9908548978
chanserv: reuse echo_api chanmode_takes_param in the MODE extban gate instead of a less-complete local copy
2026-07-17 22:52:31 +00:00
8c77016aed
helpserv: HELP EXTBANS lists the network live extban set with a friendly example for each
2026-07-17 22:23:54 +00:00
7f5b37efd6
log the extban policy at startup (all offered, or the restricted set)
2026-07-17 22:07:54 +00:00
77d09c4bdc
akick: accept a matching extban only the ircd knows (ircd-enforced +b), reject acting extbans with a clear reason
2026-07-17 22:01:32 +00:00
c990eb1e1e
extban: learn the ircd live set from CAPAB EXTBANS and validate AKICK/MODE against what it actually offers
2026-07-17 21:47:02 +00:00
da94142bad
chanserv: hold MODE ban/except/invex extbans to the [extban] enabled policy, matching AKICK
2026-07-17 21:33:00 +00:00
74a983467c
akick: match the server and fingerprint extbans from the SERVER name and ssl_cert metadata the s2s stream carries
2026-07-17 21:23:25 +00:00
f7c38cedad
chanserv: full AKICK extban registry, [extban] enabled gate, passive extbans pushed as channel bans for the ircd to enforce
2026-07-17 21:06:14 +00:00
9a197fca3d
db: one timestamp for a ban/account's logged event and in-memory record, so a peer replaying it converges (two now() calls could straddle a second)
CI / check (push) Successful in 3m55s
2026-07-17 20:38:50 +00:00
47dfa76fd5
engine: a takeover keeps the account's founded channels (the account still exists) — only a genuine drop or expiry releases them
CI / check (push) Failing after 3m56s
2026-07-17 20:23:51 +00:00
426fc694a2
akick: match extbans (account/realname/realmask/unauthed) using the ident, real host and real name the UID carries but was discarding
CI / check (push) Successful in 4m0s
2026-07-17 19:47:34 +00:00
bc4fada354
api: type GroupServ flags (GroupFlag/GroupFlags via a shared flag_set! macro); delete the stringly apply_flags
CI / check (push) Successful in 4m0s
2026-07-17 18:47:08 +00:00
2a12ebd6e3
api: typed Flag/Flags bitset for channel access (mirrors Privs); level_caps resolves every level through it, collapsing 40 lines to 5
CI / check (push) Successful in 4m0s
2026-07-17 18:30:45 +00:00
65323caaeb
chanserv: FLAGS maps sop/halfop presets to flag letters (oa=+ao), fixing privilege escalation when editing a HOP/SOP entry
CI / check (push) Successful in 4m2s
2026-07-17 18:14:58 +00:00
5dcd216eeb
api: ordered Rank enum (founder>admin>op>halfop>voice) replaces the coarse u8 access rank, so PEACE distinguishes every tier
CI / check (push) Successful in 3m59s
2026-07-17 17:33:53 +00:00
f2ba876ce4
botserv: bots join +ao (protected admin + op), keeping op alongside protect
CI / check (push) Successful in 3m53s
2026-07-17 17:11:25 +00:00
73467b91ca
botserv: bots join channels as protected admins (+a) so ordinary ops can't kick or deop them
CI / check (push) Successful in 3m50s
2026-07-17 16:52:00 +00:00
e2330c56ff
chanserv: SOP protect (+ao) and founder owner (+qo) with standard ~ & @ prefix tiers
CI / check (push) Successful in 4m12s
2026-07-17 16:10:36 +00:00
b5aef650f2
chanserv: all op-and-above tiers grant +o for a single @ prefix; tier distinction stays in the access list
CI / check (push) Successful in 4m12s
2026-07-17 15:58:11 +00:00
2f6fd41465
chanserv: SOP protect tier over AOP (+ao), founder owner (+qo); resolve op access by capability not mode string
CI / check (push) Successful in 3m59s
2026-07-17 15:43:16 +00:00
c8106035df
chanserv: give SOP/AOP/HOP/VOP four distinct access tiers matching Anope, classified by capability
CI / check (push) Successful in 3m55s
2026-07-17 14:54:36 +00:00
f5c976eb56
api/gameserv: type email ExpiryTarget and chess Ending as enums (drop stringly returns)
CI / check (push) Successful in 3m53s
2026-07-17 14:15:39 +00:00
2cdc7f820a
chanserv/nickserv: resolve access level via caps, so FLAGS-set roles list correctly in ALIST and AOP/SOP/VOP
2026-07-17 14:15:39 +00:00
7a5f1502a4
infoserv: type the news kind as an enum at the store boundary
CI / check (push) Successful in 3m53s
2026-07-17 13:53:53 +00:00
ee95225eaf
operserv: OPER ADD rejects unknown privilege names instead of silently dropping them
2026-07-17 13:53:53 +00:00
ef34c04c8d
operserv: type the X-line kind as an enum at the command/store boundary, wire token in storage
2026-07-17 13:47:10 +00:00
2c8ba4460d
