OperServ: OPER — runtime operator management
OPER ADD <account> <priv[,priv]> / DEL <account> / LIST grants or revokes services-operator privileges (auspex, suspend, admin) at runtime, without editing config and restarting. Runtime grants are event-sourced (Global, so they federate and survive restart) and UNIONED with the declarative [[oper]] config at the engine, so either source makes an account an operator; a config oper can't be revoked here. Admin-only. Factored the privilege-name parsing into Privs::from_names (+ names/union) so config loading and runtime grants share one definition.
This commit is contained in:
parent
e45eab2cd6
commit
a67409e0d3
7 changed files with 217 additions and 17 deletions
|
|
@ -80,19 +80,9 @@ pub struct Oper {
|
|||
impl Config {
|
||||
// The account -> privileges table (casefolded keys) built from [[oper]].
|
||||
pub fn opers(&self) -> std::collections::HashMap<String, fedserv_api::Privs> {
|
||||
use fedserv_api::{Priv, Privs};
|
||||
let mut map = std::collections::HashMap::new();
|
||||
for o in &self.oper {
|
||||
let mut privs = Privs::default();
|
||||
for p in &o.privs {
|
||||
match p.to_ascii_lowercase().as_str() {
|
||||
"auspex" => privs = privs.with(Priv::Auspex),
|
||||
"suspend" => privs = privs.with(Priv::Suspend),
|
||||
"admin" => privs = privs.with(Priv::Admin),
|
||||
other => tracing::warn!(privilege = other, account = %o.account, "unknown oper privilege, ignoring"),
|
||||
}
|
||||
}
|
||||
map.insert(o.account.to_ascii_lowercase(), privs);
|
||||
map.insert(o.account.to_ascii_lowercase(), fedserv_api::Privs::from_names(&o.privs));
|
||||
}
|
||||
map
|
||||
}
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ use super::scram::{self, Hash};
|
|||
// fedserv-api SDK crate; re-exported so the engine keeps naming them locally and
|
||||
// modules importing `crate::engine::db::{ChanError, ...}` are unaffected.
|
||||
pub use fedserv_api::{
|
||||
AccountView, AjoinView, AkillView, BotView, IgnoreView, MemoView, NewsView, SuspensionView, ChanAccessView, ChanAkickView, ChanError, ChanSetting, ChannelView, CertError, CodeKind, Kicker, RegError, Store, TriggerView, VhostView,
|
||||
AccountView, AjoinView, AkillView, BotView, IgnoreView, MemoView, NewsView, Privs, SuspensionView, ChanAccessView, ChanAkickView, ChanError, ChanSetting, ChannelView, CertError, CodeKind, Kicker, RegError, Store, TriggerView, VhostView,
|
||||
};
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
|
|
@ -188,6 +188,9 @@ pub enum Event {
|
|||
// News items (OperServ NEWS). The stable `id` makes deletion order-independent.
|
||||
NewsAdded { id: u64, kind: String, text: String, setter: String, ts: u64 },
|
||||
NewsDeleted { id: u64 },
|
||||
// Runtime operator grants (OperServ OPER).
|
||||
OperGranted { account: String, privs: Vec<String> },
|
||||
OperRevoked { account: String },
|
||||
// Network bans (OperServ AKILL / SQLINE). Global: a ban covers the whole
|
||||
// network, so every node holds the list and re-applies it at burst. `kind`
|
||||
// is the ircd X-line type and defaults to "G" for records predating it.
|
||||
|
|
@ -248,7 +251,9 @@ impl Event {
|
|||
| Event::AkillAdded { .. }
|
||||
| Event::AkillRemoved { .. }
|
||||
| Event::NewsAdded { .. }
|
||||
| Event::NewsDeleted { .. } => Scope::Global,
|
||||
| Event::NewsDeleted { .. }
|
||||
| Event::OperGranted { .. }
|
||||
| Event::OperRevoked { .. } => Scope::Global,
|
||||
Event::ChannelRegistered { .. }
|
||||
| Event::ChannelDropped { .. }
|
||||
| Event::ChannelMlock { .. }
|
||||
|
|
@ -359,6 +364,9 @@ pub struct NetData {
|
|||
pub akills: Vec<Akill>,
|
||||
pub news: Vec<News>,
|
||||
pub news_seq: u64,
|
||||
// Runtime services operators (OperServ OPER), casefolded account -> privilege
|
||||
// names. Merged with the declarative [[oper]] config at the engine.
|
||||
pub opers: HashMap<String, Vec<String>>,
|
||||
}
|
||||
|
||||
// A memo left for an account (MemoServ).
