modules: capability-scoped Store/NetView boundary (Tier 2)

Services no longer receive the concrete account store. on_command now takes
&mut dyn Store + &dyn NetView (both defined in fedserv-api); the engine's Db
and Network implement them. Reads hand back plain views (AccountView,
ChannelView, ...) carrying only non-secret fields, so the event log, gossip,
and credential material (password hash, SCRAM verifiers) are unreachable from
a module. All command modules ported; behaviour unchanged.

modules/chanserv/access.rs

@@ -1,8 +1,8 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // ACCESS <#channel> LIST | ADD <account> <op|voice> | DEL <account>
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: ACCESS <#channel> LIST | ADD <account> <op|voice> | DEL <account>");
         return;
@@ -55,7 +55,7 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
 }
 
 // True if `from` is the channel's founder; otherwise notices why and returns false.
-fn is_founder(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db: &Db) -> bool {
+fn is_founder(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db: &dyn Store) -> bool {
     match db.channel(chan) {
         None => {
             ctx.notice(me, from.uid, format!("\x02{chan}\x02 isn't registered."));

modules/chanserv/akick.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // AKICK <#channel> ADD <mask> [reason] | DEL <mask> | LIST
 // Masks are nick!user@host globs; matching users are banned and kicked on join.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: AKICK <#channel> ADD <mask> [reason] | DEL <mask> | LIST");
         return;

modules/chanserv/ban.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // BAN <#channel> <nick> [reason]: ban *!*@host and kick the user.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let (Some(&chan), Some(&nick)) = (args.get(1), args.get(2)) else {
         ctx.notice(me, from.uid, "Syntax: BAN <#channel> <nick> [reason]");
         return;

modules/chanserv/chanserv.rs

@@ -1,6 +1,6 @@
-use crate::engine::db::{ChanError, ChannelInfo, Db};
+use crate::engine::db::{ChanError, ChannelView, Store};
 use crate::engine::service::{Sender, Service, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 #[path = "mode.rs"]
 mod mode;
@@ -57,7 +57,7 @@ impl Service for ChanServ {
         true
     }
 
-    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &mut Db) {
+    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
         let me = self.uid.as_str();
         match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
             Some("REGISTER") => {
@@ -142,7 +142,7 @@ impl Service for ChanServ {
                         Some(info) if info.lock_on.is_empty() && info.lock_off.is_empty() => {
                             ctx.notice(me, from.uid, format!("\x02{}\x02 has no mode lock set.", info.name));
                         }
-                        Some(info) => ctx.notice(me, from.uid, format!("Mode lock for \x02{}\x02: \x02{}\x02", info.name, show_mlock(info))),
+                        Some(info) => ctx.notice(me, from.uid, format!("Mode lock for \x02{}\x02: \x02{}\x02", info.name, show_mlock(&info))),
                     }
                     return;
                 }
@@ -200,7 +200,7 @@ impl Service for ChanServ {
 }
 
 // True if `from` is the channel's founder; otherwise notices why and returns false.
-fn require_founder(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db: &Db) -> bool {
+fn require_founder(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db: &dyn Store) -> bool {
     match db.channel(chan) {
         None => {
             ctx.notice(me, from.uid, format!("\x02{chan}\x02 isn't registered."));
@@ -215,7 +215,7 @@ fn require_founder(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db
 }
 
 // True if `from` is the founder or an access-list op of `chan`; else notices why.
-fn require_op(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db: &Db) -> bool {
+fn require_op(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceCtx, db: &dyn Store) -> bool {
     match (from.account, db.channel(chan)) {
         (_, None) => {
             ctx.notice(me, from.uid, format!("\x02{chan}\x02 isn't registered."));
@@ -255,7 +255,7 @@ fn parse_mlock(spec: &str) -> (String, String) {
 }
 
 // Render a channel's lock as "+on-off" for display.
-fn show_mlock(info: &ChannelInfo) -> String {
+fn show_mlock(info: &ChannelView) -> String {
     let mut s = String::new();
     if !info.lock_on.is_empty() {
         s.push('+');

modules/chanserv/clone.rs

@@ -1,14 +1,14 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // CLONE <source> <target>: copy a channel's settings (mode lock, access,
 // auto-kick, description, entry message) into another. Founder of both.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let (Some(&src), Some(&dest)) = (args.get(1), args.get(2)) else {
         ctx.notice(me, from.uid, "Syntax: CLONE <source> <target>");
         return;
     };
-    let (Some(sinfo), Some(dinfo)) = (db.channel(src).cloned(), db.channel(dest).cloned()) else {
+    let (Some(sinfo), Some(dinfo)) = (db.channel(src), db.channel(dest)) else {
         ctx.notice(me, from.uid, "Both channels must be registered.");
         return;
     };

