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(
-			func(
-				writer http.ResponseWriter,
-				request *http.Request,
-			) {
-				peer, err := netip.ParseAddrPort(request.RemoteAddr)
-				if err == nil {
-					client := clientAddr(
-						peer.Addr().Unmap(), request.Header, trusted,
-					)
-					request.RemoteAddr = netip.AddrPortFrom(
-						client, peer.Port(),
-					).String()
-				}
-
-				next.ServeHTTP(writer, request)
-			})
-	}
-}
-
-// clientAddr returns the client's address for a request from peer. A
-// peer outside trusted is the client, whatever its headers say. A
-// trusted peer is a proxy. Its X-Forwarded-For list is read from the
-// right, past the trusted addresses, to the first untrusted one; when
-// all are trusted, the client is the leftmost. Without X-Forwarded-For,
-// the client is X-Real-IP. An entry that is not an IP address gives
-// peer.
-func clientAddr(
-	peer netip.Addr, header http.Header, trusted *netipx.IPSet,
-) netip.Addr {
-	if !trusted.Contains(peer) {
-		return peer
-	}
-
-	forwarded := strings.Join(header.Values("X-Forwarded-For"), ",")
-	if forwarded == "" {
-		realIP, err := netip.ParseAddr(
-			strings.TrimSpace(header.Get("X-Real-IP")),
-		)
-		if err != nil {
-			return peer
-		}
-
-		return realIP.Unmap()
-	}
-
-	client := peer
-
-	for _, entry := range slices.Backward(strings.Split(forwarded, ",")) {
-		addr, err := netip.ParseAddr(strings.TrimSpace(entry))
-		if err != nil {
-			return peer
-		}
-
-		client = addr.Unmap()
-		if !trusted.Contains(client) {
-			break
-		}
-	}
-
-	return client
-}
-
 type loggingResponseWriter struct {
 	http.ResponseWriter
 
@@ -200,19 +125,24 @@ func (mware *Middleware) Logging() func(http.Handler) http.Handler {
 	}
 }
 
-// CORS returns middleware that lets a page on any origin read the
+// CORS returns middleware that handles Cross-Origin Resource Sharing.
-// response. Use it only on public, read-only routes.
+// AllowCredentials is true so browsers include cookies in
+// cross-origin API requests.
 func (mware *Middleware) CORS() func(http.Handler) http.Handler {
 	return cors.Handler(cors.Options{ //nolint:exhaustruct // optional fields
-		AllowedOrigins: []string{"*"},
+		AllowOriginFunc: func(
+			_ *http.Request, _ string,
+		) bool {
+			return true
+		},
 		AllowedMethods: []string{
 			"GET", "POST", "PUT", "DELETE", "OPTIONS",
 		},
 		AllowedHeaders: []string{
-			"Accept", "Authorization", "Content-Type", "X-CSRF-Token",
+			"Accept", "Content-Type", "X-CSRF-Token",
 		},
 		ExposedHeaders:   []string{"Link"},
-		AllowCredentials: false,
+		AllowCredentials: true,
 		MaxAge:           corsMaxAge,
 	})
 }

internal/middleware/middleware_test.go

@@ -1,189 +0,0 @@
-package middleware_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"testing"
-	"time"
-
-	"go4.org/netipx"
-	"sneak.berlin/go/neoirc/internal/config"
-	"sneak.berlin/go/neoirc/internal/globals"
-	"sneak.berlin/go/neoirc/internal/logger"
-	"sneak.berlin/go/neoirc/internal/middleware"
-)
-
-// The tests trust 10.0.0.0/8. Clients use the documentation ranges
-// 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24.
-const (
-	trustedNetwork = "10.0.0.0/8"
-	proxyPeer      = "10.0.0.1:4000"
-	directPeer     = "192.0.2.1:4000"
-	client         = "203.0.113.7"
-	clientWithPort = "203.0.113.7:4000"
-	realIPClient   = "203.0.113.8"
-)
-
-type clientIPTest struct {
-	name       string
-	remoteAddr string
-	forwarded  []string
-	realIP     string
-	want       string
-}
-
-func clientIPTests() []clientIPTest {
-	return []clientIPTest{
-		{
-			name:       "untrusted peer ignores forged headers",
-			remoteAddr: directPeer,
-			forwarded:  []string{client},
-			realIP:     realIPClient,
-			want:       directPeer,
-		},
-		{name: "trusted peer without headers", remoteAddr: proxyPeer, want: proxyPeer},
-		{
-			name:       "trusted peer gives rightmost untrusted entry",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{"198.51.100.9, 203.0.113.7, 10.0.0.2"},
-			want:       clientWithPort,
-		},
-		{
-			name:       "entries split over several headers",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{"198.51.100.9", client, "10.0.0.2"},
-			want:       clientWithPort,
-		},
-		{
-			name:       "all-trusted chain gives leftmost entry",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{"10.0.0.3, 10.0.0.2"},
-			want:       "10.0.0.3:4000",
-		},
-		{
-			name:       "X-Real-IP without X-Forwarded-For",
-			remoteAddr: proxyPeer,
-			realIP:     realIPClient,
-			want:       "203.0.113.8:4000",
-		},
-		{
-			name:       "X-Forwarded-For wins over X-Real-IP",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{client},
-			realIP:     realIPClient,
-			want:       clientWithPort,
-		},
-		{
-			name:       "unparseable X-Forwarded-For entry gives peer",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{"203.0.113.7, not-an-ip, 10.0.0.2"},
-			want:       proxyPeer,
-		},
-		{
-			name:       "unparseable entry past the client is not read",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{"not-an-ip, 203.0.113.7"},
-			want:       clientWithPort,
-		},
-		{
-			name:       "unparseable X-Real-IP gives peer",
-			remoteAddr: proxyPeer,
-			realIP:     "not-an-ip",
-			want:       proxyPeer,
-		},
-		{
-			name:       "mapped IPv6 peer is unmapped and trusted",
-			remoteAddr: "[::ffff:10.0.0.1]:4000",
-			forwarded:  []string{client},
-			want:       clientWithPort,
-		},
-		{
-			name:       "mapped IPv6 peer outside the set",
-			remoteAddr: "[::ffff:192.0.2.1]:4000",
-			forwarded:  []string{client},
-			want:       directPeer,
-		},
-		{
-			name:       "IPv6 client",
-			remoteAddr: proxyPeer,
-			forwarded:  []string{"2001:db8::1"},
-			want:       "[2001:db8::1]:4000",
-		},
-	}
-}
-
-func TestClientIP(t *testing.T) {
-	t.Parallel()
-
-	mware := newMiddleware(t, trustedNetwork)
-
-	for _, test := range clientIPTests() {
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			var got string
-
-			handler := mware.ClientIP()(http.HandlerFunc(func(
-				_ http.ResponseWriter, request *http.Request,
-			) {
-				got = request.RemoteAddr
-			}))
-
-			request := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, "/", nil,
-			)
-			request.RemoteAddr = test.remoteAddr
-
-			for _, value := range test.forwarded {
-				request.Header.Add("X-Forwarded-For", value)
-			}
-
-			if test.realIP != "" {
-				request.Header.Set("X-Real-IP", test.realIP)
-			}
-
-			handler.ServeHTTP(httptest.NewRecorder(), request)
-
-			if got != test.want {
-				t.Errorf("RemoteAddr = %q, want %q", got, test.want)
-			}
-		})
-	}
-}
-
-// newMiddleware returns a Middleware that trusts the network trusted.
-func newMiddleware(t *testing.T, trusted string) *middleware.Middleware {
-	t.Helper()
-
-	var builder netipx.IPSetBuilder
-
-	builder.AddPrefix(netip.MustParsePrefix(trusted))
-
-	trustedSet, err := builder.IPSet()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	globs := &globals.Globals{
-		Appname:   "neoirc-test",
-		Version:   "test",
-		StartTime: time.Now(),
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: globs})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	mware, err := middleware.New(nil, middleware.Params{
-		Logger:  log,
-		Globals: globs,
-		Config:  &config.Config{TrustedProxies: trustedSet},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return mware
-}

internal/server/export_test.go

@@ -1,28 +0,0 @@
-package server
-
-import (
-	"net"
-
-	"github.com/go-chi/chi/v5"
-)
-
-// NewTestSPAServer creates a Server whose router serves only
-// the embedded web client.
-func NewTestSPAServer() *Server {
-	srv := &Server{router: chi.NewRouter()}
-	srv.setupSPA()
-
-	return srv
-}
-
-// Listener returns the listener the start hook bound for the
-// HTTP server.
-func (srv *Server) Listener() net.Listener {
-	return srv.listener
-}
-
-// ServeUntilShutdown runs serveUntilShutdown, which serves the
-// HTTP server on listener, and returns when it does.
-func (srv *Server) ServeUntilShutdown(listener net.Listener) {
-	srv.serveUntilShutdown(listener)
-}

internal/server/routes.go

@@ -3,7 +3,6 @@ package server
 import (
 	"io/fs"
 	"net/http"
-	"strings"
 	"time"
 
 	"sneak.berlin/go/neoirc/web"
@@ -23,13 +22,13 @@ func (srv *Server) SetupRoutes() {
 
 	srv.router.Use(middleware.Recoverer)
 	srv.router.Use(middleware.RequestID)
-	srv.router.Use(srv.mw.ClientIP())
 	srv.router.Use(srv.mw.Logging())
 
 	if viper.GetString("METRICS_USERNAME") != "" {
 		srv.router.Use(srv.mw.Metrics())
 	}
 
+	srv.router.Use(srv.mw.CORS())
 	srv.router.Use(srv.mw.CSP())
 	srv.router.Use(middleware.Timeout(routeTimeout))
 
@@ -44,7 +43,7 @@ func (srv *Server) SetupRoutes() {
 	}
 
 	// Health check.
-	srv.router.With(srv.mw.CORS()).Get(
+	srv.router.Get(
 		"/.well-known/healthcheck.json",
 		srv.handlers.HandleHealthCheck(),
 	)
@@ -68,7 +67,7 @@ func (srv *Server) SetupRoutes() {
 }
 
 func (srv *Server) setupAPIv1(router chi.Router) {
-	router.With(srv.mw.CORS()).Get(
+	router.Get(
 		"/server",
 		srv.handlers.HandleServerInfo(),
 	)
@@ -138,10 +137,8 @@ func (srv *Server) setupSPA() {
 			return
 		}
 
-		// The path is empty, not "/", for a request line such
-		// as "GET http://host HTTP/1.1".
 		fileData, readErr := readFS.ReadFile(
-			strings.TrimPrefix(request.URL.Path, "/"),
+			request.URL.Path[1:],
 		)
 		if readErr != nil || len(fileData) == 0 {
 			indexHTML, indexErr := readFS.ReadFile(

internal/server/routes_test.go

@@ -1,41 +0,0 @@
-package server_test
-
-import (
-	"io/fs"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"sneak.berlin/go/neoirc/internal/server"
-	"sneak.berlin/go/neoirc/web"
-)
-
-// An absolute-form request line with no path, such as
-// "GET http://example.com HTTP/1.1", leaves URL.Path empty.
-func TestSPAServesIndexForEmptyPath(t *testing.T) {
-	t.Parallel()
-
-	request := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "http://example.com", nil,
-	)
-	if request.URL.Path != "" {
-		t.Fatalf("URL.Path is %q, want it empty", request.URL.Path)
-	}
-
-	recorder := httptest.NewRecorder()
-
-	server.NewTestSPAServer().ServeHTTP(recorder, request)
-
-	if recorder.Code != http.StatusOK {
-		t.Fatalf("status %d, want %d", recorder.Code, http.StatusOK)
-	}
-
-	indexHTML, err := fs.ReadFile(web.Dist, "dist/index.html")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if recorder.Body.String() != string(indexHTML) {
-		t.Errorf("body is not the index page")
-	}
-}

internal/server/server.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -40,17 +39,18 @@ type Params struct {
 	Config     *config.Config
 	Middleware *middleware.Middleware
 	Handlers   *handlers.Handlers
-	Shutdowner fx.Shutdowner
 }
 
 // Server is the main HTTP server.
 // It manages routing, middleware, and lifecycle.
 type Server struct {
 	startupTime   time.Time
+	exitCode      int
 	sentryEnabled bool
 	log           *slog.Logger
+	ctx           context.Context //nolint:containedctx // signal handling pattern
+	cancelFunc    context.CancelFunc
 	httpServer    *http.Server
-	listener      net.Listener
 	router        *chi.Mux
 	params        Params
 	mw            *middleware.Middleware
@@ -69,7 +69,7 @@ func New(
 	}
 
 	lifecycle.Append(fx.Hook{
-		OnStart: func(ctx context.Context) error {
+		OnStart: func(_ context.Context) error {
 			srv.startupTime = time.Now()
 
 			// Build the router before OnStart returns, so srv can
@@ -78,14 +78,13 @@ func New(
 			srv.enableSentry()
 			srv.SetupRoutes()
 
-			// A closed stdout or stderr must not end the process.
+			// The start hook's context ends when the hook
-			signal.Ignore(syscall.SIGPIPE)
+			// returns; serving must outlive it.
+			go srv.serve() //nolint:contextcheck,gosec // G118
 
-			return srv.startHTTP(ctx)
+			return nil
 		},
-		OnStop: func(ctx context.Context) error {
+		OnStop: func(_ context.Context) error {
-			srv.cleanShutdown(ctx)
-
 			return nil
 		},
 	})
@@ -130,15 +129,44 @@ func (srv *Server) enableSentry() {
 	srv.sentryEnabled = true
 }
 
+func (srv *Server) serve() int {
+	srv.ctx, srv.cancelFunc = context.WithCancel(
+		context.Background(),
+	)
+
+	go func() {
+		sigCh := make(chan os.Signal, 1)
+
+		signal.Ignore(syscall.SIGPIPE)
+		signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
+
+		sig := <-sigCh
+
+		srv.log.Info("signal received", "signal", sig)
+
+		if srv.cancelFunc != nil {
+			srv.cancelFunc()
+		}
+	}()
+
+	go srv.serveUntilShutdown()
+
+	<-srv.ctx.Done()
+
+	srv.cleanShutdown()
+
+	return srv.exitCode
+}
+
 func (srv *Server) cleanupForExit() {
 	srv.log.Info("cleaning up")
 }
 
-// cleanShutdown stops the HTTP server, waiting up to
+func (srv *Server) cleanShutdown() {
-// shutdownTimeout for the requests in progress to finish.
+	srv.exitCode = 0
-func (srv *Server) cleanShutdown(ctx context.Context) {
+
 	ctxShutdown, shutdownCancel := context.WithTimeout(
-		ctx, shutdownTimeout,
+		context.Background(), shutdownTimeout,
 	)
 
 	err := srv.httpServer.Shutdown(ctxShutdown)
@@ -163,25 +191,11 @@ func (srv *Server) configure() {
 	// Server configuration placeholder.
 }
 
-// startHTTP binds the HTTP listen address, so that a port
+func (srv *Server) serveUntilShutdown() {
-// that is taken fails startup, then serves the HTTP server
-// from a new goroutine. srv.httpServer is set before that
-// goroutine starts and never changes, so it and cleanShutdown
-// read it without a lock.
-func (srv *Server) startHTTP(ctx context.Context) error {
 	listenAddr := fmt.Sprintf(
 		":%d", srv.params.Config.Port,
 	)
 
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(ctx, "tcp", listenAddr)
-	if err != nil {
-		return fmt.Errorf("http listen: %w", err)
-	}
-
-	srv.listener = listener
-
 	srv.httpServer = &http.Server{ //nolint:exhaustruct // optional fields
 		Addr:           listenAddr,
 		ReadTimeout:    httpReadTimeout,
@@ -190,30 +204,16 @@ func (srv *Server) startHTTP(ctx context.Context) error {
 		Handler:        srv,
 	}
 
