fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add opt-in external-account mode (delegate identity to the website)

Browse source 
By default fedserv owns accounts itself — nothing changes, no external
service required. Set [auth] external = true and an outside authority (the
website) owns identity instead: NickServ REGISTER / DROP / SET
PASSWORD|EMAIL / RESETPASS / CONFIRM / CERT / GROUP and the IRCv3
registration relay are all refused ("managed on the website"), so IRC
can't mint or change a second identity. Login is unchanged — fedserv still
authenticates locally against the accounts the authority pushes in via the
existing gRPC Accounts API, so lookups stay in-memory fast.

fedserv keeps owning all IRC-domain data (channels, access, vhosts, bans,
memos) keyed by the account name in both modes. One config bool, off by
default, so standalone deployments are unaffected.
This commit is contained in:
Jean Chevronnet 2026-07-14 03:12:59 +00:00
parent 4c899d80b0
commit fba91b4d62
No known key found for this signature in database
8 changed files with 108 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nickserv/src/lib.rs
View file

@ -62,7 +62,14 @@ impl Service for NickServ {
fn on_command(&mut self, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store) {
let me = self.uid.as_str();
match args.first().map(|s| s.to_ascii_uppercase()).as_deref() {
let cmd = args.first().map(|s| s.to_ascii_uppercase());
// When identity is owned externally (the website), IRC can log in but not
// create or change an account — those commands are refused.
if db.external_accounts() && matches!(cmd.as_deref(), Some("REGISTER" | "DROP" | "RESETPASS" | "CONFIRM" | "CERT" | "GROUP" | "UNGROUP")) {
ctx.notice(me, from.uid, "Your account is managed on the website — register or change it there. From IRC you can only \x02IDENTIFY\x02.");
return;
}
match cmd.as_deref() {
Some("REGISTER") => register::handle(me, from, args, ctx),
Some("IDENTIFY") | Some("ID") => identify::handle(me, from, args, ctx, db),
Some("LOGOUT") | Some("LOGOFF") => logout::handle(me, &self.guest_nick, &mut self.guest_seq, from, ctx),

8
nickserv/src/set.rs
View file

@ -7,7 +7,13 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
ctx.notice(me, from.uid, "You need to be logged in. Identify to NickServ first.");
return;
};
match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {
let sub = args.get(1).map(|s| s.to_ascii_uppercase());
// Credential/identity fields are owned by the website in external mode.
if db.external_accounts() && matches!(sub.as_deref(), Some("PASSWORD" | "PASS" | "EMAIL")) {
ctx.notice(me, from.uid, "That's managed on the website — change it there.");
return;
}
match sub.as_deref() {
Some("PASSWORD") | Some("PASS") => {
let Some(&password) = args.get(2) else {
ctx.notice(me, from.uid, "Syntax: SET PASSWORD <newpassword>");