Enforce the channel akick list when a user changes nick

src/engine/mod.rs

@@ -1381,6 +1381,7 @@ impl Engine {
                 self.network.user_nick_change(&uid, nick);
                 self.pending_enforce.retain(|p| p.uid != uid); // they left the old nick
                 let mut out = self.enforce_registered_nick(&uid, &new_nick);
+                out.extend(self.enforce_akick_on_nick(&uid));
                 if let Some(line) = self.notify_line('n', &uid, None, &format!("changed nick (was {old_nick})")) {
                     out.push(line);
                 }
@@ -1477,31 +1478,14 @@ impl Engine {
                     }
                     // No access: an auto-kick match is banned and kicked, else greeted.
                     None => {
-                        // Match the akick list against the user's full identity —
+                        let hit = self.akick_hit(&uid, &channel);
-                        // host and the extbans (account/realname/…) the ircd gave us.
+                        if !hit.is_empty() {
-                        let akick = {
+                            acts.extend(hit);
-                            let target = self.network.ban_target(&uid);
+                        } else if let Some(msg) = entrymsg {
-                            target.as_ref().and_then(|t| {
-                                self.db.channel(&channel).and_then(|c| c.akick_match(t)).map(|k| {
-                                    let reason = if k.reason.is_empty() { "You are banned from this channel.".to_string() } else { k.reason.clone() };
-                                    (k.mask.clone(), reason)
-                                })
-                            })
-                        };
-                        match akick {
-                            Some((mask, reason)) => {
-                                self.network.channel_part(&channel, &uid);
-                                acts.push(NetAction::ChannelMode { from: from.clone(), channel: channel.clone(), modes: format!("+b {mask}") });
-                                acts.push(NetAction::Kick { from, channel, uid, reason });
-                            }
-                            None => {
-                                if let Some(msg) = entrymsg {
                             acts.push(NetAction::Notice { from, to: uid, text: msg });
                         }
                     }
                 }
-                    }
-                }
                 // GREET: if the channel shows greets and this member has channel
                 // access + a personal greet, the assigned bot displays it.
                 if let Some(g) = greet {
@@ -1825,6 +1809,49 @@ impl Engine {
         Some(NetAction::Privmsg { from: botuid, to: channel.to_string(), text: format!("[{acc}] {greet}") })
     }
 
+    // Ban+kick `uid` from `channel` if their current identity matches its akick
+    // list. Parts them locally and returns the +b/KICK; empty when no match.
+    fn akick_hit(&mut self, uid: &str, channel: &str) -> Vec<NetAction> {
+        let matched = {
+            let target = self.network.ban_target(uid);
+            target.as_ref().and_then(|t| {
+                self.db.channel(channel).and_then(|c| c.akick_match(t)).map(|k| {
+                    let reason = if k.reason.is_empty() { "You are banned from this channel.".to_string() } else { k.reason.clone() };
+                    (k.mask.clone(), reason)
+                })
+            })
+        };
+        match matched {
+            Some((mask, reason)) => {
+                let from = self.channel_mode_source(channel);
+                self.network.channel_part(channel, uid);
+                vec![
+                    NetAction::ChannelMode { from: from.clone(), channel: channel.to_string(), modes: format!("+b {mask}") },
+                    NetAction::Kick { from, channel: channel.to_string(), uid: uid.to_string(), reason },
+                ]
+            }
+            None => Vec::new(),
+        }
+    }
+
+    // A nick change rewrites the user's n!u@h, so re-run the akick check the join
+    // path does — otherwise a user joins clean, switches to a banned nick, and stays.
+    // Access holders are exempt, as on join.
+    fn enforce_akick_on_nick(&mut self, uid: &str) -> Vec<NetAction> {
+        let mut acts = Vec::new();
+        let account = self.network.account_of(uid).map(str::to_string);
+        for channel in self.network.channels_of(uid) {
+            if self.db.is_channel_suspended(&channel) {
+                continue;
+            }
+            if account.as_deref().and_then(|a| self.db.channel_join_mode(&channel, a)).is_some() {
+                continue;
+            }
+            acts.extend(self.akick_hit(uid, &channel));
+        }
+        acts
+    }
+
     // Fantasy commands: `!op nick`, `!kick nick`, `!topic …` spoken in a channel
     // that has a bot assigned. We reuse ChanServ's real command handlers — the
 }

src/engine/tests.rs

@@ -5179,6 +5179,36 @@
         assert!(out.iter().any(|a| matches!(a, NetAction::ChannelMode { modes, .. } if modes.contains('o'))), "{out:?}");
     }
 
+    // A user who joins clean then switches to a nick matching the akick list is
+    // banned and kicked, just as if they'd joined under that nick.
+    #[test]
+    fn akick_enforced_on_nick_change() {
+        use echo_chanserv::ChanServ;
+        let path = std::env::temp_dir().join("echo-cs-akick-nick.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("alice", "sesame", None).unwrap();
+        db.register_channel("#c", "alice").unwrap();
+        let ns = NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 };
+        let cs = ChanServ { uid: "42SAAAAAB".into() };
+        let mut e = Engine::new(vec![Box::new(ns), Box::new(cs)], db);
+        let to_cs = |e: &mut Engine, from: &str, text: &str| {
+            e.handle(NetEvent::Privmsg { from: from.into(), to: "42SAAAAAB".into(), text: text.into() })
+        };
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "h1".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        to_cs(&mut e, "000AAAAAB", "AKICK #c ADD evil!*@* begone");
+
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAC".into(), nick: "bob".into(), host: "clean.host".into(), ip: "0.0.0.0".into() });
+        let out = e.handle(NetEvent::Join { uid: "000AAAAAC".into(), channel: "#c".into(), op: false });
+        assert!(!out.iter().any(|a| matches!(a, NetAction::Kick { .. })), "clean nick not kicked: {out:?}");
+
+        let out = e.handle(NetEvent::NickChange { uid: "000AAAAAC".into(), nick: "evil".into() });
+        assert!(out.iter().any(|a| matches!(a, NetAction::ChannelMode { channel, modes, .. } if channel == "#c" && modes == "+b evil!*@*")), "{out:?}");
+        assert!(out.iter().any(|a| matches!(a, NetAction::Kick { channel, uid, reason, .. } if channel == "#c" && uid == "000AAAAAC" && reason.starts_with("begone"))), "{out:?}");
+    }
+
     // ChanServ SET: description and founder transfer, founder-gated.
     #[test]
     fn chanserv_set() {