Move <oper:autologin> from m_sslinfo to core_oper and rework.

- Promote autologin to a core concept with visibility in events.

- Replace the binary yes/no value with strict/relaxed/never. This
  intentionally breaks v3 oper block autologin as admins will need
  to review them for the security implications of the new behaviour.

10 files changed, 27 insertions, 31 deletions

diff --git a/src/modules/m_account.cpp b/src/modules/m_account.cpp
index d9251f04f..6d408ba39 100644
--- a/src/modules/m_account.cpp
+++ b/src/modules/m_account.cpp
@@ -338,7 +338,7 @@ public:
 		return MOD_RES_PASSTHRU;
 	}
 
-	ModResult OnPreOperLogin(LocalUser* user, const std::shared_ptr<OperAccount>& oper) override
+	ModResult OnPreOperLogin(LocalUser* user, const std::shared_ptr<OperAccount>& oper, bool automatic) override
 	{
 		const std::string accountstr = oper->GetConfig()->getString("account");
 		if (accountstr.empty())
@@ -357,8 +357,11 @@ public:
 				return MOD_RES_PASSTHRU; // Matches on account name.
 		}
 
-		ServerInstance->SNO.WriteGlobalSno('o', "%s (%s) [%s] failed to log into the \x02%s\x02 oper account because they are not logged into the correct user account.",
-			user->nick.c_str(), user->MakeHost().c_str(), user->GetIPString().c_str(), oper->GetName().c_str());
+		if (!automatic)
+		{
+			ServerInstance->SNO.WriteGlobalSno('o', "%s (%s) [%s] failed to log into the \x02%s\x02 oper account because they are not logged into the correct user account.",
+				user->nick.c_str(), user->MakeHost().c_str(), user->GetIPString().c_str(), oper->GetName().c_str());
+		}
 		return MOD_RES_DENY; // Account required but it does not match.
 	}
 
diff --git a/src/modules/m_operjoin.cpp b/src/modules/m_operjoin.cpp
index 2608dcca3..3b4c329ad 100644
--- a/src/modules/m_operjoin.cpp
+++ b/src/modules/m_operjoin.cpp
@@ -52,7 +52,7 @@ public:
 			operChans.push_back(channame);
 	}
 
-	void OnPostOperLogin(User* user) override
+	void OnPostOperLogin(User* user, bool automatic) override
 	{
 		LocalUser* localuser = IS_LOCAL(user);
 		if (!localuser)
diff --git a/src/modules/m_opermodes.cpp b/src/modules/m_opermodes.cpp
index e0911986c..5876cfef2 100644
--- a/src/modules/m_opermodes.cpp
+++ b/src/modules/m_opermodes.cpp
@@ -35,7 +35,7 @@ public:
 	{
 	}
 
-	void OnPostOperLogin(User* user) override
+	void OnPostOperLogin(User* user, bool automatic) override
 	{
 		if (!IS_LOCAL(user))
 			return; // We don't handle remote users.
diff --git a/src/modules/m_opermotd.cpp b/src/modules/m_opermotd.cpp
index f109d43ee..7332f545b 100644
--- a/src/modules/m_opermotd.cpp
+++ b/src/modules/m_opermotd.cpp
@@ -136,7 +136,7 @@ public:
 	{
 	}
 
-	void OnPostOperLogin(User* user) override
+	void OnPostOperLogin(User* user, bool automatic) override
 	{
 		if (IS_LOCAL(user) && user->oper->GetConfig()->getBool("automotd", onoper))
 			cmd.ShowOperMOTD(user, false);
diff --git a/src/modules/m_operprefix.cpp b/src/modules/m_operprefix.cpp
index a3fae72e4..4540e63a4 100644
--- a/src/modules/m_operprefix.cpp
+++ b/src/modules/m_operprefix.cpp
@@ -104,7 +104,7 @@ public:
 			ServerInstance->Modes.Process(ServerInstance->FakeClient, memb->chan, nullptr, changelist);
 	}
 
-	void OnPostOperLogin(User* user) override
+	void OnPostOperLogin(User* user, bool automatic) override
 	{
 		if (IS_LOCAL(user) && (!user->IsModeSet(hideopermode)))
 			SetOperPrefix(user, true);
diff --git a/src/modules/m_spanningtree/main.cpp b/src/modules/m_spanningtree/main.cpp
index f84e1c91a..584b70b5e 100644
--- a/src/modules/m_spanningtree/main.cpp
+++ b/src/modules/m_spanningtree/main.cpp
@@ -772,7 +772,7 @@ restart:
 	}
 }
 
