fix: include hostmask in NAMES replies (RPL_NAMREPLY)

- Add ip column to sessions table (real client IP of session creator)
- Add ip and hostname columns to clients table (per-connection tracking)
- Update CreateSession, RegisterUser, LoginUser to store new fields
- Add GetClientHostInfo query method
- Update SessionHostInfo to include IP
- Extract executeCreateSession to fix funlen lint
- Add tests for session IP, client IP/hostname, login client tracking
- Update README with new field documentation

README.md

@@ -113,8 +113,9 @@ mechanisms or stuffing data into CTCP.
 Everything else is IRC. `PRIVMSG`, `JOIN`, `PART`, `NICK`, `TOPIC`, `MODE`,
 `KICK`, `353`, `433` — same commands, same semantics. Channels start with `#`.
 Joining a nonexistent channel creates it. Channels disappear when empty. Nicks
-are unique per server. There are no accounts — identity is a key, a nick is a
-display name.
+are unique per server. Identity starts with a key — a nick is a display name.
+Accounts are optional: you can create an anonymous session instantly, or
+register with a password for multi-client access to a single session.
 
 ### On the resemblance to JSON-RPC
 
@@ -148,16 +149,45 @@ not arbitrary choices — each one follows from the project's core thesis that
 IRC's command model is correct and only the transport and session management
 need to change.
 
-### Identity & Sessions — No Accounts
+### Identity & Sessions — Dual Authentication Model
 
-There are no accounts, no registration, no passwords. Identity is a signing
-key; a nick is just a display name. The two are decoupled.
+The server supports two authentication paths: **anonymous sessions** for
+instant access, and **optional account registration** for multi-client access.
+
+#### Anonymous Sessions (No Account Required)
+
+The simplest entry point. No registration, no passwords.
 
 - **Session creation**: client sends `POST /api/v1/session` with a desired
   nick → server assigns an **auth token** (64 hex characters of
   cryptographically random bytes) and returns the user ID, nick, and token.
 - The auth token implicitly identifies the client. Clients present it via
   `Authorization: Bearer <token>`.
+- Anonymous sessions are ephemeral — when the session expires or the user
+  QUITs, the nick is released and there is no way to reclaim it.
+
+#### Registered Accounts (Optional)
+
+For users who want multi-client access (multiple devices sharing one session):
+
+- **Registration**: client sends `POST /api/v1/register` with a nick and
+  password (minimum 8 characters) → server creates a session with the
+  password hashed via bcrypt, and returns the user ID, nick, and auth token.
+- **Login**: client sends `POST /api/v1/login` with nick and password →
+  server verifies the password against the stored bcrypt hash and creates a
+  new client token for the existing session. This enables multi-client
+  access: logging in from a new device adds a client to the existing session
+  rather than creating a new one, so channel memberships and message queues
+  are shared. Note: login only works while the session still exists — if all
+  clients have logged out or the user has sent QUIT, the session is deleted
+  and the registration is lost.
+- Registered accounts cannot be logged into via `POST /api/v1/session` —
+  that endpoint is for anonymous sessions only.
+- Anonymous sessions (created via `/session`) cannot be logged into via
+  `/login` because they have no password set.
+
+#### Common Properties (Both Paths)
+
 - Nicks are changeable via the `NICK` command; the server-assigned user ID is
   the stable identity.
 - Server-assigned IDs — clients do not choose their own IDs.
@@ -165,11 +195,43 @@ key; a nick is just a display name. The two are decoupled.
   in the token, no client-side decode. The server is the sole authority on
   token validity.
 
-**Rationale:** IRC has no accounts. You connect, pick a nick, and talk. Adding
-registration, email verification, or OAuth would solve a problem nobody asked
-about and add complexity that drives away casual users. Identity verification
-is handled at the message layer via cryptographic signatures (see
-[Security Model](#security-model)), not at the session layer.
+**Rationale:** IRC has no accounts. You connect, pick a nick, and talk.
+Anonymous sessions preserve that simplicity — instant access, zero friction.
+But some users want to access the same session from multiple devices without
+a bouncer. Optional registration with password enables multi-client login
+without adding friction for casual users: if you don't want an account,
+don't create one. Note: in the current implementation, both anonymous and
+registered sessions are deleted when the last client disconnects (QUIT or
+logout); registration does not make a session survive all-client
+removal. Identity verification at the message layer via cryptographic
+signatures (see [Security Model](#security-model)) remains independent
+of account registration.
+
+### Hostmask (nick!user@host)
+
+Each session has an IRC-style hostmask composed of three parts:
+
+- **nick** — the user's current nick (changes with `NICK` command)
+- **username** — an ident-like identifier set at session creation (optional
+  `username` field in the session/register request; defaults to the nick)
+- **hostname** — automatically resolved via reverse DNS of the connecting
+  client's IP address at session creation time
+- **ip** — the real IP address of the session creator, extracted from
+  `X-Forwarded-For`, `X-Real-IP`, or `RemoteAddr`
+
+Each **client connection** (created at session creation, registration, or login)
+also stores its own **ip** and **hostname**, allowing the server to track the
+network origin of each individual client independently from the session.
+
+The hostmask appears in:
+
+- **WHOIS** (`311 RPL_WHOISUSER`) — `params` contains
+  `[nick, username, hostname, "*"]`
+- **WHO** (`352 RPL_WHOREPLY`) — `params` contains
+  `[channel, username, hostname, server, nick, flags]`
+
+The hostmask format (`nick!user@host`) is stored for future use in ban matching
+(`+b` mode) and other access control features.
 
 ### Nick Semantics
 
@@ -207,12 +269,12 @@ User Session
 └── Client C (token_c, queue_c)
 ```
 
-**Current MVP note:** The current implementation creates a new user (with new
-nick) per `POST /api/v1/session` call. True multi-client (multiple tokens
-sharing one nick/session) is supported by the schema (`client_queues` is keyed
-by user_id, and multiple tokens can point to the same user) but the session
-creation endpoint does not yet support "add a client to an existing session."
-This will be added post-MVP.
+**Multi-client via login:** The `POST /api/v1/login` endpoint adds a new
+client to an existing registered session, enabling true multi-client support
+(multiple tokens sharing one nick/session with independent message queues).
+Anonymous sessions created via `POST /api/v1/session` always create a new
+user with a new nick. A future endpoint to "add a client to an existing
+anonymous session" is planned but not yet implemented.
 
 **Rationale:** The fundamental IRC mobile problem is that you can't have your
 phone and laptop connected simultaneously without a bouncer. Server-side
@@ -249,8 +311,8 @@ Key properties:
 - **Ordered**: Queue entries have monotonically increasing IDs. Messages are
   always delivered in order within a client's queue.
 - **No delivery/read receipts** for channel messages. DM receipts are planned.
-- **Queue depth**: Server-configurable via `QUEUE_MAX_AGE`. Default is 48
-  hours. Entries older than this are pruned.
+- **Client output queue depth**: Server-configurable via `QUEUE_MAX_AGE`.
+  Default is 30 days. Entries older than this are pruned.
 
 ### Long-Polling
 
@@ -327,8 +389,8 @@ needs to revoke a token, change the expiry model, or add/remove claims, JWT
 clients may break or behave incorrectly.
 
 Opaque tokens are simpler:
-- Server generates 32 random bytes → hex-encodes → stores hash
-- Client presents the token; server looks it up
+- Server generates 32 random bytes → hex-encodes → stores SHA-256 hash
+- Client presents the raw token; server hashes and looks it up
 - Revocation is a database delete
 - No clock skew issues, no algorithm confusion, no "none" algorithm attacks
 - Token format can change without breaking clients
@@ -355,6 +417,8 @@ The entire read/write loop for a client is two endpoints. Everything else
 
 ### Session Lifecycle
 
+#### Anonymous Session
+
 ```
 ┌─ Client ──────────────────────────────────────────────────┐
 │                                                            │
@@ -385,6 +449,30 @@ The entire read/write loop for a client is two endpoints. Everything else
 └────────────────────────────────────────────────────────────┘
 ```
 
+#### Registered Account
+
+```
+┌─ Client ──────────────────────────────────────────────────┐
+│                                                            │
+│  1. POST /api/v1/register                                  │
+│     {"nick":"alice", "password":"s3cret!!"}                │
+│     → {"id":1, "nick":"alice", "token":"a1b2c3..."}       │
+│     (Session created with bcrypt-hashed password)          │
+│                                                            │
+│  ... use the API normally (JOIN, PRIVMSG, poll, etc.) ...  │
+│                                                            │
+│  (From another device, while session is still active)      │
+│                                                            │
+│  2. POST /api/v1/login                                     │
+│     {"nick":"alice", "password":"s3cret!!"}                │
+│     → {"id":1, "nick":"alice", "token":"d4e5f6..."}       │
+│     (New client added to existing session — channels       │
+│      and message queues are preserved. If all clients      │
+│      have logged out, session no longer exists.)           │
+│                                                            │
+└────────────────────────────────────────────────────────────┘
+```
+
 ### Queue Architecture
 
 ```
@@ -914,7 +1002,7 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | `252` | RPL_LUSEROP         | On connect or LUSERS command | `{"command":"252","to":"alice","params":["0"],"body":["operator(s) online"]}` |
 | `254` | RPL_LUSERCHANNELS   | On connect or LUSERS command | `{"command":"254","to":"alice","params":["3"],"body":["channels formed"]}` |
 | `255` | RPL_LUSERME         | On connect or LUSERS command | `{"command":"255","to":"alice","body":["I have 5 clients and 1 servers"]}` |
-| `311` | RPL_WHOISUSER       | In response to WHOIS | `{"command":"311","to":"alice","params":["bob","bob","neoirc","*"],"body":["bob"]}` |
+| `311` | RPL_WHOISUSER       | In response to WHOIS | `{"command":"311","to":"alice","params":["bob","bobident","host.example.com","*"],"body":["bob"]}` |
 | `312` | RPL_WHOISSERVER     | In response to WHOIS | `{"command":"312","to":"alice","params":["bob","neoirc"],"body":["neoirc server"]}` |
 | `315` | RPL_ENDOFWHO        | End of WHO response | `{"command":"315","to":"alice","params":["#general"],"body":["End of /WHO list"]}` |
 | `318` | RPL_ENDOFWHOIS      | End of WHOIS response | `{"command":"318","to":"alice","params":["bob"],"body":["End of /WHOIS list"]}` |
@@ -925,8 +1013,8 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | `329` | RPL_CREATIONTIME    | After channel MODE query | `{"command":"329","to":"alice","params":["#general","1709251200"]}` |
 | `331` | RPL_NOTOPIC         | Channel has no topic (on JOIN) | `{"command":"331","to":"alice","params":["#general"],"body":["No topic is set"]}` |
 | `332` | RPL_TOPIC           | On JOIN or TOPIC query | `{"command":"332","to":"alice","params":["#general"],"body":["Welcome!"]}` |
-| `352` | RPL_WHOREPLY        | In response to WHO | `{"command":"352","to":"alice","params":["#general","bob","neoirc","neoirc","bob","H"],"body":["0 bob"]}` |
-| `353` | RPL_NAMREPLY        | On JOIN or NAMES query | `{"command":"353","to":"alice","params":["=","#general"],"body":["@op1 alice bob +voiced1"]}` |
+| `352` | RPL_WHOREPLY        | In response to WHO | `{"command":"352","to":"alice","params":["#general","bobident","host.example.com","neoirc","bob","H"],"body":["0 bob"]}` |
+| `353` | RPL_NAMREPLY        | On JOIN or NAMES query | `{"command":"353","to":"alice","params":["=","#general"],"body":["op1!op1@host1 alice!alice@host2 bob!bob@host3"]}` |
 | `366` | RPL_ENDOFNAMES      | End of NAMES response | `{"command":"366","to":"alice","params":["#general"],"body":["End of /NAMES list"]}` |
 | `372` | RPL_MOTD            | MOTD line | `{"command":"372","to":"alice","body":["Welcome to the server"]}` |
 | `375` | RPL_MOTDSTART       | Start of MOTD | `{"command":"375","to":"alice","body":["- neoirc-server Message of the Day -"]}` |
@@ -987,14 +1075,26 @@ the format:
 
 Create a new user session. This is the entry point for all clients.
 
-**Request:**
+If the server requires hashcash proof-of-work (see
+[Hashcash Proof-of-Work](#hashcash-proof-of-work)), the client must include a
+valid stamp in the `pow_token` field of the JSON request body. The required
+difficulty is advertised via `GET /api/v1/server` in the `hashcash_bits` field.
+
+**Request Body:**
 ```json
-{"nick": "alice"}
+{"nick": "alice", "username": "alice", "pow_token": "1:20:260310:neoirc::3a2f1"}
 ```
 
 | Field      | Type   | Required    | Constraints |
-|--------|--------|----------|-------------|
+|------------|--------|-------------|-------------|
 | `nick`     | string | Yes         | 1–32 characters, must be unique on the server |
+| `username` | string | No          | 1–32 characters, IRC ident-style. Defaults to nick if omitted. |
+| `pow_token` | string | Conditional | Hashcash stamp (required when server has `hashcash_bits` > 0) |
+
+The `username` field sets the user portion of the IRC hostmask
+(`nick!user@host`). The hostname is automatically resolved via reverse DNS of
+the connecting client's IP address at session creation time. Together these form
+the hostmask used in WHOIS, WHO, and future ban matching (`+b`).
 
 **Response:** `201 Created`
 ```json
@@ -1016,13 +1116,120 @@ Create a new user session. This is the entry point for all clients.
 | Status | Error | When |
 |--------|-------|------|
 | 400    | `nick must be 1-32 characters` | Empty or too-long nick |
+| 400    | `invalid username format` | Username doesn't match allowed format |
+| 402    | `hashcash proof-of-work required` | Missing `pow_token` field in request body when hashcash is enabled |
+| 402    | `invalid hashcash stamp: ...` | Stamp fails validation (wrong bits, expired, reused, etc.) |
 | 409    | `nick already taken` | Another active session holds this nick |
 
 **curl example:**
 ```bash
 TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/session \
   -H 'Content-Type: application/json' \
-  -d '{"nick":"alice"}' | jq -r .token)
+  -d '{"nick":"alice","pow_token":"1:20:260310:neoirc::3a2f1"}' | jq -r .token)
+echo $TOKEN
+```
+
+### POST /api/v1/register — Register Account
+
+Create a new user session with a password. The password is hashed
+with bcrypt and stored server-side. The password enables login from
+additional clients via `POST /api/v1/login` while the session
+remains active.
+
+**Request Body:**
+```json
+{"nick": "alice", "username": "alice", "password": "mypassword"}
+```
+
+| Field      | Type   | Required | Constraints |
+|------------|--------|----------|-------------|
+| `nick`     | string | Yes      | 1–32 characters, must be unique on the server |
+| `username` | string | No       | 1–32 characters, IRC ident-style. Defaults to nick if omitted. |
+| `password` | string | Yes      | Minimum 8 characters |
+
+The `username` and hostname (auto-resolved via reverse DNS) form the IRC
+hostmask (`nick!user@host`) shown in WHOIS and WHO responses.
+
+**Response:** `201 Created`
+```json
+{
+  "id": 1,
+  "nick": "alice",
+  "token": "494ba9fc0f2242873fc5c285dd4a24fc3844ba5e67789a17e69b6fe5f8c132e3"
+}
+```
+
+| Field   | Type    | Description |
+|---------|---------|-------------|
+| `id`    | integer | Server-assigned user ID |
+| `nick`  | string  | Confirmed nick |
+| `token` | string  | 64-character hex auth token |
+
+**Errors:**
+
+| Status | Error | When |
+|--------|-------|------|
+| 400    | `invalid nick format` | Nick doesn't match allowed format |
+| 400    | `invalid username format` | Username doesn't match allowed format |
+| 400    | `password must be at least 8 characters` | Password too short |
+| 409    | `nick already taken` | Another active session holds this nick |
+
+**curl example:**
+```bash
+TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/register \
+  -H 'Content-Type: application/json' \
+  -d '{"nick":"alice","password":"mypassword"}' | jq -r .token)
+echo $TOKEN
+```
+
+### POST /api/v1/login — Login to Account
+
+Authenticate with a previously registered nick and password. Creates a new
+client token for the existing session, preserving channel memberships and
+message queues. This is how multi-client access works for registered accounts:
+each login adds a new client to the session.
+
+On successful login, the server enqueues MOTD messages and synthetic channel
+state (JOIN + TOPIC + NAMES for each channel the session belongs to) into the
+new client's queue, so the client can immediately restore its UI state.
+
+**Request Body:**
+```json
+{"nick": "alice", "password": "mypassword"}
+```
+
+| Field      | Type   | Required | Constraints |
+|------------|--------|----------|-------------|
+| `nick`     | string | Yes      | Must match a registered account |
+| `password` | string | Yes      | Must match the account's password |
+
+**Response:** `200 OK`
+```json
+{
+  "id": 1,
+  "nick": "alice",
+  "token": "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f"
+}
+```
+
+| Field   | Type    | Description |
+|---------|---------|-------------|
+| `id`    | integer | Session ID (same as when registered) |
+| `nick`  | string  | Current nick |
+| `token` | string  | New 64-character hex auth token for this client |
+
+**Errors:**
+
+| Status | Error | When |
+|--------|-------|------|
+| 400    | `nick and password required` | Missing nick or password |
+| 401    | `invalid credentials` | Wrong password, nick not found, or account has no password |
+
+**curl example:**
+```bash
+TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/login \
+  -H 'Content-Type: application/json' \
+  -d '{"nick":"alice","password":"mypassword"}' | jq -r .token)
 echo $TOKEN
 ```
 
@@ -1376,26 +1583,55 @@ Return server metadata. No authentication required.
   "name": "My NeoIRC Server",
   "version": "0.1.0",
   "motd": "Welcome! Be nice.",
-  "users": 42
+  "users": 42,
+  "hashcash_bits": 20
 }
 ```
 
 | Field           | Type    | Description |
-|-----------|---------|-------------|
+|-----------------|---------|-------------|
 | `name`          | string  | Server display name |
 | `version`       | string  | Server version |
 | `motd`          | string  | Message of the day |
 | `users`         | integer | Number of currently active user sessions |
+| `hashcash_bits` | integer | Required proof-of-work difficulty (leading zero bits). Only present when > 0. See [Hashcash Proof-of-Work](#hashcash-proof-of-work). |
 
 ### GET /.well-known/healthcheck.json — Health Check
 
-Standard health check endpoint. No authentication required.
+Standard health check endpoint. No authentication required. Returns server
+health status and runtime statistics.
 
 **Response:** `200 OK`
+
 ```json
-{"status": "ok"}
+{
+  "status": "ok",
+  "now": "2024-01-15T12:00:00.000000000Z",
+  "uptimeSeconds": 3600,
+  "uptimeHuman": "1h0m0s",
+  "version": "0.1.0",
+  "appname": "neoirc",
+  "maintenanceMode": false,
+  "sessions": 42,
+  "clients": 85,
+  "queuedLines": 128,
+  "channels": 7,
+  "connectionsSinceBoot": 200,
+  "sessionsSinceBoot": 150,
+  "messagesSinceBoot": 5000
+}
 ```
 
+| Field                  | Description                                       |
+| ---------------------- | ------------------------------------------------- |
+| `sessions`             | Current number of active sessions                 |
+| `clients`              | Current number of connected clients               |
+| `queuedLines`          | Total entries in client output queues              |
+| `channels`             | Current number of channels                        |
+| `connectionsSinceBoot` | Total client connections since server start        |
+| `sessionsSinceBoot`    | Total sessions created since server start          |
+| `messagesSinceBoot`    | Total PRIVMSG/NOTICE messages sent since server start |
+
 ---
 
 ## Message Flow
@@ -1580,9 +1816,16 @@ authenticity.
 ### Authentication
 
 - **Session auth**: Opaque bearer tokens (64 hex chars = 256 bits of entropy).
-  Tokens are stored in the database and validated on every request.
-- **No passwords**: Session creation requires only a nick. The token is the
-  sole credential.
+  Tokens are hashed (SHA-256) before storage and validated on every request.
+- **Anonymous sessions**: `POST /api/v1/session` requires only a nick. No
+  password, instant access. The token is the sole credential.
+- **Registered accounts**: `POST /api/v1/register` accepts a nick and password
+  (minimum 8 characters). The password is hashed with bcrypt at the default
+  cost factor and stored alongside the session. `POST /api/v1/login`
+  authenticates against the stored hash and issues a new client token.
+- **Password security**: Passwords are never stored in plain text. bcrypt
+  handles salting and key stretching automatically. Anonymous sessions have
+  an empty `password_hash` and cannot be logged into via `/login`.
 - **Token security**: Tokens should be treated like session cookies. Transmit
   only over HTTPS in production. If a token is compromised, the attacker has
   full access to the session until QUIT or expiry.
@@ -1730,13 +1973,28 @@ The database schema is managed via embedded SQL migration files in
 
 **Current tables:**
 
-#### `users`
+#### `sessions`
+| Column         | Type     | Description |
+|----------------|----------|-------------|
+| `id`           | INTEGER  | Primary key (auto-increment) |
+| `uuid`         | TEXT     | Unique session UUID |
+| `nick`         | TEXT     | Unique nick |
+| `username`     | TEXT     | IRC ident/username portion of the hostmask (defaults to nick) |
+| `hostname`     | TEXT     | Reverse DNS hostname of the connecting client IP |
+| `password_hash`| TEXT     | bcrypt hash (empty string for anonymous sessions) |
+| `signing_key`  | TEXT     | Public signing key (empty string if unset) |
+| `away_message` | TEXT     | Away message (empty string if not away) |
+| `created_at`   | DATETIME | Session creation time |
+| `last_seen`    | DATETIME | Last API request time |
+
+#### `clients`
 | Column      | Type     | Description |
 |-------------|----------|-------------|
 | `id`        | INTEGER  | Primary key (auto-increment) |
-| `nick`      | TEXT     | Unique nick |
-| `token`     | TEXT     | Unique auth token (64 hex chars) |
-| `created_at`| DATETIME | Session creation time |
+| `uuid`      | TEXT     | Unique client UUID |
+| `session_id`| INTEGER  | FK → sessions.id (cascade delete) |
+| `token`     | TEXT     | Unique auth token (SHA-256 hash of 64 hex chars) |
+| `created_at`| DATETIME | Client creation time |
 | `last_seen` | DATETIME | Last API request time |
 
 #### `channels`
@@ -1788,15 +2046,24 @@ skew issues) and simpler than UUIDs (integer comparison vs. string comparison).
 
 ### Data Lifecycle
 
-- **Messages**: Stored indefinitely in the current implementation. Rotation
-  per `MAX_HISTORY` is planned.
-- **Queue entries**: Stored until pruned. Pruning by `QUEUE_MAX_AGE` is
-  planned.
+- **Messages**: Pruned automatically when older than `MESSAGE_MAX_AGE`
+  (default 30 days).
+- **Client output queue entries**: Pruned automatically when older than
+  `QUEUE_MAX_AGE` (default 30 days).
 - **Channels**: Deleted when the last member leaves (ephemeral).
-- **Users/sessions**: Deleted on `QUIT` or `POST /api/v1/logout`. Idle
-  sessions are automatically expired after `SESSION_IDLE_TIMEOUT` (default
-  24h) — the server runs a background cleanup loop that parts idle users
-  from all channels, broadcasts QUIT, and releases their nicks.
+- **Sessions**: Both anonymous and registered sessions are deleted on `QUIT`
+  or when the last client logs out (`POST /api/v1/logout` with no remaining
+  clients triggers session cleanup). There is no distinction between session
+  types in the cleanup path — `handleQuit` and `cleanupUser` both call
+  `DeleteSession` unconditionally. Idle sessions are automatically expired
+  after `SESSION_IDLE_TIMEOUT`
+  (default 30 days) — the server runs a background cleanup loop that parts
+  idle users from all channels, broadcasts QUIT, and releases their nicks.
+- **Clients**: Individual client tokens are deleted on `POST /api/v1/logout`.
+  A session can have multiple clients; removing one doesn't affect others.
+  However, when the last client is removed (via logout), the entire session
+  is deleted — the user is parted from all channels, QUIT is broadcast, and
+  the nick is released.
 