-	go func() {
-		srv.serveUntilShutdown(listener)
-	}()
-
-	return nil
-}
-
-// serveUntilShutdown serves the HTTP server on listener until
-// cleanShutdown stops it. If serving fails before then, it
-// stops the app with exit code 1.
-func (srv *Server) serveUntilShutdown(listener net.Listener) {
 	srv.log.Info(
-		"http begin listen", "listenaddr", srv.httpServer.Addr,
+		"http begin listen", "listenaddr", listenAddr,
 	)
 
-	err := srv.httpServer.Serve(listener)
+	err := srv.httpServer.ListenAndServe()
-	if errors.Is(err, http.ErrServerClosed) {
+	if err != nil && !errors.Is(err, http.ErrServerClosed) {
-		return
-	}
-
 		srv.log.Error("listen error", "error", err)
 
-	err = srv.params.Shutdowner.Shutdown(fx.ExitCode(1))
+		if srv.cancelFunc != nil {
-	if err != nil {
+			srv.cancelFunc()
-		srv.log.Error("shutdown failed", "error", err)
+		}
 	}
 }

internal/server/server_test.go

@@ -1,409 +0,0 @@
-// Tests use a global viper instance for configuration,
-// making parallel execution unsafe.
-//
-//nolint:paralleltest
-package server_test
-
-import (
-	"fmt"
-	"maps"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxtest"
-	"sneak.berlin/go/neoirc/internal/broker"
-	"sneak.berlin/go/neoirc/internal/config"
-	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/dbtest"
-	"sneak.berlin/go/neoirc/internal/globals"
-	"sneak.berlin/go/neoirc/internal/handlers"
-	"sneak.berlin/go/neoirc/internal/healthcheck"
-	"sneak.berlin/go/neoirc/internal/logger"
-	"sneak.berlin/go/neoirc/internal/middleware"
-	"sneak.berlin/go/neoirc/internal/server"
-	"sneak.berlin/go/neoirc/internal/service"
-	"sneak.berlin/go/neoirc/internal/stats"
-)
-
-const (
-	testTimeout = 5 * time.Second
-
-	// checkStep is how often waitUntil checks again.
-	checkStep = 10 * time.Millisecond
-
-	// stopHoldTime is how long a test waits to see that the
-	// app has not stopped.
-	stopHoldTime = 200 * time.Millisecond
-)
-
-// TestStopWaitsForRequestInProgress checks that stopping the
-// app, which runs the stop hook server.New registers, waits
-// for a long poll the HTTP server is serving to finish, and
-// that the poll gets its response.
-func TestStopWaitsForRequestInProgress(t *testing.T) {
-	var srv *server.Server
-
-	app, brk, database := startApp(t, fx.Populate(&srv))
-
-	sessionID, _, token, err := database.CreateSession(
-		t.Context(), "poller", "poller", "", "",
-	)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	tcpAddr, ok := srv.Listener().Addr().(*net.TCPAddr)
-	if !ok {
-		t.Fatalf("listener address %v is not TCP", srv.Listener().Addr())
-	}
-
-	addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(tcpAddr.Port))
-
-	statuses := make(chan int, 1)
-
-	go func() {
-		statuses <- getAuthenticated(
-			t, "http://"+addr+"/api/v1/messages?timeout=30", token,
-		)
-	}()
-
-	waitUntil(t, "the long poll to wait for a message", func() bool {
-		return brk.ListenerCount(sessionID) == 1
-	})
-
-	var stopErr error
-
-	stopped := make(chan struct{})
-
-	go func() {
-		stopErr = app.Stop(t.Context())
-
-		close(stopped)
-	}()
-
-	select {
-	case <-stopped:
-		t.Error("the app stopped while a request was in progress")
-	case <-time.After(stopHoldTime):
-	}
-
-	brk.Notify(sessionID)
-
-	status := <-statuses
-	if status != http.StatusOK {
-		t.Errorf("status %d, want %d", status, http.StatusOK)
-	}
-
-	select {
-	case <-stopped:
-		if stopErr != nil {
-			t.Errorf("stop: %v", stopErr)
-		}
-	case <-time.After(testTimeout):
-		t.Fatal("the app did not stop after the request finished")
-	}
-}
-
-// TestStartFailsWhenHTTPPortIsTaken checks that starting the
-// app, which runs the start hook server.New registers,
-// returns an error naming the HTTP listen address when
-// something else is already listening on its port.
-func TestStartFailsWhenHTTPPortIsTaken(t *testing.T) {
-	var listenConfig net.ListenConfig
-
-	taken, err := listenConfig.Listen(t.Context(), "tcp", ":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	t.Cleanup(func() { _ = taken.Close() })
-
-	tcpAddr, ok := taken.Addr().(*net.TCPAddr)
-	if !ok {
-		t.Fatalf("listener address %v is not TCP", taken.Addr())
-	}
-
-	app, _, _ := newApp(t, tcpAddr.Port)
-
-	err = app.Start(t.Context())
-	if err == nil {
-		app.RequireStop()
-		t.Fatal("the app started while its HTTP port was taken")
-	}
-
-	listenAddr := fmt.Sprintf(":%d", tcpAddr.Port)
-	if !strings.Contains(err.Error(), listenAddr) {
-		t.Errorf("start error %q does not name %s", err, listenAddr)
-	}
-}
-
-// TestServeFailureStopsApp checks that when serving HTTP fails
-// after the start hook has bound the listen address, the
-// server stops the app with exit code 1.
-func TestServeFailureStopsApp(t *testing.T) {
-	var srv *server.Server
-
-	app, _, _ := startApp(t, fx.Populate(&srv))
-
-	shutdowns := app.Wait()
-
-	srv.ServeUntilShutdown(closedListener(t))
-
-	select {
-	case shutdown := <-shutdowns:
-		if shutdown.ExitCode != 1 {
-			t.Errorf("exit code %d, want 1", shutdown.ExitCode)
-		}
-	default:
-		t.Error("the server did not stop the app")
-	}
-}
-
-// TestServeAfterStopDoesNotStopApp checks that serving HTTP
-// after the app has stopped, which ends at once because the
-// stop hook has shut the HTTP server down, does not stop the
-// app. Serving ends the same way on every normal stop.
-func TestServeAfterStopDoesNotStopApp(t *testing.T) {
-	var srv *server.Server
-
-	app, _, _ := startApp(t, fx.Populate(&srv))
-
-	shutdowns := app.Wait()
-
-	app.RequireStop()
-
-	srv.ServeUntilShutdown(closedListener(t))
-
-	select {
-	case shutdown := <-shutdowns:
-		t.Errorf(
-			"the server stopped the app with exit code %d",
-			shutdown.ExitCode,
-		)
-	default:
-	}
-}
-
-// TestCORSHeaders checks the Access-Control-Allow-* headers on the
-// answers to requests from another origin. The public, read-only
-// routes answer with Access-Control-Allow-Origin: * alone. Routes
-// that need the cookie, and a preflight to one, answer with none.
-func TestCORSHeaders(t *testing.T) {
-	var srv *server.Server
-
-	startApp(t, fx.Populate(&srv))
-
-	tests := []struct {
-		name          string
-		method        string
-		path          string
-		requestMethod string
-		wantHeaders   map[string]string
-	}{
-		{
-			name:        "server information",
-			method:      http.MethodGet,
-			path:        "/api/v1/server",
-			wantHeaders: map[string]string{"Access-Control-Allow-Origin": "*"},
-		},
-		{
-			name:        "health check",
-			method:      http.MethodGet,
-			path:        "/.well-known/healthcheck.json",
-			wantHeaders: map[string]string{"Access-Control-Allow-Origin": "*"},
-		},
-		{
-			name:   "send",
-			method: http.MethodPost,
-			path:   "/api/v1/messages",
-		},
-		{
-			name:   "state",
-			method: http.MethodGet,
-			path:   "/api/v1/state",
-		},
-		{
-			name:          "preflight for send",
-			method:        http.MethodOptions,
-			path:          "/api/v1/messages",
-			requestMethod: http.MethodPost,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			request := httptest.NewRequestWithContext(
-				t.Context(), test.method,
-				"http://chat.example.com"+test.path, nil,
-			)
-			request.Header.Set("Origin", "http://blog.example.com")
-
-			if test.requestMethod != "" {
-				request.Header.Set(
-					"Access-Control-Request-Method", test.requestMethod,
-				)
-			}
-
-			recorder := httptest.NewRecorder()
-
-			srv.ServeHTTP(recorder, request)
-
-			gotHeaders := map[string]string{}
-
-			for name := range recorder.Header() {
-				if strings.HasPrefix(name, "Access-Control-Allow-") {
-					gotHeaders[name] = recorder.Header().Get(name)
-				}
-			}
-
-			if !maps.Equal(gotHeaders, test.wantHeaders) {
-				t.Errorf(
-					"Access-Control-Allow-* headers are %v, want %v",
-					gotHeaders, test.wantHeaders,
-				)
-			}
-		})
-	}
-}
-
-// startApp starts the app newApp builds, with the HTTP port
-// set to 0, so the system gives the server a free port.
-func startApp(
-	t *testing.T,
-	options ...fx.Option,
-) (*fxtest.App, *broker.Broker, *db.Database) {
-	t.Helper()
-
-	app, brk, database := newApp(t, 0, options...)
-
-	app.RequireStart()
-
-	// Stops the app if the test ends before stopping it.
-	t.Cleanup(app.RequireStop)
-
-	return app, brk, database
-}
-
-// newApp builds, without starting it, an app that runs the
-// server with the dependencies cmd/neoircd gives it, on a
-// fresh in-memory database, with the HTTP port set to port.
-// options are added to the app, for a test that needs more
-// from it than the broker and the database.
-func newApp(
-	t *testing.T,
-	port int,
-	options ...fx.Option,
-) (*fxtest.App, *broker.Broker, *db.Database) {
-	t.Helper()
-
-	var (
-		brk      *broker.Broker
-		database *db.Database
-	)
-
-	app := fxtest.New(t,
-		fx.Supply(&globals.Globals{
-			Appname:   "neoirc-test",
-			Version:   "test",
-			StartTime: time.Now(),
-		}),
-		fx.Provide(
-			broker.New,
-			config.New,
-			db.New,
-			handlers.New,
-			healthcheck.New,
-			logger.New,
-			middleware.New,
-			server.New,
-			service.New,
-			stats.New,
-		),
-		fx.Decorate(func(cfg *config.Config) *config.Config {
-			cfg.DBURL = dbtest.NewURL(t)
-			cfg.Port = port
-
-			return cfg
-		}),
-		fx.Invoke(func(*server.Server) {}),
-		fx.Populate(&brk, &database),
-		fx.Options(options...),
-	)
-
-	return app, brk, database
-}
-
-// closedListener returns a TCP listener that has already been
-// closed, so that accepting a connection on it fails.
-func closedListener(t *testing.T) net.Listener {
-	t.Helper()
-
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(
-		t.Context(), "tcp", "127.0.0.1:0",
-	)
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	err = listener.Close()
-	if err != nil {
-		t.Fatalf("close listener: %v", err)
-	}
-
-	return listener
-}
-
-// waitUntil calls done every checkStep until it returns true,
-// and fails the test if it does not within testTimeout.
-func waitUntil(t *testing.T, what string, done func() bool) {
-	t.Helper()
-
-	deadline := time.Now().Add(testTimeout)
-
-	for !done() {
-		if time.Now().After(deadline) {
-			t.Fatalf("timed out waiting for %s", what)
-		}
-
-		time.Sleep(checkStep)
-	}
-}
-
-// getAuthenticated sends a GET request to url as the session
-// whose auth token is token, and returns the response status,
-// or 0 if there was no response.
-func getAuthenticated(t *testing.T, url, token string) int {
-	t.Helper()
-
-	request, err := http.NewRequestWithContext(
-		t.Context(), http.MethodGet, url, nil,
-	)
-	if err != nil {
-		t.Errorf("new request: %v", err)
-
-		return 0
-	}
-
-	request.Header.Set("Cookie", "neoirc_auth="+token)
-
-	client := http.Client{Timeout: testTimeout}
-
-	response, err := client.Do(request)
-	if err != nil {
-		t.Errorf("get %s: %v", url, err)
-
-		return 0
-	}
-
-	_ = response.Body.Close()
-
-	return response.StatusCode
-}

internal/service/service.go

@@ -21,7 +21,6 @@ import (
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
 	"sneak.berlin/go/neoirc/internal/globals"
-	"sneak.berlin/go/neoirc/internal/hashcash"
 	"sneak.berlin/go/neoirc/internal/logger"
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
@@ -31,7 +30,6 @@ const (
 	msgNoSuchChannel = "No such channel"
 	msgNoSuchNick    = "No such nick/channel"
 	msgNotChannelOp  = "You're not channel operator"
-	msgNotOnChannel  = "You're not on that channel"
 )
 
 // maxUserhostNicks is how many nicks one USERHOST answers
@@ -44,18 +42,6 @@ var validChannelRe = regexp.MustCompile(
 	`^#[a-zA-Z0-9_\-]{1,63}$`,
 )
 
-// validNickRe matches the nicks both transports accept: a
-// letter or _, then up to 31 letters, digits or
-// _-[]\^{}|`.
-var validNickRe = regexp.MustCompile(
-	`^[a-zA-Z_][a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{0,31}$`,
-)
-
-// ValidNick reports whether validNickRe matches nick.
-func ValidNick(nick string) bool {
-	return validNickRe.MatchString(nick)
-}
-
 // Params defines the dependencies for creating a Service.
 type Params struct {
 	fx.In
@@ -82,7 +68,6 @@ type Service struct {
 	config  *config.Config
 	globals *globals.Globals
 	log     *slog.Logger
-	channelHashcash *hashcash.ChannelValidator
 
 	wireMu    sync.Mutex
 	wireConns map[int64]WireConn
@@ -96,7 +81,6 @@ func New(params Params) *Service {
 		config:    params.Config,
 		globals:   params.Globals,
 		log:       params.Logger.Get(),
-		channelHashcash: hashcash.NewChannelValidator(),
 		wireConns: make(map[int64]WireConn),
 	}
 }
@@ -116,7 +100,6 @@ func NewTestService(
 		config:    cfg,
 		globals:   globs,
 		log:       log,
-		channelHashcash: hashcash.NewChannelValidator(),
 		wireConns: make(map[int64]WireConn),
 	}
 }
@@ -311,8 +294,8 @@ func (s *Service) SendWallops(
 	}
 
 	_, _, err = s.FanOut(
-		ctx, irc.CmdWallops, nick, "*", 0, 0,
+		ctx, irc.CmdWallops, nick, "*",
-		nil, body, nil, recipients, 0,
+		nil, body, nil, recipients,
 	)
 	if err != nil {
 		return fmt.Errorf("wallops: %w", err)
@@ -344,66 +327,71 @@ type DirectMsgResult struct {
 }
 
