diff --git a/api/src/lib.rs b/api/src/lib.rs index 3636cf3..586e5fd 100644 --- a/api/src/lib.rs +++ b/api/src/lib.rs @@ -1023,8 +1023,8 @@ pub struct ChanAccessView { // via the same primitive, by GroupServ. Each letter grants a capability: // f full/co-founder o auto-op O op commands h auto-halfop // v auto-voice t topic i invite a modify access list -// s channel settings g greet shown -pub const ACCESS_FLAGS: &str = "foOhvtiasg"; +// s channel settings g greet shown d deny all status (barred from op/voice) +pub const ACCESS_FLAGS: &str = "foOhvtiasgd"; /// A channel access rank, ordered lowest to highest. The derived `Ord` mirrors /// the ircd's prefix ranks (voice < halfop < op < admin < founder), so services @@ -1122,12 +1122,13 @@ pub enum Flag { Access, // a — manage the access / flags / akick lists Set, // s — change channel settings Greet, // g — greeting shown on join + NoStatus, // d — barred from ANY status: no auto op/voice, and services strip it } impl Flag { /// Every flag, in canonical (display / ACCESS_FLAGS) order. - pub const ALL: [Flag; 10] = [ - Flag::Founder, Flag::AutoOp, Flag::Op, Flag::Halfop, Flag::Voice, Flag::Topic, Flag::Invite, Flag::Access, Flag::Set, Flag::Greet, + pub const ALL: [Flag; 11] = [ + Flag::Founder, Flag::AutoOp, Flag::Op, Flag::Halfop, Flag::Voice, Flag::Topic, Flag::Invite, Flag::Access, Flag::Set, Flag::Greet, Flag::NoStatus, ]; /// The flag's letter. Exhaustive, so a new variant forces choosing its letter. @@ -1143,6 +1144,7 @@ impl Flag { Flag::Access => 'a', Flag::Set => 's', Flag::Greet => 'g', + Flag::NoStatus => 'd', } } @@ -1181,7 +1183,10 @@ impl Flags { let op = autoop || self.has(Flag::Op); let access = self.has(Flag::Access); // Auto-op plus access-list management is the SOP tier: auto protect + op. - let auto = if autoop { + // NoStatus (deny) overrides every status flag: the user is granted nothing. + let auto = if self.has(Flag::NoStatus) { + None + } else if autoop { if access { Some("+ao") } else { Some("+o") } } else if self.has(Flag::Halfop) { Some("+h") diff --git a/modules/chanserv/src/flags.rs b/modules/chanserv/src/flags.rs index 08893de..276a19a 100644 --- a/modules/chanserv/src/flags.rs +++ b/modules/chanserv/src/flags.rs @@ -4,7 +4,7 @@ use echo_api::t; // FLAGS <#channel> [account [+/-flags]]: the granular access model. With no // account, list the access entries and their flags; with an account, show or // change its flags. Letters: f full o auto-op O op h auto-halfop v auto-voice -// t topic i invite a access-list s settings g greet. Viewing needs op access; +// t topic i invite a access-list s settings g greet d deny-status. Viewing needs op access; // changing needs the founder or the \x02a\x02 flag. Every stored level — a tier // preset ("op"/"sop"/…) or a raw flag string — resolves through `Flags`. pub fn handle(me: &str, from: &Sender, chan: &str, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) { diff --git a/modules/chanserv/src/lib.rs b/modules/chanserv/src/lib.rs index b23b3ff..f77410d 100644 --- a/modules/chanserv/src/lib.rs +++ b/modules/chanserv/src/lib.rs @@ -55,7 +55,7 @@ const TOPICS: &[HelpEntry] = &[ HelpEntry { cmd: "LIST", summary: "list registered channels", detail: "Syntax: \x02LIST\x02\nLists registered channels." }, HelpEntry { cmd: "SET", summary: "change founder or settings", detail: "Syntax: \x02SET <#channel> FOUNDER | DESC | URL [address] | EMAIL [address] | SUCCESSOR |OFF | SIGNKICK|PRIVATE|PEACE|SECUREOPS|SECUREVOICES|RESTRICTED|AUTOOP|KEEPTOPIC|TOPICLOCK {ON|OFF}\x02\nTransfers the founder or changes a channel setting." }, HelpEntry { cmd: "ACCESS", summary: "manage the access