forbid: type the FORBID kind as an enum at the store boundary, string only in storage
CI / check (push) Successful in 3m56s
2026-07-17 13:26:16 +00:00
1fb3615b7e
auth: warn on unknown [[oper]] privilege names instead of silently dropping them
CI / check (push) Successful in 3m53s
2026-07-17 12:45:41 +00:00
cfe05481d6
gameserv: model the domain with enums (GameType/Side/Status/Outcome/Board), zero-alloc grid moves
CI / check (push) Successful in 3m54s
2026-07-17 12:20:26 +00:00
108c15e95a
gameserv: ranked ladder rides StatServ's persisted counters, no separate store
CI / check (push) Successful in 3m50s
2026-07-17 12:07:35 +00:00
b763eab9ed
gameserv: use the GamesServ nick, GameServ is reserved on the network
CI / check (push) Successful in 3m51s
2026-07-17 11:51:35 +00:00
a7a37d1277
gameserv: server-authoritative ttt/c4/chess referee with ranked ladder
CI / check (push) Successful in 3m56s
2026-07-17 11:24:13 +00:00
e3b83f4a92
operserv: REHASH announces the reload in the log channel via DebugServ
CI / check (push) Successful in 4m1s
2026-07-17 11:02:29 +00:00
64b675e61f
operserv: REHASH reloads config live without a restart
CI / check (push) Successful in 3m54s
2026-07-17 10:46:12 +00:00
e112b8737c
auth: deferred login is authoritative in the account map, not just ircd metadata
CI / check (push) Successful in 3m46s
2026-07-17 03:30:47 +00:00
75c6537532
standard replies: emit IRCv3 FAIL/WARN/NOTE for service errors, config-gated
CI / check (push) Successful in 3m42s
2026-07-17 02:53:48 +00:00
fcca7ac12b
chanserv: channel seen checks channel membership, not global presence
CI / check (push) Successful in 3m45s
2026-07-17 01:54:55 +00:00
66eb644a07
chanserv: channel-scoped seen with last message, replied in-channel
CI / check (push) Successful in 3m47s
2026-07-17 01:41:47 +00:00
f2774f13fe
services: all pseudo-clients join a configurable channel (default #services)
CI / check (push) Successful in 3m39s
2026-07-17 01:23:18 +00:00
657154e268
services: assigned bot fronts channel modes, not chanserv
CI / check (push) Successful in 3m41s
2026-07-17 01:17:29 +00:00
96654b5e5a
groupserv: gate channel access on the c flag, document !group
CI / check (push) Successful in 3m43s
2026-07-17 01:00:27 +00:00
b87a0c56a2
services: label as network service in whois
CI / check (push) Successful in 3m44s
2026-07-17 00:30:51 +00:00
952078aa7e
services: configurable pseudo-client umodes
CI / check (push) Successful in 3m43s
2026-07-17 00:01:24 +00:00
eaf3111917
whois: answer IDLE for pseudo-clients
2026-07-16 23:22:35 +00:00
a60a6df19d
debugserv: sourced auth feed, drop icons
2026-07-16 23:08:30 +00:00
9bdda721f3
keycard: redeem website login keycards over SASL
2026-07-16 22:27:59 +00:00
38d12cb0bb
debugserv: live services activity feed
2026-07-16 22:27:35 +00:00
6c403c01b0
services: configurable pseudo-client host
2026-07-16 19:15:48 +00:00
2f9790feac
auth: offload IDENTIFY + SASL PLAIN verify off the engine lock
...
CI / check (push) Successful in 3m47s
Both ran scram verify_plain (~1s PBKDF2 at 1.2M iters) inline under the engine
lock, freezing the whole daemon per login. Add NetAction::DeferAuthenticate +
AuthThen continuation + ctx.defer_authenticate, mirroring DeferPassword: the
module/SASL path fetches the verifier cheaply and defers; the link layer runs
verify_plain on spawn_blocking, then Engine::complete_authenticate finishes the
login (IDENTIFY reuses the same ctx helpers, so its login/AJOIN/vhost/memo
side-effects are unchanged). Tests resolve the defer inline (cfg(test)). The
gRPC web-login path was already fixed; no login path stalls services now.
(GHOST/DROP/CERT/GROUP still verify inline but are rare account ops, not logins.)
2026-07-16 19:04:18 +00:00
63fc2fb2c0
grpc: run authenticate's PBKDF2 verify off the engine lock
...
CI / check (push) Successful in 3m54s
The Authenticate RPC held the engine Mutex across scram verify_plain, which at
production iteration counts (1.2M) is ~0.8s of PBKDF2 on the async reactor —
freezing the whole daemon (IRC link, gossip, every RPC) for the duration and
serializing all logins. Fetch the verifier under the lock (cheap), then run
verify_plain on spawn_blocking, lock released. 6 concurrent logins: 823ms (was
~4460ms serialized). set_password/register already offload this way; drop the
now-unused authority_authenticate.
2026-07-16 18:40:30 +00:00