 // FanOut inserts a message and enqueues it to all given
-// session IDs, notifying each via the broker. toSessionID
+// session IDs, notifying each via the broker.
-// and toChannelID are the recipient InsertMessage records
-// for history, 0 when there is none.
-//
-// skipClientID is the client whose queue the message is
-// not added to: the IRC listener connection that sent the
-// command, which has already shown it to its user. The HTTP
-// API passes 0, as its clients see their own commands
-// through their queues.
 func (s *Service) FanOut(
 	ctx context.Context,
 	command, from, to string,
-	toSessionID, toChannelID int64,
 	params, body, meta json.RawMessage,
 	sessionIDs []int64,
-	skipClientID int64,
 ) (int64, string, error) {
 	dbID, msgUUID, err := s.db.InsertMessage(
-		ctx, command, from, to,
+		ctx, command, from, to, params, body, meta,
-		toSessionID, toChannelID, params, body, meta,
 	)
 	if err != nil {
 		return 0, "", fmt.Errorf("insert message: %w", err)
 	}
 
 	for _, sid := range sessionIDs {
-		_ = s.db.EnqueueToSession(ctx, sid, dbID, skipClientID)
+		_ = s.db.EnqueueToSession(ctx, sid, dbID)
 		s.broker.Notify(sid)
 	}
 
 	return dbID, msgUUID, nil
 }
 
-// SendChannelMessage checks membership, bans and
+// excludeSession returns a copy of ids without the given
-// moderation, then the hashcash stamp of a PRIVMSG to a +H
+// session.
-// channel, then fans out a message to all channel members,
+func excludeSession(
-// the sender's session included, skipping client
+	ids []int64,
-// skipClientID as FanOut does. The stamp is checked after
+	exclude int64,
-// the other checks so that a message they refuse does not
+) []int64 {
-// spend it. Returns the message UUID and any error.
+	out := make([]int64, 0, len(ids))
-func (s *Service) SendChannelMessage(
+
-	ctx context.Context,
+	for _, id := range ids {
-	sessionID, skipClientID int64,
+		if id != exclude {
-	nick, command, channel string,
+			out = append(out, id)
-	body, meta json.RawMessage,
+		}
-) (string, error) {
-	noSuchChannel := &IRCError{
-		irc.ErrNoSuchChannel, []string{channel}, msgNoSuchChannel,
 	}
 
+	return out
+}
+
+// SendChannelMessage validates membership and moderation,
+// then fans out a message to all channel members except
+// the sender. Returns the database row ID, message UUID,
+// and any error. The dbID lets callers enqueue the same
+// message to the sender when echo is needed (HTTP
+// transport).
+func (s *Service) SendChannelMessage(
+	ctx context.Context,
+	sessionID int64,
+	nick, command, channel string,
+	body, meta json.RawMessage,
+) (int64, string, error) {
 	chID, err := s.db.GetChannelByName(ctx, channel)
 	if err != nil {
-		return "", noSuchChannel
+		return 0, "", &IRCError{
+			irc.ErrNoSuchChannel,
+			[]string{channel},
+			msgNoSuchChannel,
+		}
 	}
 
 	isMember, _ := s.db.IsChannelMember(
 		ctx, chID, sessionID,
 	)
 	if !isMember {
-		return "", &IRCError{
+		return 0, "", &IRCError{
 			irc.ErrCannotSendToChan,
 			[]string{channel},
 			"Cannot send to channel",
@@ -415,7 +403,7 @@ func (s *Service) SendChannelMessage(
 		ctx, chID, sessionID,
 	)
 	if banErr == nil && isBanned {
-		return "", &IRCError{
+		return 0, "", &IRCError{
 			irc.ErrCannotSendToChan,
 			[]string{channel},
 			"Cannot send to channel (+b)",
@@ -432,7 +420,7 @@ func (s *Service) SendChannelMessage(
 		)
 
 		if !isOp && !isVoiced {
-			return "", &IRCError{
+			return 0, "", &IRCError{
 				irc.ErrCannotSendToChan,
 				[]string{channel},
 				"Cannot send to channel (+m)",
@@ -440,50 +428,36 @@ func (s *Service) SendChannelMessage(
 		}
 	}
 
-	if command == irc.CmdPrivmsg {
-		err = s.checkChannelHashcash(
-			ctx, chID, channel, body, meta,
-		)
-		if err != nil {
-			return "", err
-		}
-	}
-
 	memberIDs, _ := s.db.GetChannelMemberIDs(ctx, chID)
+	recipients := excludeSession(memberIDs, sessionID)
 
-	_, uuid, fanErr := s.FanOut(
+	dbID, uuid, fanErr := s.FanOut(
-		ctx, command, nick, channel, 0, chID,
+		ctx, command, nick, channel,
-		nil, body, meta, memberIDs, skipClientID,
+		nil, body, meta, recipients,
 	)
-	// The channel was deleted after the lookup above.
-	if db.IsForeignKeyConstraintError(fanErr) {
-		return "", noSuchChannel
-	}
-
 	if fanErr != nil {
-		return "", fanErr
+		return 0, "", fanErr
 	}
 
-	return uuid, nil
+	return dbID, uuid, nil
 }
 
 // SendDirectMessage validates the target and sends a
-// direct message to the target and the sender's session,
+// direct message, returning the message UUID and any away
-// skipping client skipClientID as FanOut does, and returns
+// message set on the target.
-// the message UUID and any away message set on the target.
 func (s *Service) SendDirectMessage(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	nick, command, target string,
 	body, meta json.RawMessage,
 ) (*DirectMsgResult, error) {
-	noSuchNick := &IRCError{
-		irc.ErrNoSuchNick, []string{target}, "No such nick",
-	}
-
 	targetSID, err := s.db.GetSessionByNick(ctx, target)
 	if err != nil {
-		return nil, noSuchNick
+		return nil, &IRCError{
+			irc.ErrNoSuchNick,
+			[]string{target},
+			"No such nick",
+		}
 	}
 
 	away, _ := s.db.GetAway(ctx, targetSID)
@@ -494,14 +468,9 @@ func (s *Service) SendDirectMessage(
 	}
 
 	_, uuid, fanErr := s.FanOut(
-		ctx, command, nick, target, targetSID, 0,
+		ctx, command, nick, target,
-		nil, body, meta, recipients, skipClientID,
+		nil, body, meta, recipients,
 	)
-	// The target's session was deleted after the lookup above.
-	if db.IsForeignKeyConstraintError(fanErr) {
-		return nil, noSuchNick
-	}
-
 	if fanErr != nil {
 		return nil, fanErr
 	}
@@ -511,12 +480,11 @@ func (s *Service) SendDirectMessage(
 
 // JoinChannel creates or joins a channel, making the
 // first joiner the operator. Fans out the JOIN to all
-// channel members, skipping client skipClientID as FanOut
+// channel members. A channel name that validChannelRe
-// does. A channel name that validChannelRe does not match
+// does not match gets ERR_NOSUCHCHANNEL.
-// gets ERR_NOSUCHCHANNEL.
 func (s *Service) JoinChannel(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	nick, channel, suppliedKey string,
 ) (*JoinResult, error) {
 	if !validChannelRe.MatchString(channel) {
@@ -527,19 +495,47 @@ func (s *Service) JoinChannel(
 		}
 	}
 
-	chID, isCreator, err := s.db.CreateOrJoinChannel(
+	chID, err := s.db.GetOrCreateChannel(ctx, channel)
-		ctx, channel, sessionID, suppliedKey,
-	)
 	if err != nil {
-		return nil, joinError(channel, err)
+		return nil, fmt.Errorf("get/create channel: %w", err)
 	}
 
+	memberCount, countErr := s.db.CountChannelMembers(
+		ctx, chID,
+	)
+	isCreator := countErr == nil && memberCount == 0
+
+	if !isCreator {
+		joinErr := checkJoinRestrictions(
+			ctx, s.db, chID, sessionID,
+			channel, suppliedKey, memberCount,
+		)
+		if joinErr != nil {
+			return nil, joinErr
+		}
+	}
+
+	if isCreator {
+		err = s.db.JoinChannelAsOperator(
+			ctx, chID, sessionID,
+		)
+	} else {
+		err = s.db.JoinChannel(ctx, chID, sessionID)
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("join channel: %w", err)
+	}
+
+	// Clear invite after successful join.
+	_ = s.db.ClearChannelInvite(ctx, chID, sessionID)
+
 	memberIDs, _ := s.db.GetChannelMemberIDs(ctx, chID)
 	body, _ := json.Marshal([]string{channel}) //nolint:errchkjson
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, irc.CmdJoin, nick, channel, 0, chID,
+		ctx, irc.CmdJoin, nick, channel,
-		nil, body, nil, memberIDs, skipClientID,
+		nil, body, nil, memberIDs,
 	)
 
 	return &JoinResult{
@@ -548,12 +544,12 @@ func (s *Service) JoinChannel(
 	}, nil
 }
 
-// PartChannel validates membership, broadcasts PART to all
+// PartChannel validates membership, broadcasts PART to
-// channel members, skipping client skipClientID as FanOut
+// remaining members, removes the user, and cleans up empty
-// does, removes the user, and cleans up empty channels.
+// channels.
 func (s *Service) PartChannel(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	nick, channel, reason string,
 ) error {
 	chID, err := s.db.GetChannelByName(ctx, channel)
@@ -572,29 +568,30 @@ func (s *Service) PartChannel(
 		return &IRCError{
 			irc.ErrNotOnChannel,
 			[]string{channel},
-			msgNotOnChannel,
+			"You're not on that channel",
 		}
 	}
 
 	memberIDs, _ := s.db.GetChannelMemberIDs(ctx, chID)
+	recipients := excludeSession(memberIDs, sessionID)
 	body, _ := json.Marshal([]string{reason}) //nolint:errchkjson
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, irc.CmdPart, nick, channel, 0, chID,
+		ctx, irc.CmdPart, nick, channel,
-		nil, body, nil, memberIDs, skipClientID,
+		nil, body, nil, recipients,
 	)
 
-	s.db.PartChannelAndDeleteIfEmpty(ctx, chID, sessionID) //nolint:errcheck,gosec
+	s.db.PartChannel(ctx, chID, sessionID) //nolint:errcheck,gosec
+	s.db.DeleteChannelIfEmpty(ctx, chID)   //nolint:errcheck,gosec
 
 	return nil
 }
 
 // SetTopic validates membership and topic-lock, sets the
-// topic, and broadcasts the change to all channel members,
+// topic, and broadcasts the change.
-// skipping client skipClientID as FanOut does.
 func (s *Service) SetTopic(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	nick, channel, topic string,
 ) error {
 	chID, err := s.db.GetChannelByName(ctx, channel)
@@ -613,7 +610,7 @@ func (s *Service) SetTopic(
 		return &IRCError{
 			irc.ErrNotOnChannel,
 			[]string{channel},
-			msgNotOnChannel,
+			"You're not on that channel",
 		}
 	}
 
@@ -642,20 +639,19 @@ func (s *Service) SetTopic(
 	body, _ := json.Marshal([]string{topic}) //nolint:errchkjson
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, irc.CmdTopic, nick, channel, 0, chID,
+		ctx, irc.CmdTopic, nick, channel,
-		nil, body, nil, memberIDs, skipClientID,
+		nil, body, nil, memberIDs,
 	)
 
 	return nil
 }
 
 // KickUser validates operator status and target
-// membership, broadcasts the KICK to all channel members,
+// membership, broadcasts the KICK, removes the target,
-// skipping client skipClientID as FanOut does, removes the
+// and cleans up empty channels.
-// target, and cleans up empty channels.
 func (s *Service) KickUser(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	nick, channel, targetNick, reason string,
 ) error {
 	chID, err := s.db.GetChannelByName(ctx, channel)
@@ -707,93 +703,21 @@ func (s *Service) KickUser(
 	)
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, irc.CmdKick, nick, channel, 0, chID,
+		ctx, irc.CmdKick, nick, channel,
-		params, body, nil, memberIDs, skipClientID,
+		params, body, nil, memberIDs,
 	)
 
-	s.db.PartChannelAndDeleteIfEmpty(ctx, chID, targetSID) //nolint:errcheck,gosec
+	s.db.PartChannel(ctx, chID, targetSID) //nolint:errcheck,gosec
+	s.db.DeleteChannelIfEmpty(ctx, chID)   //nolint:errcheck,gosec
 
 	return nil
 }
 
-// InviteUser records an invite of targetNick to channel,
-// which JoinChannel consumes, and returns the target's
-// session ID. The inviter must be on the channel, and an
-// operator if it is +i; the target must exist and not be
-// on the channel already.
-func (s *Service) InviteUser(
-	ctx context.Context,
-	sessionID int64,
-	nick, targetNick, channel string,
-) (int64, error) {
-	chID, err := s.db.GetChannelByName(ctx, channel)
-	if err != nil {
-		return 0, &IRCError{
-			irc.ErrNoSuchChannel,
-			[]string{channel},
-			msgNoSuchChannel,
-		}
-	}
-
-	isMember, memErr := s.db.IsChannelMember(
-		ctx, chID, sessionID,
-	)
-	if memErr != nil || !isMember {
-		return 0, &IRCError{
-			irc.ErrNotOnChannel,
-			[]string{channel},
-			msgNotOnChannel,
-		}
-	}
-
-	isInviteOnly, ioErr := s.db.IsChannelInviteOnly(ctx, chID)
-	if ioErr == nil && isInviteOnly {
-		isOp, opErr := s.db.IsChannelOperator(
-			ctx, chID, sessionID,
-		)
-		if opErr != nil || !isOp {
-			return 0, &IRCError{
-				irc.ErrChanOpPrivsNeeded,
-				[]string{channel},
-				msgNotChannelOp,
-			}
-		}
-	}
-
-	targetSID, err := s.db.GetSessionByNick(ctx, targetNick)
-	if err != nil {
-		return 0, &IRCError{
-			irc.ErrNoSuchNick,
-			[]string{targetNick},
-			msgNoSuchNick,
-		}
-	}
-
-	alreadyIn, aiErr := s.db.IsChannelMember(
-		ctx, chID, targetSID,
-	)
-	if aiErr == nil && alreadyIn {
-		return 0, &IRCError{
-			irc.ErrUserOnChannel,
-			[]string{targetNick, channel},
-			"is already on channel",
-		}
-	}
-
-	err = s.db.AddChannelInvite(ctx, chID, targetSID, nick)
-	if err != nil {
-		return 0, fmt.Errorf("add invite: %w", err)
-	}
-
-	return targetSID, nil
-}
-
 // ChangeNick changes a user's nickname and broadcasts the
-// change to the user's own session and all users sharing
+// change to all users sharing channels.
-// channels, skipping client skipClientID as FanOut does.
 func (s *Service) ChangeNick(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	oldNick, newNick string,
 ) error {
 	err := s.db.ChangeNick(ctx, sessionID, newNick)
@@ -814,62 +738,66 @@ func (s *Service) ChangeNick(
 		}
 	}
 
-	s.broadcastNickChange(
+	s.broadcastNickChange(ctx, sessionID, oldNick, newNick)
-		ctx, sessionID, skipClientID, oldNick, newNick,
-	)
 
 	return nil
 }
 
-// BroadcastQuit parts the session from all its channels,
+// BroadcastQuit broadcasts a QUIT to all channel peers,
-// deletes it, and queues a QUIT to the users who shared a
+// parts all channels, and deletes the session. Uses the
-// channel with it, in one transaction, so that the QUIT is
+// FanOut pattern: one message row fanned out to all unique
-// queued before anyone else can take the nick, and then
+// peer sessions.
-// wakes those users' long polls. Of several calls for one
-// session at once, only the one that deletes it sends the
-// QUIT.
 func (s *Service) BroadcastQuit(
 	ctx context.Context,
 	sessionID int64,
 	nick, reason string,
 ) {
-	body, _ := json.Marshal([]string{reason}) //nolint:errchkjson
+	channels, err := s.db.GetSessionChannels(
-
+		ctx, sessionID,
-	peerIDs, err := s.db.QuitSession(ctx, sessionID, nick, body)
+	)
 	if err != nil {
-		s.log.Error("quit failed", "error", err)
-
 		return
 	}
 
