HostServ: forbidden-vhost patterns + auto-vhost template

FORBID <regex> / FORBIDLIST / FORBIDDEL let operators block impersonating
user requests (e.g. (?i)(admin|staff)); REQUEST refuses a matching host.
Matching reuses the linear-time RegexSet, so untrusted patterns are safe.

TEMPLATE <$account...> sets a network auto-vhost pattern; DEFAULT gives a
user $account.users.example with their sanitised account name. HostServ's
node config (offers/forbidden/template) is consolidated into one HostConfig
threaded through the log replay.

hostserv/src/default.rs

@@ -0,0 +1,32 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// DEFAULT: give yourself the auto-vhost from the network template, with your
+// account name substituted for $account.
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to identify to NickServ first.");
+        return;
+    };
+    let Some(template) = db.vhost_template() else {
+        ctx.notice(me, from.uid, "This network has no auto-vhost template.");
+        return;
+    };
+    // Sanitise the account into a host-safe label (lowercase, alphanumerics only).
+    let label: String = account.to_ascii_lowercase().chars().filter(|c| c.is_ascii_alphanumeric()).collect();
+    if label.is_empty() {
+        ctx.notice(me, from.uid, "Your account name has no usable characters for a vhost.");
+        return;
+    }
+    let host = template.replace("$account", &label);
+    if !super::valid_vhost(&host) || db.vhost_is_forbidden(&host) {
+        ctx.notice(me, from.uid, "Sorry, a vhost couldn't be generated for your account.");
+        return;
+    }
+    match db.set_vhost(account, &host, "template") {
+        Ok(()) => {
+            ctx.apply_vhost(from.uid, &host);
+            ctx.notice(me, from.uid, format!("You now have the vhost \x02{host}\x02."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

hostserv/src/forbid.rs

@@ -0,0 +1,51 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// FORBID <pattern>: block user-requested vhosts matching this regex (operators),
+// e.g. (?i)(oper|admin|staff|services) to stop impersonation.
+pub fn add(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    if args.len() < 2 {
+        ctx.notice(me, from.uid, "Syntax: FORBID <regex>");
+        return;
+    }
+    let pattern = args[1..].join(" ");
+    match db.vhost_forbid_add(&pattern) {
+        Ok(true) => ctx.notice(me, from.uid, format!("Forbidden vhost pattern added: {pattern}")),
+        Ok(false) => ctx.notice(me, from.uid, "That pattern is already forbidden."),
+        Err(_) => ctx.notice(me, from.uid, format!("\x02{pattern}\x02 isn't a valid regular expression.")),
+    }
+}
+
+// FORBIDLIST: the forbidden-pattern list (operators).
+pub fn list(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let forbidden = db.vhost_forbidden();
+    if forbidden.is_empty() {
+        ctx.notice(me, from.uid, "No vhost patterns are forbidden.");
+        return;
+    }
+    ctx.notice(me, from.uid, format!("Forbidden vhost patterns ({}):", forbidden.len()));
+    for (i, p) in forbidden.iter().enumerate() {
+        ctx.notice(me, from.uid, format!("  {}. {p}", i + 1));
+    }
+}
+
+// FORBIDDEL <number>: remove a forbidden pattern (operators).
+pub fn del(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !super::require_oper(me, from, ctx) {
+        return;
+    }
+    let Some(n) = args.get(1).and_then(|s| s.parse::<usize>().ok()) else {
+        ctx.notice(me, from.uid, "Syntax: FORBIDDEL <number> (see FORBIDLIST)");
+        return;
+    };
+    match db.vhost_forbid_del(n) {
+        Ok(Some(pattern)) => ctx.notice(me, from.uid, format!("Removed forbidden pattern: {pattern}")),
+        Ok(None) => ctx.notice(me, from.uid, format!("There's no forbidden pattern #\x02{n}\x02.")),
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}

hostserv/src/lib.rs

@@ -25,6 +25,12 @@ mod approve;
 mod offer;
 #[path = "take.rs"]
 mod take;
+#[path = "forbid.rs"]
+mod forbid;
+#[path = "template.rs"]
+mod template;
+#[path = "default.rs"]
+mod default;
 
 pub struct HostServ {
     pub uid: String,
@@ -60,6 +66,11 @@ impl Service for HostServ {
             Some("OFFERLIST") => offer::list(me, from, ctx, db),
             Some("OFFERDEL") => offer::del(me, from, args, ctx, db),
             Some("TAKE") => take::handle(me, from, args, ctx, db),
+            Some("FORBID") => forbid::add(me, from, args, ctx, db),
+            Some("FORBIDLIST") => forbid::list(me, from, ctx, db),
+            Some("FORBIDDEL") => forbid::del(me, from, args, ctx, db),
+            Some("TEMPLATE") => template::handle(me, from, args, ctx, db),
+            Some("DEFAULT") => default::handle(me, from, ctx, db),
             Some("HELP") | None => ctx.notice(me, from.uid, "HostServ gives you a vhost: \x02ON\x02 activates your assigned vhost, \x02OFF\x02 restores your normal host, \x02REQUEST\x02 <host> asks for one, \x02OFFERLIST\x02 + \x02TAKE\x02 <n> pick from the menu. Operators use \x02SET\x02/\x02DEL\x02 <account>, \x02LIST\x02, \x02WAITING\x02 + \x02ACTIVATE\x02/\x02REJECT\x02, and \x02OFFER\x02/\x02OFFERDEL\x02 for the menu."),
             Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")),
         }

hostserv/src/request.rs

@@ -14,6 +14,10 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
         ctx.notice(me, from.uid, format!("\x02{host}\x02 isn't a valid host (letters, digits, hyphens and dots)."));
         return;
     }
+    if db.vhost_is_forbidden(host) {
+        ctx.notice(me, from.uid, format!("\x02{host}\x02 isn't allowed here. Please choose another."));
+        return;
+    }
     match db.request_vhost(account, host) {
         Ok(()) => ctx.notice(me, from.uid, format!("Requested vhost \x02{host}\x02 — an operator will review it.")),
         Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),

hostserv/src/template.rs

@@ -0,0 +1,32 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// TEMPLATE [<pattern>]: show the auto-vhost template, or (operators) set it.
+// Use $account for the requester's sanitised account name, e.g.
+// $account.users.example. Give no argument to show it, OFF to clear it.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    match args.get(1) {
+        None => match db.vhost_template() {
+            Some(t) => ctx.notice(me, from.uid, format!("Auto-vhost template: \x02{t}\x02. Users apply it with \x02DEFAULT\x02.")),
+            None => ctx.notice(me, from.uid, "No auto-vhost template is set."),
+        },
+        Some(&arg) => {
+            if !super::require_oper(me, from, ctx) {
+                return;
+            }
+            if arg.eq_ignore_ascii_case("OFF") {
+                let _ = db.set_vhost_template(None);
+                ctx.notice(me, from.uid, "Auto-vhost template cleared.");
+                return;
+            }
+            let template = args[1..].join(" ");
+            if !template.contains("$account") || !super::valid_vhost(&template.replace("$account", "x")) {
+                ctx.notice(me, from.uid, "The template must contain \x02$account\x02 and form a valid host, e.g. \x02$account.users.example\x02.");
+                return;
+            }
+            match db.set_vhost_template(Some(template.clone())) {
+                Ok(()) => ctx.notice(me, from.uid, format!("Auto-vhost template set to \x02{template}\x02.")),
+                Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+            }
+        }
+    }
+}