email: outbound mail subsystem and RESETPASS

Adds a config-driven mailer: a SendEmail action the link layer pipes to
a configured command (sendmail -t, msmtp, ...) off-thread. NickServ
RESETPASS <account> emails a short-lived code to the address on file;
RESETPASS <account> <code> <newpassword> completes the reset. Codes are
node-local; the password change itself federates.

modules/nickserv/nickserv.rs

@@ -26,6 +26,8 @@ mod glist;
 mod ungroup;
 #[path = "ghost.rs"]
 mod ghost;
+#[path = "resetpass.rs"]
+mod resetpass;
 
 pub struct NickServ {
     pub uid: String,
@@ -64,7 +66,8 @@ impl Service for NickServ {
             Some("GLIST") => glist::handle(me, from, ctx, db),
             Some("UNGROUP") => ungroup::handle(me, from, args, ctx, db),
             Some("GHOST") | Some("RECOVER") => ghost::handle(me, &self.guest_nick, &mut self.guest_seq, from, args, ctx, net, db),
-            Some("HELP") => ctx.notice(me, from.uid, "NickServ looks after your nickname. Commands: \x02REGISTER\x02 <password> [email], \x02IDENTIFY\x02 [account] <password>, \x02INFO\x02 [account], \x02ALIST\x02, \x02GROUP\x02/\x02GLIST\x02/\x02UNGROUP\x02, \x02GHOST\x02 <nick> [password], \x02SET\x02 PASSWORD|EMAIL, \x02DROP\x02 <password>, \x02LOGOUT\x02, \x02CERT\x02 ADD|DEL|LIST <password> [fingerprint]."),
+            Some("RESETPASS") => resetpass::handle(me, from, args, ctx, db),
+            Some("HELP") => ctx.notice(me, from.uid, "NickServ looks after your nickname. Commands: \x02REGISTER\x02 <password> [email], \x02IDENTIFY\x02 [account] <password>, \x02INFO\x02 [account], \x02ALIST\x02, \x02GROUP\x02/\x02GLIST\x02/\x02UNGROUP\x02, \x02GHOST\x02 <nick> [password], \x02SET\x02 PASSWORD|EMAIL, \x02RESETPASS\x02 <account>, \x02DROP\x02 <password>, \x02LOGOUT\x02, \x02CERT\x02 ADD|DEL|LIST <password> [fingerprint]."),
             Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")),
             None => {}
         }

modules/nickserv/resetpass.rs

@@ -0,0 +1,42 @@
+use crate::engine::db::Db;
+use crate::engine::service::{Sender, ServiceCtx};
+
+// RESETPASS <account>: email a reset code to the address on file.
+// RESETPASS <account> <code> <newpassword>: complete the reset with that code.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+    if !db.email_enabled() {
+        ctx.notice(me, from.uid, "Password reset by email isn't available here.");
+        return;
+    }
+    match (args.get(1), args.get(2), args.get(3)) {
+        (Some(&name), None, None) => {
+            let Some(canonical) = db.resolve_account(name).map(str::to_string) else {
+                ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't registered."));
+                return;
+            };
+            let Some(email) = db.account(&canonical).and_then(|a| a.email.clone()) else {
+                ctx.notice(me, from.uid, "That account has no email on file, so it can't be reset.");
+                return;
+            };
+            let code = db.issue_reset_code(&canonical);
+            ctx.send_email(
+                email,
+                format!("Password reset for {canonical}"),
+                format!("Your password reset code for {canonical} is: {code}\nIt expires in 15 minutes. Reset with:\n  /msg NickServ RESETPASS {canonical} {code} <newpassword>"),
+            );
+            ctx.notice(me, from.uid, format!("A reset code has been emailed to the address on file for \x02{canonical}\x02."));
+        }
+        (Some(&name), Some(&code), Some(&newpass)) => {
+            let Some(canonical) = db.resolve_account(name).map(str::to_string) else {
+                ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't registered."));
+                return;
+            };
+            if !db.take_reset_code(&canonical, code) {
+                ctx.notice(me, from.uid, "Invalid or expired reset code.");
+                return;
+            }
+            ctx.defer_password(&canonical, newpass, me, from.uid);
+        }
+        _ => ctx.notice(me, from.uid, "Syntax: RESETPASS <account> [<code> <newpassword>]"),
+    }
+}

modules/protocol/inspircd.rs

@@ -281,7 +281,7 @@ impl Protocol for InspIrcd {
             }
             NetAction::Raw(s) => vec![s.clone()],
             // Internal: the link layer handles these before serialization.
-            NetAction::DeferRegister { .. } | NetAction::DeferPassword { .. } => vec![],
+            NetAction::DeferRegister { .. } | NetAction::DeferPassword { .. } | NetAction::SendEmail { .. } => vec![],
         }
     }
 

modules/protocol/mod.rs

@@ -71,6 +71,9 @@ pub enum NetAction {
     // Internal only: a password change awaiting the same off-thread derivation.
     // The link layer derives, then calls Engine::complete_password_change.
     DeferPassword { account: String, password: String, agent: String, uid: String },
+    // Internal only: send an email. The link layer pipes it to the configured
+    // mail command off-thread; never serialized to the ircd.
+    SendEmail { to: String, subject: String, body: String },
 }
 
 // How to answer a registration once its credentials have been derived.