nickserv: account SUSPEND / UNSUSPEND (oper-gated)

Freezes an account (data kept, login blocked) gated on the typed Priv::Suspend.
A typed Suspension{by,reason,ts,expires} on the account, folded through the
event log (persists, replays, federates) -- no stringly Extensible/Checker like
Anope. Expiry is evaluated lazily at check-time, so there is no expiry timer.
Blocks IDENTIFY and all SASL mechanisms (via one sasl_login gate); logs out any
live sessions on suspend; the login refusal names who/when/why and when it
lifts. Shown in INFO to owner/auspex. Data + full-flow tests.

nickserv/src/identify.rs

@@ -1,4 +1,4 @@
-use fedserv_api::Store;
+use fedserv_api::{human_time, Store};
 use fedserv_api::{Sender, ServiceCtx};
 
 // IDENTIFY [account] <password>: log in. The account defaults to the current
@@ -17,6 +17,27 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
         ctx.notice(me, from.uid, format!("\x02{account_name}\x02 isn't registered."));
         return;
     }
+    // A suspended account can't be logged into (checked before the password so it
+    // doesn't reveal whether the password was right). Tell them who, when and why,
+    // and when it lifts, so they know what happened and who to reach.
+    if let Some(acc) = db.resolve_account(account_name).map(str::to_string) {
+        if db.is_suspended(&acc) {
+            if let Some(s) = db.suspension(&acc) {
+                let mut msg = format!("\x02{acc}\x02 is suspended, so you can't log in to it right now. It was suspended by \x02{}\x02 on {}", s.by, human_time(s.ts));
+                if s.reason.trim().is_empty() {
+                    msg.push('.');
+                } else {
+                    msg.push_str(&format!(" — reason: {}", s.reason));
+                }
+                if let Some(exp) = s.expires {
+                    msg.push_str(&format!(" The suspension is due to lift on {}.", human_time(exp)));
+                }
+                msg.push_str(" If you think this is a mistake, please contact the network staff.");
+                ctx.notice(me, from.uid, msg);
+            }
+            return;
+        }
+    }
     // Refuse while throttled, so a password can't be brute-forced.
     if let Some(secs) = db.auth_lockout(account_name) {
         ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));

nickserv/src/info.rs

@@ -14,6 +14,9 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
     ctx.notice(me, from.uid, format!("  Registered : {}", human_time(acct.ts)));
     let is_owner = from.account == Some(acct.name.as_str());
     if is_owner || from.privs.has(Priv::Auspex) {
+        if let Some(s) = db.suspension(&acct.name) {
+            ctx.notice(me, from.uid, format!("  Suspended  : by \x02{}\x02 — {}", s.by, s.reason));
+        }
         match &acct.email {
             Some(email) if acct.verified => ctx.notice(me, from.uid, format!("  Email      : {email}")),
             Some(email) => ctx.notice(me, from.uid, format!("  Email      : {email} (unconfirmed)")),

nickserv/src/lib.rs

@@ -32,6 +32,8 @@ mod resetpass;
 mod confirm;
 #[path = "ajoin.rs"]
 mod ajoin;
+#[path = "suspend.rs"]
+mod suspend;
 #[path = "password.rs"]
 mod password;
 
