docs: add reverse proxy security note to login rate limiting section

feat: add per-IP rate limiting to login endpoint
Add a token-bucket rate limiter (golang.org/x/time/rate) that limits login attempts per client IP on POST /api/v1/login. Returns 429 Too Many Requests with a Retry-After header when the limit is exceeded. Configurable via LOGIN_RATE_LIMIT (requests/sec, default 1) and LOGIN_RATE_BURST (burst size, default 5). Stale per-IP entries are automatically cleaned up every 10 minutes. Only the login endpoint is rate-limited per sneak's instruction — session creation and registration use hashcash proof-of-work instead.
2026-03-17 04:49:49 -07:00 · 2026-03-17 04:48:46 -07:00
22 changed files with 617 additions and 3448 deletions
--- a/21
+++ b/21
@@ -1,4 +1,4 @@
-.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
+.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks

 BINARY := neoircd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -7,21 +7,10 @@ LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)

 all: check build

-# ensure-web-dist creates placeholder files so //go:embed dist/* in
-# web/embed.go resolves without a full Node.js build.  The real SPA is
-# built by the web-builder Docker stage; these placeholders let
-# "make test" and "make build" work outside Docker.
-ensure-web-dist:
-	@if [ ! -d web/dist ]; then \
-		mkdir -p web/dist && \
-		touch web/dist/index.html web/dist/style.css web/dist/app.js && \
-		echo "==> Created placeholder web/dist/ for go:embed"; \
-	fi
-
-build: ensure-web-dist
+build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/neoircd

-lint: ensure-web-dist
+lint:
 	golangci-lint run --config .golangci.yml ./...

 fmt:
@@ -31,8 +20,8 @@ fmt:
 fmt-check:
 	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)

-test: ensure-web-dist
-	go test -timeout 30s -race -cover ./... || go test -timeout 30s -race -v ./...
+test:
+	go test -timeout 30s -v -race -cover ./...

 # check runs all validation without making changes
 # Used by CI and Docker build — fails if anything is wrong
--- a/README.md
+++ b/README.md
@@ -207,37 +207,6 @@ removal. Identity verification at the message layer via cryptographic
 signatures (see [Security Model](#security-model)) remains independent
 of account registration.

-### Hostmask (nick!user@host)
-
-Each session has an IRC-style hostmask composed of three parts:
-
- **nick** — the user's current nick (changes with `NICK` command)
- **username** — an ident-like identifier set at session creation (optional
-  `username` field in the session/register request; defaults to the nick)
- **hostname** — automatically resolved via reverse DNS of the connecting
-  client's IP address at session creation time
- **ip** — the real IP address of the session creator, extracted from
-  `X-Forwarded-For`, `X-Real-IP`, or `RemoteAddr`
-
-Each **client connection** (created at session creation, registration, or login)
-also stores its own **ip** and **hostname**, allowing the server to track the
-network origin of each individual client independently from the session.
-Client-level IP and hostname are **not displayed to regular users**. They are
-only visible to **server operators** (o-line) via `RPL_WHOISACTUALLY` (338)
-when the oper performs a WHOIS on a user.
-
-The hostmask appears in:
-
- **WHOIS** (`311 RPL_WHOISUSER`) — `params` contains
-  `[nick, username, hostname, "*"]`
- **WHOIS (oper-only)** (`338 RPL_WHOISACTUALLY`) — when the querier is a
-  server operator, includes the target's current client IP and hostname
- **WHO** (`352 RPL_WHOREPLY`) — `params` contains
-  `[channel, username, hostname, server, nick, flags]`
-
-The hostmask format (`nick!user@host`) is stored for future use in ban matching
-(`+b` mode) and other access control features.
-
 ### Nick Semantics

 - Nicks are **unique per server at any point in time** — two sessions cannot
@@ -332,8 +301,8 @@ The server implements HTTP long-polling for real-time message delivery:
   - The client disconnects (connection closed, no response needed)

 **Implementation detail:** The server maintains an in-memory broker with
-per-client notification channels. When a message is enqueued for a client, the
-broker closes all waiting channels for that client, waking up any blocked
+per-user notification channels. When a message is enqueued for a user, the
+broker closes all waiting channels for that user, waking up any blocked
 long-poll handlers. This is O(1) notification — no polling loops, no database
 scanning.

@@ -491,28 +460,28 @@ The entire read/write loop for a client is two endpoints. Everything else
              │              │              │
    ┌─────────▼──┐  ┌───────▼────┐  ┌──────▼─────┐
    │client_queue│  │client_queue│  │client_queue│
-    │ client_id=1│  │ client_id=2│  │ client_id=3│
+    │ user_id=1  │  │ user_id=2  │  │ user_id=3  │
    │ msg_id=N   │  │ msg_id=N   │  │ msg_id=N   │
    └────────────┘  └────────────┘  └────────────┘
         alice           bob             carol

-Each message is stored ONCE. One queue entry per recipient client.
+Each message is stored ONCE. One queue entry per recipient.
 ```

-The `client_queues` table contains `(client_id, message_id)` pairs. When a
+The `client_queues` table contains `(user_id, message_id)` pairs. When a
 client polls with `GET /messages?after=<queue_id>`, the server queries for
-queue entries with `id > after` for that client, joins against the messages
+queue entries with `id > after` for that user, joins against the messages
 table, and returns the results. The `queue_id` (auto-incrementing primary
 key of `client_queues`) serves as a monotonically increasing cursor.

 ### In-Memory Broker

 The server maintains an in-memory notification broker to avoid database
-polling. The broker is a map of `client_id → []chan struct{}`. When a message
-is enqueued for a client:
+polling. The broker is a map of `user_id → []chan struct{}`. When a message
+is enqueued for a user:

-1. The handler calls `broker.Notify(clientID)`
-2. The broker closes all waiting channels for that client
+1. The handler calls `broker.Notify(userID)`
+2. The broker closes all waiting channels for that user
 3. Any goroutines blocked in `select` on those channels wake up
 4. The woken handler queries the database for new queue entries
 5. Messages are returned to the client
@@ -554,7 +523,7 @@ the same JSON envelope:
 | `params`  | array of strings    | Sometimes | Sometimes | Additional IRC-style positional parameters. Used by commands like `MODE`, `KICK`, and numeric replies like `353` (NAMES). |
 | `body`    | array or object     | Usually   | Usually   | Structured message body. For text messages: array of strings (one per line). For structured data (e.g., `PUBKEY`): JSON object. **Never a raw string.** |
 | `ts`      | string (ISO 8601)   | Ignored   | Always    | Server-assigned timestamp in RFC 3339 / ISO 8601 format with nanosecond precision. Example: `"2026-02-10T20:00:00.000000000Z"`. Always UTC. |
-| `meta`    | object              | Optional  | If present | Extensible metadata. Used for cryptographic signatures (`meta.sig`, `meta.alg`), hashcash proof-of-work (`meta.hashcash`), content hashes, or any client-defined key/value pairs. Server relays `meta` verbatim except for `hashcash` which is validated on channels with `+H` mode. |
+| `meta`    | object              | Optional  | If present | Extensible metadata. Used for cryptographic signatures (`meta.sig`, `meta.alg`), content hashes, or any client-defined key/value pairs. Server relays `meta` verbatim — it does not interpret or validate it. |

 **Important invariants:**

@@ -914,12 +883,7 @@ for each channel followed by RPL_LISTEND (323).
 #### WHOIS — User Information

 Query information about a user. Returns RPL_WHOISUSER (311),
-RPL_WHOISSERVER (312), RPL_WHOISOPERATOR (313, if target is oper),
-RPL_WHOISIDLE (317), RPL_WHOISCHANNELS (319), and RPL_ENDOFWHOIS (318).
-
-If the querying user is a **server operator** (authenticated via `OPER`),
-the response additionally includes RPL_WHOISACTUALLY (338) with the
-target's current client IP address and hostname.
+RPL_WHOISSERVER (312), RPL_WHOISCHANNELS (319), and RPL_ENDOFWHOIS (318).

 **C2S:**
 ```json
@@ -954,35 +918,6 @@ LUSERS replies are also sent automatically during connection registration.

 **IRC reference:** RFC 1459 §4.3.2

-#### OPER — Gain Server Operator Status
-
-Authenticate as a server operator (o-line). On success, the session gains
-oper privileges, which currently means additional information is visible in
-WHOIS responses (e.g., target user's current client IP and hostname).
-
-**C2S:**
-```json
-{"command": "OPER", "body": ["opername", "operpassword"]}
-```
-
-**S2C (via message queue on success):**
-```json
-{"command": "381", "to": "alice", "body": ["You are now an IRC operator"]}
-```
-
-**Behavior:**
-
- `body[0]` is the operator name, `body[1]` is the operator password.
- The server checks against the configured `NEOIRC_OPER_NAME` and
-  `NEOIRC_OPER_PASSWORD` environment variables.
- On success, the session's `is_oper` flag is set and `381 RPL_YOUREOPER`
-  is returned.
- On failure (wrong credentials or no o-line configured), `491 ERR_NOOPERHOST`
-  is returned.
- Oper status persists for the session lifetime. There is no de-oper command.
-
-**IRC reference:** RFC 1459 §4.1.5
-
 #### KICK — Kick User (Planned)

