api: ordered Rank enum (founder>admin>op>halfop>voice) replaces the coarse u8 access rank, so PEACE distinguishes every tier

api/src/lib.rs

@@ -631,6 +631,22 @@ pub struct ChanAccessView {
 //   s channel settings  g greet shown
 pub const ACCESS_FLAGS: &str = "foOhvtiasg";
 
+/// A channel access rank, ordered lowest to highest. The derived `Ord` mirrors
+/// the ircd's prefix ranks (voice < halfop < op < admin < founder), so services
+/// decisions — PEACE, and merging a direct access entry with a group's — order
+/// the tiers the same way the channel itself does. `Admin` is the SOP tier
+/// (a protected op), distinct from a plain `Op` (AOP).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Default)]
+pub enum Rank {
+    #[default]
+    None,
+    Voice,
+    Halfop,
+    Op,
+    Admin,
+    Founder,
+}
+
 // The capabilities an access `level` confers (founder is layered on by callers).
 #[derive(Debug, Clone, Copy, Default)]
 pub struct Caps {
@@ -641,7 +657,7 @@ pub struct Caps {
     pub access: bool, // may modify the access / flags / akick lists
     pub set: bool,    // may change channel settings
     pub greet: bool,
-    pub rank: u8, // 3 co-founder, 2 op, 1 voice/halfop — for PEACE comparisons
+    pub rank: Rank, // ordered tier for PEACE comparisons (see `Rank`)
 }
 
 // Resolve an access `level` string to its capabilities. Recognises the legacy
@@ -649,15 +665,15 @@ pub struct Caps {
 // entries and new flag entries coexist.
 pub fn level_caps(level: &str) -> Caps {
     match level {
-        "founder" => Caps { auto: Some("+qo"), op: true, topic: true, invite: true, access: true, set: true, greet: true, rank: 3 },
+        "founder" => Caps { auto: Some("+qo"), op: true, topic: true, invite: true, access: true, set: true, greet: true, rank: Rank::Founder },
         // The XOP tiers, ordered high to low. Each op-and-above tier carries op
         // (+o, the @ prefix) plus its rank marker: founder owner (+q, ~), sop
         // protect (+a, &). So AOP and above all show @, while sop outranks aop and
         // founder outranks sop. SOP additionally holds access-list management.
-        "sop" => Caps { auto: Some("+ao"), op: true, topic: true, invite: true, access: true, rank: 2, ..Caps::default() },
+        "sop" => Caps { auto: Some("+ao"), op: true, topic: true, invite: true, access: true, rank: Rank::Admin, ..Caps::default() },
-        "op" => Caps { auto: Some("+o"), op: true, topic: true, invite: true, rank: 2, ..Caps::default() },
+        "op" => Caps { auto: Some("+o"), op: true, topic: true, invite: true, rank: Rank::Op, ..Caps::default() },
-        "halfop" => Caps { auto: Some("+h"), rank: 1, ..Caps::default() },
+        "halfop" => Caps { auto: Some("+h"), rank: Rank::Halfop, ..Caps::default() },
-        "voice" => Caps { auto: Some("+v"), rank: 1, ..Caps::default() },
+        "voice" => Caps { auto: Some("+v"), rank: Rank::Voice, ..Caps::default() },
         flags => {
             let has = |c: char| flags.contains(c);
             let auto = if has('o') {
@@ -670,18 +686,23 @@ pub fn level_caps(level: &str) -> Caps {
                 None
             };
             let founderish = has('f');
+            let op = has('o') || has('O');
             let rank = if founderish {
-                3
+                Rank::Founder
-            } else if has('o') || has('O') {
+            } else if op && has('a') {
-                2
+                Rank::Admin // op plus access-list management = the SOP tier
+            } else if op {
+                Rank::Op
+            } else if has('h') {
+                Rank::Halfop
             } else if !flags.is_empty() {
-                1
+                Rank::Voice // voice, or any other privilege without a higher status mode
             } else {
-                0
+                Rank::None
             };
             Caps {
                 auto,
-                op: founderish || has('o') || has('O'),
+                op: founderish || op,
                 topic: founderish || has('t'),
                 invite: founderish || has('i'),
                 access: founderish || has('a'),
@@ -1162,8 +1183,8 @@ impl ChannelView {
         self.caps_of(Some(account)).auto
     }
 
-    // A comparable access rank for PEACE: founder 3, op 2, voice/halfop 1, none 0.
+    // The ordered access rank used for PEACE comparisons (see `Rank`).
-    pub fn access_rank(&self, account: Option<&str>) -> u8 {
+    pub fn access_rank(&self, account: Option<&str>) -> Rank {
         self.caps_of(account).rank
     }
 

src/engine/db/tests.rs

@@ -129,19 +129,31 @@
         assert!(s.signkick && !s.private, "settings replay from the log");
     }
 
