nickserv: add SET (password/email) and DROP

SET PASSWORD changes your password (derived off-thread like register) and
SET EMAIL sets an address. DROP deletes your account, releases and drops
the channels you founded, and logs you out. A dropped account federates,
and each node logs out any local session that was relying on it.

modules/nickserv/drop.rs

@@ -0,0 +1,33 @@
+use crate::engine::db::Db;
+use crate::engine::service::{Sender, ServiceCtx};
+use crate::engine::state::Network;
+
+// DROP <password>: delete your account. Re-authenticates as confirmation, releases
+// and drops the channels you found, and logs you out.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &mut Db) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to be logged in. Identify to NickServ first.");
+        return;
+    };
+    let Some(&password) = args.get(1) else {
+        ctx.notice(me, from.uid, "Syntax: DROP <password>");
+        return;
+    };
+    if db.authenticate(account, password).is_none() {
+        ctx.notice(me, from.uid, "Invalid password.");
+        return;
+    }
+    let channels = db.channels_owned_by(account);
+    for chan in &channels {
+        let _ = db.drop_channel(chan);
+        ctx.channel_mode("", chan, "-r"); // server-sourced: release the registered mode
+    }
+    let _ = db.drop_account(account);
+    for uid in net.uids_logged_into(account) {
+        ctx.logout(&uid);
+    }
+    ctx.notice(me, from.uid, format!("Your account \x02{account}\x02 has been dropped."));
+    if !channels.is_empty() {
+        ctx.notice(me, from.uid, format!("Channels released: {}.", channels.join(", ")));
+    }
+}

modules/nickserv/nickserv.rs

@@ -14,6 +14,10 @@ mod cert;
 mod info;
 #[path = "alist.rs"]
 mod alist;
+#[path = "set.rs"]
+mod set;
+#[path = "drop.rs"]
+mod drop;
 
 pub struct NickServ {
     pub uid: String,
@@ -37,7 +41,7 @@ impl Service for NickServ {
         true
     }
 
-    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, _net: &Network, db: &mut Db) {
+    fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &Network, db: &mut Db) {
         let me = self.uid.as_str();
         match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
             Some("REGISTER") => register::handle(me, from, args, ctx),
@@ -46,7 +50,9 @@ impl Service for NickServ {
             Some("CERT") => cert::handle(me, from, args, ctx, db),
             Some("INFO") => info::handle(me, from, args, ctx, db),
             Some("ALIST") => alist::handle(me, from, ctx, db),
-            Some("HELP") => ctx.notice(me, from.uid, "NickServ looks after your nickname. Commands: \x02REGISTER\x02 <password> [email], \x02IDENTIFY\x02 [account] <password>, \x02INFO\x02 [account], \x02ALIST\x02, \x02LOGOUT\x02, \x02CERT\x02 ADD|DEL|LIST <password> [fingerprint]."),
+            Some("SET") => set::handle(me, from, args, ctx, db),
+            Some("DROP") => drop::handle(me, from, args, ctx, net, db),
+            Some("HELP") => ctx.notice(me, from.uid, "NickServ looks after your nickname. Commands: \x02REGISTER\x02 <password> [email], \x02IDENTIFY\x02 [account] <password>, \x02INFO\x02 [account], \x02ALIST\x02, \x02SET\x02 PASSWORD|EMAIL, \x02DROP\x02 <password>, \x02LOGOUT\x02, \x02CERT\x02 ADD|DEL|LIST <password> [fingerprint]."),
             Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")),
             None => {}
         }

modules/nickserv/set.rs

@@ -0,0 +1,30 @@
+use crate::engine::db::Db;
+use crate::engine::service::{Sender, ServiceCtx};
+
+// SET PASSWORD <newpassword> | SET EMAIL [address]: change your account settings.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut Db) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to be logged in. Identify to NickServ first.");
+        return;
+    };
+    match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {
+        Some("PASSWORD") | Some("PASS") => {
+            let Some(&password) = args.get(2) else {
+                ctx.notice(me, from.uid, "Syntax: SET PASSWORD <newpassword>");
+                return;
+            };
+            // The link layer derives the new password off-thread, then commits it.
+            ctx.defer_password(account, password, me, from.uid);
+        }
+        Some("EMAIL") => {
+            let email = args.get(2).map(|s| s.to_string());
+            let cleared = email.is_none();
+            match db.set_email(account, email) {
+                Ok(()) if cleared => ctx.notice(me, from.uid, format!("Email for \x02{account}\x02 cleared.")),
+                Ok(()) => ctx.notice(me, from.uid, format!("Email for \x02{account}\x02 updated.")),
+                Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+            }
+        }
+        _ => ctx.notice(me, from.uid, "Syntax: SET PASSWORD <newpassword> | SET EMAIL [address]"),
+    }
+}

modules/protocol/inspircd.rs

@@ -280,8 +280,8 @@ impl Protocol for InspIrcd {
                 vec![format!(":{} INVITE {} {} 1 0", from, uid, channel)]
             }
             NetAction::Raw(s) => vec![s.clone()],
-            // Internal: the link layer handles this before serialization.
-            NetAction::DeferRegister { .. } => vec![],
+            // Internal: the link layer handles these before serialization.
+            NetAction::DeferRegister { .. } | NetAction::DeferPassword { .. } => vec![],
         }
     }
 

modules/protocol/mod.rs

@@ -68,6 +68,9 @@ pub enum NetAction {
     // still needs its (expensive) key derivation. The link layer runs the
     // derivation off-thread, then calls Engine::complete_register.
     DeferRegister { account: String, password: String, email: Option<String>, reply: RegReply },
+    // Internal only: a password change awaiting the same off-thread derivation.
+    // The link layer derives, then calls Engine::complete_password_change.
+    DeferPassword { account: String, password: String, agent: String, uid: String },
 }
 
 // How to answer a registration once its credentials have been derived.