Replace plain != string comparison with crypto/subtle.ConstantTimeCompare
for both operator name and password checks in handleOper to prevent
timing-based side-channel attacks.
Closes review feedback on PR #82.
- Add ip column to sessions table (real client IP of session creator)
- Add ip and hostname columns to clients table (per-connection tracking)
- Update CreateSession, RegisterUser, LoginUser to store new fields
- Add GetClientHostInfo query method
- Update SessionHostInfo to include IP
- Extract executeCreateSession to fix funlen lint
- Add tests for session IP, client IP/hostname, login client tracking
- Update README with new field documentation
- Add username and hostname columns to sessions table (001_initial.sql)
- Accept optional username field in session creation and registration
endpoints; defaults to nick if not provided
- Resolve hostname via reverse DNS of connecting client IP at session
creation time (supports X-Forwarded-For and X-Real-IP headers)
- Display real username and hostname in WHOIS (311 RPL_WHOISUSER) and
WHO (352 RPL_WHOREPLY) responses instead of nick/servername
- Add FormatHostmask helper for nick!user@host format
- Add SessionHostInfo type and GetSessionHostInfo query
- Include username/hostname in MemberInfo and ChannelMembers results
- Extract validateHashcash and resolveUsername helpers to stay under
funlen limits
- Add comprehensive unit tests for all new DB functions, hostmask
formatting, and integration tests for WHOIS/WHO responses
- Update README with hostmask documentation, new API fields, and
updated schema reference
