NickServ: add SET AUTOOP per-account auto-op opt-out

A user with SET AUTOOP OFF is never auto-opped on join, even where they
hold channel access — they op themselves via ChanServ UP. Stored inverted
(no_autoop) so the default stays auto-op. Join gates on both the channel
setting and the account preference; either can opt out.

api/src/lib.rs

@@ -914,6 +914,9 @@ pub trait Store {
     fn verify_account(&mut self, account: &str) -> Result<(), RegError>;
     fn set_email(&mut self, account: &str, email: Option<String>) -> Result<(), RegError>;
     fn set_greet(&mut self, account: &str, greet: &str) -> Result<(), RegError>;
+    // NickServ SET AUTOOP: whether this account is auto-opped on join.
+    fn set_account_autoop(&mut self, account: &str, on: bool) -> Result<(), RegError>;
+    fn account_wants_autoop(&self, account: &str) -> bool;
     // HostServ vhosts.
     fn set_vhost(&mut self, account: &str, host: &str, setter: &str, ttl: Option<u64>) -> Result<(), RegError>;
     fn del_vhost(&mut self, account: &str) -> Result<bool, RegError>;

modules/nickserv/src/lib.rs

@@ -54,7 +54,7 @@ const TOPICS: &[HelpEntry] = &[
     HelpEntry { cmd: "LOGOUT", summary: "log out to a guest nick", detail: "Syntax: \x02LOGOUT\x02\nLogs you out and moves you to a guest nick. Also \x02LOGOFF\x02." },
     HelpEntry { cmd: "INFO", summary: "show account information", detail: "Syntax: \x02INFO [account]\x02\nShows account information. The email is shown only to the owner." },
     HelpEntry { cmd: "ALIST", summary: "list channels you have access on", detail: "Syntax: \x02ALIST\x02\nLists the channels you hold access on." },
-    HelpEntry { cmd: "SET", summary: "change password or email", detail: "Syntax: \x02SET PASSWORD <new>\x02 or \x02SET EMAIL <address>\x02\nChanges your account password or email." },
+    HelpEntry { cmd: "SET", summary: "change password, email, or preferences", detail: "Syntax: \x02SET PASSWORD <new>\x02, \x02SET EMAIL <address>\x02, \x02SET GREET [message]\x02, or \x02SET AUTOOP {ON|OFF}\x02\nChanges your account password, email, greet, or auto-op preference." },
     HelpEntry { cmd: "SASET", summary: "change another account's settings (operator)", detail: "Syntax: \x02SASET <account> PASSWORD <new>\x02, \x02EMAIL [address]\x02, or \x02GREET [message]\x02\nEdits another account's settings. Operators only." },
     HelpEntry { cmd: "GROUP", summary: "link this nick to an account", detail: "Syntax: \x02GROUP <account> <password>\x02\nLinks your current nick to an account as an alias, so identifying under it logs into that account." },
     HelpEntry { cmd: "GLIST", summary: "list your grouped nicks", detail: "Syntax: \x02GLIST\x02\nLists the nicks grouped to your account." },

modules/nickserv/src/set.rs

@@ -35,6 +35,18 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
                 Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
             }
         }
+        Some("AUTOOP") => {
+            let Some(on) = args.get(2).and_then(|s| parse_toggle(s)) else {
+                let state = if db.account_wants_autoop(account) { "ON" } else { "OFF" };
+                ctx.notice(me, from.uid, format!("AUTOOP is \x02{state}\x02. Syntax: SET AUTOOP {{ON|OFF}}"));
+                return;
+            };
+            match db.set_account_autoop(account, on) {
+                Ok(()) if on => ctx.notice(me, from.uid, "You will be auto-opped where you have channel access."),
+                Ok(()) => ctx.notice(me, from.uid, "You will no longer be auto-opped; op yourself with \x02/msg ChanServ UP\x02."),
+                Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+            }
+        }
         Some("GREET") => {
             // A bot shows this when you join a greet-enabled channel; no arg clears it.
             let greet = if args.len() > 2 { args[2..].join(" ") } else { String::new() };
@@ -45,6 +57,14 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
                 Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
             }
         }
-        _ => ctx.notice(me, from.uid, "Syntax: SET PASSWORD <newpassword> | SET EMAIL [address] | SET GREET [message]"),
+        _ => ctx.notice(me, from.uid, "Syntax: SET PASSWORD <newpassword> | SET EMAIL [address] | SET GREET [message] | SET AUTOOP {ON|OFF}"),
+    }
+}
+
+fn parse_toggle(s: &str) -> Option<bool> {
+    match s.to_ascii_uppercase().as_str() {
+        "ON" | "TRUE" | "YES" => Some(true),
+        "OFF" | "FALSE" | "NO" => Some(false),
+        _ => None,
     }
 }

