From d2c6448c6b48cf1510dfa837bea98372b0e64bcf Mon Sep 17 00:00:00 2001 From: Jean Date: Mon, 13 Jul 2026 03:14:43 +0000 Subject: [PATCH] chanserv: SET SECUREOPS (strip ops from users without access) When SECUREOPS is on, a user who gains channel-operator status without op-level access is immediately deopped. Enforced in the engine's ChannelOp hook (manual FMODE +o) and the Join hook (FJOIN prefix ops), sourced from ChanServ. Same typed-settings path; shown in INFO; engine test covers on and off. --- api/src/lib.rs | 2 ++ chanserv/src/lib.rs | 1 + chanserv/src/set.rs | 3 ++- src/engine/db.rs | 7 ++++++- src/engine/mod.rs | 37 +++++++++++++++++++++++++++++++++++++ 5 files changed, 48 insertions(+), 2 deletions(-) diff --git a/api/src/lib.rs b/api/src/lib.rs index 2a45804..90b60b3 100644 --- a/api/src/lib.rs +++ b/api/src/lib.rs @@ -295,6 +295,7 @@ pub struct ChannelView { pub signkick: bool, pub private: bool, pub peace: bool, + pub secureops: bool, } // A single ChanServ SET option, named for the typed `set_channel_setting` call. @@ -303,6 +304,7 @@ pub enum ChanSetting { SignKick, Private, Peace, + SecureOps, } impl ChannelView { diff --git a/chanserv/src/lib.rs b/chanserv/src/lib.rs index 56f15bd..0fa4df8 100644 --- a/chanserv/src/lib.rs +++ b/chanserv/src/lib.rs @@ -105,6 +105,7 @@ impl Service for ChanServ { if info.signkick { opts.push("SIGNKICK"); } if info.private { opts.push("PRIVATE"); } if info.peace { opts.push("PEACE"); } + if info.secureops { opts.push("SECUREOPS"); } if !opts.is_empty() { ctx.notice(me, from.uid, format!(" Options : {}", opts.join(", "))); } diff --git a/chanserv/src/set.rs b/chanserv/src/set.rs index e77e03d..9c02fe0 100644 --- a/chanserv/src/set.rs +++ b/chanserv/src/set.rs @@ -42,7 +42,8 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: Some("SIGNKICK") => toggle(me, from, ctx, db, chan, ChanSetting::SignKick, args.get(3).copied(), "SIGNKICK"), Some("PRIVATE") => toggle(me, from, ctx, db, chan, ChanSetting::Private, args.get(3).copied(), "PRIVATE"), Some("PEACE") => toggle(me, from, ctx, db, chan, ChanSetting::Peace, args.get(3).copied(), "PEACE"), - _ => ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER | DESC | SIGNKICK {ON|OFF} | PRIVATE {ON|OFF} | PEACE {ON|OFF}"), + Some("SECUREOPS") => toggle(me, from, ctx, db, chan, ChanSetting::SecureOps, args.get(3).copied(), "SECUREOPS"), + _ => ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER | DESC | SIGNKICK {ON|OFF} | PRIVATE {ON|OFF} | PEACE {ON|OFF} | SECUREOPS {ON|OFF}"), } } diff --git a/src/engine/db.rs b/src/engine/db.rs index f8407df..ad6522e 100644 --- a/src/engine/db.rs +++ b/src/engine/db.rs @@ -160,6 +160,9 @@ pub struct ChanSettings { // Forbid using ChanServ to act against someone with equal-or-higher access. #[serde(default)] pub peace: bool, + // Strip channel-operator status from anyone without op-level access. + #[serde(default)] + pub secureops: bool, } // A registered channel and who owns it. @@ -589,7 +592,7 @@ impl Db { if !c.entrymsg.is_empty() { snapshot.push(Event::ChannelEntryMsgSet { channel: c.name.clone(), msg: c.entrymsg.clone() }); } - if c.settings.signkick || c.settings.private || c.settings.peace { + if c.settings.signkick || c.settings.private || c.settings.peace || c.settings.secureops { snapshot.push(Event::ChannelSettingsSet { channel: c.name.clone(), settings: c.settings }); } } @@ -1119,6 +1122,7 @@ impl Db { ChanSetting::SignKick => settings.signkick = on, ChanSetting::Private => settings.private = on, ChanSetting::Peace => settings.peace = on, + ChanSetting::SecureOps => settings.secureops = on, } self.log .append(Event::ChannelSettingsSet { channel: channel.to_string(), settings }) @@ -1484,6 +1488,7 @@ fn channel_view(c: &ChannelInfo) -> ChannelView { signkick: c.settings.signkick, private: c.settings.private, peace: c.settings.peace, + secureops: c.settings.secureops, } } diff --git a/src/engine/mod.rs b/src/engine/mod.rs index 828e23e..3acd184 100644 --- a/src/engine/mod.rs +++ b/src/engine/mod.rs @@ -426,6 +426,11 @@ impl Engine { let mode = account.as_deref().and_then(|a| self.db.channel(&channel).and_then(|c| c.join_mode(a))); let entrymsg = self.db.channel(&channel).map(|c| c.entrymsg.clone()).filter(|m| !m.is_empty()); let mut out = Vec::new(); + // SECUREOPS: a user who arrives opped (FJOIN prefix) but lacks op-level + // access loses it, unless we're about to grant it to them anyway. + if op && mode != Some("+o") && self.db.channel(&channel).is_some_and(|c| c.settings.secureops) { + out.push(NetAction::ChannelMode { from: from.clone(), channel: channel.clone(), modes: format!("-o {uid}") }); + } match mode { // A user with access gets their status mode, plus the entry message. Some(m) => { @@ -465,6 +470,15 @@ impl Engine { } NetEvent::ChannelOp { channel, uid, op } => { self.network.set_op(&channel, &uid, op); + // SECUREOPS: a user who gains +o without op-level access loses it. + if op { + if let Some(c) = self.db.channel(&channel) { + if c.settings.secureops && !self.network.account_of(&uid).is_some_and(|a| c.join_mode(a) == Some("+o")) { + let from = self.chan_service.clone().unwrap_or_default(); + return vec![NetAction::ChannelMode { from, channel, modes: format!("-o {uid}") }]; + } + } + } Vec::new() } NetEvent::ChannelKey { channel, key } => { @@ -1469,6 +1483,29 @@ mod tests { assert!(missing.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("isn't registered"))), "{missing:?}"); } + // SECUREOPS strips channel-operator status from a user without op-level access. + #[test] + fn secureops_strips_op_from_a_user_without_access() { + use fedserv_chanserv::ChanServ; + let path = std::env::temp_dir().join("fedserv-secureops.jsonl"); + let _ = std::fs::remove_file(&path); + let mut db = Db::open(&path, "42S"); + db.register_channel("#c", "boss").unwrap(); + db.set_channel_setting("#c", db::ChanSetting::SecureOps, true).unwrap(); + let mut e = Engine::new(vec![Box::new(ChanServ { uid: "42SAAAAAB".into() })], db); + e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "rando".into(), host: "h".into() }); + // rando holds no access; being opped triggers a -o from ChanServ. + let out = e.handle(NetEvent::ChannelOp { channel: "#c".into(), uid: "000AAAAAB".into(), op: true }); + assert!( + out.iter().any(|a| matches!(a, NetAction::ChannelMode { modes, .. } if modes == "-o 000AAAAAB")), + "SECUREOPS strips the op: {out:?}" + ); + // With SECUREOPS off, the same op is left alone. + e.db.set_channel_setting("#c", db::ChanSetting::SecureOps, false).unwrap(); + let out = e.handle(NetEvent::ChannelOp { channel: "#c".into(), uid: "000AAAAAB".into(), op: true }); + assert!(out.is_empty(), "no enforcement when SECUREOPS is off: {out:?}"); + } + // ChanServ: registration needs identification, INFO shows the founder, and // only the founder can drop. #[test]