 ---
 
@@ -1812,9 +2079,9 @@ directory is also loaded automatically via
 | `PORT`             | int     | `8080`                               | HTTP listen port |
 | `DBURL`            | string  | `file:///var/lib/neoirc/state.db?_journal_mode=WAL` | SQLite connection string. For file-based: `file:///path/to/db.db?_journal_mode=WAL`. For in-memory (testing): `file::memory:?cache=shared`. |
 | `DEBUG`            | bool    | `false`                              | Enable debug logging (verbose request/response logging) |
-| `MAX_HISTORY`      | int     | `10000`                              | Maximum messages retained per channel before rotation (planned) |
-| `SESSION_IDLE_TIMEOUT` | string | `24h`                            | Session idle timeout as a Go duration string (e.g. `24h`, `30m`). Sessions with no activity for this long are expired and the nick is released. |
-| `QUEUE_MAX_AGE`    | int     | `172800`                             | Maximum age of client queue entries in seconds (48h). Entries older than this are pruned (planned). |
+| `MESSAGE_MAX_AGE`  | string  | `720h`                               | Maximum age of messages as a Go duration string (e.g. `720h`, `24h`). Messages older than this are pruned. Default is 30 days. |
+| `SESSION_IDLE_TIMEOUT` | string | `720h`                           | Session idle timeout as a Go duration string (e.g. `720h`, `24h`). Sessions with no activity for this long are expired and the nick is released. Default is 30 days. |
+| `QUEUE_MAX_AGE`    | string  | `720h`                               | Maximum age of client output queue entries as a Go duration string (e.g. `720h`, `24h`). Entries older than this are pruned. Default is 30 days. |
 | `MAX_MESSAGE_SIZE` | int     | `4096`                               | Maximum message body size in bytes (planned enforcement) |
 | `LONG_POLL_TIMEOUT`| int     | `15`                                 | Default long-poll timeout in seconds (client can override via query param, server caps at 30) |
 | `MOTD`             | string  | `""`                                 | Message of the day, shown to clients via `GET /api/v1/server` |
@@ -1823,6 +2090,7 @@ directory is also loaded automatically via
 | `SENTRY_DSN`       | string  | `""`                                 | Sentry error tracking DSN (optional) |
 | `METRICS_USERNAME` | string  | `""`                                 | Basic auth username for `/metrics` endpoint. If empty, metrics endpoint is disabled. |
 | `METRICS_PASSWORD` | string  | `""`                                 | Basic auth password for `/metrics` endpoint |
+| `NEOIRC_HASHCASH_BITS` | int | `20`                               | Required hashcash proof-of-work difficulty (leading zero bits in SHA-256) for session creation. Set to `0` to disable. |
 | `MAINTENANCE_MODE` | bool    | `false`                              | Maintenance mode flag (reserved) |
 
 ### Example `.env` file
@@ -1833,7 +2101,8 @@ SERVER_NAME=My NeoIRC Server
 MOTD=Welcome! Be excellent to each other.
 DEBUG=false
 DBURL=file:///var/lib/neoirc/state.db?_journal_mode=WAL
-SESSION_IDLE_TIMEOUT=24h
+SESSION_IDLE_TIMEOUT=720h
+NEOIRC_HASHCASH_BITS=20
 ```
 
 ---
@@ -1943,11 +2212,21 @@ A complete client needs only four HTTP calls:
 ### Step-by-Step with curl
 
 ```bash
-# 1. Create a session
+# 1a. Create an anonymous session (no account)
 export TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/session \
   -H 'Content-Type: application/json' \
   -d '{"nick":"testuser"}' | jq -r .token)
 
+# 1b. Or register an account (multi-client support)
+export TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/register \
+  -H 'Content-Type: application/json' \
+  -d '{"nick":"testuser","password":"mypassword"}' | jq -r .token)
+
+# 1c. Or login to an existing account
+export TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/login \
+  -H 'Content-Type: application/json' \
+  -d '{"nick":"testuser","password":"mypassword"}' | jq -r .token)
+
 # 2. Join a channel
 curl -s -X POST http://localhost:8080/api/v1/messages \
   -H "Authorization: Bearer $TOKEN" \
@@ -2080,9 +2359,11 @@ Clients should handle these message commands from the queue:
 
 ### Error Handling
 
-- **HTTP 401**: Token expired or invalid. Re-create session.
+- **HTTP 401**: Token expired or invalid. Re-create session (anonymous) or
+  re-login (registered account).
 - **HTTP 404**: Channel or user not found.
-- **HTTP 409**: Nick already taken (on session creation or NICK change).
+- **HTTP 409**: Nick already taken (on session creation, registration, or
+  NICK change).
 - **HTTP 400**: Malformed request. Check the `error` field in the response.
 - **Network errors**: Back off exponentially (1s, 2s, 4s, ..., max 30s).
 
@@ -2099,69 +2380,111 @@ Clients should handle these message commands from the queue:
 4. **DM tab logic**: When you receive a PRIVMSG where `to` is not a channel
    (no `#` prefix), the DM tab should be keyed by the **other** user's nick:
    if `from` is you, use `to`; if `from` is someone else, use `from`.
-5. **Reconnection**: If the poll loop fails with 401, the session is gone.
-   Create a new session. If it fails with a network error, retry with backoff.
+5. **Reconnection**: If the poll loop fails with 401, the token is invalid.
+   For anonymous sessions, create a new session. For registered accounts,
+   log in again via `POST /api/v1/login` to get a fresh token on the same
+   session. If it fails with a network error, retry with backoff.
 
 ---
 
 ## Rate Limiting & Abuse Prevention
 
-Session creation (`POST /api/v1/session`) will require a
+### Hashcash Proof-of-Work
+
+Session creation (`POST /api/v1/session`) requires a
 [hashcash](https://en.wikipedia.org/wiki/Hashcash)-style proof-of-work token.
 This is the primary defense against resource exhaustion — no CAPTCHAs, no
 account registration, no IP-based rate limits that punish shared networks.
 
 ### How It Works
 
-1. Client requests a challenge: `GET /api/v1/challenge`
-   ```json
-   → {"nonce": "random-hex-string", "difficulty": 20, "expires": "2026-02-10T20:01:00Z"}
-   ```
-2. Server returns a nonce and a required difficulty (number of leading zero
-   bits in the SHA-256 hash)
-3. Client finds a counter value such that `SHA-256(nonce || ":" || counter)`
-   has the required number of leading zero bits:
-   ```
-   SHA-256("a1b2c3:0")     = 0xf3a1...  (0 leading zeros — no good)
-   SHA-256("a1b2c3:1")     = 0x8c72...  (0 leading zeros — no good)
-   ...
-   SHA-256("a1b2c3:94217") = 0x00003a... (20 leading zero bits — success!)
-   ```
-4. Client submits the proof with the session request:
-   ```json
-   POST /api/v1/session
-   {"nick": "alice", "proof": {"nonce": "a1b2c3", "counter": 94217}}
-   ```
-5. Server verifies:
-   - Nonce was issued by this server and hasn't expired
-   - Nonce hasn't been used before (prevent replay)
-   - `SHA-256(nonce || ":" || counter)` has the required leading zeros
-   - If valid, create the session normally
+1. Client fetches server info: `GET /api/v1/server` returns a `hashcash_bits`
+   field (e.g., `20`) indicating the required difficulty.
+2. Client computes a hashcash stamp: find a counter value such that the
+   SHA-256 hash of the stamp string has the required number of leading zero
+   bits.
+3. Client includes the stamp in the `pow_token` field of the JSON request body when creating
+   a session: `POST /api/v1/session`.
+4. Server validates the stamp:
+   - Version is `1`
+   - Claimed bits ≥ required bits
+   - Resource matches the server name
+   - Date is within 48 hours (not expired, not too far in the future)
+   - SHA-256 hash has the required leading zero bits
+   - Stamp has not been used before (replay prevention)
 
-### Adaptive Difficulty
+### Stamp Format
 
-The required difficulty scales with server load. Under normal conditions, the
-cost is negligible (a few milliseconds of CPU). As concurrent sessions or
-session creation rate increases, difficulty rises — making bulk session creation
-exponentially more expensive for attackers while remaining cheap for legitimate
-single-user connections.
+Standard hashcash format:
 
-| Server Load        | Difficulty (bits) | Approx. Client CPU |
-|--------------------|-------------------|--------------------|
-| Normal (< 100/min) | 16                | ~1ms               |
-| Elevated           | 20                | ~15ms              |
-| High               | 24                | ~250ms             |
-| Under attack       | 28+               | ~4s+               |
+```
+1:bits:date:resource::counter
+```
 
-Each additional bit of difficulty doubles the expected work. An attacker
-creating 1000 sessions at difficulty 28 needs ~4000 CPU-seconds; a legitimate
-user creating one session needs ~4 seconds once and never again for the
-duration of their session.
+| Field      | Description |
+|------------|-------------|
+| `1`        | Version (always `1`) |
+| `bits`     | Claimed difficulty (must be ≥ server's `hashcash_bits`) |
+| `date`     | Date stamp in `YYMMDD` or `YYMMDDHHMMSS` format (UTC) |
+| `resource` | The server name (from `GET /api/v1/server`; defaults to `neoirc`) |
+| (empty)    | Extension field (unused) |
+| `counter`  | Hex counter value found by the client to satisfy the PoW |
+
+**Example stamp:** `1:20:260310:neoirc::3a2f1b`
+
+The SHA-256 hash of this entire string must have at least 20 leading zero bits.
+
+### Computing a Stamp
+
+```bash
+# Pseudocode
+bits = 20
+resource = "neoirc"
+date = "260310"         # YYMMDD in UTC
+counter = 0
+
+loop:
+    stamp = "1:{bits}:{date}:{resource}::{hex(counter)}"
+    hash = SHA-256(stamp)
+    if leading_zero_bits(hash) >= bits:
+        return stamp
+    counter++
+```
+
+At difficulty 20, this requires approximately 2^20 (~1M) hash attempts on
+average, taking roughly 0.5–2 seconds on modern hardware.
+
+### Client Integration
+
+Both the embedded web SPA and the CLI client automatically handle hashcash:
+
+1. Fetch `GET /api/v1/server` to read `hashcash_bits`
+2. If `hashcash_bits > 0`, compute a valid stamp
+3. Include the stamp in the `pow_token` field of the JSON body on `POST /api/v1/session`
+
+The web SPA uses the Web Crypto API (`crypto.subtle.digest`) for SHA-256
+computation with batched parallelism. The CLI client uses Go's `crypto/sha256`.
+
+### Configuration
+
+Set `NEOIRC_HASHCASH_BITS` to control difficulty:
+
+| Value | Effect | Approx. Client CPU |
+|-------|--------|---------------------|
+| `0`   | Disabled (no proof-of-work required) | — |
+| `16`  | Light protection | ~1ms |
+| `20`  | Default — good balance | ~0.5–2s |
+| `24`  | Strong protection | ~10–30s |
+| `28`  | Very strong (may frustrate users) | ~2–10min |
+
+Each additional bit doubles the expected work. An attacker creating 1000
+sessions at difficulty 20 needs ~1000–2000 CPU-seconds; a legitimate user
+creating one session pays once and keeps their session.
 
 ### Why Hashcash and Not Rate Limits?
 
 - **No state to track**: No IP tables, no token buckets, no sliding windows.
-  The server only needs to verify a hash.
+  The server only needs to verify a single hash.
 - **Works through NATs and proxies**: Doesn't punish shared IPs (university
   campuses, corporate networks, Tor exits). Every client computes their own
   proof independently.
@@ -2169,36 +2492,9 @@ duration of their session.
   (one SHA-256 hash) regardless of difficulty. Only the client does more work.
 - **Fits the "no accounts" philosophy**: Proof-of-work is the cost of entry.
   No registration, no email, no phone number, no CAPTCHA. Just compute.
-- **Trivial for legitimate clients**: A single-user client pays ~1ms of CPU
-  once. A botnet trying to create thousands of sessions pays exponentially more.
 - **Language-agnostic**: SHA-256 is available in every programming language.
   The proof computation is trivially implementable in any client.
 
-### Challenge Endpoint (Planned)
-
-```
-GET /api/v1/challenge
-```
-
-**Response:** `200 OK`
-```json
-{
-  "nonce": "a1b2c3d4e5f6...",
-  "difficulty": 20,
-  "algorithm": "sha256",
-  "expires": "2026-02-10T20:01:00Z"
-}
-```
-
-| Field        | Type    | Description |
-|--------------|---------|-------------|
-| `nonce`      | string  | Server-generated random hex string (32+ chars) |
-| `difficulty` | integer | Required number of leading zero bits in the hash |
-| `algorithm`  | string  | Hash algorithm (always `sha256` for now) |
-| `expires`    | string  | ISO 8601 expiry time for this challenge |
-
-**Status:** Not yet implemented. Tracked for post-MVP.
-
 ---
 
 ## Roadmap
@@ -2227,9 +2523,9 @@ GET /api/v1/challenge
 
 ### Post-MVP (Planned)
 
-- [ ] **Hashcash proof-of-work** for session creation (abuse prevention)
-- [ ] **Queue pruning** — delete old queue entries per `QUEUE_MAX_AGE`
-- [ ] **Message rotation** — enforce `MAX_HISTORY` per channel
+- [x] **Hashcash proof-of-work** for session creation (abuse prevention)
+- [x] **Client output queue pruning** — delete old client output queue entries per `QUEUE_MAX_AGE`
+- [x] **Message rotation** — prune messages older than `MESSAGE_MAX_AGE`
 - [ ] **Channel modes** — enforce `+i`, `+m`, `+s`, `+t`, `+n`
 - [ ] **User channel modes** — `+o` (operator), `+v` (voice)
 - [x] **MODE command** — query channel and user modes (set not yet implemented)
@@ -2280,15 +2576,18 @@ neoirc/
 ├── cmd/
 │   ├── neoircd/            # Server binary entry point
 │   │   └── main.go
-│   └── neoirc-cli/         # TUI client
-│       ├── main.go         # Command handling, poll loop
-│       ├── ui.go           # tview-based terminal UI
-│       └── api/
-│           ├── client.go   # HTTP API client library
-│           └── types.go    # Request/response types
+│   └── neoirc-cli/         # TUI client entry point
+│       └── main.go         # Minimal bootstrapping (calls internal/cli)
 ├── internal/
 │   ├── broker/             # In-memory pub/sub for long-poll notifications
 │   │   └── broker.go
+│   ├── cli/                # TUI client implementation
+│   │   ├── app.go          # App struct, command handling, poll loop
+│   │   ├── ui.go           # tview-based terminal UI
+│   │   └── api/
+│   │       ├── client.go   # HTTP API client library
+│   │       ├── types.go    # Request/response types
+│   │       └── hashcash.go # Hashcash proof-of-work minting
 │   ├── config/             # Viper-based configuration
 │   │   └── config.go
 │   ├── db/                 # Database access and migrations
@@ -2304,6 +2603,8 @@ neoirc/
 │   │   └── healthcheck.go  # Health check handler
 │   ├── healthcheck/        # Health check logic
 │   │   └── healthcheck.go
+│   ├── stats/              # Runtime statistics (atomic counters)
+│   │   └── stats.go
 │   ├── logger/             # slog-based logging
 │   │   └── logger.go
 │   ├── middleware/          # HTTP middleware (logging, CORS, metrics, auth)
@@ -2336,7 +2637,7 @@ neoirc/
 | Purpose    | Library |
 |------------|---------|
 | DI         | `go.uber.org/fx` |
-| Router     | `github.com/go-chi/chi/v5` |
+| Router     | `github.com/go-chi/chi` |
 | Logging    | `log/slog` (stdlib) |
 | Config     | `github.com/spf13/viper` |
 | Env        | `github.com/joho/godotenv/autoload` |
@@ -2355,9 +2656,13 @@ neoirc/
    build a working IRC-style TUI client against this API in an afternoon, the
    API is too complex.
 
-2. **No accounts** — identity is a signing key, nick is a display name. No
-   registration, no passwords, no email verification. Session creation is
-   instant. The cost of entry is a hashcash proof, not bureaucracy.
+2. **Accounts optional** — anonymous sessions are instant: pick a nick and
+   talk. No registration, no email verification. The cost of entry is a
+   hashcash proof, not bureaucracy. For users who want multi-client access
+   (multiple devices sharing one session), optional account registration
+   with password is available — but never required. Identity
+   verification at the message layer uses cryptographic signing,
+   independent of account status.
 
 3. **IRC semantics over HTTP** — command names and numeric codes from
    RFC 1459/2812. If you've built an IRC client or bot, you already know the

cmd/neoirc-cli/main.go

@@ -1,911 +1,8 @@
 // Package main is the entry point for the neoirc-cli client.
 package main
 
-import (
-	"fmt"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	api "git.eeqj.de/sneak/neoirc/cmd/neoirc-cli/api"
-	"git.eeqj.de/sneak/neoirc/internal/irc"
-)
-
-const (
-	splitParts  = 2
-	pollTimeout = 15
-	pollRetry   = 2 * time.Second
-	timeFormat  = "15:04"
-)
-
-// App holds the application state.
-type App struct {
-	ui     *UI
-	client *api.Client
-
-	mu        sync.Mutex
-	nick      string
-	target    string
-	connected bool
-	lastQID   int64
-	stopPoll  chan struct{}
-}
+import "git.eeqj.de/sneak/neoirc/internal/cli"
 
 func main() {
-	app := &App{ //nolint:exhaustruct
-		ui:   NewUI(),
-		nick: "guest",
-	}
-
-	app.ui.OnInput(app.handleInput)
-	app.ui.SetStatus(app.nick, "", "disconnected")
-
-	app.ui.AddStatus(
-		"Welcome to neoirc-cli — an IRC-style client",
-	)
-	app.ui.AddStatus(
-		"Type [yellow]/connect <server-url>" +
-			"[white] to begin, " +
-			"or [yellow]/help[white] for commands",
-	)
-
-	err := app.ui.Run()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func (a *App) handleInput(text string) {
-	if strings.HasPrefix(text, "/") {
-		a.handleCommand(text)
-
-		return
-	}
-
-	a.mu.Lock()
-	target := a.target
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus(
-			"[red]Not connected. Use /connect <url>",
-		)
-
-		return
-	}
-
-	if target == "" {
-		a.ui.AddStatus(
-			"[red]No target. " +
-				"Use /join #channel or /query nick",
-		)
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: irc.CmdPrivmsg,
-		To:      target,
-		Body:    []string{text},
-	})
-	if err != nil {
-		a.ui.AddStatus(
-			"[red]Send error: " + err.Error(),
-		)
-
-		return
-	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
-}
-
-func (a *App) handleCommand(text string) {
-	parts := strings.SplitN(text, " ", splitParts)
-	cmd := strings.ToLower(parts[0])
-
-	args := ""
-	if len(parts) > 1 {
-		args = parts[1]
-	}
-
-	a.dispatchCommand(cmd, args)
-}
-
-func (a *App) dispatchCommand(cmd, args string) {
-	switch cmd {
-	case "/connect":
-		a.cmdConnect(args)
-	case "/nick":
-		a.cmdNick(args)
-	case "/join":
-		a.cmdJoin(args)
-	case "/part":
-		a.cmdPart(args)
-	case "/msg":
-		a.cmdMsg(args)
-	case "/query":
-		a.cmdQuery(args)
-	case "/topic":
-		a.cmdTopic(args)
-	case "/window", "/w":
-		a.cmdWindow(args)
-	case "/quit":
-		a.cmdQuit()
-	case "/help":
-		a.cmdHelp()
-	default:
-		a.dispatchInfoCommand(cmd, args)
-	}
-}
-
-func (a *App) dispatchInfoCommand(cmd, args string) {
-	switch cmd {
-	case "/names":
-		a.cmdNames()
-	case "/list":
-		a.cmdList()
-	case "/motd":
-		a.cmdMotd()
-	case "/who":
-		a.cmdWho(args)
-	case "/whois":
-		a.cmdWhois(args)
-	default:
-		a.ui.AddStatus(
-			"[red]Unknown command: " + cmd,
-		)
-	}
-}
-
-func (a *App) cmdConnect(serverURL string) {
-	if serverURL == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /connect <server-url>",
-		)
-
-		return
-	}
-
-	serverURL = strings.TrimRight(serverURL, "/")
-
-	a.ui.AddStatus("Connecting to " + serverURL + "...")
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	client := api.NewClient(serverURL)
-
-	resp, err := client.CreateSession(nick)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Connection failed: %v", err,
-		))
-
-		return
-	}
-
-	a.mu.Lock()
-	a.client = client
-	a.nick = resp.Nick
-	a.connected = true
-	a.lastQID = 0
-	a.mu.Unlock()
-
-	a.ui.AddStatus(fmt.Sprintf(
-		"[green]Connected! Nick: %s, Session: %d",
-		resp.Nick, resp.ID,
-	))
-	a.ui.SetStatus(resp.Nick, "", "connected")
-
-	a.stopPoll = make(chan struct{})
-
-	go a.pollLoop()
-}
-
-func (a *App) cmdNick(nick string) {
-	if nick == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /nick <name>",
-		)
-
-		return
-	}
-
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.mu.Lock()
-		a.nick = nick
-		a.mu.Unlock()
-
-		a.ui.AddStatus(
-			"Nick set to " + nick +
-				" (will be used on connect)",
-		)
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: irc.CmdNick,
-		Body:    []string{nick},
-	})
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Nick change failed: %v", err,
-		))
-
-		return
-	}
-
-	a.mu.Lock()
-	a.nick = nick
-	target := a.target
-	a.mu.Unlock()
-
-	a.ui.SetStatus(nick, target, "connected")
-	a.ui.AddStatus("Nick changed to " + nick)
-}
-
-func (a *App) cmdJoin(channel string) {
-	if channel == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /join #channel",
-		)
-
-		return
-	}
-
-	if !strings.HasPrefix(channel, "#") {
-		channel = "#" + channel
-	}
-
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.JoinChannel(channel)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Join failed: %v", err,
-		))
-
-		return
-	}
-
-	a.mu.Lock()
-	a.target = channel
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.SwitchToBuffer(channel)
-	a.ui.AddLine(channel,
-		"[yellow]*** Joined "+channel,
-	)
-	a.ui.SetStatus(nick, channel, "connected")
-}
-
-func (a *App) cmdPart(channel string) {
-	a.mu.Lock()
-	if channel == "" {
-		channel = a.target
-	}
-
-	connected := a.connected
-	a.mu.Unlock()
-
-	if channel == "" ||
-		!strings.HasPrefix(channel, "#") {
-		a.ui.AddStatus("[red]No channel to part")
-
-		return
-	}
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.PartChannel(channel)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Part failed: %v", err,
-		))
-
-		return
-	}
-
-	a.ui.AddLine(channel,
-		"[yellow]*** Left "+channel,
-	)
-
-	a.mu.Lock()
-	if a.target == channel {
-		a.target = ""
-	}
-
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.SwitchBuffer(0)
-	a.ui.SetStatus(nick, "", "connected")
-}
-
-func (a *App) cmdMsg(args string) {
-	parts := strings.SplitN(args, " ", splitParts)
-	if len(parts) < splitParts {
-		a.ui.AddStatus(
-			"[red]Usage: /msg <nick> <text>",
-		)
-
-		return
-	}
-
-	target, text := parts[0], parts[1]
-
-	a.mu.Lock()
-	connected := a.connected
-	nick := a.nick
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: irc.CmdPrivmsg,
-		To:      target,
-		Body:    []string{text},
-	})
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Send failed: %v", err,
-		))
-
-		return
-	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
-}
-
-func (a *App) cmdQuery(nick string) {
-	if nick == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /query <nick>",
-		)
-
-		return
-	}
-
-	a.mu.Lock()
-	a.target = nick
-	myNick := a.nick
-	a.mu.Unlock()
-
-	a.ui.SwitchToBuffer(nick)
-	a.ui.SetStatus(myNick, nick, "connected")
-}
-
-func (a *App) cmdTopic(args string) {
-	a.mu.Lock()
-	target := a.target
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	if !strings.HasPrefix(target, "#") {
-		a.ui.AddStatus("[red]Not in a channel")
-
-		return
-	}
-
-	if args == "" {
-		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-			Command: irc.CmdTopic,
-			To:      target,
-		})
-		if err != nil {
-			a.ui.AddStatus(fmt.Sprintf(
-				"[red]Topic query failed: %v", err,
-			))
-		}
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: irc.CmdTopic,
-		To:      target,
-		Body:    []string{args},
-	})
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Topic set failed: %v", err,
-		))
-	}
-}
-
-func (a *App) cmdNames() {
-	a.mu.Lock()
-	target := a.target
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	if !strings.HasPrefix(target, "#") {
-		a.ui.AddStatus("[red]Not in a channel")
-
-		return
-	}
-
-	members, err := a.client.GetMembers(target)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Names failed: %v", err,
-		))
-
-		return
-	}
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[cyan]*** Members of %s: %s",
-		target, strings.Join(members, " "),
-	))
-}
-
-func (a *App) cmdList() {
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	channels, err := a.client.ListChannels()
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]List failed: %v", err,
-		))
-
-		return
-	}
-
-	a.ui.AddStatus("[cyan]*** Channel list:")
-
-	for _, ch := range channels {
-		a.ui.AddStatus(fmt.Sprintf(
-			"  %s (%d members) %s",
-			ch.Name, ch.Members, ch.Topic,
-		))
-	}
-
-	a.ui.AddStatus("[cyan]*** End of channel list")
-}
-
-func (a *App) cmdMotd() {
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.SendMessage(
-		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
-	)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]MOTD failed: %v", err,
-		))
-	}
-}
-
-func (a *App) cmdWho(args string) {
-	a.mu.Lock()
-	connected := a.connected
-	target := a.target
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	channel := args
-	if channel == "" {
-		channel = target
-	}
-
-	if channel == "" ||
-		!strings.HasPrefix(channel, "#") {
-		a.ui.AddStatus(
-			"[red]Usage: /who #channel",
-		)
-
-		return
-	}
-
-	err := a.client.SendMessage(
-		&api.Message{ //nolint:exhaustruct
-			Command: irc.CmdWho, To: channel,
-		},
-	)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]WHO failed: %v", err,
-		))
-	}
-}
-
-func (a *App) cmdWhois(args string) {
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	if args == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /whois <nick>",
-		)
-
-		return
-	}
-
-	err := a.client.SendMessage(
-		&api.Message{ //nolint:exhaustruct
-			Command: irc.CmdWhois, To: args,
-		},
-	)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]WHOIS failed: %v", err,
-		))
-	}
-}
-
-func (a *App) cmdWindow(args string) {
-	if args == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /window <number>",
-		)
-
-		return
-	}
-
-	var bufIndex int
-
-	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
-
-	a.ui.SwitchBuffer(bufIndex)
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
-		buf := a.ui.buffers[bufIndex]
-		if buf.Name != "(status)" {
-			a.mu.Lock()
-			a.target = buf.Name
-			a.mu.Unlock()
-
-			a.ui.SetStatus(
-				nick, buf.Name, "connected",
-			)
-		} else {
-			a.ui.SetStatus(nick, "", "connected")
-		}
-	}
-}
-
-func (a *App) cmdQuit() {
-	a.mu.Lock()
-
-	if a.connected && a.client != nil {
-		_ = a.client.SendMessage(
-			&api.Message{Command: irc.CmdQuit}, //nolint:exhaustruct
-		)
-	}
-
-	if a.stopPoll != nil {
-		close(a.stopPoll)
-	}
-
-	a.mu.Unlock()
-	a.ui.Stop()
-}
-
-func (a *App) cmdHelp() {
-	help := []string{
-		"[cyan]*** neoirc-cli commands:",
-		"  /connect <url>  — Connect to server",
-		"  /nick <name>    — Change nickname",
-		"  /join #channel  — Join channel",
-		"  /part [#chan]    — Leave channel",
-		"  /msg <nick> <text> — Send DM",
-		"  /query <nick>   — Open DM window",
-		"  /topic [text]   — View/set topic",
-		"  /names          — List channel members",
-		"  /list           — List channels",
-		"  /who [#channel] — List users in channel",
-		"  /whois <nick>   — Show user info",
-		"  /motd           — Show message of the day",
-		"  /window <n>     — Switch buffer",
-		"  /quit           — Disconnect and exit",
-		"  /help           — This help",
-		"  Plain text sends to current target.",
-	}
-
-	for _, line := range help {
-		a.ui.AddStatus(line)
-	}
-}
-
-// pollLoop long-polls for messages in the background.
-func (a *App) pollLoop() {
-	for {
-		select {
-		case <-a.stopPoll:
-			return
-		default:
-		}
-
-		a.mu.Lock()
-		client := a.client
-		lastQID := a.lastQID
-		a.mu.Unlock()
-
-		if client == nil {
-			return
-		}
-
-		result, err := client.PollMessages(
-			lastQID, pollTimeout,
-		)
-		if err != nil {
-			time.Sleep(pollRetry)
-
-			continue
-		}
-
-		if result.LastID > 0 {
-			a.mu.Lock()
-			a.lastQID = result.LastID
-			a.mu.Unlock()
-		}
-
-		for i := range result.Messages {
-			a.handleServerMessage(&result.Messages[i])
-		}
-	}
-}
-
-func (a *App) handleServerMessage(msg *api.Message) {
-	timestamp := a.formatTS(msg)
-
-	a.mu.Lock()
-	myNick := a.nick
-	a.mu.Unlock()
-
-	switch msg.Command {
-	case irc.CmdPrivmsg:
-		a.handlePrivmsgEvent(msg, timestamp, myNick)
-	case irc.CmdJoin:
-		a.handleJoinEvent(msg, timestamp)
-	case irc.CmdPart:
-		a.handlePartEvent(msg, timestamp)
-	case irc.CmdQuit:
-		a.handleQuitEvent(msg, timestamp)
-	case irc.CmdNick:
-		a.handleNickEvent(msg, timestamp, myNick)
-	case irc.CmdNotice:
-		a.handleNoticeEvent(msg, timestamp)
-	case irc.CmdTopic:
-		a.handleTopicEvent(msg, timestamp)
-	default:
-		a.handleDefaultEvent(msg, timestamp)
-	}
-}
-
-func (a *App) formatTS(msg *api.Message) string {
-	if msg.TS != "" {
-		return msg.ParseTS().UTC().Format(timeFormat)
-	}
-
-	return time.Now().Format(timeFormat)
-}
-
-func (a *App) handlePrivmsgEvent(
-	msg *api.Message, timestamp, myNick string,
-) {
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	if msg.From == myNick {
-		return
-	}
-
-	target := msg.To
-	if !strings.HasPrefix(target, "#") {
-		target = msg.From
-	}
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, msg.From, text,
-	))
-}
-
-func (a *App) handleJoinEvent(
-	msg *api.Message, timestamp string,
-) {
-	if msg.To == "" {
-		return
-	}
-
-	a.ui.AddLine(msg.To, fmt.Sprintf(
-		"[gray]%s [yellow]*** %s has joined %s",
-		timestamp, msg.From, msg.To,
-	))
-}
-
-func (a *App) handlePartEvent(
-	msg *api.Message, timestamp string,
-) {
-	if msg.To == "" {
-		return
-	}
-
-	lines := msg.BodyLines()
-	reason := strings.Join(lines, " ")
-
-	if reason != "" {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s (%s)",
-			timestamp, msg.From, msg.To, reason,
-		))
-	} else {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s",
-			timestamp, msg.From, msg.To,
-		))
-	}
-}
-
-func (a *App) handleQuitEvent(
-	msg *api.Message, timestamp string,
-) {
-	lines := msg.BodyLines()
-	reason := strings.Join(lines, " ")
-
-	if reason != "" {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has quit (%s)",
-			timestamp, msg.From, reason,
-		))
-	} else {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has quit",
-			timestamp, msg.From,
-		))
-	}
-}
-
-func (a *App) handleNickEvent(
-	msg *api.Message, timestamp, myNick string,
-) {
-	lines := msg.BodyLines()
-
-	newNick := ""
-	if len(lines) > 0 {
-		newNick = lines[0]
-	}
-
-	if msg.From == myNick && newNick != "" {
-		a.mu.Lock()
-		a.nick = newNick
-
-		target := a.target
-		a.mu.Unlock()
-
-		a.ui.SetStatus(newNick, target, "connected")
-	}
-
-	a.ui.AddStatus(fmt.Sprintf(
-		"[gray]%s [yellow]*** %s is now known as %s",
-		timestamp, msg.From, newNick,
-	))
-}
-
-func (a *App) handleNoticeEvent(
-	msg *api.Message, timestamp string,
-) {
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	a.ui.AddStatus(fmt.Sprintf(
-		"[gray]%s [magenta]--%s-- %s",
-		timestamp, msg.From, text,
-	))
-}
-
-func (a *App) handleTopicEvent(
-	msg *api.Message, timestamp string,
-) {
-	if msg.To == "" {
-		return
-	}
-
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	a.ui.AddLine(msg.To, fmt.Sprintf(
-		"[gray]%s [cyan]*** %s set topic: %s",
-		timestamp, msg.From, text,
-	))
-}
-
-func (a *App) handleDefaultEvent(
-	msg *api.Message, timestamp string,
-) {
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	if text != "" {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [white][%s] %s",
-			timestamp, msg.Command, text,
-		))
-	}
+	cli.Run()
 }

