Derive registration credentials off-thread; rate-limit REGISTER; constant-time SCRAM compare

src/engine/service.rs

@@ -1,5 +1,5 @@
 use crate::engine::db::Db;
-use crate::proto::NetAction;
+use crate::proto::{NetAction, RegReply};
 
 // Who sent the command, resolved by the engine (UID + current nick).
 pub struct Sender<'a> {
@@ -33,6 +33,17 @@ impl ServiceCtx {
         });
     }
 
+    // Hand a registration to the engine to finish: its password derivation runs
+    // off the reactor, then the engine commits it and answers `reply`.
+    pub fn defer_register(&mut self, account: impl Into<String>, password: impl Into<String>, email: Option<String>, reply: RegReply) {
+        self.actions.push(NetAction::DeferRegister {
+            account: account.into(),
+            password: password.into(),
+            email,
+            reply,
+        });
+    }
+
     // Log a user into an account: sets the accountname the ircd turns into
     // RPL_LOGGEDIN (900) and exposes to account-tag / WHOX, the same login the
     // SASL agent applies. Used after a successful REGISTER / IDENTIFY.