-    // Access ranks order founder > op > voice > none for PEACE comparisons.
+    // Access ranks order founder > sop > op > halfop > voice > none, matching the
+    // ircd prefix ranks so PEACE tells every tier apart (the old u8 collapsed
+    // SOP≡AOP and halfop≡voice).
     #[test]
-    fn access_rank_orders_founder_op_voice() {
+    fn access_rank_orders_all_tiers() {
+        use echo_api::Rank;
         let mut db = Db::open(&tmp("rank"), "N1");
         db.register_channel("#c", "boss").unwrap();
+        db.access_add("#c", "sop1", "sop").unwrap();
         db.access_add("#c", "op1", "op").unwrap();
+        db.access_add("#c", "hop1", "halfop").unwrap();
         db.access_add("#c", "v1", "voice").unwrap();
         let cv = Store::channel(&db, "#c").unwrap();
-        assert_eq!(cv.access_rank(Some("boss")), 3);
+        assert_eq!(cv.access_rank(Some("boss")), Rank::Founder);
-        assert_eq!(cv.access_rank(Some("OP1")), 2, "case-insensitive");
+        assert_eq!(cv.access_rank(Some("SOP1")), Rank::Admin, "case-insensitive");
-        assert_eq!(cv.access_rank(Some("v1")), 1);
+        assert_eq!(cv.access_rank(Some("op1")), Rank::Op);
-        assert_eq!(cv.access_rank(Some("nobody")), 0);
+        assert_eq!(cv.access_rank(Some("hop1")), Rank::Halfop);
-        assert_eq!(cv.access_rank(None), 0);
+        assert_eq!(cv.access_rank(Some("v1")), Rank::Voice);
+        assert_eq!(cv.access_rank(Some("nobody")), Rank::None);
+        assert_eq!(cv.access_rank(None), Rank::None);
+        // The whole point: each tier strictly outranks the next one down.
+        assert!(cv.access_rank(Some("boss")) > cv.access_rank(Some("sop1")));
+        assert!(cv.access_rank(Some("sop1")) > cv.access_rank(Some("op1")), "SOP outranks AOP");
+        assert!(cv.access_rank(Some("op1")) > cv.access_rank(Some("hop1")));
+        assert!(cv.access_rank(Some("hop1")) > cv.access_rank(Some("v1")), "halfop outranks voice");
     }
 
     // Suspension sets/lifts, expires lazily, and replays from the log.

src/engine/tests.rs

@@ -1414,6 +1414,51 @@
         assert!(!out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("PEACE"))), "self-deop must not be PEACE-blocked: {out:?}");
     }
 
+    // The ordered rank in action: with PEACE on, an AOP can't kick a SOP, but a
+    // SOP (higher tier) can kick an AOP. The old collapsed u8 rank made SOP and
+    // AOP equal, so neither could act on the other.
+    #[test]
+    fn peace_lets_sop_act_on_aop_not_the_reverse() {
+        use echo_chanserv::ChanServ;
+        use echo_nickserv::NickServ;
+        let path = std::env::temp_dir().join("echo-peacetiers.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        for a in ["alice", "bob", "carol"] {
+            db.register(a, "sesame", None).unwrap();
+        }
+        db.register_channel("#c", "alice").unwrap();
+        db.access_add("#c", "bob", "sop").unwrap();
+        db.access_add("#c", "carol", "op").unwrap();
+        let mut e = Engine::new(
+            vec![
+                Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
+                Box::new(ChanServ { uid: "42SAAAAAB".into() }),
+            ],
+            db,
+        );
+        for (uid, nick) in [("000AAAAAA", "alice"), ("000AAAAAB", "bob"), ("000AAAAAC", "carol")] {
+            e.handle(NetEvent::UserConnect { uid: uid.into(), nick: nick.into(), host: "h".into(), ip: "0.0.0.0".into() });
+            e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+            e.handle(NetEvent::Join { uid: uid.into(), channel: "#c".into(), op: true });
+        }
+        e.handle(NetEvent::Privmsg { from: "000AAAAAA".into(), to: "42SAAAAAB".into(), text: "SET #c PEACE ON".into() });
+
+        let kick = |e: &mut Engine, from: &str, target: &str| {
+            e.handle(NetEvent::Privmsg { from: from.into(), to: "42SAAAAAB".into(), text: format!("KICK #c {target}") })
+        };
+        let blocked = |out: &[NetAction]| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("PEACE")));
+        let kicked = |out: &[NetAction]| out.iter().any(|a| matches!(a, NetAction::Kick { .. }));
+
+        // AOP carol tries to kick SOP bob -> PEACE blocks it.
+        let out = kick(&mut e, "000AAAAAC", "bob");
+        assert!(blocked(&out) && !kicked(&out), "AOP can't kick a SOP under PEACE: {out:?}");
+        // SOP bob kicks AOP carol -> allowed (SOP outranks AOP).
+        let out = kick(&mut e, "000AAAAAB", "carol");
+        assert!(kicked(&out) && !blocked(&out), "SOP can kick an AOP: {out:?}");
+    }
+
     // NickServ LIST is auspex-gated and glob-matches; UPDATE refreshes a session.
     #[test]
     fn nickserv_list_and_update() {