diff --git a/api/src/lib.rs b/api/src/lib.rs index 6251e49..68bf79d 100644 --- a/api/src/lib.rs +++ b/api/src/lib.rs @@ -744,6 +744,8 @@ pub enum ChanSetting { SecureOps, KeepTopic, TopicLock, + // Kick users without channel access when they join. + Restricted, // BotServ: show members' personal greets on join. BotGreet, // BotServ: forbid the founder from (un)assigning a bot (admin override only). @@ -863,6 +865,8 @@ pub trait Store { fn resolve_account(&self, name: &str) -> Option<&str>; /// Registered accounts whose name matches `pattern` (a glob), for oper LIST. fn accounts_matching(&self, pattern: &str) -> Vec; + /// Names of accounts whose email matches `pattern` (a glob), for oper GETEMAIL. + fn accounts_by_email(&self, pattern: &str) -> Vec; // The canonical account name if the password is correct, else None. fn authenticate(&self, name: &str, password: &str) -> Option<&str>; fn grouped_nicks(&self, account: &str) -> Vec; diff --git a/modules/chanserv/src/lib.rs b/modules/chanserv/src/lib.rs index 8fb8a51..e624e4a 100644 --- a/modules/chanserv/src/lib.rs +++ b/modules/chanserv/src/lib.rs @@ -51,7 +51,7 @@ const TOPICS: &[HelpEntry] = &[ HelpEntry { cmd: "REGISTER", summary: "register a channel", detail: "Syntax: \x02REGISTER <#channel>\x02\nRegisters a channel to you. You must currently hold ops in it." }, HelpEntry { cmd: "INFO", summary: "show channel information", detail: "Syntax: \x02INFO <#channel>\x02\nShows a channel's registration and settings." }, HelpEntry { cmd: "LIST", summary: "list registered channels", detail: "Syntax: \x02LIST\x02\nLists registered channels." }, - HelpEntry { cmd: "SET", summary: "change founder or settings", detail: "Syntax: \x02SET <#channel> FOUNDER | DESC | SUCCESSOR |OFF | SIGNKICK|PRIVATE|PEACE|SECUREOPS|KEEPTOPIC|TOPICLOCK {ON|OFF}\x02\nTransfers the founder or changes a channel setting." }, + HelpEntry { cmd: "SET", summary: "change founder or settings", detail: "Syntax: \x02SET <#channel> FOUNDER | DESC | SUCCESSOR |OFF | SIGNKICK|PRIVATE|PEACE|SECUREOPS|RESTRICTED|KEEPTOPIC|TOPICLOCK {ON|OFF}\x02\nTransfers the founder or changes a channel setting." }, HelpEntry { cmd: "ACCESS", summary: "manage the access list", detail: "Syntax: \x02ACCESS <#channel> LIST | ADD | DEL \x02\nManages the channel access list." }, HelpEntry { cmd: "FLAGS", summary: "granular per-account flags", detail: "Syntax: \x02FLAGS <#channel> [account [+/-flags]]\x02\nViews or changes granular per-account channel flags." }, HelpEntry { cmd: "AOP/SOP/VOP", summary: "tiered access shortcuts", detail: "Syntax: \x02AOP|SOP|VOP <#channel> ADD | DEL | LIST\x02\nTiered shortcuts over ACCESS: AOP and SOP grant op, VOP grants voice." }, diff --git a/modules/chanserv/src/set.rs b/modules/chanserv/src/set.rs index 2dadecf..096976c 100644 --- a/modules/chanserv/src/set.rs +++ b/modules/chanserv/src/set.rs @@ -68,9 +68,10 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: Some("PRIVATE") => toggle(me, from, ctx, db, chan, ChanSetting::Private, args.get(3).copied()), Some("PEACE") => toggle(me, from, ctx, db, chan, ChanSetting::Peace, args.get(3).copied()), Some("SECUREOPS") => toggle(me, from, ctx, db, chan, ChanSetting::SecureOps, args.get(3).copied()), + Some("RESTRICTED") => toggle(me, from, ctx, db, chan, ChanSetting::Restricted, args.get(3).copied()), Some("KEEPTOPIC") => toggle(me, from, ctx, db, chan, ChanSetting::KeepTopic, args.get(3).copied()), Some("TOPICLOCK") => toggle(me, from, ctx, db, chan, ChanSetting::TopicLock, args.get(3).copied()), - _ => ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER | SUCCESSOR |OFF | DESC | SIGNKICK {ON|OFF} | PRIVATE {ON|OFF} | PEACE {ON|OFF} | SECUREOPS {ON|OFF} | KEEPTOPIC {ON|OFF} | TOPICLOCK {ON|OFF}"), + _ => ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER | SUCCESSOR |OFF | DESC | SIGNKICK {ON|OFF} | PRIVATE {ON|OFF} | PEACE {ON|OFF} | SECUREOPS {ON|OFF} | RESTRICTED {ON|OFF} | KEEPTOPIC {ON|OFF} | TOPICLOCK {ON|OFF}"), } } @@ -81,6 +82,7 @@ fn label(setting: ChanSetting) -> &'static str { ChanSetting::Private => "PRIVATE", ChanSetting::Peace => "PEACE", ChanSetting::SecureOps => "SECUREOPS", + ChanSetting::Restricted => "RESTRICTED", ChanSetting::KeepTopic => "KEEPTOPIC", ChanSetting::TopicLock => "TOPICLOCK", ChanSetting::BotGreet => "GREET", diff --git a/modules/nickserv/src/getemail.rs b/modules/nickserv/src/getemail.rs new file mode 100644 index 0000000..3922a78 --- /dev/null +++ b/modules/nickserv/src/getemail.rs @@ -0,0 +1,19 @@ +use echo_api::{Priv, Sender, ServiceCtx, Store}; + +// GETEMAIL : list accounts registered with a matching email. Oper-only. +pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &dyn Store) { + if !from.privs.has(Priv::Auspex) { + ctx.notice(me, from.uid, "Access denied — GETEMAIL needs the \x02auspex\x02 privilege."); + return; + } + let Some(&pattern) = args.get(1) else { + ctx.notice(me, from.uid, "Syntax: GETEMAIL "); + return; + }; + let accounts = db.accounts_by_email(pattern); + if accounts.is_empty() { + ctx.notice(me, from.uid, format!("No accounts use an email matching \x02{pattern}\x02.")); + return; + } + ctx.notice(me, from.uid, format!("Accounts with email matching \x02{pattern}\x02: {}", accounts.join(", "))); +} diff --git a/modules/nickserv/src/lib.rs b/modules/nickserv/src/lib.rs index 7659185..a5bea34 100644 --- a/modules/nickserv/src/lib.rs +++ b/modules/nickserv/src/lib.rs @@ -36,6 +36,8 @@ mod ajoin; mod update; #[path = "list.rs"] mod list; +#[path = "getemail.rs"] +mod getemail; #[path = "suspend.rs"] mod suspend; mod noexpire; @@ -62,6 +64,7 @@ const TOPICS: &[HelpEntry] = &[ HelpEntry { cmd: "AJOIN", summary: "auto-join channels on login", detail: "Syntax: \x02AJOIN ADD <#channel>\x02, \x02AJOIN DEL <#channel>\x02, \x02AJOIN LIST\x02\nChannels you are auto-joined to when you identify." }, HelpEntry { cmd: "UPDATE", summary: "refresh your session", detail: "Syntax: \x02UPDATE\x02\nRe-applies your auto-joins and vhost and re-checks for new memos." }, HelpEntry { cmd: "LIST", summary: "list accounts (oper)", detail: "Syntax: \x02LIST \x02\nLists registered accounts matching a glob. Requires the auspex privilege." }, + HelpEntry { cmd: "GETEMAIL", summary: "find accounts by email (oper)", detail: "Syntax: \x02GETEMAIL \x02\nLists accounts registered with a matching email. Requires the auspex privilege." }, HelpEntry { cmd: "SUSPEND", summary: "block an account (operator)", detail: "Syntax: \x02SUSPEND [reason]\x02\nBlocks an account from logging in. Operators only." }, HelpEntry { cmd: "UNSUSPEND", summary: "lift a suspension (operator)", detail: "Syntax: \x02UNSUSPEND \x02\nLifts a suspension. Operators only." }, HelpEntry { cmd: "NOEXPIRE", summary: "pin against expiry (operator)", detail: "Syntax: \x02NOEXPIRE {ON|OFF}\x02\nPins an account so inactivity expiry never drops it. Operators only." }, @@ -123,6 +126,7 @@ impl Service for NickServ { Some("NOEXPIRE") => noexpire::handle(me, from, args, ctx, db), Some("UPDATE") => update::handle(me, from, ctx, db), Some("LIST") => list::handle(me, from, args, ctx, db), + Some("GETEMAIL") => getemail::handle(me, from, args, ctx, db), Some("HELP") => echo_api::help(me, from, ctx, BLURB, TOPICS, args.get(1).copied()), Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")), None => {} diff --git a/src/engine/db/channel.rs b/src/engine/db/channel.rs index b89c14e..fa64180 100644 --- a/src/engine/db/channel.rs +++ b/src/engine/db/channel.rs @@ -197,6 +197,7 @@ impl Db { ChanSetting::Private => settings.private = on, ChanSetting::Peace => settings.peace = on, ChanSetting::SecureOps => settings.secureops = on, + ChanSetting::Restricted => settings.restricted = on, ChanSetting::KeepTopic => settings.keeptopic = on, ChanSetting::TopicLock => settings.topiclock = on, ChanSetting::BotGreet => settings.bot_greet = on, diff --git a/src/engine/db/mod.rs b/src/engine/db/mod.rs index fe7be94..1e01f58 100644 --- a/src/engine/db/mod.rs +++ b/src/engine/db/mod.rs @@ -343,6 +343,9 @@ pub struct ChanSettings { // Strip channel-operator status from anyone without op-level access. #[serde(default)] pub secureops: bool, + // Kick anyone without channel access when they join. + #[serde(default)] + pub restricted: bool, // Remember the topic and restore it when the channel is recreated. #[serde(default)] pub keeptopic: bool, diff --git a/src/engine/db/store.rs b/src/engine/db/store.rs index d793805..d98a39f 100644 --- a/src/engine/db/store.rs +++ b/src/engine/db/store.rs @@ -22,6 +22,12 @@ impl Store for Db { .map(|a| AccountView { name: a.name.clone(), email: a.email.clone(), ts: a.ts, verified: a.verified, greet: a.greet.clone() }) .collect() } + fn accounts_by_email(&self, pattern: &str) -> Vec { + self.accounts() + .filter(|a| a.email.as_deref().is_some_and(|e| super::glob_match(pattern, e))) + .map(|a| a.name.clone()) + .collect() + } fn authenticate(&self, name: &str, password: &str) -> Option<&str> { Db::authenticate(self, name, password) } diff --git a/src/engine/mod.rs b/src/engine/mod.rs index 89ac0eb..3784d8a 100644 --- a/src/engine/mod.rs +++ b/src/engine/mod.rs @@ -818,6 +818,14 @@ impl Engine { if op && mode != Some("+o") && self.db.channel(&channel).is_some_and(|c| c.settings.secureops) { out.push(NetAction::ChannelMode { from: from.clone(), channel: channel.clone(), modes: format!("-o {uid}") }); } + // RESTRICTED: only users with access (or opers) may be in the channel. + if mode.is_none() && self.db.channel(&channel).is_some_and(|c| c.settings.restricted) { + let is_oper = account.as_deref().is_some_and(|a| self.oper_privs(a).any()); + if !is_oper { + out.push(NetAction::Kick { from, channel, uid, reason: "This channel is restricted to users with access.".to_string() }); + return out; + } + } match mode { // A user with access gets their status mode, plus the entry message. Some(m) => { diff --git a/src/engine/tests.rs b/src/engine/tests.rs index 7c111d6..89f2af1 100644 --- a/src/engine/tests.rs +++ b/src/engine/tests.rs @@ -976,6 +976,64 @@ assert!