 Remove a user from a channel.
@@ -1041,26 +976,23 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | `252` | RPL_LUSEROP         | On connect or LUSERS command | `{"command":"252","to":"alice","params":["0"],"body":["operator(s) online"]}` |
 | `254` | RPL_LUSERCHANNELS   | On connect or LUSERS command | `{"command":"254","to":"alice","params":["3"],"body":["channels formed"]}` |
 | `255` | RPL_LUSERME         | On connect or LUSERS command | `{"command":"255","to":"alice","body":["I have 5 clients and 1 servers"]}` |
-| `311` | RPL_WHOISUSER       | In response to WHOIS | `{"command":"311","to":"alice","params":["bob","bobident","host.example.com","*"],"body":["bob"]}` |
+| `311` | RPL_WHOISUSER       | In response to WHOIS | `{"command":"311","to":"alice","params":["bob","bob","neoirc","*"],"body":["bob"]}` |
 | `312` | RPL_WHOISSERVER     | In response to WHOIS | `{"command":"312","to":"alice","params":["bob","neoirc"],"body":["neoirc server"]}` |
-| `313` | RPL_WHOISOPERATOR   | In WHOIS if target is oper | `{"command":"313","to":"alice","params":["bob"],"body":["is an IRC operator"]}` |
 | `315` | RPL_ENDOFWHO        | End of WHO response | `{"command":"315","to":"alice","params":["#general"],"body":["End of /WHO list"]}` |
 | `318` | RPL_ENDOFWHOIS      | End of WHOIS response | `{"command":"318","to":"alice","params":["bob"],"body":["End of /WHOIS list"]}` |
 | `319` | RPL_WHOISCHANNELS   | In response to WHOIS | `{"command":"319","to":"alice","params":["bob"],"body":["#general #dev"]}` |
-| `338` | RPL_WHOISACTUALLY   | In WHOIS when querier is oper | `{"command":"338","to":"alice","params":["bob","192.168.1.1"],"body":["is actually using host client.example.com"]}` |
 | `322` | RPL_LIST            | In response to LIST | `{"command":"322","to":"alice","params":["#general","5"],"body":["General discussion"]}` |
 | `323` | RPL_LISTEND         | End of LIST response | `{"command":"323","to":"alice","body":["End of /LIST"]}` |
 | `324` | RPL_CHANNELMODEIS   | In response to channel MODE query | `{"command":"324","to":"alice","params":["#general","+n"]}` |
 | `329` | RPL_CREATIONTIME    | After channel MODE query | `{"command":"329","to":"alice","params":["#general","1709251200"]}` |
 | `331` | RPL_NOTOPIC         | Channel has no topic (on JOIN) | `{"command":"331","to":"alice","params":["#general"],"body":["No topic is set"]}` |
 | `332` | RPL_TOPIC           | On JOIN or TOPIC query | `{"command":"332","to":"alice","params":["#general"],"body":["Welcome!"]}` |
-| `352` | RPL_WHOREPLY        | In response to WHO | `{"command":"352","to":"alice","params":["#general","bobident","host.example.com","neoirc","bob","H"],"body":["0 bob"]}` |
-| `353` | RPL_NAMREPLY        | On JOIN or NAMES query | `{"command":"353","to":"alice","params":["=","#general"],"body":["op1!op1@host1 alice!alice@host2 bob!bob@host3"]}` |
+| `352` | RPL_WHOREPLY        | In response to WHO | `{"command":"352","to":"alice","params":["#general","bob","neoirc","neoirc","bob","H"],"body":["0 bob"]}` |
+| `353` | RPL_NAMREPLY        | On JOIN or NAMES query | `{"command":"353","to":"alice","params":["=","#general"],"body":["@op1 alice bob +voiced1"]}` |
 | `366` | RPL_ENDOFNAMES      | End of NAMES response | `{"command":"366","to":"alice","params":["#general"],"body":["End of /NAMES list"]}` |
 | `372` | RPL_MOTD            | MOTD line | `{"command":"372","to":"alice","body":["Welcome to the server"]}` |
 | `375` | RPL_MOTDSTART       | Start of MOTD | `{"command":"375","to":"alice","body":["- neoirc-server Message of the Day -"]}` |
 | `376` | RPL_ENDOFMOTD       | End of MOTD | `{"command":"376","to":"alice","body":["End of /MOTD command"]}` |
-| `381` | RPL_YOUREOPER       | Successful OPER auth | `{"command":"381","to":"alice","body":["You are now an IRC operator"]}` |
 | `401` | ERR_NOSUCHNICK      | DM to nonexistent nick | `{"command":"401","to":"alice","params":["bob"],"body":["No such nick/channel"]}` |
 | `403` | ERR_NOSUCHCHANNEL   | Action on nonexistent channel | `{"command":"403","to":"alice","params":["#nope"],"body":["No such channel"]}` |
 | `421` | ERR_UNKNOWNCOMMAND  | Unrecognized command | `{"command":"421","to":"alice","params":["FOO"],"body":["Unknown command"]}` |
@@ -1069,7 +1001,6 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | `442` | ERR_NOTONCHANNEL    | Action on unjoined channel | `{"command":"442","to":"alice","params":["#general"],"body":["You're not on that channel"]}` |
 | `461` | ERR_NEEDMOREPARAMS  | Missing required fields | `{"command":"461","to":"alice","params":["JOIN"],"body":["Not enough parameters"]}` |
 | `482` | ERR_CHANOPRIVSNEEDED | Non-op tries op action | `{"command":"482","to":"alice","params":["#general"],"body":["You're not channel operator"]}` |
-| `491` | ERR_NOOPERHOST      | Failed OPER auth | `{"command":"491","to":"alice","body":["No O-lines for your host"]}` |

 **Note:** Numeric replies are now implemented. All IRC command responses
 (success and error) are delivered as numeric replies through the message queue.
@@ -1082,13 +1013,12 @@ carries IRC-style parameters (e.g., channel name, target nick).
 Inspired by IRC, simplified:

 | Mode | Name         | Meaning |
-|------|----------------|---------|
+|------|--------------|---------|
 | `+i` | Invite-only  | Only invited users can join |
 | `+m` | Moderated    | Only voiced (`+v`) users and operators (`+o`) can send |
 | `+s` | Secret       | Channel hidden from LIST response |
 | `+t` | Topic lock   | Only operators can change the topic |
 | `+n` | No external  | Only channel members can send messages to the channel |
-| `+H` | Hashcash       | Requires proof-of-work for PRIVMSG (parameter: bits, e.g. `+H 20`) |

 **User channel modes (set per-user per-channel):**

@@ -1099,56 +1029,6 @@ Inspired by IRC, simplified:

 **Status:** Channel modes are defined but not yet enforced. The `modes` column
 exists in the channels table but the server does not check modes on actions.
-Exception: `+H` (hashcash) is fully enforced — see below.
-
-### Per-Channel Hashcash (Anti-Spam)
-
-Channels can require hashcash proof-of-work for every `PRIVMSG`. This is an
-anti-spam mechanism: channel operators set a difficulty level, and clients must
-compute a proof-of-work stamp bound to the specific channel and message before
-sending.
-
-**Setting the requirement:**
-
-```
-MODE #channel +H <bits>    — require <bits> leading zero bits (1-40)
-MODE #channel -H           — disable hashcash requirement
-```
-
-**Stamp format:** `1:bits:YYMMDD:channel:bodyhash:counter`
-
- `bits` — difficulty (leading zero bits in SHA-256 hash of the stamp)
- `YYMMDD` — current date (prevents old token reuse)
- `channel` — channel name (prevents cross-channel reuse)
- `bodyhash` — hex-encoded SHA-256 of the message body (binds stamp to message)
- `counter` — hex nonce
-
-**Sending a message to a hashcash-protected channel:**
-
-Include the hashcash stamp in the `meta` field:
-
-```json
-{
-  "command": "PRIVMSG",
-  "to": "#general",
-  "body": ["hello world"],
-  "meta": {
-    "hashcash": "1:20:260317:#general:a1b2c3...bodyhash:1f4a"
-  }
-}
-```
-
-**Server validation:** The server checks that the stamp is well-formed, meets
-the required difficulty, is bound to the correct channel and message body, has a
-recent date, and has not been previously used. Spent stamps are cached for 1
-year to prevent replay attacks.
-
-**Error responses:** If the channel requires hashcash and the stamp is missing,
-invalid, or replayed, the server returns `ERR_CANNOTSENDTOCHAN (404)` with a
-descriptive reason.
-
-**Client minting:** The CLI provides `MintChannelHashcash(bits, channel, body)`
-to compute stamps. Higher bit counts take exponentially longer to compute.

 ---

@@ -1176,20 +1056,14 @@ difficulty is advertised via `GET /api/v1/server` in the `hashcash_bits` field.

 **Request Body:**
 ```json
-{"nick": "alice", "username": "alice", "pow_token": "1:20:260310:neoirc::3a2f1"}
+{"nick": "alice", "pow_token": "1:20:260310:neoirc::3a2f1"}
 ```

 | Field      | Type   | Required    | Constraints |
 |------------|--------|-------------|-------------|
 | `nick`     | string | Yes         | 1–32 characters, must be unique on the server |
-| `username` | string | No          | 1–32 characters, IRC ident-style. Defaults to nick if omitted. |
 | `pow_token` | string | Conditional | Hashcash stamp (required when server has `hashcash_bits` > 0) |

-The `username` field sets the user portion of the IRC hostmask
-(`nick!user@host`). The hostname is automatically resolved via reverse DNS of
-the connecting client's IP address at session creation time. Together these form
-the hostmask used in WHOIS, WHO, and future ban matching (`+b`).
-
 **Response:** `201 Created`
 ```json
 {
@@ -1210,7 +1084,6 @@ the hostmask used in WHOIS, WHO, and future ban matching (`+b`).
 | Status | Error | When |
 |--------|-------|------|
 | 400    | `nick must be 1-32 characters` | Empty or too-long nick |
-| 400    | `invalid username format` | Username doesn't match allowed format |
 | 402    | `hashcash proof-of-work required` | Missing `pow_token` field in request body when hashcash is enabled |
 | 402    | `invalid hashcash stamp: ...` | Stamp fails validation (wrong bits, expired, reused, etc.) |
 | 409    | `nick already taken` | Another active session holds this nick |
@@ -1232,18 +1105,14 @@ remains active.

 **Request Body:**
 ```json
-{"nick": "alice", "username": "alice", "password": "mypassword"}
+{"nick": "alice", "password": "mypassword"}
 ```

 | Field      | Type   | Required | Constraints |
 |------------|--------|----------|-------------|
 | `nick`     | string | Yes      | 1–32 characters, must be unique on the server |
-| `username` | string | No       | 1–32 characters, IRC ident-style. Defaults to nick if omitted. |
 | `password` | string | Yes      | Minimum 8 characters |

-The `username` and hostname (auto-resolved via reverse DNS) form the IRC
-hostmask (`nick!user@host`) shown in WHOIS and WHO responses.
-
 **Response:** `201 Created`
 ```json
 {
@@ -1264,7 +1133,6 @@ hostmask (`nick!user@host`) shown in WHOIS and WHO responses.
 | Status | Error | When |
 |--------|-------|------|
 | 400    | `invalid nick format` | Nick doesn't match allowed format |
-| 400    | `invalid username format` | Username doesn't match allowed format |
 | 400    | `password must be at least 8 characters` | Password too short |
 | 409    | `nick already taken` | Another active session holds this nick |

@@ -1475,7 +1343,6 @@ reference with all required and optional fields.
 | `WHOIS`   | `to` or `body`      |               | 200 OK          |
 | `WHO`     | `to`                |               | 200 OK          |
 | `LUSERS`  |                     |               | 200 OK          |
-| `OPER`    | `body`              |               | 200 OK          |
 | `QUIT`    |                     | `body`        | 200 OK          |
 | `PING`    |                     |               | 200 OK          |

@@ -1504,7 +1371,6 @@ auth tokens (401), and server errors (500).
 | 433     | ERR_NICKNAMEINUSE | NICK target is taken |
 | 442     | ERR_NOTONCHANNEL | Not a member of the target channel |
 | 461     | ERR_NEEDMOREPARAMS | Missing required fields (to, body) |
-| 491     | ERR_NOOPERHOST | Failed OPER authentication |

 **IRC numeric success replies (delivered via message queue):**

@@ -1522,11 +1388,9 @@ auth tokens (401), and server errors (500).
 | 255     | RPL_LUSERME | On connect or LUSERS command |
 | 311     | RPL_WHOISUSER | WHOIS user info |
 | 312     | RPL_WHOISSERVER | WHOIS server info |
-| 313     | RPL_WHOISOPERATOR | WHOIS target is oper |
 | 315     | RPL_ENDOFWHO | End of WHO list |
 | 318     | RPL_ENDOFWHOIS | End of WHOIS list |
 | 319     | RPL_WHOISCHANNELS | WHOIS channels list |
-| 338     | RPL_WHOISACTUALLY | WHOIS client IP (oper-only) |
 | 322     | RPL_LIST | Channel in LIST response |
 | 323     | RPL_LISTEND | End of LIST |
 | 324     | RPL_CHANNELMODEIS | Channel mode query response |
@@ -1539,7 +1403,6 @@ auth tokens (401), and server errors (500).
 | 375     | RPL_MOTDSTART | Start of MOTD |
 | 372     | RPL_MOTD | MOTD line |
 | 376     | RPL_ENDOFMOTD | End of MOTD |
-| 381     | RPL_YOUREOPER | Successful OPER authentication |