-	for _, peerID := range peerIDs {
+	notified := make(map[int64]bool)
-		s.broker.Notify(peerID)
-	}
-}
 
-// Logout deletes a client of the session and, if that was
+	for _, ch := range channels {
-// the session's last client, does what BroadcastQuit does.
+		memberIDs, memErr := s.db.GetChannelMemberIDs(
-// If that fails, nothing changes and Logout returns the
+			ctx, ch.ID,
-// error.
-func (s *Service) Logout(
-	ctx context.Context,
-	sessionID, clientID int64,
-	nick string,
-) error {
-	body, _ := json.Marshal([]string{"Connection closed"}) //nolint:errchkjson
-
-	peerIDs, err := s.db.LogoutClient(
-		ctx, sessionID, clientID, nick, body,
 		)
-	if err != nil {
+		if memErr != nil {
-		return fmt.Errorf("logout: %w", err)
+			continue
 		}
 
-	for _, peerID := range peerIDs {
+		for _, mid := range memberIDs {
-		s.broker.Notify(peerID)
+			if mid == sessionID || notified[mid] {
+				continue
 			}
 
-	return nil
+			notified[mid] = true
+		}
+	}
+
+	if len(notified) > 0 {
+		recipients := make([]int64, 0, len(notified))
+		for sid := range notified {
+			recipients = append(recipients, sid)
+		}
+
+		body, _ := json.Marshal([]string{reason}) //nolint:errchkjson
+
+		_, _, _ = s.FanOut(
+			ctx, irc.CmdQuit, nick, "",
+			nil, body, nil, recipients,
+		)
+	}
+
+	for _, ch := range channels {
+		s.db.PartChannel(ctx, ch.ID, sessionID) //nolint:errcheck,gosec
+		s.db.DeleteChannelIfEmpty(ctx, ch.ID)   //nolint:errcheck,gosec
+	}
+
+	s.db.DeleteSession(ctx, sessionID) //nolint:errcheck,gosec
 }
 
 // SetAway sets or clears the away message. Returns true
@@ -1036,10 +964,9 @@ func (s *Service) SetChannelFlag(
 }
 
 // BroadcastMode fans out a MODE change to all channel
-// members, skipping client skipClientID as FanOut does.
+// members.
 func (s *Service) BroadcastMode(
 	ctx context.Context,
-	skipClientID int64,
 	nick, channel string,
 	chID int64,
 	modeText string,
@@ -1048,8 +975,8 @@ func (s *Service) BroadcastMode(
 	body, _ := json.Marshal([]string{modeText}) //nolint:errchkjson
 
 	_, _, _ = s.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, irc.CmdMode, nick, channel, 0, chID,
+		ctx, irc.CmdMode, nick, channel,
-		nil, body, nil, memberIDs, skipClientID,
+		nil, body, nil, memberIDs,
 	)
 }
 
@@ -1169,12 +1096,6 @@ func (s *Service) ApplyUserMode(
 	return s.QueryUserMode(ctx, sessionID)
 }
 
-// UserModes lists the user modes the server supports, as
-// RPL_MYINFO sends them: o (server operator) and w
-// (receives WALLOPS). parseUserModeString must accept the
-// same letters.
-const UserModes = "ow"
-
 // parseUserModeString parses a user mode string such as
 // "+w", "-o" or "+w-o" into the new value of each flag it
 // names, or nil for a flag it does not name; a later letter
@@ -1248,71 +1169,11 @@ func (s *Service) requireOper(
 	return nil
 }
 
-// checkChannelHashcash returns ERR_CANNOTSENDTOCHAN unless
+// broadcastNickChange notifies channel peers of a nick
-// the channel has no +H, or meta carries a hashcash stamp
-// for this channel and body with enough bits that has not
-// been used before. Recording the stamp as spent is the
-// check that it is unused, so a stamp sent in several
-// concurrent requests passes in only one of them.
-func (s *Service) checkChannelHashcash(
-	ctx context.Context,
-	chID int64,
-	channel string,
-	body, meta json.RawMessage,
-) error {
-	bits, err := s.db.GetChannelHashcashBits(ctx, chID)
-	if err != nil {
-		return fmt.Errorf("channel hashcash bits: %w", err)
-	}
-
-	if bits <= 0 {
-		return nil
-	}
-
-	stamp := extractHashcashFromMeta(meta)
-	if stamp == "" {
-		return &IRCError{
-			irc.ErrCannotSendToChan,
-			[]string{channel},
-			"Channel requires hashcash proof-of-work",
-		}
-	}
-
-	err = s.channelHashcash.ValidateStamp(
-		stamp, bits, channel, hashcash.BodyHash(body),
-	)
-	if err != nil {
-		return &IRCError{
-			irc.ErrCannotSendToChan,
-			[]string{channel},
-			"Invalid hashcash: " + err.Error(),
-		}
-	}
-
-	stampKey := hashcash.StampHash(stamp)
-
-	recorded, err := s.db.RecordSpentHashcash(ctx, stampKey)
-	if err != nil {
-		return fmt.Errorf("record spent hashcash: %w", err)
-	}
-
-	if !recorded {
-		return &IRCError{
-			irc.ErrCannotSendToChan,
-			[]string{channel},
-			"Hashcash stamp already used",
-		}
-	}
-
-	return nil
-}
-
-// broadcastNickChange notifies the user's own session,
-// except client skipClientID, and channel peers of a nick
 // change.
 func (s *Service) broadcastNickChange(
 	ctx context.Context,
-	sessionID, skipClientID int64,
+	sessionID int64,
 	oldNick, newNick string,
 ) {
 	channels, err := s.db.GetSessionChannels(
@@ -1326,7 +1187,7 @@ func (s *Service) broadcastNickChange(
 	notified := make(map[int64]bool)
 
 	dbID, _, insErr := s.db.InsertMessage(
-		ctx, irc.CmdNick, oldNick, "", 0, 0,
+		ctx, irc.CmdNick, oldNick, "",
 		nil, body, nil,
 	)
 	if insErr != nil {
@@ -1334,7 +1195,7 @@ func (s *Service) broadcastNickChange(
 	}
 
 	// Notify the user themselves (for multi-client sync).
-	_ = s.db.EnqueueToSession(ctx, sessionID, dbID, skipClientID)
+	_ = s.db.EnqueueToSession(ctx, sessionID, dbID)
 	s.broker.Notify(sessionID)
 	notified[sessionID] = true
 
@@ -1353,36 +1214,60 @@ func (s *Service) broadcastNickChange(
 
 			notified[mid] = true
 
-			_ = s.db.EnqueueToSession(ctx, mid, dbID, 0)
+			_ = s.db.EnqueueToSession(ctx, mid, dbID)
 			s.broker.Notify(mid)
 		}
 	}
 }
 
-// joinError returns the IRC error for a JOIN of channel
+// checkJoinRestrictions validates Tier 2 join conditions:
-// that db.CreateOrJoinChannel refused with err, or err
+// bans, invite-only, channel key, and user limit.
-// wrapped if it is not a refusal.
+func checkJoinRestrictions(
-func joinError(channel string, err error) error {
+	ctx context.Context,
-	switch {
+	database *db.Database,
-	case errors.Is(err, db.ErrBannedFromChannel):
+	chID, sessionID int64,
+	channel, suppliedKey string,
+	memberCount int64,
+) error {
+	isBanned, banErr := database.IsSessionBanned(
+		ctx, chID, sessionID,
+	)
+	if banErr == nil && isBanned {
 		return &IRCError{
 			Code:    irc.ErrBannedFromChan,
 			Params:  []string{channel},
 			Message: "Cannot join channel (+b)",
 		}
-	case errors.Is(err, db.ErrInviteOnlyChannel):
+	}
+
+	isInviteOnly, ioErr := database.IsChannelInviteOnly(
+		ctx, chID,
+	)
+	if ioErr == nil && isInviteOnly {
+		hasInvite, invErr := database.HasChannelInvite(
+			ctx, chID, sessionID,
+		)
+		if invErr != nil || !hasInvite {
 			return &IRCError{
 				Code:    irc.ErrInviteOnlyChan,
 				Params:  []string{channel},
 				Message: "Cannot join channel (+i)",
 			}
-	case errors.Is(err, db.ErrBadChannelKey):
+		}
+	}
+
+	key, keyErr := database.GetChannelKey(ctx, chID)
+	if keyErr == nil && key != "" && suppliedKey != key {
 		return &IRCError{
 			Code:    irc.ErrBadChannelKey,
 			Params:  []string{channel},
 			Message: "Cannot join channel (+k)",
 		}
-	case errors.Is(err, db.ErrChannelIsFull):
+	}
+
+	limit, limErr := database.GetChannelUserLimit(ctx, chID)
+	if limErr == nil && limit > 0 &&
+		memberCount >= int64(limit) {
 		return &IRCError{
 			Code:    irc.ErrChannelIsFull,
 			Params:  []string{channel},
@@ -1390,35 +1275,5 @@ func joinError(channel string, err error) error {
 		}
 	}
 
-	return fmt.Errorf("join channel: %w", err)
+	return nil
-}
-
-// extractHashcashFromMeta parses the meta JSON and
-// returns the hashcash stamp string, or empty string
-// if not present.
-func extractHashcashFromMeta(meta json.RawMessage) string {
-	if len(meta) == 0 {
-		return ""
-	}
-
-	var metaMap map[string]json.RawMessage
-
-	err := json.Unmarshal(meta, &metaMap)
-	if err != nil {
-		return ""
-	}
-
-	raw, ok := metaMap["hashcash"]
-	if !ok {
-		return ""
-	}
-
-	var stamp string
-
-	err = json.Unmarshal(raw, &stamp)
-	if err != nil {
-		return ""
-	}
-
-	return stamp
 }

schema/README.md

@@ -1,101 +1,98 @@
-# Message schemas
+# Message Schemas
 
-This directory holds JSON Schema files (draft 2020-12) for the messages that the
+JSON Schema definitions (draft 2020-12) for the neoirc protocol. Messages use
-neoirc HTTP API carries. `message.json` describes the fields that every message
+**IRC command names and numeric reply codes** (RFC 1459/2812) encoded as JSON
-can have. `commands/` has files for some commands. `numerics/` has files for
+over HTTP.
-some of the numeric replies. A numeric reply is a server reply named by a
-three-digit number, such as `001`. `README.md` at the repository root documents
-the protocol.
 
-The server can also run an IRC listener for ordinary IRC clients. The IRC
+## Envelope
-listener sends plain IRC lines, which these files do not describe.
 
-## Message fields
+Every message is a JSON object with a `command` field. The format maps directly
-
+to IRC wire format:
-Every message is one JSON object, which `message.json` calls the envelope. These
-are the fields it can have:
-
-- `command`: the IRC command name, such as `PRIVMSG`, or the name of a numeric
-  reply, such as `RPL_WELCOME`. Always present.
-- `code`: the number of a numeric reply, such as `1` for `RPL_WELCOME`. Absent
-  on other messages.
-- `id`: the message's UUID, a unique ID that the server assigns.
-- `from`: the sender's nick, or the server name on a numeric reply or a `PONG`.
-- `to`: the target, such as a channel name starting with `#` or a nick.
-- `params`: an array of strings with the message's other parameters, in order.
-  `KICK` events and many numeric replies have it. The HTTP API ignores `params`
-  sent by a client.
-- `body`: an array of strings. It is never a bare string. In a `PRIVMSG` or
-  `NOTICE`, each string is one line of text.
-- `ts`: the time the server stored the message. It is an RFC 3339 time in UTC,
-  such as `2026-10-27T12:00:00.123Z`.
-- `meta`: an object of extra data, such as a hashcash stamp in `meta.hashcash`.
-  A hashcash stamp is a short string that takes a computer some work to make. A
-  `PRIVMSG` to a channel with mode `+H` needs one. The HTTP API relays the
-  `meta` of a `PRIVMSG` or `NOTICE` unchanged. It drops the `meta` of every
-  other command.
-
-Here is one `PRIVMSG` as the IRC listener sends it and as the HTTP API sends it.
-The JSON leaves out `id`, `ts` and `meta`:
 
 ```
-IRC:  :alice!alice@* PRIVMSG #general :hello world
+IRC:  :nick PRIVMSG #channel :hello world
-JSON: {"command": "PRIVMSG", "from": "alice", "to": "#general", "body": ["hello world"]}
+JSON: {"command": "PRIVMSG", "from": "nick", "to": "#channel", "body": ["hello world"]}
+
+IRC:  :server 353 nick = #channel :user1 @op1 +voice1
+JSON: {"command": "353", "to": "nick", "params": ["=", "#channel"], "body": ["user1 @op1 +voice1"]}
+
+Multiline:  {"command": "PRIVMSG", "to": "#ch", "body": ["line 1", "line 2"]}
+Structured: {"command": "PUBKEY", "body": {"alg": "ed25519", "key": "base64..."}}
 ```
 
-In the JSON, a numeric reply has its name in `command` and its number in `code`.
+Common fields (see `message.json` for full schema):
-This `353` reply lists the members of `#general`. The JSON again leaves out
-`id`, `ts` and `meta`:
 
-```
+| Field     | Type            | Description                                          |
-{"command": "RPL_NAMREPLY", "code": 353, "from": "neoirc", "to": "alice",
+| --------- | --------------- | ---------------------------------------------------- |
- "params": ["=", "#general"], "body": ["@op1!op1@host1 alice!alice@host2"]}
+| `id`      | string (uuid)   | Server-assigned message UUID                         |
-```
+| `command` | string          | IRC command or 3-digit numeric code                  |
+| `from`    | string          | Source nick or server name (IRC prefix)              |
+| `to`      | string          | Target: #channel or nick                             |
+| `params`  | string[]        | Middle parameters (mainly for numerics)              |
+| `body`    | array \| object | Structured body — never a raw string (see below)     |
+| `ts`      | string          | ISO 8601 timestamp (server-assigned, not in raw IRC) |
+| `meta`    | object          | Extensible metadata (signatures, hashes, etc.)       |
 
-A `PRIVMSG` whose `body` has two strings is a two-line message:
+**Structured bodies:** `body` is always an array of strings (for text) or an
+object (for structured data like PUBKEY). Never a raw string. This enables:
 
-```
+- Multiline messages without escape sequences
-{"command": "PRIVMSG", "to": "#general", "body": ["line one", "line two"]}
+- Deterministic canonicalization via RFC 8785 JCS for signing
-```
+- Structured data where needed
 
-## Files
+## Commands
 
-Most command files describe both the message a client sends and the message the
+IRC commands used for client↔server and server↔server communication.
-server sends. Their field descriptions say where the two differ. The examples in
-the files leave out `id`, `ts` and `meta`.
 
