Make the SCRAM verifier the sole password credential; finish the account-registration relay

Credentials: the SCRAM-SHA-256 verifier is now the only password
credential. PLAIN and IDENTIFY verify the plaintext against it via
scram::verify_plain, exactly as a SCRAM login proves knowledge of it, so
an account provisioned from a verifier alone (external authority) works
over every mechanism, not only SCRAM. Removed the redundant argon2 hash
entirely: the field, the Credentials member, the AccountPasswordSet
field, hash_password/verify_password, and the argon2 crate. SASL SCRAM
already forces a PBKDF2 verifier into the store, so the hash never raised
the at-rest floor. OS RNG now comes from rand_core.

Registration: finished draft/account-registration over the ircd relay.
VERIFY confirms the emailed code, RESEND reissues it, STATUS reports
state, and REGISTER now emails the code and replies verification_required
on the relay path too, not only through NickServ.

src/engine/db/account.rs

@@ -11,7 +11,6 @@ impl Db {
         let verified = !(self.email_enabled && email.is_some());
         let account = Account {
             name: name.to_string(),
-            password_hash: creds.password_hash,
             email,
             ts: now(),
             home: self.log.origin.clone(),
@@ -37,10 +36,10 @@ impl Db {
 
     /// Provision a new account directly from pre-derived SCRAM verifiers (no
     /// plaintext), for bulk backfill from an external authority that stores
-    /// verifiers rather than passwords. `password_hash` is left empty — typed-
-    /// password login stays disabled until a real password is set — but SCRAM and
-    /// keycard login work at once. Refuses if the account already exists (so a
-    /// backfill can't clobber a fully-credentialed account). `scram512` empty =
+    /// verifiers rather than passwords. The verifier is the account's sole
+    /// password credential, so SCRAM, PLAIN, and IDENTIFY all work at once (see
+    /// `authenticate`). Refuses if the account already exists (so a backfill
+    /// can't clobber a fully-credentialed account). `scram512` empty =
     /// SCRAM-SHA-512 unavailable for this account (it falls back to 256).
     pub fn provision_account(&mut self, name: &str, scram256: &str, scram512: &str, email: Option<String>) -> Result<(), RegError> {
         if self.exists(name) {
@@ -51,7 +50,6 @@ impl Db {
         }
         let account = Account {
             name: name.to_string(),
-            password_hash: String::new(),
             email,
             ts: now(),
             home: self.log.origin.clone(),
@@ -84,15 +82,19 @@ impl Db {
     }
 
     #[cfg(test)]
-    pub(crate) fn test_hash(&self, name: &str) -> Option<String> {
-        self.accounts.get(&key(name)).map(|a| a.password_hash.clone())
+    pub(crate) fn test_verifier(&self, name: &str) -> Option<String> {
+        self.accounts.get(&key(name)).and_then(|a| a.scram256.clone())
     }
 
     /// Check credentials; on success return the account's canonical name (its
-    /// stored casing), else None.
+    /// stored casing), else None. The SCRAM-SHA-256 verifier is the sole password
+    /// credential, so PLAIN and IDENTIFY verify the plaintext against it exactly
+    /// as a SCRAM login proves knowledge of it (see `scram::verify_plain`).
     pub fn authenticate(&self, name: &str, password: &str) -> Option<&str> {
         let account = self.accounts.get(&self.resolved_key(name)?)?;
-        verify_password(password, &account.password_hash).then_some(account.name.as_str())
+        let verifier = account.scram256.as_deref()?;
+        crate::engine::scram::verify_plain(crate::engine::scram::Hash::Sha256, verifier, password)
+            .then_some(account.name.as_str())
     }
 
     /// The account's canonical name and its SCRAM verifier for `mech`, if any.
@@ -425,13 +427,11 @@ impl Db {
         self.log
             .append(Event::AccountPasswordSet {
                 account: account.to_string(),
-                password_hash: creds.password_hash.clone(),
                 scram256: creds.scram256.clone(),
                 scram512: creds.scram512.clone(),
             })
             .map_err(|_| RegError::Internal)?;
         let a = self.accounts.get_mut(&k).unwrap();
-        a.password_hash = creds.password_hash;
         a.scram256 = Some(creds.scram256);
         a.scram512 = Some(creds.scram512);
         Ok(())

src/engine/db/event.rs

@@ -15,7 +15,7 @@ pub enum Event {
     CertRemoved { account: String, fp: String },
     AccountEmailSet { account: String, email: Option<String> },
     AccountGreetSet { account: String, greet: String },
-    AccountPasswordSet { account: String, password_hash: String, scram256: String, scram512: String },
+    AccountPasswordSet { account: String, scram256: String, scram512: String },
     AccountDropped { account: String },
     AccountVerified { account: String },
     AjoinAdded { account: String, channel: String, key: String },
@@ -256,9 +256,8 @@ pub(crate) fn apply(accounts: &mut HashMap<String, Account>, channels: &mut Hash
                 a.greet = greet;
             }
         }
-        Event::AccountPasswordSet { account, password_hash, scram256, scram512 } => {
+        Event::AccountPasswordSet { account, scram256, scram512 } => {
             if let Some(a) = accounts.get_mut(&key(&account)) {
-                a.password_hash = password_hash;
                 a.scram256 = Some(scram256);
                 a.scram512 = Some(scram512);
             }

src/engine/db/mod.rs

@@ -18,9 +18,7 @@ pub fn build_badword_set(patterns: &[String]) -> regex::RegexSet {
 }
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
-use argon2::password_hash::rand_core::{OsRng, RngCore};
-use argon2::password_hash::SaltString;
-use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
+use rand_core::{OsRng, RngCore};
 use serde::{Deserialize, Serialize};
 use tokio::sync::broadcast;
 