|
||||
|
|
@ -1084,6 +1092,9 @@ impl Db {
|
|||
for n in &self.net.news {
|
||||
snapshot.push(Event::NewsAdded { id: n.id, kind: n.kind.clone(), text: n.text.clone(), setter: n.setter.clone(), ts: n.ts });
|
||||
}
|
||||
for (account, privs) in &self.net.opers {
|
||||
snapshot.push(Event::OperGranted { account: account.clone(), privs: privs.clone() });
|
||||
}
|
||||
self.log.compact(snapshot)?;
|
||||
tracing::info!(before, after = self.log.len(), "compacted event log");
|
||||
Ok(())
|
||||
|
|
@ -1884,6 +1895,33 @@ impl Db {
|
|||
.collect()
|
||||
}
|
||||
|
||||
/// Grant runtime operator privileges to an account (replaces any existing).
|
||||
pub fn oper_grant(&mut self, account: &str, privs: Vec<String>) {
|
||||
let _ = self.log.append(Event::OperGranted { account: account.to_string(), privs: privs.clone() });
|
||||
self.net.opers.insert(key(account), privs);
|
||||
}
|
||||
|
||||
/// Revoke a runtime operator grant. Returns whether one existed.
|
||||
pub fn oper_revoke(&mut self, account: &str) -> bool {
|
||||
if !self.net.opers.contains_key(&key(account)) {
|
||||
return false;
|
||||
}
|
||||
let _ = self.log.append(Event::OperRevoked { account: account.to_string() });
|
||||
self.net.opers.remove(&key(account));
|
||||
true
|
||||
}
|
||||
|
||||
/// The runtime operator grants, as (account, privilege-names).
|
||||
pub fn opers_list(&self) -> Vec<(String, Vec<String>)> {
|
||||
self.net.opers.iter().map(|(a, p)| (a.clone(), p.clone())).collect()
|
||||
}
|
||||
|
||||
/// The runtime privileges granted to an account, if any (config opers are
|
||||
/// merged in separately by the engine).
|
||||
pub fn oper_privs_of(&self, account: &str) -> Option<Privs> {
|
||||
self.net.opers.get(&key(account)).map(|names| Privs::from_names(names))
|
||||
}
|
||||
|
||||
/// Add a news item of `kind` ("logon"/"oper"). Returns its stable id.
|
||||
pub fn news_add(&mut self, kind: &str, text: &str, setter: &str) -> u64 {
|
||||
let id = self.net.news_seq;
|
||||
|
|
@ -2892,6 +2930,12 @@ fn apply(accounts: &mut HashMap<String, Account>, channels: &mut HashMap<String,
|
|||
Event::NewsDeleted { id } => {
|
||||
net.news.retain(|n| n.id != id);
|
||||
}
|
||||
Event::OperGranted { account, privs } => {
|
||||
net.opers.insert(key(&account), privs);
|
||||
}
|
||||
Event::OperRevoked { account } => {
|
||||
net.opers.remove(&key(&account));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -3163,6 +3207,15 @@ impl Store for Db {
|
|||
fn news(&self, kind: &str) -> Vec<NewsView> {
|
||||
Db::news(self, kind)
|
||||
}
|
||||
fn oper_grant(&mut self, account: &str, privs: Vec<String>) {
|
||||
Db::oper_grant(self, account, privs)
|
||||
}
|
||||
fn oper_revoke(&mut self, account: &str) -> bool {
|
||||
Db::oper_revoke(self, account)
|
||||
}
|
||||
fn opers_list(&self) -> Vec<(String, Vec<String>)> {
|
||||
Db::opers_list(self)
|
||||
}
|
||||
fn register_channel(&mut self, name: &str, founder: &str) -> Result<(), ChanError> {
|
||||
Db::register_channel(self, name, founder)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -247,9 +247,15 @@ impl Engine {
|
|||
self.opers = opers;
|
||||
}
|
||||
|
||||
// The privileges an account holds, empty if it is not an oper.
|
||||
// The privileges an account holds, empty if it is not an oper. The declarative
|
||||
// config opers and the runtime OPER grants are unioned, so either source can
|
||||
// make an account an operator.
|
||||
fn oper_privs(&self, account: &str) -> Privs {
|
||||
self.opers.get(&account.to_ascii_lowercase()).copied().unwrap_or_default()
|
||||
let config = self.opers.get(&account.to_ascii_lowercase()).copied().unwrap_or_default();
|
||||
match self.db.oper_privs_of(account) {
|
||||
Some(runtime) => config.union(runtime),
|
||||
None => config,
|
||||
}
|
||||
}
|
||||
|
||||
// Our services SID, needed to mint valid bot uids.