cmd/neoircd/main.go

@@ -10,6 +10,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/middleware"
 	"git.eeqj.de/sneak/neoirc/internal/server"
+	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
 
@@ -35,6 +36,7 @@ func main() {
 			server.New,
 			middleware.New,
 			healthcheck.New,
+			stats.New,
 		),
 		fx.Invoke(func(*server.Server) {}),
 	).Run()

internal/cli/api/client.go

@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/irc"
+	"git.eeqj.de/sneak/neoirc/pkg/irc"
 )
 
 const (
@@ -43,13 +43,30 @@ func NewClient(baseURL string) *Client {
 }
 
 // CreateSession creates a new session on the server.
+// If the server requires hashcash proof-of-work, it
+// automatically fetches the difficulty and computes a
+// valid stamp.
 func (client *Client) CreateSession(
 	nick string,
 ) (*SessionResponse, error) {
+	// Fetch server info to check for hashcash requirement.
+	info, err := client.GetServerInfo()
+
+	var hashcashStamp string
+
+	if err == nil && info.HashcashBits > 0 {
+		resource := info.Name
+		if resource == "" {
+			resource = "neoirc"
+		}
+
+		hashcashStamp = MintHashcash(info.HashcashBits, resource)
+	}
+
 	data, err := client.do(
 		http.MethodPost,
 		"/api/v1/session",
-		&SessionRequest{Nick: nick},
+		&SessionRequest{Nick: nick, Hashcash: hashcashStamp},
 	)
 	if err != nil {
 		return nil, err

internal/cli/api/hashcash.go

@@ -0,0 +1,79 @@
+package neoircapi
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"math/big"
+	"time"
+)
+
+const (
+	// bitsPerByte is the number of bits in a byte.
+	bitsPerByte = 8
+	// fullByteMask is 0xFF, a mask for all bits in a byte.
+	fullByteMask = 0xFF
+	// counterSpace is the range for random counter seeds.
+	counterSpace = 1 << 48
+)
+
+// MintHashcash computes a hashcash stamp with the given
+// difficulty (leading zero bits) and resource string.
+func MintHashcash(bits int, resource string) string {
+	date := time.Now().UTC().Format("060102")
+	prefix := fmt.Sprintf(
+		"1:%d:%s:%s::", bits, date, resource,
+	)
+
+	for {
+		counter := randomCounter()
+		stamp := prefix + counter
+		hash := sha256.Sum256([]byte(stamp))
+
+		if hasLeadingZeroBits(hash[:], bits) {
+			return stamp
+		}
+	}
+}
+
+// hasLeadingZeroBits checks if hash has at least numBits
+// leading zero bits.
+func hasLeadingZeroBits(
+	hash []byte,
+	numBits int,
+) bool {
+	fullBytes := numBits / bitsPerByte
+	remainBits := numBits % bitsPerByte
+
+	for idx := range fullBytes {
+		if hash[idx] != 0 {
+			return false
+		}
+	}
+
+	if remainBits > 0 && fullBytes < len(hash) {
+		mask := byte(
+			fullByteMask << (bitsPerByte - remainBits),
+		)
+
+		if hash[fullBytes]&mask != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// randomCounter generates a random hex counter string.
+func randomCounter() string {
+	counterVal, err := rand.Int(
+		rand.Reader, big.NewInt(counterSpace),
+	)
+	if err != nil {
+		// Fallback to timestamp-based counter on error.
+		return fmt.Sprintf("%x", time.Now().UnixNano())
+	}
+
+	return hex.EncodeToString(counterVal.Bytes())
+}

internal/cli/api/types.go

@@ -5,6 +5,7 @@ import "time"
 // SessionRequest is the body for POST /api/v1/session.
 type SessionRequest struct {
 	Nick     string `json:"nick"`
+	Hashcash string `json:"pow_token,omitempty"` //nolint:tagliatelle
 }
 
 // SessionResponse is the response from session creation.
@@ -66,6 +67,7 @@ type ServerInfo struct {
 	Name         string `json:"name"`
 	MOTD         string `json:"motd"`
 	Version      string `json:"version"`
+	HashcashBits int    `json:"hashcash_bits"` //nolint:tagliatelle
 }
 
 // MessagesResponse wraps polling results.

internal/cli/app.go

@@ -0,0 +1,912 @@
+// Package cli implements the neoirc-cli terminal client.
+package cli
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	api "git.eeqj.de/sneak/neoirc/internal/cli/api"
+	"git.eeqj.de/sneak/neoirc/pkg/irc"
+)
+
+const (
+	splitParts  = 2
+	pollTimeout = 15
+	pollRetry   = 2 * time.Second
+	timeFormat  = "15:04"
+)
+
+// App holds the application state.
+type App struct {
+	ui     *UI
+	client *api.Client
+
+	mu        sync.Mutex
+	nick      string
+	target    string
+	connected bool
+	lastQID   int64
+	stopPoll  chan struct{}
+}
+
+// Run creates and runs the CLI application.
+func Run() {
+	app := &App{ //nolint:exhaustruct
+		ui:   NewUI(),
+		nick: "guest",
+	}
+
+	app.ui.OnInput(app.handleInput)
+	app.ui.SetStatus(app.nick, "", "disconnected")
+
+	app.ui.AddStatus(
+		"Welcome to neoirc-cli — an IRC-style client",
+	)
+	app.ui.AddStatus(
+		"Type [yellow]/connect <server-url>" +
+			"[white] to begin, " +
+			"or [yellow]/help[white] for commands",
+	)
+
+	err := app.ui.Run()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func (a *App) handleInput(text string) {
+	if strings.HasPrefix(text, "/") {
+		a.handleCommand(text)
+
+		return
+	}
+
+	a.mu.Lock()
+	target := a.target
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus(
+			"[red]Not connected. Use /connect <url>",
+		)
+
+		return
+	}
+
+	if target == "" {
+		a.ui.AddStatus(
+			"[red]No target. " +
+				"Use /join #channel or /query nick",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdPrivmsg,
+		To:      target,
+		Body:    []string{text},
+	})
+	if err != nil {
+		a.ui.AddStatus(
+			"[red]Send error: " + err.Error(),
+		)
+
+		return
+	}
+
+	timestamp := time.Now().Format(timeFormat)
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, nick, text,
+	))
+}
+
+func (a *App) handleCommand(text string) {
+	parts := strings.SplitN(text, " ", splitParts)
+	cmd := strings.ToLower(parts[0])
+
+	args := ""
+	if len(parts) > 1 {
+		args = parts[1]
+	}
+
+	a.dispatchCommand(cmd, args)
+}
+
+func (a *App) dispatchCommand(cmd, args string) {
+	switch cmd {
+	case "/connect":
+		a.cmdConnect(args)
+	case "/nick":
+		a.cmdNick(args)
+	case "/join":
+		a.cmdJoin(args)
+	case "/part":
+		a.cmdPart(args)
+	case "/msg":
+		a.cmdMsg(args)
+	case "/query":
+		a.cmdQuery(args)
+	case "/topic":
+		a.cmdTopic(args)
+	case "/window", "/w":
+		a.cmdWindow(args)
+	case "/quit":
+		a.cmdQuit()
+	case "/help":
+		a.cmdHelp()
+	default:
+		a.dispatchInfoCommand(cmd, args)
+	}
+}
+
+func (a *App) dispatchInfoCommand(cmd, args string) {
+	switch cmd {
+	case "/names":
+		a.cmdNames()
+	case "/list":
+		a.cmdList()
+	case "/motd":
+		a.cmdMotd()
+	case "/who":
+		a.cmdWho(args)
+	case "/whois":
+		a.cmdWhois(args)
+	default:
+		a.ui.AddStatus(
+			"[red]Unknown command: " + cmd,
+		)
+	}
+}
+
+func (a *App) cmdConnect(serverURL string) {
+	if serverURL == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /connect <server-url>",
+		)
+
+		return
+	}
+
+	serverURL = strings.TrimRight(serverURL, "/")
+
+	a.ui.AddStatus("Connecting to " + serverURL + "...")
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	client := api.NewClient(serverURL)
+
+	resp, err := client.CreateSession(nick)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Connection failed: %v", err,
+		))
+
+		return
+	}
+
+	a.mu.Lock()
+	a.client = client
+	a.nick = resp.Nick
+	a.connected = true
+	a.lastQID = 0
+	a.mu.Unlock()
+
+	a.ui.AddStatus(fmt.Sprintf(
+		"[green]Connected! Nick: %s, Session: %d",
+		resp.Nick, resp.ID,
+	))
+	a.ui.SetStatus(resp.Nick, "", "connected")
+
+	a.stopPoll = make(chan struct{})
+
+	go a.pollLoop()
+}
+
+func (a *App) cmdNick(nick string) {
+	if nick == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /nick <name>",
+		)
+
+		return
+	}
+
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.mu.Lock()
+		a.nick = nick
+		a.mu.Unlock()
+
+		a.ui.AddStatus(
+			"Nick set to " + nick +
+				" (will be used on connect)",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdNick,
+		Body:    []string{nick},
+	})
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Nick change failed: %v", err,
+		))
+
+		return
+	}
+
+	a.mu.Lock()
+	a.nick = nick
+	target := a.target
+	a.mu.Unlock()
+
+	a.ui.SetStatus(nick, target, "connected")
+	a.ui.AddStatus("Nick changed to " + nick)
+}
+
+func (a *App) cmdJoin(channel string) {
+	if channel == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /join #channel",
+		)
+
+		return
+	}
+
+	if !strings.HasPrefix(channel, "#") {
+		channel = "#" + channel
+	}
+
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.JoinChannel(channel)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Join failed: %v", err,
+		))
+
+		return
+	}
+
+	a.mu.Lock()
+	a.target = channel
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.SwitchToBuffer(channel)
+	a.ui.AddLine(channel,
+		"[yellow]*** Joined "+channel,
+	)
+	a.ui.SetStatus(nick, channel, "connected")
+}
+
+func (a *App) cmdPart(channel string) {
+	a.mu.Lock()
+	if channel == "" {
+		channel = a.target
+	}
+
+	connected := a.connected
+	a.mu.Unlock()
+
+	if channel == "" ||
+		!strings.HasPrefix(channel, "#") {
+		a.ui.AddStatus("[red]No channel to part")
+
+		return
+	}
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.PartChannel(channel)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Part failed: %v", err,
+		))
+
+		return
+	}
+
+	a.ui.AddLine(channel,
+		"[yellow]*** Left "+channel,
+	)
+
+	a.mu.Lock()
+	if a.target == channel {
+		a.target = ""
+	}
+
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.SwitchBuffer(0)
+	a.ui.SetStatus(nick, "", "connected")
+}
+
+func (a *App) cmdMsg(args string) {
+	parts := strings.SplitN(args, " ", splitParts)
+	if len(parts) < splitParts {
+		a.ui.AddStatus(
+			"[red]Usage: /msg <nick> <text>",
+		)
+
+		return
+	}
+
+	target, text := parts[0], parts[1]
+
+	a.mu.Lock()
+	connected := a.connected
+	nick := a.nick
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdPrivmsg,
+		To:      target,
+		Body:    []string{text},
+	})
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Send failed: %v", err,
+		))
+
+		return
+	}
+
+	timestamp := time.Now().Format(timeFormat)
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, nick, text,
+	))
+}
+
+func (a *App) cmdQuery(nick string) {
+	if nick == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /query <nick>",
+		)
+
+		return
+	}
+
+	a.mu.Lock()
+	a.target = nick
+	myNick := a.nick
+	a.mu.Unlock()
+
+	a.ui.SwitchToBuffer(nick)
+	a.ui.SetStatus(myNick, nick, "connected")
+}
+
+func (a *App) cmdTopic(args string) {
+	a.mu.Lock()
+	target := a.target
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	if !strings.HasPrefix(target, "#") {
+		a.ui.AddStatus("[red]Not in a channel")
+
+		return
+	}
+
+	if args == "" {
+		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdTopic,
+			To:      target,
+		})
+		if err != nil {
+			a.ui.AddStatus(fmt.Sprintf(
+				"[red]Topic query failed: %v", err,
+			))
+		}
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdTopic,
+		To:      target,
+		Body:    []string{args},
+	})
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Topic set failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdNames() {
+	a.mu.Lock()
+	target := a.target
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	if !strings.HasPrefix(target, "#") {
+		a.ui.AddStatus("[red]Not in a channel")
+
+		return
+	}
+
+	members, err := a.client.GetMembers(target)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Names failed: %v", err,
+		))
+
+		return
+	}
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[cyan]*** Members of %s: %s",
+		target, strings.Join(members, " "),
+	))
+}
+
+func (a *App) cmdList() {
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	channels, err := a.client.ListChannels()
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]List failed: %v", err,
+		))
+
+		return
+	}
+
+	a.ui.AddStatus("[cyan]*** Channel list:")
+
+	for _, ch := range channels {
+		a.ui.AddStatus(fmt.Sprintf(
+			"  %s (%d members) %s",
+			ch.Name, ch.Members, ch.Topic,
+		))
+	}
+
+	a.ui.AddStatus("[cyan]*** End of channel list")
+}
+
+func (a *App) cmdMotd() {
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.SendMessage(
+		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
+	)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]MOTD failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdWho(args string) {
+	a.mu.Lock()
+	connected := a.connected
+	target := a.target
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	channel := args
+	if channel == "" {
+		channel = target
+	}
+
+	if channel == "" ||
+		!strings.HasPrefix(channel, "#") {
+		a.ui.AddStatus(
+			"[red]Usage: /who #channel",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(
+		&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdWho, To: channel,
+		},
+	)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]WHO failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdWhois(args string) {
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	if args == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /whois <nick>",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(
+		&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdWhois, To: args,
+		},
+	)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]WHOIS failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdWindow(args string) {
+	if args == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /window <number>",
+		)
+
+		return
+	}
+
+	var bufIndex int
+
+	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
+
+	a.ui.SwitchBuffer(bufIndex)
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
+		buf := a.ui.buffers[bufIndex]
+		if buf.Name != "(status)" {
+			a.mu.Lock()
+			a.target = buf.Name
+			a.mu.Unlock()
+
+			a.ui.SetStatus(
+				nick, buf.Name, "connected",
+			)
+		} else {
+			a.ui.SetStatus(nick, "", "connected")
+		}
+	}
+}
+
+func (a *App) cmdQuit() {
+	a.mu.Lock()
+
+	if a.connected && a.client != nil {
+		_ = a.client.SendMessage(
+			&api.Message{Command: irc.CmdQuit}, //nolint:exhaustruct
+		)
+	}
+
+	if a.stopPoll != nil {
+		close(a.stopPoll)
+	}
+
+	a.mu.Unlock()
+	a.ui.Stop()
+}
+
+func (a *App) cmdHelp() {
+	help := []string{
+		"[cyan]*** neoirc-cli commands:",
+		"  /connect <url>  — Connect to server",
+		"  /nick <name>    — Change nickname",
+		"  /join #channel  — Join channel",
+		"  /part [#chan]    — Leave channel",
+		"  /msg <nick> <text> — Send DM",
+		"  /query <nick>   — Open DM window",
+		"  /topic [text]   — View/set topic",
+		"  /names          — List channel members",
+		"  /list           — List channels",
+		"  /who [#channel] — List users in channel",
+		"  /whois <nick>   — Show user info",
+		"  /motd           — Show message of the day",
+		"  /window <n>     — Switch buffer",
+		"  /quit           — Disconnect and exit",
+		"  /help           — This help",
+		"  Plain text sends to current target.",
+	}
+
+	for _, line := range help {
+		a.ui.AddStatus(line)
+	}
+}
+
+// pollLoop long-polls for messages in the background.
+func (a *App) pollLoop() {
+	for {
+		select {
+		case <-a.stopPoll:
+			return
+		default:
+		}
+
+		a.mu.Lock()
+		client := a.client
+		lastQID := a.lastQID
+		a.mu.Unlock()
+
+		if client == nil {
+			return
+		}
+
+		result, err := client.PollMessages(
+			lastQID, pollTimeout,
+		)
+		if err != nil {
+			time.Sleep(pollRetry)
+
+			continue
+		}
+
+		if result.LastID > 0 {
+			a.mu.Lock()
+			a.lastQID = result.LastID
+			a.mu.Unlock()
+		}
+
+		for i := range result.Messages {
+			a.handleServerMessage(&result.Messages[i])
+		}
+	}
+}
+
+func (a *App) handleServerMessage(msg *api.Message) {
+	timestamp := a.formatTS(msg)
+
+	a.mu.Lock()
+	myNick := a.nick
+	a.mu.Unlock()
+
+	switch msg.Command {
+	case irc.CmdPrivmsg:
+		a.handlePrivmsgEvent(msg, timestamp, myNick)
+	case irc.CmdJoin:
+		a.handleJoinEvent(msg, timestamp)
+	case irc.CmdPart:
+		a.handlePartEvent(msg, timestamp)
+	case irc.CmdQuit:
+		a.handleQuitEvent(msg, timestamp)
+	case irc.CmdNick:
+		a.handleNickEvent(msg, timestamp, myNick)
+	case irc.CmdNotice:
+		a.handleNoticeEvent(msg, timestamp)
+	case irc.CmdTopic:
+		a.handleTopicEvent(msg, timestamp)
+	default:
+		a.handleDefaultEvent(msg, timestamp)
+	}
+}
+
+func (a *App) formatTS(msg *api.Message) string {
+	if msg.TS != "" {
+		return msg.ParseTS().UTC().Format(timeFormat)
+	}
+
+	return time.Now().Format(timeFormat)
+}
+
+func (a *App) handlePrivmsgEvent(
+	msg *api.Message, timestamp, myNick string,
+) {
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	if msg.From == myNick {
+		return
+	}
+
+	target := msg.To
+	if !strings.HasPrefix(target, "#") {
+		target = msg.From
+	}
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, msg.From, text,
+	))
+}
+
+func (a *App) handleJoinEvent(
+	msg *api.Message, timestamp string,
+) {
+	if msg.To == "" {
+		return
+	}
+
+	a.ui.AddLine(msg.To, fmt.Sprintf(
+		"[gray]%s [yellow]*** %s has joined %s",
+		timestamp, msg.From, msg.To,
+	))
+}
+
+func (a *App) handlePartEvent(
+	msg *api.Message, timestamp string,
+) {
+	if msg.To == "" {
+		return
+	}
+
+	lines := msg.BodyLines()
+	reason := strings.Join(lines, " ")
+
+	if reason != "" {
+		a.ui.AddLine(msg.To, fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has left %s (%s)",
+			timestamp, msg.From, msg.To, reason,
+		))
+	} else {
+		a.ui.AddLine(msg.To, fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has left %s",
+			timestamp, msg.From, msg.To,
+		))
+	}
+}
+
+func (a *App) handleQuitEvent(
+	msg *api.Message, timestamp string,
+) {
+	lines := msg.BodyLines()
+	reason := strings.Join(lines, " ")
+
+	if reason != "" {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has quit (%s)",
+			timestamp, msg.From, reason,
+		))
+	} else {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has quit",
+			timestamp, msg.From,
+		))
+	}
+}
+
+func (a *App) handleNickEvent(
+	msg *api.Message, timestamp, myNick string,
+) {
+	lines := msg.BodyLines()
+
+	newNick := ""
+	if len(lines) > 0 {
+		newNick = lines[0]
+	}
+
+	if msg.From == myNick && newNick != "" {
+		a.mu.Lock()
+		a.nick = newNick
+
+		target := a.target
+		a.mu.Unlock()
+
+		a.ui.SetStatus(newNick, target, "connected")
+	}
+
+	a.ui.AddStatus(fmt.Sprintf(
+		"[gray]%s [yellow]*** %s is now known as %s",
+		timestamp, msg.From, newNick,
+	))
+}
+
+func (a *App) handleNoticeEvent(
+	msg *api.Message, timestamp string,
+) {
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	a.ui.AddStatus(fmt.Sprintf(
+		"[gray]%s [magenta]--%s-- %s",
+		timestamp, msg.From, text,
+	))
+}
+
+func (a *App) handleTopicEvent(
+	msg *api.Message, timestamp string,
+) {
+	if msg.To == "" {
+		return
+	}
+
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	a.ui.AddLine(msg.To, fmt.Sprintf(
+		"[gray]%s [cyan]*** %s set topic: %s",
+		timestamp, msg.From, text,
+	))
+}
+
+func (a *App) handleDefaultEvent(
+	msg *api.Message, timestamp string,
+) {
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	if text != "" {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[gray]%s [white][%s] %s",
+			timestamp, msg.Command, text,
+		))
+	}
+}