-void ModuleSpanningTree::OnOperLogin(User* user, const std::shared_ptr<OperAccount>& oper)
+void ModuleSpanningTree::OnOperLogin(User* user, const std::shared_ptr<OperAccount>& oper, bool automatic)
 {
 	if (!user->IsFullyConnected() || !IS_LOCAL(user))
 		return;
diff --git a/src/modules/m_spanningtree/main.h b/src/modules/m_spanningtree/main.h
index 539803a68..e1dc83379 100644
--- a/src/modules/m_spanningtree/main.h
+++ b/src/modules/m_spanningtree/main.h
@@ -196,7 +196,7 @@ public:
 	void OnUserKick(User* source, Membership* memb, const std::string& reason, CUList& excepts) override;
 	void OnPreRehash(User* user, const std::string& parameter) override;
 	void ReadConfig(ConfigStatus& status) override;
-	void OnOperLogin(User* user, const std::shared_ptr<OperAccount>& oper) override;
+	void OnOperLogin(User* user, const std::shared_ptr<OperAccount>& oper, bool automatic) override;
 	void OnAddLine(User* u, XLine* x) override;
 	void OnDelLine(User* u, XLine* x) override;
 	ModResult OnStats(Stats::Context& stats) override;
diff --git a/src/modules/m_spanningtree/opertype.cpp b/src/modules/m_spanningtree/opertype.cpp
index 0dcfdc4d4..2babaffe8 100644
--- a/src/modules/m_spanningtree/opertype.cpp
+++ b/src/modules/m_spanningtree/opertype.cpp
@@ -49,8 +49,9 @@ CmdResult CommandOpertype::HandleRemote(RemoteUser* u, CommandBase::Params& para
 			return CmdResult::SUCCESS;
 	}
 
-	ServerInstance->SNO.WriteToSnoMask('O', "From %s: %s (%s) is now a server operator of type %s",
-		u->server->GetName().c_str(), u->nick.c_str(), u->MakeHost().c_str(), u->oper->GetType().c_str());
+	ServerInstance->SNO.WriteToSnoMask('O', "From %s: %s (%s) [%s] is now a server operator of type \x02%s\x02.",
+		u->server->GetName().c_str(), u->nick.c_str(), u->MakeHost().c_str(), u->GetIPString().c_str(),
+		u->oper->GetType().c_str());
 	return CmdResult::SUCCESS;
 }
 
diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index d89f74006..bd47dc676 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -323,21 +323,27 @@ public:
 		return MOD_RES_PASSTHRU;
 	}
 
-	ModResult OnPreOperLogin(LocalUser* user, const std::shared_ptr<OperAccount>& oper) override
+	ModResult OnPreOperLogin(LocalUser* user, const std::shared_ptr<OperAccount>& oper, bool automatic) override
 	{
 		auto cert = cmd.sslapi.GetCertificate(user);
 		if (oper->GetConfig()->getBool("sslonly") && !cert)
 		{
-			ServerInstance->SNO.WriteGlobalSno('o', "%s (%s) [%s] failed to log into the \x02%s\x02 oper account because they are not connected using TLS.",
-				user->nick.c_str(), user->MakeHost().c_str(), user->GetIPString().c_str(), oper->GetName().c_str());
+			if (!automatic)
+			{
+				ServerInstance->SNO.WriteGlobalSno('o', "%s (%s) [%s] failed to log into the \x02%s\x02 oper account because they are not connected using TLS.",
+					user->nick.c_str(), user->MakeHost().c_str(), user->GetIPString().c_str(), oper->GetName().c_str());
+			}
 			return MOD_RES_DENY;
 		}
 
 		const std::string fingerprint = oper->GetConfig()->getString("fingerprint");
 		if (!fingerprint.empty() && (!cert || !MatchFP(cert, fingerprint)))
 		{
-			ServerInstance->SNO.WriteGlobalSno('o', "%s (%s) [%s] failed to log into the \x02%s\x02 oper account because they are not using the correct TLS client certificate.",
-				user->nick.c_str(), user->MakeHost().c_str(), user->GetIPString().c_str(), oper->GetName().c_str());
+			if (!automatic)
+			{
+				ServerInstance->SNO.WriteGlobalSno('o', "%s (%s) [%s] failed to log into the \x02%s\x02 oper account because they are not using the correct TLS client certificate.",
+					user->nick.c_str(), user->MakeHost().c_str(), user->GetIPString().c_str(), oper->GetName().c_str());
+			}
 			return MOD_RES_DENY;
 		}
 
@@ -365,20 +371,6 @@ public:
 		if (cert && !cert->GetFingerprint().empty())
 			text.append(" and your TLS client certificate fingerprint is ").append(cert->GetFingerprint());
 		user->WriteNotice(text);
-
-		if (!cert)
-			return;
-
-		// Find an auto-oper block for this user
-		for (const auto& [_, info] :  ServerInstance->Config->OperAccounts)
-		{
-			const auto& oper = info->GetConfig();
-			if (!oper->getBool("autologin"))
-				continue; // No autologin for this block.
-
-			if (!user->OperLogin(info))
-				continue; // Some other field does not match.
-		}
 	}
 
 	ModResult OnSetConnectClass(LocalUser* user, const ConnectClass::Ptr& myclass) override
diff --git a/src/modules/m_swhois.cpp b/src/modules/m_swhois.cpp
index 06e101746..bd5ae99c3 100644
--- a/src/modules/m_swhois.cpp
+++ b/src/modules/m_swhois.cpp
@@ -116,7 +116,7 @@ public:
 		return MOD_RES_PASSTHRU;
 	}
 
-	void OnPostOperLogin(User* user) override
+	void OnPostOperLogin(User* user, bool automatic) override
 	{
 		if (!IS_LOCAL(user))
 			return;