@@ -75,7 +77,9 @@ impl Service for NickServ {
             Some("RESETPASS") => resetpass::handle(me, from, args, ctx, db),
             Some("CONFIRM") => confirm::handle(me, from, args, ctx, db),
             Some("AJOIN") => ajoin::handle(me, from, args, ctx, db),
-            Some("HELP") => ctx.notice(me, from.uid, "NickServ looks after your nickname. Commands: \x02REGISTER\x02 <password> [email], \x02IDENTIFY\x02 [account] <password>, \x02INFO\x02 [account], \x02ALIST\x02, \x02GROUP\x02/\x02GLIST\x02/\x02UNGROUP\x02, \x02GHOST\x02 <nick> [password], \x02SET\x02 PASSWORD|EMAIL, \x02AJOIN\x02 ADD|DEL|LIST, \x02RESETPASS\x02 <account>, \x02CONFIRM\x02 <code>, \x02DROP\x02 <password>, \x02LOGOUT\x02, \x02CERT\x02 ADD|DEL|LIST <password> [fingerprint]."),
+            Some("SUSPEND") => suspend::handle(me, from, args, ctx, net, db, true),
+            Some("UNSUSPEND") => suspend::handle(me, from, args, ctx, net, db, false),
+            Some("HELP") => ctx.notice(me, from.uid, "NickServ looks after your nickname. Commands: \x02REGISTER\x02 <password> [email], \x02IDENTIFY\x02 [account] <password>, \x02INFO\x02 [account], \x02ALIST\x02, \x02GROUP\x02/\x02GLIST\x02/\x02UNGROUP\x02, \x02GHOST\x02 <nick> [password], \x02SET\x02 PASSWORD|EMAIL, \x02AJOIN\x02 ADD|DEL|LIST, \x02RESETPASS\x02 <account>, \x02CONFIRM\x02 <code>, \x02DROP\x02 <password>, \x02LOGOUT\x02, \x02CERT\x02 ADD|DEL|LIST <password> [fingerprint]. Operators also have \x02SUSPEND\x02/\x02UNSUSPEND\x02."),
             Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")),
             None => {}
         }

nickserv/src/suspend.rs

@@ -0,0 +1,67 @@
+use fedserv_api::{NetView, Priv, Sender, ServiceCtx, Store};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+// SUSPEND <account> [+expiry] [reason] / UNSUSPEND <account>: freeze or unfreeze
+// an account. Its data is kept but it can't be logged into. Oper-only
+// (Priv::Suspend). `suspending` selects SUSPEND vs UNSUSPEND.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store, suspending: bool) {
+    if !from.privs.has(Priv::Suspend) {
+        ctx.notice(me, from.uid, "Access denied — that command is for services operators.");
+        return;
+    }
+    let Some(&target) = args.get(1) else {
+        let syntax = if suspending { "Syntax: SUSPEND <account> [+expiry] [reason]" } else { "Syntax: UNSUSPEND <account>" };
+        ctx.notice(me, from.uid, syntax);
+        return;
+    };
+    let Some(account) = db.resolve_account(target).map(str::to_string) else {
+        ctx.notice(me, from.uid, format!("\x02{target}\x02 isn't registered."));
+        return;
+    };
+
+    if !suspending {
+        match db.unsuspend_account(&account) {
+            Ok(true) => ctx.notice(me, from.uid, format!("\x02{account}\x02 is no longer suspended.")),
+            Ok(false) => ctx.notice(me, from.uid, format!("\x02{account}\x02 isn't suspended.")),
+            Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+        }
+        return;
+    }
+
+    // Optional leading +expiry (e.g. +30d), then a free-text reason.
+    let mut rest = &args[2..];
+    let expires = rest.first().and_then(|t| t.strip_prefix('+')).and_then(parse_duration).map(|secs| now_unix() + secs);
+    if expires.is_some() {
+        rest = &rest[1..];
+    }
+    let reason = if rest.is_empty() { "No reason given.".to_string() } else { rest.join(" ") };
+    let by = from.account.unwrap_or(from.nick);
+    match db.suspend_account(&account, by, &reason, expires) {
+        Ok(()) => {
+            // Log out every session currently identified to the account.
+            for uid in net.uids_logged_into(&account) {
+                ctx.logout(&uid);
+            }
+            let expiry = if expires.is_some() { " (with expiry)" } else { "" };
+            ctx.notice(me, from.uid, format!("\x02{account}\x02 is now suspended{expiry}."));
+        }
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}
+
+// Parse a duration like "30d", "12h", "45m", "90s", or a bare number of seconds.
+fn parse_duration(s: &str) -> Option<u64> {
+    let (num, mult) = match s.chars().last()? {
+        'd' | 'D' => (&s[..s.len() - 1], 86_400),
+        'h' | 'H' => (&s[..s.len() - 1], 3_600),
+        'm' | 'M' => (&s[..s.len() - 1], 60),
+        's' | 'S' => (&s[..s.len() - 1], 1),
+        c if c.is_ascii_digit() => (s, 1),
+        _ => return None,
+    };
+    num.parse::<u64>().ok().map(|n| n * mult)
+}
+
+fn now_unix() -> u64 {
+    SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
+}