whois: show client-cert fingerprint (276) to opers and self

src/coremods/core_info.rs

@@ -117,6 +117,7 @@ impl Command for Whois {
             account,
             last_active,
             signon,
+            certfp,
         ) = {
             let u = &s.users[&tuid];
             (
@@ -134,6 +135,7 @@ impl Command for Whois {
                 u.account.clone(),
                 u.last_active,
                 u.signon,
+                u.certfp.clone(),
             )
         };
         let chans: Vec<String> = keys
@@ -193,6 +195,16 @@ impl Command for Whois {
                 &format!("{nick} :is using a secure connection"),
             );
         }
+        // client-cert fingerprint (CertFP) — shown to the user themselves and opers
+        if let Some(fp) = &certfp {
+            if is_self || asker_oper {
+                s.numeric(
+                    uid,
+                    RPL_WHOISCERTFP,
+                    &format!("{nick} :has client certificate fingerprint {fp}"),
+                );
+            }
+        }
         // 317: idle time + signon time
         let idle = crate::server::now().saturating_sub(last_active);
         s.numeric(

src/numeric.rs

@@ -89,6 +89,7 @@ pub const RPL_WHOISACCOUNT: u16 = 330; // "<nick> <account> :is logged in as"
 pub const ERR_NEEDREGGEDNICK: u16 = 477; // chan +R/+M — must be logged into an account
 pub const RPL_WHOISHOST: u16 = 378; // oper-only: real host/ip behind a cloak
 pub const RPL_WHOISSECURE: u16 = 671; // "is using a secure connection" (sslinfo)
+pub const RPL_WHOISCERTFP: u16 = 276; // "has client certificate fingerprint <fp>"
 pub const RPL_HOSTHIDDEN: u16 = 396; // "is now your displayed host" (cloak on/off)
 
 pub const RPL_CHANNELMODEIS: u16 = 324;