 ### GET /api/v1/history — Message History

@@ -2078,18 +1941,12 @@ The database schema is managed via embedded SQL migration files in
 | `id`           | INTEGER  | Primary key (auto-increment) |
 | `uuid`         | TEXT     | Unique session UUID |
 | `nick`         | TEXT     | Unique nick |
-| `username`     | TEXT     | IRC ident/username portion of the hostmask (defaults to nick) |
-| `hostname`     | TEXT     | Reverse DNS hostname of the connecting client IP |
-| `ip`           | TEXT     | Real IP address of the session creator |
-| `is_oper`      | INTEGER  | Server operator (o-line) status (0 = no, 1 = yes) |
 | `password_hash`| TEXT     | bcrypt hash (empty string for anonymous sessions) |
 | `signing_key`  | TEXT     | Public signing key (empty string if unset) |
 | `away_message` | TEXT     | Away message (empty string if not away) |
 | `created_at`   | DATETIME | Session creation time |
 | `last_seen`    | DATETIME | Last API request time |

-Index on `(uuid)`.
-
 #### `clients`
 | Column      | Type     | Description |
 |-------------|----------|-------------|
@@ -2097,33 +1954,27 @@ Index on `(uuid)`.
 | `uuid`      | TEXT     | Unique client UUID |
 | `session_id`| INTEGER  | FK → sessions.id (cascade delete) |
 | `token`     | TEXT     | Unique auth token (SHA-256 hash of 64 hex chars) |
-| `ip`        | TEXT     | Real IP address of this client connection |
-| `hostname`  | TEXT     | Reverse DNS hostname of this client connection |
 | `created_at`| DATETIME | Client creation time |
 | `last_seen` | DATETIME | Last API request time |

-Indexes on `(token)` and `(session_id)`.
-
 #### `channels`
 | Column      | Type     | Description |
-|---------------|----------|-------------|
+|-------------|----------|-------------|
 | `id`        | INTEGER  | Primary key (auto-increment) |
 | `name`      | TEXT     | Unique channel name (e.g., `#general`) |
 | `topic`     | TEXT     | Channel topic (default empty) |
-| `topic_set_by`| TEXT     | Nick of the user who set the topic (default empty) |
-| `topic_set_at`| DATETIME | When the topic was last set |
-| `created_at`  | DATETIME | Channel creation time |
-| `updated_at`  | DATETIME | Last modification time |
+| `created_at`| DATETIME | Channel creation time |
+| `updated_at`| DATETIME | Last modification time |

 #### `channel_members`
 | Column      | Type     | Description |
-|--------------|----------|-------------|
+|-------------|----------|-------------|
 | `id`        | INTEGER  | Primary key (auto-increment) |
-| `channel_id` | INTEGER  | FK → channels.id (cascade delete) |
-| `session_id` | INTEGER  | FK → sessions.id (cascade delete) |
+| `channel_id`| INTEGER  | FK → channels.id |
+| `user_id`   | INTEGER  | FK → users.id |
 | `joined_at` | DATETIME | When the user joined |

-Unique constraint on `(channel_id, session_id)`.
+Unique constraint on `(channel_id, user_id)`.

 #### `messages`
 | Column      | Type     | Description |
@@ -2133,7 +1984,6 @@ Unique constraint on `(channel_id, session_id)`.
 | `command`   | TEXT     | IRC command (`PRIVMSG`, `JOIN`, etc.) |
 | `msg_from`  | TEXT     | Sender nick |
 | `msg_to`    | TEXT     | Target (`#channel` or nick) |
-| `params`    | TEXT     | JSON-encoded IRC-style positional parameters |
 | `body`      | TEXT     | JSON-encoded body (array or object) |
 | `meta`      | TEXT     | JSON-encoded metadata |
 | `created_at`| DATETIME | Server timestamp |
@@ -2144,11 +1994,11 @@ Indexes on `(msg_to, id)` and `(created_at)`.
 | Column      | Type     | Description |
 |-------------|----------|-------------|
 | `id`        | INTEGER  | Primary key (auto-increment). Used as the poll cursor. |
-| `client_id` | INTEGER  | FK → clients.id (cascade delete) |
-| `message_id`| INTEGER  | FK → messages.id (cascade delete) |
+| `user_id`   | INTEGER  | FK → users.id |
+| `message_id`| INTEGER  | FK → messages.id |
 | `created_at`| DATETIME | When the entry was queued |

-Unique constraint on `(client_id, message_id)`. Index on `(client_id, id)`.
+Unique constraint on `(user_id, message_id)`. Index on `(user_id, id)`.

 The `client_queues.id` is the monotonically increasing cursor used by
 `GET /messages?after=<id>`. This is more reliable than timestamps (no clock
@@ -2201,8 +2051,8 @@ directory is also loaded automatically via
 | `METRICS_USERNAME` | string  | `""`                                 | Basic auth username for `/metrics` endpoint. If empty, metrics endpoint is disabled. |
 | `METRICS_PASSWORD` | string  | `""`                                 | Basic auth password for `/metrics` endpoint |
 | `NEOIRC_HASHCASH_BITS` | int | `20`                               | Required hashcash proof-of-work difficulty (leading zero bits in SHA-256) for session creation. Set to `0` to disable. |
-| `NEOIRC_OPER_NAME` | string | `""`                                 | Server operator (o-line) username. Both name and password must be set to enable OPER. |
-| `NEOIRC_OPER_PASSWORD` | string | `""`                              | Server operator (o-line) password. Both name and password must be set to enable OPER. |
+| `LOGIN_RATE_LIMIT` | float   | `1`                                  | Allowed login attempts per second per IP address. |
+| `LOGIN_RATE_BURST`  | int    | `5`                                  | Maximum burst of login attempts per IP before rate limiting kicks in. |
 | `MAINTENANCE_MODE` | bool    | `false`                              | Maintenance mode flag (reserved) |

 ### Example `.env` file
@@ -2607,6 +2457,49 @@ creating one session pays once and keeps their session.
 - **Language-agnostic**: SHA-256 is available in every programming language.
  The proof computation is trivially implementable in any client.

+### Login Rate Limiting
+
+The login endpoint (`POST /api/v1/login`) has per-IP rate limiting to prevent
+brute-force password attacks. This uses a token-bucket algorithm
+(`golang.org/x/time/rate`) with configurable rate and burst.
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `LOGIN_RATE_LIMIT`  | `1`     | Allowed login attempts per second per IP |
+| `LOGIN_RATE_BURST`  | `5`     | Maximum burst of login attempts per IP |
+
+When the limit is exceeded, the server returns **429 Too Many Requests** with a
+`Retry-After: 1` header. Stale per-IP entries are automatically cleaned up
+every 10 minutes.
+
+> **⚠️ Security: Reverse Proxy Required for Production Use**
+>
+> The rate limiter extracts the client IP by checking the `X-Forwarded-For`
+> header first, then `X-Real-IP`, and finally falling back to the TCP
+> `RemoteAddr`. Both `X-Forwarded-For` and `X-Real-IP` are **client-controlled
+> request headers** — any client can set them to arbitrary values.
+>
+> Without a properly configured reverse proxy in front of this server:
+>
+> - An attacker can **bypass rate limiting entirely** by rotating
+>   `X-Forwarded-For` values on each request (each value is treated as a
+>   distinct IP).
+> - An attacker can **deny service to a specific user** by spoofing that user's
+>   IP in the `X-Forwarded-For` header, exhausting their rate limit bucket.
+>
+> **Recommendation:** Always deploy behind a reverse proxy (e.g. nginx, Caddy,
+> Traefik) that strips or overwrites incoming `X-Forwarded-For` and `X-Real-IP`
+> headers with the actual client IP. If running without a reverse proxy, be
+> aware that the rate limiting provides no meaningful protection against a
+> targeted attack.
+
+**Why rate limits here but not on session creation?** Session creation is
+protected by hashcash proof-of-work (stateless, no IP tracking needed). Login
+involves bcrypt password verification against a registered account — a
+fundamentally different threat model where an attacker targets a specific
+account. Per-IP rate limiting is appropriate here because the cost of a wrong
+guess is borne by the server (bcrypt), not the client.
+
 ---

 ## Roadmap
--- a/go.mod
+++ b/go.mod
@@ -16,6 +16,7 @@ require (
 	github.com/spf13/viper v1.21.0
 	go.uber.org/fx v1.24.0
 	golang.org/x/crypto v0.48.0
+	golang.org/x/time v0.6.0
 	modernc.org/sqlite v1.45.0
 )

--- a/go.sum
+++ b/go.sum
@@ -151,6 +151,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
 golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
+golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
--- a/internal/cli/api/hashcash.go
+++ b/internal/cli/api/hashcash.go
@@ -7,8 +7,6 @@ import (
 	"fmt"
 	"math/big"
 	"time"
-
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 )

 const (
@@ -39,23 +37,6 @@ func MintHashcash(bits int, resource string) string {
 	}
 }

-// MintChannelHashcash computes a hashcash stamp bound to
-// a specific channel and message body. The stamp format
-// is 1:bits:YYMMDD:channel:bodyhash:counter where
-// bodyhash is the hex-encoded SHA-256 of the message
-// body bytes. Delegates to the internal/hashcash package.
-func MintChannelHashcash(
-	bits int,
-	channel string,
-	body []byte,
-) string {
-	bodyHash := hashcash.BodyHash(body)
-
-	return hashcash.MintChannelStamp(
-		bits, channel, bodyHash,
-	)
-}
-
 // hasLeadingZeroBits checks if hash has at least numBits
 // leading zero bits.
 func hasLeadingZeroBits(
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -46,8 +46,8 @@ type Config struct {
 	FederationKey      string
 	SessionIdleTimeout string
 	HashcashBits       int
-	OperName           string
-	OperPassword       string
+	LoginRateLimit     float64
+	LoginRateBurst     int
 	params             *Params
 	log                *slog.Logger
 }
@@ -80,8 +80,8 @@ func New(
 	viper.SetDefault("FEDERATION_KEY", "")
 	viper.SetDefault("SESSION_IDLE_TIMEOUT", "720h")
 	viper.SetDefault("NEOIRC_HASHCASH_BITS", "20")
-	viper.SetDefault("NEOIRC_OPER_NAME", "")
-	viper.SetDefault("NEOIRC_OPER_PASSWORD", "")
+	viper.SetDefault("LOGIN_RATE_LIMIT", "1")
+	viper.SetDefault("LOGIN_RATE_BURST", "5")

 	err := viper.ReadInConfig()
 	if err != nil {
@@ -108,8 +108,8 @@ func New(
 		FederationKey:      viper.GetString("FEDERATION_KEY"),
 		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
 		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
-		OperName:           viper.GetString("NEOIRC_OPER_NAME"),
-		OperPassword:       viper.GetString("NEOIRC_OPER_PASSWORD"),
+		LoginRateLimit:     viper.GetFloat64("LOGIN_RATE_LIMIT"),
+		LoginRateBurst:     viper.GetInt("LOGIN_RATE_BURST"),
 		log:                log,
 		params:             &params,
 	}
--- a/internal/db/auth.go
+++ b/internal/db/auth.go
@@ -10,12 +10,7 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )

-//nolint:gochecknoglobals // var so tests can override via SetBcryptCost
-var bcryptCost = bcrypt.DefaultCost
-
-// SetBcryptCost overrides the bcrypt cost.
-// Use bcrypt.MinCost in tests to avoid slow hashing.
-func SetBcryptCost(cost int) { bcryptCost = cost }
+const bcryptCost = bcrypt.DefaultCost

 var errNoPassword = errors.New(
 	"account has no password set",
@@ -25,12 +20,8 @@ var errNoPassword = errors.New(
 // and returns session ID, client ID, and token.
 func (database *Database) RegisterUser(
 	ctx context.Context,
-	nick, password, username, hostname, remoteIP string,
+	nick, password string,
 ) (int64, int64, string, error) {
-	if username == "" {
-		username = nick
-	}
-
 	hash, err := bcrypt.GenerateFromPassword(
 		[]byte(password), bcryptCost,
 	)
@@ -59,11 +50,10 @@ func (database *Database) RegisterUser(

 	res, err := transaction.ExecContext(ctx,
 		`INSERT INTO sessions
-		 (uuid, nick, username, hostname, ip,
-		  password_hash, created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-		sessionUUID, nick, username, hostname,
-		remoteIP, string(hash), now, now)
+		 (uuid, nick, password_hash,
+		  created_at, last_seen)
+		 VALUES (?, ?, ?, ?, ?)`,
+		sessionUUID, nick, string(hash), now, now)
 	if err != nil {
 		_ = transaction.Rollback()

@@ -78,11 +68,10 @@ func (database *Database) RegisterUser(

 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token, ip, hostname,
+		 (uuid, session_id, token,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, tokenHash,
-		remoteIP, hostname, now, now)
+		 VALUES (?, ?, ?, ?, ?)`,
+		clientUUID, sessionID, tokenHash, now, now)
 	if err != nil {
 		_ = transaction.Rollback()

@@ -107,7 +96,7 @@ func (database *Database) RegisterUser(
 // client token.
 func (database *Database) LoginUser(
 	ctx context.Context,
-	nick, password, remoteIP, hostname string,
+	nick, password string,
 ) (int64, int64, string, error) {
 	var (
 		sessionID    int64
@@ -154,11 +143,10 @@ func (database *Database) LoginUser(

 	res, err := database.conn.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token, ip, hostname,
+		 (uuid, session_id, token,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, tokenHash,
-		remoteIP, hostname, now, now)
+		 VALUES (?, ?, ?, ?, ?)`,
+		clientUUID, sessionID, tokenHash, now, now)
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
 			"create login client: %w", err,
--- a/internal/db/auth_test.go
+++ b/internal/db/auth_test.go
@@ -13,7 +13,7 @@ func TestRegisterUser(t *testing.T) {
 	ctx := t.Context()

 	sessionID, clientID, token, err :=
-		database.RegisterUser(ctx, "reguser", "password123", "", "", "")
+		database.RegisterUser(ctx, "reguser", "password123")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -38,69 +38,6 @@ func TestRegisterUser(t *testing.T) {
 	}
 }

-func TestRegisterUserWithUserHost(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, _, _, err := database.RegisterUser(
-		ctx, "reguhost", "password123",
-		"myident", "example.org", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	info, err := database.GetSessionHostInfo(
-		ctx, sessionID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.Username != "myident" {
-		t.Fatalf(
-			"expected myident, got %s", info.Username,
-		)
-	}
-
-	if info.Hostname != "example.org" {
-		t.Fatalf(
-			"expected example.org, got %s",
-			info.Hostname,
-		)
-	}
-}
-
-func TestRegisterUserDefaultUsername(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, _, _, err := database.RegisterUser(
-		ctx, "regdefault", "password123", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	info, err := database.GetSessionHostInfo(
-		ctx, sessionID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.Username != "regdefault" {
-		t.Fatalf(
-			"expected regdefault, got %s",
-			info.Username,
-		)
-	}
-}
-
 func TestRegisterUserDuplicateNick(t *testing.T) {
 	t.Parallel()

@@ -108,7 +45,7 @@ func TestRegisterUserDuplicateNick(t *testing.T) {
 	ctx := t.Context()

 	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "dupnick", "password123", "", "", "")
+		database.RegisterUser(ctx, "dupnick", "password123")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -118,7 +55,7 @@ func TestRegisterUserDuplicateNick(t *testing.T) {
 	_ = regToken

 	dupSID, dupCID, dupToken, dupErr :=
-		database.RegisterUser(ctx, "dupnick", "other12345", "", "", "")
+		database.RegisterUser(ctx, "dupnick", "other12345")
 	if dupErr == nil {
 		t.Fatal("expected error for duplicate nick")
 	}
@@ -135,7 +72,7 @@ func TestLoginUser(t *testing.T) {
 	ctx := t.Context()

 	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "loginuser", "mypassword", "", "", "")
+		database.RegisterUser(ctx, "loginuser", "mypassword")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -145,7 +82,7 @@ func TestLoginUser(t *testing.T) {
 	_ = regToken

 	sessionID, clientID, token, err :=
-		database.LoginUser(ctx, "loginuser", "mypassword", "", "")
+		database.LoginUser(ctx, "loginuser", "mypassword")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -166,83 +103,6 @@ func TestLoginUser(t *testing.T) {
 	}
 }

-func TestLoginUserStoresClientIPHostname(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	regSID, regCID, regToken, err := database.RegisterUser(
-		ctx, "loginipuser", "password123",
-		"", "", "10.0.0.1",
-	)
-
-	_ = regSID
-	_ = regCID
-	_ = regToken
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, clientID, _, err := database.LoginUser(
-		ctx, "loginipuser", "password123",
-		"10.0.0.99", "newhost.example.com",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	clientInfo, err := database.GetClientHostInfo(
-		ctx, clientID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if clientInfo.IP != "10.0.0.99" {
-		t.Fatalf(
-			"expected client IP 10.0.0.99, got %s",
-			clientInfo.IP,
-		)
-	}
-
-	if clientInfo.Hostname != "newhost.example.com" {
-		t.Fatalf(
-			"expected hostname newhost.example.com, got %s",
-			clientInfo.Hostname,
-		)
-	}
-}
-
-func TestRegisterUserStoresSessionIP(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, _, _, err := database.RegisterUser(
-		ctx, "regipuser", "password123",
-		"ident", "host.local", "172.16.0.5",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	info, err := database.GetSessionHostInfo(
-		ctx, sessionID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.IP != "172.16.0.5" {
-		t.Fatalf(
-			"expected session IP 172.16.0.5, got %s",
-			info.IP,
-		)
-	}
-}
-
 func TestLoginUserWrongPassword(t *testing.T) {
 	t.Parallel()

@@ -250,7 +110,7 @@ func TestLoginUserWrongPassword(t *testing.T) {
 	ctx := t.Context()

 	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "wrongpw", "correctpass", "", "", "")
+		database.RegisterUser(ctx, "wrongpw", "correctpass")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -260,7 +120,7 @@ func TestLoginUserWrongPassword(t *testing.T) {
 	_ = regToken

 	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "wrongpw", "wrongpass12", "", "")
+		database.LoginUser(ctx, "wrongpw", "wrongpass12")
 	if loginErr == nil {
 		t.Fatal("expected error for wrong password")
 	}
@@ -278,7 +138,7 @@ func TestLoginUserNoPassword(t *testing.T) {

 	// Create anonymous session (no password).
 	anonSID, anonCID, anonToken, err :=
-		database.CreateSession(ctx, "anon", "", "", "")
+		database.CreateSession(ctx, "anon")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -288,7 +148,7 @@ func TestLoginUserNoPassword(t *testing.T) {
 	_ = anonToken

 	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "anon", "anything1", "", "")
+		database.LoginUser(ctx, "anon", "anything1")
 	if loginErr == nil {
 		t.Fatal(
 			"expected error for login on passwordless account",
@@ -307,7 +167,7 @@ func TestLoginUserNonexistent(t *testing.T) {
 	ctx := t.Context()

 	loginSID, loginCID, loginToken, err :=
-		database.LoginUser(ctx, "ghost", "password123", "", "")
+		database.LoginUser(ctx, "ghost", "password123")
 	if err == nil {
 		t.Fatal("expected error for nonexistent user")
 	}
--- a/internal/db/main_test.go
+++ b/internal/db/main_test.go
@@ -1,14 +0,0 @@
-package db_test
-
-import (
-	"os"
-	"testing"
-
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"golang.org/x/crypto/bcrypt"
-)
-
-func TestMain(m *testing.M) {
-	db.SetBcryptCost(bcrypt.MinCost)
-	os.Exit(m.Run())
-}
--- a/internal/db/queries.go
+++ b/internal/db/queries.go
@@ -74,40 +74,14 @@ type ChannelInfo struct {
 type MemberInfo struct {
 	ID       int64     `json:"id"`
 	Nick     string    `json:"nick"`
-	Username string    `json:"username"`
-	Hostname string    `json:"hostname"`
 	LastSeen time.Time `json:"lastSeen"`
 }

-// Hostmask returns the IRC hostmask in
-// nick!user@host format.
-func (m *MemberInfo) Hostmask() string {
-	return FormatHostmask(m.Nick, m.Username, m.Hostname)
-}
-
-// FormatHostmask formats a nick, username, and hostname
-// into a standard IRC hostmask string (nick!user@host).
-func FormatHostmask(nick, username, hostname string) string {
-	if username == "" {
-		username = nick
-	}
-
-	if hostname == "" {
-		hostname = "*"
-	}
-
-	return nick + "!" + username + "@" + hostname
-}
-
 // CreateSession registers a new session and its first client.
 func (database *Database) CreateSession(
 	ctx context.Context,
-	nick, username, hostname, remoteIP string,
+	nick string,
 ) (int64, int64, string, error) {
-	if username == "" {
-		username = nick
-	}
-
 	sessionUUID := uuid.New().String()
 	clientUUID := uuid.New().String()

@@ -127,11 +101,9 @@ func (database *Database) CreateSession(

 	res, err := transaction.ExecContext(ctx,
 		`INSERT INTO sessions
-		 (uuid, nick, username, hostname, ip,
-		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
-		sessionUUID, nick, username, hostname,
-		remoteIP, now, now)
+		 (uuid, nick, created_at, last_seen)
+		 VALUES (?, ?, ?, ?)`,
+		sessionUUID, nick, now, now)
 	if err != nil {
 		_ = transaction.Rollback()

