From 8edb7b2ab2db0748ac24293bba7a87b7165cfe96 Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Sat, 8 Aug 2026 19:42:10 +0000
Subject: [PATCH] whois: show client-cert fingerprint (276) to opers and self

---
 src/coremods/core_info.rs | 12 ++++++++++++
 src/numeric.rs            |  1 +
 2 files changed, 13 insertions(+)

diff --git a/src/coremods/core_info.rs b/src/coremods/core_info.rs
index 8fff1c1..5d54ac7 100644
--- a/src/coremods/core_info.rs
+++ b/src/coremods/core_info.rs
@@ -117,6 +117,7 @@ impl Command for Whois {
             account,
             last_active,
             signon,
+            certfp,
         ) = {
             let u = &s.users[&tuid];
             (
@@ -134,6 +135,7 @@ impl Command for Whois {
                 u.account.clone(),
                 u.last_active,
                 u.signon,
+                u.certfp.clone(),
             )
         };
         let chans: Vec<String> = keys
@@ -193,6 +195,16 @@ impl Command for Whois {
                 &format!("{nick} :is using a secure connection"),
             );
         }
+        // client-cert fingerprint (CertFP) — shown to the user themselves and opers
+        if let Some(fp) = &certfp {
+            if is_self || asker_oper {
+                s.numeric(
+                    uid,
+                    RPL_WHOISCERTFP,
+                    &format!("{nick} :has client certificate fingerprint {fp}"),
+                );
+            }
+        }
         // 317: idle time + signon time
         let idle = crate::server::now().saturating_sub(last_active);
         s.numeric(
diff --git a/src/numeric.rs b/src/numeric.rs
index f015677..70a3f48 100644
--- a/src/numeric.rs
+++ b/src/numeric.rs
@@ -89,6 +89,7 @@ pub const RPL_WHOISACCOUNT: u16 = 330; // "<nick> <account> :is logged in as"
 pub const ERR_NEEDREGGEDNICK: u16 = 477; // chan +R/+M — must be logged into an account
 pub const RPL_WHOISHOST: u16 = 378; // oper-only: real host/ip behind a cloak
 pub const RPL_WHOISSECURE: u16 = 671; // "is using a secure connection" (sslinfo)
+pub const RPL_WHOISCERTFP: u16 = 276; // "has client certificate fingerprint <fp>"
 pub const RPL_HOSTHIDDEN: u16 = 396; // "is now your displayed host" (cloak on/off)
 
 pub const RPL_CHANNELMODEIS: u16 = 324;