nickserv/chanserv: catch styled/fullwidth look-alike names too, and add a [register] confusable_check toggle (REHASH-reloadable)

src/engine/db/mod.rs

@@ -1056,6 +1056,7 @@ pub struct Db {
     // website): IRC can't register or change credentials, only authenticate
     // against accounts pushed in (via the gRPC Accounts API). Node-local config.
     external_accounts: bool,
+    confusable_check: bool, // reject look-alike / mixed-script REGISTER names
 }
 
 // A juped server: the held name, the fake server id we allocated for it, and why.
@@ -1124,7 +1125,7 @@ impl Db {
             apply(&mut accounts, &mut channels, &mut grouped, &mut bots, &mut host_cfg, &mut net, event);
         }
         tracing::info!(accounts = accounts.len(), channels = channels.len(), "account store loaded");
-        Self { accounts, channels, grouped, log, extban_enabled: None, notify_exclude: Vec::new(), live_extbans: None, live_chanmodes: None, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), report_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), defcon: 5, external_accounts: false }
+        Self { accounts, channels, grouped, log, extban_enabled: None, notify_exclude: Vec::new(), live_extbans: None, live_chanmodes: None, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), report_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), defcon: 5, external_accounts: false, confusable_check: true }
     }
 
     /// Fold an entry authored by another node into the store — the services-side

src/engine/db/network.rs

@@ -338,6 +338,11 @@ impl Db {
         self.external_accounts = on;
     }
 
+    /// Toggle the look-alike / mixed-script REGISTER guard (from `[register]`).
+    pub fn set_confusable_check(&mut self, on: bool) {
+        self.confusable_check = on;
+    }
+
     /// The network defence level (5 = normal, 1 = full lockdown).
     pub fn defcon(&self) -> u8 {
         self.defcon

src/engine/db/store.rs

@@ -320,6 +320,9 @@ impl Store for Db {
     fn external_accounts(&self) -> bool {
         Db::external_accounts(self)
     }
+    fn confusable_check_enabled(&self) -> bool {
+        self.confusable_check
+    }
     fn set_account_note(&mut self, account: &str, note: Option<String>) -> bool {
         Db::set_account_note(self, account, note)
     }

src/engine/mod.rs

@@ -897,6 +897,7 @@ impl Engine {
         self.set_standard_replies(cfg.server.standard_replies);
         self.set_log_channel(cfg.log.as_ref().map(|l| l.channel.clone()));
         self.db.set_notify_exclude(cfg.log.as_ref().map(|l| l.notify_exclude.clone()).unwrap_or_default());
+        self.db.set_confusable_check(cfg.register.confusable_check);
         self.set_guest_nick(&cfg.server.guest_nick);
         if let Some(expire) = &cfg.expire {
             self.set_expiry(expire.account_ttl(), expire.channel_ttl(), expire.warn_ttl());