Add three-tier services operator model (operator, administrator, root)

modules/operserv/src/ignore.rs

@@ -5,8 +5,8 @@ use std::time::{SystemTime, UNIX_EPOCH};
 // drop commands from a matching user. A mask with an '@' matches nick!*@host
 // (ident isn't tracked); a bare mask matches the nick. Admin-only, node-local.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — IGNORE needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — IGNORE needs the \x02operator\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {

modules/operserv/src/info.rs

@@ -4,8 +4,8 @@ use echo_api::{Priv, Sender, ServiceCtx, Store};
 // note to an account or channel (a `#name` is a channel, else an account). The
 // note is shown to operators in that service's INFO. Admin-only.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — INFO needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — INFO needs the \x02operator\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {

modules/operserv/src/kick.rs

@@ -3,8 +3,8 @@ use echo_api::{NetView, Priv, Sender, ServiceCtx};
 // KICK <#channel> <nick> [reason]: remove a user from a channel, sourced from
 // OperServ so it's clearly a staff action. Admin-only.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — KICK needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — KICK needs the \x02operator\x02 privilege.");
         return;
     }
     let Some(&chan) = args.get(1).filter(|c| c.starts_with('#') || c.starts_with('&')) else {

modules/operserv/src/kill.rs

@@ -2,8 +2,8 @@ use echo_api::{NetView, Priv, Sender, ServiceCtx};
 
 // KILL <nick> [reason]: disconnect a user from the network. Admin-only.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — KILL needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — KILL needs the \x02operator\x02 privilege.");
         return;
     }
     let Some(&target) = args.get(1) else {

modules/operserv/src/mode.rs

@@ -4,8 +4,8 @@ use echo_api::{NetView, Priv, Sender, ServiceCtx, Store};
 // (forced, so it applies regardless of the current TS). Admin-only. Status-mode
 // targets may be given as nicks — they're resolved to uids for the ircd.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — MODE needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — MODE needs the \x02operator\x02 privilege.");
         return;
     }
     let Some(&chan) = args.get(1).filter(|c| c.starts_with('#') || c.starts_with('&')) else {

modules/operserv/src/notify.rs

@@ -9,8 +9,8 @@ const ALL_FLAGS: &str = "cdjkmnoptusS";
 // An oper watch list: users matching a mask have their flagged events announced
 // to the staff feed. Admin-only, like the rest of the ban family.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — NOTIFY needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — NOTIFY needs the \x02operator\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {

modules/operserv/src/oper.rs

@@ -1,20 +1,21 @@
-use echo_api::{parse_duration, Priv, Sender, ServiceCtx, Store};
+use echo_api::{parse_duration, Priv, Privs, Sender, ServiceCtx, Store};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 // OPER ADD <account> <priv[,priv…]> [+duration] | OPER DEL <account> | OPER LIST:
 // manage runtime services operators (merged with the declarative config opers).
-// The privileges are auspex, suspend, admin; a +duration makes the grant expire.
-// Admin-only — only an admin grants oper.
+// Privileges (low to high): auspex, oper, suspend, admin, root — or name a tier
+// directly (operator/administrator/root), which grants the matching privilege.
+// Root-only — granting operators is the top-tier power.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — OPER needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Root) {
+        ctx.notice(me, from.uid, "Access denied — OPER needs the \x02root\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {
         Some("ADD") | Some("SET") => add(me, from, args.get(2).copied(), args.get(3).copied(), args.get(4).copied(), ctx, db),
         Some("DEL") | Some("REMOVE") => del(me, from, args.get(2).copied(), ctx, db),
         Some("LIST") | Some("VIEW") => list(me, from, ctx, db),
-        _ => ctx.notice(me, from.uid, "Syntax: OPER ADD <account> <priv[,priv]> [+duration] | OPER DEL <account> | OPER LIST — privs: auspex, suspend, admin"),
+        _ => ctx.notice(me, from.uid, "Syntax: OPER ADD <account> <priv[,priv] | tier> [+duration] | OPER DEL <account> | OPER LIST — tiers: operator, administrator, root; privs: auspex, oper, suspend, admin, root"),
     }
 }
 
@@ -76,7 +77,8 @@ fn list(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store) {
     }
     for (account, privs, expires) in &opers {
         let window = if expires.is_some() { " (temporary)" } else { "" };
-        ctx.notice(me, from.uid, format!("  \x02{account}\x02 — {}{window}", privs.join(", ")));
+        let tier = Privs::from_names(privs).tier();
+        ctx.notice(me, from.uid, format!("  \x02{account}\x02 [{tier}] — {}{window}", privs.join(", ")));
     }
     ctx.notice(me, from.uid, format!("End of runtime operator list ({} shown).", opers.len()));
 }

modules/operserv/src/redact.rs

@@ -1,10 +1,14 @@
-use echo_api::{Sender, ServiceCtx};
+use echo_api::{Priv, Sender, ServiceCtx};
 
