From aa15946fed97a6b8ac89742eaf41527f8e990866 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nils=20B=C3=BCchner?= <nils@buechner.me>
Date: Sun, 13 Sep 2026 15:20:49 +0200
Subject: [PATCH] Fix SASL PLAIN using ident instead of nick as authcid

SASL PLAIN's payload is authzid\0authcid\0password. onAuthenticate()
was using opt.userName (the IRC ident sent via USER) for both identity
fields instead of the account being authenticated. Networks that
validate the account name (e.g. Libera Chat) reject this with
err_saslfail even when the password is correct, since the ident and
the NickServ account rarely match.

Default to this.nick (the connecting nick, backed by state.currentNick
which is set before registration) for both identity fields, since that
matches most networks/services. The nick and the account name aren't
guaranteed to be the same everywhere though, so add an optional
`saslAccount` opt to override it explicitly for setups where they
differ.
---
 src/irc.ts | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/irc.ts b/src/irc.ts
index 9d3fac87..9cb8b94a 100644
--- a/src/irc.ts
+++ b/src/irc.ts
@@ -63,6 +63,13 @@ export interface IrcClientOpts {
     floodProtectionDelay?: number;
     sasl?: boolean;
     saslType?: 'PLAIN'|'EXTERNAL';
+    /**
+     * The account name to authenticate as via SASL PLAIN. Defaults to the connecting nick, which
+     * is correct for most networks/services but not guaranteed to be true everywhere (a NickServ
+     * account name need not match the nick in use). Set this explicitly if your network's account
+     * name differs from the nick.
+     */
+    saslAccount?: string;
     stripColors?: boolean;
     channelPrefixes?: string;
     messageSplit?: number;
@@ -940,14 +947,23 @@ export class Client extends (EventEmitter as unknown as new () => TypedEmitter<C
             return;
         }
         switch (this.opt.saslType) {
-            case 'PLAIN':
+            case 'PLAIN': {
+                // SASL PLAIN payload is authzid\0authcid\0password. The identity to authenticate
+                // as must be the account being registered, not `opt.userName` (which is the
+                // separate IRC ident sent via USER) - using the ident here made servers that check
+                // the account name (e.g. Libera) reject the handshake with err_saslfail, even when
+                // the password was correct. The nick is the best default for this (and correct for
+                // most networks/services), but isn't guaranteed to match the actual account name,
+                // so allow it to be overridden via `saslAccount`.
+                const account = this.opt.saslAccount || this.nick;
                 this._send('AUTHENTICATE',
                     Buffer.from(
-                        this.opt.userName + '\x00' +
-                        this.opt.userName + '\x00' +
+                        account + '\x00' +
+                        account + '\x00' +
                         this.opt.password
                     ).toString('base64'));
                 break;
+            }
             case 'EXTERNAL':
                 this._send('AUTHENTICATE', '+');
                 break;