-Commands, in `commands/`:
+| Command   | File                    | RFC         | Description                |
+| --------- | ----------------------- | ----------- | -------------------------- |
+| `PRIVMSG` | `commands/PRIVMSG.json` | 1459 §4.4.1 | Message to channel or user |
+| `NOTICE`  | `commands/NOTICE.json`  | 1459 §4.4.2 | Notice (no auto-reply)     |
+| `JOIN`    | `commands/JOIN.json`    | 1459 §4.2.1 | Join a channel             |
+| `PART`    | `commands/PART.json`    | 1459 §4.2.2 | Leave a channel            |
+| `QUIT`    | `commands/QUIT.json`    | 1459 §4.1.6 | User disconnected          |
+| `NICK`    | `commands/NICK.json`    | 1459 §4.1.2 | Change nickname            |
+| `TOPIC`   | `commands/TOPIC.json`   | 1459 §4.2.4 | Get/set channel topic      |
+| `MODE`    | `commands/MODE.json`    | 1459 §4.2.3 | Set channel/user modes     |
+| `KICK`    | `commands/KICK.json`    | 1459 §4.2.8 | Kick user from channel     |
+| `PING`    | `commands/PING.json`    | 1459 §4.6.2 | Keepalive                  |
+| `PONG`    | `commands/PONG.json`    | 1459 §4.6.3 | Keepalive response         |
+| `PUBKEY`  | `commands/PUBKEY.json`  | (extension) | Announce/relay signing key |
 
-- `PRIVMSG.json`: a message to a channel or a user.
+## Numeric Replies
-- `NOTICE.json`: a notice, which is a message that a client must not answer
-  automatically.
-- `JOIN.json`: joining a channel.
-- `PART.json`: leaving a channel.
-- `QUIT.json`: leaving the server.
-- `NICK.json`: changing nick.
-- `TOPIC.json`: setting a channel's topic.
-- `MODE.json`: querying or changing a channel's modes or the user's own modes.
-- `KICK.json`: a channel operator removing a user from a channel.
-- `PING.json`: a check that the server still answers.
-- `PONG.json`: the answer to a `PING`, which is the HTTP response to it.
 
-Numeric replies, in `numerics/`:
+Three-digit codes for server responses, per IRC convention.
 
-- `001.json`: `RPL_WELCOME`, which welcomes the user.
+### Success / Informational (0xx–3xx)
-- `002.json`: `RPL_YOURHOST`, the server's name and version.
+
-- `003.json`: `RPL_CREATED`, the date the server last started.
+| Code  | Name           | File                | Description                    |
-- `004.json`: `RPL_MYINFO`, the server's name, its version and its lists of
+| ----- | -------------- | ------------------- | ------------------------------ |
-  modes.
+| `001` | RPL_WELCOME    | `numerics/001.json` | Welcome after session creation |
-- `322.json`: `RPL_LIST`, one channel in the answer to `LIST`.
+| `002` | RPL_YOURHOST   | `numerics/002.json` | Server host info               |
-- `323.json`: `RPL_LISTEND`, the end of the answer to `LIST`.
+| `003` | RPL_CREATED    | `numerics/003.json` | Server creation date           |
-- `332.json`: `RPL_TOPIC`, a channel's topic.
+| `004` | RPL_MYINFO     | `numerics/004.json` | Server info and modes          |
-- `353.json`: `RPL_NAMREPLY`, a channel's members.
+| `322` | RPL_LIST       | `numerics/322.json` | Channel list entry             |
-- `366.json`: `RPL_ENDOFNAMES`, the end of the member list.
+| `323` | RPL_LISTEND    | `numerics/323.json` | End of channel list            |
-- `372.json`: `RPL_MOTD`, one line of the message of the day.
+| `332` | RPL_TOPIC      | `numerics/332.json` | Channel topic                  |
-- `375.json`: `RPL_MOTDSTART`, the start of the message of the day.
+| `353` | RPL_NAMREPLY   | `numerics/353.json` | Channel member list            |
-- `376.json`: `RPL_ENDOFMOTD`, the end of the message of the day.
+| `366` | RPL_ENDOFNAMES | `numerics/366.json` | End of NAMES list              |
-- `401.json`: `ERR_NOSUCHNICK`, the nick does not exist.
+| `372` | RPL_MOTD       | `numerics/372.json` | MOTD line                      |
-- `403.json`: `ERR_NOSUCHCHANNEL`, the channel does not exist.
+| `375` | RPL_MOTDSTART  | `numerics/375.json` | Start of MOTD                  |
-- `433.json`: `ERR_NICKNAMEINUSE`, the nick is taken.
+| `376` | RPL_ENDOFMOTD  | `numerics/376.json` | End of MOTD                    |
-- `442.json`: `ERR_NOTONCHANNEL`, the user is not on that channel.
+
-- `482.json`: `ERR_CHANOPRIVSNEEDED`, the user is not a channel operator.
+### Errors (4xx)
+
+| Code  | Name                 | File                | Description             |
+| ----- | -------------------- | ------------------- | ----------------------- |
+| `401` | ERR_NOSUCHNICK       | `numerics/401.json` | No such nick/channel    |
+| `403` | ERR_NOSUCHCHANNEL    | `numerics/403.json` | No such channel         |
+| `433` | ERR_NICKNAMEINUSE    | `numerics/433.json` | Nickname already in use |
+| `442` | ERR_NOTONCHANNEL     | `numerics/442.json` | Not on that channel     |
+| `482` | ERR_CHANOPRIVSNEEDED | `numerics/482.json` | Not channel operator    |
+
+## Federation (S2S)
+
+Server-to-server messages use the same command format. Federated servers relay
+messages with an additional `origin` field in `meta` to track the source server.
+The PING/PONG commands serve as inter-server keepalives. State sync after link
+establishment uses a burst of JOIN, NICK, TOPIC, and MODE commands.

schema/commands/JOIN.json

@@ -2,25 +2,15 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/JOIN.json",
   "title": "JOIN",
-  "description": "Join a channel. A client sends it to join a channel, which the server creates if it does not exist. The server sends it to every member of the channel when a user joins, the new member included. RFC 1459 §4.2.1.",
+  "description": "Join a channel. C2S: request to join. S2C: notification that a user joined. RFC 1459 §4.2.1.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "JOIN" },
-    "from": { "type": "string", "description": "The nick that joined. The server sets it." },
+    "from": { "type": "string", "description": "Nick that joined (S2C)." },
-    "to": {
+    "to": { "type": "string", "description": "Channel name.", "pattern": "^#[a-zA-Z0-9_-]+$" }
-      "type": "string",
-      "description": "The channel name: # and then 1 to 63 of a-z, A-Z, 0-9, _ and -. The server adds the # if a client leaves it out.",
-      "pattern": "^#?[a-zA-Z0-9_-]{1,63}$"
-    },
-    "body": {
-      "type": "array",
-      "items": { "type": "string" },
-      "description": "From a client: the channel key as the first string, which a channel with mode +k needs. From the server: the channel name. After a login, and for GET /api/v1/state?initChannelState=1, the server queues a JOIN for each of the session's channels. That JOIN has an empty body."
-    }
   },
   "required": ["command", "to"],
   "examples": [
-    { "command": "JOIN", "to": "#general" },
+    { "command": "JOIN", "from": "alice", "to": "#general" }
-    { "command": "JOIN", "from": "alice", "to": "#general", "body": ["#general"] }
   ]
 }

schema/commands/KICK.json

@@ -2,33 +2,28 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/KICK.json",
   "title": "KICK",
-  "description": "Remove a user from a channel. A client sends it, and only a channel operator may. The server sends it to every member of the channel, the removed user included. RFC 1459 §4.2.8.",
+  "description": "Kick a user from a channel. RFC 1459 §4.2.8.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "KICK" },
-    "from": { "type": "string", "description": "The nick that removed the user. The server sets it." },
+    "from": { "type": "string", "description": "Nick that performed the kick." },
-    "to": {
+    "to": { "type": "string", "description": "Channel name.", "pattern": "^#[a-zA-Z0-9_-]+$" },
-      "type": "string",
-      "description": "The channel name. The server adds the # if a client leaves it out.",
-      "pattern": "^#?[a-zA-Z0-9_-]{1,63}$"
-    },
     "params": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The removed nick. Only the server sends it.",
+      "description": "Kicked nick. e.g. [\"alice\"].",
       "minItems": 1,
       "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "From a client: the nick to remove, then an optional reason. From the server: the reason, as one string.",
+      "description": "Optional kick reason.",
-      "minItems": 1
+      "maxItems": 1
     }
   },
-  "required": ["command", "to", "body"],
+  "required": ["command", "to", "params"],
   "examples": [
-    { "command": "KICK", "to": "#general", "body": ["troll", "Behave"] },
     { "command": "KICK", "from": "op1", "to": "#general", "params": ["troll"], "body": ["Behave"] }
   ]
 }

schema/commands/MODE.json

@@ -2,29 +2,28 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/MODE.json",
   "title": "MODE",
-  "description": "Query or change a channel's modes or the user's own modes. A client sends it. The server sends it to every member of the channel when a channel mode changes. A +H or -H sent over the HTTP API is the exception. The server answers it with RPL_CHANNELMODEIS (324) and sends no MODE. RFC 1459 §4.2.3.",
+  "description": "Set or query channel/user modes. RFC 1459 §4.2.3.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "MODE" },
     "from": {
       "type": "string",
-      "description": "The nick that changed the mode. The server sets it."
+      "description": "Nick that set the mode (S2C only)."
     },
     "to": {
       "type": "string",
-      "description": "A channel name, which starts with #, or the user's own nick."
+      "description": "Channel name.",
+      "pattern": "^#[a-zA-Z0-9_-]+$"
     },
-    "body": {
+    "params": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "From a client: the mode change and then its value, as separate strings, such as \"+o\" and \"bob\". A MODE without a body is a query. From the server: the change and its value, as one string, such as \"+o bob\", or as separate strings, such as \"+k\" and \"secret\".",
+      "description": "Mode string and optional target nick. e.g. [\"+o\", \"alice\"].",
-      "examples": [["+o", "bob"], ["-m"], ["+o bob"], ["+k", "secret"]]
+      "examples": [["+o", "alice"], ["-m"], ["+v", "bob"]]
     }
   },
-  "required": ["command", "to"],
+  "required": ["command", "to", "params"],
   "examples": [
-    { "command": "MODE", "to": "#general", "body": ["+o", "bob"] },
+    { "command": "MODE", "from": "op1", "to": "#general", "params": ["+o", "alice"] }
-    { "command": "MODE", "from": "op1", "to": "#general", "body": ["+o bob"] },
-    { "command": "MODE", "from": "op1", "to": "#general", "body": ["+k", "secret"] }
   ]
 }

schema/commands/NICK.json

@@ -2,21 +2,21 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/NICK.json",
   "title": "NICK",
-  "description": "Change nick. A client sends it to change its nick. The server sends it to the user's own clients and to the users who share a channel with the user. RFC 1459 §4.1.2.",
+  "description": "Change nickname. C2S: request new nick. S2C: notification of nick change. RFC 1459 §4.1.2.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "NICK" },
-    "from": { "type": "string", "description": "The old nick. The server sets it." },
+    "from": { "type": "string", "description": "Old nick (S2C)." },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The new nick, as the first string. The server sends one string.",
+      "description": "New nick (single-element array).",
-      "minItems": 1
+      "minItems": 1,
+      "maxItems": 1
     }
   },
   "required": ["command", "body"],
   "examples": [
-    { "command": "NICK", "body": ["newnick"] },
     { "command": "NICK", "from": "oldnick", "body": ["newnick"] }
   ]
 }

schema/commands/NOTICE.json

@@ -2,21 +2,20 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/NOTICE.json",
   "title": "NOTICE",
-  "description": "A notice: a message to a channel or a user that a client must not answer automatically. The server relays it as it relays a PRIVMSG. A NOTICE to a channel with mode +H needs no hashcash stamp. RFC 1459 §4.4.2.",
+  "description": "Send a notice. Like PRIVMSG but must not trigger automatic replies. RFC 1459 §4.4.2.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "NOTICE" },
-    "from": { "type": "string", "description": "The sender's nick. The server sets it." },
+    "from": { "type": "string" },
-    "to": { "type": "string", "description": "A channel name, which starts with #, or a nick." },
+    "to": { "type": "string", "description": "Target: #channel, nick, or * (global)." },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The lines of the notice, one string per line.",
+      "description": "Notice text lines."
-      "minItems": 1
     }
   },
   "required": ["command", "to", "body"],
   "examples": [
-    { "command": "NOTICE", "from": "alice", "to": "#general", "body": ["Back in five minutes"] }
+    { "command": "NOTICE", "from": "server.example.com", "to": "*", "body": ["Server restarting in 5 minutes"] }
   ]
 }

schema/commands/PART.json

@@ -2,20 +2,17 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/PART.json",
   "title": "PART",
-  "description": "Leave a channel. A client sends it to leave. The server sends it to every member of the channel when a user leaves, the leaving user included. RFC 1459 §4.2.2.",
+  "description": "Leave a channel. C2S: request to leave. S2C: notification that a user left. RFC 1459 §4.2.2.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "PART" },
-    "from": { "type": "string", "description": "The nick that left. The server sets it." },
+    "from": { "type": "string", "description": "Nick that left (S2C)." },
-    "to": {
+    "to": { "type": "string", "description": "Channel name.", "pattern": "^#[a-zA-Z0-9_-]+$" },
-      "type": "string",
-      "description": "The channel name. The server adds the # if a client leaves it out.",
-      "pattern": "^#?[a-zA-Z0-9_-]{1,63}$"
-    },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The reason for leaving. A client may send one as the first string. The server always sends one string, which is empty when no reason was given."
+      "description": "Optional part reason.",
+      "maxItems": 1
     }
   },
   "required": ["command", "to"],

schema/commands/PING.json

@@ -2,13 +2,19 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/PING.json",
   "title": "PING",
-  "description": "A check that the server still answers. A client sends it. The server ignores every field but 'command'. Its answer is a PONG in the HTTP response. RFC 1459 §4.6.2.",
+  "description": "Keepalive. C2S or S2S. Server responds with PONG. RFC 1459 §4.6.2.",
   "$ref": "../message.json",
   "properties": {
-    "command": { "const": "PING" }
+    "command": { "const": "PING" },
+    "body": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Opaque token to be echoed in PONG (single-element array).",
+      "maxItems": 1
+    }
   },
   "required": ["command"],
   "examples": [
-    { "command": "PING" }
+    { "command": "PING", "body": ["1707580000"] }
   ]
 }

schema/commands/PONG.json

@@ -2,14 +2,20 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/PONG.json",
   "title": "PONG",
-  "description": "The answer to a PING. The server sends it as the HTTP response to the PING, with only 'command' and 'from'. A client's PONG gets ERR_UNKNOWNCOMMAND (421). RFC 1459 §4.6.3.",
+  "description": "Keepalive response. S2C or S2S. RFC 1459 §4.6.3.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "PONG" },
-    "from": { "type": "string", "description": "The server name." }
+    "from": { "type": "string", "description": "Responding server name." },
+    "body": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Echoed token from PING (single-element array).",
+      "maxItems": 1
+    }
   },
-  "required": ["command", "from"],
+  "required": ["command"],
   "examples": [
-    { "command": "PONG", "from": "neoirc" }
+    { "command": "PONG", "from": "server.example.com", "body": ["1707580000"] }
   ]
 }

schema/commands/PRIVMSG.json

@@ -2,16 +2,16 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/PRIVMSG.json",
   "title": "PRIVMSG",
-  "description": "A message to a channel or a user. A client sends it. The server relays it to every member of the channel, or to the user, and to the sender's own clients. RFC 1459 §4.4.1.",
+  "description": "Send a message to a channel or user. C2S: client sends to server. S2C: server relays to recipients. RFC 1459 §4.4.1.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "PRIVMSG" },
-    "from": { "type": "string", "description": "The sender's nick. The server sets it." },
+    "from": { "type": "string", "description": "Sender nick (set by server on relay)." },
-    "to": { "type": "string", "description": "A channel name, which starts with #, or a nick.", "examples": ["#general", "alice"] },
+    "to": { "type": "string", "description": "Target: #channel or nick.", "examples": ["#general", "alice"] },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The lines of the message, one string per line.",
+      "description": "Message lines. One string per line.",
       "minItems": 1
     }
   },
@@ -19,6 +19,6 @@
   "examples": [
     { "command": "PRIVMSG", "from": "bob", "to": "#general", "body": ["hello world"] },
     { "command": "PRIVMSG", "from": "bob", "to": "#general", "body": ["line one", "line two"] },
-    { "command": "PRIVMSG", "from": "bob", "to": "alice", "body": ["hey"] }
+    { "command": "PRIVMSG", "from": "bob", "to": "alice", "body": ["hey"], "meta": { "sig": "base64...", "alg": "ed25519" } }
   ]
 }