list", detail: "Syntax: \x02ACCESS <#channel> LIST | ADD | DEL \x02\nManages the channel access list. The target may be a GroupServ \x02!group\x02; each of its members holding the group's \x02c\x02 flag then inherits the access." }, - HelpEntry { cmd: "FLAGS", summary: "granular per-account flags", detail: "Syntax: \x02FLAGS <#channel> [account [+/-flags]]\x02\nViews or changes granular per-account channel flags." }, + HelpEntry { cmd: "FLAGS", summary: "granular per-account flags", detail: "Syntax: \x02FLAGS <#channel> [account [+/-flags]]\x02\nViews or changes granular per-account channel flags. Letters: \x02f\x02 full, \x02o\x02 auto-op, \x02O\x02 op, \x02h\x02 auto-halfop, \x02v\x02 auto-voice, \x02t\x02 topic, \x02i\x02 invite, \x02a\x02 access, \x02s\x02 settings, \x02g\x02 greet, \x02d\x02 deny status (bar the user from any op/voice)." }, HelpEntry { cmd: "LEVELS", summary: "tune which tier holds each capability", detail: "Syntax: \x02LEVELS <#channel> [SET | RESET ]\x02\nGrants a channel capability (\x02OP\x02, \x02TOPIC\x02, \x02INVITE\x02, \x02ACCESS\x02) to an access tier (\x02VOP\x02/\x02HOP\x02/\x02AOP\x02/\x02SOP\x02) and above, e.g. let halfops manage AKICK. Additive — it never removes access. Founder only." }, HelpEntry { cmd: "SOP/AOP/HOP/VOP", summary: "tiered access shortcuts", detail: "Syntax: \x02SOP|AOP|HOP|VOP <#channel> ADD | DEL | LIST\x02\nTiered shortcuts over ACCESS: SOP grants op plus access-list management, AOP grants op, HOP grants halfop, VOP grants voice." }, HelpEntry { cmd: "STATUS", summary: "show a user's access", detail: "Syntax: \x02STATUS <#channel> [nick]\x02\nShows a user's access level on a channel." }, diff --git a/src/engine/db/mod.rs b/src/engine/db/mod.rs index 95d7a57..839e63e 100644 --- a/src/engine/db/mod.rs +++ b/src/engine/db/mod.rs @@ -686,6 +686,15 @@ impl ChannelInfo { .is_some_and(|a| echo_api::level_caps(&a.level).op) } + /// Whether `account` is barred from any channel status by the NoStatus (deny) + /// access flag — services grant them nothing and strip op/voice they're given. + pub fn denied(&self, account: &str) -> bool { + self.access + .iter() + .find(|a| a.account.eq_ignore_ascii_case(account)) + .is_some_and(|a| echo_api::Flags::from_level(&a.level).has(echo_api::Flag::NoStatus)) + } + /// The auto-kick entry matching a live user (plain host mask or extban), if any. pub fn akick_match(&self, target: &echo_api::BanTarget) -> Option<&ChanAkick> { self.akick.iter().find(|k| echo_api::akick_matches(&k.mask, target)) diff --git a/src/engine/mod.rs b/src/engine/mod.rs index 03e960b..f2a4166 100644 --- a/src/engine/mod.rs +++ b/src/engine/mod.rs @@ -1489,9 +1489,11 @@ impl Engine { // A services bot assigned here is opped on join and is never subject // to secureops/restricted — it's staff, not a member. let is_bot = self.bot_uids.values().any(|b| b == &uid); + // A user barred by the deny flag never keeps status (#549). + let denied = account.as_deref().is_some_and(|a| self.db.channel(&channel).is_some_and(|c| c.denied(a))); // SECUREOPS: a user who arrives opped (FJOIN prefix) but lacks op-level // access loses it, unless we're about to grant it to them anyway. - if op && !has_op_access && !is_bot && self.db.channel(&channel).is_some_and(|c| c.settings.secureops) { + if op && !is_bot && (denied || (!has_op_access && self.db.channel(&channel).is_some_and(|c| c.settings.secureops))) { acts.push(NetAction::ChannelMode { from: from.clone(), channel: channel.clone(), modes: format!("-o {uid}") }); } // RESTRICTED: only users with access (or opers) may be in the channel. @@ -1564,8 +1566,13 @@ impl Engine { // to secureops (the Join path exempts it the same way). let is_bot = self.bot_uids.values().any(|b| b == &uid); if op && !is_bot { + let account = self.network.account_of(&uid).map(str::to_string); if let Some(c) = self.db.channel(&channel) { - if c.settings.secureops && !self.network.account_of(&uid).is_some_and(|a| c.is_op(a)) { + // Strip +o for a denied user (always), or under secureops from a + // user without op-level access. + let denied = account.as_deref().is_some_and(|a| c.denied(a)); + let secure = c.settings.secureops && !account.as_deref().is_some_and(|a| c.is_op(a)); + if denied || secure { let from = self.chan_service.clone().unwrap_or_default(); return self.finish(out, vec![NetAction::ChannelMode { from, channel, modes: format!("-o {uid}") }]); } @@ -1579,8 +1586,13 @@ impl Engine { // access loses it. A services bot is staff, never a member. let is_bot = self.bot_uids.values().any(|b| b == &uid); if voice && !is_bot { + let account = self.network.account_of(&uid).map(str::to_string); if let Some(c) = self.db.channel(&channel) { - if c.settings.securevoices && !self.network.account_of(&uid).is_some_and(|a| c.join_mode(a).is_some()) { + // Strip +v for a denied user (always), or under securevoices from + // a user without voice-level (or higher) access. + let denied = account.as_deref().is_some_and(|a| c.denied(a)); + let secure = c.settings.securevoices && !account.as_deref().is_some_and(|a| c.join_mode(a).is_some()); + if denied || secure { let from = self.chan_service.clone().unwrap_or_default(); return self.finish(out, vec![NetAction::ChannelMode { from, channel, modes: format!("-v {uid}") }]); } diff --git a/src/engine/tests.rs b/src/engine/tests.rs index 2185246..f7061af 100644 --- a/src/engine/tests.rs +++ b/src/engine/tests.rs @@ -5245,6 +5245,31 @@ } // Being added to / removed from a channel's access list notifies the affected + // The NoStatus (deny) flag bars a user from any channel status: op/voice they + // are given is stripped straight back, regardless of secureops/securevoices. + #[test] + fn deny_flag_strips_op_and_voice() { + use echo_chanserv::ChanServ; + let path = std::env::temp_dir().join("echo-cs-deny.jsonl"); + let _ = std::fs::remove_file(&path); + let mut db = Db::open(&path, "42S"); + db.scram_iterations = 4096; + db.register("alice", "sesame", None).unwrap(); + db.register("bob", "hunter2", None).unwrap(); + db.register_channel("#c", "alice").unwrap(); + db.access_add("#c", "bob", "d").unwrap(); + let ns = NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }; + let cs = ChanServ { uid: "42SAAAAAB".into() }; + let mut e = Engine::new(vec![Box::new(ns), Box::new(cs)], db); + e.handle(NetEvent::UserConnect { uid: "000AAAAAC".into(), nick: "bob".into(), host: "h".into(), ip: "0.0.0.0".into() }); + e.handle(NetEvent::Privmsg { msgid: None, from: "000AAAAAC".into(), to: "42SAAAAAA".into(), text: "IDENTIFY hunter2".into() }); + e.handle(NetEvent::Join { uid: "000AAAAAC".into(), channel: "#c".into(), op: false }); + let op = e.handle(NetEvent::ChannelOp { channel: "#c".into(), uid: "000AAAAAC".into(), op: true }); + assert!(op.iter().any(|a| matches!(a, NetAction::ChannelMode { channel, modes, .. } if channel == "#c" && modes == "-o 000AAAAAC")), "deny strips op: {op:?}"); + let voice = e.handle(NetEvent::ChannelVoice { channel: "#c".into(), uid: "000AAAAAC".into(), voice: true }); + assert!(voice.iter().any(|a| matches!(a, NetAction::ChannelMode { channel, modes, .. } if channel == "#c" && modes == "-v 000AAAAAC")), "deny strips voice: {voice:?}"); + } + // user: a memo while they're offline, a direct notice while they're online. #[test] fn access_change_notifies_the_affected_user() {