@@ -146,11 +118,10 @@ func (database *Database) CreateSession(

 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token, ip, hostname,
+		 (uuid, session_id, token,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, tokenHash,
-		remoteIP, hostname, now, now)
+		 VALUES (?, ?, ?, ?, ?)`,
+		clientUUID, sessionID, tokenHash, now, now)
 	if err != nil {
 		_ = transaction.Rollback()

@@ -238,135 +209,6 @@ func (database *Database) GetSessionByNick(
 	return sessionID, nil
 }

-// SessionHostInfo holds the username, hostname, and IP
-// for a session.
-type SessionHostInfo struct {
-	Username string
-	Hostname string
-	IP       string
-}
-
-// GetSessionHostInfo returns the username, hostname,
-// and IP for a session.
-func (database *Database) GetSessionHostInfo(
-	ctx context.Context,
-	sessionID int64,
-) (*SessionHostInfo, error) {
-	var info SessionHostInfo
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		`SELECT username, hostname, ip
-		 FROM sessions WHERE id = ?`,
-		sessionID,
-	).Scan(&info.Username, &info.Hostname, &info.IP)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"get session host info: %w", err,
-		)
-	}
-
-	return &info, nil
-}
-
-// ClientHostInfo holds the IP and hostname for a client.
-type ClientHostInfo struct {
-	IP       string
-	Hostname string
-}
-
-// GetClientHostInfo returns the IP and hostname for a
-// client.
-func (database *Database) GetClientHostInfo(
-	ctx context.Context,
-	clientID int64,
-) (*ClientHostInfo, error) {
-	var info ClientHostInfo
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		`SELECT ip, hostname
-		 FROM clients WHERE id = ?`,
-		clientID,
-	).Scan(&info.IP, &info.Hostname)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"get client host info: %w", err,
-		)
-	}
-
-	return &info, nil
-}
-
-// SetSessionOper sets the is_oper flag on a session.
-func (database *Database) SetSessionOper(
-	ctx context.Context,
-	sessionID int64,
-	isOper bool,
-) error {
-	val := 0
-	if isOper {
-		val = 1
-	}
-
-	_, err := database.conn.ExecContext(
-		ctx,
-		`UPDATE sessions SET is_oper = ? WHERE id = ?`,
-		val, sessionID,
-	)
-	if err != nil {
-		return fmt.Errorf("set session oper: %w", err)
-	}
-
-	return nil
-}
-
-// IsSessionOper returns whether the session has oper
-// status.
-func (database *Database) IsSessionOper(
-	ctx context.Context,
-	sessionID int64,
-) (bool, error) {
-	var isOper int
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		`SELECT is_oper FROM sessions WHERE id = ?`,
-		sessionID,
-	).Scan(&isOper)
-	if err != nil {
-		return false, fmt.Errorf(
-			"check session oper: %w", err,
-		)
-	}
-
-	return isOper != 0, nil
-}
-
-// GetLatestClientForSession returns the IP and hostname
-// of the most recently created client for a session.
-func (database *Database) GetLatestClientForSession(
-	ctx context.Context,
-	sessionID int64,
-) (*ClientHostInfo, error) {
-	var info ClientHostInfo
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		`SELECT ip, hostname FROM clients
-		 WHERE session_id = ?
-		 ORDER BY created_at DESC LIMIT 1`,
-		sessionID,
-	).Scan(&info.IP, &info.Hostname)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"get latest client for session: %w", err,
-		)
-	}
-
-	return &info, nil
-}
-
 // GetChannelByName returns the channel ID for a name.
 func (database *Database) GetChannelByName(
 	ctx context.Context,
@@ -546,8 +388,7 @@ func (database *Database) ChannelMembers(
 	channelID int64,
 ) ([]MemberInfo, error) {
 	rows, err := database.conn.QueryContext(ctx,
-		`SELECT s.id, s.nick, s.username,
-		   s.hostname, s.last_seen
+		`SELECT s.id, s.nick, s.last_seen
 		 FROM sessions s
 		 INNER JOIN channel_members cm
 		   ON cm.session_id = s.id
@@ -567,9 +408,7 @@ func (database *Database) ChannelMembers(
 		var member MemberInfo

 		err = rows.Scan(
-			&member.ID, &member.Nick,
-			&member.Username, &member.Hostname,
-			&member.LastSeen,
+			&member.ID, &member.Nick, &member.LastSeen,
 		)
 		if err != nil {
 			return nil, fmt.Errorf(
@@ -1020,26 +859,6 @@ func (database *Database) GetUserCount(
 	return count, nil
 }

-// GetOperCount returns the number of sessions with oper
-// status.
-func (database *Database) GetOperCount(
-	ctx context.Context,
-) (int64, error) {
-	var count int64
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		"SELECT COUNT(*) FROM sessions WHERE is_oper = 1",
-	).Scan(&count)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"get oper count: %w", err,
-		)
-	}
-
-	return count, nil
-}
-
 // ClientCountForSession returns the number of clients
 // belonging to a session.
 func (database *Database) ClientCountForSession(
@@ -1486,110 +1305,3 @@ func (database *Database) GetQueueEntryCount(

 	return count, nil
 }
-
-// GetChannelHashcashBits returns the hashcash difficulty
-// requirement for a channel. Returns 0 if not set.
-func (database *Database) GetChannelHashcashBits(
-	ctx context.Context,
-	channelID int64,
-) (int, error) {
-	var bits int
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		"SELECT hashcash_bits FROM channels WHERE id = ?",
-		channelID,
-	).Scan(&bits)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"get channel hashcash bits: %w", err,
-		)
-	}
-
-	return bits, nil
-}
-
-// SetChannelHashcashBits sets the hashcash difficulty
-// requirement for a channel. A value of 0 disables the
-// requirement.
-func (database *Database) SetChannelHashcashBits(
-	ctx context.Context,
-	channelID int64,
-	bits int,
-) error {
-	_, err := database.conn.ExecContext(ctx,
-		`UPDATE channels
-		 SET hashcash_bits = ?, updated_at = ?
-		 WHERE id = ?`,
-		bits, time.Now(), channelID)
-	if err != nil {
-		return fmt.Errorf(
-			"set channel hashcash bits: %w", err,
-		)
-	}
-
-	return nil
-}
-
-// RecordSpentHashcash stores a spent hashcash stamp hash
-// for replay prevention.
-func (database *Database) RecordSpentHashcash(
-	ctx context.Context,
-	stampHash string,
-) error {
-	_, err := database.conn.ExecContext(ctx,
-		`INSERT OR IGNORE INTO spent_hashcash
-		 (stamp_hash, created_at)
-		 VALUES (?, ?)`,
-		stampHash, time.Now())
-	if err != nil {
-		return fmt.Errorf(
-			"record spent hashcash: %w", err,
-		)
-	}
-
-	return nil
-}
-
-// IsHashcashSpent checks whether a hashcash stamp hash
-// has already been used.
-func (database *Database) IsHashcashSpent(
-	ctx context.Context,
-	stampHash string,
-) (bool, error) {
-	var count int
-
-	err := database.conn.QueryRowContext(ctx,
-		`SELECT COUNT(*) FROM spent_hashcash
-		 WHERE stamp_hash = ?`,
-		stampHash,
-	).Scan(&count)
-	if err != nil {
-		return false, fmt.Errorf(
-			"check spent hashcash: %w", err,
-		)
-	}
-
-	return count > 0, nil
-}
-
-// PruneSpentHashcash deletes spent hashcash tokens older
-// than the cutoff and returns the number of rows removed.
-func (database *Database) PruneSpentHashcash(
-	ctx context.Context,
-	cutoff time.Time,
-) (int64, error) {
-	res, err := database.conn.ExecContext(ctx,
-		"DELETE FROM spent_hashcash WHERE created_at < ?",
-		cutoff,
-	)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"prune spent hashcash: %w", err,
-		)
-	}
-
-	deleted, _ := res.RowsAffected()
-
-	return deleted, nil
-}
--- a/internal/db/queries_test.go
+++ b/internal/db/queries_test.go
@@ -34,7 +34,7 @@ func TestCreateSession(t *testing.T) {
 	ctx := t.Context()

 	sessionID, _, token, err := database.CreateSession(
-		ctx, "alice", "", "", "",
+		ctx, "alice",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -45,7 +45,7 @@ func TestCreateSession(t *testing.T) {
 	}

 	_, _, dupToken, dupErr := database.CreateSession(
-		ctx, "alice", "", "", "",
+		ctx, "alice",
 	)
 	if dupErr == nil {
 		t.Fatal("expected error for duplicate nick")
@@ -54,249 +54,13 @@ func TestCreateSession(t *testing.T) {
 	_ = dupToken
 }

-// assertSessionHostInfo creates a session and verifies
-// the stored username and hostname match expectations.
-func assertSessionHostInfo(
-	t *testing.T,
-	database *db.Database,
-	nick, inputUser, inputHost,
-	expectUser, expectHost string,
-) {
-	t.Helper()
-
-	sessionID, _, _, err := database.CreateSession(
-		t.Context(), nick, inputUser, inputHost, "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	info, err := database.GetSessionHostInfo(
-		t.Context(), sessionID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.Username != expectUser {
-		t.Fatalf(
-			"expected username %s, got %s",
-			expectUser, info.Username,
-		)
-	}
-
-	if info.Hostname != expectHost {
-		t.Fatalf(
-			"expected hostname %s, got %s",
-			expectHost, info.Hostname,
-		)
-	}
-}
-
-func TestCreateSessionWithUserHost(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-
-	assertSessionHostInfo(
-		t, database,
-		"hostuser", "myident", "example.com",
-		"myident", "example.com",
-	)
-}
-
-func TestCreateSessionDefaultUsername(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-
-	// Empty username defaults to nick.
-	assertSessionHostInfo(
-		t, database,
-		"defaultu", "", "host.local",
-		"defaultu", "host.local",
-	)
-}
-
-func TestCreateSessionStoresIP(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, clientID, _, err := database.CreateSession(
-		ctx, "ipuser", "ident", "host.example.com",
-		"192.168.1.42",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	info, err := database.GetSessionHostInfo(
-		ctx, sessionID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.IP != "192.168.1.42" {
-		t.Fatalf(
-			"expected session IP 192.168.1.42, got %s",
-			info.IP,
-		)
-	}
-
-	clientInfo, err := database.GetClientHostInfo(
-		ctx, clientID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if clientInfo.IP != "192.168.1.42" {
-		t.Fatalf(
-			"expected client IP 192.168.1.42, got %s",
-			clientInfo.IP,
-		)
-	}
-
-	if clientInfo.Hostname != "host.example.com" {
-		t.Fatalf(
-			"expected client hostname host.example.com, got %s",
-			clientInfo.Hostname,
-		)
-	}
-}
-
-func TestGetClientHostInfoNotFound(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-
-	_, err := database.GetClientHostInfo(
-		t.Context(), 99999,
-	)
-	if err == nil {
-		t.Fatal("expected error for nonexistent client")
-	}
-}
-
-func TestGetSessionHostInfoNotFound(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-
-	_, err := database.GetSessionHostInfo(
-		t.Context(), 99999,
-	)
-	if err == nil {
-		t.Fatal("expected error for nonexistent session")
-	}
-}
-
-func TestFormatHostmask(t *testing.T) {
-	t.Parallel()
-
-	result := db.FormatHostmask(
-		"nick", "user", "host.com",
-	)
-	if result != "nick!user@host.com" {
-		t.Fatalf(
-			"expected nick!user@host.com, got %s",
-			result,
-		)
-	}
-}
-
-func TestFormatHostmaskDefaults(t *testing.T) {
-	t.Parallel()
-
-	result := db.FormatHostmask("nick", "", "")
-	if result != "nick!nick@*" {
-		t.Fatalf(
-			"expected nick!nick@*, got %s",
-			result,
-		)
-	}
-}
-
-func TestMemberInfoHostmask(t *testing.T) {
-	t.Parallel()
-
-	member := &db.MemberInfo{ //nolint:exhaustruct // test only uses hostmask fields
-		Nick:     "alice",
-		Username: "aliceident",
-		Hostname: "alice.example.com",
-	}
-
-	hostmask := member.Hostmask()
-	expected := "alice!aliceident@alice.example.com"
-
-	if hostmask != expected {
-		t.Fatalf(
-			"expected %s, got %s", expected, hostmask,
-		)
-	}
-}
-
-func TestChannelMembersIncludeUserHost(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sid, _, _, err := database.CreateSession(
-		ctx, "memuser", "myuser", "myhost.net", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chID, err := database.GetOrCreateChannel(
-		ctx, "#hostchan",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = database.JoinChannel(ctx, chID, sid)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	members, err := database.ChannelMembers(ctx, chID)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(members) != 1 {
-		t.Fatalf(
-			"expected 1 member, got %d", len(members),
-		)
-	}
-
-	if members[0].Username != "myuser" {
-		t.Fatalf(
-			"expected username myuser, got %s",
-			members[0].Username,
-		)
-	}
-
-	if members[0].Hostname != "myhost.net" {
-		t.Fatalf(
-			"expected hostname myhost.net, got %s",
-			members[0].Hostname,
-		)
-	}
-}
-
 func TestGetSessionByToken(t *testing.T) {
 	t.Parallel()