internal/cli/ui.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"fmt"

internal/config/config.go

@@ -38,12 +38,14 @@ type Config struct {
 	MetricsUsername    string
 	Port               int
 	SentryDSN          string
-	MaxHistory         int
+	MessageMaxAge      string
 	MaxMessageSize     int
+	QueueMaxAge        string
 	MOTD               string
 	ServerName         string
 	FederationKey      string
 	SessionIdleTimeout string
+	HashcashBits       int
 	params             *Params
 	log                *slog.Logger
 }
@@ -68,12 +70,14 @@ func New(
 	viper.SetDefault("SENTRY_DSN", "")
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
-	viper.SetDefault("MAX_HISTORY", "10000")
+	viper.SetDefault("MESSAGE_MAX_AGE", "720h")
 	viper.SetDefault("MAX_MESSAGE_SIZE", "4096")
+	viper.SetDefault("QUEUE_MAX_AGE", "720h")
 	viper.SetDefault("MOTD", defaultMOTD)
 	viper.SetDefault("SERVER_NAME", "")
 	viper.SetDefault("FEDERATION_KEY", "")
-	viper.SetDefault("SESSION_IDLE_TIMEOUT", "24h")
+	viper.SetDefault("SESSION_IDLE_TIMEOUT", "720h")
+	viper.SetDefault("NEOIRC_HASHCASH_BITS", "20")
 
 	err := viper.ReadInConfig()
 	if err != nil {
@@ -92,12 +96,14 @@ func New(
 		MaintenanceMode:    viper.GetBool("MAINTENANCE_MODE"),
 		MetricsUsername:    viper.GetString("METRICS_USERNAME"),
 		MetricsPassword:    viper.GetString("METRICS_PASSWORD"),
-		MaxHistory:         viper.GetInt("MAX_HISTORY"),
+		MessageMaxAge:      viper.GetString("MESSAGE_MAX_AGE"),
 		MaxMessageSize:     viper.GetInt("MAX_MESSAGE_SIZE"),
+		QueueMaxAge:        viper.GetString("QUEUE_MAX_AGE"),
 		MOTD:               viper.GetString("MOTD"),
 		ServerName:         viper.GetString("SERVER_NAME"),
 		FederationKey:      viper.GetString("FEDERATION_KEY"),
 		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
+		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
 		log:                log,
 		params:             &params,
 	}

internal/db/auth.go

@@ -20,8 +20,12 @@ var errNoPassword = errors.New(
 // and returns session ID, client ID, and token.
 func (database *Database) RegisterUser(
 	ctx context.Context,
-	nick, password string,
+	nick, password, username, hostname, remoteIP string,
 ) (int64, int64, string, error) {
+	if username == "" {
+		username = nick
+	}
+
 	hash, err := bcrypt.GenerateFromPassword(
 		[]byte(password), bcryptCost,
 	)
@@ -50,10 +54,11 @@ func (database *Database) RegisterUser(
 
 	res, err := transaction.ExecContext(ctx,
 		`INSERT INTO sessions
-		 (uuid, nick, password_hash,
-		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		sessionUUID, nick, string(hash), now, now)
+		 (uuid, nick, username, hostname, ip,
+		  password_hash, created_at, last_seen)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+		sessionUUID, nick, username, hostname,
+		remoteIP, string(hash), now, now)
 	if err != nil {
 		_ = transaction.Rollback()
 
@@ -68,10 +73,11 @@ func (database *Database) RegisterUser(
 
 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token,
+		 (uuid, session_id, token, ip, hostname,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, tokenHash, now, now)
+		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		clientUUID, sessionID, tokenHash,
+		remoteIP, hostname, now, now)
 	if err != nil {
 		_ = transaction.Rollback()
 
@@ -96,7 +102,7 @@ func (database *Database) RegisterUser(
 // client token.
 func (database *Database) LoginUser(
 	ctx context.Context,
-	nick, password string,
+	nick, password, remoteIP, hostname string,
 ) (int64, int64, string, error) {
 	var (
 		sessionID    int64
@@ -143,10 +149,11 @@ func (database *Database) LoginUser(
 
 	res, err := database.conn.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token,
+		 (uuid, session_id, token, ip, hostname,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, tokenHash, now, now)
+		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		clientUUID, sessionID, tokenHash,
+		remoteIP, hostname, now, now)
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
 			"create login client: %w", err,

internal/db/auth_test.go

@@ -13,7 +13,7 @@ func TestRegisterUser(t *testing.T) {
 	ctx := t.Context()
 
 	sessionID, clientID, token, err :=
-		database.RegisterUser(ctx, "reguser", "password123")
+		database.RegisterUser(ctx, "reguser", "password123", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -38,6 +38,69 @@ func TestRegisterUser(t *testing.T) {
 	}
 }
 
+func TestRegisterUserWithUserHost(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.RegisterUser(
+		ctx, "reguhost", "password123",
+		"myident", "example.org", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := database.GetSessionHostInfo(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if info.Username != "myident" {
+		t.Fatalf(
+			"expected myident, got %s", info.Username,
+		)
+	}
+
+	if info.Hostname != "example.org" {
+		t.Fatalf(
+			"expected example.org, got %s",
+			info.Hostname,
+		)
+	}
+}
+
+func TestRegisterUserDefaultUsername(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.RegisterUser(
+		ctx, "regdefault", "password123", "", "", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := database.GetSessionHostInfo(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if info.Username != "regdefault" {
+		t.Fatalf(
+			"expected regdefault, got %s",
+			info.Username,
+		)
+	}
+}
+
 func TestRegisterUserDuplicateNick(t *testing.T) {
 	t.Parallel()
 
@@ -45,7 +108,7 @@ func TestRegisterUserDuplicateNick(t *testing.T) {
 	ctx := t.Context()
 
 	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "dupnick", "password123")
+		database.RegisterUser(ctx, "dupnick", "password123", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -55,7 +118,7 @@ func TestRegisterUserDuplicateNick(t *testing.T) {
 	_ = regToken
 
 	dupSID, dupCID, dupToken, dupErr :=
-		database.RegisterUser(ctx, "dupnick", "other12345")
+		database.RegisterUser(ctx, "dupnick", "other12345", "", "", "")
 	if dupErr == nil {
 		t.Fatal("expected error for duplicate nick")
 	}
@@ -72,7 +135,7 @@ func TestLoginUser(t *testing.T) {
 	ctx := t.Context()
 
 	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "loginuser", "mypassword")
+		database.RegisterUser(ctx, "loginuser", "mypassword", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -82,7 +145,7 @@ func TestLoginUser(t *testing.T) {
 	_ = regToken
 
 	sessionID, clientID, token, err :=
-		database.LoginUser(ctx, "loginuser", "mypassword")
+		database.LoginUser(ctx, "loginuser", "mypassword", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -103,6 +166,83 @@ func TestLoginUser(t *testing.T) {
 	}
 }
 
+func TestLoginUserStoresClientIPHostname(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	regSID, regCID, regToken, err := database.RegisterUser(
+		ctx, "loginipuser", "password123",
+		"", "", "10.0.0.1",
+	)
+
+	_ = regSID
+	_ = regCID
+	_ = regToken
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, clientID, _, err := database.LoginUser(
+		ctx, "loginipuser", "password123",
+		"10.0.0.99", "newhost.example.com",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	clientInfo, err := database.GetClientHostInfo(
+		ctx, clientID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if clientInfo.IP != "10.0.0.99" {
+		t.Fatalf(
+			"expected client IP 10.0.0.99, got %s",
+			clientInfo.IP,
+		)
+	}
+
+	if clientInfo.Hostname != "newhost.example.com" {
+		t.Fatalf(
+			"expected hostname newhost.example.com, got %s",
+			clientInfo.Hostname,
+		)
+	}
+}
+
+func TestRegisterUserStoresSessionIP(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, _, _, err := database.RegisterUser(
+		ctx, "regipuser", "password123",
+		"ident", "host.local", "172.16.0.5",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := database.GetSessionHostInfo(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if info.IP != "172.16.0.5" {
+		t.Fatalf(
+			"expected session IP 172.16.0.5, got %s",
+			info.IP,
+		)
+	}
+}
+
 func TestLoginUserWrongPassword(t *testing.T) {
 	t.Parallel()
 
@@ -110,7 +250,7 @@ func TestLoginUserWrongPassword(t *testing.T) {
 	ctx := t.Context()
 
 	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "wrongpw", "correctpass")
+		database.RegisterUser(ctx, "wrongpw", "correctpass", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -120,7 +260,7 @@ func TestLoginUserWrongPassword(t *testing.T) {
 	_ = regToken
 
 	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "wrongpw", "wrongpass12")
+		database.LoginUser(ctx, "wrongpw", "wrongpass12", "", "")
 	if loginErr == nil {
 		t.Fatal("expected error for wrong password")
 	}
@@ -138,7 +278,7 @@ func TestLoginUserNoPassword(t *testing.T) {
 
 	// Create anonymous session (no password).
 	anonSID, anonCID, anonToken, err :=
-		database.CreateSession(ctx, "anon")
+		database.CreateSession(ctx, "anon", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -148,7 +288,7 @@ func TestLoginUserNoPassword(t *testing.T) {
 	_ = anonToken
 
 	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "anon", "anything1")
+		database.LoginUser(ctx, "anon", "anything1", "", "")
 	if loginErr == nil {
 		t.Fatal(
 			"expected error for login on passwordless account",
@@ -167,7 +307,7 @@ func TestLoginUserNonexistent(t *testing.T) {
 	ctx := t.Context()
 
 	loginSID, loginCID, loginToken, err :=
-		database.LoginUser(ctx, "ghost", "password123")
+		database.LoginUser(ctx, "ghost", "password123", "", "")
 	if err == nil {
 		t.Fatal("expected error for nonexistent user")
 	}

internal/db/queries.go

@@ -11,7 +11,7 @@ import (
 	"strconv"
 	"time"
 
-	"git.eeqj.de/sneak/neoirc/internal/irc"
+	"git.eeqj.de/sneak/neoirc/pkg/irc"
 	"github.com/google/uuid"
 )
 
@@ -74,14 +74,40 @@ type ChannelInfo struct {
 type MemberInfo struct {
 	ID       int64     `json:"id"`
 	Nick     string    `json:"nick"`
+	Username string    `json:"username"`
+	Hostname string    `json:"hostname"`
 	LastSeen time.Time `json:"lastSeen"`
 }
 
+// Hostmask returns the IRC hostmask in
+// nick!user@host format.
+func (m *MemberInfo) Hostmask() string {
+	return FormatHostmask(m.Nick, m.Username, m.Hostname)
+}
+
+// FormatHostmask formats a nick, username, and hostname
+// into a standard IRC hostmask string (nick!user@host).
+func FormatHostmask(nick, username, hostname string) string {
+	if username == "" {
+		username = nick
+	}
+
+	if hostname == "" {
+		hostname = "*"
+	}
+
+	return nick + "!" + username + "@" + hostname
+}
+
 // CreateSession registers a new session and its first client.
 func (database *Database) CreateSession(
 	ctx context.Context,
-	nick string,
+	nick, username, hostname, remoteIP string,
 ) (int64, int64, string, error) {
+	if username == "" {
+		username = nick
+	}
+
 	sessionUUID := uuid.New().String()
 	clientUUID := uuid.New().String()
 
@@ -101,9 +127,11 @@ func (database *Database) CreateSession(
 
 	res, err := transaction.ExecContext(ctx,
 		`INSERT INTO sessions
-		 (uuid, nick, created_at, last_seen)
-		 VALUES (?, ?, ?, ?)`,
-		sessionUUID, nick, now, now)
+		 (uuid, nick, username, hostname, ip,
+		  created_at, last_seen)
+		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		sessionUUID, nick, username, hostname,
+		remoteIP, now, now)
 	if err != nil {
 		_ = transaction.Rollback()
 
@@ -118,10 +146,11 @@ func (database *Database) CreateSession(
 
 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token,
+		 (uuid, session_id, token, ip, hostname,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, tokenHash, now, now)
+		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		clientUUID, sessionID, tokenHash,
+		remoteIP, hostname, now, now)
 	if err != nil {
 		_ = transaction.Rollback()
 
@@ -209,6 +238,66 @@ func (database *Database) GetSessionByNick(
 	return sessionID, nil
 }
 
+// SessionHostInfo holds the username, hostname, and IP
+// for a session.
+type SessionHostInfo struct {
+	Username string
+	Hostname string
+	IP       string
+}
+
+// GetSessionHostInfo returns the username, hostname,
+// and IP for a session.
+func (database *Database) GetSessionHostInfo(
+	ctx context.Context,
+	sessionID int64,
+) (*SessionHostInfo, error) {
+	var info SessionHostInfo
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		`SELECT username, hostname, ip
+		 FROM sessions WHERE id = ?`,
+		sessionID,
+	).Scan(&info.Username, &info.Hostname, &info.IP)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get session host info: %w", err,
+		)
+	}
+
+	return &info, nil
+}
+
+// ClientHostInfo holds the IP and hostname for a client.
+type ClientHostInfo struct {
+	IP       string
+	Hostname string
+}
+
+// GetClientHostInfo returns the IP and hostname for a
+// client.
+func (database *Database) GetClientHostInfo(
+	ctx context.Context,
+	clientID int64,
+) (*ClientHostInfo, error) {
+	var info ClientHostInfo
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		`SELECT ip, hostname
+		 FROM clients WHERE id = ?`,
+		clientID,
+	).Scan(&info.IP, &info.Hostname)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get client host info: %w", err,
+		)
+	}
+
+	return &info, nil
+}
+
 // GetChannelByName returns the channel ID for a name.
 func (database *Database) GetChannelByName(
 	ctx context.Context,
@@ -388,7 +477,8 @@ func (database *Database) ChannelMembers(
 	channelID int64,
 ) ([]MemberInfo, error) {
 	rows, err := database.conn.QueryContext(ctx,
-		`SELECT s.id, s.nick, s.last_seen
+		`SELECT s.id, s.nick, s.username,
+		   s.hostname, s.last_seen
 		 FROM sessions s
 		 INNER JOIN channel_members cm
 		   ON cm.session_id = s.id
@@ -408,7 +498,9 @@ func (database *Database) ChannelMembers(
 		var member MemberInfo
 
 		err = rows.Scan(
-			&member.ID, &member.Nick, &member.LastSeen,
+			&member.ID, &member.Nick,
+			&member.Username, &member.Hostname,
+			&member.LastSeen,
 		)
 		if err != nil {
 			return nil, fmt.Errorf(
@@ -746,8 +838,8 @@ func scanMessages(
 			code, _ := strconv.Atoi(msg.Command)
 			msg.Code = code
 
-			if name := irc.Name(code); name != "" {
-				msg.Command = name
+			if mt, err := irc.FromInt(code); err == nil {
+				msg.Command = mt.Name()
 			}
 		}
 
@@ -1109,3 +1201,199 @@ func (database *Database) GetSessionCreatedAt(
 
 	return createdAt, nil
 }
+
+// SetAway sets the away message for a session.
+// An empty message clears the away status.
+func (database *Database) SetAway(
+	ctx context.Context,
+	sessionID int64,
+	message string,
+) error {
+	_, err := database.conn.ExecContext(ctx,
+		"UPDATE sessions SET away_message = ? WHERE id = ?",
+		message, sessionID)
+	if err != nil {
+		return fmt.Errorf("set away: %w", err)
+	}
+
+	return nil
+}
+
+// GetAway returns the away message for a session.
+// Returns an empty string if the user is not away.
+func (database *Database) GetAway(
+	ctx context.Context,
+	sessionID int64,
+) (string, error) {
+	var msg string
+
+	err := database.conn.QueryRowContext(ctx,
+		"SELECT away_message FROM sessions WHERE id = ?",
+		sessionID,
+	).Scan(&msg)
+	if err != nil {
+		return "", fmt.Errorf("get away: %w", err)
+	}
+
+	return msg, nil
+}
+
+// SetTopicMeta sets the topic along with who set it and
+// when.
+func (database *Database) SetTopicMeta(
+	ctx context.Context,
+	channelName, topic, setBy string,
+) error {
+	now := time.Now()
+
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET topic = ?, topic_set_by = ?,
+		     topic_set_at = ?, updated_at = ?
+		 WHERE name = ?`,
+		topic, setBy, now, now, channelName)
+	if err != nil {
+		return fmt.Errorf("set topic meta: %w", err)
+	}
+
+	return nil
+}
+
+// TopicMeta holds topic metadata for a channel.
+type TopicMeta struct {
+	SetBy string
+	SetAt time.Time
+}
+
+// GetTopicMeta returns who set the topic and when.
+func (database *Database) GetTopicMeta(
+	ctx context.Context,
+	channelID int64,
+) (*TopicMeta, error) {
+	var (
+		setBy string
+		setAt sql.NullTime
+	)
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT topic_set_by, topic_set_at
+		 FROM channels WHERE id = ?`,
+		channelID,
+	).Scan(&setBy, &setAt)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"get topic meta: %w", err,
+		)
+	}
+
+	if setBy == "" || !setAt.Valid {
+		return nil, nil //nolint:nilnil
+	}
+
+	return &TopicMeta{
+		SetBy: setBy,
+		SetAt: setAt.Time,
+	}, nil
+}
+
+// GetSessionLastSeen returns the last_seen time for a
+// session.
+func (database *Database) GetSessionLastSeen(
+	ctx context.Context,
+	sessionID int64,
+) (time.Time, error) {
+	var lastSeen time.Time
+
+	err := database.conn.QueryRowContext(ctx,
+		"SELECT last_seen FROM sessions WHERE id = ?",
+		sessionID,
+	).Scan(&lastSeen)
+	if err != nil {
+		return time.Time{}, fmt.Errorf(
+			"get session last_seen: %w", err,
+		)
+	}
+
+	return lastSeen, nil
+}
+
+// PruneOldQueueEntries deletes client output queue entries
+// older than cutoff and returns the number of rows removed.
+func (database *Database) PruneOldQueueEntries(
+	ctx context.Context,
+	cutoff time.Time,
+) (int64, error) {
+	res, err := database.conn.ExecContext(ctx,
+		"DELETE FROM client_queues WHERE created_at < ?",
+		cutoff,
+	)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"prune old client output queue entries: %w", err,
+		)
+	}
+
+	deleted, _ := res.RowsAffected()
+
+	return deleted, nil
+}
+
+// PruneOldMessages deletes messages older than cutoff and
+// returns the number of rows removed.
+func (database *Database) PruneOldMessages(
+	ctx context.Context,
+	cutoff time.Time,
+) (int64, error) {
+	res, err := database.conn.ExecContext(ctx,
+		"DELETE FROM messages WHERE created_at < ?",
+		cutoff,
+	)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"prune old messages: %w", err,
+		)
+	}
+
+	deleted, _ := res.RowsAffected()
+
+	return deleted, nil
+}
+
+// GetClientCount returns the total number of clients.
+func (database *Database) GetClientCount(
+	ctx context.Context,
+) (int64, error) {
+	var count int64
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		"SELECT COUNT(*) FROM clients",
+	).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"get client count: %w", err,
+		)
+	}
+
+	return count, nil
+}
+
+// GetQueueEntryCount returns the total number of entries
+// in the client output queues.
+func (database *Database) GetQueueEntryCount(
+	ctx context.Context,
+) (int64, error) {
+	var count int64
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		"SELECT COUNT(*) FROM client_queues",
+	).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"get queue entry count: %w", err,
+		)
+	}
+
+	return count, nil
+}

internal/db/queries_test.go

@@ -34,7 +34,7 @@ func TestCreateSession(t *testing.T) {
 	ctx := t.Context()
 
 	sessionID, _, token, err := database.CreateSession(
-		ctx, "alice",
+		ctx, "alice", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -45,7 +45,7 @@ func TestCreateSession(t *testing.T) {
 	}
 
 	_, _, dupToken, dupErr := database.CreateSession(
-		ctx, "alice",
+		ctx, "alice", "", "", "",
 	)
 	if dupErr == nil {
 		t.Fatal("expected error for duplicate nick")
@@ -54,13 +54,249 @@ func TestCreateSession(t *testing.T) {
 	_ = dupToken
 }
 
+// assertSessionHostInfo creates a session and verifies
+// the stored username and hostname match expectations.
+func assertSessionHostInfo(
+	t *testing.T,
+	database *db.Database,
+	nick, inputUser, inputHost,
+	expectUser, expectHost string,
+) {
+	t.Helper()
+
+	sessionID, _, _, err := database.CreateSession(
+		t.Context(), nick, inputUser, inputHost, "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := database.GetSessionHostInfo(
+		t.Context(), sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if info.Username != expectUser {
+		t.Fatalf(
+			"expected username %s, got %s",
+			expectUser, info.Username,
+		)
+	}
+
+	if info.Hostname != expectHost {
+		t.Fatalf(
+			"expected hostname %s, got %s",
+			expectHost, info.Hostname,
+		)
+	}
+}
+
+func TestCreateSessionWithUserHost(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+
+	assertSessionHostInfo(
+		t, database,
+		"hostuser", "myident", "example.com",
+		"myident", "example.com",
+	)
+}
+
+func TestCreateSessionDefaultUsername(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+
+	// Empty username defaults to nick.
+	assertSessionHostInfo(
+		t, database,
+		"defaultu", "", "host.local",
+		"defaultu", "host.local",
+	)
+}
+
+func TestCreateSessionStoresIP(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sessionID, clientID, _, err := database.CreateSession(
+		ctx, "ipuser", "ident", "host.example.com",
+		"192.168.1.42",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := database.GetSessionHostInfo(
+		ctx, sessionID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if info.IP != "192.168.1.42" {
+		t.Fatalf(
+			"expected session IP 192.168.1.42, got %s",
+			info.IP,
+		)
+	}
+
+	clientInfo, err := database.GetClientHostInfo(
+		ctx, clientID,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if clientInfo.IP != "192.168.1.42" {
+		t.Fatalf(
+			"expected client IP 192.168.1.42, got %s",
+			clientInfo.IP,
+		)
+	}
+
+	if clientInfo.Hostname != "host.example.com" {
+		t.Fatalf(
+			"expected client hostname host.example.com, got %s",
+			clientInfo.Hostname,
+		)
+	}
+}
+
+func TestGetClientHostInfoNotFound(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+
+	_, err := database.GetClientHostInfo(
+		t.Context(), 99999,
+	)
+	if err == nil {
+		t.Fatal("expected error for nonexistent client")
+	}
+}
+
+func TestGetSessionHostInfoNotFound(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+
+	_, err := database.GetSessionHostInfo(
+		t.Context(), 99999,
+	)
+	if err == nil {
+		t.Fatal("expected error for nonexistent session")
+	}
+}
+
+func TestFormatHostmask(t *testing.T) {
+	t.Parallel()
+
+	result := db.FormatHostmask(
+		"nick", "user", "host.com",
+	)
+	if result != "nick!user@host.com" {
+		t.Fatalf(
+			"expected nick!user@host.com, got %s",
+			result,
+		)
+	}
+}
+
+func TestFormatHostmaskDefaults(t *testing.T) {
+	t.Parallel()
+
+	result := db.FormatHostmask("nick", "", "")
+	if result != "nick!nick@*" {
+		t.Fatalf(
+			"expected nick!nick@*, got %s",
+			result,
+		)
+	}
+}
+
+func TestMemberInfoHostmask(t *testing.T) {
+	t.Parallel()
+
+	member := &db.MemberInfo{ //nolint:exhaustruct // test only uses hostmask fields
+		Nick:     "alice",
+		Username: "aliceident",
+		Hostname: "alice.example.com",
+	}
+
+	hostmask := member.Hostmask()
+	expected := "alice!aliceident@alice.example.com"
+
+	if hostmask != expected {
+		t.Fatalf(
+			"expected %s, got %s", expected, hostmask,
+		)
+	}
+}
+
+func TestChannelMembersIncludeUserHost(t *testing.T) {
+	t.Parallel()
+
+	database := setupTestDB(t)
+	ctx := t.Context()
+
+	sid, _, _, err := database.CreateSession(
+		ctx, "memuser", "myuser", "myhost.net", "",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	chID, err := database.GetOrCreateChannel(
+		ctx, "#hostchan",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = database.JoinChannel(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	members, err := database.ChannelMembers(ctx, chID)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(members) != 1 {
+		t.Fatalf(
+			"expected 1 member, got %d", len(members),
+		)
+	}
+
+	if members[0].Username != "myuser" {
+		t.Fatalf(
+			"expected username myuser, got %s",
+			members[0].Username,
+		)
+	}
+
+	if members[0].Hostname != "myhost.net" {
+		t.Fatalf(
+			"expected hostname myhost.net, got %s",
+			members[0].Hostname,
+		)
+	}
+}
+
 func TestGetSessionByToken(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	_, _, token, err := database.CreateSession(ctx, "bob")
+	_, _, token, err := database.CreateSession(ctx, "bob", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -93,7 +329,7 @@ func TestGetSessionByNick(t *testing.T) {
 	ctx := t.Context()
 
 	charlieID, charlieClientID, charlieToken, err :=
-		database.CreateSession(ctx, "charlie")
+		database.CreateSession(ctx, "charlie", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -150,7 +386,7 @@ func TestJoinAndPart(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	sid, _, _, err := database.CreateSession(ctx, "user1")
+	sid, _, _, err := database.CreateSession(ctx, "user1", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -199,7 +435,7 @@ func TestDeleteChannelIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	sid, _, _, err := database.CreateSession(ctx, "temp")
+	sid, _, _, err := database.CreateSession(ctx, "temp", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -234,7 +470,7 @@ func createSessionWithChannels(
 
 	ctx := t.Context()
 