src/engine/db/account.rs

@@ -21,7 +21,7 @@ impl Db {
             ajoin: Vec::new(),
             suspension: None,
             memos: Vec::new(), memo_ignore: Vec::new(), memo_notify: true, memo_limit: None,
-            greet: String::new(),
+            greet: String::new(), no_autoop: false,
             vhost: None,
             vhost_request: None,
             last_seen: now(),
@@ -60,7 +60,7 @@ impl Db {
             ajoin: Vec::new(),
             suspension: None,
             memos: Vec::new(), memo_ignore: Vec::new(), memo_notify: true, memo_limit: None,
-            greet: String::new(),
+            greet: String::new(), no_autoop: false,
             vhost: None,
             vhost_request: None,
             last_seen: now(),
@@ -418,6 +418,22 @@ impl Db {
         Ok(())
     }
 
+    /// Set whether `account` wants to be auto-opped on join (NickServ SET AUTOOP).
+    pub fn set_account_autoop(&mut self, account: &str, on: bool) -> Result<(), RegError> {
+        let k = key(account);
+        if !self.accounts.contains_key(&k) {
+            return Err(RegError::Internal);
+        }
+        self.log.append(Event::AccountAutoOpSet { account: account.to_string(), on }).map_err(|_| RegError::Internal)?;
+        self.accounts.get_mut(&k).unwrap().no_autoop = !on;
+        Ok(())
+    }
+
+    /// Whether `account` wants auto-op on join (default true). Unknown = true.
+    pub fn account_wants_autoop(&self, account: &str) -> bool {
+        self.accounts.get(&key(account)).is_none_or(|a| !a.no_autoop)
+    }
+
     /// Replace `account`'s password with freshly derived credentials.
     pub fn set_credentials(&mut self, account: &str, creds: Credentials) -> Result<(), RegError> {
         let k = key(account);

src/engine/db/event.rs

@@ -15,6 +15,7 @@ pub enum Event {
     CertRemoved { account: String, fp: String },
     AccountEmailSet { account: String, email: Option<String> },
     AccountGreetSet { account: String, greet: String },
+    AccountAutoOpSet { account: String, on: bool },
     AccountPasswordSet { account: String, scram256: String, scram512: String },
     AccountDropped { account: String },
     AccountVerified { account: String },
@@ -147,6 +148,7 @@ impl Event {
             | Event::CertRemoved { .. }
             | Event::AccountEmailSet { .. }
             | Event::AccountGreetSet { .. }
+            | Event::AccountAutoOpSet { .. }
             | Event::AccountPasswordSet { .. }
             | Event::AccountDropped { .. }
             | Event::AccountVerified { .. }
@@ -273,6 +275,11 @@ pub(crate) fn apply(accounts: &mut HashMap<String, Account>, channels: &mut Hash
                 a.greet = greet;
             }
         }
+        Event::AccountAutoOpSet { account, on } => {
+            if let Some(a) = accounts.get_mut(&key(&account)) {
+                a.no_autoop = !on;
+            }
+        }
         Event::AccountPasswordSet { account, scram256, scram512 } => {
             if let Some(a) = accounts.get_mut(&key(&account)) {
                 a.scram256 = Some(scram256);

src/engine/db/mod.rs

@@ -91,6 +91,11 @@ pub struct Account {
     // Personal greet a bot shows when this account joins a greet-enabled channel.
     #[serde(default)]
     pub greet: String,
+    // NickServ SET AUTOOP: when off, this user is never auto-opped on join even
+    // where they hold access (they op themselves). Stored inverted so the default
+    // (auto-op enabled) is the zero value.
+    #[serde(default)]
+    pub no_autoop: bool,
     // Assigned vhost (HostServ), applied to the displayed host on identify.
     #[serde(default)]
     pub vhost: Option<Vhost>,

