Allow restricting an oper account based on services account.

1 files changed, 22 insertions, 0 deletions

diff --git a/src/modules/m_account.cpp b/src/modules/m_account.cpp
index 778a47bf1..3c446dffc 100644
--- a/src/modules/m_account.cpp
+++ b/src/modules/m_account.cpp
@@ -338,6 +338,28 @@ public:
 		return MOD_RES_PASSTHRU;
 	}
 
+	ModResult OnPreOperLogin(LocalUser* user, const std::shared_ptr<OperAccount>& oper) override
+	{
+		const std::string accountstr = oper->GetConfig()->getString("account");
+		if (accountstr.empty())
+			return MOD_RES_PASSTHRU;
+
+		const std::string* accountid = accountapi.GetAccountId(user);
+		const std::string* accountname = accountapi.GetAccountName(user);
+
+		irc::spacesepstream accountstream(accountstr);
+		for (std::string account; accountstream.GetToken(account); )
+		{
+			if (accountid && irc::equals(account, *accountid))
+				return MOD_RES_PASSTHRU; // Matches on account id.
+
+			if (accountname && irc::equals(account, *accountname))
+				return MOD_RES_PASSTHRU; // Matches on account name.
+		}
+
+		return MOD_RES_DENY; // Account required but it does not match.
+	}
+
 	ModResult OnSetConnectClass(LocalUser* user, const ConnectClass::Ptr& myclass) override
 	{
 		const char* error = nullptr;