 	database := setupTestDB(t)
 	ctx := t.Context()

-	_, _, token, err := database.CreateSession(ctx, "bob", "", "", "")
+	_, _, token, err := database.CreateSession(ctx, "bob")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -329,7 +93,7 @@ func TestGetSessionByNick(t *testing.T) {
 	ctx := t.Context()

 	charlieID, charlieClientID, charlieToken, err :=
-		database.CreateSession(ctx, "charlie", "", "", "")
+		database.CreateSession(ctx, "charlie")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -386,7 +150,7 @@ func TestJoinAndPart(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()

-	sid, _, _, err := database.CreateSession(ctx, "user1", "", "", "")
+	sid, _, _, err := database.CreateSession(ctx, "user1")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -435,7 +199,7 @@ func TestDeleteChannelIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}

-	sid, _, _, err := database.CreateSession(ctx, "temp", "", "", "")
+	sid, _, _, err := database.CreateSession(ctx, "temp")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -470,7 +234,7 @@ func createSessionWithChannels(

 	ctx := t.Context()

-	sid, _, _, err := database.CreateSession(ctx, nick, "", "", "")
+	sid, _, _, err := database.CreateSession(ctx, nick)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -553,7 +317,7 @@ func TestChangeNick(t *testing.T) {
 	ctx := t.Context()

 	sid, _, token, err := database.CreateSession(
-		ctx, "old", "", "", "",
+		ctx, "old",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -637,7 +401,7 @@ func TestPollMessages(t *testing.T) {
 	ctx := t.Context()

 	sid, _, token, err := database.CreateSession(
-		ctx, "poller", "", "", "",
+		ctx, "poller",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -744,7 +508,7 @@ func TestDeleteSession(t *testing.T) {
 	ctx := t.Context()

 	sid, _, _, err := database.CreateSession(
-		ctx, "deleteme", "", "", "",
+		ctx, "deleteme",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -784,12 +548,12 @@ func TestChannelMembers(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()

-	sid1, _, _, err := database.CreateSession(ctx, "m1", "", "", "")
+	sid1, _, _, err := database.CreateSession(ctx, "m1")
 	if err != nil {
 		t.Fatal(err)
 	}

-	sid2, _, _, err := database.CreateSession(ctx, "m2", "", "", "")
+	sid2, _, _, err := database.CreateSession(ctx, "m2")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -847,7 +611,7 @@ func TestEnqueueToClient(t *testing.T) {
 	ctx := t.Context()

 	_, _, token, err := database.CreateSession(
-		ctx, "enqclient", "", "", "",
+		ctx, "enqclient",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -887,133 +651,3 @@ func TestEnqueueToClient(t *testing.T) {
 		t.Fatalf("expected 1, got %d", len(msgs))
 	}
 }
-
-func TestSetAndCheckSessionOper(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, _, _, err := database.CreateSession(
-		ctx, "opernick", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Initially not oper.
-	isOper, err := database.IsSessionOper(ctx, sessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if isOper {
-		t.Fatal("expected session not to be oper")
-	}
-
-	// Set oper.
-	err = database.SetSessionOper(ctx, sessionID, true)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	isOper, err = database.IsSessionOper(ctx, sessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !isOper {
-		t.Fatal("expected session to be oper")
-	}
-
-	// Unset oper.
-	err = database.SetSessionOper(ctx, sessionID, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	isOper, err = database.IsSessionOper(ctx, sessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if isOper {
-		t.Fatal("expected session not to be oper")
-	}
-}
-
-func TestGetLatestClientForSession(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, _, _, err := database.CreateSession(
-		ctx, "clientnick", "", "", "10.0.0.1",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	clientInfo, err := database.GetLatestClientForSession(
-		ctx, sessionID,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if clientInfo.IP != "10.0.0.1" {
-		t.Fatalf(
-			"expected IP 10.0.0.1, got %s",
-			clientInfo.IP,
-		)
-	}
-}
-
-func TestGetOperCount(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	// Create two sessions.
-	sid1, _, _, err := database.CreateSession(
-		ctx, "user1", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	sid2, _, _, err := database.CreateSession(
-		ctx, "user2", "", "", "",
-	)
-	_ = sid2
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Initially zero opers.
-	count, err := database.GetOperCount(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if count != 0 {
-		t.Fatalf("expected 0 opers, got %d", count)
-	}
-
-	// Set one as oper.
-	err = database.SetSessionOper(ctx, sid1, true)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	count, err = database.GetOperCount(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if count != 1 {
-		t.Fatalf("expected 1 oper, got %d", count)
-	}
-}
--- a/internal/db/schema/001_initial.sql
+++ b/internal/db/schema/001_initial.sql
@@ -6,10 +6,6 @@ CREATE TABLE IF NOT EXISTS sessions (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    uuid TEXT NOT NULL UNIQUE,
    nick TEXT NOT NULL UNIQUE,
-    username TEXT NOT NULL DEFAULT '',
-    hostname TEXT NOT NULL DEFAULT '',
-    ip TEXT NOT NULL DEFAULT '',
-    is_oper INTEGER NOT NULL DEFAULT 0,
    password_hash TEXT NOT NULL DEFAULT '',
    signing_key TEXT NOT NULL DEFAULT '',
    away_message TEXT NOT NULL DEFAULT '',
@@ -24,8 +20,6 @@ CREATE TABLE IF NOT EXISTS clients (
    uuid TEXT NOT NULL UNIQUE,
    session_id INTEGER NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
    token TEXT NOT NULL UNIQUE,
-    ip TEXT NOT NULL DEFAULT '',
-    hostname TEXT NOT NULL DEFAULT '',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    last_seen DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -39,7 +33,6 @@ CREATE TABLE IF NOT EXISTS channels (
    topic TEXT NOT NULL DEFAULT '',
    topic_set_by TEXT NOT NULL DEFAULT '',
    topic_set_at DATETIME,
-    hashcash_bits INTEGER NOT NULL DEFAULT 0,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -68,14 +61,6 @@ CREATE TABLE IF NOT EXISTS messages (
 CREATE INDEX IF NOT EXISTS idx_messages_to_id ON messages(msg_to, id);
 CREATE INDEX IF NOT EXISTS idx_messages_created ON messages(created_at);

-- Spent hashcash tokens for replay prevention (1-year TTL)
-CREATE TABLE IF NOT EXISTS spent_hashcash (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    stamp_hash TEXT NOT NULL UNIQUE,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-CREATE INDEX IF NOT EXISTS idx_spent_hashcash_created ON spent_hashcash(created_at);
-
 -- Per-client message queues for fan-out delivery
 CREATE TABLE IF NOT EXISTS client_queues (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
--- a/internal/handlers/api.go
+++ b/internal/handlers/api.go
--- a/internal/handlers/api_test.go
+++ b/internal/handlers/api_test.go
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -2,6 +2,7 @@ package handlers

 import (
 	"encoding/json"
+	"net"
 	"net/http"
 	"strings"

@@ -10,6 +11,33 @@ import (

 const minPasswordLength = 8

+// clientIP extracts the client IP address from the request.
+// It checks X-Forwarded-For and X-Real-IP headers before
+// falling back to RemoteAddr.
+func clientIP(request *http.Request) string {
+	if forwarded := request.Header.Get("X-Forwarded-For"); forwarded != "" {
+		// X-Forwarded-For may contain a comma-separated list;
+		// the first entry is the original client.
+		parts := strings.SplitN(forwarded, ",", 2) //nolint:mnd // split into two parts
+		ip := strings.TrimSpace(parts[0])
+
+		if ip != "" {
+			return ip
+		}
+	}
+
+	if realIP := request.Header.Get("X-Real-IP"); realIP != "" {
+		return strings.TrimSpace(realIP)
+	}
+
+	host, _, err := net.SplitHostPort(request.RemoteAddr)
+	if err != nil {
+		return request.RemoteAddr
+	}
+
+	return host
+}
+
 // HandleRegister creates a new user with a password.
 func (hdlr *Handlers) HandleRegister() http.HandlerFunc {
 	return func(
@@ -30,7 +58,6 @@ func (hdlr *Handlers) handleRegister(
 ) {
 	type registerRequest struct {
 		Nick     string `json:"nick"`
-		Username string `json:"username,omitempty"`
 		Password string `json:"password"`
 	}

@@ -59,20 +86,6 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}

-	username := resolveUsername(
-		payload.Username, payload.Nick,
-	)
-
-	if !validUsernameRe.MatchString(username) {
-		hdlr.respondError(
-			writer, request,
-			"invalid username format",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
 	if len(payload.Password) < minPasswordLength {
 		hdlr.respondError(
 			writer, request,
@@ -83,27 +96,11 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}