-	sid, _, _, err := database.CreateSession(ctx, nick)
+	sid, _, _, err := database.CreateSession(ctx, nick, "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -317,7 +553,7 @@ func TestChangeNick(t *testing.T) {
 	ctx := t.Context()
 
 	sid, _, token, err := database.CreateSession(
-		ctx, "old",
+		ctx, "old", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -401,7 +637,7 @@ func TestPollMessages(t *testing.T) {
 	ctx := t.Context()
 
 	sid, _, token, err := database.CreateSession(
-		ctx, "poller",
+		ctx, "poller", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -508,7 +744,7 @@ func TestDeleteSession(t *testing.T) {
 	ctx := t.Context()
 
 	sid, _, _, err := database.CreateSession(
-		ctx, "deleteme",
+		ctx, "deleteme", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -548,12 +784,12 @@ func TestChannelMembers(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	sid1, _, _, err := database.CreateSession(ctx, "m1")
+	sid1, _, _, err := database.CreateSession(ctx, "m1", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	sid2, _, _, err := database.CreateSession(ctx, "m2")
+	sid2, _, _, err := database.CreateSession(ctx, "m2", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -611,7 +847,7 @@ func TestEnqueueToClient(t *testing.T) {
 	ctx := t.Context()
 
 	_, _, token, err := database.CreateSession(
-		ctx, "enqclient",
+		ctx, "enqclient", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)

internal/db/schema/001_initial.sql

@@ -6,8 +6,12 @@ CREATE TABLE IF NOT EXISTS sessions (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     uuid TEXT NOT NULL UNIQUE,
     nick TEXT NOT NULL UNIQUE,
+    username TEXT NOT NULL DEFAULT '',
+    hostname TEXT NOT NULL DEFAULT '',
+    ip TEXT NOT NULL DEFAULT '',
     password_hash TEXT NOT NULL DEFAULT '',
     signing_key TEXT NOT NULL DEFAULT '',
+    away_message TEXT NOT NULL DEFAULT '',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     last_seen DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -19,6 +23,8 @@ CREATE TABLE IF NOT EXISTS clients (
     uuid TEXT NOT NULL UNIQUE,
     session_id INTEGER NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
     token TEXT NOT NULL UNIQUE,
+    ip TEXT NOT NULL DEFAULT '',
+    hostname TEXT NOT NULL DEFAULT '',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     last_seen DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -30,6 +36,8 @@ CREATE TABLE IF NOT EXISTS channels (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     name TEXT NOT NULL UNIQUE,
     topic TEXT NOT NULL DEFAULT '',
+    topic_set_by TEXT NOT NULL DEFAULT '',
+    topic_set_at DATETIME,
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );

internal/handlers/api.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/http"
 	"regexp"
 	"strconv"
@@ -11,7 +12,7 @@ import (
 	"time"
 
 	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/irc"
+	"git.eeqj.de/sneak/neoirc/pkg/irc"
 	"github.com/go-chi/chi/v5"
 )
 
@@ -23,6 +24,12 @@ var validChannelRe = regexp.MustCompile(
 	`^#[a-zA-Z0-9_\-]{1,63}$`,
 )
 
+var validUsernameRe = regexp.MustCompile(
+	`^[a-zA-Z0-9_\-\[\]\\^{}|` + "`" + `]{1,32}$`,
+)
+
+const dnsLookupTimeout = 3 * time.Second
+
 const (
 	maxLongPollTimeout = 30
 	pollMessageLimit   = 100
@@ -39,6 +46,55 @@ func (hdlr *Handlers) maxBodySize() int64 {
 	return defaultMaxBodySize
 }
 
+// clientIP extracts the connecting client's IP address
+// from the request, checking X-Forwarded-For and
+// X-Real-IP headers before falling back to RemoteAddr.
+func clientIP(request *http.Request) string {
+	if forwarded := request.Header.Get("X-Forwarded-For"); forwarded != "" {
+		// X-Forwarded-For can contain a comma-separated list;
+		// the first entry is the original client.
+		parts := strings.SplitN(forwarded, ",", 2) //nolint:mnd
+		ip := strings.TrimSpace(parts[0])
+
+		if ip != "" {
+			return ip
+		}
+	}
+
+	if realIP := request.Header.Get("X-Real-IP"); realIP != "" {
+		return strings.TrimSpace(realIP)
+	}
+
+	host, _, err := net.SplitHostPort(request.RemoteAddr)
+	if err != nil {
+		return request.RemoteAddr
+	}
+
+	return host
+}
+
+// resolveHostname performs a reverse DNS lookup on the
+// given IP address. Returns the first PTR record with the
+// trailing dot stripped, or the raw IP if lookup fails.
+func resolveHostname(
+	reqCtx context.Context,
+	addr string,
+) string {
+	resolver := &net.Resolver{} //nolint:exhaustruct // using default resolver
+
+	ctx, cancel := context.WithTimeout(
+		reqCtx, dnsLookupTimeout,
+	)
+	defer cancel()
+
+	names, err := resolver.LookupAddr(ctx, addr)
+	if err != nil || len(names) == 0 {
+		return addr
+	}
+
+	return strings.TrimSuffix(names[0], ".")
+}
+
 // authSession extracts the session from the client token.
 func (hdlr *Handlers) authSession(
 	request *http.Request,
@@ -71,11 +127,10 @@ func (hdlr *Handlers) requireAuth(
 	sessionID, clientID, nick, err :=
 		hdlr.authSession(request)
 	if err != nil {
-		hdlr.respondError(
-			writer, request,
-			"unauthorized",
-			http.StatusUnauthorized,
-		)
+		hdlr.respondJSON(writer, request, map[string]any{
+			"error":   "not registered",
+			"numeric": irc.ErrNotRegistered,
+		}, http.StatusUnauthorized)
 
 		return 0, 0, "", false
 	}
@@ -147,6 +202,8 @@ func (hdlr *Handlers) handleCreateSession(
 ) {
 	type createRequest struct {
 		Nick     string `json:"nick"`
+		Username string `json:"username,omitempty"`
+		Hashcash string `json:"pow_token,omitempty"` //nolint:tagliatelle
 	}
 
 	var payload createRequest
@@ -162,6 +219,12 @@ func (hdlr *Handlers) handleCreateSession(
 		return
 	}
 
+	if !hdlr.validateHashcash(
+		writer, request, payload.Hashcash,
+	) {
+		return
+	}
+
 	payload.Nick = strings.TrimSpace(payload.Nick)
 
 	if !validNickRe.MatchString(payload.Nick) {
@@ -174,9 +237,40 @@ func (hdlr *Handlers) handleCreateSession(
 		return
 	}
 
+	username := resolveUsername(
+		payload.Username, payload.Nick,
+	)
+
+	if !validUsernameRe.MatchString(username) {
+		hdlr.respondError(
+			writer, request,
+			"invalid username format",
+			http.StatusBadRequest,
+		)
+
+		return
+	}
+
+	hdlr.executeCreateSession(
+		writer, request, payload.Nick, username,
+	)
+}
+
+func (hdlr *Handlers) executeCreateSession(
+	writer http.ResponseWriter,
+	request *http.Request,
+	nick, username string,
+) {
+	remoteIP := clientIP(request)
+
+	hostname := resolveHostname(
+		request.Context(), remoteIP,
+	)
+
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.CreateSession(
-			request.Context(), payload.Nick,
+			request.Context(),
+			nick, username, hostname, remoteIP,
 		)
 	if err != nil {
 		hdlr.handleCreateSessionError(
@@ -186,15 +280,67 @@ func (hdlr *Handlers) handleCreateSession(
 		return
 	}
 
-	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)
+	hdlr.stats.IncrSessions()
+	hdlr.stats.IncrConnections()
+
+	hdlr.deliverMOTD(request, clientID, sessionID, nick)
 
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
-		"nick":  payload.Nick,
+		"nick":  nick,
 		"token": token,
 	}, http.StatusCreated)
 }
 
+// validateHashcash validates a hashcash stamp if required.
+// Returns false if validation failed and a response was
+// already sent.
+func (hdlr *Handlers) validateHashcash(
+	writer http.ResponseWriter,
+	request *http.Request,
+	stamp string,
+) bool {
+	if hdlr.params.Config.HashcashBits == 0 {
+		return true
+	}
+
+	if stamp == "" {
+		hdlr.respondError(
+			writer, request,
+			"hashcash proof-of-work required",
+			http.StatusPaymentRequired,
+		)
+
+		return false
+	}
+
+	err := hdlr.hashcashVal.Validate(
+		stamp, hdlr.params.Config.HashcashBits,
+	)
+	if err != nil {
+		hdlr.respondError(
+			writer, request,
+			"invalid hashcash stamp: "+err.Error(),
+			http.StatusPaymentRequired,
+		)
+
+		return false
+	}
+
+	return true
+}
+
+// resolveUsername returns the trimmed username, defaulting
+// to the nick if empty.
+func resolveUsername(username, nick string) string {
+	username = strings.TrimSpace(username)
+	if username == "" {
+		return nick
+	}
+
+	return username
+}
+
 func (hdlr *Handlers) handleCreateSessionError(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -398,12 +544,12 @@ func (hdlr *Handlers) serverName() string {
 func (hdlr *Handlers) enqueueNumeric(
 	ctx context.Context,
 	clientID int64,
-	code int,
+	code irc.IRCMessageType,
 	nick string,
 	params []string,
 	text string,
 ) {
-	command := fmt.Sprintf("%03d", code)
+	command := code.Code()
 
 	body, err := json.Marshal([]string{text})
 	if err != nil {
@@ -810,6 +956,11 @@ func (hdlr *Handlers) dispatchCommand(
 	bodyLines func() []string,
 ) {
 	switch command {
+	case irc.CmdAway:
+		hdlr.handleAway(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
 	case irc.CmdPrivmsg, irc.CmdNotice:
 		hdlr.handlePrivmsg(
 			writer, request,
@@ -920,8 +1071,8 @@ func (hdlr *Handlers) handlePrivmsg(
 	if target == "" {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			irc.ErrNeedMoreParams, nick, []string{command},
-			"Not enough parameters",
+			irc.ErrNoRecipient, nick, []string{command},
+			"No recipient given",
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
@@ -935,8 +1086,8 @@ func (hdlr *Handlers) handlePrivmsg(
 	if len(lines) == 0 {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
-			irc.ErrNeedMoreParams, nick, []string{command},
-			"Not enough parameters",
+			irc.ErrNoTextToSend, nick, []string{command},
+			"No text to send",
 		)
 		hdlr.broker.Notify(sessionID)
 		hdlr.respondJSON(writer, request,
@@ -946,6 +1097,8 @@ func (hdlr *Handlers) handlePrivmsg(
 		return
 	}
 
+	hdlr.stats.IncrMessages()
+
 	if strings.HasPrefix(target, "#") {
 		hdlr.handleChannelMsg(
 			writer, request,
@@ -969,7 +1122,7 @@ func (hdlr *Handlers) respondIRCError(
 	writer http.ResponseWriter,
 	request *http.Request,
 	clientID, sessionID int64,
-	code int,
+	code irc.IRCMessageType,
 	nick string,
 	params []string,
 	text string,
@@ -1023,8 +1176,8 @@ func (hdlr *Handlers) handleChannelMsg(
 	if !isMember {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
-			irc.ErrNotOnChannel, nick, []string{target},
-			"You're not on that channel",
+			irc.ErrCannotSendToChan, nick, []string{target},
+			"Cannot send to channel",
 		)
 
 		return
@@ -1120,6 +1273,19 @@ func (hdlr *Handlers) handleDirectMsg(
 		return
 	}
 
+	// If the target is away, send RPL_AWAY to the sender.
+	awayMsg, awayErr := hdlr.params.Database.GetAway(
+		request.Context(), targetSID,
+	)
+	if awayErr == nil && awayMsg != "" {
+		hdlr.enqueueNumeric(
+			request.Context(), clientID,
+			irc.RplAway, nick,
+			[]string{target}, awayMsg,
+		)
+		hdlr.broker.Notify(sessionID)
+	}
+
 	hdlr.respondJSON(writer, request,
 		map[string]string{"id": msgUUID, "status": "sent"},
 		http.StatusOK)
@@ -1230,14 +1396,25 @@ func (hdlr *Handlers) deliverJoinNumerics(
 ) {
 	ctx := request.Context()
 
-	chInfo, err := hdlr.params.Database.GetChannelByName(
-		ctx, channel,
+	hdlr.deliverTopicNumerics(
+		ctx, clientID, sessionID, nick, channel, chID,
 	)
-	if err == nil {
-		_ = chInfo // chInfo is the ID; topic comes from DB.
+
+	hdlr.deliverNamesNumerics(
+		ctx, clientID, nick, channel, chID,
+	)
+
+	hdlr.broker.Notify(sessionID)
 }
 
-	// Get topic from channel info.
+// deliverTopicNumerics sends RPL_TOPIC or RPL_NOTOPIC,
+// plus RPL_TOPICWHOTIME when topic metadata is available.
+func (hdlr *Handlers) deliverTopicNumerics(
+	ctx context.Context,
+	clientID, sessionID int64,
+	nick, channel string,
+	chID int64,
+) {
 	channels, listErr := hdlr.params.Database.ListChannels(
 		ctx, sessionID,
 	)
@@ -1259,29 +1436,54 @@ func (hdlr *Handlers) deliverJoinNumerics(
 			ctx, clientID, irc.RplTopic, nick,
 			[]string{channel}, topic,
 		)
+
+		topicMeta, tmErr := hdlr.params.Database.
+			GetTopicMeta(ctx, chID)
+		if tmErr == nil && topicMeta != nil {
+			hdlr.enqueueNumeric(
+				ctx, clientID,
+				irc.RplTopicWhoTime, nick,
+				[]string{
+					channel,
+					topicMeta.SetBy,
+					strconv.FormatInt(
+						topicMeta.SetAt.Unix(), 10,
+					),
+				},
+				"",
+			)
+		}
 	} else {
 		hdlr.enqueueNumeric(
 			ctx, clientID, irc.RplNoTopic, nick,
 			[]string{channel}, "No topic is set",
 		)
 	}
+}
 
-	// Get member list for NAMES reply.
+// deliverNamesNumerics sends RPL_NAMREPLY and
+// RPL_ENDOFNAMES for a channel.
+func (hdlr *Handlers) deliverNamesNumerics(
+	ctx context.Context,
+	clientID int64,
+	nick, channel string,
+	chID int64,
+) {
 	members, memErr := hdlr.params.Database.ChannelMembers(
 		ctx, chID,
 	)
 
 	if memErr == nil && len(members) > 0 {
-		nicks := make([]string, 0, len(members))
+		entries := make([]string, 0, len(members))
 
 		for _, mem := range members {
-			nicks = append(nicks, mem.Nick)
+			entries = append(entries, mem.Hostmask())
 		}
 
 		hdlr.enqueueNumeric(
 			ctx, clientID, irc.RplNamReply, nick,
 			[]string{"=", channel},
-			strings.Join(nicks, " "),
+			strings.Join(entries, " "),
 		)
 	}
 
@@ -1289,8 +1491,6 @@ func (hdlr *Handlers) deliverJoinNumerics(
 		ctx, clientID, irc.RplEndOfNames, nick,
 		[]string{channel}, "End of /NAMES list",
 	)
-
-	hdlr.broker.Notify(sessionID)
 }
 
 func (hdlr *Handlers) handlePart(
@@ -1558,6 +1758,32 @@ func (hdlr *Handlers) handleTopic(
 		return
 	}
 
+	isMember, err := hdlr.params.Database.IsChannelMember(
+		request.Context(), chID, sessionID,
+	)
+	if err != nil {
+		hdlr.log.Error(
+			"check membership failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	if !isMember {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNotOnChannel, nick, []string{channel},
+			"You're not on that channel",
+		)
+
+		return
+	}
+
 	hdlr.executeTopic(
 		writer, request,
 		sessionID, clientID, nick,
@@ -1574,8 +1800,8 @@ func (hdlr *Handlers) executeTopic(
 	body json.RawMessage,
 	chID int64,
 ) {
-	setErr := hdlr.params.Database.SetTopic(
-		request.Context(), channel, topic,
+	setErr := hdlr.params.Database.SetTopicMeta(
+		request.Context(), channel, topic, nick,
 	)
 	if setErr != nil {
 		hdlr.log.Error(
@@ -1602,6 +1828,25 @@ func (hdlr *Handlers) executeTopic(
 		request.Context(), clientID,
 		irc.RplTopic, nick, []string{channel}, topic,
 	)
+
+	// 333 RPL_TOPICWHOTIME
+	topicMeta, tmErr := hdlr.params.Database.
+		GetTopicMeta(request.Context(), chID)
+	if tmErr == nil && topicMeta != nil {
+		hdlr.enqueueNumeric(
+			request.Context(), clientID,
+			irc.RplTopicWhoTime, nick,
+			[]string{
+				channel,
+				topicMeta.SetBy,
+				strconv.FormatInt(
+					topicMeta.SetAt.Unix(), 10,
+				),
+			},
+			"",
+		)
+	}
+
 	hdlr.broker.Notify(sessionID)
 
 	hdlr.respondJSON(writer, request,
@@ -1837,16 +2082,16 @@ func (hdlr *Handlers) handleNames(
 		ctx, chID,
 	)
 	if memErr == nil && len(members) > 0 {
-		nicks := make([]string, 0, len(members))
+		entries := make([]string, 0, len(members))
 
 		for _, mem := range members {
-			nicks = append(nicks, mem.Nick)
+			entries = append(entries, mem.Hostmask())
 		}
 
 		hdlr.enqueueNumeric(
 			ctx, clientID, irc.RplNamReply, nick,
 			[]string{"=", channel},
-			strings.Join(nicks, " "),
+			strings.Join(entries, " "),
 		)
 	}
 
@@ -1977,10 +2222,26 @@ func (hdlr *Handlers) executeWhois(
 		return
 	}
 
+	// Look up username and hostname for the target.
+	username := queryNick
+	hostname := srvName
+
+	hostInfo, hostErr := hdlr.params.Database.
+		GetSessionHostInfo(ctx, targetSID)
+	if hostErr == nil && hostInfo != nil {
+		if hostInfo.Username != "" {
+			username = hostInfo.Username
+		}
+
+		if hostInfo.Hostname != "" {
+			hostname = hostInfo.Hostname
+		}
+	}
+
 	// 311 RPL_WHOISUSER
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplWhoisUser, nick,
-		[]string{queryNick, queryNick, srvName, "*"},
+		[]string{queryNick, username, hostname, "*"},
 		queryNick,
 	)
 
@@ -1991,6 +2252,11 @@ func (hdlr *Handlers) executeWhois(
 		"neoirc server",
 	)
 
+	// 317 RPL_WHOISIDLE
+	hdlr.deliverWhoisIdle(
+		ctx, clientID, nick, queryNick, targetSID,
+	)
+
 	// 319 RPL_WHOISCHANNELS
 	hdlr.deliverWhoisChannels(
 		ctx, clientID, nick, queryNick, targetSID,
@@ -2082,11 +2348,21 @@ func (hdlr *Handlers) handleWho(
 	)
 	if memErr == nil {
 		for _, mem := range members {
+			username := mem.Username
+			if username == "" {
+				username = mem.Nick
+			}
+
+			hostname := mem.Hostname
+			if hostname == "" {
+				hostname = srvName
+			}
+
 			// 352 RPL_WHOREPLY
 			hdlr.enqueueNumeric(
 				ctx, clientID, irc.RplWhoReply, nick,
 				[]string{
-					channel, mem.Nick, srvName,
+					channel, username, hostname,
 					srvName, mem.Nick, "H",
 				},
 				"0 "+mem.Nick,
@@ -2392,11 +2668,111 @@ func (hdlr *Handlers) HandleServerInfo() http.HandlerFunc {
 			return
 		}
 
-		hdlr.respondJSON(writer, request, map[string]any{
+		resp := map[string]any{
 			"name":    hdlr.params.Config.ServerName,
 			"version": hdlr.params.Globals.Version,
 			"motd":    hdlr.params.Config.MOTD,
 			"users":   users,
-		}, http.StatusOK)
+		}
+
+		if hdlr.params.Config.HashcashBits > 0 {
+			resp["hashcash_bits"] = hdlr.params.Config.HashcashBits
+		}
+
+		hdlr.respondJSON(
+			writer, request, resp, http.StatusOK,
+		)
 	}
 }
+
+// handleAway handles the AWAY command. An empty body
+// clears the away status; a non-empty body sets it.
+func (hdlr *Handlers) handleAway(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick string,
+	bodyLines func() []string,
+) {
+	ctx := request.Context()
+
+	lines := bodyLines()
+
+	awayMsg := ""
+	if len(lines) > 0 {
+		awayMsg = strings.Join(lines, " ")
+	}
+
+	err := hdlr.params.Database.SetAway(
+		ctx, sessionID, awayMsg,
+	)
+	if err != nil {
+		hdlr.log.Error("set away failed", "error", err)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	if awayMsg == "" {
+		// 305 RPL_UNAWAY
+		hdlr.enqueueNumeric(
+			ctx, clientID, irc.RplUnaway, nick, nil,
+			"You are no longer marked as being away",
+		)
+	} else {
+		// 306 RPL_NOWAWAY
+		hdlr.enqueueNumeric(
+			ctx, clientID, irc.RplNowAway, nick, nil,
+			"You have been marked as being away",
+		)
+	}
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// deliverWhoisIdle sends RPL_WHOISIDLE (317) with idle
+// time and signon time.
+func (hdlr *Handlers) deliverWhoisIdle(
+	ctx context.Context,
+	clientID int64,
+	nick, queryNick string,
+	targetSID int64,
+) {
+	lastSeen, lsErr := hdlr.params.Database.
+		GetSessionLastSeen(ctx, targetSID)
+	if lsErr != nil {
+		return
+	}
+
+	createdAt, caErr := hdlr.params.Database.
+		GetSessionCreatedAt(ctx, targetSID)
+	if caErr != nil {
+		return
+	}
+
+	idleSeconds := int64(time.Since(lastSeen).Seconds())
+	if idleSeconds < 0 {
+		idleSeconds = 0
+	}
+
+	signonUnix := strconv.FormatInt(
+		createdAt.Unix(), 10,
+	)
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplWhoisIdle, nick,
+		[]string{
+			queryNick,
+			strconv.FormatInt(idleSeconds, 10),
+			signonUnix,
+		},
+		"seconds idle, signon time",
+	)
+}

internal/handlers/api_test.go

@@ -26,6 +26,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/middleware"
 	"git.eeqj.de/sneak/neoirc/internal/server"
+	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
 )
@@ -85,10 +86,12 @@ func newTestServer(
 
 				cfg.DBURL = dbURL
 				cfg.Port = 0
+				cfg.HashcashBits = 0
 
 				return cfg, nil
 			},
 			newTestDB,
+			stats.New,
 			newTestHealthcheck,
 			newTestMiddleware,
 			newTestHandlers,
@@ -143,12 +146,14 @@ func newTestHealthcheck(
 	cfg *config.Config,
 	log *logger.Logger,
 	database *db.Database,
+	tracker *stats.Tracker,
 ) (*healthcheck.Healthcheck, error) {
 	hcheck, err := healthcheck.New(lifecycle, healthcheck.Params{ //nolint:exhaustruct
 		Globals:  globs,
 		Config:   cfg,
 		Logger:   log,
 		Database: database,
+		Stats:    tracker,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("test healthcheck: %w", err)
@@ -182,6 +187,7 @@ func newTestHandlers(
 	cfg *config.Config,
 	database *db.Database,
 	hcheck *healthcheck.Healthcheck,
+	tracker *stats.Tracker,
 ) (*handlers.Handlers, error) {
 	hdlr, err := handlers.New(lifecycle, handlers.Params{ //nolint:exhaustruct
 		Logger:      log,
@@ -189,6 +195,7 @@ func newTestHandlers(
 		Config:      cfg,
 		Database:    database,
 		Healthcheck: hcheck,
+		Stats:       tracker,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("test handlers: %w", err)
@@ -810,9 +817,9 @@ func TestMessageMissingBody(t *testing.T) {
 
 	msgs, _ := tserver.pollMessages(token, lastID)
 
-	if !findNumeric(msgs, "461") {
+	if !findNumeric(msgs, "412") {
 		t.Fatalf(
-			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			"expected ERR_NOTEXTTOSEND (412), got %v",
 			msgs,
 		)
 	}
@@ -834,9 +841,9 @@ func TestMessageMissingTo(t *testing.T) {
 
 	msgs, _ := tserver.pollMessages(token, lastID)
 
-	if !findNumeric(msgs, "461") {
+	if !findNumeric(msgs, "411") {
 		t.Fatalf(
-			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			"expected ERR_NORECIPIENT (411), got %v",
 			msgs,
 		)
 	}
@@ -869,9 +876,9 @@ func TestNonMemberCannotSend(t *testing.T) {
 
 	msgs, _ := tserver.pollMessages(aliceToken, lastID)
 
