Add invite-only registration: a new account waits for a confirmed member to VOUCH

src/config.rs

@@ -126,11 +126,16 @@ pub struct Register {
     // default; turn it off for a community that legitimately uses mixed or
     // non-Latin names. Reloadable with REHASH.
     pub confusable_check: bool,
+    // Invite-only registration: a new account stays pending until an existing
+    // member vouches for it (NickServ VOUCH), instead of confirming by email.
+    // Off by default. Reloadable with REHASH.
+    #[serde(default)]
+    pub vouch: bool,
 }
 
 impl Default for Register {
     fn default() -> Self {
-        Self { confusable_check: true }
+        Self { confusable_check: true, vouch: false }
     }
 }
 

src/engine/db/account.rs

@@ -6,9 +6,10 @@ impl Db {
         if self.exists(name) {
             return Err(RegError::Exists);
         }
-        // Unverified only when email confirmation actually applies (email is
-        // configured and an address was given); otherwise verified immediately.
-        let verified = !(self.email_enabled && email.is_some());
+        // Unverified when email confirmation applies (email configured and an
+        // address given) OR the network is invite-only (a member must VOUCH);
+        // otherwise verified immediately.
+        let verified = !(self.registration_vouch || (self.email_enabled && email.is_some()));
         let ts = now(); // one timestamp: registered-at == last-seen at creation
         let account = Account {
             name: name.to_string(),

src/engine/db/mod.rs

@@ -1181,6 +1181,7 @@ pub struct Db {
     // against accounts pushed in (via the gRPC Accounts API). Node-local config.
     external_accounts: bool,
     confusable_check: bool, // reject look-alike / mixed-script REGISTER names
+    registration_vouch: bool, // invite-only: new accounts wait for a member to vouch
     default_language: String, // network-wide reply language for users with no preference
     available_languages: Vec<String>, // language codes a user may pick with SET LANGUAGE
 }
@@ -1251,7 +1252,7 @@ impl Db {
             apply(&mut accounts, &mut channels, &mut grouped, &mut bots, &mut host_cfg, &mut net, event);
         }
         tracing::info!(accounts = accounts.len(), channels = channels.len(), "account store loaded");
-        Self { accounts, channels, grouped, log, extban_enabled: None, notify_exclude: Vec::new(), live_extbans: None, live_chanmodes: None, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), email_confirm_url: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), report_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), defcon: 5, external_accounts: false, confusable_check: true, default_language: "en".to_string(), available_languages: vec!["en".to_string()] }
+        Self { accounts, channels, grouped, log, extban_enabled: None, notify_exclude: Vec::new(), live_extbans: None, live_chanmodes: None, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), email_confirm_url: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), report_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), defcon: 5, external_accounts: false, confusable_check: true, registration_vouch: false, default_language: "en".to_string(), available_languages: vec!["en".to_string()] }
     }
 
     /// Fold an entry authored by another node into the store — the services-side

src/engine/db/network.rs

@@ -355,6 +355,10 @@ impl Db {
         self.confusable_check = on;
     }
 
+    pub fn set_registration_vouch(&mut self, on: bool) {
+        self.registration_vouch = on;
+    }
+
     /// The network-wide reply language for users who haven't set a preference.
     pub fn set_default_language(&mut self, lang: &str) {
         if !lang.is_empty() {
@@ -382,6 +386,10 @@ impl Db {
         self.confusable_check
     }
 
+    pub fn registration_vouch(&self) -> bool {
+        self.registration_vouch
+    }
+
     /// The network defence level (5 = normal, 1 = full lockdown).
     pub fn defcon(&self) -> u8 {
         self.defcon

src/engine/db/store.rs

@@ -338,6 +338,9 @@ impl Store for Db {
     fn confusable_check_enabled(&self) -> bool {
         self.confusable_check
     }
+    fn registration_vouch(&self) -> bool {
+        Db::registration_vouch(self)
+    }
     fn set_account_note(&mut self, account: &str, note: Option<String>) -> bool {
         Db::set_account_note(self, account, note)
     }

src/engine/mod.rs

@@ -1002,6 +1002,7 @@ impl Engine {
         self.set_log_channel(cfg.log.as_ref().map(|l| l.channel.clone()));
         self.db.set_notify_exclude(cfg.log.as_ref().map(|l| l.notify_exclude.clone()).unwrap_or_default());
         self.db.set_confusable_check(cfg.register.confusable_check);
+        self.db.set_registration_vouch(cfg.register.vouch);
         self.set_guest_nick(&cfg.server.guest_nick);
         if let Some(expire) = &cfg.expire {
             self.set_expiry(expire.account_ttl(), expire.channel_ttl(), expire.warn_ttl());

src/engine/register.rs

@@ -342,7 +342,12 @@ impl Engine {
         // NickServ or the account-registration relay path. The relay reply
         // already carries verification_required; NickServ users get a notice.
         if needs_verify {
-            if let Some(addr) = addr {
+            if self.db.registration_vouch() {
+                // Invite-only: the account waits for a member to VOUCH, not an email code.
+                if let RegReply::NickServ { agent, uid, .. } = &reply {
+                    out.push(NetAction::Notice { from: agent.clone(), to: uid.clone(), text: echo_api::render(&self.lang_for_account(account), "Your account is pending. Ask an existing member to vouch for you with \x02/msg NickServ VOUCH {account}\x02.", &[("account", account.to_string())]) });
+                }
+            } else if let Some(addr) = addr {
                 let code = self.db.issue_code(account, db::CodeKind::Confirm);
                 let mail = echo_api::email::confirm(self.db.email_brand(), self.db.email_accent(), self.db.email_logo(), account, &code, self.db.email_confirm_url(), &self.lang_for_account(account));
                 out.push(NetAction::SendEmail { to: addr, subject: mail.subject, text: mail.text, html: Some(mail.html) });

src/engine/tests.rs

@@ -5344,6 +5344,27 @@
         assert!(!out.iter().any(|a| matches!(a, NetAction::Kick { reason, .. } if reason.contains("requested by"))), "op founder exempt on LEVEL: {out:?}");
     }
 
+    // Invite-only registration: a new account starts pending, and a confirmed
+    // member's VOUCH activates it.
+    #[test]
+    fn vouch_confirms_a_pending_account() {
+        let path = std::env::temp_dir().join("echo-vouch.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("alice", "sesame", None).unwrap(); // verified (vouch off)
+        db.set_registration_vouch(true);
+        db.register("bob", "pw", None).unwrap(); // invite-only -> pending
+        assert!(!db.is_verified("bob"), "bob starts pending under vouch mode");
+        let ns = NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 };
+        let mut e = Engine::new(vec![Box::new(ns)], db);
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "h".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        let out = e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "VOUCH bob".into() });
+        assert!(out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("vouched"))), "vouch confirmation: {out:?}");
+        assert!(e.db.is_verified("bob"), "bob is now active after the vouch");
+    }
+
     // ChanServ SET: description and founder transfer, founder-gated.
     #[test]
     fn chanserv_set() {

src/main.rs

@@ -241,6 +241,7 @@ async fn main() -> Result<()> {
     db.set_email_enabled(cfg.email.is_some());
     db.set_external_accounts(cfg.auth.as_ref().is_some_and(|a| a.external));
     db.set_confusable_check(cfg.register.confusable_check);
+    db.set_registration_vouch(cfg.register.vouch);
     if let Some(lang) = &cfg.language {
         db.set_default_language(&lang.default);
         db.set_available_languages(lang.available.clone());