(notice(&e.handle(NetEvent::Privmsg { from: "000AAAAAD".into(), to: "42SAAAAAH".into(), text: "FORBID ADD NICK x y".into() }), "Access denied"), "non-oper refused"); } + // NickServ GETEMAIL (oper) finds accounts by their email glob. + #[test] + fn nickserv_getemail() { + use echo_nickserv::NickServ; + let path = std::env::temp_dir().join("echo-getemail.jsonl"); + let _ = std::fs::remove_file(&path); + let mut db = Db::open(&path, "42S"); + db.scram_iterations = 4096; + db.register("staff", "pw", None).unwrap(); + db.register("alice", "pw", Some("alice@x.com".into())).unwrap(); + db.register("bob", "pw", Some("bob@x.com".into())).unwrap(); + let mut e = Engine::new(vec![Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 })], db); + let mut opers = std::collections::HashMap::new(); + opers.insert("staff".to_string(), Privs::default().with(echo_api::Priv::Auspex)); + e.set_opers(opers); + let ns = |e: &mut Engine, uid: &str, t: &str| e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAA".into(), text: t.into() }); + let notice = |out: &[NetAction], n: &str| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains(n))); + e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "staff".into(), host: "h".into(), ip: "0.0.0.0".into() }); + e.handle(NetEvent::UserConnect { uid: "000AAAAAC".into(), nick: "rando".into(), host: "h".into(), ip: "0.0.0.0".into() }); + + assert!(notice(&ns(&mut e, "000AAAAAC", "GETEMAIL *@x.com"), "Access denied"), "non-oper refused"); + ns(&mut e, "000AAAAAB", "IDENTIFY pw"); + let out = ns(&mut e, "000AAAAAB", "GETEMAIL *@x.com"); + assert!(notice(&out, "alice") && notice(&out, "bob"), "finds both: {out:?}"); + assert!(notice(&ns(&mut e, "000AAAAAB", "GETEMAIL nobody@z.com"), "No accounts"), "no match reported"); + } + + // ChanServ SET RESTRICTED kicks joining users who have no channel access. + #[test] + fn chanserv_restricted_kicks_users_without_access() { + use echo_chanserv::ChanServ; + use echo_nickserv::NickServ; + let path = std::env::temp_dir().join("echo-restricted.jsonl"); + let _ = std::fs::remove_file(&path); + let mut db = Db::open(&path, "42S"); + db.scram_iterations = 4096; + db.register("alice", "sesame", None).unwrap(); + db.register_channel("#c", "alice").unwrap(); + let mut e = Engine::new( + vec![ + Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }), + Box::new(ChanServ { uid: "42SAAAAAB".into() }), + ], + db, + ); + e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "h".into(), ip: "0.0.0.0".into() }); + e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() }); + e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAB".into(), text: "SET #c RESTRICTED ON".into() }); + + // The founder has access and is not kicked. + let out = e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: false }); + assert!(!out.iter().any(|a| matches!(a, NetAction::Kick { uid, .. } if uid == "000AAAAAB")), "founder not kicked: {out:?}"); + // A user with no access is kicked. + e.handle(NetEvent::UserConnect { uid: "000AAAAAC".into(), nick: "rando".into(), host: "h".into(), ip: "0.0.0.0".into() }); + let out = e.handle(NetEvent::Join { uid: "000AAAAAC".into(), channel: "#c".into(), op: false }); + assert!(out.iter().any(|a| matches!(a, NetAction::Kick { uid, channel, .. } if uid == "000AAAAAC" && channel == "#c")), "no-access user kicked: {out:?}"); + } + // BotServ BOT ADD/LIST is oper-gated (Priv::Admin) and the bot is remembered. #[test] fn botserv_bot_add_list_is_oper_gated() {