@@ -48,7 +46,6 @@ pub use echo_api::{
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Account {
     pub name: String,
-    pub password_hash: String,
     pub email: Option<String>,
     pub ts: u64,
     // The node that first registered this account (its "home"). With `ts` it
@@ -833,10 +830,12 @@ fn valid_fp(fp: &str) -> bool {
 }
 
 // The expensive, password-derived half of an account, computed once at
-// registration. Split out from `register` so the derivation (argon2 + two SCRAM
+// registration. Split out from `register` so the derivation (two SCRAM
 // verifiers, ~1s at the default cost) can run off the reactor via spawn_blocking.
+// The SCRAM verifier is the sole password credential: SCRAM logins use it
+// directly, and PLAIN/IDENTIFY verify the plaintext against it (see
+// `scram::verify_plain`), so there is no separate password hash to keep in step.
 pub struct Credentials {
-    pub(crate) password_hash: String,
     pub(crate) scram256: String,
     pub(crate) scram512: String,
 }
@@ -1155,7 +1154,6 @@ impl Db {
     /// `register_prepared` then commits the result.
     pub fn derive_credentials(password: &str, iterations: u32) -> Option<Credentials> {
         Some(Credentials {
-            password_hash: hash_password(password)?,
             scram256: scram::make_verifier(Hash::Sha256, password, iterations),
             scram512: scram::make_verifier(Hash::Sha512, password, iterations),
         })
@@ -1204,16 +1202,6 @@ fn gen_code() -> String {
     b.iter().map(|x| ALPHABET[(*x % 32) as usize] as char).collect()
 }
 
-fn hash_password(password: &str) -> Option<String> {
-    let salt = SaltString::generate(&mut OsRng);
-    Argon2::default().hash_password(password.as_bytes(), &salt).ok().map(|h| h.to_string())
-}
-
-fn verify_password(password: &str, hash: &str) -> bool {
-    PasswordHash::new(hash)
-        .map(|parsed| Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok())
-        .unwrap_or(false)
-}
 
 // The module-facing account/channel store. Every method forwards to Db's own
 // (fully-qualified so it is the inherent method, never this trait method), with

src/engine/db/tests.rs

@@ -28,15 +28,17 @@
 
     #[test]
     fn account_conflict_resolves_deterministically() {
-        let alice = |hash: &str, ts: u64, home: &str| Account {
-            name: "alice".into(), password_hash: hash.into(), email: None,
+        // `tag` (carried in the email field, a free identity slot here) labels
+        // which of the two competing registrations we're looking at.
+        let alice = |tag: &str, ts: u64, home: &str| Account {
+            name: "alice".into(), email: Some(tag.into()),
             ts, home: home.into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], greet: String::new(), vhost: None, vhost_request: None, last_seen: ts, noexpire: false, expiry_warned: false, oper_note: None,
         };
         let converge = |first: &Account, second: &Account| {
             let (mut acc, mut ch, mut gr, mut bo, mut hc, mut nd) = (HashMap::new(), HashMap::new(), HashMap::new(), HashMap::new(), HostConfig::default(), NetData::default());
             apply(&mut acc, &mut ch, &mut gr, &mut bo, &mut hc, &mut nd, Event::AccountRegistered(Box::new(first.clone())));
             apply(&mut acc, &mut ch, &mut gr, &mut bo, &mut hc, &mut nd, Event::AccountRegistered(Box::new(second.clone())));
-            acc["alice"].password_hash.clone()
+            acc["alice"].email.clone().unwrap()
         };
         // Earlier registration wins, regardless of which claim applies first.
         let early = alice("EARLY", 100, "nodeB");
@@ -305,7 +307,7 @@
         db.scram_iterations = 4096;
         db.register("alice", "pw", None).unwrap();
         let bob = Account {
-            name: "bob".into(), password_hash: "x".into(), email: None,
+            name: "bob".into(), email: None,
             ts: 0, home: "peer".into(), scram256: None, scram512: None, certfps: vec![], verified: true, ajoin: vec![], suspension: None, memos: vec![], greet: String::new(), vhost: None, vhost_request: None, last_seen: 0, noexpire: false, expiry_warned: false, oper_note: None,
         };
         let entry = LogEntry { origin: "peer".into(), seq: 0, lamport: 1, event: Event::AccountRegistered(Box::new(bob)) };
@@ -342,6 +344,23 @@
         assert_eq!(db.certfps("bob"), &[kept][..], "kept cert survives");
     }
 
+    // An account provisioned from a SCRAM verifier alone (external authority)
+    // must authenticate over the PLAIN / IDENTIFY path (db.authenticate), not
+    // only over SCRAM — the verifier is the sole credential, so a backfilled
+    // member can still `/msg NickServ IDENTIFY`.
+    #[test]
+    fn provisioned_account_authenticates_over_plain() {
+        let mut db = Db::open(tmp("prov-plain"), "N1");
+        db.scram_iterations = 4096;
+        let creds = Db::derive_credentials("hunter2", 4096).unwrap();
+        db.provision_account("ext", &creds.scram256, "", None).unwrap();
+
+        // The verifier is the only credential on file, and PLAIN/IDENTIFY works.
+        assert!(db.test_verifier("ext").is_some(), "provisioned: verifier is the credential");
+        assert_eq!(db.authenticate("ext", "hunter2"), Some("ext"), "right password logs in");
+        assert!(db.authenticate("ext", "wrong").is_none(), "wrong password rejected");
+    }
+
     // A peer with an empty log converges from a node that has already compacted.
     #[test]
     fn compacted_node_still_converges() {