-	if !findNumeric(msgs, "442") {
+	if !findNumeric(msgs, "404") {
 		t.Fatalf(
-			"expected ERR_NOTONCHANNEL (442), got %v",
+			"expected ERR_CANNOTSENDTOCHAN (404), got %v",
 			msgs,
 		)
 	}
@@ -1133,6 +1140,42 @@ func TestTopicMissingBody(t *testing.T) {
 	}
 }
 
+func TestTopicNonMember(t *testing.T) {
+	tserver := newTestServer(t)
+	aliceToken := tserver.createSession("alice_topic")
+	bobToken := tserver.createSession("bob_topic")
+
+	// Only alice joins the channel.
+	tserver.sendCommand(aliceToken, map[string]any{
+		commandKey: joinCmd, toKey: "#topicpriv",
+	})
+
+	// Drain bob's initial messages.
+	_, lastID := tserver.pollMessages(bobToken, 0)
+
+	// Bob tries to set topic without joining.
+	status, _ := tserver.sendCommand(
+		bobToken,
+		map[string]any{
+			commandKey: "TOPIC",
+			toKey:      "#topicpriv",
+			bodyKey:    []string{"Hijacked topic"},
+		},
+	)
+	if status != http.StatusOK {
+		t.Fatalf("expected 200, got %d", status)
+	}
+
+	msgs, _ := tserver.pollMessages(bobToken, lastID)
+
+	if !findNumeric(msgs, "442") {
+		t.Fatalf(
+			"expected ERR_NOTONCHANNEL (442), got %v",
+			msgs,
+		)
+	}
+}
+
 func TestPing(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("ping_user")
@@ -1656,6 +1699,133 @@ func TestHealthcheck(t *testing.T) {
 	}
 }
 
+func TestHealthcheckRuntimeStatsFields(t *testing.T) {
+	tserver := newTestServer(t)
+
+	resp, err := doRequest(
+		t,
+		http.MethodGet,
+		tserver.url("/.well-known/healthcheck.json"),
+		nil,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf(
+			"expected 200, got %d", resp.StatusCode,
+		)
+	}
+
+	var result map[string]any
+
+	decErr := json.NewDecoder(resp.Body).Decode(&result)
+	if decErr != nil {
+		t.Fatalf("decode healthcheck: %v", decErr)
+	}
+
+	requiredFields := []string{
+		"sessions", "clients", "queuedLines",
+		"channels", "connectionsSinceBoot",
+		"sessionsSinceBoot", "messagesSinceBoot",
+	}
+
+	for _, field := range requiredFields {
+		if _, ok := result[field]; !ok {
+			t.Errorf(
+				"missing field %q in healthcheck", field,
+			)
+		}
+	}
+}
+
+func TestHealthcheckRuntimeStatsValues(t *testing.T) {
+	tserver := newTestServer(t)
+
+	token := tserver.createSession("statsuser")
+
+	tserver.sendCommand(token, map[string]any{
+		commandKey: joinCmd, toKey: "#statschan",
+	})
+	tserver.sendCommand(token, map[string]any{
+		commandKey: privmsgCmd,
+		toKey:      "#statschan",
+		bodyKey:    []string{"hello stats"},
+	})
+
+	result := tserver.fetchHealthcheck(t)
+
+	assertFieldGTE(t, result, "sessions", 1)
+	assertFieldGTE(t, result, "clients", 1)
+	assertFieldGTE(t, result, "channels", 1)
+	assertFieldGTE(t, result, "queuedLines", 0)
+	assertFieldGTE(t, result, "sessionsSinceBoot", 1)
+	assertFieldGTE(t, result, "connectionsSinceBoot", 1)
+	assertFieldGTE(t, result, "messagesSinceBoot", 1)
+}
+
+func (tserver *testServer) fetchHealthcheck(
+	t *testing.T,
+) map[string]any {
+	t.Helper()
+
+	resp, err := doRequest(
+		t,
+		http.MethodGet,
+		tserver.url("/.well-known/healthcheck.json"),
+		nil,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf(
+			"expected 200, got %d", resp.StatusCode,
+		)
+	}
+
+	var result map[string]any
+
+	decErr := json.NewDecoder(resp.Body).Decode(&result)
+	if decErr != nil {
+		t.Fatalf("decode healthcheck: %v", decErr)
+	}
+
+	return result
+}
+
+func assertFieldGTE(
+	t *testing.T,
+	result map[string]any,
+	field string,
+	minimum float64,
+) {
+	t.Helper()
+
+	val, ok := result[field].(float64)
+	if !ok {
+		t.Errorf(
+			"field %q: not a number (got %T)",
+			field, result[field],
+		)
+
+		return
+	}
+
+	if val < minimum {
+		t.Errorf(
+			"expected %s >= %v, got %v",
+			field, minimum, val,
+		)
+	}
+}
+
 func TestRegisterValid(t *testing.T) {
 	tserver := newTestServer(t)
 
@@ -1960,6 +2130,249 @@ func TestSessionStillWorks(t *testing.T) {
 	}
 }
 
+// findNumericWithParams returns the first message matching
+// the given numeric code. Returns nil if not found.
+func findNumericWithParams(
+	msgs []map[string]any,
+	numeric string,
+) map[string]any {
+	want, _ := strconv.Atoi(numeric)
+
+	for _, msg := range msgs {
+		code, ok := msg["code"].(float64)
+		if ok && int(code) == want {
+			return msg
+		}
+	}
+
+	return nil
+}
+
+// getNumericParams extracts the params array from a
+// numeric message as a string slice.
+func getNumericParams(
+	msg map[string]any,
+) []string {
+	raw, exists := msg["params"]
+	if !exists || raw == nil {
+		return nil
+	}
+
+	arr, isArr := raw.([]any)
+	if !isArr {
+		return nil
+	}
+
+	result := make([]string, 0, len(arr))
+
+	for _, val := range arr {
+		str, isString := val.(string)
+		if isString {
+			result = append(result, str)
+		}
+	}
+
+	return result
+}
+
+func TestWhoisShowsHostInfo(t *testing.T) {
+	tserver := newTestServer(t)
+
+	token := tserver.createSessionWithUsername(
+		"whoisuser", "myident",
+	)
+
+	queryToken := tserver.createSession("querier")
+
+	_, lastID := tserver.pollMessages(queryToken, 0)
+
+	tserver.sendCommand(queryToken, map[string]any{
+		commandKey: "WHOIS",
+		toKey:      "whoisuser",
+	})
+
+	msgs, _ := tserver.pollMessages(queryToken, lastID)
+
+	whoisMsg := findNumericWithParams(msgs, "311")
+	if whoisMsg == nil {
+		t.Fatalf(
+			"expected RPL_WHOISUSER (311), got %v",
+			msgs,
+		)
+	}
+
+	params := getNumericParams(whoisMsg)
+
+	if len(params) < 2 {
+		t.Fatalf(
+			"expected at least 2 params, got %v",
+			params,
+		)
+	}
+
+	if params[1] != "myident" {
+		t.Fatalf(
+			"expected username myident, got %s",
+			params[1],
+		)
+	}
+
+	_ = token
+}
+
+// createSessionWithUsername creates a session with a
+// specific username and returns the token.
+func (tserver *testServer) createSessionWithUsername(
+	nick, username string,
+) string {
+	tserver.t.Helper()
+
+	body, err := json.Marshal(map[string]string{
+		"nick":     nick,
+		"username": username,
+	})
+	if err != nil {
+		tserver.t.Fatalf("marshal session: %v", err)
+	}
+
+	resp, err := doRequest(
+		tserver.t,
+		http.MethodPost,
+		tserver.url(apiSession),
+		bytes.NewReader(body),
+	)
+	if err != nil {
+		tserver.t.Fatalf("create session: %v", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusCreated {
+		respBody, _ := io.ReadAll(resp.Body)
+		tserver.t.Fatalf(
+			"create session: status %d: %s",
+			resp.StatusCode, respBody,
+		)
+	}
+
+	var result struct {
+		Token string `json:"token"`
+	}
+
+	_ = json.NewDecoder(resp.Body).Decode(&result)
+
+	return result.Token
+}
+
+func TestWhoShowsHostInfo(t *testing.T) {
+	tserver := newTestServer(t)
+
+	whoToken := tserver.createSessionWithUsername(
+		"whouser", "whoident",
+	)
+
+	tserver.sendCommand(whoToken, map[string]any{
+		commandKey: joinCmd, toKey: "#whotest",
+	})
+
+	queryToken := tserver.createSession("whoquerier")
+
+	tserver.sendCommand(queryToken, map[string]any{
+		commandKey: joinCmd, toKey: "#whotest",
+	})
+
+	_, lastID := tserver.pollMessages(queryToken, 0)
+
+	tserver.sendCommand(queryToken, map[string]any{
+		commandKey: "WHO",
+		toKey:      "#whotest",
+	})
+
+	msgs, _ := tserver.pollMessages(queryToken, lastID)
+
+	assertWhoReplyUsername(t, msgs, "whouser", "whoident")
+}
+
+func assertWhoReplyUsername(
+	t *testing.T,
+	msgs []map[string]any,
+	targetNick, expectedUsername string,
+) {
+	t.Helper()
+
+	for _, msg := range msgs {
+		code, isCode := msg["code"].(float64)
+		if !isCode || int(code) != 352 {
+			continue
+		}
+
+		params := getNumericParams(msg)
+		if len(params) < 5 || params[4] != targetNick {
+			continue
+		}
+
+		if params[1] != expectedUsername {
+			t.Fatalf(
+				"expected username %s in WHO, got %s",
+				expectedUsername, params[1],
+			)
+		}
+
+		return
+	}
+
+	t.Fatalf(
+		"expected RPL_WHOREPLY (352) for %s, msgs: %v",
+		targetNick, msgs,
+	)
+}
+
+func TestSessionUsernameDefault(t *testing.T) {
+	tserver := newTestServer(t)
+
+	// Create session without specifying username.
+	token := tserver.createSession("defaultusr")
+
+	queryToken := tserver.createSession("querier2")
+
+	_, lastID := tserver.pollMessages(queryToken, 0)
+
+	// WHOIS should show the nick as the username.
+	tserver.sendCommand(queryToken, map[string]any{
+		commandKey: "WHOIS",
+		toKey:      "defaultusr",
+	})
+
+	msgs, _ := tserver.pollMessages(queryToken, lastID)
+
+	whoisMsg := findNumericWithParams(msgs, "311")
+	if whoisMsg == nil {
+		t.Fatalf(
+			"expected RPL_WHOISUSER (311), got %v",
+			msgs,
+		)
+	}
+
+	params := getNumericParams(whoisMsg)
+
+	if len(params) < 2 {
+		t.Fatalf(
+			"expected at least 2 params, got %v",
+			params,
+		)
+	}
+
+	// Username defaults to nick.
+	if params[1] != "defaultusr" {
+		t.Fatalf(
+			"expected default username defaultusr, got %s",
+			params[1],
+		)
+	}
+
+	_ = token
+}
+
 func TestNickBroadcastToChannels(t *testing.T) {
 	tserver := newTestServer(t)
 	aliceToken := tserver.createSession("nick_a")
@@ -1987,3 +2400,135 @@ func TestNickBroadcastToChannels(t *testing.T) {
 		)
 	}
 }
+
+func TestNamesShowsHostmask(t *testing.T) {
+	tserver := newTestServer(t)
+
+	queryToken, lastID := setupChannelWithIdentMember(
+		tserver, "namesmember", "nmident",
+		"namesquery", "#namestest",
+	)
+
+	// Issue an explicit NAMES command.
+	tserver.sendCommand(queryToken, map[string]any{
+		commandKey: "NAMES",
+		toKey:      "#namestest",
+	})
+
+	msgs, _ := tserver.pollMessages(queryToken, lastID)
+
+	assertNamesHostmask(
+		t, msgs, "namesmember", "nmident",
+	)
+}
+
+func TestNamesOnJoinShowsHostmask(t *testing.T) {
+	tserver := newTestServer(t)
+
+	// First user joins to populate the channel.
+	firstToken := tserver.createSessionWithUsername(
+		"joinmem", "jmident",
+	)
+
+	tserver.sendCommand(firstToken, map[string]any{
+		commandKey: joinCmd, toKey: "#joinnamestest",
+	})
+
+	// Second user joins; the JOIN triggers
+	// deliverNamesNumerics which should include
+	// hostmask data.
+	joinerToken := tserver.createSession("joiner")
+
+	tserver.sendCommand(joinerToken, map[string]any{
+		commandKey: joinCmd, toKey: "#joinnamestest",
+	})
+
+	msgs, _ := tserver.pollMessages(joinerToken, 0)
+
+	assertNamesHostmask(
+		t, msgs, "joinmem", "jmident",
+	)
+}
+
+// setupChannelWithIdentMember creates a member session
+// with username, joins a channel, then creates a querier
+// and joins the same channel. Returns the querier token
+// and last message ID.
+func setupChannelWithIdentMember(
+	tserver *testServer,
+	memberNick, memberUsername,
+	querierNick, channel string,
+) (string, int64) {
+	tserver.t.Helper()
+
+	memberToken := tserver.createSessionWithUsername(
+		memberNick, memberUsername,
+	)
+
+	tserver.sendCommand(memberToken, map[string]any{
+		commandKey: joinCmd, toKey: channel,
+	})
+
+	queryToken := tserver.createSession(querierNick)
+
+	tserver.sendCommand(queryToken, map[string]any{
+		commandKey: joinCmd, toKey: channel,
+	})
+
+	_, lastID := tserver.pollMessages(queryToken, 0)
+
+	return queryToken, lastID
+}
+
+// assertNamesHostmask verifies that a RPL_NAMREPLY (353)
+// message contains the expected nick with hostmask format
+// (nick!user@host).
+func assertNamesHostmask(
+	t *testing.T,
+	msgs []map[string]any,
+	targetNick, expectedUsername string,
+) {
+	t.Helper()
+
+	for _, msg := range msgs {
+		code, ok := msg["code"].(float64)
+		if !ok || int(code) != 353 {
+			continue
+		}
+
+		raw, exists := msg["body"]
+		if !exists || raw == nil {
+			continue
+		}
+
+		arr, isArr := raw.([]any)
+		if !isArr || len(arr) == 0 {
+			continue
+		}
+
+		bodyStr, isStr := arr[0].(string)
+		if !isStr {
+			continue
+		}
+
+		// Look for the target nick's hostmask entry.
+		expected := targetNick + "!" +
+			expectedUsername + "@"
+
+		if !strings.Contains(bodyStr, expected) {
+			t.Fatalf(
+				"expected NAMES body to contain %q, "+
+					"got %q",
+				expected, bodyStr,
+			)
+		}
+
+		return
+	}
+
+	t.Fatalf(
+		"expected RPL_NAMREPLY (353) with hostmask "+
+			"for %s, msgs: %v",
+		targetNick, msgs,
+	)
+}

internal/handlers/auth.go

@@ -30,6 +30,7 @@ func (hdlr *Handlers) handleRegister(
 ) {
 	type registerRequest struct {
 		Nick     string `json:"nick"`
+		Username string `json:"username,omitempty"`
 		Password string `json:"password"`
 	}
 
@@ -58,6 +59,20 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}
 
+	username := resolveUsername(
+		payload.Username, payload.Nick,
+	)
+
+	if !validUsernameRe.MatchString(username) {
+		hdlr.respondError(
+			writer, request,
+			"invalid username format",
+			http.StatusBadRequest,
+		)
+
+		return
+	}
+
 	if len(payload.Password) < minPasswordLength {
 		hdlr.respondError(
 			writer, request,
@@ -68,11 +83,27 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}
 
+	hdlr.executeRegister(
+		writer, request,
+		payload.Nick, payload.Password, username,
+	)
+}
+
+func (hdlr *Handlers) executeRegister(
+	writer http.ResponseWriter,
+	request *http.Request,
+	nick, password, username string,
+) {
+	remoteIP := clientIP(request)
+
+	hostname := resolveHostname(
+		request.Context(), remoteIP,
+	)
+
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.RegisterUser(
 			request.Context(),
-			payload.Nick,
-			payload.Password,
+			nick, password, username, hostname, remoteIP,
 		)
 	if err != nil {
 		hdlr.handleRegisterError(
@@ -82,11 +113,14 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}
 
-	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)
+	hdlr.stats.IncrSessions()
+	hdlr.stats.IncrConnections()
+
+	hdlr.deliverMOTD(request, clientID, sessionID, nick)
 
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
-		"nick":  payload.Nick,
+		"nick":  nick,
 		"token": token,
 	}, http.StatusCreated)
 }
@@ -164,11 +198,18 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 
+	remoteIP := clientIP(request)
+
+	hostname := resolveHostname(
+		request.Context(), remoteIP,
+	)
+
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.LoginUser(
 			request.Context(),
 			payload.Nick,
 			payload.Password,
+			remoteIP, hostname,
 		)
 	if err != nil {
 		hdlr.respondError(
@@ -180,6 +221,8 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 
+	hdlr.stats.IncrConnections()
+
 	hdlr.deliverMOTD(
 		request, clientID, sessionID, payload.Nick,
 	)

internal/handlers/handlers.go

@@ -13,8 +13,10 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/config"
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
+	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
 
@@ -29,9 +31,10 @@ type Params struct {
 	Config      *config.Config
 	Database    *db.Database
 	Healthcheck *healthcheck.Healthcheck
+	Stats       *stats.Tracker
 }
 
-const defaultIdleTimeout = 24 * time.Hour
+const defaultIdleTimeout = 30 * 24 * time.Hour
 
 // Handlers manages HTTP request handling.
 type Handlers struct {
@@ -39,6 +42,8 @@ type Handlers struct {
 	log           *slog.Logger
 	hc            *healthcheck.Healthcheck
 	broker        *broker.Broker
+	hashcashVal   *hashcash.Validator
+	stats         *stats.Tracker
 	cancelCleanup context.CancelFunc
 }
 
@@ -47,11 +52,18 @@ func New(
 	lifecycle fx.Lifecycle,
 	params Params,
 ) (*Handlers, error) {
+	resource := params.Config.ServerName
+	if resource == "" {
+		resource = "neoirc"
+	}
+
 	hdlr := &Handlers{ //nolint:exhaustruct // cancelCleanup set in startCleanup
 		params:      &params,
 		log:         params.Logger.Get(),
 		hc:          params.Healthcheck,
 		broker:      broker.New(),
+		hashcashVal: hashcash.NewValidator(resource),
+		stats:       params.Stats,
 	}
 
 	lifecycle.Append(fx.Hook{
@@ -200,4 +212,77 @@ func (hdlr *Handlers) runCleanup(
 			"deleted", deleted,
 		)
 	}
+
+	hdlr.pruneQueuesAndMessages(ctx)
+}
+
+// parseDurationConfig parses a Go duration string,
+// returning zero on empty input and logging on error.
+func (hdlr *Handlers) parseDurationConfig(
+	name, raw string,
+) time.Duration {
+	if raw == "" {
+		return 0
+	}
+
+	dur, err := time.ParseDuration(raw)
+	if err != nil {
+		hdlr.log.Error(
+			"invalid duration config, skipping",
+			"name", name, "value", raw, "error", err,
+		)
+
+		return 0
+	}
+
+	return dur
+}
+
+// pruneQueuesAndMessages removes old client output queue
+// entries per QUEUE_MAX_AGE and old messages per
+// MESSAGE_MAX_AGE.
+func (hdlr *Handlers) pruneQueuesAndMessages(
+	ctx context.Context,
+) {
+	queueMaxAge := hdlr.parseDurationConfig(
+		"QUEUE_MAX_AGE",
+		hdlr.params.Config.QueueMaxAge,
+	)
+	if queueMaxAge > 0 {
+		queueCutoff := time.Now().Add(-queueMaxAge)
+
+		pruned, err := hdlr.params.Database.
+			PruneOldQueueEntries(ctx, queueCutoff)
+		if err != nil {
+			hdlr.log.Error(
+				"client output queue pruning failed", "error", err,
+			)
+		} else if pruned > 0 {
+			hdlr.log.Info(
+				"pruned old client output queue entries",
+				"deleted", pruned,
+			)
+		}
+	}
+
+	messageMaxAge := hdlr.parseDurationConfig(
+		"MESSAGE_MAX_AGE",
+		hdlr.params.Config.MessageMaxAge,
+	)
+	if messageMaxAge > 0 {
+		msgCutoff := time.Now().Add(-messageMaxAge)
+
+		pruned, err := hdlr.params.Database.
+			PruneOldMessages(ctx, msgCutoff)
+		if err != nil {
+			hdlr.log.Error(
+				"message pruning failed", "error", err,
+			)
+		} else if pruned > 0 {
+			hdlr.log.Info(
+				"pruned old messages",
+				"deleted", pruned,
+			)
+		}
+	}
 }

internal/handlers/healthcheck.go

@@ -12,7 +12,7 @@ func (hdlr *Handlers) HandleHealthCheck() http.HandlerFunc {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		resp := hdlr.hc.Healthcheck()
+		resp := hdlr.hc.Healthcheck(request.Context())
 		hdlr.respondJSON(writer, request, resp, httpStatusOK)
 	}
 }

internal/hashcash/hashcash.go

@@ -0,0 +1,277 @@
+// Package hashcash implements SHA-256-based hashcash
+// proof-of-work validation for abuse prevention.
+//
+// Stamp format: 1:bits:YYMMDD:resource::counter.
+//
+// The SHA-256 hash of the entire stamp string must have
+// at least `bits` leading zero bits.
+package hashcash
+
+import (
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	// stampVersion is the only supported hashcash version.
+	stampVersion = "1"
+	// stampFields is the number of fields in a stamp.
+	stampFields = 6
+	// maxStampAge is how old a stamp can be before
+	// rejection.
+	maxStampAge = 48 * time.Hour
+	// maxFutureSkew allows stamps slightly in the future.
+	maxFutureSkew = 1 * time.Hour
+	// pruneInterval controls how often expired stamps are
+	// removed from the spent set.
+	pruneInterval = 10 * time.Minute
+	// dateFormatShort is the YYMMDD date layout.
+	dateFormatShort = "060102"
+	// dateFormatLong is the YYMMDDHHMMSS date layout.
+	dateFormatLong = "060102150405"
+	// dateShortLen is the length of YYMMDD.
+	dateShortLen = 6
+	// dateLongLen is the length of YYMMDDHHMMSS.
+	dateLongLen = 12
+	// bitsPerByte is the number of bits in a byte.
+	bitsPerByte = 8
+	// fullByteMask is 0xFF, a mask for all bits in a byte.
+	fullByteMask = 0xFF
+)
+
+var (
+	errInvalidFields    = errors.New("invalid stamp field count")
+	errBadVersion       = errors.New("unsupported stamp version")
+	errInsufficientBits = errors.New("insufficient difficulty")
+	errWrongResource    = errors.New("wrong resource")
+	errStampExpired     = errors.New("stamp expired")
+	errStampFuture      = errors.New("stamp date in future")
+	errProofFailed      = errors.New("proof-of-work failed")
+	errStampReused      = errors.New("stamp already used")
+	errBadDateFormat    = errors.New("unrecognized date format")
+)
+
+// Validator checks hashcash stamps for validity and
+// prevents replay attacks via an in-memory spent set.
+type Validator struct {
+	resource string
+	mu       sync.Mutex
+	spent    map[string]time.Time
+}
+
+// NewValidator creates a Validator for the given resource.
+func NewValidator(resource string) *Validator {
+	validator := &Validator{
+		resource: resource,
+		mu:       sync.Mutex{},
+		spent:    make(map[string]time.Time),
+	}
+
+	go validator.pruneLoop()
+
+	return validator
+}
+
+// Validate checks a hashcash stamp. It returns nil if the
+// stamp is valid and has not been seen before.
+func (v *Validator) Validate(
+	stamp string,
+	requiredBits int,
+) error {
+	if requiredBits <= 0 {
+		return nil
+	}
+
+	parts := strings.Split(stamp, ":")
+	if len(parts) != stampFields {
+		return fmt.Errorf(
+			"%w: expected %d, got %d",
+			errInvalidFields, stampFields, len(parts),
+		)
+	}
+
+	version := parts[0]
+	bitsStr := parts[1]
+	dateStr := parts[2]
+	resource := parts[3]
+
+	if err := v.validateHeader(
+		version, bitsStr, resource, requiredBits,
+	); err != nil {
+		return err
+	}
+
+	stampTime, err := parseStampDate(dateStr)
+	if err != nil {
+		return err
+	}
+
+	if err := validateTime(stampTime); err != nil {
+		return err
+	}
+
+	if err := validateProof(
+		stamp, requiredBits,
+	); err != nil {
+		return err
+	}
+
+	return v.checkAndRecordStamp(stamp, stampTime)
+}
+
+func (v *Validator) validateHeader(
+	version, bitsStr, resource string,
+	requiredBits int,
+) error {
+	if version != stampVersion {
+		return fmt.Errorf(
+			"%w: %s", errBadVersion, version,
+		)
+	}
+
+	claimedBits, err := strconv.Atoi(bitsStr)
+	if err != nil || claimedBits < requiredBits {
+		return fmt.Errorf(
+			"%w: need %d bits",
+			errInsufficientBits, requiredBits,
+		)
+	}
+
+	if resource != v.resource {
+		return fmt.Errorf(
+			"%w: got %q, want %q",
+			errWrongResource, resource, v.resource,
+		)
+	}
+
+	return nil
+}
+
+func validateTime(stampTime time.Time) error {
+	now := time.Now()
+
+	if now.Sub(stampTime) > maxStampAge {
+		return errStampExpired
+	}
+
+	if stampTime.Sub(now) > maxFutureSkew {
+		return errStampFuture
+	}
+
+	return nil
+}
+
+func validateProof(stamp string, requiredBits int) error {
+	hash := sha256.Sum256([]byte(stamp))
+	if !hasLeadingZeroBits(hash[:], requiredBits) {
+		return fmt.Errorf(
+			"%w: need %d leading zero bits",
+			errProofFailed, requiredBits,
+		)
+	}
+
+	return nil
+}
+
+func (v *Validator) checkAndRecordStamp(
+	stamp string,
+	stampTime time.Time,
+) error {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+
+	if _, ok := v.spent[stamp]; ok {
+		return errStampReused
+	}
+
+	v.spent[stamp] = stampTime
+
+	return nil
+}
+
+// hasLeadingZeroBits checks if the hash has at least n
+// leading zero bits.
+func hasLeadingZeroBits(hash []byte, numBits int) bool {
+	fullBytes := numBits / bitsPerByte
+	remainBits := numBits % bitsPerByte
+
+	for idx := range fullBytes {
+		if hash[idx] != 0 {
+			return false
+		}
+	}
+
+	if remainBits > 0 && fullBytes < len(hash) {
+		mask := byte(
+			fullByteMask << (bitsPerByte - remainBits),
+		)
+
+		if hash[fullBytes]&mask != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// parseStampDate parses a hashcash date stamp.
+// Supports YYMMDD and YYMMDDHHMMSS formats.
+func parseStampDate(dateStr string) (time.Time, error) {
+	switch len(dateStr) {
+	case dateShortLen:
+		parsed, err := time.Parse(
+			dateFormatShort, dateStr,
+		)
+		if err != nil {
+			return time.Time{}, fmt.Errorf(
+				"parse date: %w", err,
+			)
+		}
+
+		return parsed, nil
+	case dateLongLen:
+		parsed, err := time.Parse(
+			dateFormatLong, dateStr,
+		)
+		if err != nil {
+			return time.Time{}, fmt.Errorf(
+				"parse date: %w", err,
+			)
+		}
+
+		return parsed, nil
+	default:
+		return time.Time{}, fmt.Errorf(
+			"%w: %q", errBadDateFormat, dateStr,
+		)
+	}
+}
+
+// pruneLoop periodically removes expired stamps from the
+// spent set.
+func (v *Validator) pruneLoop() {
+	ticker := time.NewTicker(pruneInterval)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		v.prune()
+	}
+}
+
+func (v *Validator) prune() {
+	cutoff := time.Now().Add(-maxStampAge)
+
+	v.mu.Lock()
+	defer v.mu.Unlock()
+
+	for stamp, stampTime := range v.spent {
+		if stampTime.Before(cutoff) {
+			delete(v.spent, stamp)
+		}
+	}
+}

