Separate SASL, NickServ and oper credentials; add SASL-first auth #5

Merged

drawblank merged 1 commit from sasl-oper-auth into main 2026-09-24 07:14:28 +00:00

Conversation 0 Commits 1 Files changed 7 +308 -40

drawblank commented 2026-09-24 07:14:12 +00:00

Owner

Copy link

The single irc.password was doing triple duty — NickServ IDENTIFY, OPER, and (soon) SASL — so OPER reused the account password and always failed with 481 (operator credentials are a different secret).

• Authenticate with SASL PLAIN first, falling back to NickServ IDENTIFY when SASL is unavailable or rejected (903 vs 904–907).
• Add sasl_account (defaults to nick), oper_user (defaults to name), and oper_password. OPER is only attempted when oper_password is set and never reuses the account password.
• Re-request draft/relaymsg message-tags after RPL_YOUREOPER, since some servers only grant relaymsg to operators.
• Add util_base64_encode for the SASL PLAIN payload, with unit tests.

Verified: meson compile clean, meson test passes, clang-format --dry-run --Werror clean.

The single `irc.password` was doing triple duty — NickServ IDENTIFY, OPER, and (soon) SASL — so OPER reused the account password and always failed with `481` (operator credentials are a different secret). - Authenticate with **SASL PLAIN** first, falling back to NickServ IDENTIFY when SASL is unavailable or rejected (903 vs 904–907). - Add `sasl_account` (defaults to nick), `oper_user` (defaults to name), and `oper_password`. OPER is only attempted when `oper_password` is set and never reuses the account password. - Re-request `draft/relaymsg message-tags` after `RPL_YOUREOPER`, since some servers only grant relaymsg to operators. - Add `util_base64_encode` for the SASL PLAIN payload, with unit tests. Verified: `meson compile` clean, `meson test` passes, `clang-format --dry-run --Werror` clean.

drawblank added 1 commit 2026-09-24 07:14:12 +00:00

Separate SASL, NickServ and oper credentials; add SASL-first auth ... 7b7755dc4e

The single irc.password was doing triple duty: it fed NickServ IDENTIFY,
OPER, and was about to feed SASL. That meant OPER reused the account
password and always failed with 481 (operator credentials are a different
secret).

- Authenticate with SASL PLAIN first, falling back to NickServ IDENTIFY
  when SASL is unavailable or rejected (903 vs 904-907).
- Add sasl_account (defaults to nick), oper_user (defaults to name), and
  oper_password. OPER is only attempted when oper_password is set and never
  reuses the account password.
- Re-request draft/relaymsg message-tags after RPL_YOUREOPER, since some
  servers only grant relaymsg to operators.
- Add util_base64_encode for the SASL PLAIN payload, with unit tests.

drawblank merged commit e8b15239ab into main 2026-09-24 07:14:28 +00:00

drawblank referenced this pull request from a commit 2026-09-24 07:14:30 +00:00

Merge pull request 'Separate SASL, NickServ and oper credentials; add SASL-first auth' (#5) from sasl-oper-auth into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

slopnode/bridge!5

No description provided.