schema/commands/PUBKEY.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sneak.berlin/go/neoirc/schema/commands/PUBKEY.json",
+  "title": "PUBKEY",
+  "description": "Announce or relay a user's public signing key. C2S: client announces key to channel or server. S2C: server relays to channel members. Protocol extension (not in RFC 1459). Body is a structured object (not an array) containing the key material.",
+  "$ref": "../message.json",
+  "properties": {
+    "command": { "const": "PUBKEY" },
+    "from": { "type": "string", "description": "Nick announcing the key (set by server on relay)." },
+    "to": {
+      "type": "string",
+      "description": "Target: #channel to announce to channel members, or omit for server-wide announcement."
+    },
+    "body": {
+      "type": "object",
+      "description": "Key material.",
+      "properties": {
+        "alg": {
+          "type": "string",
+          "description": "Key algorithm.",
+          "enum": ["ed25519"]
+        },
+        "key": {
+          "type": "string",
+          "description": "Base64-encoded public key."
+        }
+      },
+      "required": ["alg", "key"],
+      "additionalProperties": false
+    }
+  },
+  "required": ["command", "body"],
+  "examples": [
+    { "command": "PUBKEY", "from": "alice", "body": { "alg": "ed25519", "key": "base64-encoded-pubkey" } },
+    { "command": "PUBKEY", "from": "alice", "to": "#general", "body": { "alg": "ed25519", "key": "base64-encoded-pubkey" } }
+  ]
+}

schema/commands/QUIT.json

@@ -2,20 +2,20 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/QUIT.json",
   "title": "QUIT",
-  "description": "A user left the server. A client sends it to end its session. The server sends it to the users who shared a channel with the user who left. RFC 1459 §4.1.6.",
+  "description": "User disconnected. S2C only. RFC 1459 §4.1.6.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "QUIT" },
-    "from": { "type": "string", "description": "The nick that quit. The server sets it." },
+    "from": { "type": "string", "description": "Nick that quit." },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The reason for leaving. A client may send one as the first string, and the server uses 'Client quit' when it does not. The server always sends one string."
+      "description": "Optional quit reason.",
+      "maxItems": 1
     }
   },
-  "required": ["command"],
+  "required": ["command", "from"],
   "examples": [
-    { "command": "QUIT", "body": ["Gone for the day"] },
+    { "command": "QUIT", "from": "alice", "body": ["Connection reset"] }
-    { "command": "QUIT", "from": "alice", "body": ["Connection closed"] }
   ]
 }

schema/commands/TOPIC.json

@@ -2,24 +2,20 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/commands/TOPIC.json",
   "title": "TOPIC",
-  "description": "Set a channel's topic. A client sends it to set the topic. The server sends it to every member of the channel when the topic changes. RFC 1459 §4.2.4.",
+  "description": "Get or set channel topic. C2S: set topic (body present) or query (body absent). S2C: topic change notification. RFC 1459 §4.2.4.",
   "$ref": "../message.json",
   "properties": {
     "command": { "const": "TOPIC" },
-    "from": { "type": "string", "description": "The nick that set the topic. The server sets it." },
+    "from": { "type": "string", "description": "Nick that changed the topic (S2C)." },
-    "to": {
+    "to": { "type": "string", "description": "Channel name.", "pattern": "^#[a-zA-Z0-9_-]+$" },
-      "type": "string",
-      "description": "The channel name. The server adds the # if a client leaves it out.",
-      "pattern": "^#?[a-zA-Z0-9_-]{1,63}$"
-    },
     "body": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The new topic. The server joins a client's strings with spaces, and sends the topic as one string. [\"\"] clears the topic.",
+      "description": "New topic text (single-element array). Empty array clears the topic.",
-      "minItems": 1
+      "maxItems": 1
     }
   },
-  "required": ["command", "to", "body"],
+  "required": ["command", "to"],
   "examples": [
     { "command": "TOPIC", "from": "alice", "to": "#general", "body": ["Welcome to the channel"] }
   ]

schema/message.json

@@ -2,55 +2,67 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/message.json",
   "title": "IRC Message Envelope",
-  "description": "Every message in the HTTP API is one JSON object with these fields. Only 'command' is always present.",
+  "description": "Base envelope for all messages. Mirrors IRC wire format (RFC 1459/2812) encoded as JSON over HTTP. The 'command' field carries either an IRC command name (PRIVMSG, JOIN, etc.) or a three-digit numeric reply code (001, 353, 433, etc.).",
   "type": "object",
   "properties": {
     "id": {
       "type": "string",
       "format": "uuid",
-      "description": "The message's UUID, which the server assigns. Present on every message the server queues for a client."
+      "description": "Server-assigned message UUID. Present on all server-originated messages."
     },
     "command": {
       "type": "string",
-      "description": "An IRC command name, such as PRIVMSG, or the name of a numeric reply, such as RPL_WELCOME. The server reads a client's command in any case and sends it in upper case.",
+      "description": "IRC command name (PRIVMSG, JOIN, NICK, etc.) or three-digit numeric reply code (001, 353, 433, etc.).",
-      "examples": ["PRIVMSG", "JOIN", "RPL_WELCOME", "ERR_NICKNAMEINUSE"]
+      "examples": ["PRIVMSG", "JOIN", "001", "353", "433"]
-    },
-    "code": {
-      "type": "integer",
-      "minimum": 1,
-      "maximum": 999,
-      "description": "The number of a numeric reply, such as 1 for RPL_WELCOME. Absent on other messages."
     },
     "from": {
       "type": "string",
-      "description": "The sender's nick, or the server name on a numeric reply or a PONG. The server sets it and ignores it from a client."
+      "description": "Source — nick for user messages, server name for server messages. Equivalent to IRC prefix."
     },
     "to": {
       "type": "string",
-      "description": "The target: a channel name, such as #general, or a nick. A WALLOPS has * here."
+      "description": "Target — channel (#name) or nick. Equivalent to first IRC parameter for most commands."
     },
     "params": {
       "type": "array",
       "items": { "type": "string" },
-      "description": "The message's other parameters, in order. KICK events and many numeric replies have it. The server ignores it from a client."
+      "description": "Additional parameters (used primarily by numeric replies). Equivalent to IRC middle parameters."
     },
     "body": {
+      "oneOf": [
+        {
           "type": "array",
           "items": { "type": "string" },
-      "description": "An array of strings, never a bare string. In a PRIVMSG or NOTICE, each string is one line of text."
+          "description": "Array of strings (one per line for text messages)."
+        },
+        {
+          "type": "object",
+          "description": "Structured data (e.g. PUBKEY key material).",
+          "additionalProperties": true
+        }
+      ],
+      "description": "Message body. MUST be an array or object, never a raw string. Arrays represent lines of text; objects carry structured data. This enables deterministic canonicalization (RFC 8785 JCS) for signing."
     },
     "ts": {
       "type": "string",
       "format": "date-time",
-      "description": "The time the server stored the message, as an RFC 3339 time in UTC."
+      "description": "Server-assigned timestamp (ISO 8601). Not present in original IRC; added for HTTP transport."
     },
     "meta": {
       "type": "object",
-      "description": "An object of extra data. Every message the server queues for a client has meta, which is {} when there is none. The server keeps a client's meta only on a PRIVMSG or NOTICE, and relays it unchanged.",
+      "description": "Extensible metadata. Used for signatures (meta.sig, meta.alg), hashes (meta.hash), and client extensions.",
       "properties": {
-        "hashcash": {
+        "sig": {
           "type": "string",
-          "description": "A hashcash stamp. A PRIVMSG to a channel with mode +H needs one."
+          "description": "Base64-encoded cryptographic signature over the canonical message form."
+        },
+        "alg": {
+          "type": "string",
+          "description": "Signature algorithm (e.g. 'ed25519')."
+        },
+        "hash": {
+          "type": "string",
+          "description": "Hash of the canonical message form (e.g. 'sha256:base64...')."
         }
       },
       "additionalProperties": true

schema/numerics/001.json

@@ -2,45 +2,32 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/001.json",
   "title": "001 RPL_WELCOME",
-  "description": "Welcomes the user. Sent after a session is created, after a login, and in answer to MOTD. RFC 2812 §5.1.",
+  "description": "Welcome message sent after successful session creation. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_WELCOME"
+      "const": "001"
-    },
-    "code": {
-      "const": 1
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
       "type": "string",
-      "description": "The user's nick."
+      "description": "Target nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'Welcome to the network, ' and the user's nick.",
+      "description": "Welcome text lines."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
     "body"
   ],
   "examples": [
     {
-      "command": "RPL_WELCOME",
+      "command": "001",
-      "code": 1,
-      "from": "neoirc",
       "to": "alice",
       "body": [
         "Welcome to the network, alice"

schema/numerics/002.json

@@ -2,48 +2,34 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/002.json",
   "title": "002 RPL_YOURHOST",
-  "description": "The server's name and version. Sent right after RPL_WELCOME. RFC 2812 §5.1.",
+  "description": "Server host info sent after session creation. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_YOURHOST"
+      "const": "002"
-    },
-    "code": {
-      "const": 2
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'Your host is ', the server name, ', running version ' and the version.",
+      "description": "Host info lines."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
     "body"
   ],
   "examples": [
     {
-      "command": "RPL_YOURHOST",
+      "command": "002",
-      "code": 2,
-      "from": "neoirc",
       "to": "alice",
       "body": [
-        "Your host is neoirc, running version dev"
+        "Your host is neoirc.example.com, running version 0.1.0"
       ]
     }
   ]

schema/numerics/003.json

@@ -2,45 +2,31 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/003.json",
   "title": "003 RPL_CREATED",
-  "description": "The date the server last started. Sent right after RPL_YOURHOST. RFC 2812 §5.1.",
+  "description": "Server creation date. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_CREATED"
+      "const": "003"
-    },
-    "code": {
-      "const": 3
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'This server was created ' and the start date as YYYY-MM-DD.",
+      "description": "Text lines."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
     "body"
   ],
   "examples": [
     {
-      "command": "RPL_CREATED",
+      "command": "003",
-      "code": 3,
-      "from": "neoirc",
       "to": "alice",
       "body": [
         "This server was created 2026-02-01"

schema/numerics/004.json

@@ -2,64 +2,37 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/004.json",
   "title": "004 RPL_MYINFO",
-  "description": "The server's name, its version, and its lists of user and channel modes. Sent right after RPL_CREATED. RFC 2812 §5.1.",
+  "description": "Server info (name, version, available modes). RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_MYINFO"
+      "const": "004"
-    },
-    "code": {
-      "const": 4
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The server name, the version, the user modes 'ow' and the channel modes 'Hbiklmnostv'.",
+      "description": "[server_name, version, user_modes, channel_modes]."
-      "minItems": 4,
-      "maxItems": 4
-    },
-    "body": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      },
-      "description": "One empty string.",
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
   ],
   "examples": [
     {
-      "command": "RPL_MYINFO",
+      "command": "004",
-      "code": 4,
-      "from": "neoirc",
       "to": "alice",
       "params": [
-        "neoirc",
+        "neoirc.example.com",
-        "dev",
+        "0.1.0",
-        "ow",
+        "o",
-        "Hbiklmnostv"
+        "imnst+ov"
-      ],
-      "body": [
-        ""
       ]
     }
   ]

schema/numerics/322.json

@@ -2,55 +2,38 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/322.json",
   "title": "322 RPL_LIST",
-  "description": "One channel in the answer to LIST. The answer has one per channel, except a secret channel, one with mode +s, that the user is not on. RFC 1459 §6.2.",
+  "description": "Channel list entry. One per channel in response to LIST. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_LIST"
+      "const": "322"
-    },
-    "code": {
-      "const": 322
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The channel name and its number of members.",
+      "description": "[channel, visible_count]."
-      "minItems": 2,
-      "maxItems": 2
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: the channel's topic, empty when it has none.",
+      "description": "Channel topic."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
   ],
   "examples": [
     {
-      "command": "RPL_LIST",
+      "command": "322",
-      "code": 322,
-      "from": "neoirc",
       "to": "alice",
       "params": [
         "#general",

schema/numerics/323.json

@@ -2,49 +2,26 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/323.json",
   "title": "323 RPL_LISTEND",
-  "description": "The end of the answer to LIST. RFC 1459 §6.2.",
+  "description": "End of channel list. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_LISTEND"
+      "const": "323"
-    },
-    "code": {
-      "const": 323
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'End of /LIST'.",
+      "description": "End of /LIST",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
+    "to"
-    "from",
-    "to",
-    "body"
-  ],
-  "examples": [
-    {
-      "command": "RPL_LISTEND",
-      "code": 323,
-      "from": "neoirc",
-      "to": "alice",
-      "body": [
-        "End of /LIST"
-      ]
-    }
   ]
 }

schema/numerics/332.json

@@ -2,55 +2,39 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/332.json",
   "title": "332 RPL_TOPIC",
-  "description": "A channel's topic. Sent to a client after it sets the topic, and after it joins a channel that has one. Also sent for each of a session's channels that has one after a login, and for GET /api/v1/state?initChannelState=1. RFC 1459 §6.2.",
+  "description": "Channel topic (sent on JOIN or TOPIC query). RFC 1459 \u00a76.2.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_TOPIC"
+      "const": "332"
-    },
-    "code": {
-      "const": 332
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The channel name.",
+      "description": "[channel]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: the topic.",
+      "description": "Topic text."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
     "params",
     "body"
   ],
   "examples": [
     {
-      "command": "RPL_TOPIC",
+      "command": "332",
-      "code": 332,
-      "from": "neoirc",
       "to": "alice",
       "params": [
         "#general"

schema/numerics/353.json

@@ -2,62 +2,46 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/353.json",
   "title": "353 RPL_NAMREPLY",
-  "description": "A channel's members. Sent to a client after it joins a channel, and in answer to NAMES. Also sent for each of a session's channels after a login, and for GET /api/v1/state?initChannelState=1. RFC 1459 §6.2.",
+  "description": "Channel member list. Sent on JOIN or NAMES query. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_NAMREPLY"
+      "const": "353"
-    },
-    "code": {
-      "const": 353
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "'=' and the channel name. The server always sends '='.",
+      "description": "[channel_type, channel]. channel_type: = (public), * (private), @ (secret)."
-      "minItems": 2,
-      "maxItems": 2
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: the members as nick!user@host, separated by spaces. '@' comes before a channel operator and '+' before a voiced member. The host is '*' when the server does not know it.",
+      "description": "Space-separated list of nicks. Prefixed with @ for ops, + for voiced."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
     "params",
     "body"
   ],
   "examples": [
     {
-      "command": "RPL_NAMREPLY",
+      "command": "353",
-      "code": 353,
-      "from": "neoirc",
       "to": "alice",
       "params": [
         "=",
         "#general"
       ],
       "body": [
-        "@op1!op1@host1 alice!alice@host2 +bob!bob@host3"
+        "@op1 alice bob +voiced1"
       ]
     }
   ]

schema/numerics/366.json

@@ -2,62 +2,34 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/366.json",
   "title": "366 RPL_ENDOFNAMES",
-  "description": "The end of a channel's member list. It comes after the RPL_NAMREPLY for the channel. RFC 1459 §6.2.",
+  "description": "End of NAMES list. RFC 1459 \u00a76.2.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_ENDOFNAMES"
+      "const": "366"
-    },
-    "code": {
-      "const": 366
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The channel name.",
+      "description": "[channel]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'End of /NAMES list'.",
+      "description": "End of /NAMES list",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
-  ],
-  "examples": [
-    {
-      "command": "RPL_ENDOFNAMES",
-      "code": 366,
-      "from": "neoirc",
-      "to": "alice",
-      "params": [
-        "#general"
-      ],
-      "body": [
-        "End of /NAMES list"
-      ]
-    }
   ]
 }

schema/numerics/372.json

@@ -2,45 +2,31 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/372.json",
   "title": "372 RPL_MOTD",
-  "description": "One line of the message of the day. The server sends one per line, after RPL_MOTDSTART. RFC 2812 §5.1.",
+  "description": "MOTD line. One message per line of the MOTD. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_MOTD"
+      "const": "372"
-    },
-    "code": {
-      "const": 372
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: '- ' and the line.",
+      "description": "MOTD line text (prefixed with '- ')."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
     "body"
   ],
   "examples": [
     {
-      "command": "RPL_MOTD",
+      "command": "372",
-      "code": 372,
-      "from": "neoirc",
       "to": "alice",
       "body": [
         "- Welcome to our server!"