internal/hashcash/hashcash_test.go

@@ -0,0 +1,261 @@
+package hashcash_test
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"math/big"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/neoirc/internal/hashcash"
+)
+
+const testBits = 2
+
+// mintStampWithDate creates a valid hashcash stamp using
+// the given date string.
+func mintStampWithDate(
+	tb testing.TB,
+	bits int,
+	resource string,
+	date string,
+) string {
+	tb.Helper()
+
+	prefix := fmt.Sprintf(
+		"1:%d:%s:%s::", bits, date, resource,
+	)
+
+	for {
+		counterVal, err := rand.Int(
+			rand.Reader, big.NewInt(1<<48),
+		)
+		if err != nil {
+			tb.Fatalf("random counter: %v", err)
+		}
+
+		stamp := prefix + hex.EncodeToString(
+			counterVal.Bytes(),
+		)
+		hash := sha256.Sum256([]byte(stamp))
+
+		if hasLeadingZeroBits(hash[:], bits) {
+			return stamp
+		}
+	}
+}
+
+// hasLeadingZeroBits checks if hash has at least numBits
+// leading zero bits. Duplicated here for test minting.
+func hasLeadingZeroBits(
+	hash []byte,
+	numBits int,
+) bool {
+	fullBytes := numBits / 8
+	remainBits := numBits % 8
+
+	for idx := range fullBytes {
+		if hash[idx] != 0 {
+			return false
+		}
+	}
+
+	if remainBits > 0 && fullBytes < len(hash) {
+		mask := byte(0xFF << (8 - remainBits))
+
+		if hash[fullBytes]&mask != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+func todayDate() string {
+	return time.Now().UTC().Format("060102")
+}
+
+func TestMintAndValidate(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	stamp := mintStampWithDate(
+		t, testBits, "test-resource", todayDate(),
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err != nil {
+		t.Fatalf("valid stamp rejected: %v", err)
+	}
+}
+
+func TestReplayDetection(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	stamp := mintStampWithDate(
+		t, testBits, "test-resource", todayDate(),
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err != nil {
+		t.Fatalf("first use failed: %v", err)
+	}
+
+	err = validator.Validate(stamp, testBits)
+	if err == nil {
+		t.Fatal("replay not detected")
+	}
+}
+
+func TestResourceMismatch(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("correct-resource")
+	stamp := mintStampWithDate(
+		t, testBits, "wrong-resource", todayDate(),
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err == nil {
+		t.Fatal("expected resource mismatch error")
+	}
+}
+
+func TestInvalidStampFormat(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+
+	err := validator.Validate(
+		"not:a:valid:stamp", testBits,
+	)
+	if err == nil {
+		t.Fatal("expected error for bad format")
+	}
+}
+
+func TestBadVersion(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	stamp := fmt.Sprintf(
+		"2:%d:%s:%s::abc123",
+		testBits, todayDate(), "test-resource",
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err == nil {
+		t.Fatal("expected bad version error")
+	}
+}
+
+func TestInsufficientDifficulty(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	// Claimed bits=1, but we require testBits=2.
+	stamp := fmt.Sprintf(
+		"1:1:%s:%s::counter",
+		todayDate(), "test-resource",
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err == nil {
+		t.Fatal("expected insufficient bits error")
+	}
+}
+
+func TestExpiredStamp(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	oldDate := time.Now().Add(-72 * time.Hour).
+		UTC().Format("060102")
+	stamp := mintStampWithDate(
+		t, testBits, "test-resource", oldDate,
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err == nil {
+		t.Fatal("expected expired stamp error")
+	}
+}
+
+func TestZeroBitsSkipsValidation(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+
+	err := validator.Validate("garbage", 0)
+	if err != nil {
+		t.Fatalf("zero bits should skip: %v", err)
+	}
+}
+
+func TestLongDateFormat(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	longDate := time.Now().UTC().Format("060102150405")
+	stamp := mintStampWithDate(
+		t, testBits, "test-resource", longDate,
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err != nil {
+		t.Fatalf("long date stamp rejected: %v", err)
+	}
+}
+
+func TestBadDateFormat(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+	stamp := fmt.Sprintf(
+		"1:%d:BADDATE:%s::counter",
+		testBits, "test-resource",
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err == nil {
+		t.Fatal("expected bad date error")
+	}
+}
+
+func TestMultipleUniqueStamps(t *testing.T) {
+	t.Parallel()
+
+	validator := hashcash.NewValidator("test-resource")
+
+	for range 5 {
+		stamp := mintStampWithDate(
+			t, testBits, "test-resource", todayDate(),
+		)
+
+		err := validator.Validate(stamp, testBits)
+		if err != nil {
+			t.Fatalf("unique stamp rejected: %v", err)
+		}
+	}
+}
+
+func TestHigherBitsStillValid(t *testing.T) {
+	t.Parallel()
+
+	// Mint with bits=4 but validate requiring only 2.
+	validator := hashcash.NewValidator("test-resource")
+	stamp := mintStampWithDate(
+		t, 4, "test-resource", todayDate(),
+	)
+
+	err := validator.Validate(stamp, testBits)
+	if err != nil {
+		t.Fatalf(
+			"higher-difficulty stamp rejected: %v",
+			err,
+		)
+	}
+}

internal/healthcheck/healthcheck.go

@@ -10,6 +10,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
 
@@ -21,6 +22,7 @@ type Params struct {
 	Config   *config.Config
 	Logger   *logger.Logger
 	Database *db.Database
+	Stats    *stats.Tracker
 }
 
 // Healthcheck tracks server uptime and provides health status.
@@ -64,11 +66,22 @@ type Response struct {
 	Version       string `json:"version"`
 	Appname       string `json:"appname"`
 	Maintenance   bool   `json:"maintenanceMode"`
+
+	// Runtime statistics.
+	Sessions             int64 `json:"sessions"`
+	Clients              int64 `json:"clients"`
+	QueuedLines          int64 `json:"queuedLines"`
+	Channels             int64 `json:"channels"`
+	ConnectionsSinceBoot int64 `json:"connectionsSinceBoot"`
+	SessionsSinceBoot    int64 `json:"sessionsSinceBoot"`
+	MessagesSinceBoot    int64 `json:"messagesSinceBoot"`
 }
 
 // Healthcheck returns the current health status of the server.
-func (hcheck *Healthcheck) Healthcheck() *Response {
-	return &Response{
+func (hcheck *Healthcheck) Healthcheck(
+	ctx context.Context,
+) *Response {
+	resp := &Response{
 		Status:        "ok",
 		Now:           time.Now().UTC().Format(time.RFC3339Nano),
 		UptimeSeconds: int64(hcheck.uptime().Seconds()),
@@ -76,6 +89,64 @@ func (hcheck *Healthcheck) Healthcheck() *Response {
 		Appname:       hcheck.params.Globals.Appname,
 		Version:       hcheck.params.Globals.Version,
 		Maintenance:   hcheck.params.Config.MaintenanceMode,
+
+		Sessions:             0,
+		Clients:              0,
+		QueuedLines:          0,
+		Channels:             0,
+		ConnectionsSinceBoot: hcheck.params.Stats.ConnectionsSinceBoot(),
+		SessionsSinceBoot:    hcheck.params.Stats.SessionsSinceBoot(),
+		MessagesSinceBoot:    hcheck.params.Stats.MessagesSinceBoot(),
+	}
+
+	hcheck.populateDBStats(ctx, resp)
+
+	return resp
+}
+
+// populateDBStats fills in database-derived counters.
+func (hcheck *Healthcheck) populateDBStats(
+	ctx context.Context,
+	resp *Response,
+) {
+	sessions, err := hcheck.params.Database.GetUserCount(ctx)
+	if err != nil {
+		hcheck.log.Error(
+			"healthcheck: session count failed",
+			"error", err,
+		)
+	} else {
+		resp.Sessions = sessions
+	}
+
+	clients, err := hcheck.params.Database.GetClientCount(ctx)
+	if err != nil {
+		hcheck.log.Error(
+			"healthcheck: client count failed",
+			"error", err,
+		)
+	} else {
+		resp.Clients = clients
+	}
+
+	queued, err := hcheck.params.Database.GetQueueEntryCount(ctx)
+	if err != nil {
+		hcheck.log.Error(
+			"healthcheck: queue entry count failed",
+			"error", err,
+		)
+	} else {
+		resp.QueuedLines = queued
+	}
+
+	channels, err := hcheck.params.Database.GetChannelCount(ctx)
+	if err != nil {
+		hcheck.log.Error(
+			"healthcheck: channel count failed",
+			"error", err,
+		)
+	} else {
+		resp.Channels = channels
 	}
 }
 

internal/irc/numerics.go

@@ -1,150 +0,0 @@
-// Package irc provides constants and utilities for the
-// IRC protocol, including numeric reply codes from
-// RFC 1459 and RFC 2812, and standard command names.
-package irc
-
-// Connection registration replies (001-005).
-const (
-	RplWelcome  = 1
-	RplYourHost = 2
-	RplCreated  = 3
-	RplMyInfo   = 4
-	RplIsupport = 5
-)
-
-// Command responses (200-399).
-const (
-	RplUmodeIs       = 221
-	RplLuserClient   = 251
-	RplLuserOp       = 252
-	RplLuserUnknown  = 253
-	RplLuserChannels = 254
-	RplLuserMe       = 255
-	RplAway          = 301
-	RplUserHost      = 302
-	RplIson          = 303
-	RplUnaway        = 305
-	RplNowAway       = 306
-	RplWhoisUser     = 311
-	RplWhoisServer   = 312
-	RplWhoisOperator = 313
-	RplEndOfWho      = 315
-	RplWhoisIdle     = 317
-	RplEndOfWhois    = 318
-	RplWhoisChannels = 319
-	RplList          = 322
-	RplListEnd       = 323
-	RplChannelModeIs = 324
-	RplCreationTime  = 329
-	RplNoTopic       = 331
-	RplTopic         = 332
-	RplTopicWhoTime  = 333
-	RplInviting      = 341
-	RplWhoReply      = 352
-	RplNamReply      = 353
-	RplEndOfNames    = 366
-	RplBanList       = 367
-	RplEndOfBanList  = 368
-	RplMotd          = 372
-	RplMotdStart     = 375
-	RplEndOfMotd     = 376
-)
-
-// Error replies (400-599).
-const (
-	ErrNoSuchNick        = 401
-	ErrNoSuchServer      = 402
-	ErrNoSuchChannel     = 403
-	ErrCannotSendToChan  = 404
-	ErrTooManyChannels   = 405
-	ErrNoRecipient       = 411
-	ErrNoTextToSend      = 412
-	ErrUnknownCommand    = 421
-	ErrNoNicknameGiven   = 431
-	ErrErroneusNickname  = 432
-	ErrNicknameInUse     = 433
-	ErrUserNotInChannel  = 441
-	ErrNotOnChannel      = 442
-	ErrNotRegistered     = 451
-	ErrNeedMoreParams    = 461
-	ErrAlreadyRegistered = 462
-	ErrChannelIsFull     = 471
-	ErrInviteOnlyChan    = 473
-	ErrBannedFromChan    = 474
-	ErrBadChannelKey     = 475
-	ErrChanOpPrivsNeeded = 482
-)
-
-// names maps numeric codes to their standard IRC names.
-//
-//nolint:gochecknoglobals
-var names = map[int]string{
-	RplWelcome:       "RPL_WELCOME",
-	RplYourHost:      "RPL_YOURHOST",
-	RplCreated:       "RPL_CREATED",
-	RplMyInfo:        "RPL_MYINFO",
-	RplIsupport:      "RPL_ISUPPORT",
-	RplUmodeIs:       "RPL_UMODEIS",
-	RplLuserClient:   "RPL_LUSERCLIENT",
-	RplLuserOp:       "RPL_LUSEROP",
-	RplLuserUnknown:  "RPL_LUSERUNKNOWN",
-	RplLuserChannels: "RPL_LUSERCHANNELS",
-	RplLuserMe:       "RPL_LUSERME",
-	RplAway:          "RPL_AWAY",
-	RplUserHost:      "RPL_USERHOST",
-	RplIson:          "RPL_ISON",
-	RplUnaway:        "RPL_UNAWAY",
-	RplNowAway:       "RPL_NOWAWAY",
-	RplWhoisUser:     "RPL_WHOISUSER",
-	RplWhoisServer:   "RPL_WHOISSERVER",
-	RplWhoisOperator: "RPL_WHOISOPERATOR",
-	RplEndOfWho:      "RPL_ENDOFWHO",
-	RplWhoisIdle:     "RPL_WHOISIDLE",
-	RplEndOfWhois:    "RPL_ENDOFWHOIS",
-	RplWhoisChannels: "RPL_WHOISCHANNELS",
-	RplList:          "RPL_LIST",
-	RplListEnd:       "RPL_LISTEND", //nolint:misspell
-	RplChannelModeIs: "RPL_CHANNELMODEIS",
-	RplCreationTime:  "RPL_CREATIONTIME",
-	RplNoTopic:       "RPL_NOTOPIC",
-	RplTopic:         "RPL_TOPIC",
-	RplTopicWhoTime:  "RPL_TOPICWHOTIME",
-	RplInviting:      "RPL_INVITING",
-	RplWhoReply:      "RPL_WHOREPLY",
-	RplNamReply:      "RPL_NAMREPLY",
-	RplEndOfNames:    "RPL_ENDOFNAMES",
-	RplBanList:       "RPL_BANLIST",
-	RplEndOfBanList:  "RPL_ENDOFBANLIST",
-	RplMotd:          "RPL_MOTD",
-	RplMotdStart:     "RPL_MOTDSTART",
-	RplEndOfMotd:     "RPL_ENDOFMOTD",
-
-	ErrNoSuchNick:        "ERR_NOSUCHNICK",
-	ErrNoSuchServer:      "ERR_NOSUCHSERVER",
-	ErrNoSuchChannel:     "ERR_NOSUCHCHANNEL",
-	ErrCannotSendToChan:  "ERR_CANNOTSENDTOCHAN",
-	ErrTooManyChannels:   "ERR_TOOMANYCHANNELS",
-	ErrNoRecipient:       "ERR_NORECIPIENT",
-	ErrNoTextToSend:      "ERR_NOTEXTTOSEND",
-	ErrUnknownCommand:    "ERR_UNKNOWNCOMMAND",
-	ErrNoNicknameGiven:   "ERR_NONICKNAMEGIVEN",
-	ErrErroneusNickname:  "ERR_ERRONEUSNICKNAME",
-	ErrNicknameInUse:     "ERR_NICKNAMEINUSE",
-	ErrUserNotInChannel:  "ERR_USERNOTINCHANNEL",
-	ErrNotOnChannel:      "ERR_NOTONCHANNEL",
-	ErrNotRegistered:     "ERR_NOTREGISTERED",
-	ErrNeedMoreParams:    "ERR_NEEDMOREPARAMS",
-	ErrAlreadyRegistered: "ERR_ALREADYREGISTERED",
-	ErrChannelIsFull:     "ERR_CHANNELISFULL",
-	ErrInviteOnlyChan:    "ERR_INVITEONLYCHAN",
-	ErrBannedFromChan:    "ERR_BANNEDFROMCHAN",
-	ErrBadChannelKey:     "ERR_BADCHANNELKEY",
-	ErrChanOpPrivsNeeded: "ERR_CHANOPRIVSNEEDED",
-}
-
-// Name returns the standard IRC name for a numeric code
-// (e.g., Name(2) returns "RPL_YOURHOST"). Returns an
-// empty string if the code is unknown.
-func Name(code int) string {
-	return names[code]
-}

internal/stats/stats.go

@@ -0,0 +1,52 @@
+// Package stats tracks runtime statistics since server boot.
+package stats
+
+import (
+	"sync/atomic"
+)
+
+// Tracker holds atomic counters for runtime statistics
+// that accumulate since the server started.
+type Tracker struct {
+	connectionsSinceBoot atomic.Int64
+	sessionsSinceBoot    atomic.Int64
+	messagesSinceBoot    atomic.Int64
+}
+
+// New creates a new Tracker with all counters at zero.
+func New() *Tracker {
+	return &Tracker{} //nolint:exhaustruct // atomic fields have zero-value defaults
+}
+
+// IncrConnections increments the total connection count.
+func (t *Tracker) IncrConnections() {
+	t.connectionsSinceBoot.Add(1)
+}
+
+// IncrSessions increments the total session count.
+func (t *Tracker) IncrSessions() {
+	t.sessionsSinceBoot.Add(1)
+}
+
+// IncrMessages increments the total PRIVMSG/NOTICE count.
+func (t *Tracker) IncrMessages() {
+	t.messagesSinceBoot.Add(1)
+}
+
+// ConnectionsSinceBoot returns the total number of
+// client connections since boot.
+func (t *Tracker) ConnectionsSinceBoot() int64 {
+	return t.connectionsSinceBoot.Load()
+}
+
+// SessionsSinceBoot returns the total number of sessions
+// created since boot.
+func (t *Tracker) SessionsSinceBoot() int64 {
+	return t.sessionsSinceBoot.Load()
+}
+
+// MessagesSinceBoot returns the total number of
+// PRIVMSG/NOTICE messages sent since boot.
+func (t *Tracker) MessagesSinceBoot() int64 {
+	return t.messagesSinceBoot.Load()
+}

internal/stats/stats_test.go

@@ -0,0 +1,117 @@
+package stats_test
+
+import (
+	"testing"
+
+	"git.eeqj.de/sneak/neoirc/internal/stats"
+)
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+
+	tracker := stats.New()
+	if tracker == nil {
+		t.Fatal("expected non-nil tracker")
+	}
+
+	if tracker.ConnectionsSinceBoot() != 0 {
+		t.Errorf(
+			"expected 0 connections, got %d",
+			tracker.ConnectionsSinceBoot(),
+		)
+	}
+
+	if tracker.SessionsSinceBoot() != 0 {
+		t.Errorf(
+			"expected 0 sessions, got %d",
+			tracker.SessionsSinceBoot(),
+		)
+	}
+
+	if tracker.MessagesSinceBoot() != 0 {
+		t.Errorf(
+			"expected 0 messages, got %d",
+			tracker.MessagesSinceBoot(),
+		)
+	}
+}
+
+func TestIncrConnections(t *testing.T) {
+	t.Parallel()
+
+	tracker := stats.New()
+
+	tracker.IncrConnections()
+	tracker.IncrConnections()
+	tracker.IncrConnections()
+
+	got := tracker.ConnectionsSinceBoot()
+	if got != 3 {
+		t.Errorf(
+			"expected 3 connections, got %d", got,
+		)
+	}
+}
+
+func TestIncrSessions(t *testing.T) {
+	t.Parallel()
+
+	tracker := stats.New()
+
+	tracker.IncrSessions()
+	tracker.IncrSessions()
+
+	got := tracker.SessionsSinceBoot()
+	if got != 2 {
+		t.Errorf(
+			"expected 2 sessions, got %d", got,
+		)
+	}
+}
+
+func TestIncrMessages(t *testing.T) {
+	t.Parallel()
+
+	tracker := stats.New()
+
+	tracker.IncrMessages()
+
+	got := tracker.MessagesSinceBoot()
+	if got != 1 {
+		t.Errorf(
+			"expected 1 message, got %d", got,
+		)
+	}
+}
+
+func TestCountersAreIndependent(t *testing.T) {
+	t.Parallel()
+
+	tracker := stats.New()
+
+	tracker.IncrConnections()
+	tracker.IncrSessions()
+	tracker.IncrMessages()
+	tracker.IncrMessages()
+
+	if tracker.ConnectionsSinceBoot() != 1 {
+		t.Errorf(
+			"expected 1 connection, got %d",
+			tracker.ConnectionsSinceBoot(),
+		)
+	}
+
+	if tracker.SessionsSinceBoot() != 1 {
+		t.Errorf(
+			"expected 1 session, got %d",
+			tracker.SessionsSinceBoot(),
+		)
+	}
+
+	if tracker.MessagesSinceBoot() != 2 {
+		t.Errorf(
+			"expected 2 messages, got %d",
+			tracker.MessagesSinceBoot(),
+		)
+	}
+}

pkg/irc/commands.go

@@ -2,6 +2,7 @@ package irc
 
 // IRC command names (RFC 1459 / RFC 2812).
 const (
+	CmdAway    = "AWAY"
 	CmdJoin    = "JOIN"
 	CmdList    = "LIST"
 	CmdLusers  = "LUSERS"