|
||||
|
|
@ -1604,6 +1610,8 @@ fn audit_summary(event: &db::Event) -> Option<String> {
|
|||
},
|
||||
NewsAdded { kind, .. } => format!("added a \x02{kind}\x02 news item"),
|
||||
NewsDeleted { .. } => "removed a news item".to_string(),
|
||||
OperGranted { account, privs } => format!("granted \x02{account}\x02 operator ({})", privs.join(", ")),
|
||||
OperRevoked { account } => format!("revoked \x02{account}\x02's operator access"),
|
||||
AccountNoExpire { account, on } => {
|
||||
let verb = if *on { "pinned" } else { "unpinned" };
|
||||
format!("{verb} account \x02{account}\x02 against expiry")
|
||||
|
|
@ -4046,6 +4054,52 @@ mod tests {
|
|||
}
|
||||
}
|
||||
|
||||
// OperServ OPER: a runtime grant actually confers privileges (merged with the
|
||||
// config opers), and revoking removes them. Admin-only.
|
||||
#[test]
|
||||
fn operserv_oper_grants_runtime_privileges() {
|
||||
use fedserv_operserv::OperServ;
|
||||
let path = std::env::temp_dir().join("fedserv-osoper.jsonl");
|
||||
let _ = std::fs::remove_file(&path);
|
||||
let mut db = Db::open(&path, "42S");
|
||||
db.scram_iterations = 4096;
|
||||
db.register("staff", "password1", None).unwrap();
|
||||
db.register("alice", "password1", None).unwrap();
|
||||
let mut e = Engine::new(
|
||||
vec![
|
||||
Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
|
||||
Box::new(OperServ { uid: "42SAAAAAH".into() }),
|
||||
],
|
||||
db,
|
||||
);
|
||||
e.set_sid("42S".into());
|
||||
let mut opers = std::collections::HashMap::new();
|
||||
opers.insert("staff".to_string(), Privs::default().with(fedserv_api::Priv::Admin));
|
||||
e.set_opers(opers);
|
||||
let os = |e: &mut Engine, uid: &str, t: &str| e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAH".into(), text: t.into() });
|
||||
let denied = |out: &[NetAction]| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("Access denied")));
|
||||
|
||||
e.handle(NetEvent::UserConnect { uid: "000AAAAAS".into(), nick: "staff".into(), host: "h".into() });
|
||||
e.handle(NetEvent::Privmsg { from: "000AAAAAS".into(), to: "42SAAAAAA".into(), text: "IDENTIFY password1".into() });
|
||||
e.handle(NetEvent::UserConnect { uid: "000AAAAAL".into(), nick: "alice".into(), host: "h".into() });
|
||||
e.handle(NetEvent::Privmsg { from: "000AAAAAL".into(), to: "42SAAAAAA".into(), text: "IDENTIFY password1".into() });
|
||||
|
||||
// Before the grant, alice is a plain user — OperServ shuts her out.
|
||||
assert!(denied(&os(&mut e, "000AAAAAL", "STATS")), "alice not an oper yet");
|
||||
|
||||
// Grant alice admin at runtime; now the same command works.
|
||||
os(&mut e, "000AAAAAS", "OPER ADD alice admin");
|
||||
assert!(!denied(&os(&mut e, "000AAAAAL", "STATS")), "alice is an oper after the grant");
|
||||
assert!(os(&mut e, "000AAAAAS", "OPER LIST").iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("alice"))), "listed");
|
||||
|
||||
// Revoke; alice loses access again.
|
||||
os(&mut e, "000AAAAAS", "OPER DEL alice");
|
||||
assert!(denied(&os(&mut e, "000AAAAAL", "STATS")), "alice lost access after revoke");
|
||||
|
||||
// A config oper is not a runtime oper, so it can't be DEL'd here.
|
||||
assert!(os(&mut e, "000AAAAAS", "OPER DEL staff").iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("isn't a runtime operator"))), "config oper untouched");
|
||||
}
|
||||
|
||||
// OperServ NEWS: logon news greets everyone on connect, oper news greets an
|
||||
// operator on login; ADD/DEL/LIST are admin-only.
|
||||
#[test]
|
||||
|
|
|
|||
|
|
@ -172,7 +172,9 @@ fn to_wire(entry: &LogEntry) -> Option<ReplicationEvent> {
|
|||
| Event::AccountOperNoteSet { .. }
|
||||
| Event::ChannelOperNoteSet { .. }
|
||||
| Event::NewsAdded { .. }
|
||||
| Event::NewsDeleted { .. } => return None,
|
||||
| Event::NewsDeleted { .. }
|
||||
| Event::OperGranted { .. }
|
||||
| Event::OperRevoked { .. } => return None,
|
||||
};
|
||||
Some(ReplicationEvent { origin: entry.origin().to_string(), seq: entry.seq(), lamport: entry.lamport(), kind: Some(kind) })
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue