nickserv/chanserv: catch styled/fullwidth look-alike names too, and add a [register] confusable_check toggle (REHASH-reloadable)

src/config.rs

@@ -49,6 +49,9 @@ pub struct Config {
     // not load and echo makes no outbound lookup requests. Opt-in on purpose.
     #[serde(default)]
     pub dictserv: Option<Dict>,
+    // Registration policy. Absent = defaults (the look-alike guard is on).
+    #[serde(default)]
+    pub register: Register,
     // Which InspIRCd matching-extbans AKICK may use. Absent = every extban echo
     // knows (full compatibility). List `enabled` to restrict it — e.g. drop the
     // ones your ircd doesn't provide.
@@ -85,6 +88,22 @@ fn default_dict_server() -> String {
     "dict.org:2628".to_string()
 }
 
+// Registration policy.
+#[derive(Debug, Deserialize, Clone)]
+#[serde(default)]
+pub struct Register {
+    // Reject look-alike / mixed-script / invisible registration names. On by
+    // default; turn it off for a community that legitimately uses mixed or
+    // non-Latin names. Reloadable with REHASH.
+    pub confusable_check: bool,
+}
+
+impl Default for Register {
+    fn default() -> Self {
+        Self { confusable_check: true }
+    }
+}
+
 // Account-authority configuration.
 #[derive(Debug, Deserialize, Clone)]
 pub struct Auth {

src/engine/db/mod.rs

@@ -1056,6 +1056,7 @@ pub struct Db {
     // website): IRC can't register or change credentials, only authenticate
     // against accounts pushed in (via the gRPC Accounts API). Node-local config.
     external_accounts: bool,
+    confusable_check: bool, // reject look-alike / mixed-script REGISTER names
 }
 
 // A juped server: the held name, the fake server id we allocated for it, and why.
@@ -1124,7 +1125,7 @@ impl Db {
             apply(&mut accounts, &mut channels, &mut grouped, &mut bots, &mut host_cfg, &mut net, event);
         }
         tracing::info!(accounts = accounts.len(), channels = channels.len(), "account store loaded");
-        Self { accounts, channels, grouped, log, extban_enabled: None, notify_exclude: Vec::new(), live_extbans: None, live_chanmodes: None, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), report_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), defcon: 5, external_accounts: false }
+        Self { accounts, channels, grouped, log, extban_enabled: None, notify_exclude: Vec::new(), live_extbans: None, live_chanmodes: None, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), report_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), defcon: 5, external_accounts: false, confusable_check: true }
     }
 
     /// Fold an entry authored by another node into the store — the services-side

src/engine/db/network.rs

@@ -338,6 +338,11 @@ impl Db {
         self.external_accounts = on;
     }
 
+    /// Toggle the look-alike / mixed-script REGISTER guard (from `[register]`).
+    pub fn set_confusable_check(&mut self, on: bool) {
+        self.confusable_check = on;
+    }
+
     /// The network defence level (5 = normal, 1 = full lockdown).
     pub fn defcon(&self) -> u8 {
         self.defcon

src/engine/db/store.rs

@@ -320,6 +320,9 @@ impl Store for Db {
     fn external_accounts(&self) -> bool {
         Db::external_accounts(self)
     }
+    fn confusable_check_enabled(&self) -> bool {
+        self.confusable_check
+    }
     fn set_account_note(&mut self, account: &str, note: Option<String>) -> bool {
         Db::set_account_note(self, account, note)
     }

src/engine/mod.rs

@@ -897,6 +897,7 @@ impl Engine {
         self.set_standard_replies(cfg.server.standard_replies);
         self.set_log_channel(cfg.log.as_ref().map(|l| l.channel.clone()));
         self.db.set_notify_exclude(cfg.log.as_ref().map(|l| l.notify_exclude.clone()).unwrap_or_default());
+        self.db.set_confusable_check(cfg.register.confusable_check);
         self.set_guest_nick(&cfg.server.guest_nick);
         if let Some(expire) = &cfg.expire {
             self.set_expiry(expire.account_ttl(), expire.channel_ttl(), expire.warn_ttl());

src/main.rs

@@ -186,6 +186,7 @@ async fn main() -> Result<()> {
     db.set_outbound(gossip_tx.clone());
     db.set_email_enabled(cfg.email.is_some());
     db.set_external_accounts(cfg.auth.as_ref().is_some_and(|a| a.external));
+    db.set_confusable_check(cfg.register.confusable_check);
     match cfg.extban.as_ref().map(|e| e.enabled.as_slice()) {
         Some(list) if !list.is_empty() => {
             db.set_extban_enabled(list.to_vec());