 // REDACT <#channel|nick> <msgid> [reason]: delete a message by its IRCv3 msgid.
 // The msgid comes from the reporting oper's client (which saw the tagged message);
 // echo relays it as a server-trusted redaction, so no ircd oper privilege is needed
 // (draft/message-redaction). One-shot — nothing is stored.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx) {
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — REDACT needs the \x02operator\x02 privilege.");
+        return;
+    }
     let (Some(&target), Some(&msgid)) = (args.get(1), args.get(2)) else {
         ctx.notice(me, from.uid, "Syntax: REDACT <#channel|nick> <msgid> [reason]");
         return;

modules/operserv/src/rehash.rs

@@ -7,8 +7,8 @@ use echo_api::{Priv, Sender, ServiceCtx};
 // endpoint still need a RESTART. The engine does the re-read off the command
 // path and notices the outcome (or a parse error, keeping the old config).
 pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — REHASH needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Root) {
+        ctx.notice(me, from.uid, "Access denied — REHASH needs the \x02root\x02 privilege.");
         return;
     }
     ctx.rehash(me, from.uid);

modules/operserv/src/session.rs

@@ -4,8 +4,8 @@ use echo_api::{NetView, Priv, Sender, ServiceCtx, Store};
 // EXCEPTION ADD <ip-mask> <limit> [reason] | DEL <ip-mask> | LIST: manage the
 // per-IP-mask allowances that override the default limit. All admin-only.
 pub fn handle_session(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — SESSION needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — SESSION needs the \x02operator\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {
@@ -33,7 +33,7 @@ pub fn handle_session(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceC
 }
 
 pub fn handle_exception(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
+    if !from.privs.has(Priv::Oper) {
         ctx.notice(me, from.uid, "Access denied — EXCEPTION needs the \x02admin\x02 privilege.");
         return;
     }

modules/operserv/src/set.rs

@@ -4,8 +4,8 @@ use echo_api::{Priv, Sender, ServiceCtx, Store};
 // While on, no new registrations or changes are accepted; existing data and
 // gossip replication keep working. Admin-only. No argument reports the state.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — SET is for services operators.");
+    if !from.privs.has(Priv::Root) {
+        ctx.notice(me, from.uid, "Access denied — SET needs the \x02root\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {

modules/operserv/src/shutdown.rs

@@ -6,8 +6,8 @@ use echo_api::{Priv, Sender, ServiceCtx};
 // first so users know why services vanished.
 pub fn handle(me: &str, from: &Sender, restart: bool, args: &[&str], ctx: &mut ServiceCtx) {
     let cmd = if restart { "RESTART" } else { "SHUTDOWN" };
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, format!("Access denied — {cmd} needs the \x02admin\x02 privilege."));
+    if !from.privs.has(Priv::Root) {
+        ctx.notice(me, from.uid, format!("Access denied — {cmd} needs the \x02root\x02 privilege."));
         return;
     }
     let reason = if args.len() > 1 { args[1..].join(" ") } else { format!("Services {}", if restart { "restarting" } else { "shutting down" }) };

modules/operserv/src/spamfilter.rs

@@ -11,8 +11,8 @@ const DEFAULT_FLAGS: &str = "*";
 // expression (the ircd's filter engine), e.g. `.*free.*bitcoin.*`. `action` is what
 // happens on a match: gline / zline / block / silent / kill / shun / warn / none.
 pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
-    if !from.privs.has(Priv::Admin) {
-        ctx.notice(me, from.uid, "Access denied — SPAMFILTER needs the \x02admin\x02 privilege.");
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — SPAMFILTER needs the \x02operator\x02 privilege.");
         return;
     }
     match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {

modules/operserv/src/stats.rs

@@ -1,9 +1,13 @@
-use echo_api::{Sender, ServiceCtx, Store, XlineKind};
+use echo_api::{Priv, Sender, ServiceCtx, Store, XlineKind};
 
 // STATS: an at-a-glance summary of the enforcement state OperServ holds — how
 // many network bans of each kind and how many services ignores are live.
 // Read-only, so any operator may run it (the module is already oper-gated).
 pub fn handle(me: &str, from: &Sender, db: &mut dyn Store, ctx: &mut ServiceCtx) {
+    if !from.privs.has(Priv::Oper) {
+        ctx.notice(me, from.uid, "Access denied — STATS needs the \x02operator\x02 privilege.");
+        return;
+    }
     let akills = db.akills();
     let glines = akills.iter().filter(|a| a.kind == XlineKind::Gline).count();
     let qlines = akills.iter().filter(|a| a.kind == XlineKind::Qline).count();

modules/operserv/src/xline.rs

@@ -1,4 +1,4 @@
-use echo_api::{parse_duration, Sender, ServiceCtx, Store, XlineKind};
+use echo_api::{parse_duration, Priv, Sender, ServiceCtx, Store, XlineKind};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 // A network-ban command family (AKILL, SQLINE, …): the ircd X-line `kind`, the
@@ -13,6 +13,10 @@ pub struct Xline {
 
 impl Xline {
     pub fn handle(&self, me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+        if !from.privs.has(Priv::Oper) {
+            ctx.notice(me, from.uid, format!("Access denied — {} needs the \x02operator\x02 privilege.", self.name));
+            return;
+        }
         match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {
             Some("ADD") => self.add(me, from, &args[2..], ctx, db),
             Some("DEL") | Some("REMOVE") => self.del(me, from, args.get(2).copied(), ctx, db),

modules/statserv/src/lib.rs

@@ -55,7 +55,7 @@ fn require_channel_admin(me: &str, from: &Sender, chan: &str, ctx: &mut ServiceC
         ctx.notice(me, from.uid, format!("\x02{chan}\x02 isn't registered."));
         return false;
     };
-    if from.account != Some(founder.as_str()) && !from.privs.has(Priv::Admin) {
+    if from.account != Some(founder.as_str()) && !from.privs.has(Priv::Oper) {
         ctx.notice(me, from.uid, format!("Only \x02{chan}\x02's founder can see its stats."));
         return false;
     }