fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

OperServ: temporary OPER grants that auto-expire

Browse source 
OPER ADD <account> <priv[,priv]> [+duration] now takes an optional window,
after which the grant lazily stops conferring privileges — no timer, the
oper_privs merge just hides an expired grant (evaluated on the engine's
clock so it's testable). Permanent grants are unchanged; LIST flags the
temporary ones and hides expired entries. Runtime opers now carry an
OperGrant{privs, expires} instead of a bare priv list.
This commit is contained in:
Jean Chevronnet 2026-07-14 02:29:03 +00:00
parent 90824513a7
commit 85d01b3ebf
No known key found for this signature in database
4 changed files with 113 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

69
src/engine/db.rs
View file

@ -189,7 +189,12 @@ pub enum Event {
NewsAdded { id: u64, kind: String, text: String, setter: String, ts: u64 },
NewsDeleted { id: u64 },
// Runtime operator grants (OperServ OPER).
OperGranted { account: String, privs: Vec<String> },
OperGranted {
account: String,
privs: Vec<String>,
#[serde(default)]
expires: Option<u64>,
},
OperRevoked { account: String },
// Session-limit exceptions (OperServ SESSION).
SessionExceptionAdded { mask: String, limit: u32, reason: String },
@ -378,9 +383,9 @@ pub struct NetData {
pub akills: Vec<Akill>,
pub news: Vec<News>,
pub news_seq: u64,
// Runtime services operators (OperServ OPER), casefolded account -> privilege
// names. Merged with the declarative [[oper]] config at the engine.
pub opers: HashMap<String, Vec<String>>,
// Runtime services operators (OperServ OPER), casefolded account -> grant.
// Merged with the declarative [[oper]] config at the engine.
pub opers: HashMap<String, OperGrant>,
// Session-limit exceptions (OperServ SESSION): per-IP-mask allowances.
pub sess_exceptions: Vec<SessionException>,
}
@ -394,6 +399,14 @@ pub struct SessionException {
pub reason: String,
}
// A runtime operator grant: the privilege names and an optional absolute-unix
// expiry (None = permanent), evaluated lazily like suspensions/vhosts.
#[derive(Debug, Clone)]
pub struct OperGrant {
pub privs: Vec<String>,
pub expires: Option<u64>,
}
// A memo left for an account (MemoServ).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Memo {
@ -1129,8 +1142,8 @@ impl Db {
for n in &self.net.news {
snapshot.push(Event::NewsAdded { id: n.id, kind: n.kind.clone(), text: n.text.clone(), setter: n.setter.clone(), ts: n.ts });
}
for (account, privs) in &self.net.opers {
snapshot.push(Event::OperGranted { account: account.clone(), privs: privs.clone() });
for (account, grant) in &self.net.opers {
snapshot.push(Event::OperGranted { account: account.clone(), privs: grant.privs.clone(), expires: grant.expires });
}
for e in &self.net.sess_exceptions {
snapshot.push(Event::SessionExceptionAdded { mask: e.mask.clone(), limit: e.limit, reason: e.reason.clone() });
@ -1968,10 +1981,11 @@ impl Db {
.max_by_key(|&l| if l == 0 { u32::MAX } else { l })
}
/// Grant runtime operator privileges to an account (replaces any existing).
pub fn oper_grant(&mut self, account: &str, privs: Vec<String>) {
let _ = self.log.append(Event::OperGranted { account: account.to_string(), privs: privs.clone() });
self.net.opers.insert(key(account), privs);
/// Grant runtime operator privileges to an account (replaces any existing),
/// optionally expiring at an absolute unix time.
pub fn oper_grant(&mut self, account: &str, privs: Vec<String>, expires: Option<u64>) {
let _ = self.log.append(Event::OperGranted { account: account.to_string(), privs: privs.clone(), expires });
self.net.opers.insert(key(account), OperGrant { privs, expires });
}
/// Revoke a runtime operator grant. Returns whether one existed.
@ -1984,15 +1998,26 @@ impl Db {
true
}
/// The runtime operator grants, as (account, privilege-names).
pub fn opers_list(&self) -> Vec<(String, Vec<String>)> {
self.net.opers.iter().map(|(a, p)| (a.clone(), p.clone())).collect()
/// The live runtime operator grants, as (account, privilege-names, expiry);
/// expired ones are hidden.
pub fn opers_list(&self) -> Vec<(String, Vec<String>, Option<u64>)> {
let now = now();
self.net
.opers
.iter()
.filter(|(_, g)| g.expires.is_none_or(|e| e > now))
.map(|(a, g)| (a.clone(), g.privs.clone(), g.expires))
.collect()
}
/// The runtime privileges granted to an account, if any (config opers are
/// merged in separately by the engine).
pub fn oper_privs_of(&self, account: &str) -> Option<Privs> {
self.net.opers.get(&key(account)).map(|names| Privs::from_names(names))
/// The runtime privileges granted to an account as of `now`, if the grant is
/// present and unexpired (config opers are merged in separately by the engine).
pub fn oper_privs_of(&self, account: &str, now: u64) -> Option<Privs> {
self.net
.opers
.get(&key(account))
.filter(|g| g.expires.is_none_or(|e| e > now))
.map(|g| Privs::from_names(&g.privs))
}
/// Add a news item of `kind` ("logon"/"oper"). Returns its stable id.
@ -3027,8 +3052,8 @@ fn apply(accounts: &mut HashMap<String, Account>, channels: &mut HashMap<String,
Event::NewsDeleted { id } => {
net.news.retain(|n| n.id != id);
}
Event::OperGranted { account, privs } => {
net.opers.insert(key(&account), privs);
Event::OperGranted { account, privs, expires } => {
net.opers.insert(key(&account), OperGrant { privs, expires });
}
Event::OperRevoked { account } => {
net.opers.remove(&key(&account));
@ -3320,13 +3345,13 @@ impl Store for Db {
fn news(&self, kind: &str) -> Vec<NewsView> {
Db::news(self, kind)
}
fn oper_grant(&mut self, account: &str, privs: Vec<String>) {
Db::oper_grant(self, account, privs)
fn oper_grant(&mut self, account: &str, privs: Vec<String>, expires: Option<u64>) {
Db::oper_grant(self, account, privs, expires)
}
fn oper_revoke(&mut self, account: &str) -> bool {
Db::oper_revoke(self, account)
}
fn opers_list(&self) -> Vec<(String, Vec<String>)> {
fn opers_list(&self) -> Vec<(String, Vec<String>, Option<u64>)> {
Db::opers_list(self)
}
fn session_except_add(&mut self, mask: &str, limit: u32, reason: &str) {