pkg/irc/numerics.go

@@ -0,0 +1,391 @@
+// Package irc provides constants and utilities for the
+// IRC protocol, including numeric reply codes from
+// RFC 1459 and RFC 2812, and standard command names.
+package irc
+
+import (
+	"errors"
+	"fmt"
+)
+
+// IRCMessageType represents an IRC numeric reply or error code.
+type IRCMessageType int //nolint:revive // Name requested by project owner.
+
+// Name returns the standard IRC name for this numeric code
+// (e.g., IRCMessageType(252).Name() returns "RPL_LUSEROP").
+// Returns an empty string if the code is unknown.
+func (t IRCMessageType) Name() string {
+	return names[t]
+}
+
+// String returns the name and numeric code in angle brackets
+// (e.g., IRCMessageType(252).String() returns "RPL_LUSEROP <252>").
+// If the code is unknown, returns "UNKNOWN <NNN>".
+func (t IRCMessageType) String() string {
+	n := names[t]
+	if n == "" {
+		n = "UNKNOWN"
+	}
+
+	return fmt.Sprintf("%s <%03d>", n, int(t))
+}
+
+// Code returns the three-digit zero-padded string representation
+// of the numeric code (e.g., IRCMessageType(252).Code() returns "252").
+func (t IRCMessageType) Code() string {
+	return fmt.Sprintf("%03d", int(t))
+}
+
+// Int returns the bare integer value of the numeric code.
+func (t IRCMessageType) Int() int {
+	return int(t)
+}
+
+// ErrUnknownNumeric is returned by FromInt when the numeric code is not recognized.
+var ErrUnknownNumeric = errors.New("unknown IRC numeric code")
+
+// FromInt converts an integer to an IRCMessageType, returning an error
+// if the numeric code is not a known IRC reply or error code.
+func FromInt(n int) (IRCMessageType, error) {
+	t := IRCMessageType(n)
+	if _, ok := names[t]; !ok {
+		return 0, fmt.Errorf("%w: %d", ErrUnknownNumeric, n)
+	}
+
+	return t, nil
+}
+
+// Connection registration replies (001-005).
+const (
+	RplWelcome  IRCMessageType = 1
+	RplYourHost IRCMessageType = 2
+	RplCreated  IRCMessageType = 3
+	RplMyInfo   IRCMessageType = 4
+	RplBounce   IRCMessageType = 5 // RFC 2812; also known as RPL_ISUPPORT in practice
+	RplIsupport IRCMessageType = 5 // De-facto standard (same numeric as RplBounce)
+)
+
+// Command responses (200-399).
+const (
+	// RFC 2812 trace/stats/links replies (200-219).
+	RplTraceLink       IRCMessageType = 200
+	RplTraceConnecting IRCMessageType = 201
+	RplTraceHandshake  IRCMessageType = 202
+	RplTraceUnknown    IRCMessageType = 203
+	RplTraceOperator   IRCMessageType = 204
+	RplTraceUser       IRCMessageType = 205
+	RplTraceServer     IRCMessageType = 206
+	RplTraceService    IRCMessageType = 207
+	RplTraceNewType    IRCMessageType = 208
+	RplTraceClass      IRCMessageType = 209
+	RplStatsLinkInfo   IRCMessageType = 211
+	RplStatsCommands   IRCMessageType = 212
+	RplStatsCLine      IRCMessageType = 213
+	RplStatsNLine      IRCMessageType = 214
+	RplStatsILine      IRCMessageType = 215
+	RplStatsKLine      IRCMessageType = 216
+	RplStatsQLine      IRCMessageType = 217
+	RplStatsYLine      IRCMessageType = 218
+	RplEndOfStats      IRCMessageType = 219
+
+	RplUmodeIs      IRCMessageType = 221
+	RplServList     IRCMessageType = 234
+	RplServListEnd  IRCMessageType = 235
+	RplStatsLLine   IRCMessageType = 241
+	RplStatsUptime  IRCMessageType = 242
+	RplStatsOLine   IRCMessageType = 243
+	RplStatsHLine   IRCMessageType = 244
+	RplLuserClient  IRCMessageType = 251
+	RplLuserOp      IRCMessageType = 252
+	RplLuserUnknown IRCMessageType = 253
+
+	RplLuserChannels IRCMessageType = 254
+	RplLuserMe       IRCMessageType = 255
+	RplAdminMe       IRCMessageType = 256
+	RplAdminLoc1     IRCMessageType = 257
+	RplAdminLoc2     IRCMessageType = 258
+	RplAdminEmail    IRCMessageType = 259
+	RplTraceLog      IRCMessageType = 261
+	RplTraceEnd      IRCMessageType = 262
+	RplTryAgain      IRCMessageType = 263
+
+	RplAway          IRCMessageType = 301
+	RplUserHost      IRCMessageType = 302
+	RplIson          IRCMessageType = 303
+	RplUnaway        IRCMessageType = 305
+	RplNowAway       IRCMessageType = 306
+	RplWhoisUser     IRCMessageType = 311
+	RplWhoisServer   IRCMessageType = 312
+	RplWhoisOperator IRCMessageType = 313
+	RplWhoWasUser    IRCMessageType = 314
+	RplEndOfWho      IRCMessageType = 315
+	RplWhoisIdle     IRCMessageType = 317
+	RplEndOfWhois    IRCMessageType = 318
+	RplWhoisChannels IRCMessageType = 319
+	RplListStart     IRCMessageType = 321
+	RplList          IRCMessageType = 322
+	RplListEnd       IRCMessageType = 323
+	RplChannelModeIs IRCMessageType = 324
+
+	RplUniqOpIs        IRCMessageType = 325
+	RplCreationTime    IRCMessageType = 329
+	RplNoTopic         IRCMessageType = 331
+	RplTopic           IRCMessageType = 332
+	RplTopicWhoTime    IRCMessageType = 333
+	RplInviting        IRCMessageType = 341
+	RplSummoning       IRCMessageType = 342
+	RplInviteList      IRCMessageType = 346
+	RplEndOfInviteList IRCMessageType = 347
+	RplExceptList      IRCMessageType = 348
+	RplEndOfExceptList IRCMessageType = 349
+	RplVersion         IRCMessageType = 351
+	RplWhoReply        IRCMessageType = 352
+	RplNamReply        IRCMessageType = 353
+	RplLinks           IRCMessageType = 364
+	RplEndOfLinks      IRCMessageType = 365
+	RplEndOfNames      IRCMessageType = 366
+	RplBanList         IRCMessageType = 367
+	RplEndOfBanList    IRCMessageType = 368
+	RplEndOfWhowas     IRCMessageType = 369
+	RplInfo            IRCMessageType = 371
+	RplMotd            IRCMessageType = 372
+	RplEndOfInfo       IRCMessageType = 374
+	RplMotdStart       IRCMessageType = 375
+	RplEndOfMotd       IRCMessageType = 376
+	RplYoureOper       IRCMessageType = 381
+	RplRehashing       IRCMessageType = 382
+	RplYoureService    IRCMessageType = 383
+	RplTime            IRCMessageType = 391
+	RplUsersStart      IRCMessageType = 392
+	RplUsers           IRCMessageType = 393
+	RplEndOfUsers      IRCMessageType = 394
+	RplNoUsers         IRCMessageType = 395
+)
+
+// Error replies (400-599).
+const (
+	ErrNoSuchNick       IRCMessageType = 401
+	ErrNoSuchServer     IRCMessageType = 402
+	ErrNoSuchChannel    IRCMessageType = 403
+	ErrCannotSendToChan IRCMessageType = 404
+	ErrTooManyChannels  IRCMessageType = 405
+	ErrWasNoSuchNick    IRCMessageType = 406
+	ErrTooManyTargets   IRCMessageType = 407
+	ErrNoSuchService    IRCMessageType = 408
+	ErrNoOrigin         IRCMessageType = 409
+	ErrNoRecipient      IRCMessageType = 411
+	ErrNoTextToSend     IRCMessageType = 412
+	ErrNoTopLevel       IRCMessageType = 413
+	ErrWildTopLevel     IRCMessageType = 414
+	ErrBadMask          IRCMessageType = 415
+	ErrUnknownCommand   IRCMessageType = 421
+	ErrNoMotd           IRCMessageType = 422
+	ErrNoAdminInfo      IRCMessageType = 423
+	ErrFileError        IRCMessageType = 424
+	ErrNoNicknameGiven  IRCMessageType = 431
+	ErrErroneusNickname IRCMessageType = 432
+	ErrNicknameInUse    IRCMessageType = 433
+	ErrNickCollision    IRCMessageType = 436
+	ErrUnavailResource  IRCMessageType = 437
+
+	ErrUserNotInChannel  IRCMessageType = 441
+	ErrNotOnChannel      IRCMessageType = 442
+	ErrUserOnChannel     IRCMessageType = 443
+	ErrNoLogin           IRCMessageType = 444
+	ErrSummonDisabled    IRCMessageType = 445
+	ErrUsersDisabled     IRCMessageType = 446
+	ErrNotRegistered     IRCMessageType = 451
+	ErrNeedMoreParams    IRCMessageType = 461
+	ErrAlreadyRegistered IRCMessageType = 462
+	ErrNoPermForHost     IRCMessageType = 463
+	ErrPasswdMismatch    IRCMessageType = 464
+	ErrYoureBannedCreep  IRCMessageType = 465
+	ErrYouWillBeBanned   IRCMessageType = 466
+	ErrKeySet            IRCMessageType = 467
+	ErrChannelIsFull     IRCMessageType = 471
+	ErrUnknownMode       IRCMessageType = 472
+	ErrInviteOnlyChan    IRCMessageType = 473
+	ErrBannedFromChan    IRCMessageType = 474
+	ErrBadChannelKey     IRCMessageType = 475
+	ErrBadChanMask       IRCMessageType = 476
+	ErrNoChanModes       IRCMessageType = 477
+	ErrBanListFull       IRCMessageType = 478
+	ErrNoPrivileges      IRCMessageType = 481
+	ErrChanOpPrivsNeeded IRCMessageType = 482
+	ErrCantKillServer    IRCMessageType = 483
+	ErrRestricted        IRCMessageType = 484
+	ErrUniqOpPrivsNeeded IRCMessageType = 485
+	ErrNoOperHost        IRCMessageType = 491
+
+	ErrUmodeUnknownFlag IRCMessageType = 501
+	ErrUsersDoNotMatch  IRCMessageType = 502
+)
+
+// names maps numeric codes to their standard IRC names.
+//
+//nolint:gochecknoglobals
+var names = map[IRCMessageType]string{
+	RplWelcome:  "RPL_WELCOME",
+	RplYourHost: "RPL_YOURHOST",
+	RplCreated:  "RPL_CREATED",
+	RplMyInfo:   "RPL_MYINFO",
+	RplBounce:   "RPL_BOUNCE",
+
+	RplTraceLink:       "RPL_TRACELINK",
+	RplTraceConnecting: "RPL_TRACECONNECTING",
+	RplTraceHandshake:  "RPL_TRACEHANDSHAKE",
+	RplTraceUnknown:    "RPL_TRACEUNKNOWN",
+	RplTraceOperator:   "RPL_TRACEOPERATOR",
+	RplTraceUser:       "RPL_TRACEUSER",
+	RplTraceServer:     "RPL_TRACESERVER",
+	RplTraceService:    "RPL_TRACESERVICE",
+	RplTraceNewType:    "RPL_TRACENEWTYPE",
+	RplTraceClass:      "RPL_TRACECLASS",
+	RplStatsLinkInfo:   "RPL_STATSLINKINFO",
+	RplStatsCommands:   "RPL_STATSCOMMANDS",
+	RplStatsCLine:      "RPL_STATSCLINE",
+	RplStatsNLine:      "RPL_STATSNLINE",
+	RplStatsILine:      "RPL_STATSILINE",
+	RplStatsKLine:      "RPL_STATSKLINE",
+	RplStatsQLine:      "RPL_STATSQLINE",
+	RplStatsYLine:      "RPL_STATSYLINE",
+	RplEndOfStats:      "RPL_ENDOFSTATS",
+
+	RplUmodeIs:      "RPL_UMODEIS",
+	RplServList:     "RPL_SERVLIST",
+	RplServListEnd:  "RPL_SERVLISTEND",
+	RplStatsLLine:   "RPL_STATSLLINE",
+	RplStatsUptime:  "RPL_STATSUPTIME",
+	RplStatsOLine:   "RPL_STATSOLINE",
+	RplStatsHLine:   "RPL_STATSHLINE",
+	RplLuserClient:  "RPL_LUSERCLIENT",
+	RplLuserOp:      "RPL_LUSEROP",
+	RplLuserUnknown: "RPL_LUSERUNKNOWN",
+
+	RplLuserChannels: "RPL_LUSERCHANNELS",
+	RplLuserMe:       "RPL_LUSERME",
+	RplAdminMe:       "RPL_ADMINME",
+	RplAdminLoc1:     "RPL_ADMINLOC1",
+	RplAdminLoc2:     "RPL_ADMINLOC2",
+	RplAdminEmail:    "RPL_ADMINEMAIL",
+	RplTraceLog:      "RPL_TRACELOG",
+	RplTraceEnd:      "RPL_TRACEEND",
+	RplTryAgain:      "RPL_TRYAGAIN",
+
+	RplAway:          "RPL_AWAY",
+	RplUserHost:      "RPL_USERHOST",
+	RplIson:          "RPL_ISON",
+	RplUnaway:        "RPL_UNAWAY",
+	RplNowAway:       "RPL_NOWAWAY",
+	RplWhoisUser:     "RPL_WHOISUSER",
+	RplWhoisServer:   "RPL_WHOISSERVER",
+	RplWhoisOperator: "RPL_WHOISOPERATOR",
+	RplWhoWasUser:    "RPL_WHOWASUSER",
+	RplEndOfWho:      "RPL_ENDOFWHO",
+	RplWhoisIdle:     "RPL_WHOISIDLE",
+	RplEndOfWhois:    "RPL_ENDOFWHOIS",
+	RplWhoisChannels: "RPL_WHOISCHANNELS",
+	RplListStart:     "RPL_LISTSTART",
+	RplList:          "RPL_LIST",
+	RplListEnd:       "RPL_LISTEND", //nolint:misspell
+	RplChannelModeIs: "RPL_CHANNELMODEIS",
+
+	RplUniqOpIs:        "RPL_UNIQOPIS",
+	RplCreationTime:    "RPL_CREATIONTIME",
+	RplNoTopic:         "RPL_NOTOPIC",
+	RplTopic:           "RPL_TOPIC",
+	RplTopicWhoTime:    "RPL_TOPICWHOTIME",
+	RplInviting:        "RPL_INVITING",
+	RplSummoning:       "RPL_SUMMONING",
+	RplInviteList:      "RPL_INVITELIST",
+	RplEndOfInviteList: "RPL_ENDOFINVITELIST",
+	RplExceptList:      "RPL_EXCEPTLIST",
+	RplEndOfExceptList: "RPL_ENDOFEXCEPTLIST",
+	RplVersion:         "RPL_VERSION",
+	RplWhoReply:        "RPL_WHOREPLY",
+	RplNamReply:        "RPL_NAMREPLY",
+	RplLinks:           "RPL_LINKS",
+	RplEndOfLinks:      "RPL_ENDOFLINKS",
+	RplEndOfNames:      "RPL_ENDOFNAMES",
+	RplBanList:         "RPL_BANLIST",
+	RplEndOfBanList:    "RPL_ENDOFBANLIST",
+	RplEndOfWhowas:     "RPL_ENDOFWHOWAS",
+	RplInfo:            "RPL_INFO",
+	RplMotd:            "RPL_MOTD",
+	RplEndOfInfo:       "RPL_ENDOFINFO",
+	RplMotdStart:       "RPL_MOTDSTART",
+	RplEndOfMotd:       "RPL_ENDOFMOTD",
+	RplYoureOper:       "RPL_YOUREOPER",
+	RplRehashing:       "RPL_REHASHING",
+	RplYoureService:    "RPL_YOURESERVICE",
+	RplTime:            "RPL_TIME",
+	RplUsersStart:      "RPL_USERSSTART",
+	RplUsers:           "RPL_USERS",
+	RplEndOfUsers:      "RPL_ENDOFUSERS",
+	RplNoUsers:         "RPL_NOUSERS",
+
+	ErrNoSuchNick:       "ERR_NOSUCHNICK",
+	ErrNoSuchServer:     "ERR_NOSUCHSERVER",
+	ErrNoSuchChannel:    "ERR_NOSUCHCHANNEL",
+	ErrCannotSendToChan: "ERR_CANNOTSENDTOCHAN",
+	ErrTooManyChannels:  "ERR_TOOMANYCHANNELS",
+	ErrWasNoSuchNick:    "ERR_WASNOSUCHNICK",
+	ErrTooManyTargets:   "ERR_TOOMANYTARGETS",
+	ErrNoSuchService:    "ERR_NOSUCHSERVICE",
+	ErrNoOrigin:         "ERR_NOORIGIN",
+	ErrNoRecipient:      "ERR_NORECIPIENT",
+	ErrNoTextToSend:     "ERR_NOTEXTTOSEND",
+	ErrNoTopLevel:       "ERR_NOTOPLEVEL",
+	ErrWildTopLevel:     "ERR_WILDTOPLEVEL",
+	ErrBadMask:          "ERR_BADMASK",
+	ErrUnknownCommand:   "ERR_UNKNOWNCOMMAND",
+	ErrNoMotd:           "ERR_NOMOTD",
+	ErrNoAdminInfo:      "ERR_NOADMININFO",
+	ErrFileError:        "ERR_FILEERROR",
+	ErrNoNicknameGiven:  "ERR_NONICKNAMEGIVEN",
+	ErrErroneusNickname: "ERR_ERRONEUSNICKNAME",
+	ErrNicknameInUse:    "ERR_NICKNAMEINUSE",
+	ErrNickCollision:    "ERR_NICKCOLLISION",
+	ErrUnavailResource:  "ERR_UNAVAILRESOURCE",
+
+	ErrUserNotInChannel:  "ERR_USERNOTINCHANNEL",
+	ErrNotOnChannel:      "ERR_NOTONCHANNEL",
+	ErrUserOnChannel:     "ERR_USERONCHANNEL",
+	ErrNoLogin:           "ERR_NOLOGIN",
+	ErrSummonDisabled:    "ERR_SUMMONDISABLED",
+	ErrUsersDisabled:     "ERR_USERSDISABLED",
+	ErrNotRegistered:     "ERR_NOTREGISTERED",
+	ErrNeedMoreParams:    "ERR_NEEDMOREPARAMS",
+	ErrAlreadyRegistered: "ERR_ALREADYREGISTERED",
+	ErrNoPermForHost:     "ERR_NOPERMFORHOST",
+	ErrPasswdMismatch:    "ERR_PASSWDMISMATCH",
+	ErrYoureBannedCreep:  "ERR_YOUREBANNEDCREEP",
+	ErrYouWillBeBanned:   "ERR_YOUWILLBEBANNED",
+	ErrKeySet:            "ERR_KEYSET",
+	ErrChannelIsFull:     "ERR_CHANNELISFULL",
+	ErrUnknownMode:       "ERR_UNKNOWNMODE",
+	ErrInviteOnlyChan:    "ERR_INVITEONLYCHAN",
+	ErrBannedFromChan:    "ERR_BANNEDFROMCHAN",
+	ErrBadChannelKey:     "ERR_BADCHANNELKEY",
+	ErrBadChanMask:       "ERR_BADCHANMASK",
+	ErrNoChanModes:       "ERR_NOCHANMODES",
+	ErrBanListFull:       "ERR_BANLISTFULL",
+	ErrNoPrivileges:      "ERR_NOPRIVILEGES",
+	ErrChanOpPrivsNeeded: "ERR_CHANOPRIVSNEEDED",
+	ErrCantKillServer:    "ERR_CANTKILLSERVER",
+	ErrRestricted:        "ERR_RESTRICTED",
+	ErrUniqOpPrivsNeeded: "ERR_UNIQOPPRIVSNEEDED",
+	ErrNoOperHost:        "ERR_NOOPERHOST",
+
+	ErrUmodeUnknownFlag: "ERR_UMODEUNKNOWNFLAG",
+	ErrUsersDoNotMatch:  "ERR_USERSDONTMATCH",
+}
+
+// Name returns the standard IRC name for a numeric code
+// (e.g., Name(2) returns "RPL_YOURHOST"). Returns an
+// empty string if the code is unknown.
+//
+// Deprecated: Use IRCMessageType.Name() instead.
+func Name(code IRCMessageType) string {
+	return names[code]
+}

pkg/irc/numerics_test.go

@@ -0,0 +1,163 @@
+package irc_test
+
+import (
+	"errors"
+	"testing"
+
+	"git.eeqj.de/sneak/neoirc/pkg/irc"
+)
+
+func TestName(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		numeric irc.IRCMessageType
+		want    string
+	}{
+		{irc.RplWelcome, "RPL_WELCOME"},
+		{irc.RplBounce, "RPL_BOUNCE"},
+		{irc.RplLuserOp, "RPL_LUSEROP"},
+		{irc.ErrCannotSendToChan, "ERR_CANNOTSENDTOCHAN"},
+		{irc.ErrNicknameInUse, "ERR_NICKNAMEINUSE"},
+	}
+
+	for _, tc := range tests {
+		if got := tc.numeric.Name(); got != tc.want {
+			t.Errorf("IRCMessageType(%d).Name() = %q, want %q", tc.numeric.Int(), got, tc.want)
+		}
+	}
+}
+
+func TestString(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		numeric irc.IRCMessageType
+		want    string
+	}{
+		{irc.RplWelcome, "RPL_WELCOME <001>"},
+		{irc.RplBounce, "RPL_BOUNCE <005>"},
+		{irc.RplLuserOp, "RPL_LUSEROP <252>"},
+		{irc.ErrCannotSendToChan, "ERR_CANNOTSENDTOCHAN <404>"},
+	}
+
+	for _, tc := range tests {
+		if got := tc.numeric.String(); got != tc.want {
+			t.Errorf("IRCMessageType(%d).String() = %q, want %q", tc.numeric.Int(), got, tc.want)
+		}
+	}
+}
+
+func TestCode(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		numeric irc.IRCMessageType
+		want    string
+	}{
+		{irc.RplWelcome, "001"},
+		{irc.RplBounce, "005"},
+		{irc.RplLuserOp, "252"},
+		{irc.ErrCannotSendToChan, "404"},
+	}
+
+	for _, tc := range tests {
+		if got := tc.numeric.Code(); got != tc.want {
+			t.Errorf("IRCMessageType(%d).Code() = %q, want %q", tc.numeric.Int(), got, tc.want)
+		}
+	}
+}
+
+func TestInt(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		numeric irc.IRCMessageType
+		want    int
+	}{
+		{irc.RplWelcome, 1},
+		{irc.RplBounce, 5},
+		{irc.RplLuserOp, 252},
+		{irc.ErrCannotSendToChan, 404},
+	}
+
+	for _, tc := range tests {
+		if got := tc.numeric.Int(); got != tc.want {
+			t.Errorf("IRCMessageType(%d).Int() = %d, want %d", tc.want, got, tc.want)
+		}
+	}
+}
+
+func TestFromInt_Known(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		code int
+		want irc.IRCMessageType
+	}{
+		{1, irc.RplWelcome},
+		{5, irc.RplBounce},
+		{252, irc.RplLuserOp},
+		{404, irc.ErrCannotSendToChan},
+		{433, irc.ErrNicknameInUse},
+	}
+
+	for _, test := range tests {
+		got, err := irc.FromInt(test.code)
+		if err != nil {
+			t.Errorf("FromInt(%d) returned unexpected error: %v", test.code, err)
+
+			continue
+		}
+
+		if got != test.want {
+			t.Errorf("FromInt(%d) = %v, want %v", test.code, got, test.want)
+		}
+	}
+}
+
+func TestFromInt_Unknown(t *testing.T) {
+	t.Parallel()
+
+	unknowns := []int{0, 999, 600, -1}
+	for _, code := range unknowns {
+		_, err := irc.FromInt(code)
+		if err == nil {
+			t.Errorf("FromInt(%d) expected error, got nil", code)
+
+			continue
+		}
+
+		if !errors.Is(err, irc.ErrUnknownNumeric) {
+			t.Errorf("FromInt(%d) error = %v, want ErrUnknownNumeric", code, err)
+		}
+	}
+}
+
+func TestUnknownNumeric_Name(t *testing.T) {
+	t.Parallel()
+
+	unknown := irc.IRCMessageType(999)
+	if got := unknown.Name(); got != "" {
+		t.Errorf("IRCMessageType(999).Name() = %q, want empty string", got)
+	}
+}
+
+func TestUnknownNumeric_String(t *testing.T) {
+	t.Parallel()
+
+	unknown := irc.IRCMessageType(999)
+	want := "UNKNOWN <999>"
+
+	if got := unknown.String(); got != want {
+		t.Errorf("IRCMessageType(999).String() = %q, want %q", got, want)
+	}
+}
+
+func TestDeprecatedNameFunc(t *testing.T) {
+	t.Parallel()
+
+	if got := irc.Name(irc.RplYourHost); got != "RPL_YOURHOST" {
+		t.Errorf("Name(RplYourHost) = %q, want %q", got, "RPL_YOURHOST")
+	}
+}

web/src/app.jsx

@@ -8,6 +8,56 @@ const MEMBER_REFRESH_INTERVAL = 10000;
 const ACTION_PREFIX = "\x01ACTION ";
 const ACTION_SUFFIX = "\x01";
 
+// Hashcash proof-of-work helpers using Web Crypto API.
+
+function checkLeadingZeros(hashBytes, bits) {
+  let count = 0;
+  for (let i = 0; i < hashBytes.length; i++) {
+    if (hashBytes[i] === 0) {
+      count += 8;
+      continue;
+    }
+    let b = hashBytes[i];
+    while ((b & 0x80) === 0) {
+      count++;
+      b <<= 1;
+    }
+    break;
+  }
+  return count >= bits;
+}
+
+async function mintHashcash(bits, resource) {
+  const encoder = new TextEncoder();
+  const now = new Date();
+  const date =
+    String(now.getUTCFullYear()).slice(2) +
+    String(now.getUTCMonth() + 1).padStart(2, "0") +
+    String(now.getUTCDate()).padStart(2, "0");
+  const prefix = `1:${bits}:${date}:${resource}::`;
+  let nonce = Math.floor(Math.random() * 0x100000);
+  const batchSize = 1024;
+
+  for (;;) {
+    const stamps = [];
+    const hashPromises = [];
+    for (let i = 0; i < batchSize; i++) {
+      const stamp = prefix + (nonce + i).toString(16);
+      stamps.push(stamp);
+      hashPromises.push(
+        crypto.subtle.digest("SHA-256", encoder.encode(stamp)),
+      );
+    }
+    const hashes = await Promise.all(hashPromises);
+    for (let i = 0; i < hashes.length; i++) {
+      if (checkLeadingZeros(new Uint8Array(hashes[i]), bits)) {
+        return stamps[i];
+      }
+    }
+    nonce += batchSize;
+  }
+}
+
 function api(path, opts = {}) {
   const token = localStorage.getItem("neoirc_token");
   const headers = {
@@ -60,12 +110,16 @@ function LoginScreen({ onLogin }) {
   const [motd, setMotd] = useState("");
   const [serverName, setServerName] = useState("NeoIRC");
   const inputRef = useRef();
+  const hashcashBitsRef = useRef(0);
+  const hashcashResourceRef = useRef("neoirc");
 
   useEffect(() => {
     api("/server")
       .then((s) => {
         if (s.name) setServerName(s.name);
         if (s.motd) setMotd(s.motd);
+        hashcashBitsRef.current = s.hashcash_bits || 0;
+        if (s.name) hashcashResourceRef.current = s.name;
       })
       .catch(() => {});
     const saved = localStorage.getItem("neoirc_token");
@@ -81,9 +135,22 @@ function LoginScreen({ onLogin }) {
     e.preventDefault();
     setError("");
     try {
+      let hashcashStamp = "";
+      if (hashcashBitsRef.current > 0) {
+        setError("Computing proof-of-work...");
+        hashcashStamp = await mintHashcash(
+          hashcashBitsRef.current,
+          hashcashResourceRef.current,
+        );
+        setError("");
+      }
+      const reqBody = { nick: nick.trim() };
+      if (hashcashStamp) {
+        reqBody.pow_token = hashcashStamp;
+      }
       const res = await api("/session", {
         method: "POST",
-        body: JSON.stringify({ nick: nick.trim() }),
+        body: JSON.stringify(reqBody),
       });
       localStorage.setItem("neoirc_token", res.token);
       onLogin(res.nick);