schema/numerics/375.json

@@ -2,49 +2,25 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/375.json",
   "title": "375 RPL_MOTDSTART",
-  "description": "The start of the message of the day. Sent after RPL_LUSERME (255) when the server has a message of the day. RFC 2812 §5.1.",
+  "description": "Start of MOTD. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_MOTDSTART"
+      "const": "375"
-    },
-    "code": {
-      "const": 375
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: '- ', the server name and ' Message of the Day -'.",
+      "description": "Text lines."
-      "minItems": 1,
-      "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
+    "to"
-    "from",
-    "to",
-    "body"
-  ],
-  "examples": [
-    {
-      "command": "RPL_MOTDSTART",
-      "code": 375,
-      "from": "neoirc",
-      "to": "alice",
-      "body": [
-        "- neoirc Message of the Day -"
-      ]
-    }
   ]
 }

schema/numerics/376.json

@@ -2,49 +2,26 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/376.json",
   "title": "376 RPL_ENDOFMOTD",
-  "description": "The end of the message of the day. RFC 2812 §5.1.",
+  "description": "End of MOTD. RFC 2812 \u00a75.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "RPL_ENDOFMOTD"
+      "const": "376"
-    },
-    "code": {
-      "const": 376
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'End of /MOTD command.'.",
+      "description": "End of /MOTD command",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
+    "to"
-    "from",
-    "to",
-    "body"
-  ],
-  "examples": [
-    {
-      "command": "RPL_ENDOFMOTD",
-      "code": 376,
-      "from": "neoirc",
-      "to": "alice",
-      "body": [
-        "End of /MOTD command."
-      ]
-    }
   ]
 }

schema/numerics/401.json

@@ -2,61 +2,45 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/401.json",
   "title": "401 ERR_NOSUCHNICK",
-  "description": "No user has that nick. RFC 1459 §6.1.",
+  "description": "No such nick/channel. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "ERR_NOSUCHNICK"
+      "const": "401"
-    },
-    "code": {
-      "const": 401
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The nick that was not found.",
+      "description": "[target_nick]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'No such nick' in answer to a PRIVMSG or NOTICE, and 'No such nick/channel' in answer to anything else.",
+      "description": "No such nick/channel",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
   ],
   "examples": [
     {
-      "command": "ERR_NOSUCHNICK",
+      "command": "401",
-      "code": 401,
-      "from": "neoirc",
       "to": "alice",
       "params": [
         "bob"
       ],
       "body": [
-        "No such nick"
+        "No such nick/channel"
       ]
     }
   ]

schema/numerics/403.json

@@ -2,55 +2,39 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/403.json",
   "title": "403 ERR_NOSUCHCHANNEL",
-  "description": "No channel has that name. A JOIN with a channel name that the server does not allow gets it too. RFC 1459 §6.1.",
+  "description": "No such channel. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "ERR_NOSUCHCHANNEL"
+      "const": "403"
-    },
-    "code": {
-      "const": 403
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The channel name.",
+      "description": "[channel_name]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'No such channel'.",
+      "description": "No such channel",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
   ],
   "examples": [
     {
-      "command": "ERR_NOSUCHCHANNEL",
+      "command": "403",
-      "code": 403,
-      "from": "neoirc",
       "to": "alice",
       "params": [
         "#nonexistent"

schema/numerics/433.json

@@ -2,58 +2,42 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/433.json",
   "title": "433 ERR_NICKNAMEINUSE",
-  "description": "Another user has the nick. Sent in answer to a NICK. RFC 1459 §6.1.",
+  "description": "Nickname is already in use. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "ERR_NICKNAMEINUSE"
+      "const": "433"
-    },
-    "code": {
-      "const": 433
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick, which has not changed."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The nick that was asked for.",
+      "description": "[requested_nick]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'Nickname is already in use'.",
+      "description": "Nickname is already in use",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
   ],
   "examples": [
     {
-      "command": "ERR_NICKNAMEINUSE",
+      "command": "433",
-      "code": 433,
+      "to": "*",
-      "from": "neoirc",
-      "to": "alice",
       "params": [
-        "bob"
+        "alice"
       ],
       "body": [
         "Nickname is already in use"

schema/numerics/442.json

@@ -2,62 +2,34 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/442.json",
   "title": "442 ERR_NOTONCHANNEL",
-  "description": "The user is not on that channel. RFC 1459 §6.1.",
+  "description": "You're not on that channel. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "ERR_NOTONCHANNEL"
+      "const": "442"
-    },
-    "code": {
-      "const": 442
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The channel name.",
+      "description": "[channel]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'You're not on that channel'.",
+      "description": "You're not on that channel",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
-  ],
-  "examples": [
-    {
-      "command": "ERR_NOTONCHANNEL",
-      "code": 442,
-      "from": "neoirc",
-      "to": "alice",
-      "params": [
-        "#general"
-      ],
-      "body": [
-        "You're not on that channel"
-      ]
-    }
   ]
 }

schema/numerics/482.json

@@ -2,62 +2,34 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://sneak.berlin/go/neoirc/schema/numerics/482.json",
   "title": "482 ERR_CHANOPRIVSNEEDED",
-  "description": "The user is not a channel operator, and the command needs one. RFC 1459 §6.1.",
+  "description": "You're not channel operator. RFC 1459 \u00a76.1.",
   "$ref": "../message.json",
   "properties": {
     "command": {
-      "const": "ERR_CHANOPRIVSNEEDED"
+      "const": "482"
-    },
-    "code": {
-      "const": 482
-    },
-    "from": {
-      "type": "string",
-      "description": "The server name."
     },
     "to": {
-      "type": "string",
+      "type": "string"
-      "description": "The user's nick."
     },
     "params": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "The channel name.",
+      "description": "[channel]."
-      "minItems": 1,
-      "maxItems": 1
     },
     "body": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "description": "One string: 'You're not channel operator'.",
+      "description": "You're not channel operator",
-      "minItems": 1,
       "maxItems": 1
     }
   },
   "required": [
     "command",
-    "code",
-    "from",
     "to",
-    "params",
+    "params"
-    "body"
-  ],
-  "examples": [
-    {
-      "command": "ERR_CHANOPRIVSNEEDED",
-      "code": 482,
-      "from": "neoirc",
-      "to": "alice",
-      "params": [
-        "#general"
-      ],
-      "body": [
-        "You're not channel operator"
-      ]
-    }
   ]
 }

web/src/app.jsx

@@ -7,11 +7,6 @@ const RECONNECT_DELAY = 3000;
 const MEMBER_REFRESH_INTERVAL = 10000;
 const ACTION_PREFIX = "\x01ACTION ";
 const ACTION_SUFFIX = "\x01";
-// SERVER_TAB is the Server tab's name, under which its messages and
-// unread count are stored. No nick or channel name can contain *, so a
-// user with the nick Server gets a direct-message tab of its own. The
-// tab bar labels this tab Server.
-const SERVER_TAB = "*server*";
 
 // Hashcash proof-of-work helpers using Web Crypto API.
 
@@ -63,13 +58,13 @@ async function mintHashcash(bits, resource) {
   }
 }
 
-// Requests are authenticated by the auth cookie, which the browser
-// sends on its own.
 function api(path, opts = {}) {
+  const token = localStorage.getItem("neoirc_token");
   const headers = {
     "Content-Type": "application/json",
     ...(opts.headers || {}),
   };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
   const { signal, ...rest } = opts;
 
   return fetch(API + path, { ...rest, headers, signal }).then(async (r) => {
@@ -127,11 +122,12 @@ function LoginScreen({ onLogin }) {
         if (s.name) hashcashResourceRef.current = s.name;
       })
       .catch(() => {});
-    // Resume the session if the browser still holds a valid auth
+    const saved = localStorage.getItem("neoirc_token");
-    // cookie; a 401 leaves the login form up.
+    if (saved) {
       api("/state?initChannelState=1")
         .then((u) => onLogin(u.nick, true))
-      .catch(() => {});
+        .catch(() => localStorage.removeItem("neoirc_token"));
+    }
     inputRef.current?.focus();
   }, []);
 
@@ -156,6 +152,7 @@ function LoginScreen({ onLogin }) {
         method: "POST",
         body: JSON.stringify(reqBody),
       });
+      localStorage.setItem("neoirc_token", res.token);
       onLogin(res.nick);
     } catch (err) {
       setError(err.data?.error || "Connection failed");
@@ -230,9 +227,10 @@ function UserList({ members, onNickClick }) {
   const regular = [];
 
   for (const m of members) {
-    if (m.isOperator) {
+    const mode = m.mode || "";
+    if (mode === "o") {
       ops.push(m);
-    } else if (m.isVoiced) {
+    } else if (mode === "v") {
       voiced.push(m);
     } else {
       regular.push(m);
@@ -275,9 +273,9 @@ function UserList({ members, onNickClick }) {
 function App() {
   const [loggedIn, setLoggedIn] = useState(false);
   const [nick, setNick] = useState("");
-  const [tabs, setTabs] = useState([{ type: "server", name: SERVER_TAB }]);
+  const [tabs, setTabs] = useState([{ type: "server", name: "Server" }]);
   const [activeTab, setActiveTab] = useState(0);
-  const [messages, setMessages] = useState({ [SERVER_TAB]: [] });
+  const [messages, setMessages] = useState({ Server: [] });
   const [members, setMembers] = useState({});
   const [topics, setTopics] = useState({});
   const [unread, setUnread] = useState({});
@@ -305,14 +303,11 @@ function App() {
     nickRef.current = nick;
   }, [nick]);
 
-  // Persist joined channels, once logged in: before then only the
+  // Persist joined channels.
-  // Server tab exists, and writing would erase the saved channels
-  // that onLogin rejoins.
   useEffect(() => {
-    if (!loggedIn) return;
     const channels = tabs.filter((t) => t.type === "channel").map((t) => t.name);
     localStorage.setItem("neoirc_channels", JSON.stringify(channels));
-  }, [loggedIn, tabs]);
+  }, [tabs]);
 
   // Clear unread on tab switch.
   useEffect(() => {
@@ -360,26 +355,6 @@ function App() {
       .catch(() => {});
   }, []);
 
-  // removeChannelTab closes a channel's tab. The tab the user was
-  // reading stays active, found by its name; when it was the closed tab,
-  // the Server tab shows.
-  const removeChannelTab = useCallback((name) => {
-    setTabs((prev) => {
-      const remaining = prev.filter(
-        (t) => !(t.type === "channel" && t.name === name),
-      );
-      // Preact runs this update at once, on the newest active tab.
-      setActiveTab((active) => {
-        const reading = prev[active]?.name;
-        const idx = remaining.findIndex((t) => t.name === reading);
-
-        return idx >= 0 ? idx : 0;
-      });
-
-      return remaining;
-    });
-  }, []);
-
   const processMessage = useCallback(
     (msg) => {
       const body = Array.isArray(msg.body) ? msg.body.join("\n") : "";
@@ -391,9 +366,7 @@ function App() {
         command: msg.command,
       };
 
-      // A numeric reply carries its number in `code` and its name in
+      switch (msg.command) {
-      // `command`; other messages have no `code`.
-      switch (msg.code || msg.command) {
         case "PRIVMSG":
         case "NOTICE": {
           let text = body;
@@ -449,13 +422,6 @@ function App() {
           break;
         }
         case "PART": {
-          // The user's own PART, sent from this client or another,
-          // closes the tab and adds no message or unread count.
-          if (msg.from === nickRef.current) {
-            removeChannelTab(msg.to);
-
-            break;
-          }
           const reason = body ? " (" + body + ")" : "";
           const text = `${msg.from} has parted ${msg.to}${reason}`;
           if (msg.to) addMessage(msg.to, { ...base, text, system: true });
@@ -463,29 +429,6 @@ function App() {
 
           break;
         }
-        case "KICK": {
-          // The kicked nick is in params; the body is the reason.
-          const kicked = Array.isArray(msg.params) ? msg.params[0] : "";
-          const reason = body ? " (" + body + ")" : "";
-          const text = `${kicked} was kicked from ${msg.to} by ${msg.from}${reason}`;
-          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
-          if (kicked === nickRef.current) {
-            // The channel's tab closes, so the Server tab gets the line
-            // too. It needs an id of its own: addMessage drops a message
-            // whose id it has already seen.
-            addMessage(SERVER_TAB, {
-              ...base,
-              id: msg.id + "-server",
-              text,
-              system: true,
-            });
-            removeChannelTab(msg.to);
-          } else if (msg.to && msg.to.startsWith("#")) {
-            refreshMembers(msg.to);
-          }
-
-          break;
-        }
         case "QUIT": {
           const reason = body ? " (" + body + ")" : "";
           const text = `${msg.from} has quit${reason}`;
@@ -521,18 +464,8 @@ function App() {
 
           break;
         }
-        case "MODE": {
+        case "353": {
-          // The body is the change, with its value where it has one:
+          // RPL_NAMREPLY — parse mode prefixes from names list.
-          // ["+o bob"], ["+m"], ["+k", "secretpass"].
-          const modes = Array.isArray(msg.body) ? msg.body.join(" ") : "";
-          const text = `${msg.from} sets mode ${modes} on ${msg.to}`;
-          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
-
-          break;
-        }
-        case 353: {
-          // RPL_NAMREPLY — each name is a hostmask (nick!user@host),
-          // prefixed with @ for an operator or + for a voiced member.
           if (
             Array.isArray(msg.params) &&
             msg.params.length >= 2 &&
@@ -544,18 +477,21 @@ function App() {
               : String(msg.body);
             const names = namesStr.split(/\s+/).filter(Boolean);
             const parsed = names.map((n) => {
-              const isOperator = n.startsWith("@");
+              if (n.startsWith("@")) {
-              const isVoiced = n.startsWith("+");
+                return { nick: n.slice(1), mode: "o" };
-              const hostmask = isOperator || isVoiced ? n.slice(1) : n;
+              }
+              if (n.startsWith("+")) {
+                return { nick: n.slice(1), mode: "v" };
+              }
 