43
src/engine/mod.rs
View file

@ -255,7 +255,7 @@ impl Engine {
// make an account an operator.
fn oper_privs(&self, account: &str) -> Privs {
let config = self.opers.get(&account.to_ascii_lowercase()).copied().unwrap_or_default();
match self.db.oper_privs_of(account) {
match self.db.oper_privs_of(account, self.now_secs()) {
Some(runtime) => config.union(runtime),
None => config,
}
@ -1671,7 +1671,7 @@ fn audit_summary(event: &db::Event) -> Option<String> {
},
NewsAdded { kind, .. } => format!("added a \x02{kind}\x02 news item"),
NewsDeleted { .. } => "removed a news item".to_string(),
OperGranted { account, privs } => format!("granted \x02{account}\x02 operator ({})", privs.join(", ")),
OperGranted { account, privs, .. } => format!("granted \x02{account}\x02 operator ({})", privs.join(", ")),
OperRevoked { account } => format!("revoked \x02{account}\x02's operator access"),
SessionExceptionAdded { mask, limit, .. } => format!("set a session exception \x02{mask}\x02 (limit {limit})"),
SessionExceptionRemoved { mask } => format!("removed the session exception \x02{mask}\x02"),
@ -4393,6 +4393,45 @@ mod tests {
assert!(os(&mut e, "000AAAAAS", "OPER DEL staff").iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("isn't a runtime operator"))), "config oper untouched");
}
// A temporary OPER grant confers privileges until it lazily expires.
#[test]
fn operserv_oper_grant_can_expire() {
use fedserv_operserv::OperServ;
let path = std::env::temp_dir().join("fedserv-opertmp.jsonl");
let _ = std::fs::remove_file(&path);
let mut db = Db::open(&path, "42S");
db.scram_iterations = 4096;
db.register("staff", "password1", None).unwrap();
db.register("temp", "password1", None).unwrap();
let mut e = Engine::new(
vec![
Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
Box::new(OperServ { uid: "42SAAAAAH".into() }),
],
db,
);
e.set_sid("42S".into());
let mut opers = std::collections::HashMap::new();
opers.insert("staff".to_string(), Privs::default().with(fedserv_api::Priv::Admin));
e.set_opers(opers);
let os = |e: &mut Engine, uid: &str, t: &str| e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAH".into(), text: t.into() });
let denied = |out: &[NetAction]| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("Access denied")));
e.handle(NetEvent::UserConnect { uid: "000AAAAAS".into(), nick: "staff".into(), host: "h".into(), ip: "0.0.0.0".into() });
e.handle(NetEvent::Privmsg { from: "000AAAAAS".into(), to: "42SAAAAAA".into(), text: "IDENTIFY password1".into() });
e.handle(NetEvent::UserConnect { uid: "000AAAAAP".into(), nick: "temp".into(), host: "h".into(), ip: "0.0.0.0".into() });
e.handle(NetEvent::Privmsg { from: "000AAAAAP".into(), to: "42SAAAAAA".into(), text: "IDENTIFY password1".into() });
// A one-hour admin grant is active now...
os(&mut e, "000AAAAAS", "OPER ADD temp admin +1h");
assert!(!denied(&os(&mut e, "000AAAAAP", "STATS")), "active while granted");
assert!(os(&mut e, "000AAAAAS", "OPER LIST").iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("temp") && text.contains("temporary"))), "listed as temporary");
// ...but not after its window passes.
e.now_override = Some(10_000_000_000);
assert!(denied(&os(&mut e, "000AAAAAP", "STATS")), "expired grant confers nothing");
}
// OperServ NEWS: logon news greets everyone on connect, oper news greets an
// operator on login; ADD/DEL/LIST are admin-only.
#[test]