Add SECUREVOICES: strip voice from users without channel access

src/engine/db/channel.rs

@@ -274,6 +274,7 @@ impl Db {
             ChanSetting::Private => settings.private = on,
             ChanSetting::Peace => settings.peace = on,
             ChanSetting::SecureOps => settings.secureops = on,
+            ChanSetting::SecureVoices => settings.securevoices = on,
             ChanSetting::Restricted => settings.restricted = on,
             ChanSetting::AutoOp => settings.noautoop = !on, // stored inverted (default on)
             ChanSetting::KeepTopic => settings.keeptopic = on,

src/engine/db/mod.rs

@@ -428,6 +428,9 @@ pub struct ChanSettings {
     // Strip channel-operator status from anyone without op-level access.
     #[serde(default)]
     pub secureops: bool,
+    // Strip voice from anyone without voice-level (or higher) access.
+    #[serde(default)]
+    pub securevoices: bool,
     // Kick anyone without channel access when they join.
     #[serde(default)]
     pub restricted: bool,

src/engine/db/store.rs

@@ -653,6 +653,7 @@ fn channel_view(c: &ChannelInfo) -> ChannelView {
         private: c.settings.private,
         peace: c.settings.peace,
         secureops: c.settings.secureops,
+        securevoices: c.settings.securevoices,
         keeptopic: c.settings.keeptopic,
         topiclock: c.settings.topiclock,
         topic: c.topic.clone(),

src/engine/mod.rs

@@ -1538,6 +1538,17 @@ impl Engine {
             }
             NetEvent::ChannelVoice { channel, uid, voice } => {
                 self.network.set_voice(&channel, &uid, voice);
+                // SECUREVOICES: a user who gains +v without voice-level (or higher)
+                // access loses it. A services bot is staff, never a member.
+                let is_bot = self.bot_uids.values().any(|b| b == &uid);
+                if voice && !is_bot {
+                    if let Some(c) = self.db.channel(&channel) {
+                        if c.settings.securevoices && !self.network.account_of(&uid).is_some_and(|a| c.join_mode(a).is_some()) {
+                            let from = self.chan_service.clone().unwrap_or_default();
+                            return self.finish(out, vec![NetAction::ChannelMode { from, channel, modes: format!("-v {uid}") }]);
+                        }
+                    }
+                }
                 Vec::new()
             }
             NetEvent::ChannelKey { channel, key } => {

src/engine/tests.rs

@@ -5286,6 +5286,32 @@
         assert!(out.iter().any(|a| matches!(a, NetAction::SetHost { uid, host } if uid == "000AAAAAB" && host == "cloak.host")), "logout restores the cloak: {out:?}");
     }
 
+    // SECUREVOICES strips voice from a user with no channel access, but leaves an
+    // access holder's voice alone.
+    #[test]
+    fn securevoices_strips_voice_from_non_access_users() {
+        use echo_chanserv::ChanServ;
+        let path = std::env::temp_dir().join("echo-securevoices.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("alice", "sesame", None).unwrap();
+        db.register_channel("#c", "alice").unwrap();
+        let ns = NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 };
+        let cs = ChanServ { uid: "42SAAAAAB".into() };
+        let mut e = Engine::new(vec![Box::new(ns), Box::new(cs)], db);
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "h".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAB".into(), text: "SET #c SECUREVOICES ON".into() });
+
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAC".into(), nick: "bob".into(), host: "h".into(), ip: "0.0.0.0".into() });
+        let out = e.handle(NetEvent::ChannelVoice { channel: "#c".into(), uid: "000AAAAAC".into(), voice: true });
+        assert!(out.iter().any(|a| matches!(a, NetAction::ChannelMode { channel, modes, .. } if channel == "#c" && modes == "-v 000AAAAAC")), "non-access voice stripped: {out:?}");
+
+        let out = e.handle(NetEvent::ChannelVoice { channel: "#c".into(), uid: "000AAAAAB".into(), voice: true });
+        assert!(!out.iter().any(|a| matches!(a, NetAction::ChannelMode { modes, .. } if modes.starts_with("-v"))), "founder keeps voice: {out:?}");
+    }
+
     // ChanServ SET: description and founder transfer, founder-gated.
     #[test]
     fn chanserv_set() {

src/migrate.rs

@@ -273,6 +273,7 @@ pub fn import_anope(anope_path: &str, out_path: &str, node: &str) -> std::io::Re
             private: any(&["PRIVATE", "CS_PRIVATE"]),
             peace: any(&["PEACE"]),
             secureops: any(&["SECUREOPS", "CS_SECUREOPS"]),
+            securevoices: false, // no Anope equivalent
             restricted: any(&["RESTRICTED", "CS_RESTRICTED"]),
             noautoop: any(&["NOAUTOOP", "CS_NOAUTOOP"]),
             keeptopic: any(&["KEEPTOPIC"]),