chanserv: SET SECUREOPS (strip ops from users without access)

When SECUREOPS is on, a user who gains channel-operator status without op-level
access is immediately deopped. Enforced in the engine's ChannelOp hook (manual
FMODE +o) and the Join hook (FJOIN prefix ops), sourced from ChanServ. Same
typed-settings path; shown in INFO; engine test covers on and off.

api/src/lib.rs

@@ -295,6 +295,7 @@ pub struct ChannelView {
     pub signkick: bool,
     pub private: bool,
     pub peace: bool,
+    pub secureops: bool,
 }
 
 // A single ChanServ SET option, named for the typed `set_channel_setting` call.
@@ -303,6 +304,7 @@ pub enum ChanSetting {
     SignKick,
     Private,
     Peace,
+    SecureOps,
 }
 
 impl ChannelView {

chanserv/src/lib.rs

@@ -105,6 +105,7 @@ impl Service for ChanServ {
                         if info.signkick { opts.push("SIGNKICK"); }
                         if info.private { opts.push("PRIVATE"); }
                         if info.peace { opts.push("PEACE"); }
+                        if info.secureops { opts.push("SECUREOPS"); }
                         if !opts.is_empty() {
                             ctx.notice(me, from.uid, format!("  Options    : {}", opts.join(", ")));
                         }

chanserv/src/set.rs

@@ -42,7 +42,8 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
         Some("SIGNKICK") => toggle(me, from, ctx, db, chan, ChanSetting::SignKick, args.get(3).copied(), "SIGNKICK"),
         Some("PRIVATE") => toggle(me, from, ctx, db, chan, ChanSetting::Private, args.get(3).copied(), "PRIVATE"),
         Some("PEACE") => toggle(me, from, ctx, db, chan, ChanSetting::Peace, args.get(3).copied(), "PEACE"),
-        _ => ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER <account> | DESC <text> | SIGNKICK {ON|OFF} | PRIVATE {ON|OFF} | PEACE {ON|OFF}"),
+        Some("SECUREOPS") => toggle(me, from, ctx, db, chan, ChanSetting::SecureOps, args.get(3).copied(), "SECUREOPS"),
+        _ => ctx.notice(me, from.uid, "Syntax: SET <#channel> FOUNDER <account> | DESC <text> | SIGNKICK {ON|OFF} | PRIVATE {ON|OFF} | PEACE {ON|OFF} | SECUREOPS {ON|OFF}"),
     }
 }
 

src/engine/db.rs

@@ -160,6 +160,9 @@ pub struct ChanSettings {
     // Forbid using ChanServ to act against someone with equal-or-higher access.
     #[serde(default)]
     pub peace: bool,
+    // Strip channel-operator status from anyone without op-level access.
+    #[serde(default)]
+    pub secureops: bool,
 }
 
 // A registered channel and who owns it.
@@ -589,7 +592,7 @@ impl Db {
             if !c.entrymsg.is_empty() {
                 snapshot.push(Event::ChannelEntryMsgSet { channel: c.name.clone(), msg: c.entrymsg.clone() });
             }
-            if c.settings.signkick || c.settings.private || c.settings.peace {
+            if c.settings.signkick || c.settings.private || c.settings.peace || c.settings.secureops {
                 snapshot.push(Event::ChannelSettingsSet { channel: c.name.clone(), settings: c.settings });
             }
         }
@@ -1119,6 +1122,7 @@ impl Db {
             ChanSetting::SignKick => settings.signkick = on,
             ChanSetting::Private => settings.private = on,
             ChanSetting::Peace => settings.peace = on,
+            ChanSetting::SecureOps => settings.secureops = on,
         }
         self.log
             .append(Event::ChannelSettingsSet { channel: channel.to_string(), settings })
@@ -1484,6 +1488,7 @@ fn channel_view(c: &ChannelInfo) -> ChannelView {
         signkick: c.settings.signkick,
         private: c.settings.private,
         peace: c.settings.peace,
+        secureops: c.settings.secureops,
     }
 }
 

src/engine/mod.rs

@@ -426,6 +426,11 @@ impl Engine {
                 let mode = account.as_deref().and_then(|a| self.db.channel(&channel).and_then(|c| c.join_mode(a)));
                 let entrymsg = self.db.channel(&channel).map(|c| c.entrymsg.clone()).filter(|m| !m.is_empty());
                 let mut out = Vec::new();
+                // SECUREOPS: a user who arrives opped (FJOIN prefix) but lacks op-level
+                // access loses it, unless we're about to grant it to them anyway.
+                if op && mode != Some("+o") && self.db.channel(&channel).is_some_and(|c| c.settings.secureops) {
+                    out.push(NetAction::ChannelMode { from: from.clone(), channel: channel.clone(), modes: format!("-o {uid}") });
+                }
                 match mode {
                     // A user with access gets their status mode, plus the entry message.
                     Some(m) => {
@@ -465,6 +470,15 @@ impl Engine {
             }
             NetEvent::ChannelOp { channel, uid, op } => {
                 self.network.set_op(&channel, &uid, op);
+                // SECUREOPS: a user who gains +o without op-level access loses it.
+                if op {
+                    if let Some(c) = self.db.channel(&channel) {
+                        if c.settings.secureops && !self.network.account_of(&uid).is_some_and(|a| c.join_mode(a) == Some("+o")) {
+                            let from = self.chan_service.clone().unwrap_or_default();
+                            return vec![NetAction::ChannelMode { from, channel, modes: format!("-o {uid}") }];
+                        }
+                    }
+                }
                 Vec::new()
             }
             NetEvent::ChannelKey { channel, key } => {
@@ -1469,6 +1483,29 @@ mod tests {
         assert!(missing.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("isn't registered"))), "{missing:?}");
     }
 
+    // SECUREOPS strips channel-operator status from a user without op-level access.
+    #[test]
+    fn secureops_strips_op_from_a_user_without_access() {
+        use fedserv_chanserv::ChanServ;
+        let path = std::env::temp_dir().join("fedserv-secureops.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.register_channel("#c", "boss").unwrap();
+        db.set_channel_setting("#c", db::ChanSetting::SecureOps, true).unwrap();
+        let mut e = Engine::new(vec![Box::new(ChanServ { uid: "42SAAAAAB".into() })], db);
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "rando".into(), host: "h".into() });
+        // rando holds no access; being opped triggers a -o from ChanServ.
+        let out = e.handle(NetEvent::ChannelOp { channel: "#c".into(), uid: "000AAAAAB".into(), op: true });
+        assert!(
+            out.iter().any(|a| matches!(a, NetAction::ChannelMode { modes, .. } if modes == "-o 000AAAAAB")),
+            "SECUREOPS strips the op: {out:?}"
+        );
+        // With SECUREOPS off, the same op is left alone.
+        e.db.set_channel_setting("#c", db::ChanSetting::SecureOps, false).unwrap();
+        let out = e.handle(NetEvent::ChannelOp { channel: "#c".into(), uid: "000AAAAAB".into(), op: true });
+        assert!(out.is_empty(), "no enforcement when SECUREOPS is off: {out:?}");
+    }
+
     // ChanServ: registration needs identification, INFO shows the founder, and
     // only the founder can drop.
     #[test]