Rate-limit REPORT and REQUEST on the real host instead of the spoofable nick

api/src/lib.rs

@@ -2056,13 +2056,13 @@ pub trait Store {
     fn news_del(&mut self, id: u64) -> bool;
     fn news(&self, kind: NewsKind) -> Vec<NewsView>;
     // Abuse reports (ReportServ). `report_file` is rate-limited (None = too soon).
-    fn report_file(&mut self, reporter: &str, target: &str, reason: &str) -> Option<u64>;
+    fn report_file(&mut self, reporter: &str, cooldown_key: &str, target: &str, reason: &str) -> Option<u64>;
     fn report_close(&mut self, id: u64) -> bool;
     fn report_del(&mut self, id: u64) -> bool;
     fn reports(&self, open_only: bool) -> Vec<ReportView>;
     fn report(&self, id: u64) -> Option<ReportView>;
     // Help-desk tickets (HelpServ). `help_request` is rate-limited (None = too soon).
-    fn help_request(&mut self, requester: &str, message: &str) -> Option<u64>;
+    fn help_request(&mut self, requester: &str, cooldown_key: &str, message: &str) -> Option<u64>;
     fn help_take(&mut self, id: u64, handler: &str) -> bool;
     fn help_close(&mut self, id: u64) -> bool;
     fn help_tickets(&self, open_only: bool) -> Vec<HelpView>;

modules/helpserv/src/lib.rs

@@ -60,7 +60,7 @@ impl Service for HelpServ {
     fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
         let me = self.uid.as_str();
         match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
-            Some("REQUEST") | Some("HELPME") => request::handle(me, from, &args[1..], ctx, db),
+            Some("REQUEST") | Some("HELPME") => request::handle(me, from, &args[1..], ctx, net, db),
             Some("CANCEL") => cancel::handle(me, from, ctx, db),
             Some("LIST") => list::handle(me, from, args.get(1).copied(), ctx, db),
             Some("VIEW") | Some("READ") => view::handle(me, from, args.get(1).copied(), ctx, db),

modules/helpserv/src/request.rs

@@ -1,19 +1,16 @@
-use echo_api::{Sender, ServiceCtx, Store};
+use echo_api::{NetView, Sender, ServiceCtx, Store};
 
 // REQUEST <message> (aka HELPME): open a help-desk ticket for the staff.
-pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
     let message = rest.join(" ");
     if message.trim().is_empty() {
         ctx.notice(me, from.uid, "Tell us what you need help with: REQUEST <message>");
         return;
     }
-    // Require identification, so the cooldown keys on a stable account rather than a
+    let requester = from.account.unwrap_or(from.nick);
-    // spoofable nick a flooder can cycle to reset it.
+    // Rate-limit on the real host, not the spoofable nick (see REPORT).
-    let Some(requester) = from.account else {
+    let cooldown_key = net.host_of(from.uid).unwrap_or(from.uid);
-        ctx.notice(me, from.uid, "Please identify to NickServ before opening a ticket.");
+    match db.help_request(requester, cooldown_key, &message) {
-        return;
-    };
-    match db.help_request(requester, &message) {
         Some(id) => ctx.notice(me, from.uid, format!("Thanks — your request (\x02#{id}\x02) is in the queue. A staff member will be with you.")),
         None => ctx.notice(me, from.uid, "You just opened a ticket — please wait a moment before opening another."),
     }

modules/reportserv/src/lib.rs

@@ -50,10 +50,10 @@ impl Service for ReportServ {
         (BLURB, TOPICS)
     }
 
-    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, _net: &dyn NetView, db: &mut dyn Store) {
+    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
         let me = self.uid.as_str();
         match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
-            Some("REPORT") => report::handle(me, from, &args[1..], ctx, db),
+            Some("REPORT") => report::handle(me, from, &args[1..], ctx, net, db),
             Some("LIST") => list::handle(me, from, args.get(1).copied(), ctx, db),
             Some("VIEW") | Some("READ") => view::handle(me, from, args.get(1).copied(), ctx, db),
             Some("CLOSE") | Some("RESOLVE") => close::handle(me, from, args.get(1).copied(), ctx, db),

modules/reportserv/src/report.rs

@@ -1,7 +1,7 @@
-use echo_api::{Sender, ServiceCtx, Store};
+use echo_api::{NetView, Sender, ServiceCtx, Store};
 
