From ed58813ea525cfec9458983e626729fca29880b4 Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Sun, 30 Aug 2026 04:52:40 +0000
Subject: [PATCH] sasl: advertise and relay ECDSA-NIST256P-CHALLENGE

---
 src/coremods/core_user.rs | 11 +++++++----
 src/users.rs              |  4 ++--
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/coremods/core_user.rs b/src/coremods/core_user.rs
index 78cefb7..e485536 100644
--- a/src/coremods/core_user.rs
+++ b/src/coremods/core_user.rs
@@ -335,6 +335,7 @@ impl Command for Authenticate {
                     CmdResult::Ok
                 } else if arg.eq_ignore_ascii_case("PLAIN")
                     || arg.eq_ignore_ascii_case("SCRAM-SHA-256")
+                    || arg.eq_ignore_ascii_case("ECDSA-NIST256P-CHALLENGE")
                 {
                     if !have_services {
                         s.numeric(
@@ -344,12 +345,14 @@ impl Command for Authenticate {
                         );
                         return CmdResult::Fail;
                     }
-                    // SCRAM is challenge-response, so the password never crosses the wire —
-                    // it's fine to offer over plaintext too. The rounds relay mech-agnostically.
+                    // SCRAM and ECDSA are challenge-response, so the password/key never
+                    // crosses the wire — fine over plaintext too. Rounds relay mech-agnostically.
                     let mech = if arg.eq_ignore_ascii_case("PLAIN") {
                         "PLAIN"
-                    } else {
+                    } else if arg.eq_ignore_ascii_case("SCRAM-SHA-256") {
                         "SCRAM-SHA-256"
+                    } else {
+                        "ECDSA-NIST256P-CHALLENGE"
                     };
                     if let Some(u) = s.users.get_mut(&uid) {
                         u.sasl_mech = Some(mech.to_string());
@@ -382,7 +385,7 @@ impl Command for Authenticate {
                         }
                     }
                 } else {
-                    s.numeric(uid, RPL_SASLMECHS, "PLAIN,SCRAM-SHA-256 :are available SASL mechanisms");
+                    s.numeric(uid, RPL_SASLMECHS, "PLAIN,SCRAM-SHA-256,ECDSA-NIST256P-CHALLENGE :are available SASL mechanisms");
                     s.numeric(uid, ERR_SASLFAIL, ":Unsupported SASL mechanism");
                     CmdResult::Fail
                 }
diff --git a/src/users.rs b/src/users.rs
index 0b1f462..c8e5bc6 100644
--- a/src/users.rs
+++ b/src/users.rs
@@ -194,9 +194,9 @@ impl Caps {
             .map(|c| {
                 if *c == "sasl" && cap302 {
                     if secure {
-                        "sasl=PLAIN,EXTERNAL,SCRAM-SHA-256".to_string()
+                        "sasl=PLAIN,EXTERNAL,SCRAM-SHA-256,ECDSA-NIST256P-CHALLENGE".to_string()
                     } else {
-                        "sasl=PLAIN,SCRAM-SHA-256".to_string()
+                        "sasl=PLAIN,SCRAM-SHA-256,ECDSA-NIST256P-CHALLENGE".to_string()
                     }
                 } else if *c == "draft/multiline" && cap302 {
                     format!("draft/multiline=max-bytes={mline_bytes},max-lines={mline_lines}")