Restore the connect-time host when a session logs out, reversing any services vhost

api/src/lib.rs

@@ -2093,6 +2093,7 @@ pub trait Store {
     fn set_vhost(&mut self, account: &str, host: &str, setter: &str, ttl: Option<u64>) -> Result<(), RegError>;
     fn del_vhost(&mut self, account: &str) -> Result<bool, RegError>;
     fn vhost(&self, account: &str) -> Option<VhostView>;
+    fn active_vhost(&self, account: &str) -> Option<String>;
     fn vhosts(&self) -> Vec<VhostView>;
     fn vhost_owner(&self, host: &str) -> Option<String>;
     fn request_vhost(&mut self, account: &str, host: &str) -> Result<(), RegError>;
@@ -2446,6 +2447,26 @@ pub fn next_guest_nick(base: &str, seq: &mut u32, net: &dyn NetView, store: &dyn
     candidate
 }
 
+/// The actions to reverse a services vhost when a session logs out: restore the
+/// connect-time host, and the ident too if the vhost set one (`ident@host`).
+/// Empty when the account holds no vhost. Restores the stored displayed host —
+/// the cloak, never the real host — since the vhost apply never overwrites it.
+pub fn vhost_restore_actions(net: &dyn NetView, store: &dyn Store, uid: &str, account: &str) -> Vec<NetAction> {
+    let Some(vhost) = store.active_vhost(account) else {
+        return Vec::new();
+    };
+    let mut out = Vec::new();
+    if vhost.contains('@') {
+        if let Some(ident) = net.ident_of(uid).filter(|i| !i.is_empty()) {
+            out.push(NetAction::SetIdent { uid: uid.to_string(), ident: ident.to_string() });
+        }
+    }
+    if let Some(host) = net.host_of(uid).filter(|h| !h.is_empty()) {
+        out.push(NetAction::SetHost { uid: uid.to_string(), host: host.to_string() });
+    }
+    out
+}
+
 /// Tell `target` account they were affected by someone else's action: notice
 /// every online session, or leave a memo (from `by`) if they're offline. The
 /// message renders in the target's own language. No-op when the actor is the

modules/nickserv/src/logout.rs

@@ -3,11 +3,12 @@ use echo_api::t;
 
 // LOGOUT: log out and rename to a guest nick (prefix + a per-logout sequence).
 pub fn handle(me: &str, guest_nick: &str, guest_seq: &mut u32, from: &Sender, ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
-    if from.account.is_none() {
+    let Some(account) = from.account else {
         ctx.notice(me, from.uid, "You're not logged in.");
         return;
-    }
+    };
     let guest = echo_api::next_guest_nick(guest_nick, guest_seq, net, db);
+    ctx.actions.extend(echo_api::vhost_restore_actions(net, db, from.uid, account));
     ctx.logout(from.uid);
     ctx.force_nick(from.uid, &guest);
     ctx.notice(me, from.uid, t!(ctx, "You're now logged out. Your nick is now \x02{guest}\x02.", guest = guest));

src/engine/db/store.rs

@@ -152,6 +152,9 @@ impl Store for Db {
             a.vhost.as_ref().filter(|v| v.expires.is_none_or(|e| e > now())).map(|v| VhostView { account: a.name.clone(), host: v.host.clone(), setter: v.setter.clone(), expires: v.expires })
         })
     }
+    fn active_vhost(&self, account: &str) -> Option<String> {
+        Db::active_vhost(self, account)
+    }
     fn vhosts(&self) -> Vec<VhostView> {
         Db::vhosts(self).into_iter().map(|(account, host, setter, expires)| VhostView { account, host, setter, expires }).collect()
     }

src/engine/mod.rs

@@ -767,6 +767,9 @@ impl Engine {
         if let Some(action) = self.feed("SESS", format!("{} logged out of \x02{account}\x02 ({reason})", self.who(uid))) {
             self.emit_irc(action);
         }
+        for act in echo_api::vhost_restore_actions(&self.network, &self.db, uid, account) {
+            self.emit_irc(act);
+        }
         self.network.clear_account(uid);
         self.emit_irc(NetAction::Metadata { target: uid.to_string(), key: "accountname".to_string(), value: String::new() });
         if let Some(ns) = self.nick_service.clone() {

src/engine/tests.rs

@@ -5240,6 +5240,24 @@
         assert_eq!(e.db.unread_memos("bob"), 1, "no extra memo when online");
     }
 
+    // Logging out reverses a services vhost, restoring the connect-time host (the
+    // cloak we were given at UserConnect), not the real host.
+    #[test]
+    fn logout_restores_the_connect_host_over_a_vhost() {
+        let path = std::env::temp_dir().join("echo-logout-vhost.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("alice", "sesame", None).unwrap();
+        db.set_vhost("alice", "cool.vhost", "admin", None).unwrap();
+        let ns = NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 };
+        let mut e = Engine::new(vec![Box::new(ns)], db);
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "cloak.host".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        let out = e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "LOGOUT".into() });
+        assert!(out.iter().any(|a| matches!(a, NetAction::SetHost { uid, host } if uid == "000AAAAAB" && host == "cloak.host")), "logout restores the cloak: {out:?}");
+    }
+
     // ChanServ SET: description and founder transfer, founder-gated.
     #[test]
     fn chanserv_set() {