 // REPORT <nick|#channel> <reason>: file an abuse report. Rate-limited.
-pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
     let Some((&target, reason_words)) = rest.split_first() else {
         ctx.notice(me, from.uid, "Syntax: REPORT <nick|#channel> <reason>");
         return;
@@ -11,13 +11,11 @@ pub fn handle(me: &str, from: &Sender, rest: &[&str], ctx: &mut ServiceCtx, db:
         return;
     }
     let reason = reason_words.join(" ");
-    // Require identification, so the cooldown keys on a stable account rather than a
+    let reporter = from.account.unwrap_or(from.nick);
-    // spoofable nick a flooder can cycle to reset it.
+    // Rate-limit on the real host, not the (spoofable) nick a flooder could cycle to
-    let Some(reporter) = from.account else {
+    // reset the cooldown. Anonymous reports still work; the host anchors the limit.
-        ctx.notice(me, from.uid, "Please identify to NickServ before filing a report.");
+    let cooldown_key = net.host_of(from.uid).unwrap_or(from.uid);
-        return;
+    match db.report_file(reporter, cooldown_key, target, &reason) {
-    };
-    match db.report_file(reporter, target, &reason) {
         Some(id) => ctx.notice(me, from.uid, format!("Thanks — your report (\x02#{id}\x02) about \x02{target}\x02 has been sent to the staff.")),
         None => ctx.notice(me, from.uid, "You just filed a report — please wait a moment before filing another."),
     }

src/engine/db/network.rs

@@ -460,10 +460,10 @@ impl Db {
 
     /// File an abuse report, rate-limited per reporter. Returns the new report's
     /// id, or None if the reporter filed one too recently.
-    pub fn report_file(&mut self, reporter: &str, target: &str, reason: &str) -> Option<u64> {
+    pub fn report_file(&mut self, reporter: &str, cooldown_key: &str, target: &str, reason: &str) -> Option<u64> {
         const COOLDOWN: u64 = 30;
         let now = now();
-        let key = reporter.to_ascii_lowercase();
+        let key = cooldown_key.to_ascii_lowercase();
         if self.report_times.get(&key).is_some_and(|&t| now.saturating_sub(t) < COOLDOWN) {
             return None;
         }
@@ -516,10 +516,10 @@ impl Db {
 
     /// Open a help-desk ticket, rate-limited per requester (shares the report
     /// throttle namespace). Returns the new ticket's id, or None if too soon.
-    pub fn help_request(&mut self, requester: &str, message: &str) -> Option<u64> {
+    pub fn help_request(&mut self, requester: &str, cooldown_key: &str, message: &str) -> Option<u64> {
         const COOLDOWN: u64 = 30;
         let now = now();
-        let tkey = format!("help:{}", requester.to_ascii_lowercase());
+        let tkey = format!("help:{}", cooldown_key.to_ascii_lowercase());
         if self.report_times.get(&tkey).is_some_and(|&t| now.saturating_sub(t) < COOLDOWN) {
             return None;
         }

src/engine/db/store.rs

@@ -344,8 +344,8 @@ impl Store for Db {
     fn news(&self, kind: NewsKind) -> Vec<NewsView> {
         Db::news(self, kind)
     }
-    fn report_file(&mut self, reporter: &str, target: &str, reason: &str) -> Option<u64> {
+    fn report_file(&mut self, reporter: &str, cooldown_key: &str, target: &str, reason: &str) -> Option<u64> {
-        Db::report_file(self, reporter, target, reason)
+        Db::report_file(self, reporter, cooldown_key, target, reason)
     }
     fn report_close(&mut self, id: u64) -> bool {
         Db::report_close(self, id)
@@ -359,8 +359,8 @@ impl Store for Db {
     fn report(&self, id: u64) -> Option<ReportView> {
         Db::report(self, id)
     }
-    fn help_request(&mut self, requester: &str, message: &str) -> Option<u64> {
+    fn help_request(&mut self, requester: &str, cooldown_key: &str, message: &str) -> Option<u64> {
-        Db::help_request(self, requester, message)
+        Db::help_request(self, requester, cooldown_key, message)
     }
     fn help_take(&mut self, id: u64, handler: &str) -> bool {
         Db::help_take(self, id, handler)

src/engine/kicker.rs

@@ -218,7 +218,7 @@ impl Engine {
         let threshold = self.db.channel(channel).map(|c| c.kickers.votekick).unwrap_or(0);
         let botnick = self.db.channel(channel).and_then(|c| c.assigned_bot.clone());
         let (Some(botnick), true) = (botnick, threshold > 0) else { return None };
-        let Some(botuid) = self.network.uid_by_nick(&botnick).map(str::to_string) else { return None };
+        let botuid = self.network.uid_by_nick(&botnick).map(str::to_string)?;
         let Some(target_uid) = self.network.uid_by_nick(target_nick).map(str::to_string) else {
             return Some(vec![NetAction::Privmsg { from: botuid, to: channel.to_string(), text: format!("There's no \x02{target_nick}\x02 here to vote on.") }]);
         };