modules/chanserv/enforce.rs

@@ -1,10 +1,10 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // ENFORCE <#channel>: re-apply the channel's settings to everyone present —
 // the mode lock, access status modes, and the auto-kick list.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: ENFORCE <#channel>");
         return;
@@ -12,11 +12,11 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net:
     if !super::require_op(me, from, chan, ctx, db) {
         return;
     }
-    let Some(info) = db.channel(chan).cloned() else {
+    let Some(info) = db.channel(chan) else {
         return;
     };
     ctx.channel_mode(me, chan, &info.lock_modes());
-    let members: Vec<String> = net.channel_members(chan).map(str::to_string).collect();
+    let members: Vec<String> = net.channel_members(chan);
     for uid in members {
         match net.account_of(&uid).and_then(|a| info.join_mode(a)) {
             Some(m) => ctx.channel_mode(me, chan, &format!("{m} {uid}")),

modules/chanserv/entrymsg.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // ENTRYMSG <#channel> [CLEAR | <text>]: message noticed to users as they join.
 // With no argument, show the current message.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: ENTRYMSG <#channel> [CLEAR | <text>]");
         return;

modules/chanserv/getkey.rs

@@ -1,10 +1,10 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // GETKEY <#channel>: report the channel key (+k), for ops who need to let
 // someone in.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: GETKEY <#channel>");
         return;

modules/chanserv/invite.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // INVITE <#channel> [nick]: invite a user (self if no nick) into the channel.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: INVITE <#channel> [nick]");
         return;

modules/chanserv/kick.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // KICK <#channel> <nick> [reason]: kick a user.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let (Some(&chan), Some(&nick)) = (args.get(1), args.get(2)) else {
         ctx.notice(me, from.uid, "Syntax: KICK <#channel> <nick> [reason]");
         return;

modules/chanserv/list.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // LIST: show all registered channels.
-pub fn handle(me: &str, from: &Sender, _args: &[&str], ctx: &mut ServiceCtx, db: &Db) {
-    let mut names: Vec<&str> = db.channels().map(|c| c.name.as_str()).collect();
+pub fn handle(me: &str, from: &Sender, _args: &[&str], ctx: &mut ServiceCtx, db: &dyn Store) {
+    let mut names: Vec<String> = db.channels().into_iter().map(|c| c.name).collect();
     if names.is_empty() {
         ctx.notice(me, from.uid, "No channels are registered.");
         return;

modules/chanserv/mode.rs

@@ -1,8 +1,8 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // MODE <#channel> <modes>: the founder sets channel modes via ChanServ.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: MODE <#channel> <modes>, e.g. MODE #chan +nt");
         return;

modules/chanserv/op.rs

@@ -1,10 +1,10 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // OP/DEOP/VOICE/DEVOICE <#channel> [nick]: set a status mode on a user (self if
 // no nick given). `mode` is the mode to apply, e.g. "+o".
-pub fn handle(me: &str, from: &Sender, mode: &str, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, mode: &str, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: OP/DEOP/VOICE/DEVOICE <#channel> [nick]");
         return;

modules/chanserv/seen.rs

@@ -1,8 +1,8 @@
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // SEEN <nick>: when a nick was last seen, and doing what.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView) {
     let Some(&nick) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: SEEN <nick>");
         return;

modules/chanserv/set.rs

@@ -1,8 +1,8 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // SET <#channel> FOUNDER <account> | DESC <text>: founder-only channel settings.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER <account> | DESC <text>");
         return;

modules/chanserv/status.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // STATUS <#channel> [nick]: show a user's access level (self if no nick).
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: STATUS <#channel> [nick]");
         return;

modules/chanserv/topic.rs

@@ -1,8 +1,8 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // TOPIC <#channel> <text>: set the channel topic (empty clears it).
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: TOPIC <#channel> <text>");
         return;

modules/chanserv/unban.rs

@@ -1,9 +1,9 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
-use crate::engine::state::Network;
+use crate::engine::state::NetView;
 
 // UNBAN <#channel> [nick]: remove the *!*@host ban of a user (self if no nick).
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &Db) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, "Syntax: UNBAN <#channel> [nick]");
         return;

modules/chanserv/xop.rs

@@ -1,10 +1,10 @@
-use crate::engine::db::Db;
+use crate::engine::db::Store;
 use crate::engine::service::{Sender, ServiceCtx};
 
 // AOP/SOP/VOP <#channel> ADD <account> | DEL <account> | LIST — tiered
 // shortcuts over the access list. `level` is the access level they map to
 // ("op" for AOP/SOP, "voice" for VOP); `word` is what the user typed.
-pub fn handle(me: &str, from: &Sender, word: &str, level: &str, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+pub fn handle(me: &str, from: &Sender, word: &str, level: &str, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let Some(&chan) = args.get(1) else {
         ctx.notice(me, from.uid, format!("Syntax: {word} <#channel> ADD <account> | DEL <account> | LIST"));
         return;