src/engine/db/store.rs

@@ -82,6 +82,12 @@ impl Store for Db {
     fn set_greet(&mut self, account: &str, greet: &str) -> Result<(), RegError> {
         Db::set_greet(self, account, greet)
     }
+    fn set_account_autoop(&mut self, account: &str, on: bool) -> Result<(), RegError> {
+        Db::set_account_autoop(self, account, on)
+    }
+    fn account_wants_autoop(&self, account: &str) -> bool {
+        Db::account_wants_autoop(self, account)
+    }
     fn set_vhost(&mut self, account: &str, host: &str, setter: &str, ttl: Option<u64>) -> Result<(), RegError> {
         Db::set_vhost(self, account, host, setter, ttl)
     }

src/engine/db/tests.rs

@@ -32,7 +32,7 @@
         // which of the two competing registrations we're looking at.
         let alice = |tag: &str, ts: u64, home: &str| Account {
             name: "alice".into(), email: Some(tag.into()),
-            ts, home: home.into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], memo_ignore: vec![], memo_notify: true, memo_limit: None, greet: String::new(), vhost: None, vhost_request: None, last_seen: ts, noexpire: false, expiry_warned: false, oper_note: None,
+            ts, home: home.into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], memo_ignore: vec![], memo_notify: true, memo_limit: None, greet: String::new(), no_autoop: false, vhost: None, vhost_request: None, last_seen: ts, noexpire: false, expiry_warned: false, oper_note: None,
         };
         let converge = |first: &Account, second: &Account| {
             let (mut acc, mut ch, mut gr, mut bo, mut hc, mut nd) = (HashMap::new(), HashMap::new(), HashMap::new(), HashMap::new(), HostConfig::default(), NetData::default());
@@ -329,7 +329,7 @@
         db.register("alice", "pw", None).unwrap();
         let bob = Account {
             name: "bob".into(), email: None,
-            ts: 0, home: "peer".into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], memo_ignore: vec![], memo_notify: true, memo_limit: None, greet: String::new(), vhost: None, vhost_request: None, last_seen: 0, noexpire: false, expiry_warned: false, oper_note: None,
+            ts: 0, home: "peer".into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], memo_ignore: vec![], memo_notify: true, memo_limit: None, greet: String::new(), no_autoop: false, vhost: None, vhost_request: None, last_seen: 0, noexpire: false, expiry_warned: false, oper_note: None,
         };
         let entry = LogEntry { origin: "peer".into(), seq: 0, lamport: 1, event: Event::AccountRegistered(Box::new(bob)) };
         db.ingest(entry).unwrap();

src/engine/mod.rs

@@ -827,8 +827,10 @@ impl Engine {
                         return out;
                     }
                 }
-                // AUTOOP (on by default): whether access members are auto-opped here.
+                // AUTOOP (on by default): the channel must allow it and the user
-                let autoop = self.db.channel(&channel).is_none_or(|c| !c.settings.noautoop);
+                // must want it (NickServ SET AUTOOP) — either can opt out.
+                let autoop = self.db.channel(&channel).is_none_or(|c| !c.settings.noautoop)
+                    && account.as_deref().is_none_or(|a| self.db.account_wants_autoop(a));
                 match mode {
                     // A user with access gets their status mode, plus the entry message.
                     Some(m) => {
@@ -1178,7 +1180,7 @@ fn audit_summary(event: &db::Event) -> Option<String> {
             format!("{verb} channel \x02{channel}\x02 against expiry")
         }
         // Private, self-service, or cosmetic — not surfaced.
-        AjoinAdded { .. } | AjoinRemoved { .. } | AccountGreetSet { .. } | VhostRequested { .. }
+        AjoinAdded { .. } | AjoinRemoved { .. } | AccountGreetSet { .. } | AccountAutoOpSet { .. } | VhostRequested { .. }
         | VhostRequestCleared { .. } | MemoSent { .. } | MemoRead { .. } | MemoDeleted { .. }
         | MemoIgnoreAdd { .. } | MemoIgnoreDel { .. } | MemoPrefsSet { .. }
         | ChannelMlock { .. } | ChannelDescSet { .. } | ChannelEntryMsgSet { .. } | ChannelSettingsSet { .. }