-              return { nick: hostmask.split("!")[0], isOperator, isVoiced };
+              return { nick: n, mode: "" };
             });
             setMembers((prev) => ({ ...prev, [channel]: parsed }));
           }
 
           break;
         }
-        case 332: {
+        case "332": {
           // RPL_TOPIC — set topic from server.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const channel = msg.params[0];
@@ -567,13 +503,13 @@ function App() {
 
           break;
         }
-        case 322: {
+        case "322": {
           // RPL_LIST — channel, member count, topic.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const chName = msg.params[0];
             const count = msg.params[1];
             const chTopic = body || "";
-            addMessage(SERVER_TAB, {
+            addMessage("Server", {
               ...base,
               text: `${chName} (${count} users): ${chTopic.trim()}`,
               system: true,
@@ -582,21 +518,21 @@ function App() {
 
           break;
         }
-        case 323:
+        case "323":
-          addMessage(SERVER_TAB, {
+          addMessage("Server", {
             ...base,
             text: body || "End of channel list",
             system: true,
           });
 
           break;
-        case 352: {
+        case "352": {
           // RPL_WHOREPLY — channel, user, host, server, nick, flags.
           if (Array.isArray(msg.params) && msg.params.length >= 5) {
             const whoCh = msg.params[0];
             const whoNick = msg.params[4];
             const whoFlags = msg.params.length > 5 ? msg.params[5] : "";
-            addMessage(SERVER_TAB, {
+            addMessage("Server", {
               ...base,
               text: `${whoCh} ${whoNick} ${whoFlags}`,
               system: true,
@@ -605,33 +541,33 @@ function App() {
 
           break;
         }
-        case 315:
+        case "315":
-          addMessage(SERVER_TAB, {
+          addMessage("Server", {
             ...base,
             text: body || "End of /WHO list",
             system: true,
           });
 
           break;
-        case 311: {
+        case "311": {
-          // RPL_WHOISUSER — params nick, user, host, *; body realname.
+          // RPL_WHOISUSER — nick, user, host, *, realname.
-          if (Array.isArray(msg.params) && msg.params.length >= 3) {
+          if (Array.isArray(msg.params) && msg.params.length >= 1) {
-            const [wiNick, wiUser, wiHost] = msg.params;
+            const wiNick = msg.params[0];
-            addMessage(SERVER_TAB, {
+            addMessage("Server", {
               ...base,
-              text: `${wiNick} is ${wiUser}@${wiHost} (${body})`,
+              text: `${wiNick} (${body})`,
               system: true,
             });
           }
 
           break;
         }
-        case 312: {
+        case "312": {
           // RPL_WHOISSERVER — nick, server, server info.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const wiNick = msg.params[0];
             const wiServer = msg.params[1];
-            addMessage(SERVER_TAB, {
+            addMessage("Server", {
               ...base,
               text: `${wiNick} on ${wiServer}`,
               system: true,
@@ -640,37 +576,11 @@ function App() {
 
           break;
         }
-        case 313: {
+        case "319": {
-          // RPL_WHOISOPERATOR — nick; body "is an IRC operator".
-          if (Array.isArray(msg.params) && msg.params.length >= 1) {
-            addMessage(SERVER_TAB, {
-              ...base,
-              text: `${msg.params[0]} ${body}`,
-              system: true,
-            });
-          }
-
-          break;
-        }
-        case 317: {
-          // RPL_WHOISIDLE — nick, idle seconds, signon time (Unix).
-          if (Array.isArray(msg.params) && msg.params.length >= 3) {
-            const [wiNick, idle, signon] = msg.params;
-            const signedOn = new Date(Number(signon) * 1000).toLocaleString();
-            addMessage(SERVER_TAB, {
-              ...base,
-              text: `${wiNick} has been idle ${idle}s, signed on ${signedOn}`,
-              system: true,
-            });
-          }
-
-          break;
-        }
-        case 319: {
           // RPL_WHOISCHANNELS — nick, channels.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const wiNick = msg.params[0];
-            addMessage(SERVER_TAB, {
+            addMessage("Server", {
               ...base,
               text: `${wiNick} is on: ${body}`,
               system: true,
@@ -679,39 +589,27 @@ function App() {
 
           break;
         }
-        case 318:
+        case "318":
-          addMessage(SERVER_TAB, {
+          addMessage("Server", {
             ...base,
             text: body || "End of /WHOIS list",
             system: true,
           });
 
           break;
-        case 324: {
+        case "375":
-          // RPL_CHANNELMODEIS — channel, mode string.
+        case "372":
-          if (Array.isArray(msg.params) && msg.params.length >= 2) {
+        case "376":
-            addMessage(SERVER_TAB, {
+          addMessage("Server", { ...base, text: body, system: true });
-              ...base,
-              text: `${msg.params[0]} modes: ${msg.params[1]}`,
-              system: true,
-            });
-          }
-
-          break;
-        }
-        case 375:
-        case 372:
-        case 376:
-          addMessage(SERVER_TAB, { ...base, text: body, system: true });
 
           break;
         default:
           if (body) {
-            addMessage(SERVER_TAB, { ...base, text: body, system: true });
+            addMessage("Server", { ...base, text: body, system: true });
           }
       }
     },
-    [addMessage, refreshMembers, removeChannelTab],
+    [addMessage, refreshMembers],
   );
 
   // Long-poll loop.
@@ -739,14 +637,6 @@ function App() {
         } catch (err) {
           if (!alive) break;
           if (err.name === "AbortError") continue;
-          // 401: the session is gone (QUIT from another client, or
-          // expiry). Reloading drops this page's state and brings
-          // back the login screen.
-          if (err.status === 401) {
-            window.location.reload();
-
-            return;
-          }
           setConnected(false);
           await new Promise((r) => setTimeout(r, RECONNECT_DELAY));
         }
@@ -826,14 +716,9 @@ function App() {
 
   const onLogin = useCallback(
     async (userNick, isResumed) => {
-      // Read before setLoggedIn(true): from then on the effect under
-      // "Persist joined channels" writes the open channel tabs over it.
-      const saved = JSON.parse(
-        localStorage.getItem("neoirc_channels") || "[]",
-      );
       setNick(userNick);
       setLoggedIn(true);
-      addSystemMessage(SERVER_TAB, `Connected as ${userNick}`);
+      addSystemMessage("Server", `Connected as ${userNick}`);
 
       if (isResumed) {
         // Request MOTD on resumed sessions (new sessions
@@ -855,13 +740,15 @@ function App() {
       }
 
       // Fresh session — join any previously saved channels.
+      const saved = JSON.parse(
+        localStorage.getItem("neoirc_channels") || "[]",
+      );
       for (const ch of saved) {
         try {
-          const res = await api("/messages", {
+          await api("/messages", {
             method: "POST",
             body: JSON.stringify({ command: "JOIN", to: ch }),
           });
-          if (res?.status !== "joined") continue;
           setTabs((prev) => {
             if (prev.find((t) => t.type === "channel" && t.name === ch))
               return prev;
@@ -881,30 +768,18 @@ function App() {
     name = name.trim();
     if (!name.startsWith("#")) name = "#" + name;
     try {
-      const res = await api("/messages", {
+      await api("/messages", {
         method: "POST",
         body: JSON.stringify({ command: "JOIN", to: name }),
       });
-      // A refused join opens no tab. The error numeric that the
-      // server sends to the message queue tells the user why.
-      if (res?.status !== "joined") return;
-      // Show the channel's tab. Preact runs this update at once on the
-      // newest tab list, so the tab is found there by name: the user's
-      // own JOIN event may already have added it, and other tabs may
-      // have closed.
       setTabs((prev) => {
-        const idx = prev.findIndex(
+        if (prev.find((t) => t.type === "channel" && t.name === name))
-          (t) => t.type === "channel" && t.name === name,
-        );
-        if (idx >= 0) {
-          setActiveTab(idx);
-
           return prev;
-        }
-        setActiveTab(prev.length);
 
         return [...prev, { type: "channel", name }];
       });
+      const newIdx = tabsRef.current.length;
+      setActiveTab(newIdx);
       try {
         const hist = await api(
           `/history?target=${encodeURIComponent(name)}&limit=50`,
@@ -917,7 +792,7 @@ function App() {
       }
     } catch (err) {
       addSystemMessage(
-        SERVER_TAB,
+        "Server",
         `Failed to join ${name}: ${err.data?.error || "error"}`,
       );
     }
@@ -933,7 +808,10 @@ function App() {
     } catch (e) {
       // Ignore.
     }
-    removeChannelTab(name);
+    setTabs((prev) =>
+      prev.filter((t) => !(t.type === "channel" && t.name === name)),
+    );
+    setActiveTab(0);
   };
 
   const closeTab = (idx) => {
@@ -948,23 +826,16 @@ function App() {
 
   const openDM = (targetNick) => {
     if (targetNick === nickRef.current) return;
-    // Show the direct-message tab. Preact runs this update at once on
-    // the newest tab list, so the tab is found there by name: the
-    // server's copy of the user's message may already have added it,
-    // and other tabs may have opened or closed.
     setTabs((prev) => {
-      const idx = prev.findIndex(
+      if (prev.find((t) => t.type === "dm" && t.name === targetNick))
-        (t) => t.type === "dm" && t.name === targetNick,
-      );
-      if (idx >= 0) {
-        setActiveTab(idx);
-
         return prev;
-      }
-      setActiveTab(prev.length);
 
       return [...prev, { type: "dm", name: targetNick }];
     });
+    const idx = tabs.findIndex(
+      (t) => t.type === "dm" && t.name === targetNick,
+    );
+    setActiveTab(idx >= 0 ? idx : tabs.length);
   };
 
   const handleCommand = async (text) => {
@@ -975,7 +846,7 @@ function App() {
     switch (cmd) {
       case "/join": {
         if (parts[1]) joinChannel(parts[1]);
-        else addSystemMessage(SERVER_TAB, "Usage: /join #channel");
+        else addSystemMessage("Server", "Usage: /join #channel");
 
         break;
       }
@@ -984,7 +855,7 @@ function App() {
           const reason = parts.slice(1).join(" ") || undefined;
           partChannel(tab.name, reason);
         } else {
-          addSystemMessage(SERVER_TAB, "You are not in a channel");
+          addSystemMessage("Server", "You are not in a channel");
         }
 
         break;
@@ -1005,19 +876,19 @@ function App() {
             openDM(target);
           } catch (err) {
             addSystemMessage(
-              SERVER_TAB,
+              "Server",
               `Message failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage(SERVER_TAB, "Usage: /msg <nick> <message>");
+          addSystemMessage("Server", "Usage: /msg <nick> <message>");
         }
 
         break;
       }
       case "/me": {
         if (tab.type === "server") {
-          addSystemMessage(SERVER_TAB, "Cannot use /me in server window");
+          addSystemMessage("Server", "Cannot use /me in server window");
 
           break;
         }
@@ -1039,7 +910,7 @@ function App() {
             );
           }
         } else {
-          addSystemMessage(SERVER_TAB, "Usage: /me <action>");
+          addSystemMessage("Server", "Usage: /me <action>");
         }
 
         break;
@@ -1053,19 +924,19 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              SERVER_TAB,
+              "Server",
               `Nick change failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage(SERVER_TAB, "Usage: /nick <newnick>");
+          addSystemMessage("Server", "Usage: /nick <newnick>");
         }
 
         break;
       }
       case "/topic": {
         if (tab.type !== "channel") {
-          addSystemMessage(SERVER_TAB, "You are not in a channel");
+          addSystemMessage("Server", "You are not in a channel");
 
           break;
         }
@@ -1082,13 +953,13 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              SERVER_TAB,
+              "Server",
               `Topic change failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
           addSystemMessage(
-            SERVER_TAB,
+            "Server",
             `Current topic for ${tab.name}: ${topics[tab.name] || "(none)"}`,
           );
         }
@@ -1097,26 +968,31 @@ function App() {
       }
       case "/mode": {
         if (tab.type !== "channel") {
-          addSystemMessage(SERVER_TAB, "You are not in a channel");
+          addSystemMessage("Server", "You are not in a channel");
 
           break;
         }
-        // With no arguments MODE is a query. A change is one sign and
-        // letter, then its value where it takes one: +m, +o nick.
         const modeArgs = parts.slice(1);
-        const body =
+        if (modeArgs.length > 0) {
-          modeArgs.length > 0
-            ? { command: "MODE", to: tab.name, body: modeArgs }
-            : { command: "MODE", to: tab.name };
           try {
             await api("/messages", {
               method: "POST",
-            body: JSON.stringify(body),
+              body: JSON.stringify({
+                command: "MODE",
+                to: tab.name,
+                params: modeArgs,
+              }),
             });
           } catch (err) {
             addSystemMessage(
-            SERVER_TAB,
+              "Server",
-            `MODE failed: ${err.data?.error || "error"}`,
+              `Mode change failed: ${err.data?.error || "error"}`,
+            );
+          }
+        } else {
+          addSystemMessage(
+            "Server",
+            "Usage: /mode <+/-mode> [params]",
           );
         }
 
@@ -1133,6 +1009,7 @@ function App() {
         } catch (e) {
           // Ignore.
         }
+        localStorage.removeItem("neoirc_token");
         localStorage.removeItem("neoirc_channels");
         window.location.reload();
 
@@ -1146,7 +1023,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            SERVER_TAB,
+            "Server",
             `Failed to request MOTD: ${err.data?.error || "error"}`,
           );
         }
@@ -1170,13 +1047,13 @@ function App() {
               });
             } catch (err) {
               addSystemMessage(
-                SERVER_TAB,
+                "Server",
                 `Message failed: ${err.data?.error || "error"}`,
               );
             }
           }
         } else {
-          addSystemMessage(SERVER_TAB, "Usage: /query <nick> [message]");
+          addSystemMessage("Server", "Usage: /query <nick> [message]");
         }
 
         break;
@@ -1189,7 +1066,7 @@ function App() {
           });
         } catch (err) {
           addSystemMessage(
-            SERVER_TAB,
+            "Server",
             `Failed to list channels: ${err.data?.error || "error"}`,
           );
         }
@@ -1206,12 +1083,12 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              SERVER_TAB,
+              "Server",
               `WHO failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage(SERVER_TAB, "Usage: /who #channel");
+          addSystemMessage("Server", "Usage: /who #channel");
         }
 
         break;
@@ -1225,12 +1102,12 @@ function App() {
             });
           } catch (err) {
             addSystemMessage(
-              SERVER_TAB,
+              "Server",
               `WHOIS failed: ${err.data?.error || "error"}`,
             );
           }
         } else {
-          addSystemMessage(SERVER_TAB, "Usage: /whois <nick>");
+          addSystemMessage("Server", "Usage: /whois <nick>");
         }
 
         break;
@@ -1251,7 +1128,7 @@ function App() {
           "  /me action            — Send an action",
           "  /nick newnick         — Change your nickname",
           "  /topic [text]         — View or set channel topic",
-          "  /mode [+/-flag [arg]] — View or set channel modes",
+          "  /mode +/-flags        — Set channel modes",
           "  /motd                 — Display the message of the day",
           "  /list                 — List all channels",
           "  /who [#channel]       — List users in a channel",
@@ -1261,13 +1138,13 @@ function App() {
           "  /help                 — Show this help",
         ];
         for (const line of helpLines) {
-          addSystemMessage(SERVER_TAB, line);
+          addSystemMessage("Server", line);
         }
 
         break;
       }
       default:
-        addSystemMessage(SERVER_TAB, `Unknown command: ${cmd}`);
+        addSystemMessage("Server", `Unknown command: ${cmd}`);
     }
   };
 
@@ -1296,7 +1173,7 @@ function App() {
 
     if (tab.type === "server") {
       addSystemMessage(
-        SERVER_TAB,
+        "Server",
         "Cannot send messages to the server window. Use /join #channel first.",
       );
 
@@ -1367,7 +1244,7 @@ function App() {
               key={tab.name}
             >
               <span class="tab-label">
-                {tab.type === "server" ? "Server" : tab.name}
+                {tab.type === "dm" ? tab.name : tab.name}
               </span>
               {unread[tab.name] > 0 && i !== activeTab && (
                 <span class="unread-count">({unread[tab.name]})</span>