-	hdlr.executeRegister(
-		writer, request,
-		payload.Nick, payload.Password, username,
-	)
-}
-
-func (hdlr *Handlers) executeRegister(
-	writer http.ResponseWriter,
-	request *http.Request,
-	nick, password, username string,
-) {
-	remoteIP := clientIP(request)
-
-	hostname := resolveHostname(
-		request.Context(), remoteIP,
-	)
-
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.RegisterUser(
 			request.Context(),
-			nick, password, username, hostname, remoteIP,
+			payload.Nick,
+			payload.Password,
 		)
 	if err != nil {
 		hdlr.handleRegisterError(
@@ -116,11 +113,11 @@ func (hdlr *Handlers) executeRegister(
 	hdlr.stats.IncrSessions()
 	hdlr.stats.IncrConnections()

-	hdlr.deliverMOTD(request, clientID, sessionID, nick)
+	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)

 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
-		"nick":  nick,
+		"nick":  payload.Nick,
 		"token": token,
 	}, http.StatusCreated)
 }
@@ -168,6 +165,21 @@ func (hdlr *Handlers) handleLogin(
 	writer http.ResponseWriter,
 	request *http.Request,
 ) {
+	ip := clientIP(request)
+
+	if !hdlr.loginLimiter.Allow(ip) {
+		writer.Header().Set(
+			"Retry-After", "1",
+		)
+		hdlr.respondError(
+			writer, request,
+			"too many login attempts, try again later",
+			http.StatusTooManyRequests,
+		)
+
+		return
+	}
+
 	type loginRequest struct {
 		Nick     string `json:"nick"`
 		Password string `json:"password"`
@@ -198,18 +210,11 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}

-	remoteIP := clientIP(request)
-
-	hostname := resolveHostname(
-		request.Context(), remoteIP,
-	)
-
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.LoginUser(
 			request.Context(),
 			payload.Nick,
 			payload.Password,
-			remoteIP, hostname,
 		)
 	if err != nil {
 		hdlr.respondError(
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -16,6 +16,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -36,11 +37,6 @@ type Params struct {

 const defaultIdleTimeout = 30 * 24 * time.Hour

-// spentHashcashTTL is how long spent hashcash tokens are
-// retained for replay prevention. Per issue requirements,
-// this is 1 year.
-const spentHashcashTTL = 365 * 24 * time.Hour
-
 // Handlers manages HTTP request handling.
 type Handlers struct {
 	params        *Params
@@ -48,7 +44,7 @@ type Handlers struct {
 	hc            *healthcheck.Healthcheck
 	broker        *broker.Broker
 	hashcashVal   *hashcash.Validator
-	channelHashcash *hashcash.ChannelValidator
+	loginLimiter  *ratelimit.Limiter
 	stats         *stats.Tracker
 	cancelCleanup context.CancelFunc
 }
@@ -63,13 +59,23 @@ func New(
 		resource = "neoirc"
 	}

+	loginRate := params.Config.LoginRateLimit
+	if loginRate <= 0 {
+		loginRate = ratelimit.DefaultRate
+	}
+
+	loginBurst := params.Config.LoginRateBurst
+	if loginBurst <= 0 {
+		loginBurst = ratelimit.DefaultBurst
+	}
+
 	hdlr := &Handlers{ //nolint:exhaustruct // cancelCleanup set in startCleanup
 		params:       &params,
 		log:          params.Logger.Get(),
 		hc:           params.Healthcheck,
 		broker:       broker.New(),
 		hashcashVal:  hashcash.NewValidator(resource),
-		channelHashcash: hashcash.NewChannelValidator(),
+		loginLimiter: ratelimit.New(loginRate, loginBurst),
 		stats:        params.Stats,
 	}

@@ -162,6 +168,10 @@ func (hdlr *Handlers) stopCleanup() {
 	if hdlr.cancelCleanup != nil {
 		hdlr.cancelCleanup()
 	}
+
+	if hdlr.loginLimiter != nil {
+		hdlr.loginLimiter.Stop()
+	}
 }