src/engine/tests.rs

@@ -411,7 +411,7 @@
         // An earlier claim from another node wins and takes the name over.
         let winner = db::Account {
             name: "alice".into(), email: None,
-            ts: 0, home: "peer".into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], memo_ignore: vec![], memo_notify: true, memo_limit: None, greet: String::new(), vhost: None, vhost_request: None, last_seen: 0, noexpire: false, expiry_warned: false, oper_note: None,
+            ts: 0, home: "peer".into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], memo_ignore: vec![], memo_notify: true, memo_limit: None, greet: String::new(), no_autoop: false, vhost: None, vhost_request: None, last_seen: 0, noexpire: false, expiry_warned: false, oper_note: None,
         };
         let entry = LogEntry::for_test("peer", 0, 1, db::Event::AccountRegistered(Box::new(winner)));
         e.gossip_ingest(entry).unwrap();
@@ -1376,6 +1376,46 @@
         assert!(!opped(&e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: false })), "no auto-op when AUTOOP is off");
     }
 
+    // NickServ SET AUTOOP OFF is a per-account opt-out: the user isn't auto-opped
+    // anywhere, even where the channel allows it.
+    #[test]
+    fn nickserv_set_autoop_off_opts_out_of_status() {
+        use echo_chanserv::ChanServ;
+        use echo_nickserv::NickServ;
+        let path = std::env::temp_dir().join("echo-nsautoop.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("alice", "sesame", None).unwrap();
+        db.register_channel("#c", "alice").unwrap();
+        let mut e = Engine::new(
+            vec![
+                Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
+                Box::new(ChanServ { uid: "42SAAAAAB".into() }),
+            ],
+            db,
+        );
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "h".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        let ns = |e: &mut Engine, t: &str| e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: t.into() });
+        let opped = |out: &[NetAction]| out.iter().any(|a| matches!(a, NetAction::ChannelMode { modes, .. } if modes == "+o 000AAAAAB"));
+        let notice = |out: &[NetAction], n: &str| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains(n)));
+
+        // Default: founder is auto-opped (channel AUTOOP on, account AUTOOP on).
+        assert!(opped(&e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: false })), "auto-op on by default");
+        e.handle(NetEvent::Part { uid: "000AAAAAB".into(), channel: "#c".into() });
+
+        // Account opts out via NickServ; now no auto-op despite channel allowing it.
+        assert!(notice(&ns(&mut e, "SET AUTOOP OFF"), "no longer be auto-opped"), "pref set off");
+        assert!(!e.db.account_wants_autoop("alice"), "preference stored");
+        assert!(!opped(&e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: false })), "no auto-op with account AUTOOP off");
+
+        // Turn it back on: auto-op resumes.
+        e.handle(NetEvent::Part { uid: "000AAAAAB".into(), channel: "#c".into() });
+        assert!(notice(&ns(&mut e, "SET AUTOOP ON"), "auto-opped where you have"), "pref set on");
+        assert!(opped(&e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: false })), "auto-op resumes");
+    }
+
     // BotServ BOT ADD/LIST is oper-gated (Priv::Admin) and the bot is remembered.
     #[test]
     fn botserv_bot_add_list_is_oper_gated() {

src/grpc.rs

@@ -128,6 +128,7 @@ fn to_wire(entry: &LogEntry) -> Option<ReplicationEvent> {
         | Event::CertRemoved { .. }
         | Event::AccountPasswordSet { .. }
         | Event::AccountGreetSet { .. }
+        | Event::AccountAutoOpSet { .. }
         | Event::AjoinAdded { .. }
         | Event::AjoinRemoved { .. }
         | Event::VhostSet { .. }
@@ -461,7 +462,7 @@ mod tests {
             memo_ignore: vec![],
             memo_notify: true,
             memo_limit: None,
-            greet: String::new(),
+            greet: String::new(), no_autoop: false,
             vhost: None,
             vhost_request: None,
             last_seen: 111,