# Operators

Server operators are defined by `oper` blocks and typed by `opertype` blocks. An oper's power is the
sum of three allow-lists: the **commands** they may run, the named **privileges** they hold, and the
user/channel **modes** they may set. `class` blocks bundle those into reusable roles that opertypes
compose.

## Oper accounts

An `oper` block ties a login to an `opertype`. Hash the password with `echoircd mkpasswd`. A block
with neither a password nor a fingerprint is refused.

```ini
oper {
    name        "alice";
    password    "$2b$11$...";        # from: echoircd mkpasswd
    fingerprint "AA:BB:...";          # optional TLS client-cert (2FA, or alone)
    type        "netadmin";
    host        "*@192.0.2.0/24";
}
```

Then, as a client: `/oper alice hunter2`.

## Classes and types

A `class` is a reusable capability bundle; an `opertype` composes classes into a named WHOIS role.

```ini
class {
    name      "ban";
    commands  "KILL KLINE GLINE ZLINE";
    privs     "users/auspex channels/auspex";
    snomasks  "cdkx";
}

opertype {
    name    "helper";
    classes "auspex";
    modes   "+ih";
    title   "Help Operator";
}
```

Command and privilege lists are space-separated tokens: `*` grants everything, a `-` prefix removes
one (`* -KILL` = everything except `KILL`). `usermodes` / `chanmodes` on a class limit which oper-only
modes the type may set.

### Built-in classes

`announce` · `ban` · `override` · `host` · `services` · `server` · `auspex` — covering broadcast,
X-lines, SA-overrides, host/identity changes, the SVS commands, server control, and the auspex/bypass
privileges respectively.

### Built-in types

Five ship ready to use (only `netadmin` holds every privilege):

| Type | Title | Level |
| --- | --- | --- |
| `helpop` | Help Operator | 10 |
| `globop` | GlobOp | 20 |
| `admin` | Administrator | 50 |
| `servadmin` | Services Administrator | 70 |
| `netadmin` | Network Administrator | 100 |

## Named privileges

Privileges gate individual abilities. Assign them per class/type via `privs`; the daemon enforces
them everywhere the ability is used.

| Privilege | Grants |
| --- | --- |
| `users/auspex` | See a user's real host+IP and geo, and `+i` users you share no channel with |
| `channels/auspex` | See secret/private (`+s`/`+p`) channels in LIST / WHO / WHOIS |
| `servers/auspex` | See U-lined/services servers otherwise hidden by `hideservices` |
| `users/flood` | Exempt from message- and join-flood limits |
| `users/ignore-commonchans` | Message a `+c` user without sharing a common channel |
| `channels/override` | Join through `+k`/`+b`/`+i`/`+l`/`+z`/`+R`/`+J`, CBAN, and the channel cap |
| `channels/restricted-create` | Create a channel while `restrictchans` is on |
| `channels/ignore-nonicks` | Change nick while on a `+N` channel |
| `users/ignore-callerid` | Message a `+g` user without being on their ACCEPT list |
| `users/ignore-privdeaf` | Reach a `+D` (deaf) user with channel messages |
| `users/secret-whois` | WHOIS a `+W` user without notifying them |
| `users/ignore-restrictmsg` | Private-message anyone while `restrictmsg` is on |
| `servers/use-disabled-commands` | Use a command turned off by `disabled_commands` |
| `servers/ignore-securelist` | Bypass the `securelist` LIST hold |
| `servers/ignore-blockamsg` | Send multi-channel messages that `blockamsg` blocks |

An untyped ("legacy") oper — an `oper` block with no `type` — holds every command and privilege.