 func (hdlr *Handlers) cleanupLoop(ctx context.Context) {
@@ -292,20 +302,4 @@ func (hdlr *Handlers) pruneQueuesAndMessages(
 			)
 		}
 	}
-
-	// Prune spent hashcash tokens older than 1 year.
-	hashcashCutoff := time.Now().Add(-spentHashcashTTL)
-
-	pruned, err := hdlr.params.Database.
-		PruneSpentHashcash(ctx, hashcashCutoff)
-	if err != nil {
-		hdlr.log.Error(
-			"spent hashcash pruning failed", "error", err,
-		)
-	} else if pruned > 0 {
-		hdlr.log.Info(
-			"pruned spent hashcash tokens",
-			"deleted", pruned,
-		)
-	}
 }
--- a/internal/hashcash/channel.go
+++ b/internal/hashcash/channel.go
@@ -1,186 +0,0 @@
-package hashcash
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-)
-
-var (
-	errBodyHashMismatch = errors.New(
-		"body hash mismatch",
-	)
-	errBodyHashMissing = errors.New(
-		"body hash missing",
-	)
-)
-
-// ChannelValidator checks hashcash stamps for
-// per-channel PRIVMSG validation. It verifies that
-// stamps are bound to a specific channel and message
-// body. Replay prevention is handled externally via
-// the database spent_hashcash table for persistence
-// across server restarts (1-year TTL).
-type ChannelValidator struct{}
-
-// NewChannelValidator creates a ChannelValidator.
-func NewChannelValidator() *ChannelValidator {
-	return &ChannelValidator{}
-}
-
-// BodyHash computes the hex-encoded SHA-256 hash of a
-// message body for use in hashcash stamp validation.
-func BodyHash(body []byte) string {
-	hash := sha256.Sum256(body)
-
-	return hex.EncodeToString(hash[:])
-}
-
-// ValidateStamp checks a channel hashcash stamp. It
-// verifies the stamp format, difficulty, date, channel
-// binding, body hash binding, and proof-of-work. Replay
-// detection is NOT performed here — callers must check
-// the spent_hashcash table separately.
-//
-// Stamp format: 1:bits:YYMMDD:channel:bodyhash:counter.
-func (cv *ChannelValidator) ValidateStamp(
-	stamp string,
-	requiredBits int,
-	channel string,
-	bodyHash string,
-) error {
-	if requiredBits <= 0 {
-		return nil
-	}
-
-	parts := strings.Split(stamp, ":")
-	if len(parts) != stampFields {
-		return fmt.Errorf(
-			"%w: expected %d, got %d",
-			errInvalidFields, stampFields, len(parts),
-		)
-	}
-
-	version := parts[0]
-	bitsStr := parts[1]
-	dateStr := parts[2]
-	resource := parts[3]
-	stampBodyHash := parts[4]
-
-	headerErr := validateChannelHeader(
-		version, bitsStr, resource,
-		requiredBits, channel,
-	)
-	if headerErr != nil {
-		return headerErr
-	}
-
-	stampTime, parseErr := parseStampDate(dateStr)
-	if parseErr != nil {
-		return parseErr
-	}
-
-	timeErr := validateTime(stampTime)
-	if timeErr != nil {
-		return timeErr
-	}
-
-	bodyErr := validateBodyHash(
-		stampBodyHash, bodyHash,
-	)
-	if bodyErr != nil {
-		return bodyErr
-	}
-
-	return validateProof(stamp, requiredBits)
-}
-
-// StampHash returns a deterministic hash of a stamp
-// string for use as a spent-token key.
-func StampHash(stamp string) string {
-	hash := sha256.Sum256([]byte(stamp))
-
-	return hex.EncodeToString(hash[:])
-}
-
-func validateChannelHeader(
-	version, bitsStr, resource string,
-	requiredBits int,
-	channel string,
-) error {
-	if version != stampVersion {
-		return fmt.Errorf(
-			"%w: %s", errBadVersion, version,
-		)
-	}
-
-	claimedBits, err := strconv.Atoi(bitsStr)
-	if err != nil || claimedBits < requiredBits {
-		return fmt.Errorf(
-			"%w: need %d bits",
-			errInsufficientBits, requiredBits,
-		)
-	}
-
-	if resource != channel {
-		return fmt.Errorf(
-			"%w: got %q, want %q",
-			errWrongResource, resource, channel,
-		)
-	}
-
-	return nil
-}
-
-func validateBodyHash(
-	stampBodyHash, expectedBodyHash string,
-) error {
-	if stampBodyHash == "" {
-		return errBodyHashMissing
-	}
-
-	if stampBodyHash != expectedBodyHash {
-		return fmt.Errorf(
-			"%w: got %q, want %q",
-			errBodyHashMismatch,
-			stampBodyHash, expectedBodyHash,
-		)
-	}
-
-	return nil
-}
-
-// MintChannelStamp computes a channel hashcash stamp
-// with the given difficulty, channel name, and body hash.
-// This is intended for clients to generate stamps before
-// sending PRIVMSG to hashcash-protected channels.
-//
-// Stamp format: 1:bits:YYMMDD:channel:bodyhash:counter.
-func MintChannelStamp(
-	bits int,
-	channel string,
-	bodyHash string,
-) string {
-	date := time.Now().UTC().Format(dateFormatShort)
-	prefix := fmt.Sprintf(
-		"1:%d:%s:%s:%s:",
-		bits, date, channel, bodyHash,
-	)
-
-	counter := uint64(0)
-
-	for {
-		stamp := prefix + strconv.FormatUint(counter, 16)
-		hash := sha256.Sum256([]byte(stamp))
-
-		if hasLeadingZeroBits(hash[:], bits) {
-			return stamp
-		}
-
-		counter++
-	}
-}
--- a/internal/hashcash/channel_test.go
+++ b/internal/hashcash/channel_test.go
@@ -1,244 +0,0 @@
-package hashcash_test
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"testing"
-
-	"git.eeqj.de/sneak/neoirc/internal/hashcash"
-)
-
-const (
-	testChannel  = "#general"
-	testBodyText = `["hello world"]`
-)
-
-func testBodyHash() string {
-	hash := sha256.Sum256([]byte(testBodyText))
-
-	return hex.EncodeToString(hash[:])
-}
-
-func TestChannelValidateHappyPath(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	stamp := hashcash.MintChannelStamp(
-		testBits, testChannel, bodyHash,
-	)
-
-	err := validator.ValidateStamp(
-		stamp, testBits, testChannel, bodyHash,
-	)
-	if err != nil {
-		t.Fatalf("valid channel stamp rejected: %v", err)
-	}
-}
-
-func TestChannelValidateWrongChannel(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	stamp := hashcash.MintChannelStamp(
-		testBits, testChannel, bodyHash,
-	)
-
-	err := validator.ValidateStamp(
-		stamp, testBits, "#other", bodyHash,
-	)
-	if err == nil {
-		t.Fatal("expected channel mismatch error")
-	}
-}
-
-func TestChannelValidateWrongBodyHash(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	stamp := hashcash.MintChannelStamp(
-		testBits, testChannel, bodyHash,
-	)
-
-	wrongHash := sha256.Sum256([]byte("different body"))
-	wrongBodyHash := hex.EncodeToString(wrongHash[:])
-
-	err := validator.ValidateStamp(
-		stamp, testBits, testChannel, wrongBodyHash,
-	)
-	if err == nil {
-		t.Fatal("expected body hash mismatch error")
-	}
-}
-
-func TestChannelValidateInsufficientBits(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	// Mint with 2 bits but require 4.
-	stamp := hashcash.MintChannelStamp(
-		testBits, testChannel, bodyHash,
-	)
-
-	err := validator.ValidateStamp(
-		stamp, 4, testChannel, bodyHash,
-	)
-	if err == nil {
-		t.Fatal("expected insufficient bits error")
-	}
-}
-
-func TestChannelValidateZeroBitsSkips(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-
-	err := validator.ValidateStamp(
-		"garbage", 0, "#ch", "abc",
-	)
-	if err != nil {
-		t.Fatalf("zero bits should skip: %v", err)
-	}
-}
-
-func TestChannelValidateBadFormat(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-
-	err := validator.ValidateStamp(
-		"not:valid", testBits, testChannel, "abc",
-	)
-	if err == nil {
-		t.Fatal("expected bad format error")
-	}
-}
-
-func TestChannelValidateBadVersion(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	stamp := "2:2:260317:#general:" + bodyHash + ":counter"
-
-	err := validator.ValidateStamp(
-		stamp, testBits, testChannel, bodyHash,
-	)
-	if err == nil {
-		t.Fatal("expected bad version error")
-	}
-}
-
-func TestChannelValidateExpiredStamp(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	// Mint with a very old date by manually constructing.
-	stamp := mintStampWithDate(
-		t, testBits, testChannel, "200101",
-	)
-
-	err := validator.ValidateStamp(
-		stamp, testBits, testChannel, bodyHash,
-	)
-	if err == nil {
-		t.Fatal("expected expired stamp error")
-	}
-}
-
-func TestChannelValidateMissingBodyHash(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewChannelValidator()
-	bodyHash := testBodyHash()
-
-	// Construct a stamp with empty body hash field.
-	stamp := mintStampWithDate(
-		t, testBits, testChannel, todayDate(),
-	)
-
-	// This uses the session-style stamp which has empty
-	// ext field — body hash is missing.
-	err := validator.ValidateStamp(
-		stamp, testBits, testChannel, bodyHash,
-	)
-	if err == nil {
-		t.Fatal("expected missing body hash error")
-	}
-}
-
-func TestBodyHash(t *testing.T) {
-	t.Parallel()
-
-	body := []byte(`["hello world"]`)
-	bodyHash := hashcash.BodyHash(body)
-
-	if len(bodyHash) != 64 {
-		t.Fatalf(
-			"expected 64-char hex hash, got %d",
-			len(bodyHash),
-		)
-	}
-
-	// Same input should produce same hash.
-	bodyHash2 := hashcash.BodyHash(body)
-	if bodyHash != bodyHash2 {
-		t.Fatal("body hash not deterministic")
-	}
-
-	// Different input should produce different hash.
-	bodyHash3 := hashcash.BodyHash([]byte("different"))
-	if bodyHash == bodyHash3 {
-		t.Fatal("different inputs produced same hash")
-	}
-}
-
-func TestStampHash(t *testing.T) {
-	t.Parallel()
-
-	hash1 := hashcash.StampHash("stamp1")
-	hash2 := hashcash.StampHash("stamp2")
-
-	if hash1 == hash2 {
-		t.Fatal("different stamps produced same hash")
-	}
-
-	// Same input should be deterministic.
-	hash1b := hashcash.StampHash("stamp1")
-	if hash1 != hash1b {
-		t.Fatal("stamp hash not deterministic")
-	}
-}
-
-func TestMintChannelStamp(t *testing.T) {
-	t.Parallel()
-
-	bodyHash := testBodyHash()
-	stamp := hashcash.MintChannelStamp(
-		testBits, testChannel, bodyHash,
-	)
-
-	if stamp == "" {
-		t.Fatal("expected non-empty stamp")
-	}
-
-	// Validate the minted stamp.
-	validator := hashcash.NewChannelValidator()
-
-	err := validator.ValidateStamp(
-		stamp, testBits, testChannel, bodyHash,
-	)
-	if err != nil {
-		t.Fatalf("minted stamp failed validation: %v", err)
-	}
-}
--- a/internal/ratelimit/ratelimit.go
+++ b/internal/ratelimit/ratelimit.go
@@ -0,0 +1,122 @@
+// Package ratelimit provides per-IP rate limiting for HTTP endpoints.
+package ratelimit
+
+import (
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+const (
+	// DefaultRate is the default number of allowed requests per second.
+	DefaultRate = 1.0
+
+	// DefaultBurst is the default maximum burst size.
+	DefaultBurst = 5
+
+	// DefaultSweepInterval controls how often stale entries are pruned.
+	DefaultSweepInterval = 10 * time.Minute
+
+	// DefaultEntryTTL is how long an unused entry lives before eviction.
+	DefaultEntryTTL = 15 * time.Minute
+)
+
+// entry tracks a per-IP rate limiter and when it was last used.
+type entry struct {
+	limiter  *rate.Limiter
+	lastSeen time.Time
+}
+
+// Limiter manages per-key rate limiters with automatic cleanup
+// of stale entries.
+type Limiter struct {
+	mu       sync.Mutex
+	entries  map[string]*entry
+	rate     rate.Limit
+	burst    int
+	entryTTL time.Duration
+	stopCh   chan struct{}
+}
+
+// New creates a new per-key rate Limiter.
+// The ratePerSec parameter sets how many requests per second are
+// allowed per key.  The burst parameter sets the maximum number of
+// requests that can be made in a single burst.
+func New(ratePerSec float64, burst int) *Limiter {
+	limiter := &Limiter{
+		mu:       sync.Mutex{},
+		entries:  make(map[string]*entry),
+		rate:     rate.Limit(ratePerSec),
+		burst:    burst,
+		entryTTL: DefaultEntryTTL,
+		stopCh:   make(chan struct{}),
+	}
+
+	go limiter.sweepLoop()
+
+	return limiter
+}
+
+// Allow reports whether a request from the given key should be
+// allowed.  It consumes one token from the key's rate limiter.
+func (l *Limiter) Allow(key string) bool {
+	l.mu.Lock()
+	ent, exists := l.entries[key]
+
+	if !exists {
+		ent = &entry{
+			limiter:  rate.NewLimiter(l.rate, l.burst),
+			lastSeen: time.Now(),
+		}
+		l.entries[key] = ent
+	} else {
+		ent.lastSeen = time.Now()
+	}
+	l.mu.Unlock()
+
+	return ent.limiter.Allow()
+}
+
+// Stop terminates the background sweep goroutine.
+func (l *Limiter) Stop() {
+	close(l.stopCh)
+}
+
+// Len returns the number of tracked keys (for testing).
+func (l *Limiter) Len() int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	return len(l.entries)
+}
+
+// sweepLoop periodically removes entries that haven't been seen
+// within the TTL.
+func (l *Limiter) sweepLoop() {
+	ticker := time.NewTicker(DefaultSweepInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			l.sweep()
+		case <-l.stopCh:
+			return
+		}
+	}
+}
+
+// sweep removes stale entries.
+func (l *Limiter) sweep() {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	cutoff := time.Now().Add(-l.entryTTL)
+
+	for key, ent := range l.entries {
+		if ent.lastSeen.Before(cutoff) {
+			delete(l.entries, key)
+		}
+	}
+}
--- a/internal/ratelimit/ratelimit_test.go
+++ b/internal/ratelimit/ratelimit_test.go
@@ -0,0 +1,106 @@
+package ratelimit_test
+
+import (
+	"testing"
+
+	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
+)
+
+func TestNewCreatesLimiter(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(1.0, 5)
+	defer limiter.Stop()
+
+	if limiter == nil {
+		t.Fatal("expected non-nil limiter")
+	}
+}
+
+func TestAllowWithinBurst(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(1.0, 3)
+	defer limiter.Stop()
+
+	for i := range 3 {
+		if !limiter.Allow("192.168.1.1") {
+			t.Fatalf(
+				"request %d should be allowed within burst",
+				i+1,
+			)
+		}
+	}
+}
+
+func TestAllowExceedsBurst(t *testing.T) {
+	t.Parallel()
+
+	// Rate of 0 means no token replenishment, only burst.
+	limiter := ratelimit.New(0, 3)
+	defer limiter.Stop()
+
+	for range 3 {
+		limiter.Allow("10.0.0.1")
+	}
+
+	if limiter.Allow("10.0.0.1") {
+		t.Fatal("fourth request should be denied after burst exhausted")
+	}
+}
+
+func TestAllowSeparateKeys(t *testing.T) {
+	t.Parallel()
+
+	// Rate of 0, burst of 1 — only one request per key.
+	limiter := ratelimit.New(0, 1)
+	defer limiter.Stop()
+
+	if !limiter.Allow("10.0.0.1") {
+		t.Fatal("first request for key A should be allowed")
+	}
+
+	if !limiter.Allow("10.0.0.2") {
+		t.Fatal("first request for key B should be allowed")
+	}
+
+	if limiter.Allow("10.0.0.1") {
+		t.Fatal("second request for key A should be denied")
+	}
+
+	if limiter.Allow("10.0.0.2") {
+		t.Fatal("second request for key B should be denied")
+	}
+}
+
+func TestLenTracksKeys(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(1.0, 5)
+	defer limiter.Stop()
+
+	if limiter.Len() != 0 {
+		t.Fatalf("expected 0 entries, got %d", limiter.Len())
+	}
+
+	limiter.Allow("10.0.0.1")
+	limiter.Allow("10.0.0.2")
+
+	if limiter.Len() != 2 {
+		t.Fatalf("expected 2 entries, got %d", limiter.Len())
+	}
+
+	// Same key again should not increase count.
+	limiter.Allow("10.0.0.1")
+
+	if limiter.Len() != 2 {
+		t.Fatalf("expected 2 entries, got %d", limiter.Len())
+	}
+}
+
+func TestStopDoesNotPanic(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(1.0, 5)
+	limiter.Stop()
+}
--- a/pkg/irc/commands.go
+++ b/pkg/irc/commands.go
@@ -11,7 +11,6 @@ const (
 	CmdNames   = "NAMES"
 	CmdNick    = "NICK"
 	CmdNotice  = "NOTICE"
-	CmdOper    = "OPER"
 	CmdPart    = "PART"
 	CmdPing    = "PING"
 	CmdPong    = "PONG"
--- a/pkg/irc/numerics.go
+++ b/pkg/irc/numerics.go
@@ -132,7 +132,6 @@ const (
 	RplNoTopic         IRCMessageType = 331
 	RplTopic           IRCMessageType = 332
 	RplTopicWhoTime    IRCMessageType = 333
-	RplWhoisActually   IRCMessageType = 338
 	RplInviting        IRCMessageType = 341
 	RplSummoning       IRCMessageType = 342
 	RplInviteList      IRCMessageType = 346
@@ -296,7 +295,6 @@ var names = map[IRCMessageType]string{
 	RplNoTopic:         "RPL_NOTOPIC",
 	RplTopic:           "RPL_TOPIC",
 	RplTopicWhoTime:    "RPL_TOPICWHOTIME",
-	RplWhoisActually:   "RPL_WHOISACTUALLY",
 	RplInviting:        "RPL_INVITING",
 	RplSummoning:       "RPL_SUMMONING",
 	RplInviteList:      "RPL_INVITELIST",